AI Law and Regulation

China's AI regulation is a set of binding administrative measures, national standards and statute amendments, issued mainly by the Cyberspace Administration of China (CAC) with other ministries, that regulate specific AI applications (recommendation algorithms, deep synthesis, generative AI services, and labelling of AI-generated content). As of 2026-10-18 China has no single comprehensive AI statute in the sources reviewed; comprehensive AI legislation appears in official 2026 legislative plans but no draft was found.

China regulates AI through a layered, application-specific approach and has acted earlier than other jurisdictions on generative AI services. Its regime combines content-control obligations tied to state policy with technical-governance measures (algorithm filing, security assessments, content labelling). The approach contrasts with the EU's horizontal risk-tier statute (GOV-EU-001) and the US reliance on executive action (GOV-US-001). Whether the regime is "stricter" or "lighter" depends on the dimension compared; it is more restrictive on content and more permissive of state-directed industrial promotion.

• Algorithm recommendation provisions. CAC Order No. 9 (jointly with MIIT, Ministry of Public Security and the State Administration for Market Regulation), dated 31 December 2021 and effective 1 March 2022 (CAC, 2021). Article 24 requires providers of services with "public opinion attributes or social mobilisation capacity" to file with the algorithm filing system within ten working days of starting service.
• Deep synthesis provisions. Joint order of the CAC, the Ministry of Industry and Information Technology and the Ministry of Public Security, issued 25 November 2022 (Order No. 12) and effective 10 January 2023, as published on the CAC site (CAC, 2022). Article 9 requires real-identity verification of users of deep synthesis services and management of deep synthesis content.
• Interim Measures for the Management of Generative AI Services. CAC Order No. 15, issued 10 July 2023 by the CAC jointly with the NDRC, Ministry of Education, Ministry of Science and Technology, MIIT, Ministry of Public Security and the National Radio and Television Administration; effective 15 August 2023 (CAC, 2023).
• Measures for Labelling AI-Generated and Synthetic Content. Jointly issued by the CAC, MIIT, Ministry of Public Security and the National Radio and Television Administration, effective 1 September 2025. A CAC statement reproduced by Xinhua on 14 March 2025 says a mandatory national standard, Cybersecurity technology: Method for labelling AI-generated and synthetic content, approved by the State Administration for Market Regulation and the Standardization Administration (2025 No. 3), takes effect on the same day (Xinhua, 2025). The standard number GB 45438-2025 comes from secondary law-firm summaries and was not seen in an official page [VERIFICATION NEEDED: standard number and CAC order number on the CAC original].
• Cybersecurity Law amendment. Decision adopted by the NPC Standing Committee on 28 October 2025 (18th session of the 14th Standing Committee), effective 1 January 2026 (Xinhua, 2025b). The text of the Decision, as reproduced by a security-industry site citing the NPC website, adds a new Article 20 under which the state supports basic AI research and key technologies such as algorithms, training-data and compute infrastructure, improves AI ethics norms, and strengthens risk monitoring and safety supervision; Xinhua describes the revision as focused on strengthening legal liability and raising penalties for some violations [VERIFICATION NEEDED: the npc.gov.cn page itself was not opened; article wording taken from a reproduction].
• Legislative planning. Xinhua reported on 11 May 2026 that the State Council General Office issued the State Council 2026 Legislative Work Plan, which "deploys" faster work on comprehensive legislation for the healthy development of AI (Xinhua, 2026). Media reports of the NPC Standing Committee's 2026 plan, published the same day, say it lists AI-related legislation as a preliminary-review item, to be researched and drafted "by the relevant parties" and scheduled "as appropriate" [VERIFICATION NEEDED: NPC plan text not read first-hand]. The Standing Committee work report to the NPC (March 2026, reproduced by Xinhua) says the committee will "strengthen research on legislation in fields such as artificial intelligence". No draft AI law was found in sources reviewed.

Generative AI Interim Measures (Chinese text read at CAC).

• Scope (Article 2): services using generative AI to provide text, image, audio or video content to the public within the PRC; organisations that develop or apply the technology without offering the service to the domestic public are outside scope.
• Content (Article 4): providers must comply with law and social ethics, must not generate content prohibited by law, and must take measures against discrimination, respect intellectual property and personal rights, and improve transparency and reliability.
• Training data (Article 7): data and base models from lawful sources, respect for intellectual property, consent or another legal basis for personal information, and efforts to improve data quality.
• Filing and security assessment (Article 17): services with "public opinion attributes or social mobilisation capacity" must undergo a security assessment and complete algorithm filing.
• Effective date: 15 August 2023.

Labelling. The 2025 measures distinguish explicit labels perceivable by users from implicit labels embedded in file data (such as metadata). A companion mandatory national standard sets implementation methods. According to Xinhua's account of the Measures, explicit labels are text, sound or graphics perceivable by users, and implicit labels (for example in file metadata) carry attributes such as the content's generated status and the provider's name or code.

Compute thresholds. The sources reviewed contain no FLOP-based regulatory threshold in these measures.

