{"course":{"slug":"ai-actually-explained","title":"AI, Actually Explained","url":"https://addaly.com/learn/ai-actually-explained","level":"beginner","track":"start"},"lesson":{"slug":"the-laws-that-have-arrived","title":"The laws that have arrived","url":"https://addaly.com/learn/ai-actually-explained/the-laws-that-have-arrived","position":84,"of":92,"minutes":10,"answer":"Europe regulates AI by the risk of its use, in tiers with dates; India, Britain and the United States apply existing law with advisories and state-by-state rules; China licenses providers and requires labels.","keyIdea":"Europe regulates AI by the risk of its use, in tiers with dates; India, Britain and the United States apply existing law with advisories and state-by-state rules; China licenses providers and requires labels; and none of them can reach a model file on a laptop."},"body":{"format":"markdown","text":"## Five approaches\n\nBy 2025 the rules had arrived in five recognisable shapes, and it is worth knowing each precisely enough to know what it asks of the tools you use. This is a description of law as it stood, not legal advice, and the dates were still moving as this was written.\n\n## The European Union: regulate the use, by risk\n\nThe EU's AI Act entered into force in August 2024 and applies in stages. It sorts uses of AI into tiers.\n\n**Banned**, from February 2025: social scoring by governments, systems that manipulate people to their harm, untargeted scraping of faces from the internet to build recognition databases, emotion recognition in workplaces and schools, and real-time remote facial recognition by police except in narrow cases.\n\n**High-risk**, with most obligations from August 2026: AI used in hiring, education, credit, essential services, law enforcement, migration and justice. Providers must manage risk, govern their data, keep logs, allow human oversight and pass a conformity assessment before deployment. In late 2025 the Commission proposed delaying parts of this timetable, and the dates were being renegotiated.\n\n**Transparency** duties: a chatbot must tell you it is one; generated media must be marked in a machine-readable way, which is the watermark lesson made law; deepfakes must be labelled.\n\n**General-purpose models** (the frontier models themselves) from August 2025: documentation, a copyright policy that honours rights-holders' opt-outs, and a published summary of training data; the largest must also run evaluations and report serious incidents. Fines run to seven per cent of global turnover.\n\n## India: existing law, advisories and a data act\n\nIndia has no AI statute. Three things do the work. The Digital Personal Data Protection Act of 2023, with rules notified in late 2025, governs personal data and makes an organisation responsible for what it hands to a chatbot. The intermediary rules under the IT Act oblige platforms to act on unlawful content, including synthetic media. And the ministry's advisories: one in March 2024 initially required government permission before deploying an \"under-tested\" model in India, was widely criticised, and was revised within a fortnight to drop the permission and keep the labelling. A draft rule in late 2025 proposed mandatory, prominent labels on synthetic content. Sector regulators (the central bank, the securities regulator) issue their own guidance. The approach is deliberately light and has stayed so.\n\n## The United Kingdom: no act, existing regulators\n\nBritain chose, in 2023, not to legislate, and to ask its existing regulators (for data, competition, communications, medicines) to apply existing law to AI in their sectors. It founded an institute in 2023 to test frontier models, renamed it in 2025 to emphasise security over safety, and has repeatedly promised and deferred an AI bill. The copyright question, in the next lesson, is where the British approach has been most contested.\n\n## The United States: no federal law, and a fight over the states\n\nThere is no federal AI statute. A 2023 presidential order requiring the largest labs to report safety tests was revoked in January 2025 and replaced by orders aimed at removing barriers. The action moved to the states: Colorado passed a law in 2024 on high-risk uses in decisions about people, with its start date delayed; California's governor vetoed a frontier-model bill in 2024 and signed a narrower transparency law in 2025. In mid-2025 Congress considered and rejected, by a vote of 99 to 1, a ten-year ban on state AI laws. Expect the map to keep changing.