2.3 AI-specific laws: the EU AI Act & the US landscape

AI-specific law arrives: the EU AI Act and the US landscape

A new generation of statutes now targets AI directly. The AIGP exam gives the most weight to the EU AI Act—the world's first comprehensive AI law—and expects working familiarity with the fragmented US approach.

The EU AI Act's risk-based tiers

The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and regulates AI by risk tier: the greater the risk to health, safety, or fundamental rights, the stricter the obligations.

Prohibited practices (Article 5) form the hard floor. High-risk systems carry the heaviest load—a full quality-management and conformity-assessment regime before and after they reach the market. Limited-risk systems trigger only transparency: users must be told they are interacting with AI, and AI-generated or manipulated content (deepfakes) must be labeled as such. Minimal-risk AI, the vast majority of systems, faces no new duties.

The Act adds a distinct layer for general-purpose AI (GPAI)—foundation models. All GPAI providers must keep technical documentation, publish a summary of training content, and adopt a policy to respect EU copyright, including TDM opt-outs. GPAI models posing systemic risk—presumed when training compute exceeds 10^25 FLOPs—face extra duties: model evaluation and adversarial testing, systemic-risk assessment and mitigation, serious-incident reporting, and cybersecurity protection.

Obligations phase in over time, a favorite exam detail:

• 1 Aug 2024 — the Act enters into force.
• 2 Feb 2025 — prohibitions and the AI-literacy duty (Article 4) apply.
• 2 Aug 2025 — GPAI rules, the governance and enforcement bodies, and penalty provisions apply.
• 2 Aug 2026 — most high-risk obligations under Annex III apply.
• 2 Aug 2027 — high-risk obligations for AI embedded in regulated products (Annex I) apply.

Penalties are severe: up to EUR 35 million or 7% of global annual turnover for prohibited-practice violations, with lower caps for other breaches and for supplying misleading information. The Act also reaches beyond Europe—it covers providers and deployers outside the EU where the AI system's output is used within it.

The US landscape: executive action, NIST, and state laws

The US has no comprehensive federal AI statute. Federal policy runs largely through executive orders, which swing with administrations. President Biden's EO 14110 (October 2023) directed agencies to address AI safety, security, and civil rights. In January 2025 the Trump administration revoked it and issued a new order, Removing Barriers to American Leadership in Artificial Intelligence, favoring deregulation and innovation, followed by an AI Action Plan. The exam takeaway: US federal direction is policy, not durable legislation, and it can reverse.

NIST plays a pivotal but non-regulatory role. Its AI Risk Management Framework (AI RMF 1.0, January 2023) is a voluntary framework organized around four functions—Govern, Map, Measure, and Manage—and is widely adopted as a de facto standard even though NIST cannot enforce it. On the EU side, enforcement is layered: a new AI Office within the European Commission supervises general-purpose AI, while designated national competent authorities in each member state police high-risk systems—a structure worth contrasting with the single-agency models candidates may expect.

Because Congress has not acted, states have moved into the gap:

• Colorado AI Act (SB 24-205) — the first comprehensive US state AI law. It imposes a duty of reasonable care on developers and deployers of "high-risk" systems used in consequential decisions to protect consumers from algorithmic discrimination, with disclosure and impact-assessment obligations. Its effective date was pushed from February 2026 to 30 June 2026.
• NYC Local Law 144 — since July 2023, an employer using an automated employment decision tool (AEDT) must commission an independent annual bias audit, publish a summary of the results, and notify candidates in advance.
• Other measures include Illinois BIPA and its 2026 Human Rights Act amendments on AI in employment, Utah's AI Policy Act, Texas's Responsible AI Governance Act, and California transparency laws—an expanding, uneven patchwork.

The strategic contrast the exam wants you to draw is stark: the EU offers a single, comprehensive, risk-based regime with hard deadlines and very large fines, while the US relies on shifting executive orders, voluntary NIST guidance, and a growing quilt of sectoral and state laws. A global organization must therefore design its AI governance to the strictest applicable standard—often the EU AI Act—while continuously tracking fast-moving US state requirements.