Three ways to make rules

There are three main ways to set rules for AI. Each has a different enforcer, and each fails in its own way. Everything here is as of October 2026, and it will change.

Binding law. The EU AI Act is the broadest AI law so far. It uses a risk-based approach (show definition): the higher the risk, the stricter the rule. A short list of uses is banned, such as social scoring. High-risk uses, such as AI in hiring or education, face strict checks. Chatbots must tell you they are AI. Most AI, like spam filters, faces no new rules.

Government policy. The US has no broad federal AI law. Presidents have set direction through executive orders instead. A 2023 order on AI safety was revoked in January 2025. A December 2025 order told federal agencies to challenge state AI laws the administration saw as too burdensome. In January 2026, the Justice Department set up a task force to do that in court.

Voluntary commitments. In July 2023, seven AI companies promised the White House they would safety-test models and help people spot AI-made content. No law required it and no one enforces it. That is a voluntary commitment (show definition).

Approach	Who enforces it	Strength	Weakness
Binding law	Regulators, with fines	Applies to every company it covers	Slow to write and slow to update
Government policy	Federal agencies	Can change within weeks	Can be reversed just as quickly
Voluntary commitment	No one	Companies can act before any law exists	No penalty for breaking it