\n\n## China: license the provider, label the output\n\nChina regulates through the provider. Measures in force from August 2023 require anyone offering a generative service to the public to register, to filter training data and outputs, and to uphold the state's values in what the model says. Rules from January 2023 govern \"deep synthesis\", and labelling rules in force from September 2025 require both a visible and an embedded mark on generated content. It is the most prescriptive regime and the one whose obligations fall most directly on the model's behaviour.\n\n> Figure: When the obligations actually start. Timeline: Jan 2023, China's deep synthesis rules take effect; Aug 2023, China requires generative services to the public to register and filter; Aug 2024, The EU AI Act enters into force, applying in stages; Feb 2025, EU bans apply: social scoring, untargeted face scraping, emotion recognition at work and school; Aug 2025, EU duties on general-purpose models: documentation, a copyright policy, a training-data summary; Sep 2025, China requires both a visible and an embedded label on generated content; Aug 2026, Most EU high-risk obligations (hiring, credit, education, essential services) were due to apply. The gap between passing a law and applying it has been two years in the most developed regime, and parts of that schedule were being renegotiated as this was written. Every one of these reaches a provider or a deployer. None reaches a model file already downloaded to a laptop.\n\n## What no law reaches\n\nEvery regime above addresses a *provider* or a *deployer*: a company that offers a service or a firm that uses one in a decision. None of them can reach a model file downloaded to a laptop, a model trained in another jurisdiction, or an open-weights model that has already been released and copied a million times. The open-weights lesson gave you the mechanism, and the refusal lesson later in this module gives the consequence: the safety properties of an open model are whatever its user chooses. Law can shape the compliant products; the rest is as it was.\n\n## Reading a rule\n\nWhen you see that a country has \"regulated AI\", ask which of the five shapes it took: risk tiers on uses, existing law applied, advisories, provider licensing or labels. Ask whether it reaches the model, the service or the decision. And ask what date it applies from, because the gap between passing and applying has been two years in the most developed regime and the schedule is still moving."},"check":{"question":"Under the EU's approach, why does a chatbot for booking restaurant tables face lighter obligations than a system that screens job applications, even if they run on the same model?","options":[{"text":"Because job-screening systems use larger models than booking systems.","correct":false,"tempting":"Puts the distinction in the model; the tiers are about the use, and the model may be identical."},{"text":"Because the law sorts uses by risk to people, and a hiring decision is high-risk while a booking is not.","correct":true},{"text":"Because restaurant chatbots are exempt as small businesses.","correct":false,"tempting":"Invents an exemption; the light duty on the booking chatbot is a transparency duty, not an exemption."},{"text":"Because job-screening systems were mostly built before the law took effect and must be re-certified under it.","correct":false,"tempting":"Confuses timing with tier; the obligations follow from the category of use whenever the system was built."}]},"prev":{"slug":"the-stack-and-its-chokepoints","title":"Four layers and their chokepoints","url":"https://addaly.com/learn/ai-actually-explained/the-stack-and-its-chokepoints"},"next":{"slug":"the-copyright-fight","title":"The copyright fight, as a fight","url":"https://addaly.com/learn/ai-actually-explained/the-copyright-fight"},"authorship":"Founder and series editor: Dr Mustafa Mun. Written by AI models to a written standard. Exam keys checked blind by a second model: 3,665 of 3,666 agreed. Academic review invited.","review":{"status":"Draft, open for academic review"},"cite":"Addaly (2026) 'The laws that have arrived', in AI, Actually Explained. Edited by M. Mun. Addaly. Available at: https://addaly.com/learn/ai-actually-explained/the-laws-that-have-arrived (Accessed: 13 October 2026).","licence":{"name":"CC BY-NC-SA 4.0","url":"https://creativecommons.org/licenses/by-nc-sa/4.0/"},"reader":{"schema":1,"title":"The laws that have arrived","courseTitle":"AI, Actually Explained","module":{"index":9,"slug":"who-decides","title":"Who controls it, and what is unsettled"},"answer":null,"keyIdea":"Europe regulates AI by the risk of its use, in tiers with dates; India, Britain and the United States apply existing law with advisories and state-by-state rules; China licenses providers and requires labels; and none of them can reach a model file on a laptop.","hero":{"kind":"figure","figure":{"t":"figure","label":"Figure","figure":{"type":"timeline","title":"When the obligations