AI policy and safety: a map of who sets the rules

"AI regulation" covers very different things. A new law, a voluntary standard, a court ruling, and a company's safety pledge can all make headlines the same week. They carry very different weight.

Binding laws

Laws and regulations create obligations that can be enforced, often with fines. The most comprehensive example is the European Union's AI Act (Regulation (EU) 2024/1689). It sorts AI uses by risk: some practices are banned, "high-risk" uses face requirements such as risk management and human oversight, and providers of general-purpose AI models have their own duties. The obligations apply in stages, so a story should say which part applies and from when.

Other countries and US states have passed narrower laws, for example on deepfakes, automated hiring decisions, or AI in specific sectors.

Voluntary frameworks and standards

Many widely used documents are not laws. The US NIST AI Risk Management Framework gives organizations a structure for identifying and managing AI risks. The OECD AI Principles set out shared values adopted by many governments. Technical standards bodies also publish AI standards. These can become important when laws or contracts refer to them.

Courts

Judges decide how existing law applies to AI: whether training on copyrighted work is lawful, who is liable when a system causes harm, and how privacy law applies. A ruling in one court may be appealed and may not apply elsewhere.

Company policies

AI developers publish safety frameworks, usage policies, and model evaluations. These matter, because they describe what the companies say they will do. But they are set and changed by the companies themselves.

How we report policy

We name the instrument (law, proposal, guidance, ruling, or company policy), say whether it is binding, and say when it takes effect. A proposed law is reported as a proposal until it is adopted.