There is no single global rulebook for artificial intelligence. Governments are taking different approaches that reflect their legal traditions, economic priorities and political systems. For any company deploying AI internationally, understanding these differences is now part of doing business.

The European Union: comprehensive, risk-based law

The EU chose a single horizontal law, the AI Act, covering AI across sectors with obligations scaled to risk, plus specific rules for general-purpose models. It sits alongside existing EU laws such as the GDPR for personal data, the Digital Services Act and product safety rules. See our EU AI Act explainer.

The United States: sectoral rules and shifting federal policy

The US has no comprehensive federal AI law. Instead:

  • Existing agencies apply existing laws — consumer protection, anti-discrimination, financial and health regulation — to AI.
  • Federal policy has been shaped largely by executive actions, which have changed between administrations, alongside national AI strategies focused on innovation, infrastructure and competitiveness.
  • Standards: the National Institute of Standards and Technology (NIST) published the voluntary AI Risk Management Framework in 2023, widely used as a reference.
  • States have passed their own laws on topics such as deepfakes in elections, AI in hiring, automated decision-making and frontier model safety, creating a patchwork that companies must track.

China: targeted rules and state oversight

China has issued a series of specific regulations: rules on algorithmic recommendation (2022), “deep synthesis” content such as deepfakes (2023), and interim measures for generative AI services (2023). Requirements include security assessments, algorithm registration with authorities, labelling of AI-generated content and content controls aligned with state policy.

The United Kingdom: principles through existing regulators

The UK has favored a “pro-innovation” approach: rather than a single AI law, existing regulators apply cross-cutting principles — safety, transparency, fairness, accountability and contestability — in their sectors. The UK also created a government institute to evaluate advanced AI models, now named the AI Security Institute.

Other notable approaches

  • Canada, Brazil, South Korea, Japan and others have adopted or debated AI laws or frameworks, ranging from comprehensive statutes to soft-law guidelines.
  • International frameworks: the OECD AI Principles (2019, updated 2024), UNESCO’s Recommendation on the Ethics of AI (2021), the G7 Hiroshima process and the Council of Europe’s Framework Convention on AI, the first binding international treaty on AI.

Common themes

Despite differences, most frameworks share themes: transparency about AI use, risk management, human oversight in high-stakes decisions, protection against discrimination, and accountability for harms.

What companies should do

  1. Map where AI is used in your products and operations.
  2. Identify applicable rules by market and sector.
  3. Adopt a recognized risk framework such as NIST’s AI RMF or ISO/IEC 42001 as a common baseline.
  4. Document data, models, testing and oversight — documentation is required almost everywhere.
  5. Monitor changes — the landscape is moving fast.

How businesses can keep up

Map where you operate and sell, identify which AI uses fall into high-risk categories in each jurisdiction, assign an owner for regulatory monitoring, and build compliance documentation that can be reused across regimes.

Related: sovereign AI.

What to watch next

  • Implementation and possible adjustments of the EU AI Act timelines.
  • Federal versus state tensions in US AI policy.
  • New national AI laws in Asia and Latin America.
  • Ratifications of the Council of Europe AI convention.

Key takeaways

  • The EU regulates AI with a single risk-based law; the US relies on sectoral rules, executive policy and state laws.
  • China uses targeted regulations with security assessments, registration and labelling.
  • The UK applies principles through existing regulators and evaluates frontier models through a dedicated institute.
  • International frameworks from the OECD, UNESCO, G7 and Council of Europe set shared principles.
  • Transparency, risk management, oversight and accountability are common to nearly all approaches.

Frequently asked questions

Which AI law is the strictest?

The EU AI Act is the most comprehensive horizontal law, while China’s targeted rules impose strict requirements on specific services such as generative AI.

Is the NIST AI RMF mandatory?

No. It is a voluntary framework, though it is widely referenced and can be required through contracts or specific policies.

How can a small company keep up?

Focus on the markets you serve, adopt one recognized framework as a baseline, document your AI uses and follow updates from trusted policy trackers.