Societal Implications › Regulatory Approaches

Governments around the world recognized relatively quickly that language AI required regulatory attention. The regulatory response has been heterogeneous, with different jurisdictions taking quite different approaches reflecting different values, institutional structures, and risk assessments.

The core challenge for regulators is that AI capabilities are evolving faster than the regulatory process. A framework carefully designed for 2023-era AI capabilities may be inadequate or poorly fitted for 2026-era capabilities. Regulation that was appropriately targeted at a specific risk may fail to cover new failure modes that emerge as models become more capable. This creates a difficult governance dilemma: moving too fast produces poorly designed rules that may create compliance costs without addressing real harms; moving too slowly allows harmful deployments that better governance could prevent.

The EU has taken the broadest regulatory approach to AI with the AI Act, which entered into force in 2024. The Act uses a risk-tiered framework that classifies AI systems by their risk level and applies proportionally stringent requirements.

The framework defines four risk tiers:

• Unacceptable risk: AI systems that pose unacceptable risks are banned outright. This includes social scoring systems, real-time biometric surveillance in public spaces (with narrow exceptions), and systems that exploit psychological vulnerabilities. These applications were deemed incompatible with EU fundamental rights regardless of their benefits.
• High risk: AI systems in high-stakes domains including critical infrastructure, education, employment, essential services, law enforcement, and democratic processes face substantial requirements. They must undergo conformity assessments, maintain detailed documentation, implement human oversight mechanisms, and register in a public database.
• Limited risk: AI systems like chatbots or emotion recognition systems face lighter transparency requirements. Users must be informed they are interacting with AI.
• Minimal risk: The vast majority of AI applications, including spam filters and AI-enabled video games, face no specific requirements.

Foundation models and large language models receive special treatment in the Act. General-purpose AI models must comply with transparency requirements including publishing technical documentation and complying with EU copyright law. Very large models, above a computational training threshold, face additional requirements including adversarial testing, incident reporting, and cybersecurity measures.

The EU approach reflects a view that fundamental rights and democratic values should constrain AI deployment even when this imposes costs on innovation. The Act has generated substantial criticism from industry arguing that compliance costs will impede European AI development and push development to less regulated jurisdictions. It has also generated criticism from civil society arguing that it does not go far enough, particularly in restricting surveillance uses.

One tension in the EU approach is between the scope of the framework and the pace of AI development. The risk tier classifications were designed with specific use cases in mind, but the multipurpose nature of general AI systems creates classification difficulties. A large language model integrated into a hiring tool sits in the high-risk tier; the same model used for general business correspondence sits outside it. Whether the classification follows the model or the application matters enormously for compliance, and the answers are not always clear.

The US has taken a more fragmented, sector-specific approach without broad federal AI legislation as of 2025. Instead, existing regulatory bodies are applying existing legal frameworks to AI.

The Federal Trade Commission has issued guidance on AI under its existing authority to address unfair and deceptive practices, warning that companies cannot use AI to engage in deceptive marketing, discriminatory lending, or manipulation. The Equal Employment Opportunity Commission has issued guidance on employer obligations when using AI in hiring decisions. The Consumer Financial Protection Bureau has emphasized that existing fair lending laws apply to AI-based credit decisions.

The Biden administration issued a wide-ranging Executive Order on AI in October 2023 that established requirements for federal agencies, directed the development of safety standards, and tasked agencies with evaluating AI's impact in their sectors. The Trump administration rescinded this executive order in January 2025, signaling a shift toward a more permissive approach that prioritized AI development over preemptive regulation.

The US approach has the advantage of flexibility: different sectors can develop domain-appropriate standards with the expertise of the relevant regulatory body. The disadvantage is inconsistency and gaps. Without federal legislation that covers AI across sectors, there are AI applications that fall between jurisdictional cracks, and state-by-state variation creates compliance challenges for national deployments.

Several US states have enacted their own AI legislation, particularly around algorithmic accountability, biometric data use, and AI in employment decisions. Colorado, California, and Illinois have some of the most extensive state-level requirements. This creates a patchwork regulatory environment where compliance obligations depend on where users are located. For companies operating nationally, compliance with the most stringent state requirements effectively sets the standard, but this is an inefficient approach to national governance.

The US approach also reflects a long-standing American preference for light-touch technology regulation, often justified by arguments about not stifling innovation. This preference has served the technology sector well in some respects, allowing rapid development of internet platforms, but it has also allowed harms to accumulate before regulatory responses developed. The debate about whether AI governance should break from this pattern is ongoing.