Related law not covered in depth: the Data Security Law and the Personal Information Protection Law, which the Interim Measures expressly require providers to observe.

Providers of public-facing generative models operating in mainland China must comply with the filing and labelling requirements; the CAC publishes lists of registered services, whose size is a fast-changing figure and is not reproduced here [VERIFICATION NEEDED: no count obtained from a CAC page]. Article 20 of the Interim Measures provides that for generative AI services originating outside the PRC and offered domestically in breach of the rules, the national cyberspace authority shall notify relevant bodies to take technical and other necessary measures; whether and how this has been applied was not checked.

• Reported strengths: early, concrete obligations (labelling, filing), supervisory capacity.
• Limitations and criticisms: content obligations are tied to state-policy requirements, which are criticised as constraining expression; regulatory scope relies on administrative discretion; enforcement data are not systematically public in sources reviewed.
• Unresolved: whether a comprehensive AI law will be adopted, at what level (NPC statute versus State Council regulation), and with what relation to the "interim" measures.

As of 2026-10-18 the instruments listed in section 5 are the operative regime among those reviewed; the list may not be exhaustive of all CAC and sectoral AI-related rules. No instrument among them was found revoked or replaced in the searches run. The Interim Measures remain titled interim. A draft comprehensive AI law has not, in sources reviewed, been published. Comparative claims about enforcement intensity are Preliminary.

Observed: sustained use of targeted measures and amendment of existing statutes. The State Council 2026 legislative plan mentions comprehensive AI legislation but, in the reports read, gives no date for a draft or adoption. No forecast is registered. See TIME-001 for updates.

• Foundational Concepts:
  • GOV-LAW-001 Global AI Governance & Regulation
• Comparative regimes:
  • GOV-EU-001 The EU AI Act
  • GOV-US-001 United States AI Policy
• Related:
  • GOV-INTL-001 International AI Governance and Compute Governance: China's role in multilateral processes.
  • GOV-EXPORT-001 Export Controls and AI Geopolitics: the external pressure on China's compute supply.

The EU AI Act is Regulation (EU) 2024/1689 of the European Parliament and of the Council, a directly applicable European Union regulation that lays down harmonised rules for placing on the market, putting into service and using artificial intelligence systems and for placing general-purpose AI models on the market. It combines product-safety-style obligations that scale with risk, a short list of prohibited practices, transparency duties, and a separate regime for general-purpose AI (GPAI) models.

The Act is the first comprehensive horizontal statute on AI adopted by a major jurisdiction. Under Article 2(1) it applies to providers placing AI systems on the market or putting them into service, or placing general-purpose AI models on the market, in the Union irrespective of where they are established; to deployers established or located in the Union; and to providers and deployers in third countries where the output produced by the AI system is used in the Union. It sets a reference point for other jurisdictions, whose approaches differ (see GOV-US-001 and GOV-CN-001). It is in force and, as of 2026-10-18, applies in most respects other than the high-risk obligations, which have been postponed by an amending regulation adopted in 2026 (section 3).

The European Commission proposed the Act on 21 April 2021 (COM(2021) 206 final; European Commission, 2021). The regulation is dated 13 June 2024 and was published in the Official Journal on 12 July 2024 as Regulation (EU) 2024/1689 (European Parliament & Council, 2024). Under Article 113 it entered into force on the twentieth day after publication (1 August 2024) and applies in stages.

Original staging (Article 113 as adopted): prohibitions and general provisions from 2 February 2025; GPAI obligations (Chapter V), governance (Chapter VII) and most penalty provisions (Chapter XII, with the exception of Article 101) from 2 August 2025; the Regulation as a whole from 2 August 2026; Article 6(1) and the corresponding obligations (Annex I product-embedded high-risk rules) from 2 August 2027 (Article 113, Official Journal text read 2026-10-18). The Commission's AI policy page confirms the February 2025, August 2025 and August 2026 dates as having taken effect (European Commission, 2026).

2026 amendment ("Digital Omnibus on AI"). The Commission adopted its simplification proposal on 19 November 2025; according to the Commission's AI policy page, a political agreement was reached on 7 May 2026 and the amending act entered into force on 27 July 2026 (European Commission, 2026). The amending act is Regulation (EU) 2026/1744, OJ L of 24 July 2026, amending Regulations (EU) 2024/1689, 2018/1139 and 2023/1230; it was signed at Strasbourg on 8 July 2026 and, under its Article 4, entered into force on the third day after publication (27 July 2026). The provisions below marked as checked were read in the Official Journal text on EUR-Lex (2026-10-15 and 2026-10-18):

