AI regulation and governance

The big idea

A startup builds three AI features: a chatbot that answers questions about its product, a tool that ranks job applicants for its customers, and a spam filter for its own inbox. Are they regulated the same way? Under a risk-basedAn approach to regulation in which the obligations on a system depend on how much harm its use could cause, with the strictest rules for the riskiest uses and few or none for low-risk ones. approach, clearly not. The spam filter carries almost no obligations. The chatbot must tell people they are talking to a machine. The hiring tool can shape someone's career, so it faces strict requirements before it can be sold.

That is the core idea of modern AI regulation: rules follow the use, not the technology. The same language model can sit inside a harmless writing aid or a high-stakes decision system, and the obligations differ accordingly.

Think of how food is regulated. Anyone can cook dinner at home. A restaurant needs a hygiene certificate and inspections. A factory making baby formula faces the strictest testing of all. Same ingredients, different risk, different rules.

How it works

Four tiers of risk

The European Union's AI ActThe European Union's law on artificial intelligence, in force since 1 August 2024, which sorts AI systems into risk tiers with obligations that apply in stages through 2028. is the most comprehensive example, and it sorts AI systems into four levels.

1. Unacceptable: banned Practices seen as a clear threat to people's safety and rights, such as social scoring or untargeted scraping of faces to build recognition databases, are prohibited.
2. High risk: strict requirements Uses that can seriously affect health, safety or fundamental rights, such as recruitment, credit scoring, education and critical infrastructure, need risk management, good data, logging, documentation and human oversight.
3. Transparency: tell people Chatbots must say they are AI. Generated audio, images, video and text must be marked as AI-generated, and deepfakes must be labelled.
4. Minimal: no new rules Most AI systems, such as spam filters and AI in video games, carry no new obligations under the Act.

1. Unacceptable risk: banned. The Act prohibits a short list of practices, including harmful manipulation and deception, exploiting people's vulnerabilities, social scoring, untargeted scraping of the internet or CCTV footage to build facial recognition databases, and emotion recognition in workplaces and schools. Most of these bans have applied since February 2025.
2. High risk: strict requirements. Uses that can seriously affect health, safety or fundamental rights: AI in recruitment and worker management, credit scoring, access to education, critical infrastructure, law enforcement, migration and the justice system. Before such a system goes on the market, it needs risk assessment and mitigation, high-quality training data to minimise discriminatory outcomes, activity logging, detailed documentation, clear information for the organisation using it, human oversight, and robustness, cybersecurity and accuracy.
3. Transparency risk: tell people. People must be told when they are talking to an AI system, unless it is obvious. Providers of generative systems must mark their outputs in a machine-readable way, and deepfakes and AI-written text published to inform the public on matters of public interest must be labelled ( Video and audio generation overview ).
4. Minimal risk: no new rules. The European Commission says the vast majority of AI systems used in the EU fall here, such as spam filters and AI-enabled video games.

When the rules apply

The Act applies in stages. As amended by the Digital Omnibus on AI, the Commission's timeline is:

Date	What applies
1 August 2024	The Act enters into force
2 February 2025	Definitions, AI literacy and the first prohibitions
2 August 2025	Rules for general-purpose AI models; governance bodies set up
2 August 2026	Most rules, including the transparency rules; enforcement starts
2 December 2026	A new prohibition on generating non-consensual sexual deepfakes and child sexual abuse material; deadline for marking by generative systems already on the market
2 December 2027	Rules for high-risk systems listed in Annex III, such as hiring and credit scoring
2 August 2028	Rules for high-risk AI built into regulated products, such as medical devices

Penalties are large on purpose. Breaking a prohibition can cost up to 35 million euros or 7 percent of worldwide annual turnover, whichever is higher; most other breaches, including the transparency rules, up to 15 million euros or 3 percent.

Providers and deployers

The Act puts different duties on different roles. A providerUnder the EU AI Act, the organisation that develops an AI system, or has it developed, and places it on the market or puts it into service under its own name. builds the system and sells or releases it. A deployerUnder the EU AI Act, an organisation that uses an AI system under its own authority in a professional activity. uses it professionally. If you build on a model API and ship a product under your name, you are usually the provider of that product, even though you did not train the model. Rules also reach providers outside the EU when their system's output is used in the EU.

