Laws and Regulations

Governance becomes real when it carries the force of law. A company can ignore a think-tank's recommendation. It cannot ignore a regulatory fine, a court injunction, or the withdrawal of its operating license. Law is governance with teeth — and the question of how to apply legal instruments to AI systems is one of the most technically and politically contested areas in public policy today.

Risk-Based Regulation: The EU AI Act

The most architecturally significant AI-specific law enacted so far is the European Union's AI Act, which completed its legislative process in 2024 and began phased application in 2025. The EU AI Act adopts a risk-based architecture: the regulatory requirements imposed on a system are proportional to the risk it poses to fundamental rights, health, safety, or democratic processes. The Act defines four risk tiers. Unacceptable-risk systems are banned outright — including AI used for social scoring by public authorities, real-time remote biometric identification in public spaces by law enforcement (with narrow exceptions), systems that exploit subconscious vulnerabilities to manipulate behavior, and AI that infers emotions in workplace or education settings. High-risk systems — covering AI used in critical infrastructure, education, employment, essential services, law enforcement, migration, administration of justice, and democratic processes — must meet a set of mandatory requirements before deployment: training data quality standards, technical documentation, logging sufficient for post-incident audit, transparency to users, human oversight mechanisms, and robustness and accuracy standards. These systems must be registered in a public EU database. Limited-risk systems — such as chatbots — must disclose to users that they are interacting with an AI. Minimal-risk systems — such as spam filters and AI in video games — face no mandatory requirements. The EU AI Act also places special obligations on providers of general-purpose AI models (GPAIs), including large language models released for use by third parties. Providers of GPAIs with systemic risk (above a threshold of training computation) must additionally perform adversarial testing, report serious incidents to the European AI Office, and ensure cybersecurity protections.

US Sectoral Regulation and Executive Action

The United States has not enacted a comprehensive federal AI statute as of 2025. Instead, existing sectoral regulators have begun applying their existing statutory authority to AI: The Federal Trade Commission has authority over unfair and deceptive trade practices. It has taken action against companies making false claims about AI capabilities and issued guidance on AI-generated endorsements and synthetic media in advertising. The Equal Employment Opportunity Commission has issued guidance clarifying that Title VII's prohibition on employment discrimination applies when an employer uses an AI hiring tool that produces disparate impact on protected groups — the employer cannot escape liability by blaming the algorithm. The Consumer Financial Protection Bureau has clarified that the Fair Credit Reporting Act's adverse-action notice requirements (which require lenders to explain credit denials) apply when the decision was made by an AI model, and that 'the algorithm decided' is not a legally sufficient explanation. The Food and Drug Administration has an established pathway for AI-based medical devices and software as a medical device (SaMD), requiring evidence of safety and effectiveness proportionate to risk. This sectoral approach has the advantage of applying domain expertise — financial regulators understand finance, medical regulators understand medicine — but it leaves significant gaps in domains with no applicable existing law, and creates inconsistency across sectors.

A fundamental legal challenge across all jurisdictions is liability: when an AI system causes harm, who is legally responsible? Traditional product liability law, which holds manufacturers responsible for defective products, fits AI imperfectly. Software is often classified as a service rather than a product, creating a doctrinal gap. AI systems learn from data and change over time, so the 'product' at deployment may differ significantly from the product when the harm occurs. AI systems make probabilistic decisions — they sometimes produce wrong outputs even when operating normally — which challenges the concept of 'defect.' The EU AI Liability Directive (proposed alongside the AI Act) attempts to address this by creating a rebuttable presumption of causation when a high-risk AI system causes harm and the provider has violated the AI Act's requirements — shifting the burden of proof from victim to developer. This is a significant departure from traditional liability rules. Another approach emerging in some jurisdictions is algorithmic accountability: statutory rights for individuals to be informed when an AI system has made a significant decision about them, to receive a meaningful explanation of the basis for that decision, and to contest it before a human reviewer.