EU vs US AI regulation: federal, state and EU AI Act compared

The EU has one binding law applied across 27 Member States; the United States has federal policy that binds agencies, a voluntary NIST framework, and a growing set of state statutes. Colorado is included because it is the closest US analogue to the EU's high-risk approach.

Comparison of European Union, United States, Colorado (United States)
Category	European Union Source-linked	United States Source-linked	Colorado (United States) Source-linked
Regulatory status	Binding regulation in force and partially applicable. Prohibited practices and AI-literacy duties apply since 2 February 2025; general-purpose AI model obligations and the governance and penalties chapters since 2 August 2025; most remaining obligations, including Annex III high-risk requirements, are scheduled from 2 August 2026, with high-risk AI embedded in Annex I regulated products from 2 August 2027. A Commission "Digital Omnibus" proposal published in November 2025 would adjust some high-risk application dates; its adoption status must be checked against the official sources linked below.	Federal: executive-branch policy (Executive Order 14179 of January 2025 and the July 2025 AI Action Plan) plus binding OMB requirements for federal agencies' use and procurement of AI; NIST AI RMF is voluntary. States: a growing number of binding statutes with 2025–2026 effective dates. A reviewer must confirm the status of federal efforts to pre-empt or discourage state AI laws announced in late 2025.	Adopted state statute; originally effective 1 February 2026, delayed to 30 June 2026 by SB 25B-004 (August 2025). Enforcement is by the Colorado Attorney General. A reviewer must confirm whether the 2026 regular session made further amendments before the effective date.
Binding AI legislation	EU AI Act (Partially applicable)	EO 14179 (In force) OMB M-25-21 (In force)	Colorado AI Act (Adopted)
High-risk AI rules	19 binding, 0 voluntary Apply data governance and quality criteria to training, validation and testing data Achieve appropriate accuracy, robustness and cybersecurity Operate a quality management system Complete conformity assessment, CE marking and EU database registration Carry out a fundamental rights impact assessment before deployment Ensure AI literacy of staff operating AI systems	No high-risk tiering recorded.	4 binding, 0 voluntary Deployers must complete impact assessments for high-risk AI Notify consumers and explain adverse consequential decisions Developers must document high-risk systems and disclose known risks Deployers must implement a risk management policy and programme
Generative and general-purpose AI rules	4 binding, 0 voluntary Ensure AI literacy of staff operating AI systems Disclose AI interaction and label synthetic content Meet general-purpose AI model provider obligations Manage systemic risk for high-impact general-purpose models	0 binding, 4 voluntary Prioritise, respond to and monitor AI risks (Manage) (voluntary) Establish AI governance policies, roles and accountability (Govern) (voluntary) Map context, intended use and potential impacts (Map) (voluntary) Measure and test trustworthiness characteristics (Measure) (voluntary)	No generative-AI-specific obligations recorded.
Transparency obligations	2 binding, 0 voluntary Disclose AI interaction and label synthetic content Provide deployers with clear instructions for use	1 binding, 0 voluntary Publish an annual AI use-case inventory	1 binding, 0 voluntary Notify consumers and explain adverse consequential decisions
Impact assessment	1 binding, 0 voluntary Carry out a fundamental rights impact assessment before deployment	0 binding, 1 voluntary Map context, intended use and potential impacts (Map) (voluntary)	1 binding, 0 voluntary Deployers must complete impact assessments for high-risk AI
Data governance and personal data	1 binding, 0 voluntary Apply data governance and quality criteria to training, validation and testing data	No data-governance obligations recorded.	No data-governance obligations recorded.
Human oversight	1 binding, 0 voluntary Enable and assign effective human oversight	No human-oversight obligations recorded.	No human-oversight obligations recorded.
Public-sector requirements	Public-authority deployers must register high-risk AI use and assess fundamental-rights impact	Federal acquisition of AI must follow OMB M-25-22 Federal agencies must review and revise actions inconsistent with the new AI policy	No public-sector-specific requirements recorded.
Key effective dates	1 August 2024: Entry into force (EU AI Act) 2 February 2025: Prohibited practices and AI literacy apply (Chapters I and II) (EU AI Act) 2 August 2025: General-purpose AI, governance, notified bodies and penalties apply (EU AI Act) 2 August 2026: General application, including Annex III high-risk systems and Article 50 transparency (EU AI Act) 2 August 2027: High-risk AI as safety components of Annex I products (EU AI Act) 2 August 2027: General-purpose models placed on the market before 2 August 2025 must comply (EU AI Act) 31 December 2030: Large-scale IT systems listed in Annex X placed on the market before 2 August 2027 (EU AI Act)	22 July 2025: AI Action Plan due (180 days) (EO 14179)	17 May 2024: Signed into law (Colorado AI Act) 30 June 2026: Effective date after SB 25B-004 delay (Colorado AI Act)
Official sources	Regulation (EU) 2024/1689 (Artificial Intelligence Act) — Official Journal AI Act — European Commission policy page European AI Office	NIST AI Risk Management Framework (AI RMF 1.0) Executive Order 14179: Removing Barriers to American Leadership in Artificial Intelligence America's AI Action Plan	SB24-205 Consumer Protections for Artificial Intelligence

Cells are generated from published records; a category showing "not recorded" means no source-backed entry exists yet, not that the jurisdiction has no rules. Scroll horizontally on small screens.

AI regulation in the European Union AI regulation in the United States AI regulation in Colorado (United States)Adjust comparison

Informational only, not legal advice. Verify every claim against the linked official sources and consult qualified counsel before acting.