AI Regulation Compared: How the EU, US and the Rest of the World Are Writing the Rules
A comparison of the EU AI Act's risk-tiered model, the US's sectoral approach, and international coordination efforts, and why the same AI model can face very different obligations depending on where it is deployed.
Two starting premises, two very different laws
The European Union and the United States began from opposite premises when they set out to govern artificial intelligence, and that single difference explains most of what follows. The EU treats AI as a product safety problem: a new category of technology that, like pharmaceuticals or medical devices, should be classified by risk before it reaches the market and subjected to conformity assessment proportionate to that risk. The AI Act, which entered into force in 2024 with obligations phasing in through 2026 and beyond, sorts AI systems into four tiers — unacceptable risk (banned outright, covering things like social scoring by governments and certain forms of biometric categorisation), high risk (subject to detailed pre-market obligations), limited risk (transparency duties, such as disclosing that a chatbot is a machine), and minimal risk (largely unregulated). A system used for CV-screening or credit-scoring lands in the high-risk tier not because of what algorithm it runs but because of what decision it makes about a person's access to opportunity.
The United States, by contrast, has no single AI statute. Its approach is sectoral and enforcement-led: existing agencies apply existing law to AI-enabled conduct within their jurisdiction. The Federal Trade Commission polices deceptive or unfair AI claims under its general consumer-protection authority. The Equal Employment Opportunity Commission has said that an employer using an AI hiring tool remains liable for disparate-impact discrimination exactly as if a human recruiter had made the same biased calls. Colorado and Illinois have passed their own AI-specific statutes covering high-risk employment and insurance decisions, while a 2023 executive order (later modified by subsequent administrations) directed federal agencies to develop AI risk-management guidance for their own domains. The result is a patchwork where the binding rule on a given AI system depends on which regulator, which state, and which use case you land in, rather than a single classification that travels with the model itself.
Why the same model gets regulated differently
This divergence matters concretely for anyone building or deploying a model that operates across borders, because the AI Act regulates based on the system's intended purpose and deployment context, not its underlying architecture. A large language model fine-tuned for general customer support might fall into the AI Act's limited-risk or even minimal-risk category. The identical base model, fine-tuned and deployed to triage insurance claims or screen loan applications, jumps to high-risk status and triggers a cascade of obligations: a risk-management system, high-quality training data governance, technical documentation, human oversight design, robustness and accuracy testing, and registration in an EU database before the product can be placed on the market. The obligation attaches to the use case, not to the neural network weights, which is precisely why the same foundation model provider can ship one product that needs a CE-marking-style conformity process in the EU and, when repurposed for a benign use, needs almost nothing.
In the US, the equivalent product faces a different kind of variability: not a formal risk tier but a patchwork of applicable law that depends on jurisdiction and sector. A hiring tool sold nationally might need to comply with New York City's Local Law 144 (mandatory bias audits for automated employment decision tools) if used by employers in that city, Illinois's AI Video Interview Act if used for video interviews there, and general EEOC guidance everywhere — three overlapping but non-identical compliance regimes for a single product, none of which requires pre-market registration the way the EU Act does. This is the practical meaning of "the same model gets regulated differently": geography and use case jointly determine the compliance burden, and a genuinely global AI product needs a compliance architecture that can answer, for any given deployment, which rulebook applies.
General-purpose AI and the foundation model problem
Both regimes have had to grapple with a problem neither anticipated when drafting began: general-purpose foundation models that get deployed downstream in ways their original developers cannot fully predict or control. The EU AI Act addresses this with a separate tier for general-purpose AI (GPAI) models, imposing baseline transparency obligations (technical documentation, a summary of training data, copyright compliance) on all GPAI providers, and a heavier layer of obligations — model evaluation, adversarial testing, incident reporting, cybersecurity safeguards — on models deemed to carry "systemic risk," a threshold currently defined by a compute-based proxy (models trained using more than 10^25 floating point operations are presumed systemic). This puts the compliance burden partly on the upstream developer (OpenAI, Google, Anthropic, Meta) rather than solely on the downstream deployer, an acknowledgement that a hospital fine-tuning a foundation model for triage cannot meaningfully audit training data it never saw.
The US has no legal equivalent, but the 2023 executive order used the Defense Production Act to require companies training the largest frontier models to report safety test results to the government, a much lighter and more discretionary mechanism than the EU's tiered disclosure regime, and one whose durability across administrations has proven far less stable than statute. The gap illustrates a genuine and unresolved policy question rather than a simple EU-strict/US-lax story: should the entity that trains a general-purpose model bear responsibility for downstream misuse it cannot foresee, or should responsibility sit entirely with whoever deploys it for a specific purpose? The EU has answered with shared, tiered responsibility; the US has largely left the question to downstream sectoral regulators and civil litigation.
International coordination and its limits
Beneath the EU-US contrast sits a slower, quieter effort at coordination. The G7's Hiroshima AI Process produced a voluntary code of conduct for advanced AI developers in 2023, the UK convened the first global AI Safety Summit at Bletchley Park that same year producing a declaration signed by 28 countries including the US, EU and China, and the OECD's AI Principles (first published in 2019, updated since) provide a common vocabulary — transparency, accountability, robustness — that both the AI Act and US agency guidance explicitly draw on. The Council of Europe's Framework Convention on AI, opened for signature in 2024, is the first legally binding international treaty on AI, though it deliberately leaves implementation detail to domestic law, which is exactly where the EU/US divergence re-enters.
What these efforts have achieved is convergence on definitions and risk taxonomy — most jurisdictions now talk about "high-risk" AI, transparency, and human oversight using recognisably similar language — without convergence on enforcement mechanism or legal form. That gap is unlikely to close soon, because it reflects a genuine difference in regulatory philosophy: the EU's precautionary, pre-market-clearance tradition versus the US's ex-post, litigation-and-enforcement tradition, the same split visible in how the two jurisdictions have long regulated chemicals, data privacy and financial products. A company operating globally should expect this to persist and plan for a compliance layer that maps deployments to jurisdictions, not a single global AI policy that satisfies every regulator at once.
Frequently Asked Questions
Does the EU AI Act apply to companies outside the EU?
Yes. Like the GDPR, the AI Act has extraterritorial reach: it applies to any provider placing an AI system on the EU market or whose system's output is used within the EU, regardless of where the provider is established.
Is there a US federal AI law equivalent to the AI Act?
No single comprehensive federal AI statute exists. US AI governance currently runs through existing sectoral regulators (FTC, EEOC, financial regulators), state laws such as those in Colorado and Illinois, and executive-branch guidance that can be revised or rescinded by a new administration.
What counts as "high-risk" under the EU AI Act?
The Act lists specific use categories in its annexes, including AI used in employment, education, credit and insurance, law enforcement, migration, critical infrastructure, and essential private and public services. The classification depends on the application's purpose, not the model architecture.
How do developers know if their foundation model is a "systemic risk" GPAI model under the Act?
The Act uses a compute threshold (currently 10^25 FLOPs used in training) as a rebuttable presumption of systemic risk, alongside a discretionary designation power the European Commission can exercise for models it judges to pose comparable risk regardless of compute.