AI Regulation

AI Regulation

Disclaimer: This skill provides general educational information about legal topics relevant to software development. It is not legal advice. Laws vary by jurisdiction and change frequently. Always consult a qualified attorney licensed in the relevant jurisdiction before making legal decisions for your organization.

Overview

AI regulation is the fastest-moving area of technology law. The EU AI Act is the first comprehensive AI law globally, but jurisdictions worldwide are rapidly developing their own frameworks. Any company deploying AI/​ML must track these regulations to avoid penalties, reputational damage, and market access restrictions. The regulatory landscape ranges from binding legislation with significant fines to voluntary frameworks and sector-specific guidance.

Global AI Regulation Landscape

EU AI Act Risk Classification

EU AI Act Key Obligations for High-Risk AI Systems

1. Risk management system — Establish and maintain a continuous risk management process throughout the AI system's lifecycle, identifying and mitigating risks to health, safety, and fundamental rights.
2. Data governance — Ensure training, validation, and testing datasets are relevant, representative, free of errors, and complete. Address potential biases in datasets.
3. Technical documentation — Prepare detailed documentation before the system is placed on the market, including system description, development process, monitoring, and performance metrics.
4. Record-keeping — Implement automatic logging of events (logs) throughout the system's lifecycle to enable traceability and auditability.
5. Transparency to users — Provide clear and adequate information to deployers, including system capabilities, limitations, intended purpose, and human oversight requirements.
6. Human oversight — Design the system so that it can be effectively overseen by natural persons, including the ability to understand, monitor, and override the system's outputs.
7. Accuracy, robustness, and cybersecurity — Ensure the system achieves appropriate levels of accuracy, is resilient to errors and attacks, and maintains cybersecurity throughout its lifecycle.
8. Conformity assessment — Undergo a conformity assessment procedure (self-assessment or third-party audit depending on the use case) before placing the system on the market.
9. CE marking — Affix the CE marking to high-risk AI systems that have passed conformity assessment, indicating compliance with the regulation.
10. Post-market monitoring — Establish a post-market monitoring system to collect and analyze data on the system's performance and compliance throughout its operational life.

EU AI Act General-Purpose AI (GPAI) Models

The EU AI Act introduces specific obligations for providers of general-purpose AI models (foundation models), including large language models:

• Transparency obligations — Provide technical documentation, usage instructions, and information about the model's capabilities and limitations to downstream providers.
• Technical documentation — Maintain detailed documentation of the training process, design choices, testing, and evaluation results.
• Copyright compliance — Implement a policy to comply with EU copyright law, including the text and data mining opt-out provisions. Provide a sufficiently detailed summary of training data content.
• Systemic risk assessment — GPAI models with significant capabilities (defined by compute thresholds or Commission designation) must additionally perform model evaluations, assess and mitigate systemic risks, conduct adversarial testing, report serious incidents, and ensure adequate cybersecurity protections.

US AI Landscape

The United States takes a sectoral approach to AI regulation rather than a single comprehensive law:

• Executive Order 14110 (October 2023) — Directs federal agencies to develop AI safety and security standards, requires safety testing and reporting for powerful AI models, establishes AI governance across federal agencies, and tasks NIST with developing AI standards.
• NIST AI Risk Management Framework (AI RMF) — A voluntary framework for managing AI risks organized around four functions: Govern, Map, Measure, and Manage. Widely referenced as a baseline for responsible AI.
• Sectoral enforcement — Existing regulatory agencies apply current law to AI:
  • FTC — Enforces against unfair or deceptive AI practices under Section 5 of the FTC Act, including algorithmic bias in consumer products.
  • EEOC — Issues guidance on AI in employment decisions, including ADA implications of AI-driven hiring tools.
  • FDA — Regulates AI/​ML-based software as a medical device (SaMD) under existing frameworks.
  • SEC — Monitors AI use in financial services, including algorithmic trading and robo-advisors.
• State laws — Colorado AI Act (SB 24-205) is among the first state laws specifically targeting high-risk AI in employment and insurance decisions, requiring impact assessments, transparency, and risk management for developers and deployers.

Compliance Timeline

Best Practices

• Recognize that AI regulation is rapidly evolving and requires ongoing legal counsel. The regulatory landscape is changing on a quarterly basis. Engage legal advisors who specialize in AI law and monitor legislative developments in every jurisdiction where you operate.
• Classify your AI systems by risk level early in the development process. Understanding whether your system falls into the high-risk, limited-risk, or minimal-risk category under the EU AI Act (and equivalent frameworks) determines your compliance obligations.
• Implement a comprehensive AI risk management framework. Adopt a structured approach such as the NIST AI RMF to govern, map, measure, and manage AI risks across your organization.
• Design for human oversight from the start. Build mechanisms that allow humans to understand, monitor, intervene in, and override AI system outputs. This is both a regulatory requirement and an engineering best practice.
• Maintain thorough documentation of your AI system's lifecycle. Document training data provenance, model architecture, testing methodology, evaluation results, known limitations, and deployment decisions. This documentation is essential for conformity assessments and audits.
• Conduct bias and fairness assessments regularly. Test your AI systems for discriminatory outcomes across protected characteristics. Document the results and remediation steps taken.
• Implement transparency measures appropriate to your system's risk level. At minimum, inform users when they are interacting with an AI system. For high-risk systems, provide detailed information about the system's purpose, capabilities, limitations, and the role of human oversight.
• Monitor your deployed AI systems continuously. Post-market monitoring is a legal requirement under the EU AI Act and a best practice globally. Track performance metrics, log incidents, and maintain feedback loops to detect model drift and emergent risks.