• Annex III stand-alone high-risk obligations delayed from 2 August 2026 to 2 December 2027 (Art. 113(c)(i) as amended; checked).
• Annex I product-embedded high-risk obligations delayed from 2 August 2027 to 2 August 2028 (Art. 113(c)(ii) as amended; checked).
• A new prohibition on AI systems generating non-consensual intimate imagery and child sexual abuse material, applying from 2 December 2026 (Art. 5(1), points (ba) and (bb), and Art. 5(1a) and (1b), per the amended Art. 113(a); checked).
• Article 50 transparency duties remain applicable from 2 August 2026, with a grace period to 2 December 2026 for providers whose generative systems were placed on the market before 2 August 2026 to comply with Article 50(2) marking (checked).
• Article 4 (AI literacy) is replaced. The original text required providers and deployers to "take measures to ensure, to their best extent, a sufficient level of AI literacy" of their staff; the amended text requires them to "take measures to support the development of AI literacy" and adds that the obligation "does not require providers or deployers to guarantee any specific level of AI literacy of any individual" (checked in both texts).
• Amended Article 75(1) makes the AI Office exclusively competent for supervision and enforcement in relation to AI systems based on GPAI models where the model and the system are developed by the same provider or by providers in the same undertaking, and to AI systems that constitute or are integrated into a designated very large online platform or search engine, with listed exceptions (including Annex I product-related systems, Annex III point 2 and certain law-enforcement, border and financial-institution systems; checked in the amending text).
• Stated rationale: recital (2) of the amending act cites "the delayed preparation of standards" and "the delayed establishment of the governance and the conformity assessment frameworks at national level" as having produced a compliance burden "heavier than expected" (checked).

Scope definitions. The Act regulates "AI systems" (machine-based systems that infer from inputs how to generate outputs such as predictions, content, recommendations or decisions) and, separately, "general-purpose AI models".

Risk tiers.

1. Prohibited practices (Article 5), applicable since 2 February 2025 (the original eight points, Art. 5(1)(a) to (h)): for example manipulative or deceptive techniques and exploitation of vulnerabilities causing significant harm, social scoring, risk assessment of offending based solely on profiling, untargeted scraping of facial images from the internet or CCTV to build facial recognition databases, emotion inference in workplaces and education (with medical or safety exceptions), certain biometric categorisation, and, unless strictly necessary for one of three listed objectives, real-time remote biometric identification in publicly accessible spaces for law enforcement. The Commission counts nine prohibited practices after the omnibus addition (section 3).
2. High-risk systems (Article 6, Annexes I and III). Annex III lists use areas such as biometrics, critical infrastructure, education, employment, access to essential services, law enforcement, migration and administration of justice. Obligations (Articles 9 to 15, 17, 43 and 72) include a risk-management system, data governance, technical documentation, record-keeping, transparency to deployers, human oversight, accuracy, robustness and cybersecurity, a quality management system, conformity assessment and post-market monitoring.
3. Transparency duties (Article 50): informing people that they are interacting with an AI system (Art. 50(1)), marking synthetic audio, image, video or text outputs in a machine-readable format (Art. 50(2)), informing people exposed to emotion recognition or biometric categorisation (Art. 50(3)), and disclosing deepfakes (Art. 50(4)).
4. Minimal risk: no specific obligations.

General-purpose AI models (Chapter V). Under Article 53(1), GPAI providers must maintain technical documentation (Annex XI), provide information to downstream providers (Annex XII), put in place a copyright-compliance policy, and publish a sufficiently detailed training-content summary using the AI Office template; the documentation duties in points (a) and (b) do not apply to models under a free and open-source licence with publicly available parameters, except where the model has systemic risk (Art. 53(2)). A GPAI model is classified as having systemic risk if it has high-impact capabilities or is so designated by a Commission decision (Art. 51(1)); it is presumed to have high-impact capabilities when the cumulative computation used for its training, measured in floating-point operations, is greater than $10^{25}$ (Art. 51(2)). The Commission may amend the thresholds by delegated act (Art. 51(3)). Systemic-risk providers face extra duties (Article 55(1)) on model evaluation including adversarial testing, assessing and mitigating systemic risks, reporting serious incidents to the AI Office, and cybersecurity protection. The threshold is a presumption, not a measure of danger; see ECON-COMP-001 for the compute accounting underlying it.

Penalties. Article 99 sets administrative-fine maxima of EUR 35 million or, for an undertaking, 7% of total worldwide annual turnover of the preceding financial year (whichever is higher) for breaches of the Article 5 prohibitions (Art. 99(3)); EUR 15 million or 3% (whichever is higher) for listed operator obligations including those of providers (Art. 16), deployers (Art. 26) and the Article 50 transparency duties (Art. 99(4)); and EUR 7.5 million or 1% (whichever is higher) for incorrect, incomplete or misleading information to notified bodies or national competent authorities (Art. 99(5)). For SMEs, including start-ups, each fine is up to the percentage or amount, whichever is lower (Art. 99(6)). Article 101 allows the Commission to fine GPAI providers up to 3% of annual worldwide turnover or EUR 15 million, whichever is higher, where it finds intentional or negligent infringement. Article 113(b) excepts Article 101 from the 2 August 2025 date, so it applies from the general date of 2 August 2026, consistent with the Commission's statement that the AI Office can issue fines from 2 August 2026.

