There is still no global rulebook for AI. In 2026 the European Union enforces the only comprehensive, risk-based AI law, but it has just postponed its toughest part. The United States has no federal AI law, yet its states passed a record 150 AI laws in 2025. South Korea's AI Basic Act came into force in January, China keeps tightening targeted rules, and Japan and the United Kingdom bet on promotion instead of penalties. This guide compares the six major regimes with data from the Stanford AI Index 2026, explains what changed in the AI Act this year, and shows what it means for companies in Croatia and the DACH region that use Claude, ChatGPT or Mistral.
Who passes AI laws: the G20 count
In 2016 not a single G20 country had an AI-related law on the books. By the end of 2025 the picture had changed, but very unevenly. The Stanford AI Index 2026 counts enacted national laws (not proposals) using data from Digital Policy Alert: the United States leads with 25, followed by South Korea with 17. France and Japan passed 10 each and Italy 9, while Russia, Saudi Arabia, China and India passed one or none.
Source: Stanford HAI, AI Index Report 2026, chapter 8 (data: Digital Policy Alert). Counts enacted national laws; an omnibus law with several AI provisions counts once. EU regulations such as the AI Act are not attributed to member states, which is why France, Italy and Germany (amber) look less active than they are. China counts low because it regulates AI mainly through administrative measures, not statutes.
The count needs one caveat: it measures laws, not regulatory pressure. China passed only one AI-related statute, yet it runs one of the most demanding AI regimes in the world through measures issued by its internet regulator. And in Europe the decisive law is EU-wide, so it does not show up under any member state.
European Union: the AI Act after the Digital Omnibus
The AI Act entered into force in August 2024 and applies in stages. The biggest change in 2026 is the Digital Omnibus on AI: the Council and Parliament agreed on it on 7 May 2026, and it entered into force on 27 July 2026 as Regulation (EU) 2026/1744. It replaced the original August 2026 deadline for high-risk systems with fixed later dates and kept everything else on schedule.
| Date | What applies | Status |
|---|---|---|
| 2 Feb 2025 | Bans on unacceptable practices (e.g. social scoring, emotion recognition at work), AI literacy | In force |
| 2 Aug 2025 | Obligations for providers of general-purpose AI models (GPAI): documentation, copyright policy, training data summary | In force |
| 2 Aug 2026 | Article 50 transparency (chatbot disclosure, deepfake labels), Commission can fine GPAI providers | In force |
| 2 Dec 2026 | Machine-readable marking for generative systems already on the market; new ban on AI that generates non-consensual intimate images or child abuse material | Upcoming |
| 2 Dec 2027 | High-risk systems in Annex III: hiring, education, credit scoring, essential services, law enforcement | Delayed from Aug 2026 |
| 2 Aug 2028 | High-risk AI embedded in regulated products (Annex I): medical devices, machinery, vehicles | Delayed from Aug 2027 |
The Omnibus also softened the AI literacy duty: providers and deployers must now support AI literacy among staff rather than guarantee a certain level. It gives the AI Office stronger investigative powers, lets companies process sensitive data for bias detection under a strict necessity test, and largely exempts AI in machinery products from double regulation. For the full list of duties see our EU AI Act compliance guide and the article on Article 50 and AI content labels.
United States: no federal law, a patchwork of states
Washington has not passed a comprehensive AI law, and federal policy has moved toward deregulation. In January 2025 the new administration revoked the 2023 AI executive order. A December 2025 order set up a Justice Department task force to challenge state AI laws, and an order of 2 June 2026 created a voluntary framework under which frontier model developers can give federal agencies access up to 30 days before release. Attempts in Congress to pre-empt state AI laws have failed twice so far.
The real rule-making happens in the states. According to the AI Index 2026, state legislatures passed 150 AI-related laws in 2025, up from fewer than 10 in 2020. California alone accounts for 62 since 2016, more than twice any other state.
Source: Stanford HAI, AI Index Report 2026, figure 8.4.5. Counts only enacted bills whose text contains the phrase "artificial intelligence". In 2025 alone California passed 20, Texas 12 and New York 10. Missouri and Rhode Island have passed none.
- California SB 53 (in force since 1 January 2026) requires large frontier model developers to publish a safety framework, report critical safety incidents and protect whistleblowers, with civil penalties of up to 1 million dollars per violation. Anthropic publicly endorsed the bill in September 2025.
- Texas TRAIGA (in force since 1 January 2026) bans a narrow list of harmful AI uses and mostly binds government agencies; it also created a regulatory sandbox.
- Colorado was supposed to have the first broad US law on high-risk AI. After xAI sued and a federal court stayed enforcement in April 2026, the state replaced it in May 2026 with a narrower, notice-based law on automated decisions that applies from 1 January 2027.
China, South Korea, Japan and the UK
China has no single AI law but some of the most concrete obligations. Generative AI services for the public must pass a security assessment and be filed with the Cyberspace Administration, and since 1 September 2025 all AI-generated text, images, audio and video must carry visible and embedded labels. An amendment to the Cybersecurity Law that took effect on 1 January 2026 added a general AI clause.
