AI regulation around the world: EU, UK, US and beyond

AI regulation stopped being hypothetical when the EU AI Act’s obligations began phasing in and when UK regulators started naming foundation models in consumer guidance. The global picture is not one law — it is a stack of product safety, data protection, copyright, sector rules and export controls that happen to intersect where models meet users. Founders who treat “we are just a wrapper” as immunity get surprised at enterprise procurement and app store review.

This explainer maps the jurisdictions our readers most often ship into: the European Union, the United Kingdom, the United States, and the emerging patterns in Canada, Japan and Singapore. It is not legal advice. It is the briefing we wish every product team had before writing their first privacy policy footnote.

European Union: the AI Act as architecture

The EU AI Act classifies systems by risk. Unacceptable practices — social scoring by governments, certain manipulative techniques — are banned. High-risk uses, including some employment, credit and medical scenarios, face conformity assessments, logging, human oversight and CE marking-style documentation. General-purpose AI models have separate duties: technical documentation, copyright compliance, energy reporting for large models, and systemic risk mitigations for the most capable tier.

GP AI providers must publish training data summaries and honour opt-outs recognised under EU copyright law. Downstream deployers — startups fine-tuning or wrapping models — inherit transparency duties and must not disable safety features. Timelines stagger through 2027; prohibited practices and GPAI obligations are among the earliest. Enforcement sits with national market surveillance authorities coordinated via the EU AI Office.

United Kingdom: pro-innovation framing, real regulators

The UK did not transpose the AI Act. Instead it relies on sector regulators — FCA for finance, MHRA for medical devices, ICO for data protection — plus cross-cutting principles from the AI Safety Institute and DSIT guidance. The result is flexibility and fragmentation. A fintech chatbot answers to the FCA’s consumer duty; a recruitment screener faces Equality and Human Rights Commission scrutiny on bias.

Data protection remains the universal backstop. Automated decision-making with legal or similarly significant effects triggers Article 22 GDPR constraints — meaningful information, right to human intervention. UK GDPR post-Brexit mirrors this. If your AI denies a loan or flags a employee misconduct case, lawyers care about Article 22 even if “AI Act” never appears in your risk register.

“Regulation should be proportionate, adaptable and sector-aware — but ‘light touch’ is not ‘no touch’ when people's rights are affected.”

— UK Department for Science, Innovation and Technology, AI regulation white paper follow-up, gov.uk

United States: executive orders, states and litigation

Federal US AI policy remains a patchwork. Executive orders on AI safety require red-team reporting from the largest model trainers contracting with government. NIST’s AI Risk Management Framework is voluntary but influential in enterprise RFPs. The FTC treats deceptive AI claims and dark patterns as consumer protection issues — “AI washing” draws enforcement attention the way greenwashing did.

State law fills the vacuum. Colorado’s AI Act imposes impact assessments for high-risk decisions. California’s SB 1047-style debates continue in revised forms, focusing on frontier model developers. Illinois biometric rules affect facial analysis features. If you sell nationally in the US, you need a state matrix, not a single federal checklist.

Copyright, content and training data

Regulation is not only safety — it is rights. The EU AI Act’s copyright articles interact with the DSM Directive’s opt-out regime. The UK IPO continues consulting on text and data mining exceptions. US courts may settle fair use questions years before Congress acts. Products generating images or text for commercial use need provenance policies and, increasingly, customer indemnities documented in contracts.

See our separate analysis of AI art disputes for creator-facing detail. For product teams, the actionable point is: know your base model’s training claims and do not repeat marketing language in legal filings.

Sector overlays: health, finance and children

Healthcare AI in the UK requires MHRA clearance for medical devices — software that diagnoses or recommends treatment usually qualifies. NHS deployment adds DTAC, DCB0129 clinical safety and data access agreements. Finance faces FCA/PRA algorithm governance expectations; explainability for credit decisions is non-negotiable in EU and UK sales.

Children’s data triggers ICO’s Age Appropriate Design Code and EU GDPR children’s provisions. General chatbots marketed to kids face heightened scrutiny — COPPA in the US, UK AADC in Britain. Default-on profiling is a design choice regulators punish.

Rest of world: Canada, Japan, Singapore and China

Canada’s AIDA bill stalled and revived in pieces; provincial privacy laws still govern many deployments. Japan promotes agile guidelines with sector codes — lighter than EU but not permissive on personal data under APPI. Singapore’s Model AI Governance Framework remains a reference for ASEAN startups. China’s generative AI rules require registration, content labelling and adherence to socialist core values — relevant if you localise models for Chinese app stores.

Multinationals often standardise on EU AI Act conformity for global SKUs, then strip or add features per region — the same pattern used for GDPR cookie banners years ago.

What founders should do this quarter

Inventory AI use cases by risk tier. Document model providers, training claims and data flows. Assign a DPO or external counsel for Article 22 and DPIA triggers. Build human review into high-stakes outputs before regulators ask. Add AI-specific clauses to vendor contracts — subprocessors, retention, audit rights.

Compliance is continuous. The AI Act allows updates; UK regulators issue guidance without always waiting for Parliament. Track DSIT, EU AI Office publications and your sector’s rulemaker. The product velocity that ignored law in 2023 will not survive enterprise sales in 2026.