AI Policy
AI policy is the body of laws, regulations, standards, funding decisions, and government practices that shape how artificial intelligence is developed, deployed, bought, and overseen. It is an umbrella term spanning binding rules (such as product-safety-style regulation), soft law (principles and voluntary frameworks), technical standards, public procurement conditions, industrial and research strategy, and trade measures such as export controls. Different jurisdictions weight these tools differently, so AI policy is better understood as an evolving set of overlapping instruments than as a single rulebook.
Binding regulation is exemplified by the European Union's AI Act, Regulation (EU) 2024/1689, which entered into force on 1 August 2024 and applies in stages. It takes a risk-based approach: a small set of practices are prohibited outright, high-risk systems (for example in employment, credit, education, and critical infrastructure) face requirements for risk management, data governance, documentation, human oversight, and conformity assessment, certain systems carry transparency duties such as disclosing that a user is talking to a machine, and most other uses are left largely unregulated. A separate chapter covers general-purpose AI models, with extra obligations for those presumed to pose systemic risk (see compute governance). Other jurisdictions have taken different paths: China has issued targeted rules on recommendation algorithms, deepfakes, and, effective August 2023, interim measures for generative AI services; the United States has relied on a mix of sector regulators, existing law, executive action, and state legislation such as Colorado's 2024 AI act, rather than one comprehensive federal statute.
Executive action in the United States shows how quickly policy can change. Executive Order 14110, on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence, was signed in October 2023 and directed agencies to develop standards, required reporting from developers of the largest models under the Defense Production Act, and addressed topics from civil rights to biosecurity. It was rescinded in January 2025 by the incoming administration, which redirected federal policy toward reducing regulatory barriers. The episode illustrates a general feature: executive orders can be reversed without legislation, whereas statutes such as the EU AI Act persist unless amended, and the practical result for companies operating across borders is uneven and shifting compliance duties.
Soft law and voluntary frameworks supply shared vocabulary and often precede regulation. The OECD AI Principles, adopted in May 2019 and updated in 2024, were the first intergovernmental standard on AI, covering inclusive growth, human-centred values, transparency, robustness, and accountability, and they informed later national approaches and G20 and G7 statements. The NIST AI Risk Management Framework 1.0, released in January 2023, is a voluntary US framework organized around four functions, Govern, Map, Measure, and Manage, and was followed by a generative AI profile in 2024. International summitry, from the Bletchley Park AI Safety Summit in November 2023 to the G7 Hiroshima Process, and the Council of Europe's Framework Convention on AI opened for signature in 2024, add further layers without replacing national law.
Standards and procurement translate principles into practice. The ISO/IEC 42001 standard (2023) specifies an AI management system that organizations can be audited against, and European standardization bodies are developing harmonized standards intended to give a presumption of conformity with the AI Act. Governments are also large buyers, and procurement conditions on testing, transparency, data handling, and vendor accountability can shape the market faster than regulation; this connects directly to vendor lock-in and build-versus-buy decisions in the public sector. Both approaches rely on measurement, and evaluation science remains immature for some risks, which limits how precisely rules can be written.
Common misconceptions and pitfalls are worth naming. One is that AI is unregulated: existing law on discrimination, consumer protection, privacy (for example the GDPR), copyright, product liability, and employment already applies to AI systems. Another is that a single framework gives compliance everywhere; organizations typically need a governance program that maps several regimes at once. A third is treating policy as only restriction: industrial and research policy, covered under national AI strategy, funds and promotes AI as well. Finally, rules written for one technology generation, such as fixed compute thresholds, can age quickly, which is why many regimes include review and update mechanisms.
Read AI policy as a layered, changing mix of laws, voluntary frameworks, standards, and state purchasing power, in which the layers differ by country and date rather than forming one settled rulebook.