South Korea is the first country after the EU with a comprehensive AI framework law. The AI Basic Act has applied since 22 January 2026. It defines "high-impact" AI in areas such as healthcare, energy, hiring and lending, requires labels on generative AI output, imposes extra duties on models trained with at least 1026 FLOPs and obliges large foreign providers to appoint a representative in Korea. The penalties are mild: at most 30 million won (about 21,000 dollars), and the government is not issuing fines during a grace period of at least one year.
Japan chose promotion over prohibition. The AI Promotion Act of 2025 created an AI Strategy Headquarters under the prime minister, and the cabinet adopted the first AI Basic Plan in December 2025. The law contains no penalties; the government relies on guidance and on naming companies that cause harm.
The United Kingdom still has no AI bill. The King's Speech of 13 May 2026 again left one out and announced a broader Regulating for Growth Bill with sandbox powers instead. Frontier models are tested on a voluntary basis by the AI Security Institute, and existing regulators apply existing law.
Our assessment based on the legal texts and sources cited in this article. "Partial" means voluntary, narrow, not yet applicable or without fines yet: e.g. US states' high-risk rules (Colorado from 2027), China's security assessment for public-facing services, Korea's grace period on fines, Japan's framework law without obligations for companies, voluntary pre-release testing in the US and UK.
Fines: the EU is in a league of its own
The differences become starkest in the penalties. The maximum AI Act fine for a prohibited practice is 35 million euros or 7% of worldwide annual turnover, whichever is higher. California caps SB 53 penalties at 1 million dollars per violation, and Korea's ceiling is lower than the cost of a single compliance audit.
Sources: AI Act Art. 99 and 101, California SB 53, Texas HB 149, Korea AI Basic Act Art. 43. Dollar and won amounts converted approximately (1 million USD ≈ 860,000 EUR; 30 million KRW ≈ 18,000 EUR). The EU caps are the fixed amounts; for large companies the turnover-based cap (7% or 3%) is higher. The scale is logarithmic: each gridline is ten times the previous one.
Where Anthropic, OpenAI, Mistral and Manus stand
For companies that buy AI rather than build it, the most important question is whether their vendor already meets the rules that apply to models. The European Commission lists Anthropic, OpenAI, Mistral AI, Google, Microsoft, Amazon, IBM and Aleph Alpha as full signatories of the General-Purpose AI Code of Practice, the voluntary path to demonstrate compliance with the AI Act's GPAI obligations. xAI signed only the safety and security chapter, and Meta did not sign.
- Anthropic signed the EU Code and supported California's SB 53, arguing that frontier developers should be held to their published safety frameworks.
- OpenAI signed the EU Code as well and, like the other frontier labs, falls under SB 53 in California.
- Mistral AI, the largest European model developer, signed the Code in full. For companies that want an EU-based provider, see our article on sovereign AI and data residency.
- Manus is an agent platform built on models from other labs and is not on the signatory list. If you deploy an agent, the AI Act deployer duties are yours regardless of the vendor.
What companies in Croatia and the DACH region should do now
- Build an AI inventory and classify each use case. Note whether it is prohibited, high-risk (Annex III), subject to transparency duties or minimal risk. Hiring, credit and employee evaluation are the most common high-risk cases in SMEs.
- Use the extra time for high-risk systems, do not waste it. Plan risk management, data governance, logging and human oversight so they are ready before 2 December 2027.
- Check today's duties. Chatbot disclosure and deepfake labels already apply, and generative systems need machine-readable marks by 2 December 2026.
- Map where your customers are. If you sell AI-based services to the US, Korea or China, their rules can apply to you. Korea requires a local representative above certain revenue or user thresholds.
- Prefer vendors who signed the GPAI Code and ask for their AI Act documentation in writing. A management system under ISO/IEC 42001 covers much of what regulators in all six jurisdictions ask for.
Frequently asked questions
Which country has the strictest AI regulation in 2026?
The EU: the AI Act is the only comprehensive risk-based AI law, with fines up to 35 million euros or 7% of turnover. South Korea has a similar framework law with much lower fines; China regulates through targeted, strictly enforced rules.
Was the EU AI Act delayed?
Only the high-risk rules: Annex III moves to 2 December 2027 and Annex I to 2 August 2028 (Regulation (EU) 2026/1744). Bans, GPAI rules and Article 50 transparency still apply.
Is there a federal AI law in the United States?
No. Federal policy runs on executive orders (one created a voluntary frontier-model review in June 2026); the binding rules come from states such as California, Colorado and Texas.
Does the AI Act apply to companies outside the EU?
Yes, if the AI system or its output is used in the EU. Korea's law has a similar reach and requires larger foreign providers to name a local representative.
Did Anthropic, OpenAI and Mistral sign the EU Code of Practice for general-purpose AI?
Yes. Anthropic, OpenAI, Mistral AI, Google and Microsoft signed in full; xAI only the safety chapter; Meta did not sign.
Not sure where your AI use cases fall under the AI Act?
We help companies in Croatia and the DACH region build an AI inventory, classify use cases under the AI Act and set up the documentation and oversight that also hold up in other markets. As a Claude Certified Architect from Zagreb, we start with your processes, not with a slide deck.
Talk to an AI consultant