A company can now face a fine of up to 7% of its global annual revenue for breaking one AI law. In Europe, that’s real. In the United States, there’s still no single federal AI statute at all.
That split defines AI law in 2026. One region has a binding, risk-tiered rulebook. Another runs on executive orders, agency posture, and a fast-growing pile of state laws.
This is general information, not legal advice. For decisions affecting your business, talk to a qualified lawyer.
What Is AI Law?
AI law isn’t one rulebook. It’s a mix of laws, regulations, court rulings, and agency guidance that govern how AI gets built and used.
Some rules target AI directly. Others apply older laws to new technology, like copyright, privacy, consumer protection, and anti-discrimination law.
There is still no single global AI law. Each region has chosen a different path, and the gaps between them matter for any company working across borders.
The EU AI Act: The First Comprehensive AI Law
The European Union AI Act is the world’s first comprehensive AI law. It sorts AI systems into risk tiers and sets stricter rules as the risk rises.
How the Risk Tiers Work
Unacceptable risk systems are banned outright. High-risk systems, like those used in hiring or healthcare, face strict requirements. Limited-risk systems mostly face transparency duties. Minimal-risk systems face few rules at all.
The Rollout Timeline
The law is phasing in over several years. Banned practices applied from February 2025. Rules for general-purpose AI models began in August 2025.
August 2, 2026 was the next major milestone. Transparency obligations under Article 50 and enforcement powers over general-purpose models both took effect then.
Standalone high-risk system rules follow in December 2027. High-risk AI embedded in regulated products follows in August 2028. Some of these dates have shifted during implementation, so check the current schedule before planning around any one deadline.
The Penalties
Fines are steep. The top tier reaches €35 million or 7% of global annual turnover, whichever is higher. That’s designed to matter even for the largest companies.
Training Data and Copyright
General-purpose AI providers must publish summaries of the data used to train their models. They must also show compliance with EU copyright law, including respecting rights holders who opt out of data mining.
EU AI Act by the Numbers
| Metric | Figure |
| Maximum fine | €35 million or 7% of global turnover |
| Banned practices applied from | February 2025 |
| General-purpose AI rules began | August 2025 |
| Transparency and enforcement milestone | August 2, 2026 |
| Standalone high-risk rules | December 2027 |
| Embedded high-risk rules | August 2028 |
| Enterprises reporting they’re unprepared for their obligations | 78% |
Implementation dates have been adjusted at points. Confirm current deadlines with official EU sources.
US AI Law: No Federal Statute, Many State Laws
The US takes a very different approach. There’s no comprehensive federal AI law.
The only standalone federal statute that substantively regulates AI systems is the TAKE IT DOWN Act, signed in May 2025. It requires platforms to run notice-and-removal processes for non-consensual intimate imagery, including AI-generated deepfakes. The compliance deadline was May 19, 2026. Law firm Baker Botts tracks this and related shifts in its AI Legal Watch series.
The Federal Posture: Light Touch and Preemption
Federal policy favors a light-touch, innovation-first approach. In December 2025, an executive order called for a national AI framework and set up a DOJ task force to challenge state AI laws.
The order also directed the FCC and FTC to consider federal standards that could override conflicting state rules. In March 2026, the White House followed with a framework urging Congress to pass broad preemption.
Why Preemption Is Still Unresolved
An executive order can direct agencies and litigation. It can’t, on its own, cancel an existing state law. That takes an act of Congress or a court ruling.
As of late summer 2026, general federal preemption legislation was proposed but not enacted. A narrower FRONTIER Act, introduced in July 2026, would limit state rules for frontier AI developers in three areas: catastrophic-risk transparency, third-party auditing, and incident reporting.
Critics argue even this narrower approach sets a federal ceiling that states couldn’t exceed. A recent analysis in The Regulatory Review makes that case, and argues for a federal floor that states can build on instead.
The practical takeaway: until courts or Congress settle this, state laws that are on the books generally remain enforceable.
The State Law Patchwork
States aren’t waiting. Several significant AI laws took effect on January 1, 2026.
California enacted SB 53, a frontier-AI transparency law. New York signed the RAISE Act in December 2025, making it the first state to pass major AI safety legislation after the federal preemption order. Colorado’s AI Act was named directly in that order. New York City’s Local Law 144, one of the oldest AI-specific laws in the country, governs automated hiring tools.
Volume tells the story too. 45 states had introduced more than 1,561 AI-related bills by March 2026, focused heavily on bias, hiring, and deepfakes.
AI Law: EU vs. US at a Glance
| Factor | European Union | United States |
| Core approach | One binding, risk-tiered law | Executive action plus state laws |
| Comprehensive federal/EU-wide statute? | Yes, the AI Act | No |
| Maximum penalty | €35M or 7% of global turnover | Varies by law and agency |
| Who enforces | European AI Office and national authorities | FTC, EEOC, SEC, state attorneys general |
| Transparency rules | Mandatory, with set dates | State by state, sector by sector |
| Biggest open question | Timeline adjustments and enforcement capacity | Federal preemption of state law |
Courts Are Writing AI Law Too
Statutes aren’t the only source of AI law. Courts are deciding key questions case by case.
Copyright is the biggest battleground. Several lawsuits, including NYT v. OpenAI, test whether training AI on copyrighted material counts as fair use. Rulings here will shape how AI companies can source training data for years.
Other courts are dealing with AI-fabricated content in legal filings. More than 1,500 such cases had surfaced by mid-2026, with sanctions rising as judges lose patience.
What Businesses Should Do Now
A few steps hold up regardless of how the preemption fight ends.
Map where your AI is used. You can’t comply with rules for systems you haven’t inventoried. Classify by risk. The EU’s tiers are a useful starting point, even for companies outside Europe. Follow state laws, not just federal signals. Enforceable state rules apply today. Document your training data and decisions. Transparency duties are spreading across jurisdictions.
Rules get harder to apply as AI systems act with more autonomy. A closer look at agentic AI covers why liability and oversight questions grow once software starts taking actions on its own, not just answering questions.
Final Thoughts
AI law in 2026 is a story of two models. The EU chose one comprehensive, phased rulebook with serious penalties. The US chose executive action, agency posture, and a growing patchwork of state statutes.
Neither path is settled. Deadlines in Europe have moved. Federal preemption in the US remains contested. Courts are filling gaps in between.
The safest approach for any organization is practical. Know where your AI runs, classify the risk, track the rules that are actually enforceable today, and expect the picture to keep changing.
