What are our obligations under emerging AI regulations?

There is no single global AI regulation. Instead, compliance teams face a patchwork of binding regulations, voluntary frameworks, sector-specific rules, and emerging legislation that varies by jurisdiction, industry, and use case. The challenge is not understanding any single rule. It is maintaining a current map of which rules apply to your organization and what they actually require.

The EU AI Act is the most comprehensive binding framework currently in force. It applies to any organization that places AI systems on the EU market or affects EU residents, regardless of where the organization is headquartered. Compliance deadlines are phased. Prohibitions and the AI literacy duty have applied since February 2025, and obligations for general-purpose AI (GPAI) models since August 2025. Regulation (EU) 2026/1744 later moved the high-risk obligations to 2 December 2027 for stand-alone Annex III systems, and 2 August 2028 for systems embedded in regulated products.

At the federal level, Executive Order 14110 on Safe, Secure, and Trustworthy AI directed agencies to develop sector-specific guidance. EO 14148 revoked it on 20 January 2025, though some agency guidance it started may still apply. The FTC has issued guidance on AI in advertising and consumer-facing products. The SEC has signaled that AI-related disclosures in public filings are subject to existing material disclosure requirements. Equal Employment Opportunity Commission (EEOC) guidance addresses AI use in employment decisions under Title VII.

In financial services, banking regulators have issued model risk management guidance that applies to AI models used in credit decisions. Healthcare organizations must navigate HIPAA obligations when AI systems process protected health information. The Fair Credit Reporting Act (FCRA) applies to AI used in credit, employment, housing, and insurance decisions and requires adverse action notices when AI influences a denial.

Colorado's SB 26-189 replaces the repealed 2024 AI Act from 1 January 2027. Deployers of automated decision-making technology must give notice, explain adverse outcomes, and offer human review. Illinois and New York City have enacted specific rules on AI use in employment decisions. California has several AI-related bills in various stages of passage.

For organizations operating across multiple U.S. states, the practical approach is to identify the most stringent applicable requirements and build to that standard. Complying with Colorado's SB 26-189 and the EU AI Act will put you in a strong position relative to most other jurisdictions, even if it exceeds what is strictly required locally.

Regulatory monitoring should be a continuous process, not an annual review. Assign someone responsibility for tracking AI regulatory developments in your key jurisdictions. Subscribe to regulatory agency feeds, use a directory like this one to track changes, and build relationships with outside counsel who specialize in AI law.

Map each regulation to the AI systems in your inventory. For each system, document which regulations apply, what they require, your current compliance status, and the timeline for any gaps to be remediated. This mapping becomes the foundation of your AI compliance program.