AI Regulation
Governments deciding what AI systems may do — moving fast by legislative standards, slowly by technological ones, and genuinely contested.
Reviewed July 13, 2026Stable
When not to use it
- (It's a landscape, not a tool. The question is when it applies.)*
- Assuming it doesn't apply because you're small. Obligations follow the decision, not the company size.
- Assuming it doesn't apply because you're outside the EU. The reach is extraterritorial by use.
- Treating a compute threshold as a capability measure. Efficiency rises; the threshold captures less each year.
- Reading any summary — including this one — as legal advice. It isn't. Get a lawyer if the tiers touch you.
Reach for something else instead
- (Adjacent approaches, not substitutes.)*
- Existing sectoral law — discrimination, product liability, consumer protection already apply.
- NIST AI RMF — voluntary structure, no jurisdiction required.
- Internal governance — evaluation, documentation, human oversight, whether or not anyone makes you.
- Third-party audit — the enforcement mechanism most frameworks lack.
Read more on the blog
- AI in finance: the regulator looked and stepped backBanking has had formal model risk regulation since 2011. In April 2026 the successor framework arrived and deliberately placed generative AI outside its scope. That decision is the finding.
- AI in government: 126 use cases, 65 not made publicOne agency reported 126 active AI use cases and auditors found the inventory still incomplete, with tools contracted to build criminal cases missing from it entirely.
- The EU delayed the part with no standardsThree AI Act obligations take effect today and the widely reported headline says the opposite. What was deferred, what was not, and why the split falls exactly where it does.
- The framework that exists produced 1.6%The FDA has two AI tracks. One is final, has authorised over 1,350 devices, and is the regime under which almost none of them cite a trial. The other missed its own deadline five weeks ago.
Further reading
- European Union (2024), Regulation (EU) 2024/1689 (AI Act) — the primary text; read the risk tiers rather than the coverage.
- NIST (2023), AI Risk Management Framework 1.0 — voluntary, structured, useful in any jurisdiction.
- Bommasani et al. (2021), On the Opportunities and Risks of Foundation Models — why general-purpose systems break use-based regulatory categories.
Primary sources, listed so you can check the claims on this page rather than take them on trust.
Where people go wrong
- Asking "is it AI" instead of "what decision does it affect." Every framework turns on the second.
- Assuming geography protects you. Use, not location.
- Treating documentation obligations as novel. They're model cards, made mandatory.
- Believing either side's account that this is obvious. The trade-offs are real in both directions.
At a glance
FieldSafety & Ethics
The common structurerisk tiers by use, not by technology
The trigger questionwhat decision does it affect
Reachextraterritorial, by use
The structural flawcompute thresholds are administrable and a poor capability proxy
Statusgenuinely contested
DifficultyBeginner
Often compared with
Regulating the model vs. regulating the application — a general-purpose model has no fixed use, so obligations have to attach somewhere, and neither place fits cleanly.
Where this sits
2 concepts come first. Understanding it opens up 6 more.
2Levelsteps in
2Needs firstconcepts
6Opens up2% of 310
3Areascrosses fields
Learn these firstAI Ethics
Computed from the prerequisite graph, not assigned. How this works