AI Rules Get Real: What New Laws Mean for Startups

After years of promises, rules arrive

Artificial intelligence is moving from bold pledges to binding rules. The European Unions landmark AI Act entered into force in 2024, setting a risk-based framework for systems deployed in the bloc. In the United States, the White House issued an Executive Order in late 2023 on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence, and federal agencies have been translating it into standards and guidance. Other governments, from the United Kingdom to G7 members, are aligning on safety and transparency. The regulatory picture is sharpening. Companies now face a clearer, if complex, compliance road.

These moves come as AI spreads into search, productivity software, customer service, and healthcare tools. Investors and boards want growth, but they also want operational discipline. Policymakers want benefits without undue harm. The next phase is about implementation and enforcement.

What the EU AI Act actually does

The AI Act is the first comprehensive AI statute in a major market. It sets obligations based on the level of risk. The laws purpose is stated plainly: This Regulation lays down harmonised rules on artificial intelligence (AI) and rules on the placing on the market, the putting into service and the use of AI systems in the Union. (EU AI Act, Article 1.)

Its approach has four broad tiers:

  • Unacceptable risk: Certain practices are banned. These include social scoring by public authorities and systems that manipulate behavior in ways likely to cause harm. Some uses of remote biometric identification in public spaces are heavily restricted.
  • High risk: AI used in sensitive contexts faces strict requirements. Examples include systems for employment, education, medical devices, critical infrastructure, and law enforcement. Providers must meet obligations on risk management, data governance, human oversight, robustness, and transparency. Many high-risk systems must be registered in an EU database.
  • Limited risk: Systems with significant but lower risks must meet transparency rules. Users should be informed when they interact with AI or when content is AI-generated in specific contexts.
  • Minimal risk: Most AI systems, such as spam filters or video game AI, face no new obligations.

The law also addresses general-purpose AI (GPAI), including large models. Providers of GPAI must publish summaries of training data sources, respect copyright, and share technical documentation with downstream developers. Models with systemic risk are subject to tighter testing and reporting. Obligations will phase in over the next two to three years, with bans taking effect sooner and high-risk requirements later.

The U.S. path: standards over statutes

Washington has taken a different route. Rather than a single federal AI law, the White House ordered a government-wide push on safety, security, and civil rights under existing authority. The 2023 Executive Orders title Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence captures its intent.

Since then, agencies have moved on several tracks:

  • Safety testing: Companies developing the most capable models must report certain safety test results and other information to the government, under rules grounded in national security and critical infrastructure authorities.
  • Standards and benchmarks: The U.S. Department of Commerce launched the U.S. AI Safety Institute at NIST to create testing protocols, reference evaluations, and red-teaming guidance. The aim is to make safety claims measurable and comparable.
  • Content provenance: The Commerce Department has advanced guidance toward watermarking and provenance signals for synthetic media, seeking to curb deception and boost transparency.
  • Government use: The Office of Management and Budget issued guidance directing federal agencies to inventory AI uses, manage risks, and appoint chief AI officers.

Congress continues to debate comprehensive AI legislation, but bipartisan consensus on a single bill remains elusive. For now, the U.S. approach leans on executive action, sector rules, and voluntary standards with market pressure.

What this means for builders

For startups and product teams, the shift is practical. Compliance is no longer a nice to have. It is a market entry requirement in the EU and a rising expectation in the U.S. and beyond. The good news: many controls align with known software assurance and privacy practices.

  • Map your use cases: Inventory where and how your product uses AI. Classify features by risk category for each market you serve.
  • Document your model pipeline: Keep technical documentation on data sources, training process, evaluations, and known limitations. Expect to provide summaries for customers and, in some cases, regulators.
  • Build a risk program: Stand up red-teaming, adversarial testing, and model monitoring. Track prompt injection, jailbreaks, data leakage, and distribution shift. Log incidents and fixes.
  • Improve data hygiene: Apply data governance, consent where required, and data minimization. Address bias in datasets and outputs. Measure error rates across demographics.
  • Design for human oversight: Make it easy for users to review, challenge, and correct AI outputs. Keep humans in control for consequential decisions.
  • Label and disclose: Tell users when content is AI-generated where rules require it. Provide clear user guidance and model cards.
  • Mind your supply chain: Vet third-party models, APIs, and data vendors. Pass through obligations in contracts.

As the statistician George E. P. Box famously put it, All models are wrong, but some are useful. The new rules push companies to prove usefulness without undue risk.

Voices from the rulebooks

Policymakers are trying to set a common direction. The OECDs 2019 AI Principles, adopted by dozens of countries, state: AI should benefit people and the planet by driving inclusive growth, sustainable development and well-being. The EU law codifies a rights-based approach. The U.S. is building testable standards. The language differs, but the target is similar: trustworthy systems.

The coming challenge is consistency. Regulators must coordinate on definitions, testing metrics, and audit expectations. Companies will ask which benchmarks count and which disclosures matter. The answer will shape product roadmaps and budgets.

What comes next

Enforcement capacity will be tested. The EU must stand up market surveillance and coordinate national authorities. The U.S. must turn draft standards into repeatable evaluation suites. Courts will interpret new rules. Developers will adapt, and some features may ship more slowly.

There are open questions. How will open-source models be treated when they scale? Which thresholds trigger systemic risk duties? How should watermarking work across text, images, audio, and video without breaking privacy or performance? And how do small firms meet obligations without losing speed?

The direction of travel is clear. AI will stay fast. Governance must become faster. For companies, the path is to operationalize compliance and keep shipping. For the public, the test is whether guardrails enable innovation while protecting rights. The stakes are high, but so is the opportunity.

MOST POPULAR