• Actors: providers, deployers, importers, distributors, authorised representatives.
• Governance: the AI Office within the Commission (Art. 64), which supervises GPAI models and, under Article 75(1) as amended, certain AI systems built on them; a European AI Board with one representative per Member State (Art. 65); a scientific panel of independent experts (Art. 68); and national notifying and market-surveillance authorities (Art. 70).
• Soft instruments: the GPAI Code of Practice, published 10 July 2025, with three chapters (transparency, copyright, safety and security); the Commission describes it as a voluntary tool, and states that the Commission and the AI Board have confirmed it as an adequate voluntary tool for demonstrating compliance; the Transparency and Copyright chapters relate to Article 53 and the Safety and Security chapter to Article 55 (European Commission, 2025, page last updated 7 October 2026). Articles 53(4) and 55(2) let providers rely on codes of practice until a harmonised standard is published. Under Article 40, conformity with harmonised standards whose references are published in the Official Journal gives a presumption of conformity with the high-risk requirements and with the GPAI obligations they cover; see ORG-STANDARDS-001.
• Legacy GPAI models: providers of models placed on the market before 2 August 2025 must comply by 2 August 2027 (Article 111(3)).

As a law, the Act has no "applications" in the engineering sense; its practical effect is on deployment decisions. Examples of affected activity: CV-screening software (Annex III employment category), credit-scoring tools, exam-proctoring systems, and chatbots (Article 50 disclosure). Frontier LLM providers are the principal addressees of Chapter V (see TECH-LLM-001). The Commission's Code of Practice page (last updated 7 October 2026, read 2026-10-18) lists signatories including Amazon, Anthropic, Google, IBM, Microsoft, Mistral AI and OpenAI, and states that xAI signed only the Safety and Security chapter; Meta does not appear on that list. The list is updated continuously and should be re-checked.

Claimed strengths: legal certainty across 27 Member States, a single market for compliant products, and proportionality through risk tiers.

Limitations and criticisms:

• Compliance depends on harmonised standards and governance frameworks that were not ready when obligations were originally scheduled; recital (2) of Regulation (EU) 2026/1744 states this as a reason for the 2026 amendments (section 3).
• A fixed compute threshold is a proxy that algorithmic efficiency gains may make over- or under-inclusive.
• Enforcement is distributed across national authorities, creating risk of uneven application.
• Whether and how the Act interacts with existing law (GDPR, copyright, product safety) remains partly unresolved.
• Effects on innovation and on EU competitiveness are disputed and have not been measured in a source reviewed here.

As of 2026-10-18: prohibitions and AI-literacy duties (Article 4, since amended) have applied since 2 February 2025; GPAI obligations since 2 August 2025; the general application date of 2 August 2026 has passed, with governance, penalties and Article 50 transparency in effect, subject to the grace periods above. The Commission states that from 2 August 2026 the AI Office holds enforcement powers over GPAI models, including requesting documentation, evaluating models, requiring corrective measures and issuing fines. High-risk obligations are not yet applicable: 2 December 2027 (Annex III) and 2 August 2028 (Annex I) as amended. The new prohibition on intimate-imagery/CSAM generation applies from 2 December 2026 and the Article 50(2) grace period for earlier systems also ends on that date. Evidence on enforcement outcomes is not yet available; no fine under the Act is recorded in the sources reviewed.

Observed trend: dates have moved later while the substantive structure has been retained. No forecast is registered here; further delegated acts (including threshold updates), harmonised standards and Commission guidelines are the items to monitor. Readers should consult the Living Reference collections (TIME-001, FCST-REG-001) for dated updates.

• Foundational Concepts:
  • GOV-LAW-001 Global AI Governance & Regulation: general overview of regulatory approaches.
• Related Methods & Technologies:
  • TECH-LLM-001 Large Language Models: principal GPAI models addressed by Chapter V.
  • ECON-COMP-001 The Economics of Compute and Scaling: compute accounting behind the $10^{25}$ FLOP presumption.
  • ORG-STANDARDS-001 Standards Bodies (ISO/IEC, NIST): harmonised standards.
• Comparative regimes:
  • GOV-US-001 United States AI Policy
  • GOV-CN-001 China's AI Regulation
  • GOV-INTL-001 International AI Governance and Compute Governance

Global AI Governance & Regulation encompasses the statutory frameworks, international treaties, export controls, and institutional auditing mechanisms designed to manage the societal, economic, and existential risks posed by advanced artificial intelligence. It seeks to balance the acceleration of beneficial technological innovation with the enforcement of safety guardrails, primarily focusing on data privacy, algorithmic bias, copyright protections, and the containment of potentially dangerous dual-use foundation models. Taeihagh (2021) is cited only for the general notion of AI governance and its challenges, not for this specific scope. All legal statuses below are as of 2026-10-15.

The rapid capability scaling of Large Language Models (LLMs) and autonomous agents has strained traditional, slow-moving regulatory frameworks (an interpretive claim). AI governance is uniquely challenging because the technology is general-purpose, intangible, and evolves at a pace that vastly outstrips legislative cycles.

