Research · AI Governance, Risk & Compliance

AI Regulations: EU AI Act and US State Laws

AI regulation is arriving unevenly. The EU has a comprehensive law with shifting deadlines, while the United States has a patchwork of state laws and a federal push toward preemption. This page summarizes where things stand as of September 2026.

The Regulatory Exposure Path

AI rules now differ by jurisdiction and by the role your organization plays, and several deadlines moved during 2026. The Regulatory Exposure Path is a CorpExcellence framework that turns this uncertainty into a repeatable check. It runs in six steps, starting with your own AI inventory and ending with a dated obligation register that you revisit whenever the law changes. It gives counsel the facts needed to advise quickly.

Inventory and location

Exposure starts with what you run, not with the statute. The inventory should cover models you build or deploy, plus AI features embedded in vendor software. For each entry, record where the system is offered and whose decisions it affects. The EU AI Act reaches providers outside the EU when their systems are used in the EU, so the location of your headquarters settles very little.

Role and classification

Obligations attach to roles. The EU AI Act separates providers from deployers, and Colorado separates developers from deployers. One company can deploy a vendor hiring tool while providing its own customer chatbot. Classification then sorts each use into prohibited practices, high-risk uses such as employment and credit decisions, systems with transparency duties such as chatbots and generated content, general-purpose or frontier models, and everything else.

Dates and change

Each obligation needs an application date, an owner and the evidence that shows compliance. Because dates have moved, the register should also record which version of each law it reflects and when someone last checked it.

Where the rules stand (as of September 2026)

• EU: The Digital Omnibus on AI (Regulation (EU) 2026/1744), in force since July 27, 2026, moved high-risk obligations to December 2, 2027 for Annex III uses and to August 2, 2028 for AI in regulated products. Prohibited practices have applied since February 2, 2025. GPAI model obligations have applied since August 2, 2025, and the Commission gained enforcement powers on August 2, 2026. Most transparency duties apply from August 2, 2026, with a grace period to December 2, 2026 for machine-readable marking by generative systems already on the market.
• Colorado: SB 26-189, signed in May 2026, replaced the original Colorado AI Act before it took effect. The new law is narrower and centers on notice and explanation for automated decisions. It takes effect January 1, 2027.
• California: SB 53 (2025) requires large frontier developers to publish safety frameworks and report critical safety incidents. The state passed more AI laws in September 2026, including measures on independent verification of AI systems and a registry of AI auditors.
• Texas: TRAIGA (HB 149) took effect January 1, 2026, with enforcement by the attorney general.
• Federal: Executive Order 14365 (December 2025) created a Justice Department task force to challenge state AI laws and called for preemption legislation. Congress had not passed a preemption law as of September 2026, so state laws remain in force unless a court rules otherwise.

Common pitfalls

• Treating the Omnibus as a pause. GPAI and most transparency duties already apply.
• Building a program around the original Colorado act, which never took effect.
• Assuming an executive order has already preempted state statutes.