AI’s Rulebook Arrives: What New Laws Mean Now

Governments move from principles to enforcement

Artificial intelligence is moving fast. So are the rules. In 2024, regulators shifted from broad principles to concrete obligations for developers and deployers of AI. The European Union’s AI Act entered into force with phased timelines. The United States issued a sweeping Executive Order and new technical guidance. The United Kingdom set up a safety institute and rallied partners at Bletchley Park. The result is clear: AI governance is moving from voluntary codes to enforceable standards.

It marks a change in tone. As OpenAI chief executive Sam Altman told U.S. senators in 2023, “We think that regulatory intervention by governments will be critical to mitigate the risks of increasingly powerful models.” Many policymakers now share that view.

EU AI Act: risk-based rules with real penalties

The EU AI Act is the centerpiece of global AI regulation. The European Commission calls it “the first comprehensive law on artificial intelligence worldwide.” It applies across the bloc and takes a risk-based approach. Some uses are banned outright. High-risk systems face strict duties. General-purpose models must meet transparency and safety expectations. Fines can reach up to 7% of global turnover for the most serious breaches.

  • Banned uses: Practices seen as unacceptable risk, such as social scoring by public authorities, manipulative systems that exploit vulnerabilities, and certain forms of biometric categorization.
  • High-risk obligations: Providers of AI used in fields like hiring, education, critical infrastructure, or law enforcement must implement risk management, data quality controls, human oversight, cybersecurity, and post‑market monitoring.
  • General-purpose AI (GPAI): Model developers must provide technical documentation, respect copyright disclosures, and support downstream transparency. Very large models with potential systemic risk face extra testing, incident reporting, and evaluation requirements.
  • Transparency to users: People must be told when they interact with AI, when content is AI-generated or manipulated, and when biometric categorization or emotion recognition is in use.
  • Enforcement: National authorities will supervise, while a new European AI Office coordinates and oversees powerful models.

The law’s obligations take effect in stages over the next two years. Bans apply first. Requirements for high-risk systems and general-purpose models follow later. Industry groups welcome the clarity but warn about compliance costs, especially for small firms. EU officials argue the rules will build trust and create a single market for safe AI.

United States: safety standards and reporting duties

Washington has pursued a mix of executive action and technical guidance. The White House issued an Executive Order directing agencies to set safeguards, spur innovation, and protect privacy and civil rights. A fact sheet said the order “establishes new standards for AI safety and security.” It also leans on the Defense Production Act to require disclosures from companies training very large models, including details about testing and cybersecurity.

  • NIST guidance: The National Institute of Standards and Technology (NIST) published its AI Risk Management Framework and profiles for generative AI. NIST describes the framework as “a voluntary resource … to help manage the risks of AI.”
  • Testing and red-teaming: Agencies are directing more rigorous evaluations for powerful systems, including adversarial testing.
  • Labeling and provenance: Work is advancing on content provenance and watermarking tools to help identify synthetic media.
  • Civil rights and labor: The administration has urged safeguards against discrimination and harmful workplace surveillance.

Congress continues to debate federal privacy rules and sector-specific AI legislation. States are moving too, especially on deepfakes and automated decision-making disclosures. The patchwork increases pressure for federal action.

UK and global: coordination over one big law

The UK favors a regulator-led approach rather than a single statute. It created the AI Safety Institute to test cutting-edge models and published guidance for sector regulators. In 2023, the UK hosted the AI Safety Summit at Bletchley Park. Governments and labs signed a declaration acknowledging both opportunity and risk from frontier AI. The approach stresses international cooperation and technical evaluation.

Other players are acting as well:

  • OECD and G7: Countries reference the OECD AI Principles on safety, fairness, and accountability. The G7’s Hiroshima process adds voluntary commitments for generative AI.
  • Standards bodies: ISO and IEC are developing management system standards for AI. These may become the backbone for audits and certifications.
  • Regulatory sandboxes: Many jurisdictions offer supervised test environments to help startups comply while they innovate.

What this means for companies and users

For companies, the new rulebook turns best practices into requirements. The reforms aim to reduce harm without choking innovation, but the burden will be real. Practical steps include:

  • Map your systems: Identify where AI is in your products and operations. Classify use cases by risk.
  • Document and test: Maintain technical documentation, model cards, and data lineage. Red-team models before release. Track known limitations.
  • Build controls: Add human-in-the-loop checks for high-stakes decisions. Implement access controls, monitoring, and incident response.
  • Inform users: Label AI-generated content. Provide clear explanations where decisions affect people’s rights.
  • Governance: Set up an internal risk committee. Assign accountable owners. Train staff on responsible use.

For the public, the aim is more reliable systems, clearer notices, and paths to contest automated decisions. Expect more labels on images, audio, and text. Some uses, like manipulative ads targeting children or intrusive biometric profiling, will face tighter limits or bans.

Open questions: compute, capability, and open source

Regulators are still refining how to measure AI risk. The EU links extra obligations to very large training runs, using compute as a proxy for capability. Critics say model behavior and context matter more than raw size. A second debate concerns open-source models. Supporters argue they improve security and competition. Others fear that easy access could lower barriers to misuse. Authorities are trying to strike a balance with transparency requirements that do not kill collaborative research.

Another challenge is capacity. Oversight will require technical expertise, shared testing infrastructure, and coordinated enforcement. The creation of bodies like the European AI Office and the UK AI Safety Institute shows an intent to build that capacity. But hiring specialized talent and keeping pace with new model releases will be a long-term task.

The bottom line

The era of AI self-policing is ending. The emerging framework combines laws, standards, and testing. It is stricter for high-risk uses and more flexible for low-risk applications. There is room for adjustment as technology evolves. For now, companies should not wait. Start with inventories, documentation, and robust testing. For users, expect clearer labels and stronger rights. The rules are getting real—and they will shape how AI reaches the world.

MOST POPULAR