Two Rulebooks, One Product: AI Regulation in Brussels, Washington and London After August 2026

Brussels switched on AI enforcement in August 2026 while postponing its toughest rules, and that mismatch now drives every compliance decision.

The AI rulebook is the subject of this article: what binds a company selling AI products into Europe, America and Britain in late 2026. Three regimes now apply at once and none was designed alongside the others. Brussels runs one statute with global reach, Washington runs state experiments, and London runs existing regulators. The question is which combination a mid-sized firm can satisfy.

1. The Date That Moved

The second of August 2026 is the date the EU AI Act stopped being a drafting exercise and became an operational regime. Two separate things happened that day, and conflating them is the fastest way to misjudge exposure. Article 50 transparency duties came into force, and the enforcement machinery switched on, meaning the AI Office and national market surveillance authorities gained their powers and general purpose model supervision began. What did not happen is the part most compliance teams had built their calendars around. The high-risk track, covering recruitment, credit, education and safety components, was postponed to 2 December 2027 and 2 August 2028 respectively.

Anyone who planned against the original calendar now has a hole where their plan used to be. The transparency duties landed on time, the high-risk duties did not, and the difference matters commercially. A recruitment platform that spent two years preparing conformity assessment for an Annex III system can stand down that work until December 2027, but it still has to meet Article 50 now. A bank that assumed 2026 was the year for credit scoring documentation is wrong in one direction and right in another. The schedule moved; the obligations did not disappear. Planning confusion, not enforcement intensity, is the immediate risk for most firms.

2. Four Dates Moved

The mechanism of the postponement is worth naming, because it tells you how stable the underlying rules are. Regulation (EU) 2026/1744, the Digital Omnibus on AI, was adopted in June 2026. It moved four application dates and changed nothing else in substance. That is the important sentence. The text of the obligations is settled; the timetable is political. A firm that reads only the launch announcement from 2024 will have the wrong dates, and a firm that reads only the amendment will assume the rules are still being argued over. Both readings fail in the same way, by treating a schedule change as a substantive change.

Four dates moved. The high-risk obligations for standalone Annex III systems now land on 2 December 2027, and for AI embedded in regulated products on 2 August 2028. Legacy general purpose models already on the market were given until 2 August 2027 to comply. A new prohibited practice, numbered nine in Article 5, takes effect in December 2026. Everything else holds. The prohibitions in Article 5 have applied since 2 February 2025, and the general purpose model obligations since 2 August 2025. Read together, the amended text says Brussels has finished writing the regime and is now managing, not writing, the date when industry meets it.

3. What Switched On

Enforcement quality changed on 2 August 2026, not just timing. The AI Office and the national market surveillance authorities gained their powers, and general purpose model supervision began. Each member state had to establish at least one national AI regulatory sandbox by that date, under Article 57. Ireland created an AI Office under its AI Regulation Bill 2026, expected to be operational by 2 August 2026, alongside its competent authorities. An institution now sat on the other side of the obligation. That matters more than the calendar, because a duty without an enforcer is a design preference and a duty with one is a cost.

Transparency is the obligation most firms have to meet immediately. Article 50 duties require disclosure when a person interacts with an AI system, when synthetic content is generated, and when emotion recognition or biometric categorisation is used. These are not deferred to 2027 under any reading. They apply now, to systems already in the market, and they apply to providers placing systems on the EU market wherever those providers are established. A model built in California or London is in scope if its output is used in the European Union. That is why a British or American compliance officer cannot treat the Act as foreign.

4. Fines And Borders

The penalty structure explains the asymmetry. Fines are tiered. The headline maximum is 35 million euros or 7 per cent of global annual turnover, whichever is higher, and that top tier belongs to the Article 5 prohibited practices. Other tiers run at 15 million euros or 3 per cent, and 7.5 million euros or 1 per cent. There is a proportionality rule for small and medium firms, and two separate fine regimes, under Article 99 and Article 101. The top tier is the number that appears in board papers, and it is the one that makes a voluntary compliance programme cheaper than a contested enforcement case.

Two features of the EU regime do most of the commercial damage. The first is territorial reach: the Act applies to providers placing systems on the EU market wherever they are established, so a Californian or London developer is captured by the output it sells into Europe. The second is the fine ceiling, which is expressed as a share of global turnover rather than a share of European revenue. Together, those features mean a firm with modest EU sales but substantial worldwide turnover faces a penalty calculated on the larger number, so the size of the European footprint does not determine the size of the exposure.

