AI Policy and Regulation: EU AI Act / US EO / China's Rules Compared

By 2025, AI regulation has moved from “should there be any” to “what kind, how strict, who enforces it”.

Three jurisdictions matter most: EU, US, China. Each took a different path.

The EU AI Act (2024)

The EU passed the world’s first comprehensive AI law. Key principles:

Risk-based classification

Applications categorized:

Risk level	Examples	Treatment
Unacceptable	Social scoring, real-time biometric ID in public	Banned
High	Healthcare, education, employment, justice	Strict requirements
Limited	Chatbots, deep fakes	Must disclose AI involvement
Minimal	Spam filters, game NPCs	No requirements

Foundation models (general-purpose AI)

Models above certain compute thresholds (10^25 FLOP for training) face additional rules:

• Disclose training data
• Provide capability evaluations
• Implement risk assessments

Timeline

• August 2024: Enacted
• February 2025: Prohibited practices ban takes effect
• August 2025: General-purpose AI rules apply
• August 2026: High-risk AI rules apply
• August 2027: All provisions enforced

Penalties

• Up to €35 million or 7% global revenue for major violations
• Comparable to GDPR

The US Approach

Notably decentralized. No single federal law (yet).

Executive Order 14110 (Oct 2023, Biden)

Required AI developers to:

• Share safety test results with the government
• Report compute used to train large models
• Notify NIST about advanced AI development

Revoked (Jan 2025, Trump)

The Trump administration rescinded EO 14110, replacing it with a lighter framework focused on:

• Avoiding “regulatory burden”
• Promoting US AI competitiveness
• Voluntary safety measures

State-level

In the regulatory vacuum, US states are filling in:

• California (SB 1047 vetoed in 2024, but newer bills pending)
• New York (algorithmic discrimination in employment)
• Texas (data privacy)

NIST AI RMF

The NIST AI Risk Management Framework is voluntary but widely adopted in enterprise:

• Risk identification
• Risk management practices
• Audit-friendly

China’s Approach

China implemented AI rules faster than most, but with different priorities:

Generative AI Provisions (Aug 2023)

Requirements:

• Pre-deployment safety assessment mandatory
• Must align with socialist core values
• Must protect personal information
• Disclose data sources
• Real-name registration for users (in some applications)

Algorithmic Recommendation Rules (Mar 2022)

For platforms using AI for recommendation:

• Must allow users to opt out
• Must disclose how recommendations work
• Must protect minors

Deep Synthesis Provisions (Jan 2023)

Specifically for deep fakes:

• Mandatory watermarking
• Real-name registration

Enforcement

Strong, swift action:

• ByteDance, Alibaba, Tencent have all received warnings
• Apps occasionally removed from app stores until compliant

Side-by-Side

Dimension	EU	US	China
Approach	Comprehensive framework	Sectoral, voluntary	Top-down rules
Strictness	Strict, prescriptive	Light-touch	Mixed
Coverage	Wide (all AI uses)	Narrow (specific applications)	Wide
Focus	Rights protection	Innovation + economic competitiveness	State priorities + safety
Penalties	Heavy fines	Mostly market-based	Administrative orders
Speed	Slow process, complete	Patchwork	Fast iteration

What This Means for Developers

If you serve EU users

• High-risk applications: prepare for audit + documentation burden
• Foundation models above threshold: data + capability disclosure
• Cost of compliance: estimated €100k-€2M for high-risk app deployment

If you serve US users

• For now, lighter regulatory burden
• Watch state laws (CA, NY, TX)
• NIST RMF as voluntary north star

If you serve Chinese users

• Pre-deployment safety review mandatory
• Real-name registration may be required
• Content alignment with state priorities required
• Foreign LLMs face additional barriers (national security review)

If you serve globally

You need to comply with all three — or geofence by jurisdiction.

Specific Compliance Tasks

EU-mandated

• Conformity assessment before deployment
• CE marking (like other EU products)
• Logging and traceability for high-risk
• Human oversight documented
• Cybersecurity measures

US-friendly

• Document risks clearly
• Provide opt-out mechanisms
• Comply with state-specific rules
• Watch for federal pre-emption (could come)

China-mandated

• Filing with CAC (Cyberspace Administration of China)
• Content moderation infrastructure
• Data localization (Chinese user data stays in China)

Trends

Trend 1: Global convergence on key issues

Despite differences, three trends emerge everywhere:

• Transparency (disclose AI use)
• Accountability (someone owns the harm)
• Risk management (proportional to use case)

Trend 2: Foundation models = special treatment

EU, US (under EO 14110), China all single out frontier models for tighter rules.

Trend 3: Sector-specific regulation

Healthcare, finance, employment, autonomous vehicles — each getting their own AI rules.

Trend 4: Compute thresholds

A novel regulatory hook: model trained with more than X FLOPs = more rules. Allows distinguishing toy projects from frontier models.

Open Questions

• Whose liability? Developer, deployer, user — when AI causes harm
• International coordination? Or fragmentation forever
• Algorithmic auditing? Who certifies models — government, third parties, or industry?
• Open source treatment? Different rules for open vs closed weights?

What’s Coming

Likely in next 2-3 years

• EU AI Act fully enforced
• US federal framework (possibly fragmented but emerging)
• China continuing iteration
• More countries adopting similar frameworks (UK, Canada, Japan, India)

Watch

• AI Safety Institutes in UK, US, EU, Japan — quasi-governmental safety testing
• Bletchley / Seoul / Paris declarations — international cooperation
• Standards bodies (NIST, ISO) — technical specs

Next recommended: L6-07 AI Safety Research Entry or L6-04 Mechanistic Interpretability.