China has implemented AI regulation through a series of more targeted regulations focused on specific application domains. The Provisions on the Management of Generative AI Services, issued in 2023, require providers of generative AI to register with the government, ensure content complies with existing content regulations (including political restrictions), implement mechanisms to prevent generation of prohibited content, and protect user data.

China's regulatory approach emphasizes state control over content and prioritizes social stability. AI systems must not generate content that undermines state authority or social harmony. This creates quite different deployment constraints than the EU or US frameworks, which are more focused on discrimination, transparency, and safety.

China has also moved aggressively on AI development through national industrial policy, which blurs the line between regulation and industrial promotion in ways that have no clear Western equivalent. The government simultaneously funds domestic AI development, creates standards that favor domestic products, and regulates foreign AI providers. Understanding China's AI governance requires treating industrial policy and regulation as parts of a single integrated strategy rather than separate domains.

One of the significant challenges in AI governance is that AI systems are developed and deployed globally, while regulation occurs at national levels. A model trained in the US, deployed by a European company, and used by customers in multiple countries simultaneously implicates multiple regulatory frameworks.

The UK launched the AI Safety Institute following the Bletchley Park AI Safety Summit in November 2023, positioning itself as a potential hub for international AI safety coordination. The US established a parallel AI Safety Institute. These institutes focus on evaluating frontier AI capabilities and developing shared evaluation methodologies, though their authority over deployment decisions is limited.

The OECD has established AI principles that form a baseline for international coordination, and the Global Partnership on AI provides a forum for cross-border collaboration. These mechanisms facilitate information sharing and standard development but lack enforcement mechanisms.

International coordination on AI is structurally difficult for reasons that go beyond the usual challenges of international governance. AI capability is increasingly treated as a national security asset, creating tensions between the transparency needed for coordination and the secrecy preferred for strategic advantage. The US export controls on advanced AI chips designed to limit Chinese AI development capacity represent an explicit decision to prioritize strategic competition over cooperation, which complicates any cooperative framework for safety governance. Managing this tension between competitive and cooperative imperatives is one of the fundamental challenges of international AI governance.

The regulatory pattern that emerges from this comparison is fragmented. No two major jurisdictions have adopted the same basic approach, and the differences reflect real disagreements about values, not just different paths to the same destination. Whether this diversity is a feature, allowing experimentation with different approaches and learning from comparative experience, or a bug, creating opportunities for regulatory arbitrage and inconsistent protection, remains contested. The empirical answer may depend on how long the divergence persists: short-term divergence that facilitates learning may be beneficial; long-term divergence that prevents global standards may not be.

Beyond broad frameworks, sector regulators in various jurisdictions have been active.

Healthcare AI regulation is advancing rapidly. The US FDA has approved hundreds of AI/ML-enabled medical devices and is developing new frameworks for AI-based clinical decision support tools. The EU MDR applies to AI diagnostic tools, requiring clinical validation. The challenge is that regulatory frameworks designed for static software do not map cleanly onto continuously learning AI systems that may change behavior after deployment. An AI diagnostic tool that was validated at deployment may behave differently six months later if it has continued learning from new data. Regulatory frameworks are still developing ways to handle this kind of post-deployment adaptation.

Financial services AI operates under existing financial regulation, including fair lending, anti-discrimination requirements, and model risk management requirements that predate the current AI moment but apply to AI systems. US banking regulators have issued guidance on model risk management that covers AI and machine learning, requiring explainability and bias testing for models used in consequential decisions. The financial sector is unusual in that it already had relatively well-developed model governance practices before the current AI wave, giving a foundation for AI governance that many other sectors lack.

Hiring AI regulation has advanced at the state and local level. New York City Local Law 144, which took effect in 2023, requires automated employment decision tools to undergo bias audits and requires employers to notify candidates when such tools are used. Illinois, California, and Maryland have enacted similar transparency requirements. These requirements are significant because hiring is one of the clearest cases where AI deployment has the potential to systematically encode historical discrimination at scale and speed.

Content moderation and disinformation is an area of particular regulatory attention given language AI's capacity to generate persuasive text at scale. The EU Digital Services Act requires large platforms to conduct risk assessments for AI-enabled content moderation. Several jurisdictions have enacted or are considering rules on AI-generated political advertising, requiring disclosure when AI is used to create political content.