AI Regulation

AI regulation is not one global approach but three genuinely different legal strategies developing in parallel, and the differences aren't cosmetic — the EU, the US, and China each built their frameworks around a different underlying question: what level of risk justifies restriction, which sectors already have regulators to lean on, and how much the state wants direct control over what AI systems can say. A company deploying one model across all three jurisdictions is, in practice, complying with three structurally different regulatory philosophies at once, not one law with regional variations.

The EU built a single, horizontal law that classifies AI systems by risk tier before anything else. The EU AI Act (2024) sorts AI applications into tiers — unacceptable risk (banned outright, such as social scoring), high risk (subject to conformity assessment, documentation, and human oversight requirements), limited risk (transparency obligations, like disclosing that a user is talking to a chatbot), and minimal risk (largely unregulated) — and every obligation a system faces flows from which tier it lands in, determined by its use case rather than by which industry happens to be deploying it. This horizontal, risk-tiered structure is a deliberate choice: rather than writing separate rules for AI in healthcare, AI in hiring, and AI in finance, the EU wrote one framework that applies the same risk logic across every sector, with sector-specific detail layered on only where the general framework needs it.

Three different regulatory architectures, not one law with variations EU one horizontal law risk-tiered unacceptable / high / limited / minimal risk same risk logic applies across every sector conformity assessment, documentation, oversight comprehensive, enacted as a single statute United States sectoral patchwork existing regulators, not a new law FTC, FDA, EEOC each apply existing authority to AI no single comprehensive federal AI statute state-level laws fill gaps unevenly (e.g. Colorado, Illinois) federal approach has shifted across administrations China targeted, content-focused algorithm-specific rules algorithm registration since 2022 Generative AI Measures (effective Aug 2023) security assessment + content alignment requirements narrower, faster-moving rules rather than one statute Same underlying technology, three structurally different compliance obligations.

The US built its approach on existing sector regulators rather than writing new, AI-specific law. Rather than a single comprehensive federal AI statute, US AI policy has largely proceeded through agencies applying their existing authority to AI-specific cases — the FTC addressing deceptive AI claims under its existing consumer protection mandate, the EEOC addressing AI-driven hiring discrimination under existing employment law, the FDA evaluating AI-based medical devices under its existing device approval framework. Biden's Executive Order 14110 (October 2023) was the most significant binding federal action to date, directing agencies to develop AI safety guidance and establishing reporting requirements for the largest frontier model developers, but it operated through existing executive authority rather than new congressional legislation, and federal AI policy direction has shifted across administrations in a way a single comprehensive statute would be more resistant to. Individual states have moved faster than the federal government on specific issues — Colorado's AI Act and Illinois's biometric privacy law are commonly cited examples — producing a genuinely uneven compliance landscape where obligations can differ significantly by state.

Deploying an AI system
which jurisdictions does it touch?
EU: what risk tier does the use case fall into?
Unacceptable → banned
High-risk → conformity assessment, documentation, oversight
Limited/minimal → lighter transparency duties or none
US: which existing regulator's domain does this touch?
Consumer protection, employment, health, finance
each sector's existing regulator applies its own existing rules to the AI use case
Plus whatever the deployment state requires
state law varies significantly
China: does it require algorithm registration or content review?
Generative AI and recommendation algorithms
security assessment and registration obligations apply

The "Brussels Effect" is why the EU's law matters globally even though it's legally binding in only one jurisdiction. The term, coined to describe the earlier pattern with GDPR, describes how a sufficiently large, sufficiently strict regulatory market can become the de facto global standard — a company serving EU customers has to build compliant systems anyway, and it's often cheaper to build one compliant system for a global product than to maintain a separate, non-compliant version just for non-EU markets. The EU AI Act is expected to produce the same effect: companies with no EU-specific obligations at all may still build toward EU AI Act requirements by default, simply because building two separate versions of the same system costs more than building one version to the stricter standard.

Read AI regulation as three different bets about where the real risk in AI systems lives and who's best positioned to catch it: the EU bet on a comprehensive, risk-classified law applied uniformly across sectors; the US bet on existing sector expertise being more adaptable than a new statute, at the cost of federal consistency; and China bet on direct, fast-moving control over specific algorithmic categories rather than one broad framework — and a system built to satisfy all three isn't complying with one law in three places, it's satisfying three genuinely different theories of what needs to be regulated and why.

Take ai regulation further

Ask the copilot about this term, or have our engineers assess it against your process.

Ask CFSGPT about this → Request a technical assessment → Open the CFS app