Regulating AI

Why governments write rules for AI, the four main ways they do it, and what the EU, the US, China and others have chosen — so the next headline about an “AI law” makes sense.

Imagine you apply for a housing loan and are turned down in seconds. Nobody at the bank can tell you why: a scoring system decided. Was it fair? Was it even legal? Who would you complain to — the bank, the company that sold the software, or the people who trained the model on data from somewhere else entirely? Questions like these are why, after decades of leaving AI largely alone, governments around the world have started writing rules. They have not all reached the same answers.

This page explains laws and policies in plain language for general understanding. It is not legal advice. Laws on AI are changing quickly; check the official text or a qualified adviser before relying on any detail.

Why regulate AI at all?

Much of what AI does is already covered by existing law. Fraud is fraud whether a person or a chatbot writes the message; Malaysia’s Personal Data Protection Act applies to personal data whatever software touches it (see AI in the Workplace). So why do governments think new rules are needed?

Four arguments come up again and again:

The counter-argument: rules written too early may freeze a fast-moving technology and favour large companies that can afford compliance lawyers. How a country balances these worries largely decides its approach.

Four ways to regulate

Almost every AI law or policy in the world mixes four basic tools. Tap each to see how it works and where it is used.

The words that matter are risk-based regulation and soft law. Most countries start with soft law, then move some of it into binding law as they learn where the real harms are. A popular in-between tool is the regulatory sandbox, in which a company can test a new product under a regulator’s supervision before the full rules apply.

The European Union’s AI Act

The EU AI Act (Regulation (EU) 2024/1689) is the world’s first comprehensive, cross-sector AI law. It applies to anyone who places an AI system on the EU market or whose system’s output is used in the EU — so a Malaysian company selling AI software to European customers can be caught by it. Consensus Whatever people think of its details, it has become the reference point that other countries’ debates react to.

The Act sorts AI into tiers. Climb down the ladder from the most to the least tightly controlled:

  1. Unacceptable risk — bannedSocial scoring of people; manipulative techniques that cause significant harm; exploiting people’s age, disability or circumstances; predicting crime from personality profiling alone; scraping faces from the internet or CCTV to build recognition databases; emotion recognition at work or school; inferring race, religion or sexual orientation from biometrics; and live facial recognition in public by police, except in narrow, authorised cases. A 2026 amendment adds “nudify” apps and AI that generates child sexual abuse material As of 2026.
  2. High risk — strict dutiesAI used in hiring, education, credit scoring, essential public services, policing, migration, justice and critical infrastructure, plus AI built into products such as medical devices and machinery. Providers need risk management, good-quality data, documentation, human oversight, accuracy and cybersecurity checks, and registration in an EU database.
  3. Transparency risk — tell peoplePeople must be told when they are talking to a chatbot, and AI-generated or manipulated images, audio, video and text published to inform the public must be labelled — including deepfakes.
  4. Minimal risk — no new dutiesSpam filters, game AI and most everyday tools.

Alongside the tiers sits a separate set of duties for general-purpose AI models — the large foundation models behind chatbots. Their developers must keep technical documentation, give information to companies building on them, have a policy for respecting EU copyright law and publish a summary of their training data. The most capable models, presumed to pose “systemic risk” when training used more than 1025 operations of compute, must also evaluate and reduce those risks, report serious incidents and keep strong cybersecurity. Fines for using banned practices reach €35 million or 7% of worldwide annual turnover, whichever is higher.

The Act entered into force on 1 August 2024 but applies in stages, and in 2026 the EU changed its own timetable:

  1. 1 Aug 2024Act enters into forcePublished in July 2024 as Regulation (EU) 2024/1689; obligations then phase in.
  2. 2 Feb 2025Bans and AI-literacy duty applyThe prohibited practices become unlawful. (The 2026 amendment later softened the AI-literacy duty on individual organisations into a duty on the Commission and member states to support it.)
  3. 2 Aug 2025General-purpose AI rules applyDuties for developers of general-purpose models begin, overseen by the European Commission’s AI Office; the Code of Practice had been published that July.
  4. Nov 2025“Digital omnibus” proposedWith standards and guidance not ready, the Commission proposed delaying and simplifying parts of the Act.
  5. 27 Jul 2026Amendment in forceAfter a provisional deal in May and final approval in June, Regulation (EU) 2026/1744 took effect. It moves the main high-risk deadlines back and adds new bans As of 2026.
  6. 2 Aug 2026Transparency labelling beginsChatbot disclosure and AI-content labelling duties start for new systems; systems already on the market have until 2 December 2026 to add machine-readable labels.
  7. 2 Dec 2027High-risk rules for stand-alone systemsHiring, credit, education and similar uses — originally due August 2026.
  8. 2 Aug 2028High-risk rules for AI inside regulated productsMedical devices, machinery, toys and the like — originally due August 2027.

