AI Act vs the United States: differences and what to reuse (2026)
The European Union regulates AI with a single law. The United States has no general federal law: it has state laws, sector rules and an executive order that tries to limit the states. For a company selling on both sides, what matters is knowing what you can reuse.

Two different philosophies
- EU: one law for all AI, with risk levels, specific obligations and high fines. You comply before placing the system on the market.
- US: no general federal law. State laws, sector rules (employment, credit, health) and agency action such as the FTC combine. The federal government is pursuing a lighter national framework.
What has happened at federal level
On December 11, 2025 the executive order Ensuring a National Policy Framework for Artificial Intelligence was signed. It creates a Department of Justice litigation task force (active since January 10, 2026) to challenge state AI laws, asks the Department of Commerce to identify the most “onerous” ones (due March 2026) and ties part of federal funding to states not enforcing conflicting rules. An executive order does not by itself overturn state laws: only Congress or the courts can do that, so those laws remain in force while challenges are pending. In March 2026 the White House also published a national framework with non-binding recommendations to Congress.
The state laws that matter most
- Colorado: the 2024 AI Act (SB 24-205) was delayed several times and then replaced by a narrower law, SB 189, signed on May 14, 2026 and applicable from January 1, 2027. It focuses on automated decision systems that materially influence important decisions (employment, housing, credit, insurance, health, education, public services): prior notices, explanation after an adverse outcome, record keeping and the right to human review. The attorney general enforces it, with no private right of action and a 60-day cure period.
- California (SB 53): in force since January 1, 2026. It affects developers of very large frontier models (revenue above $500 million and training above 10^26 operations): they must publish a safety framework and report serious incidents. Fines of up to one million dollars per violation.
- Texas (TRAIGA): in force since January 1, 2026; enforced by the attorney general and requires intent in discrimination claims.
- Illinois (HB 3773): since January 1, 2026, it regulates employers’ use of AI in employment decisions and allows private actions.
Quick comparison
- Scope: EU, all AI by risk. US, by state and sector.
- Prohibitions: the EU bans certain uses (social scoring, manipulation…). The US has no equivalent federal list.
- High risk: the EU defines it by use case. Colorado frames it by important decisions about people.
- Transparency: both require it, in different forms (user notices, documentation for the customer or regulator).
- Penalties: in the EU, very high fines for non-compliance. In the US they depend on the state: attorney general, no private action in Colorado and private action in Illinois.
What you can reuse
- AI system inventory with purpose, data and owner.
- Classification by risk and type of decision (does it affect employment, credit, health?).
- Technical documentation: what you prepare for the AI Act answers much of what states will ask.
- User notice and explanation of adverse decisions.
- Human oversight and incident log.
- A common reference framework: the NIST AI Risk Management Framework is the de facto standard in the US and fits the European approach.
What to watch
The federal situation keeps moving: litigation, proposals in Congress and changes to state laws. This guide reflects the information available as of October 2026; before selling in a specific state, check its current law.
Frequently asked questions
Does the AI Act apply to US companies?
Yes, if they place AI systems on the EU market or their outputs are used in the EU. The reach is similar to the GDPR’s.
Is there a federal AI law in the US?
There is no general federal law. There is an executive order and recommendations to Congress, but they have not replaced state laws.
Which standard should I use if I sell on both sides?
A common base with the AI Act as the minimum requirement and the NIST AI RMF as the risk management reference makes it easier to comply with both.
Informational content, not legal advice. AI regulation changes quickly: always check the current official text before deciding. Information reviewed as of October 14, 2026.
What's your Data Governance maturity?
Free assessment with your priority gaps and the templates on the Data Governance path.