How Is AI Regulated Around the World? Laws, Pledges and Safety Rules Explained

Why it matters now

In a single week in November 2026, Australia said it would force the companies building the most powerful AI models to report incidents and allow outside testing, with a new regulator to enforce it. A day earlier, six governments and ten AI developers signed a joint declaration in Paris promising shared tests and early warnings for the most powerful models. Neither the United States nor China signed it.

That pattern is typical. AI is built by a handful of global companies but used everywhere, and every country is deciding for itself how much to control it. If you use AI at work, build products with it or simply wonder who is responsible when it goes wrong, the answer now depends on where you live.

How it works, step by step

Think of AI rules like rules for vehicles. Some rules are about the vehicle itself (brakes must work). Some are about how you use it (no driving through a school at 60 miles an hour). Some are about labelling (a learner driver shows an L plate). And some are informal, like a promise between neighbours to keep the street safe. AI regulation uses all four.

Step 1: Sort AI by risk

The European Union’s AI Act is the most complete AI law so far. It entered into force on 1 August 2024 and does not treat all AI the same. Instead it sorts uses into four levels of risk, according to the European Commission:

• Unacceptable risk: banned outright. Since 2 February 2025 the EU has banned a list of practices it considers a clear threat to people’s safety or rights. In 2026 lawmakers added a ban on AI systems that generate non-consensual sexual images of real people or child sexual abuse material, due to apply from December 2026.
• High risk: allowed, but only with strict checks before it reaches the market. These are uses that can seriously affect someone’s health, safety or rights.
• Transparency risk: systems such as chatbots must tell you that you are talking to a machine, and AI-generated content must be labelled.
• Minimal or no risk: most AI, such as spam filters, has no specific rules.

The idea is like food safety: a sandwich shop and a baby-formula factory both make food, but only one gets inspected weekly.

Step 2: Watch the most powerful models

A newer layer of rules targets the biggest general-purpose models, often called frontier models. These are the models that can do many tasks and might, in the worst case, help with cyber attacks or weapons.

The EU’s obligations for general-purpose AI models started on 2 August 2025. California’s Transparency in Frontier Artificial Intelligence Act (SB 53), signed on 29 September 2025, applies to developers that train models with more than 10²⁶ computing operations. The largest of them, those with annual revenue above $500 million, must publish a framework explaining how they manage catastrophic risks, and every covered developer must report critical safety incidents to the state.

Australia’s plan, announced on 10 November 2026, goes in the same direction: six mandatory obligations, including independent evaluation of models and rapid incident reporting, enforced by a new regulator. The government has not yet given penalty amounts or a timetable.

Step 3: Label what AI makes

As AI pictures, voices and videos get harder to tell from real ones, governments are asking for labels. China’s measures on labelling AI-generated content, issued by four agencies including the Cyberspace Administration of China, took effect on 1 September 2025. Providers must add a visible label to generated text, audio, images, video and virtual scenes, and a hidden label in the file’s metadata. The EU AI Act has its own labelling duty, now due from 2 December 2026 for providers that need time to build it in.

Labels are related to watermarking, which hides a signal inside the content itself.

Step 4: Argue about who is in charge

In the United States there is no single federal AI law. States such as California have passed their own. On 11 December 2025 the President signed an executive order, “Ensuring a National Policy Framework for Artificial Intelligence”, which set up a task force to challenge state AI laws the administration considers inconsistent with national policy and asked for a proposal for one federal framework that would override conflicting state rules. So the US debate is as much about who writes the rules as about what they say.

Step 5: Make promises when laws are slow

Laws take years. Pledges can be signed in a day. The Paris declaration of 9 November 2026 commits signatories to a common way of testing frontier models for misuse in cyber attacks and chemical, biological, radiological and nuclear weapons, and for loss of control. Developers promise to disclose capabilities and risks and to build ways to shut down model operations they control. It is voluntary, and some of the biggest developers did not sign. Pledges like this often become the first draft of later laws.

A worked example: one chatbot, three countries

Imagine a company launches a chatbot that can also make images.

• In the EU, it must tell users they are talking to an AI, and label the images it makes. If the company also lets employers use it to screen job applicants, that use can count as high risk and needs extra checks, although the EU has delayed the start of most high-risk rules to 2 December 2027 (or 2 August 2028 for AI built into products such as machines).
• In China, every image needs a visible AI label and a hidden metadata label.
• In California, if the model behind the chatbot is a frontier model trained above the computing threshold, its developer must publish a transparency report before release and report critical safety incidents.

Same product, three different checklists. This is why large AI companies employ teams just to track rules.

What people get wrong

“AI is unregulated.” It is not. Beyond AI-specific laws, existing rules on privacy, consumer protection, discrimination and copyright still apply to AI products.

“The EU AI Act bans AI.” It bans a short list of uses. Most AI has no specific obligations under it.

“A voluntary pledge means nothing.” It is not enforceable, but it puts specific promises on the record, which journalists, researchers and future regulators can check against.

“Rules only matter to big tech.” A small business using an AI hiring tool in Europe, or a creator posting AI images in China, is affected too.

Where it is heading

The timeline keeps moving. In June 2026 the Council of the EU gave final approval to a simplification package that pushed back the high-risk rules to December 2027 and August 2028, shortened the grace period for labelling AI content and postponed national AI regulatory sandboxes (test zones for new products) to August 2027. Australia says the details of its frontier rules will follow “in due course”. In the US, the fight between federal and state rules is ongoing.

The clearest trend is a shared focus on the most powerful models: outside testing, published safety frameworks and fast incident reporting now appear in California’s law, the EU’s rules, Australia’s plan and the Paris declaration alike.

Key terms

• Frontier model
• Alignment
• Red teaming
• Watermarking
• Deepfake
• Open weights (more in Open Weights vs Closed Models)

Sources

• European Commission, AI Act policy page (entry into force, risk levels, application dates). digital-strategy.ec.europa.eu
• Council of the EU, “Artificial Intelligence: Council gives final green light to simplify and streamline rules”, 29 June 2026. consilium.europa.eu
• Office of the Governor of California, SB 53 signing, 29 September 2025. gov.ca.gov
• Future of Privacy Forum, “California’s SB 53: The First Frontier AI Law, Explained” (thresholds and obligations). fpf.org
• Cyberspace Administration of China, Q&A on the Measures for Labelling AI-Generated and Synthetic Content, 14 March 2025. cac.gov.cn
• The White House, Executive Order 14365, “Ensuring a National Policy Framework for Artificial Intelligence”, 11 December 2025. whitehouse.gov
• Prime Minister of Australia, “New Australian AI safety and security protections”, 10 November 2026. pm.gov.au
• Joint Declaration on the Paris Call for AI Safety and Security, released by the Prime Minister’s Office of Canada, 9 November 2026. newswire.ca