Debated Supporters call the delay sensible housekeeping: companies cannot comply with rules whose technical standards are not yet written. Critics, including some digital-rights groups, see the EU retreating under pressure from industry and the United States.

The United States and China

The world’s two largest AI powers have taken very different routes, and the US route has changed direction more than once.

United States. There is no comprehensive federal AI law As of 2026. Policy has been driven mainly by presidential executive orders, which a later president can reverse. In October 2023 President Biden’s Executive Order 14110 required developers of the most powerful models to share safety-test results with the government. President Trump revoked it on his first day in office in January 2025 and in July 2025 published America’s AI Action Plan, centred on innovation, infrastructure and exports. In December 2025 a further order set out to challenge state AI laws seen as burdensome, creating a Justice Department “AI Litigation Task Force” in January 2026. Congress has debated overriding (“pre-empting”) state AI laws but had not done so by October 2026. One narrower federal law did pass: the TAKE IT DOWN Act of 2025 makes publishing non-consensual intimate images, including AI-generated ones, a crime and requires platforms to remove them quickly.

In that gap, the states have acted — and then revised. California’s Transparency in Frontier Artificial Intelligence Act (SB 53), signed in September 2025 and largely in effect since January 2026, requires the largest developers of frontier models to publish safety frameworks and report critical safety incidents. Colorado passed the first broad state law against algorithmic discrimination in 2024, delayed it, then in May 2026 repealed and replaced it with a narrower law focused on telling consumers when AI makes important decisions about them, due to start in January 2027 once the state’s Attorney General has made rules As of 2026. Expect this picture to keep shifting.

China. China has regulated faster and more specifically than anyone, through a series of targeted rules issued mainly by the Cyberspace Administration of China (CAC): rules on recommendation algorithms (in force March 2022), on “deep synthesis” such as deepfakes (January 2023), and the Interim Measures for generative AI services offered to the public (August 2023). Providers must file their algorithms with the regulator, carry out security assessments, and ensure content upholds “core socialist values”. Since 1 September 2025, measures on labelling AI-generated content require both visible labels and hidden labels in file metadata — similar in aim to content credentials and watermarks elsewhere. This guide’s framing China’s approach combines quick, specific rules on new technologies with state control of information; it shows that detailed AI regulation is possible quickly, but its content rules serve political purposes that democracies would not share.

Comparing the world’s approaches

Use the tabs to compare the main approaches.

Style: one comprehensive, binding, risk-based law, plus liability and data-protection law.

Strength: legal certainty and individual rights. Worry: complexity and cost; deadlines already delayed once As of 2026.

Malaysia, still relying on voluntary guidelines but preparing a risk-based AI Governance Bill, is covered in detail in AI in Malaysia.

Trying to agree internationally

AI models cross borders as easily as email, so governments have also tried to coordinate. The main milestones:

Consensus Nearly all of this is soft law: declarations, principles and voluntary commitments. It builds shared vocabulary and networks of experts, but no international body can yet enforce rules on AI.

Innovation versus safety

Underneath every argument about AI law lies one question: does regulation now protect people, or slow down benefits and hand the lead to someone else?

The question

Should a country pass a binding AI law now, or wait?

Choose one to hear its case.

Debated There is no settled answer, and the arguments cut across ordinary political lines.

Other views
  • Safety first: many AI researchers, civil-society and consumer groups argue binding rules, independent testing and liability are overdue, especially for the most capable models.
  • Innovation first: many industry leaders, investors and some governments (notably the US administration since 2025) argue that heavy regulation hurts competitiveness and that most rules should wait for evidence of harm.
  • Rights and fairness first: other critics say the “safety versus innovation” framing itself is misleading: the urgent issues are present-day discrimination, surveillance and workers’ rights, not speculative future risks (see Ethics and Bias).
  • Global South: developing countries stress access to compute, data and skills, and worry that rules written elsewhere will shape their markets without their voice.
Quick check

Under the EU AI Act, which of these is banned outright?

Emotion recognition at work and in schools is a prohibited practice. Chatbots carry a transparency duty; spam filters are minimal risk.

What did the EU’s 2026 “digital omnibus” amendment mainly do?

The Act still stands; the amendment pushed back high-risk deadlines, eased some duties and added new bans.

Which statement best describes US federal AI policy in 2026?

Executive orders have set direction and been reversed; Congress has debated pre-empting state laws but had not passed it by October 2026.

// Pause and reflect

  1. Think of one AI decision that could affect you — a loan, a job application, a school placement. Which of the four approaches would protect you best, and why?
  2. Is it better for a smaller country such as Malaysia to write its own AI law, to follow the EU’s model, or to rely on voluntary guidance for now?
  3. When a law is delayed, as the EU’s was in 2026, is that a sign of wisdom or of weakness? What would change your mind?

Your notes are saved privately in this browser.

Key terms on this page

Sources & further reading