AI Regulatory Compliance: What Is Actually In Force Now

AI regulatory compliance is conformance with the binding laws that govern AI systems: how they are classified, what disclosures and human oversight they require, what data they may use, and what records you must keep. Collibra's 2026 guide draws the line that matters most for anyone budgeting the work: this is not the same as adopting a voluntary framework, because compliance is mandatory and non-compliance carries penalties.

Almost every guide on this subject summarises a rulebook. The problem, in August 2026, is that the rulebook moved three times this year. The European Union pushed its heaviest obligations back by more than a year. Colorado's landmark AI act was frozen by a federal court and then repealed by the state that wrote it. The United States federal government began litigating against state AI laws rather than replacing them. A summary of the rules is therefore not a plan.

What follows separates three things that get mixed together: what is legally in force today, what moved and why the extra time is not slack, and the small set of controls that survives whichever way the remaining fights land. The position below is current as of 18 August 2026 and it will change. Treat it as a map, and take the specifics to counsel.

What is in force today

This is the section most guides skip, because it is less exciting than the deadlines still ahead. It is also the only part that can generate a fine this quarter.

The European duties that already bite

The AI Act phases in, and three phases have already landed. Per dotlegal's guide to the regulation, the eight prohibited practices under Article 5 have applied since 2 February 2025 and carry the heaviest fines in the entire Act. So has Article 4, which is short, easy to miss, and applies to nearly everyone: providers and deployers must ensure a sufficient level of AI literacy among staff and anyone operating AI on their behalf, across all risk tiers. If all your organisation does is let people use a commercial chatbot, that one still lands on you.

The third phase is the general purpose AI regime, applicable since 2 August 2025. Baseline duties for model providers include technical documentation, information for downstream providers, a copyright policy and a public summary of training content. A model is treated as carrying systemic risk once the compute used to train it exceeds 10^25 floating point operations, which adds evaluation, adversarial testing and incident reporting obligations.

Everything else flows from classification into four tiers: unacceptable and therefore prohibited, high risk, limited risk carrying transparency duties, and minimal risk, which is the vast majority of AI and carries no mandatory obligations at all. Classification follows how a system is used, not how advanced it is. That single sentence resolves more anxiety than any checklist.

The American laws that are actually operative

Here the abstraction about a patchwork is worse than useless, because the patchwork is smaller and more specific than it sounds. The AI Policy Desk state tracker counted seven state level AI laws in force as of 30 June 2026. Texas passed the Responsible Artificial Intelligence Governance Act, in force since 1 January 2026, which prohibits intentional AI discrimination and bans social scoring, and which only the attorney general can enforce. New York City's bias audit rule for automated employment tools has been live since 2023. Utah's AI Policy Act since 2024. Connecticut's broader SB 5 begins a staggered start on 1 October 2026.

California is its own cluster. Cooley's April 2026 review records that AB 2013 took effect on 1 January 2026, requiring developers to publish a high level summary of the datasets used to build a generative AI system, with almost no implementation guidance on format or depth. The AI transparency law SB 942 had its effective date moved to 2 August 2026 by AB 853, which also layered on duties for large online platforms from 1 January 2027 and for capture device manufacturers from 1 January 2028.

None of this is a European style ex ante programme. It is disclosure, notice and record keeping, which matters for how you build.

What moved, and why later is not slack

Two changes account for most of the confusion in the market right now.

The first is the Digital Omnibus. Docker's compliance walkthrough dates the European Parliament's approval to 16 June 2026 and records what it did: standalone high risk systems under Annex III moved from August 2026 to 2 December 2027, and high risk AI embedded in regulated products under Annex I moved to 2 August 2028. The same source puts the Article 50 transparency duties, covering chatbot disclosure and the machine readable marking of synthetic content, at 2 August 2026, with a four month grace period to 2 December 2026 for systems already on the market before that date. Read those together and the shape of the year becomes clear. The obligations that were delayed are the documentation heavy ones. The obligations that arrived on schedule are the ones your users can see.

