EU vs US AI regulation: federal, state and AI Act compared
The EU has one binding law applied across 27 Member States; the United States has federal policy that binds agencies, a voluntary NIST framework, and a growing set of state statutes. Colorado is included because it is the closest US analogue to the EU's high-risk approach.
Cells are generated from published records; a category showing "not recorded" means no source-backed entry exists yet, not that the jurisdiction has no rules. Scroll horizontally on small screens.
Obligation overlap: EU and US
Recorded duties by category. A category both sides record is where evidence can be reused; one side only is new work for that side. Binding / voluntary counts.
| Category | EU | US | Overlap |
|---|---|---|---|
| Transparency and disclosure | 8 binding / 0 voluntary | 1 binding / 0 voluntary | Both |
| Governance and accountability | 8 binding / 0 voluntary | 0 binding / 1 voluntary | Both |
| AI risk management | 1 binding / 0 voluntary | 1 binding / 1 voluntary | Both |
| Public-sector use and procurement | 1 binding / 0 voluntary | 1 binding / 0 voluntary | Both |
| Impact assessment | 1 binding / 0 voluntary | 0 binding / 1 voluntary | Both |
| Safety testing and evaluation | 1 binding / 0 voluntary | 0 binding / 1 voluntary | Both |
| Incident reporting and handling | 3 binding / 0 voluntary | — | EU only |
| Record keeping and logging | 3 binding / 0 voluntary | — | EU only |
| Technical documentation | 3 binding / 0 voluntary | — | EU only |
| Accuracy, robustness and cybersecurity | 2 binding / 0 voluntary | — | EU only |
| Data governance and quality | 2 binding / 0 voluntary | — | EU only |
| Post-market monitoring | 2 binding / 0 voluntary | — | EU only |
| Vendor and supply-chain governance | 2 binding / 0 voluntary | — | EU only |
| AI literacy and training | 1 binding / 0 voluntary | — | EU only |
| Conformity assessment and registration | 1 binding / 0 voluntary | — | EU only |
| Copyright and training-data transparency | 1 binding / 0 voluntary | — | EU only |
| Human oversight | 1 binding / 0 voluntary | — | EU only |
| Privacy and personal-data protection | 1 binding / 0 voluntary | — | EU only |
| Prohibited practices | 1 binding / 0 voluntary | — | EU only |
| Quality management system | 1 binding / 0 voluntary | — | EU only |
If you comply with the European Union, what is left for the United States?
Check, don't redo: 3 binding duties in categories both record
The same control usually serves both; the provisions differ, so each is listed with its reference.
- Federal agencies must review and revise actions inconsistent with the new AI policy
- Apply minimum risk-management practices to high-impact AI
- Publish an annual AI use-case inventory
Computed from recorded duties by category. Overlap by category is not equivalence: read each provision before treating evidence as reusable. The applicability matrix template lists every binding instrument by jurisdiction.
Frequently asked questions
Which has stricter AI rules, the European Union or the United States?
The European Union records 1 binding AI instrument and the United States records 3. Strictness also depends on scope and enforcement, which the table sets out row by row with links to each record.
If we comply with the European Union, what is left for the United States?
No binding duty recorded for the United States falls outside the categories the European Union already binds; the remaining work is checking 3 shared duties against their own provisions.
Where does this comparison come from?
From the published records for both jurisdictions: instruments, obligations, deadlines and official sources. When a record changes, the comparison changes with it.
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.