AI Policy Tracker: How the EU AI Act Differs from the US Executive Order

Ask two regulators what a rulebook should accomplish and you will get two different answers. One drafts a single statute that governs an entire market and sorts technology by the risk it carries. The other leans on agencies that already exist, plus standards, courts and market pressure, to handle problems case by case. That split explains most of what separates the European Union's rulebook from the American executive order — not only what each forbids, but who has to prove what, and to whom.

A statute versus a directive

The European Union chose a regulation: Regulation (EU) 2024/1689, the AI Act, in force since August 2024. Because it is a regulation and not a directive, it applies directly in every member state without waiting for national parliaments to pass their own versions. Its duties arrive in waves rather than all at once — first the prohibitions, then rules for general-purpose models, then the heaviest obligations for high-risk systems.

The American executive order signed in October 2023 took a structurally lighter path. It leaned on powers agencies already had and required developers of the largest models to report certain safety and security information. It was rescinded in January 2025 and replaced by an order built around removing barriers to American leadership. The practical consequence is that no single federal statute governs the field today. Agencies, states, courts and voluntary standards fill the space.

Who has to comply

Scope is where the two approaches separate fastest. The European rules follow the system, not the company's mailing address: a provider based outside the EU is covered when the system's output is used inside the EU. Duties are also split by role, and providers of general-purpose models carry requirements of their own.

• EU: providers, deployers, importers and distributors, plus general-purpose model providers — including non-EU firms whose output reaches European users.
• US executive order: chiefly federal agencies, with reporting duties aimed at developers of the largest frontier models.
• US states: a widening patchwork. Colorado's law, for instance, targets high-risk uses in areas such as hiring and lending, and other states have taken their own routes.
• Voluntary frameworks: NIST's risk management framework is not mandatory, yet it is frequently cited as a benchmark for reasonable practice.

Two ways to sort risk

The European ladder

The European rules sort systems into four tiers. At the top sit prohibited practices: social scoring by public authorities, manipulative techniques that exploit vulnerabilities, several biometric uses, and emotion recognition in workplaces and schools. Below that is the high-risk category, listed in an annex and covering areas such as recruitment, credit scoring, education, essential public services, critical infrastructure, and parts of migration and law enforcement. Then comes limited risk, which is mostly about transparency — a chatbot should make itself known, and synthetic or altered media should be labelled. Everything else falls into the minimal tier and carries few obligations.

The American patchwork

The executive order never created a ladder. Instead, harm is handled where it lands. A hiring tool runs into equal employment rules and state law; a lending model runs into fair lending rules; a diagnostic tool runs into medical device oversight; a misleading claim about what a product can do runs into consumer protection enforcement. The upside is speed and flexibility. The downside is that a small company may face no framework at all until something breaks, while a large one may face several regulators at once with different expectations.

The European model asks a company to demonstrate risk management before deployment. The American model tends to ask questions after something has gone wrong.

Enforcement: penalties versus persuasion

In Europe, enforcement runs through national market surveillance authorities, coordinated with a central office. High-risk systems are expected to arrive with technical documentation, a risk management process, human oversight, logging, and a conformity assessment that supports a CE mark. Penalties reach up to €35 million or 7% of global annual turnover for the most serious breaches, with lower ceilings for other duties.

In the United States, the levers are different. The Federal Trade Commission can pursue unfair or deceptive practices. State attorneys general can enforce state statutes. Private litigation does a lot of the work. Sector regulators police their own corners. There is no general pre-market approval and no single filing a company must make before selling a system, which means the risk profile is less about passing a gate and more about surviving scrutiny later.

What this means if you build or buy

• Inventory systems by use, not by vendor. Two products from the same supplier can land in different tiers once you look at what they actually do with data about people.
• Map your role. Provider, deployer, importer and distributor carry different duties in Europe, and one company can hold more than one role for the same product.
• Write contracts that allocate evidence, not just liability. Ask who produces documentation, who keeps logs, who handles an incident, and who answers a regulator.
• Assume documentation will be requested. Even where it is not required, records of testing, decisions and oversight are what make a defense possible.
• Watch the calendar. Phased rules mean obligations keep arriving, and a system that is fine this year may be in scope next year.

A short practical checklist

1. Verify the current legal position before you rely on it. Executive orders can be rescinded with a signature; regulations move more slowly but hold. Confirm what is in force this quarter.
2. Classify each system against the strictest regime you might touch, not the loosest.
3. Keep a one-page record per system: purpose, data used, affected people, human review, known limits, and an owner.
4. Give one person clear responsibility for regulatory changes and a fixed quarterly review date.
5. Revisit the assessment before every major change to a model, a dataset or a use case.

This is a general overview, not legal advice, and the rules are moving. If a system affects hiring, credit, health, education or access to public services, bring in qualified counsel early — the cost of a review is almost always smaller than the cost of an inquiry.

Photo: Felix-Mittermeier / Pixabay