actually start","events":[{"when":"Jan 2023","what":"China’s deep synthesis rules take effect"},{"when":"Aug 2023","what":"China requires generative services to the public to register and filter"},{"when":"Aug 2024","what":"The EU AI Act enters into force, applying in stages"},{"when":"Feb 2025","what":"EU bans apply: social scoring, untargeted face scraping, emotion recognition at work and school"},{"when":"Aug 2025","what":"EU duties on general-purpose models: documentation, a copyright policy, a training-data summary"},{"when":"Sep 2025","what":"China requires both a visible and an embedded label on generated content"},{"when":"Aug 2026","what":"Most EU high-risk obligations (hiring, credit, education, essential services) were due to apply"}],"caption":"The gap between passing a law and applying it has been two years in the most developed regime, and parts of that schedule were being renegotiated as this was written. Every one of these reaches a provider or a deployer. None reaches a model file already downloaded to a laptop."},"alt":"Figure: When the obligations actually start. Timeline: Jan 2023, China’s deep synthesis rules take effect; Aug 2023, China requires generative services to the public to register and filter; Aug 2024, The EU AI Act enters into force, applying in stages; Feb 2025, EU bans apply: social scoring, untargeted face scraping, emotion recognition at work and school; Aug 2025, EU duties on general-purpose models: documentation, a copyright policy, a training-data summary; Sep 2025, China requires both a visible and an embedded label on generated content; Aug 2026, Most EU high-risk obligations (hiring, credit, education, essential services) were due to apply. The gap between passing a law and applying it has been two years in the most developed regime, and parts of that schedule were being renegotiated as this was written. Every one of these reaches a provider or a deployer. None reaches a model file already downloaded to a laptop."}},"blocks":[{"t":"h2","id":"five-approaches","runs":[{"text":"Five approaches"}]},{"t":"p","runs":[{"text":"By 2025 the rules had arrived in five recognisable shapes, and it is worth knowing each precisely enough to know what it asks of the tools you use. This is a description of law as it stood, not legal advice, and the dates were still moving as this was written."}]},{"t":"h2","id":"the-european-union-regulate-the-use-by-risk","runs":[{"text":"The European Union: regulate the use, by risk"}]},{"t":"p","runs":[{"text":"The EU’s AI Act entered into force in August 2024 and applies in stages. It sorts uses of AI into tiers."}]},{"t":"p","runs":[{"text":"Banned","b":true},{"text":", from February 2025: social scoring by governments, systems that manipulate people to their harm, untargeted scraping of faces from the internet to build recognition databases, emotion recognition in workplaces and schools, and real-time remote facial recognition by police except in narrow cases."}]},{"t":"p","runs":[{"text":"High-risk","b":true},{"text":", with most obligations from August 2026: AI used in hiring, education, credit, essential services, law enforcement, migration and justice. Providers must manage risk, govern their data, keep logs, allow human oversight and pass a conformity assessment before deployment. In late 2025 the Commission proposed delaying parts of this timetable, and the dates were being renegotiated."}]},{"t":"p","runs":[{"text":"Transparency","b":true},{"text":" duties: a chatbot must tell you it is one; generated media must be marked in a machine-readable way, which is the watermark lesson made law; deepfakes must be labelled."}]},{"t":"p","runs":[{"text":"General-purpose models","b":true},{"text":" (the frontier models themselves) from August 2025: documentation, a copyright policy that honours rights-holders’ opt-outs, and a published summary of training data; the largest must also run evaluations and report serious incidents. Fines run to seven per cent of global turnover."}]},{"t":"h2","id":"india-existing-law-advisories-and-a-data-act","runs":[{"text":"India: existing law, advisories and a data act"}]},{"t":"p","runs":[{"text":"India has no AI statute. Three things do the work. The Digital Personal Data Protection Act of 2023, with rules notified in late 2025, governs personal data and makes an organisation responsible for what it hands to a chatbot. The intermediary rules under the IT Act oblige platforms to act on unlawful content, including synthetic media. And the ministry’s advisories: one in March 2024 initially required government permission before deploying an “under-tested” model in India, was widely criticised, and was revised within a fortnight to drop the permission and keep the labelling. A draft rule in late 2025 proposed mandatory, prominent labels on synthetic content. Sector regulators (the central bank, the securities regulator) issue their own guidance. The approach is deliberately light and has stayed so."