The second change is what the delay actually buys. Regulation AI's compliance checklist puts a realistic figure on a single standalone high risk programme: 12 to 24 months, broken into three to six months of gap assessment and quality management system design, six to twelve months of technical documentation, data governance and conformity assessment, and three to six months for database registration and CE marking. It also flags the constraint nobody controls, which is notified body capacity tightening as December 2027 approaches. Subtract 24 months from that date and the honest conclusion is that a programme starting in late 2026 is on time, not early.

The American fight over who regulates at all

The defining feature of United States AI policy in mid 2026 is not a statute. It is an open contest over who has the authority to write one.

The executive order of 11 December 2025 is the document to read rather than the commentary about it. It directs the Attorney General to stand up an AI Litigation Task Force whose sole responsibility is challenging state AI laws, instructs the Secretary of Commerce to publish an evaluation identifying onerous state laws, tells the Federal Communications Commission to consider a federal reporting and disclosure standard that would preempt conflicting state rules, and asks the Federal Trade Commission to explain when state laws requiring alterations to truthful model outputs are preempted. It also names three categories it does not propose to preempt: child safety, compute and data centre infrastructure, and a state government's own procurement and use of AI.

King and Spalding's analysis adds the machinery: the Commerce evaluation and the FTC policy statement were both due by 11 March 2026, and the order reaches for leverage beyond litigation by conditioning certain broadband funds and discretionary grants on states declining to pass conflicting rules.

Colorado is the case study. Its SB 24-205 would have been the first comprehensive state AI law in the country. AI Risk Aware's account records that a federal magistrate stayed its enforcement on 27 April 2026 while the Department of Justice joined a constitutional challenge to the statute, and that on 14 May 2026 the governor signed SB 26-189, replacing it with a narrower automated decision making regime effective 1 January 2027. Consumer notice and appeal rights survived. The risk programme architecture did not.

The planning lesson from that sequence is unglamorous. A law can die, and the thing that killed Colorado's was a court and a legislature, not an executive order. Until a court enjoins a specific statute, state law remains fully enforceable, and expecting future preemption is not a compliance defence. This is also where the vocabulary matters, because governance and regulation are not the same job and only one of them waits for a legislature.

The controls that survive either outcome

Here is the useful pattern, and it is the reason this article is not a rulebook summary. Across the surviving and incoming American rules, legislatures have been converging on a thin core: tell people when an automated system materially shapes a consequential decision about them, explain it, give them a route to a human, and keep the records that prove all three. That convergence is the practical good news, because one well built control set covers most of the map, and because it overlaps heavily with what the European Act demands of deployers anyway.

Build in this order.

Inventory, because every regime assumes you have one. No classification, notice or evidence obligation can be met before you know which systems exist, including the AI buried inside software you already license. Reuse your existing records of processing to seed it.

Classify once and map to many. Assign each system a risk tier and map that one assessment onto each regime that applies. Watch the exemption trap: a system that only performs a narrow procedural task can fall outside the high risk tier, but profiling of natural persons always counts as high risk with no exemption, and relying on the exemption still means documenting the assessment and registering the system.

Turn deployer duties into operations. The Commission's own text of Article 26 on deployer obligations is more concrete than most secondary guides. Deployers must use systems in line with the instructions for use, assign human oversight to people with the necessary competence, training and authority, ensure input data under their control is relevant and sufficiently representative, monitor operation and suspend use when a risk appears, and keep the automatically generated logs for at least six months. Employers must inform workers' representatives and the affected workers before a high risk system is put to work on them. Almost all of that is a staffing and process decision rather than an engineering one.

Push the obligation into your contracts. Most organisations are deployers buying from providers, and the European Commission's implementation guidance is explicit that a provider and a third party supplying components must specify by written agreement the information, capabilities and technical access needed for the provider to comply. The same guidance defines when a change becomes a substantial modification that reopens conformity assessment: a change not foreseen in the initial assessment that affects compliance or alters the intended purpose. Performance and safety improvements that do neither are not substantial modifications. Get both points into the vendor agreement before you need them.