The significance of global AI regulation operates across three risk tiers:

1. Immediate Harms: Protecting citizens from automated discrimination, deepfake-driven democratic subversion, and massive copyright infringement by generative models.
2. National Security & Dual-Use: Preventing state and non-state actors from using open-weight models to accelerate the design of biological weapons or orchestrate autonomous cyberattacks.
3. Existential Risk Coordination: Establishing international non-proliferation treaties and compute monitoring to prevent a catastrophic global arms race toward unaligned Artificial Superintelligence (ASI).

Before 2022, AI-specific binding regulation was limited, and soft-law guidance such as the OECD AI Principles (May 2019) predominated [VERIFICATION NEEDED: OECD and IEEE instruments not re-checked in this revision].

The paradigm shifted radically in 2022/2023 with the public release of ChatGPT, which demonstrated generalized, open-ended capabilities.

• The European Union adopted the EU AI Act, Regulation (EU) 2024/1689 (dated 13 June 2024, published in the Official Journal on 12 July 2024; in force 1 August 2024), a risk-based regime that prohibits certain practices (e.g., social scoring, Art. 5(1)(c)) and sets obligations for providers of general-purpose AI (GPAI) models, with additional duties for GPAI models with systemic risk. Application dates are in the table in section 4.1.
• The United States under Executive Order 14110 (30 October 2023) set reporting requirements for developers of the most compute-intensive models. EO 14110 was revoked on 20 January 2025 by EO 14148, and EO 14179 (23 January 2025, 90 FR 8741) directed a deregulatory review of actions taken under it. It is not in force. See section 4.1 for later US measures.
• The UK AI Safety Summit (1-2 November 2023) produced the Bletchley Declaration, signed by 28 countries and the EU (including China and the USA), which refers to "serious, even catastrophic, harm" from frontier AI (UK Government, 2023). It was an early international statement of this kind; no source was checked establishing it as the first.

#4.1 The Compute Threshold Approach

Some governance instruments use the training compute of a model as a trigger, because compute is more measurable than software capability. Two instruments are relevant and their thresholds differ:

The $10^{25}$ and $10^{26}$ figures therefore belong to different instruments and are not in conflict.

EU AI Act application dates (Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, Official Journal texts read 2026-10-15 and 2026-10-18; see GOV-EU-001):

These high-risk dates were deferred by the "Digital Omnibus on AI", reported as Regulation (EU) 2026/1744, which was signed on 8 July 2026, published in the Official Journal on 24 July 2026 and entered into force on the third day after publication, 27 July 2026 (Art. 4; Official Journal text read on EUR-Lex). It also adds prohibitions on AI systems generating non-consensual intimate content or child sexual abuse material (Art. 5(1), points (ba) and (bb), and Art. 5(1a) and (1b)), applying from 2 December 2026. [VERIFICATION NEEDED: application dates of provisions other than Art. 5 additions, Art. 50(2) transition and the high-risk dates have not been individually checked.]

US federal and state measures after EO 14110: EO 14179 (23 January 2025) directed a review of actions taken under EO 14110. The White House published "America's AI Action Plan" in July 2025 and, on 11 December 2025, an executive order titled "Ensuring a National Policy Framework for Artificial Intelligence" directing challenges to state AI laws (law-firm and White House fact-sheet summaries; litigation and legislative status not checked). [VERIFICATION NEEDED: current federal legislation and the status of state laws such as California SB 53 and the Colorado AI Act.]

#4.2 Liability and Open-Weight Models

A central regulatory debate revolves around the liability of "open-weight" or "open-source" AI models. If a corporation releases the weights of a highly capable model to the public, and a malicious actor fine-tunes that model to orchestrate a cyberattack, assigning legal liability remains an unresolved legal frontier. Commentators argue both that strict regulation could constrain open-source development and that lax regulation could permit misuse; neither claim is empirically settled.

#4.3 Export Controls and Semiconductor Chokepoints

Governance is inextricably linked to hardware. Export controls on advanced AI accelerators and semiconductor manufacturing equipment have been imposed since October 2022 and revised repeatedly; controls on EUV lithography rest substantially on Dutch (ASML) licensing and allied alignment as well as US rules. [VERIFICATION NEEDED: specific BIS rules, their dates and current status; no primary source was checked in this revision. See GOV-EXPORT-001.]

Regulatory approaches globally are highly fragmented:

• Risk-Based Framework (EU): Classifies AI systems by their intended use (Unacceptable Risk, High Risk, Limited Risk, Minimal Risk) with corresponding compliance burdens.
• Sectoral/Distributed Approach (US): Federal AI-specific regulation is limited and authority is dispersed across existing agencies and state laws. [VERIFICATION NEEDED: which agencies (e.g., FDA, SEC, FTC) have issued AI-specific rules; the earlier list was uncited.]
• State-Led Development (China): The Interim Measures for the Management of Generative AI Services took effect on 15 August 2023 (issued 13 July 2023 by the CAC and six other regulators), and the Measures for Labeling AI-Generated Synthetic Content, with mandatory standard GB 45438-2025, took effect on 1 September 2025 and require explicit and implicit (metadata) labels (law-firm summaries; official CAC texts not read). See GOV-CN-001. [VERIFICATION NEEDED: security-assessment and "alignment with state values" characterizations are not sourced here.]

