The laws that have arrived

Five approaches

By 2025 the rules had arrived in five recognisable shapes, and it is worth knowing each precisely enough to know what it asks of the tools you use. This is a description of law as it stood, not legal advice, and the dates were still moving as this was written.

The European Union: regulate the use, by risk

The EU’s AI Act entered into force in August 2024 and applies in stages. It sorts uses of AI into tiers.

Banned, from February 2025: social scoring by governments, systems that manipulate people to their harm, untargeted scraping of faces from the internet to build recognition databases, emotion recognition in workplaces and schools, and real-time remote facial recognition by police except in narrow cases.

High-risk, with most obligations from August 2026: AI used in hiring, education, credit, essential services, law enforcement, migration and justice. Providers must manage risk, govern their data, keep logs, allow human oversight and pass a conformity assessment before deployment. In late 2025 the Commission proposed delaying parts of this timetable, and the dates were being renegotiated.

Transparency duties: a chatbot must tell you it is one; generated media must be marked in a machine-readable way, which is the watermark lesson made law; deepfakes must be labelled.

General-purpose models (the frontier models themselves) from August 2025: documentation, a copyright policy that honours rights-holders’ opt-outs, and a published summary of training data; the largest must also run evaluations and report serious incidents. Fines run to seven per cent of global turnover.

India: existing law, advisories and a data act

India has no AI statute. Three things do the work. The Digital Personal Data Protection Act of 2023, with rules notified in late 2025, governs personal data and makes an organisation responsible for what it hands to a chatbot. The intermediary rules under the IT Act oblige platforms to act on unlawful content, including synthetic media. And the ministry’s advisories: one in March 2024 initially required government permission before deploying an “under-tested” model in India, was widely criticised, and was revised within a fortnight to drop the permission and keep the labelling. A draft rule in late 2025 proposed mandatory, prominent labels on synthetic content. Sector regulators (the central bank, the securities regulator) issue their own guidance. The approach is deliberately light and has stayed so.

The United Kingdom: no act, existing regulators

Britain chose, in 2023, not to legislate, and to ask its existing regulators (for data, competition, communications, medicines) to apply existing law to AI in their sectors. It founded an institute in 2023 to test frontier models, renamed it in 2025 to emphasise security over safety, and has repeatedly promised and deferred an AI bill. The copyright question, in the next lesson, is where the British approach has been most contested.

The United States: no federal law, and a fight over the states

There is no federal AI statute. A 2023 presidential order requiring the largest labs to report safety tests was revoked in January 2025 and replaced by orders aimed at removing barriers. The action moved to the states: Colorado passed a law in 2024 on high-risk uses in decisions about people, with its start date delayed; California’s governor vetoed a frontier-model bill in 2024 and signed a narrower transparency law in 2025. In mid-2025 Congress considered and rejected, by a vote of 99 to 1, a ten-year ban on state AI laws. Expect the map to keep changing.

China: license the provider, label the output

China regulates through the provider. Measures in force from August 2023 require anyone offering a generative service to the public to register, to filter training data and outputs, and to uphold the state’s values in what the model says. Rules from January 2023 govern “deep synthesis”, and labelling rules in force from September 2025 require both a visible and an embedded mark on generated content. It is the most prescriptive regime and the one whose obligations fall most directly on the model’s behaviour.

What no law reaches

Every regime above addresses a provider or a deployer: a company that offers a service or a firm that uses one in a decision. None of them can reach a model file downloaded to a laptop, a model trained in another jurisdiction, or an open-weights model that has already been released and copied a million times. The open-weights lesson gave you the mechanism, and the refusal lesson later in this module gives the consequence: the safety properties of an open model are whatever its user chooses. Law can shape the compliant products; the rest is as it was.

Reading a rule

When you see that a country has “regulated AI”, ask which of the five shapes it took: risk tiers on uses, existing law applied, advisories, provider licensing or labels. Ask whether it reaches the model, the service or the decision. And ask what date it applies from, because the gap between passing and applying has been two years in the most developed regime and the schedule is still moving.