Who Regulates AI? A Simple Guide to a Complicated Landscape

By the TrueNorthAI team: Althea, Editor-in-Chief, with AI contributors Claude, CoPilot and Littlebird.

Last updated: September 2026. AI governance is the one subject on this site that changes monthly - this piece is dated so you know how current it is.

If you want to understand how AI is governed in the United States, imagine a map of the London Underground being used to navigate Tokyo. That is roughly the situation today: the systems we most depend on are global, fast-moving, and increasingly powerful, while the rules that govern them are fragmented, slow-moving, and written for technologies that no longer exist.

This is not because regulators are lazy or corrupt (though individual cases exist). It is because AI governance is genuinely hard. It spans multiple levels of government, multiple sectors of the economy, and multiple definitions of what “AI” even means. This article is a map of that complicated landscape - not a legal treatise, but a practical guide for real people who want to know who, exactly, is responsible for keeping these systems in check.

Most AI governance around the world falls into one of three models, though many countries blend elements of all three:

Understanding which model a country follows tells you a great deal about what its rules can and cannot do.

The United States does not have a comprehensive federal AI law. Instead, existing agencies (the FTC on deception and unfairness, the EEOC on hiring discrimination, the CFPB on lending) apply the laws they already enforce, executive actions direct agencies but bind only the executive branch, and states have filled the gap with their own laws. California’s SB 53 now requires the largest AI developers to publish safety frameworks and report serious incidents. Texas’s Responsible AI Governance Act took effect January 1, 2026. It bans AI systems built to encourage self-harm, unlawfully discriminate, or produce child sexual abuse material, and it is enforced exclusively by the Texas Attorney General, who must allow companies a 60-day period to cure violations before pursuing enforcement.

That state-by-state approach is now contested. In December 2025, Executive Order 14365 directed the Justice Department to challenge state AI laws and tied some federal funding to states dropping “onerous” rules. Colorado became the test case: after xAI sued - with the DOJ intervening on its side - state lawmakers repealed the original Colorado AI Act before it ever took effect, replacing it with a narrower, notice-based disclosure law that takes effect in January 2027. In Congress, a bipartisan draft bill would pause state rules on AI development for three years while leaving rules on deployment alone; it has not been formally introduced.

Supporters of preemption argue that fifty different rulebooks slow innovation and burden smaller companies. Critics argue that overriding state laws without a federal replacement leaves the public with no protection at all. Both concerns are real. The unresolved question is who fills the gap.

The European Union took a different approach: the AI Act, adopted in 2024, is the world’s first comprehensive AI regulation. It sorts AI systems into risk tiers:

The Act applies to any company whose AI is used in the EU, wherever the company is based - which is why it has become the de facto global standard, a phenomenon known as the “Brussels Effect.”

General-purpose models like ChatGPT and Claude have had transparency and safety obligations since August 2025. The strictest rules, for high-risk uses like hiring, credit, and education, were due in August 2026; in 2026, the EU delayed them to December 2027 (and August 2028 for AI built into regulated products such as medical devices).

Most international bodies - UNESCO, the OECD, the UN - issue principles and recommendations without enforcement power. The G7 launched the Hiroshima Process. The UK hosted the first AI Safety Summit. These efforts matter because they build consensus and vocabulary - but they are soft power in a hard-power problem.

The exception is the Council of Europe’s Framework Convention on AI, the first legally binding international AI treaty: the US, UK, and EU signed it in 2024, and the EU ratified it in May 2026. Even so, enforcement ultimately depends on each country’s own courts.

The US National Institute of Standards and Technology released its AI Risk Management Framework (RMF) in January 2023. It is voluntary. It organizes AI governance into four functions:

Its strength is specificity; its weakness is that nobody has to follow it. Texas’s Responsible AI Governance Act gives companies a legal defense if they follow the NIST AI Risk Management Framework - voluntary guidance turned into a practical shield.

Executive Order 14110 (October 2023) was the most significant US action to date. It required:

Its vulnerability is structural: an executive order binds the executive branch and can be rescinded by the next president. Executive Order 14110 was rescinded on January 20, 2025, and replaced days later by an order focused on removing barriers to AI development.

The Act entered into force in August 2024, and its obligations phase in over several years. The bans on unacceptable uses - social scoring, manipulative techniques, and emotion recognition in workplaces and schools, with medical and safety exceptions - have applied since February 2025. It restricts facial recognition databases and requires fundamental rights impact assessments for high-risk systems. Even the world’s first comprehensive AI law, in other words, arrives in installments.

AI development cycles are measured in months. Legislative cycles are measured in years. By the time a law is passed, the technology it targets has already been replaced by something its drafters never imagined.

AI systems are opaque even to their builders. Asking a legislature to write precise technical requirements for systems that evolve faster than committees can meet is asking for either vagueness (which lacks teeth) or specificity (which is obsolete on arrival).

AI governance crosses traditional ideological lines in strange ways. It touches free speech, copyright, national security, labor, and civil rights simultaneously. Coalitions that form for one issue dissolve for the next.

The White House secured voluntary commitments from major AI companies in July 2023. Seven companies promised safety testing, watermarks, and vulnerability disclosure. These commitments matter as signals, but they have three structural limits:

The pattern across history - auto safety, aviation, pharmaceuticals, food - is consistent: voluntary standards raised the floor somewhat, but binding rules with enforcement are what actually protected the public. The question for AI is not whether this pattern will repeat, but when and at what cost of waiting.

In policy documents, “responsible AI” typically bundles:

The term is doing real work, but it is also in danger of becoming what “organic” was before standards defined it: a meaningful word stretched until it loses meaning.

AI governance is not a single law to pass but a system to maintain - closer to environmental regulation or financial oversight than to a one-time product standard. The lesson from every mature governance domain is the same: start early, build capacity, expect iteration, and never mistake the absence of catastrophe for the presence of safety.