5. America Is Fragmented

There is no federal AI statute in the United States. Thirty-eight states passed more than one hundred AI-related laws in 2025, and the effect is a patchwork harder to manage than a single national regime. A single statute gives you one text to build against. A patchwork gives you thirty-eight, and in practice you build to the strictest state and then defend that choice in every other one. This is not a gap in regulation; it is a different shape of regulation, and it lands on the same teams that must satisfy Brussels. Compliance cost scales with the number of regimes, not with their severity.

Three state frameworks matter most in 2026, and all three became effective on 1 January 2026. Texas took a prohibited-use approach. California went after frontier risk. Colorado tried a general duty of reasonable care and then delayed its own start date. Below those three sit narrower layers that still bind specific functions: Illinois HB 3773 on AI in employment, Utah's SB 149 AI Policy Act, and New York City's bias audit requirement for automated employment decision tools. None of these is optional for a firm operating nationally, and none maps cleanly onto the EU categories, so the mapping work has to be done twice over.

6. Texas And California

Texas passed the Responsible AI Governance Act, HB 149, codified in Texas Business and Commerce Code Chapter 552. It took effect on 1 January 2026 as a prohibited-use model rather than a broad regulatory regime. It bans AI used for manipulative, discriminatory or unlawful purposes, bans intentional harm, social scoring and child sexual abuse material deepfakes, and requires state agencies to disclose AI interactions to consumers. Enforcement sits solely with the Attorney General. For a private firm the consequence is narrower than the EU Act but sharper: there is no administrative sandbox and no grace period, only a state law officer deciding whether a use is banned.

California passed Senate Bill 53, the Transparency in Frontier Artificial Intelligence Act, signed on 29 September 2025 and effective 1 January 2026. It requires large frontier developers to write, implement and conspicuously publish a frontier AI framework on their website, and to report dangerous model incidents to a state regulator. It is the first US statute aimed at catastrophic risk rather than consumer harm. Only the largest developers are in scope, which limits the burden on most firms, but it sets a disclosure expectation that procurement teams elsewhere are already borrowing. Contract questionnaires now ask for that framework even when the buyer sits outside California.

7. Colorado And Preemption

Colorado is the clearest example of how unsettled American AI law is. The Colorado AI Act was originally due to take effect on 1 February 2026, was delayed to 30 June 2026 by an August 2025 special session, and after further amendments now lands on 1 January 2027. It is also under constitutional challenge: xAI filed suit on 9 April 2026, and the Department of Justice intervened on xAI's side on 24 April 2026. Planning against a rule that may be struck down is a real cost, because the work is not optional while the challenge is pending and may be wasted when it ends.

The preemption fight is unresolved, and that is the real risk. An executive order on state AI preemption was signed on 11 December 2025, twenty days before the January 2026 frameworks activated, and a Department of Justice AI Litigation Task Force was stood up to challenge state laws. As of 26 August 2026, no federal statute and no court had preempted or paused any state AI law. A firm cannot plan on preemption and cannot ignore the state laws meanwhile. The rational response is to build to the texts as written and keep the record portable, so a future federal change is a simplification, not a rewrite.

8. London And The Lesson

The UK has no AI Act. The government has kept a deliberately sectoral, pro-innovation approach in which existing regulators handle AI within their own remits, rather than a single cross-cutting statute, and that position was still the government line through 2026. The UK has an AI Safety Institute and a policy agenda built around adoption and growth. The practical effect is that a UK company selling into the EU is regulated by Brussels the moment its output is used there, while its purely domestic competitors are not. That asymmetry is a market condition, not a philosophical point.

For a mid-sized company the work is concrete. Classify what you are shipping. Keep a technical file. Decide who is the provider and who is the deployer. Meet the Article 50 transparency duties now rather than in 2027. Write the origin of each obligation into the contract, so a customer in Ohio and a customer in Ireland each carry their own regulatory weight. The final lesson is about reading. Regulation is a design input with a publication date, and the firms that do best read the amended text, not the launch announcement. That habit is dull, and it is the one that survives contact with an enforcement office.

Tags

#ai #business