Governance in practice

Regulation sets the floor. Day-to-day governance is the set of habits that let a team show what it built and why it is safe enough:

• Model cards and system documentation. A model cardA short document released with a model that states its intended uses, the uses it is not suited for, how it was evaluated, and how it performs across different groups and conditions. states what a model is for, what it is not for, how it was evaluated and how it performs across groups and conditions. Many providers publish them, and the same idea scales to your own features: a one-page sheet per AI system with purpose, data, evaluations, known limits and owners.
• Risk assessments. Before launch, list what could go wrong (hallucination, injection, privacy, bias, misuse), how likely and how bad it is, and what controls exist. The earlier lessons in this module are the checklist.
• Audits and evaluations. Internal or external reviews check that the documentation matches reality: re-running bias and safety evals, reviewing logs and testing controls.
• Incident handling. Have a way to report, investigate and fix failures. Under the AI Act, providers of high-risk systems must report serious incidents.
• Frameworks. Voluntary frameworks help structure all this. The US National Institute of Standards and Technology's AI Risk Management Framework, released in January 2023, organizes the work into four functions: govern, map, measure and manage. In July 2024 NIST added a profile for generative AI.

Try it

1. Which items surprised you? Notice that the chatbot and the hiring tool could use the very same model.
2. A team adds a feature that summarizes support tickets for internal staff only. Where would you place it, and what would change if the summaries started deciding which customers get refunds?

Going deeper

General-purpose models

The Act has separate rules for providers of general-purpose AI models, the large models other companies build on, which have applied since August 2025. If you only use such a model through an API to build your product, those model-level duties fall on the model provider; your duties depend on what your product does with it.

Beyond the EU

Other jurisdictions take different paths: some rely on existing consumer, privacy and anti-discrimination law, some issue sector rules (for hiring, finance or health), and some publish voluntary frameworks and standards. Rules on specific harms, such as deepfakes and election content, are spreading quickly. Practical advice for a team shipping worldwide: map each feature to its use, identify the strictest applicable rule, and keep documentation good enough to answer a regulator, an auditor or an enterprise customer's security review.

Good governance is good engineering

Most of what regulators ask for, written purpose, tested data, logs, documentation, human oversight and a way to handle incidents, is what a careful team would want anyway. Treat compliance artefacts as living engineering documents, updated with each model or prompt change, and they cost far less than reconstructing them under deadline.

Trade-offs

Common mistakes

• Assuming that using a third-party model makes you exempt. If your product is high-risk, the obligations follow the product.
• Classifying by technology ("it is just a chatbot") instead of by use ("it decides who gets a loan").
• Writing documentation once at launch and never updating it after model or prompt changes.
• Treating a published model card from your model provider as documentation of your own system.
• Relying on old deadlines: the EU timeline was amended in 2026, and other regions keep changing too.

In the wild

European Commission (policy page)

AI Act: regulatory framework for AI (opens in a new tab)

The Commission's overview explains the four risk levels, lists the prohibited practices and the high-risk use cases, and sets out the obligations for high-risk systems: risk assessment, data quality, logging, documentation, information for deployers, human oversight, and robustness, cybersecurity and accuracy. It notes that most AI systems in the EU are minimal risk, and that providers and deployers must report serious incidents.

European Commission (AI Act Service Desk)

Timeline for the implementation of the EU AI Act (opens in a new tab)

The official timeline shows the Act applying in stages from entry into force in August 2024 to full roll-out in August 2028, reflecting the amendments made by the Digital Omnibus on AI. It is the place to check dates before planning compliance work, since several deadlines moved in 2026.

Mitchell et al., 2019 (paper)

Model Cards for Model Reporting (opens in a new tab)

The paper proposes model cards: short documents released with trained models that report evaluation across different groups and conditions, the intended uses and the contexts the model is not suited for. The authors give two example cards, for a smiling-face detector and a toxic-comment classifier. The idea became a standard part of releasing models and a template for documenting AI systems.

NIST (framework)

AI Risk Management Framework (opens in a new tab)

The US National Institute of Standards and Technology released its AI Risk Management Framework in January 2023 for voluntary use, built through public consultation. Its core organizes AI risk work into four functions, govern, map, measure and manage, and a generative AI profile added in July 2024 covers risks specific to generative models.

Check yourself

Recap