• National AI evaluation institutes: The UK institute is now the AI Security Institute (renamed from AI Safety Institute, February 2025, per a Japan AISI document; its website uses the current name). The US institute was re-established in June 2025 as the Center for AI Standards and Innovation (CAISI) at NIST (NIST, 25 September 2025 news item, uses that name); as read on 2026-10-18, NIST's own page for the body and a 16 October 2026 NIST news item call it the Center for Advancing Innovation and Standards for Super Intelligence (CAISSI) [VERIFICATION NEEDED: no NIST or Commerce announcement of the change was found, so its date is unconfirmed]. Japan has an AI Safety Institute (J-AISI; not further checked). Their pre-deployment evaluations rest on voluntary agreements with developers (e.g., NIST agreements with OpenAI and Anthropic), not a legal gate.
• Content marking and labeling: The EU AI Act Art. 50 sets transparency duties for synthetic content (see dates in section 4.1), and China's labeling measures apply from 1 September 2025 (section 5). The earlier general claim of "cryptographic or statistical watermarks" mandates is not supported and is withdrawn. [VERIFICATION NEEDED: exact technical requirements of Art. 50(2).]

#Limitations of Current Regulation

• Regulatory Capture: Massive compliance costs heavily favor incumbent tech monopolies, potentially crushing open-source ecosystems and startup competitors who cannot afford vast legal auditing teams.
• The Pace of Innovation: Commentators note that the EU AI Act was drafted before the spread of general-purpose models and that GPAI provisions were added during negotiation [VERIFICATION NEEDED: source for the legislative history]; the later deferral of high-risk deadlines (section 4.1) is attributed in secondary sources to unready standards and supervisory capacity.
• Enforcement Jurisdictions: AI development is borderless. Strict regulations in the West may simply offshore development to jurisdictions with minimal oversight ("regulatory havens").

#Unresolved Legal and Scientific Questions

1. Copyright and Fair Use: Do companies have the legal right to scrape copyrighted internet data to pretrain their models? Litigation in several jurisdictions is pending or has been decided; its outcome may affect the industry. [VERIFICATION NEEDED: specific cases, dates and outcomes as of 2026-10-15; see SAFE-IP-001.]
2. Algorithmic Disgorgement: If a model is found to be trained on illegal or copyrighted data, can the offending data be "unlearned," or must the regulatory body force the deletion of the entire multi-million-dollar model?

Global AI governance is in a state of rapid, fragmented experimentation. Views differ on how to regulate frontier models; the Bletchley Declaration (UK Government, 2023) records agreement among signatories that frontier AI poses serious risks, but no cited source establishes a wider consensus on regulatory paradigms. No international treaty comparable to the IAEA framework for AI exists. The Council of Europe Framework Convention on AI (CETS No. 225) is a binding treaty for its parties: opened for signature 5 September 2024, with 21 signatories reported by the Council of Europe and the EU reported to have ratified in May 2026; its entry-into-force status was not confirmed [VERIFICATION NEEDED]. Voluntary lab commitments (e.g., Anthropic's Responsible Scaling Policy, which has been revised more than once; version not checked) supplement hard law.

The following are qualitative outlooks, not registered forecasts under docs/EVIDENCE_FRAMEWORK.md section 2; no probabilities are assigned.

• Near-Term (0–3 Years): Continued copyright litigation; phased application of the EU AI Act (section 4.1 dates, including the December 2027 and August 2028 high-risk dates as currently scheduled); possible further changes to US federal and state AI policy.
• Medium-Term (3–10 Years): Proposals exist for an international agency for AI and for hardware-level tracking of advanced chips (Anderljung et al., 2023, discuss compute governance and licensing); whether any will be adopted is unknown [Hypothetical].
• Long-Term (10+ Years): Some analysts argue that AGI, if achieved, would make AI a matter of international strategic deterrence; this is a contested scenario, not an expected outcome.

• Foundational Concepts:
  • ECON-COMP-001 The Economics of Compute & Scaling: The physical infrastructure that regulations attempt to monitor.
  • CAP-BENCH-001 AI Evaluation, Benchmarking & Contamination: The metrics used by safety institutes to enforce compliance.
• Advanced Implications & Future Trajectories:
  • SAFE-XRISK-001 AI Existential Risk & Catastrophic Scenarios: The primary threat model driving international governance efforts.
  • SAFE-ALIGN-001 The AI Alignment Problem: The technical problem regulations seek to buy time to solve.

United States AI policy is the combination of executive orders, agency guidance, existing sector laws, federal funding and procurement rules, export controls, and state legislation that governs the development and use of artificial intelligence in the US. There is, as of 2026-10-18, no comprehensive federal AI statute located in the sources reviewed comparable to the EU AI Act (GOV-EU-001).

The US hosts many of the frontier AI developers, so its policy choices have effects beyond its borders. Policy since January 2025 has emphasised removing perceived barriers to AI development and international competitiveness, in contrast with the 2023-2024 emphasis on safety reporting. Because most rules are executive actions or agency practice rather than statute, they can be, and have been, reversed quickly. The state level has become a second centre of rule-making, which the federal executive branch has sought to limit.

