AI Rules Get Real: What Regulators Want Next

Governments are moving fast to set the ground rules for artificial intelligence. After years of speeches and voluntary pledges, binding requirements are taking shape. The European Union has finalized its landmark AI Act. The United States is using a sweeping executive order and agency guidance. The United Kingdom is building an AI Safety Institute and coordinating standards. China has issued national rules for generative AI services. The result is a new phase: concrete compliance expectations, more model testing, and closer scrutiny of claims about AI.

The new rulebook, in brief

The EU AI Act is the most comprehensive law so far. It uses a risk-based approach. Some AI uses are banned outright, such as social scoring by public authorities and certain types of biometric categorization. Many uses in areas like hiring, education, and critical infrastructure are classed as high-risk. Those systems must meet strict obligations, including risk management, data governance, human oversight, and documentation. Fines can reach up to a significant percentage of global annual turnover for serious violations. The law enters into force in stages over the next two to three years, giving companies time to adapt.

In the United States, the federal government is leaning on existing powers and procurement rules. A 2023 executive order requires safety testing for advanced models, reporting to the government above certain compute thresholds, and standards work on content provenance and watermarking. The National Institute of Standards and Technology (NIST) launched an AI Safety Institute to develop testing methods and evaluation frameworks. Agencies, including the Federal Trade Commission, have warned they will police deceptive claims about AI.

The United Kingdom convened the 2023 AI Safety Summit and signed the Bletchley Declaration with dozens of countries. It created a national AI Safety Institute focused on evaluating frontier systems. The U.K. has not passed a single broad AI law. Instead, it has tasked existing regulators to apply guidance within their sectors.

China issued interim measures for generative AI services in 2023, including content moderation, security reviews, and labeling requirements. That framework has already shaped how large models operate on Chinese platforms.

What changes for companies now

Across jurisdictions, several obligations are converging. Even where rules differ, the direction is clear: more testing, more transparency, and stronger accountability.

• Risk assessment and testing: Providers of high-risk and frontier models are expected to conduct red-team testing, document hazards, and mitigate failures before release.
• Data governance: Organizations must track training and evaluation data sources, address bias, and maintain documentation that auditors can review.
• Transparency: Users should be informed when they interact with AI systems. Providers are encouraged or required to disclose system capabilities and limits.
• Content authenticity: Watermarking and provenance signals for AI-generated media are moving from voluntary to expected, especially around elections and public safety.
• Incident response: Companies need processes to log and report significant failures, from security incidents to harmful outputs.

Regulators are also focusing on general-purpose and foundation models. The EU Act introduces tailored obligations for very capable models, with extra duties if they pose systemic risks. U.S. policy ties obligations to compute and capability, with standards work feeding into federal procurement. Open-source developers are watching closely to see how these thresholds and documentation requirements apply in practice.

Industry pushback and civil society concerns

Big technology firms want clarity and unity. They warn that a patchwork of rules across continents could slow deployment and raise costs. Start-ups fear compliance will favor incumbents with large legal teams. Open-source advocates caution that rules aimed at large models could catch community projects and dampen innovation.

Rights groups and researchers have a different worry. They argue that enforcement must be robust, especially for biometric surveillance and algorithms used in public services. They want stronger bans, faster timelines, and meaningful penalties when systems cause harm. Consumer agencies are also sharpening their message. In a 2023 blog post, a Federal Trade Commission staff attorney wrote, “If you think you can get away with baseless claims about AI, think again.” The warning was clear: traditional truth-in-advertising rules apply to AI, too.

Expert voices frame the stakes

AI veterans have been sounding both optimism and caution. In 2017, computer scientist Andrew Ng said, “AI is the new electricity.” He argued that the technology would power many sectors, much as electrification did a century ago. That promise continues to drive investment and deployment.

Others stress the limits of today’s techniques. In 2016, Meta’s chief AI scientist Yann LeCun wrote, “If intelligence is a cake, the bulk is unsupervised learning, the icing is supervised learning, and the cherry on the cake is reinforcement learning.” The quote underscored the importance of data-efficient learning, a continuing challenge for large models.

Some pioneers now emphasize risks as well as benefits. In a 2023 interview with the New York Times, Geoffrey Hinton, often called a “godfather of AI,” said, “I console myself with the normal excuse: If I hadn’t done it, somebody else would have.” His remark captured a broader unease about powerful systems that are not yet fully understood.

Why it matters

AI is moving from labs to daily life. It screens resumes, helps doctors read scans, answers customer questions, and writes code. With each step, the stakes rise. Errors can lock people out of jobs or loans. False images and audio can sway voters. Security failures can expose sensitive data. Policymakers are trying to reduce these risks without crushing innovation.

The new rules aim to make AI more predictable and trustworthy. Clear responsibilities could help the market. Companies that invest in safety and documentation will have a way to differentiate their products. Regulators will get better tools to act when things go wrong. And the public will gain more visibility into how these systems work.

What to watch next

• Final standards: NIST and international bodies are drafting test methods for model evaluation, robustness, and transparency. These will guide audits and procurement.
• Foundation model thresholds: Policymakers still need to define capability and compute lines that trigger extra obligations. Those choices will shape the next wave of models.
• Enforcement muscle: Watch early cases. How agencies handle deceptive AI marketing and high-risk failures will set precedents.
• Open-source carve-outs: Expect more debate over how to protect research and small developers while managing systemic risks.
• Global coordination: Cross-border alignment on safety testing, provenance, and incident reporting will be key as models scale worldwide.

The bottom line

AI is entering a rules-first era. The regulatory path is not uniform, but the direction is steady: more testing before release, more transparency after, and real consequences when systems cause harm. Supporters say these steps will build trust and accelerate adoption. Critics say poorly designed rules could slow progress and entrench incumbents. Both can be true in different moments.

For now, one point draws broad agreement. As the systems grow more capable, the public expects stronger guardrails. Regulating AI is no longer a theoretical debate. It is a practical task, unfolding in real time, with high stakes for innovators, regulators, and everyone who will rely on the technology.