}]},{"t":"h2","id":"the-united-kingdom-no-act-existing-regulators","runs":[{"text":"The United Kingdom: no act, existing regulators"}]},{"t":"p","runs":[{"text":"Britain chose, in 2023, not to legislate, and to ask its existing regulators (for data, competition, communications, medicines) to apply existing law to AI in their sectors. It founded an institute in 2023 to test frontier models, renamed it in 2025 to emphasise security over safety, and has repeatedly promised and deferred an AI bill. The copyright question, in the next lesson, is where the British approach has been most contested."}]},{"t":"h2","id":"the-united-states-no-federal-law-and-a-fight-over-the-states","runs":[{"text":"The United States: no federal law, and a fight over the states"}]},{"t":"p","runs":[{"text":"There is no federal AI statute. A 2023 presidential order requiring the largest labs to report safety tests was revoked in January 2025 and replaced by orders aimed at removing barriers. The action moved to the states: Colorado passed a law in 2024 on high-risk uses in decisions about people, with its start date delayed; California’s governor vetoed a frontier-model bill in 2024 and signed a narrower transparency law in 2025. In mid-2025 Congress considered and rejected, by a vote of 99 to 1, a ten-year ban on state AI laws. Expect the map to keep changing."}]},{"t":"h2","id":"china-license-the-provider-label-the-output","runs":[{"text":"China: license the provider, label the output"}]},{"t":"p","runs":[{"text":"China regulates through the provider. Measures in force from August 2023 require anyone offering a generative service to the public to register, to filter training data and outputs, and to uphold the state’s values in what the model says. Rules from January 2023 govern “deep synthesis”, and labelling rules in force from September 2025 require both a visible and an embedded mark on generated content. It is the most prescriptive regime and the one whose obligations fall most directly on the model’s behaviour."}]},{"t":"h2","id":"what-no-law-reaches","runs":[{"text":"What no law reaches"}]},{"t":"p","runs":[{"text":"Every regime above addresses a "},{"text":"provider","i":true},{"text":" or a "},{"text":"deployer","i":true},{"text":": a company that offers a service or a firm that uses one in a decision. None of them can reach a model file downloaded to a laptop, a model trained in another jurisdiction, or an open-weights model that has already been released and copied a million times. The open-weights lesson gave you the mechanism, and the refusal lesson later in this module gives the consequence: the safety properties of an open model are whatever its user chooses. Law can shape the compliant products; the rest is as it was."}]},{"t":"h2","id":"reading-a-rule","runs":[{"text":"Reading a rule"}]},{"t":"p","runs":[{"text":"When you see that a country has “regulated AI”, ask which of the five shapes it took: risk tiers on uses, existing law applied, advisories, provider licensing or labels. Ask whether it reaches the model, the service or the decision. And ask what date it applies from, because the gap between passing and applying has been two years in the most developed regime and the schedule is still moving."}]}],"check":{"question":[{"text":"Under the EU’s approach, why does a chatbot for booking restaurant tables face lighter obligations than a system that screens job applications, even if they run on the same model?"}],"options":[{"text":[{"text":"Because job-screening systems use larger models than booking systems."}],"correct":false,"tempting":[{"text":"Puts the distinction in the model; the tiers are about the use, and the model may be identical."}]},{"text":[{"text":"Because the law sorts uses by risk to people, and a hiring decision is high-risk while a booking is not."}],"correct":true,"tempting":null},{"text":[{"text":"Because restaurant chatbots are exempt as small businesses."}],"correct":false,"tempting":[{"text":"Invents an exemption; the light duty on the booking chatbot is a transparency duty, not an exemption."}]},{"text":[{"text":"Because job-screening systems were mostly built before the law took effect and must be re-certified under it."}],"correct":false,"tempting":[{"text":"Confuses timing with tier; the obligations follow from the category of use whenever the system was built."}]}],"order":[0,1,2,3],"why":null},"prev":{"slug":"the-stack-and-its-chokepoints","title":"Four layers and their chokepoints","minutes":9},"next":{"slug":"the-copyright-fight","title":"The copyright fight, as a fight","minutes":12}}}