Pre-2023. Federal action consisted of strategy documents and funding (for example, the National Artificial Intelligence Initiative Act of 2020, Division E of Public Law 116-283, dated 1 January 2021 (GovInfo, 2021)) and voluntary guidance. The National Institute of Standards and Technology (NIST) published the AI Risk Management Framework 1.0 (NIST AI 100-1) in January 2023 as a voluntary framework (NIST, 2023).

Executive Order 14110 (30 October 2023), "Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence," required, among other things, reporting to the Commerce Department by companies developing dual-use foundation models, using Defense Production Act authority (Federal Register, 2023). It was revoked by Executive Order 14148 of 20 January 2025, "Initial Rescissions of Harmful Executive Orders and Actions," whose Section 2 lists Executive Order 14110 among the revoked orders (Federal Register, 2025a; 90 FR 8237, 28 January 2025).

Executive Order 14179 (23 January 2025), "Removing Barriers to American Leadership in Artificial Intelligence," states a policy "to sustain and enhance America's global AI dominance", directs an AI action plan within 180 days, and directs an immediate review of actions taken under the revoked Order 14110 (Federal Register, 2025b; 90 FR 8741, 31 January 2025). The order itself describes Order 14110 as "revoked" in its Section 5.

America's AI Action Plan (23 July 2025). The plan, titled "Winning the Race," is organised around three pillars, which its table of contents names "Accelerate AI Innovation," "Build American AI Infrastructure" and "Lead in International AI Diplomacy and Security"; the plan text is dated July 2025 and the White House announcement page is dated 23 July 2025 (The White House, 2025d, 2025e). It is a policy document, not self-executing law.

Standards body rename (June 2025, and again by October 2026). Trade press reported that the Commerce Department announced in early June 2025 that the US AI Safety Institute, created in 2023, would become the Center for AI Standards and Innovation (CAISI) within NIST, with a stated focus on demonstrable risks such as cybersecurity, biosecurity and chemical weapons; NIST news items from 2025 and early 2026 use the CAISI name. As read on 2026-10-18, NIST's own page for the body (nist.gov/caissi, last modified 3 September 2026) names it the Center for Advancing Innovation and Standards for Super Intelligence (CAISSI), and describes it as industry's primary point of contact in the US government for testing and collaborative research on commercial "SI" systems (NIST, n.d.); a NIST news item dated 16 October 2026, issued with the National Security Agency and CISA, uses the same name (NIST, 2026). This article uses "CAISI" for the body under either name. [VERIFICATION NEEDED: the Commerce press release itself could not be retrieved (commerce.gov blocks automated access), so the exact date of the June 2025 announcement is unconfirmed from a primary source, and no announcement of the CAISSI rename or its date was found; see ORG-SAFETY-001].

Executive Order 14365 (11 December 2025), "Ensuring a National Policy Framework for Artificial Intelligence," published at 90 FR 58499 on 16 December 2025 (Federal Register, 2025c). Its text directs: the Attorney General to establish, within 30 days, an AI Litigation Task Force to challenge State AI laws inconsistent with the order's policy, including on interstate-commerce, preemption or other grounds (Sec. 3); the Commerce Secretary to publish within 90 days an evaluation identifying onerous State AI laws (Sec. 4); Commerce, through NTIA, to issue within 90 days a BEAD Policy Notice making States with such laws ineligible for non-deployment BEAD funds "to the maximum extent allowed by Federal law," and agencies to assess conditioning discretionary grants (Sec. 5); the FCC Chairman to initiate a proceeding on a federal reporting and disclosure standard for AI models that preempts conflicting State laws (Sec. 6); the FTC Chairman to issue a policy statement on when State laws requiring alteration of truthful AI outputs are preempted by the FTC Act (Sec. 7); and the preparation of a legislative recommendation for a uniform federal framework preempting conflicting State AI laws, which is not to propose preempting otherwise lawful State laws on child safety, AI compute and data-centre infrastructure, or State government procurement and use of AI (Sec. 8). Like Order 14179, it creates no private rights (Sec. 9(c)). The White House fact sheet of the same date summarises these directives (The White House, 2025f). Whether the Sec. 4 evaluation, Sec. 5 notice, Sec. 6 proceeding or Sec. 7 statement were issued was not checked [VERIFICATION NEEDED].

National Policy Framework for AI (20 March 2026). A set of non-binding legislative recommendations to Congress, supporting broad preemption of state AI laws imposing "undue burdens", no new federal AI regulator, and preserving state authority over generally applicable laws such as child protection (reported by WilmerHale, 2026, which dates the release 20 March 2026 and describes it as not binding and as advising Congress not to create a new federal AI regulator; primary White House text not retrieved [VERIFICATION NEEDED]).

Instruments in use.

