TL;DR: Most AI regulation follows one idea: the more harm a system can do, the more obligations its builders carry. The EU wrote that into a comprehensive risk-tiered law, the AI Act; the US leans on sector regulators and state laws instead. For builders, the work is the same either way - know your use case's risk level, document, test, and keep humans over consequential decisions.
How it works
A chatbot that recommends movies and a model that screens job applicants can run on the same technology - but only one of them can quietly deny someone a livelihood. Regulators key on that difference: nearly every framework regulates the use, not the underlying tech. The clearest example is the EU AI Act, the first comprehensive AI law, which sorts systems into tiers - a small set of practices banned outright (such as social scoring by governments), high-risk uses like hiring, credit, and medical applications that carry real obligations (risk management, data governance, documentation, human oversight, accuracy testing), lighter transparency duties such as telling people they are talking to an AI, and minimal-risk uses left mostly alone. General-purpose model providers get their own documentation and safety duties, scaled up for the most capable models.
The US has taken the opposite structural approach: no single omnibus law, but sector regulators applying existing law to AI uses - employment discrimination rules to hiring tools, credit law to lending models, medical device review to clinical AI - with a growing patchwork of state laws layered on top. Between the two poles, many jurisdictions publish standards and frameworks rather than statutes; the NIST AI Risk Management Framework is the most influential of the voluntary ones, and shows up in contracts and procurement even where no law requires it.
For builders, the practical playbook falls out of the pattern. First, classify your use case honestly - it is the use, not the model, that sets your obligations, and deployers carry duties of their own, not just model providers. Then do the things every framework converges on: document your system and the models inside it (this is where model cards earn their keep), test it with real evals rather than vibes, and put human-in-the-loop review over decisions that affect people's rights or money. Teams with a working responsible AI program tend to find that most compliance work is already done.
Where it sits in the AI stack
Regulation sits above the technical stack, pushing obligations down through everyone who builds on it:
Key frameworks and rulebooks
-
EU AI Act
The comprehensive risk-tiered law: banned practices, regulated high-risk uses, transparency duties.
-
NIST AI RMF
The influential voluntary US framework for mapping, measuring, and managing AI risk.
-
Sectoral enforcement
Existing employment, credit, and medical regulators applying their current law to AI uses.
-
Management standards
Certifiable AI governance standards, like ISO/IEC 42001, that organizations adopt to prove process.
Related entries
- Responsible AI The organizational practice of building AI systems that are fair, transparent, and accountable.
- Model cards A structured document describing an AI model's intended use, training data, evaluations, and known limitations.
- AI safety The practice of preventing AI systems from causing harm, from everyday failures to large-scale misuse.
- Evals (AI evaluations) Structured tests that score an AI system's outputs so teams can measure quality and catch regressions.