The NewsRupt

Regulatory announcements and enforceable obligations are separated, reliably, by something in the region of eighteen months. Most coverage of AI regulation reports the first and implies the second. It is worth setting out where the line currently sits, and being explicit about what is settled, what is scheduled and what is merely proposed.

What is settled is narrower than the volume of commentary suggests. In the European Union, the AI Act is in force as law, with obligations phasing in on a staggered timetable rather than arriving at once: prohibitions on a defined set of unacceptable-risk practices apply first, transparency and general-purpose model obligations next, and the substantive high-risk regime later still, with the outer dates running into the second half of this decade. Guidance and harmonised standards that determine what compliance concretely requires are still being produced, which means organisations are preparing against a specification that is not finished.

What is scheduled but not yet biting includes most of the high-risk conformity-assessment machinery, the associated documentation and post-market monitoring duties, and the national enforcement capacity to supervise any of it. Supervisory authorities in several member states are still being resourced. A rule with no inspector is a rule in a weaker sense than a headline implies.

What is proposed, contested or in active revision is a longer list than a year ago. There has been visible political pressure to simplify or delay parts of the European framework on competitiveness grounds, and the outcome of that pressure is not yet resolved. In the United States, the position remains a patchwork: no comprehensive federal statute, an active and shifting executive posture, sectoral regulators applying existing law to AI-mediated decisions, and a growing set of state laws — on automated decision-making, transparency and deepfakes — that create real obligations for companies operating nationally. The United Kingdom continues with a regulator-led approach rather than a single act. China operates the most specific requirements on generative services, including labelling of synthetic content.

For an organisation trying to plan, three points follow, none of which depend on the unresolved questions.

Obligations attach to use, not to the model. Whether an application sits in a high-risk category depends on what it decides about people — employment, credit, education, essential services — not on which model is behind it. Buying a compliant model does not make an application compliant.

Documentation is the common denominator across every regime. Training and data provenance, intended purpose, evaluation results, known limitations, human oversight arrangements, incident logs. These are demanded in different words by different jurisdictions and are expensive to reconstruct retrospectively. Building them into the development process now is the cheapest available hedge and is useful regardless of how the rules settle.

Extraterritorial reach means location of establishment is a weak defence. The European framework applies to providers placing systems on the EU market and, in defined circumstances, to output used within it. Structuring around it is harder than the early commentary assumed.

The limitations of this survey should be explicit. Timelines in the European framework have been subject to active amendment discussions and specific dates should be checked against the current official text rather than against this piece. National implementation varies. The United States position can change materially with a single executive action. And nothing here is legal advice; it is a map of where the enforceable line appears to be, which is a different and more perishable thing.

The honest summary for this quarter is that very little became newly enforceable, several things moved closer, and the direction of political travel in Europe was towards simplification rather than expansion. Organisations that read the headlines as a deadline have been over-preparing on some fronts and, in documentation, under-preparing on the one that every regime will eventually ask for.