The regulatory landscape

AI regulation is a patchwork — and moving fast. This module gives you a map of the main regimes and a strategy for dealing with all of them.

2.1 The EU AI Act

The EU AI Act is the world's first comprehensive, horizontal AI law. It takes a risk-based approach — prohibited practices, high-risk systems with strict requirements, transparency duties and rules for general-purpose AI models — and applies to organisations outside the EU whose AI is placed on the EU market or whose outputs are used in the EU. The Digital Omnibus on AI (Regulation (EU) 2026/1744) moved the high-risk deadlines to December 2027 (stand-alone systems) and August 2028 (AI in regulated products).

2.2 The United Kingdom

The UK has taken a principles-based, regulator-led approach rather than a single AI law. Its 2023 white paper set five cross-sector principles — safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; contestability and redress — for existing regulators to apply in their sectors. In practice that means:

• ICO — data protection, including AI guidance and automated decision-making rules (updated by the Data (Use and Access) Act 2025)
• FCA and PRA — financial services, including model risk management and consumer duty
• CMA — competition and consumer protection, including foundation model markets
• MHRA — AI as a medical device
• Equality and Human Rights Commission — equality law
• Ofcom — online safety, including AI-generated content on platforms

The government's AI Security Institute evaluates advanced AI models, and the AI Cyber Security Code of Practice (January 2025) sets baseline security principles. UK policy continues to evolve, so check for current developments.

2.3 The United States

The US has no comprehensive federal AI law. Instead: existing laws enforced by agencies (consumer protection, civil rights, employment, financial regulation); federal policy that has shifted between administrations, including the 2025 AI Action Plan; and a growing number of state laws on topics such as automated decision-making, AI in hiring, deepfakes and frontier model safety. The NIST AI Risk Management Framework is a widely used voluntary standard (Module 3).

2.4 Elsewhere

• China has specific rules for recommendation algorithms, deep synthesis (deepfakes), generative AI services (2023) and labelling of AI-generated content (2025).
• Canada, Singapore, Japan, South Korea, Brazil and others have laws, frameworks or voluntary codes at different stages.
• International: the OECD AI Principles, the Council of Europe Framework Convention on AI (the first international AI treaty, opened for signature in 2024), and the G7 Hiroshima process code of conduct for advanced AI.

2.5 Laws that already apply to AI

Whatever AI-specific rules exist, existing law already applies:

2.6 A strategy for a multi-jurisdiction world

Most organisations can't build a separate programme for every jurisdiction. A common strategy: build one governance programme on an international standard (ISO/IEC 42001) and framework (NIST AI RMF), map it to the strictest applicable law (often the EU AI Act), and add local requirements as needed.

Key takeaways

• The EU AI Act is risk-based with extraterritorial reach; high-risk deadlines are December 2027 and August 2028.
• The UK applies five principles through existing regulators.
• The US relies on existing law, voluntary frameworks and state laws.
• Data protection, equality, consumer and IP law already apply to AI.
• Build one programme on international standards, mapped to the strictest applicable law.