AI Rules Arrive: What the New Era Means for Business

Governments have entered a new phase in governing artificial intelligence. The European Unions AI Act took effect in 2024. The United States is tightening federal oversight and standards. Global norms are forming fast. Companies now face a clearer, stricter rulebook for how they build and deploy AI.

A turning point for AI governance

The policy shift is significant. The European Commission calls the AI Act the first-ever comprehensive legal framework on AI worldwide. In Washington, the White House pledged to lead in seizing the promise and managing the risks of artificial intelligence. These moves reflect a consensus. AI brings opportunity. It also brings risk.

Sundar Pichai, the CEO of Google, once said AI is more profound than electricity or fire. That ambition helps explain the pace of lawmaking. Policymakers want progress, but with guardrails.

What the EU AI Act changes

The AI Act entered into force in 2024. Its rules will apply in stages through 2025 and 2026. The law uses a risk-based model. It bans some uses. It places strict duties on others. It leaves most low-risk uses largely free.

  • Banned practices: The Act forbids certain unacceptable risk systems. These include social scoring by public authorities. It also restricts real-time remote biometric identification in public spaces, with narrow law-enforcement exceptions.
  • High-risk systems: Tools used in critical infrastructure, employment, education, medical devices, law enforcement, migration, and the courts face strict rules. Providers must run risk management, ensure data quality, keep logs, and enable human oversight. They must show accuracy, robustness, and security.
  • Transparency duties: Some systems must disclose that users are interacting with AI. Synthetic media and deepfakes require labels in many contexts.
  • General-purpose AI (GPAI): Providers of large general models have new obligations. They must share technical summaries, comply with EU copyright law, and document training sources in high-level terms. The EU has also created an AI Office to coordinate oversight of these models.

Penalties can be large. Serious violations can bring fines tied to global turnover. National supervisory authorities will enforce the law. Coordination will run through EU bodies and the new AI Office.

For developers and deployers, the core message is simple. Prove your system is safe for its context. Keep documentation. Be transparent. Plan for audits.

The U.S. path: standards and oversight

The U.S. is acting through a mix of executive action, agency guidance, and standards. In October 2023, the White House issued an Executive Order on AI safety and security. It directed federal agencies to set testing, reporting, and safety rules for advanced models. It tasked the National Institute of Standards and Technology (NIST) with building evaluations and guidance.

In 2024, the Office of Management and Budget set new rules for federal AI use. Agencies must appoint Chief AI Officers, maintain inventories of AI systems, and assess risks for safety-impacting uses. More transparency is required when AI affects the public. The U.S. approach is less prescriptive than the EUs. But the signal is clear. Federal buyers and regulators will expect documentation, testing, and human oversight.

Standards bodies play a larger role in the U.S. system. NISTs AI Risk Management Framework offers a common language for assessing risk. It encourages governance, measurement, and continuous improvement. International standards now complement that work.

Standards step in: ISO/IEC 42001

In late 2023, the International Organization for Standardization published ISO/IEC 42001. It is a management standard for AI. It adapts the structure used in ISO standards for quality and security. The goal is to help organizations govern AI responsibly across teams and products.

The standards scope is concise. It specifies requirements for establishing, implementing, maintaining and continually improving an artificial intelligence management system. Companies can certify against it. That will not replace legal compliance. But it can support it. It gives a checklist for roles, processes, and evidence.

How companies are preparing

Firms are moving from principles to practice. Many have set up AI governance committees. They use impact assessments before launch. They track model changes and retraining. They document data sources and consent. They label synthetic content. Some are piloting ISO/IEC 42001. Others align with NISTs framework.

  • Map your AI systems: Build an inventory. Know where models run. Know their purpose and users.
  • Classify risk: Decide which uses are high-risk under EU rules. Flag safety-impacting uses for U.S. oversight.
  • Harden the lifecycle: Apply secure development, testing, and monitoring. Log inputs and outputs where lawful. Plan for incident response.
  • Document and disclose: Keep technical files. Provide user instructions. Label AI-generated content where required.
  • Govern data: Track data provenance and licensing. Respect copyright. Manage synthetic and personal data carefully.
  • Empower humans: Define human-in-the-loop controls. Train staff on escalation and override procedures.

Expert and official voices

European Commission: The EU AI Act is the first-ever comprehensive legal framework on AI worldwide. The Commission argues the law will foster trust and innovation by setting clear rules.

White House (2023 Fact Sheet): The administration said it aims to lead in seizing the promise and managing the risks of artificial intelligence. It framed the push as both a competitiveness and safety issue.

ISO/IEC 42001 (2023): The standard calls for establishing, implementing, maintaining and continually improving an artificial intelligence management system. It offers a route to structured governance.

Sundar Pichai: He has called AI more profound than electricity or fire. The line underscores the scale of expected change.

Concerns and open questions

Industry groups warn of compliance costs, especially for small firms. They fear uncertainty around definitions and scope. Civil society groups want stronger limits on biometric surveillance and workplace monitoring. They argue exceptions may widen over time. Both sides agree on one point. Enforcement details will matter.

There are technical challenges, too. Evaluating general-purpose models is hard. Measuring bias and robustness across contexts takes time and data. Supply chains are complex. Model components come from many sources. Liability lines are still emerging.

What to watch next

  • Deadlines and guidance: The EU will issue guidance and codes of practice. Compliance dates arrive through 2025 and 2026.
  • EU AI Office operations: The new office will shape how general-purpose model rules work in practice.
  • U.S. implementation: Agencies will refine testing, safety, and reporting. Federal procurement will raise the bar for vendors.
  • Global convergence: More countries are drafting rules. Many will draw on the EU, the U.S., and ISO standards.
  • Independent audits: Expect growth in third-party testing and certification services.

The direction is set. AI will face higher standards for safety, transparency, and accountability. The laws are demanding but not inflexible. Firms that invest in governance now can reduce risk. They can also speed approvals and build trust. In the new AI era, good controls are not just a cost. They are a competitive edge.

MOST POPULAR