• Executive orders bind agencies and federal procurement but do not create private rights and can be rescinded by a later order.
• Existing statutes applied to AI: consumer protection (FTC Act), civil rights and anti-discrimination law, product liability, copyright, sectoral regulators (FDA, SEC, CFPB).
• Voluntary standards: the NIST AI RMF and CAISI evaluations.
• Export controls on advanced chips and model-related items are covered in GOV-EXPORT-001.
• Federal funding conditions as a lever over states (Executive Order 14365, Sec. 5).

Compute thresholds. Until Commerce defined technical conditions, Order 14110 Sec. 4.2(b) required reporting for models trained using more than $10^{26}$ integer or floating-point operations (more than $10^{23}$ for models trained primarily on biological sequence data) (Federal Register, 2023); with the order's revocation, that federal reporting requirement is no longer in force. California's SB 53 is reported by a law firm to define "frontier model" as one trained with more than $10^{26}$ operations (below).

• Federal executive branch: White House Office of Science and Technology Policy and National Security Council; Commerce (NIST/CAISI, Bureau of Industry and Security); Justice (the litigation task force); FTC and FCC.
• Congress: numerous bills introduced; as of mid-October 2026 secondary sources report that no federal preemption statute has been enacted. StateScoop reported that the Senate voted 99-1 on 1 July 2025 to remove a proposed state-law AI moratorium from the budget bill (StateScoop, 2025a), and, on 8 December 2025, that the text of the 2026 National Defense Authorization Act did not include such a moratorium (StateScoop, 2025b). The status of 2026 bills (reported as a "Great American AI Act" draft and a "FRONTIER Act") is described inconsistently in secondary sources [VERIFICATION NEEDED: check congress.gov].
• States: California's Transparency in Frontier Artificial Intelligence Act (SB 53) was signed on 29 September 2025, according to the Governor's office (Office of the Governor of California, 2025), which states that it requires large frontier developers to publish a framework on their website, creates a mechanism to report critical safety incidents, protects whistleblowers and sets civil penalties. Law-firm summaries add a 1 January 2026 effective date for key provisions and a more-than-$10^{26}$-operation threshold for "frontier models" [VERIFICATION NEEDED: the chaptered bill text could not be retrieved (leginfo.legislature.ca.gov returned a bot challenge), so the threshold, effective date and penalty amounts are from law-firm sources only]. Colorado: the Legislature's bill page shows SB 26-189 ("Automated Decision-Making Technology") signed 14 May 2026 and repealing and re-enacting the provisions of the 2024 Colorado AI Act (SB 24-205), with some duties starting 1 January 2027 (Colorado General Assembly, 2026). A law-firm alert reports that xAI sued over SB 24-205 on 9 April 2026, that the US Department of Justice filed a companion complaint on 24 April 2026, and that on 27 April 2026 a magistrate judge granted a stipulated order under which the state agreed not to enforce SB 24-205 pending a ruling on a preliminary-injunction motion (McDermott Will & Emery, 2026) [VERIFICATION NEEDED: litigation details from the law-firm alert only; the court docket was not checked; the final status of the case is unknown].

Concrete effects: federal procurement of AI follows executive direction; state laws such as California's SB 53 impose duties on frontier developers; the Department of Justice task force is a mechanism for litigation against state laws. The Colorado litigation described in Section 5 involved a Department of Justice filing, but no ruling on the merits of any challenge to a state AI law was found in the sources reviewed, and none is recorded.

• Argued advantages: speed and flexibility, a single national standard, lower compliance burden.
• Limitations: executive measures are reversible and lack statutory force; litigation over preemption raises constitutional questions (legal commentators expect prolonged uncertainty per secondary reports); absence of binding federal safety requirements for frontier models; reliance on voluntary industry commitments.
• Contested: whether federal preemption without a substantive federal standard is desirable or lawful; whether training on copyrighted material is lawful (the 2026 framework states an administration view but leaves fair use to courts).

As of 2026-10-18: Executive Order 14110 is revoked; Order 14179 and the July 2025 Action Plan state current federal direction; Order 14365 (December 2025) is an executive instrument (its implementation status was not checked); the March 2026 framework is a recommendation only; no comprehensive federal AI statute or preemption statute has been located. State laws, including California's SB 53, are not known to have been preempted or enjoined in the sources reviewed; the Colorado AI Act was replaced by SB 26-189 in May 2026.

Observed: policy moves by executive action and litigation rather than statute. No forecasts are registered here. Items to watch: congressional preemption bills, court rulings on Order 14365 and on Colorado's law, and revisions to export-control rules. See Living Reference TIME-001.

• Foundational Concepts:
  • GOV-LAW-001 Global AI Governance & Regulation: general context; note that GOV-LAW-001 describes the revoked Order 14110 as operative and should be read with this article.
• Comparative regimes:
  • GOV-EU-001 The EU AI Act
  • GOV-CN-001 China's AI Regulation
• Related:
  • GOV-EXPORT-001 Export Controls and AI Geopolitics: chip and model controls.
  • GOV-INTL-001 International AI Governance and Compute Governance
  • ORG-SAFETY-001 AI Safety Institutes and Research Organizations
  • ORG-STANDARDS-001 Standards Bodies (ISO/IEC, NIST)