What getting it wrong costs

The European penalty structure is tiered, and Foley and Lardner's July 2026 briefing sets it against a familiar benchmark. Violating a prohibited practice draws up to 35 million euro or 7 percent of global annual turnover, whichever is higher. Other high risk violations reach 15 million euro or 3 percent. Both ceilings sit above the GDPR's already significant 4 percent, and on a business with 10 billion euro of revenue a single prohibited practice violation could reach 700 million euro.

The same briefing is useful on the rest of the world, where the requirements genuinely conflict rather than merely differ. China imposes algorithm registration and content labelling. The United Kingdom has stayed with a lighter sector by sector approach and no comprehensive statute. American enforcement runs through existing powers, principally the Federal Trade Commission and state attorneys general, rather than a dedicated AI regulator. No single compliance approach satisfies every regime at once, which is why the standard advice is to build to the most demanding one you are exposed to and treat ISO/IEC 42001 and the NIST AI Risk Management Framework as scaffolding rather than as shelter. They are voluntary. They do not discharge a statutory duty.

Where the rules and the operators meet

Most of this article describes rules being written by people who will never operate the systems, for people who had no seat when they were written. Closing that gap is a format problem more than a policy one.

The EX Future Summit programme runs a Government track on exactly this ground, alongside an AI Ethics track and eight hosted sessions that put university research teams in front of private partners. It runs from 18 to 20 November 2026 as a single continuous thirty hour broadcast moving between Las Palmas in the Canary Islands and Bali, twelve hours apart, so participants can join from any timezone, and online attendance is free for verified researchers, students and the EX community.

The more interesting development is what happens when a jurisdiction gives compliance somewhere to be tested. Bali Province's digital residency sandbox opens a cohort at the summit, granting a ninety day residency, a policy pilot lane and access to municipal data. That is a small example of a large idea, which is that rules improve faster where the distance between a rule and its consequence is short. There are structural reasons islands make unusually good regulatory sandboxes, and the same logic sits behind what sovereign AI actually means for a state that will never train a frontier model but still has to govern one.

None of which settles the underlying argument about whether AI should be regulated at all. It does suggest the argument is better held in a room containing both sides of it.

FAQ

Does the EU AI Act apply to a company based outside the EU?

Yes, in the circumstances the Act specifies. It reaches any organisation that places an AI system on the EU market, deployers established in the EU, and cases where the output of an AI system is used in the EU, regardless of where the organisation is headquartered. Location of incorporation is not the test.

Do the rules apply if we only use AI internally?

Partly, and more than teams expect. Putting a system into service covers internal deployment that affects people, such as HR decisions, employee monitoring or internal credit assessment. A system used purely for backend technical computation with no human facing output may fall outside scope, but that conclusion needs documented legal analysis rather than an assumption. The AI literacy duty applies to all providers and deployers regardless of scope.

What is the difference between a provider and a deployer?

A provider develops an AI system and places it on the market under its own name. A deployer uses that system under its own authority in a professional activity. A bank buying an AI credit scoring tool is the deployer and the vendor is the provider. Providers carry the primary conformity burden; deployers carry oversight, monitoring and transparency duties. One organisation can hold both roles at once, and modifying or rebranding a system you bought can flip you into the provider role.

Is there a comprehensive federal AI law in the United States?

No. There is no single comprehensive federal AI statute. Federal posture is being set through executive action, agency proceedings and litigation, with a legislative recommendation for a preemptive national framework. As of the most recent state law review in June 2026, no litigation task force suit had been filed against a state AI law and no federal statute had passed Congress.

Does an ISO/IEC 42001 certificate make us compliant?

No. ISO/IEC 42001 is an international management system standard and the NIST framework is a voluntary risk methodology. Both are genuinely useful for structuring a programme that spans jurisdictions, and mapping their controls to a binding regime lets one control set serve several obligations. Neither removes the obligation to comply with each jurisdiction's specific law, and neither is a defence to a statutory breach.