As artificial intelligence becomes integral to business operations worldwide, governments are racing to establish regulatory frameworks that balance innovation with protection. California leads American state efforts with comprehensive AI oversight, while the European Union sets the global standard and other US jurisdictions develop targeted approaches. Understanding these different regulatory models helps businesses navigate the complex landscape of AI compliance.

California’s Comprehensive Three-Pillar Approach

California has established the most comprehensive state-level AI regulatory framework in the United States through three major initiatives targeting different aspects of AI use. The state’s approach addresses employment discrimination, data transparency, and judicial system applications through coordinated policies.

The employment regulations, approved on June 27, 2025 and set to go into effect on October 1, 2025 , require companies to conduct bias testing for automated decision-making tools used in hiring, promotions, and terminations. Employers must maintain detailed records for four years and demonstrate their systems don’t discriminate against protected classes.

Assembly Bill 2013 mandates that developers post documentation about training data on their websites by January 1, 2026, for any generative AI system released on or after January 1, 2022 . This transparency requirement covers specific datasets, copyrighted content, and data sources used to train AI models.

The judicial system rules, implemented July 18, 2025, with mandatory compliance by September 1, 2025, require courts to either ban AI entirely or develop policies addressing confidentiality, bias prevention, oversight, transparency, and human verification.

New York’s Pioneering City-Level Employment Focus

New York City established America’s first municipal AI regulation with Local Law 144, which came into force on Wednesday, says that employers who use AI in hiring have to tell candidates they are doing so. They will also have to submit to annual independent audits to prove that their systems are not racist or sexist .

The law requires employers using automated employment decision tools to conduct annual third-party bias audits and publish results publicly. Failure to comply with the new law, which is mandatory for any company operating and hiring in New York City, could result in fines starting at $500 with a maximum penalty of $1,500 per instance .

At the state level, New York is developing broader AI legislation. On 8 January 2025, New York State Senator Kristen Gonzalez introduced the NY AI Act and Assembly Member Alex Bores introduced the Protection Act, both seeking to prevent the use of AI algorithms to discriminate against protected classes .

The proposed state legislation would create private rights of action, allowing citizens to sue technology companies for algorithmic discrimination, representing a more aggressive enforcement approach than most other jurisdictions.

Colorado’s State Framework

Colorado enacted the first comprehensive state-level AI regulation in the United States. On May 17, 2024, Colorado Governor Jared Polis signed into law Senate Bill (SB) 24-205, “Concerning Consumer Protections in Interactions With Artificial Intelligence Systems,” a groundbreaking measure designed to regulate the private-sector use of AI systems .

The Colorado Artificial Intelligence Act focuses on “high-risk” AI systems that make consequential decisions affecting employment, education, finance, healthcare, housing, insurance, or legal services. The CAIA defines “algorithmic discrimination” as any condition in which the use of an AI system results in an unlawful differential treatment or impact that disfavors an individual or group based on protected characteristics .

The law requires both developers and deployers of high-risk AI systems to use “reasonable care” to prevent algorithmic discrimination. Employers can demonstrate reasonable care by implementing an AI governance risk management policy, conducting impact assessments, and notifying job applicants when AI systems make adverse decisions .

However, implementation challenges emerged. With SB 318 dying, institutions must meet the Feb. 1, 2026, deadline to comply with the 2024 bill , despite attempts to modify the original legislation.

Illinois’s Dual-Track Employment Protection

Illinois has implemented two complementary AI regulations focusing specifically on employment contexts. The state already operates under the Artificial Intelligence Video Interview Act, which requires employers to notify applicants about AI use in video interviews and obtain consent.

On Aug. 9, 2024, Illinois Gov. Pritzker signed into law HB3733, which amends the Illinois Human Rights Act (IHRA) to cover employer use of artificial intelligence. Effective Jan. 1, 2026, the amendments will add to existing requirements for employers that use AI to analyze video interviews .

The new law prohibits employers from using AI in a manner that causes a discriminatory effect for any protected characteristic already covered under the IHRA or zip codes as a proxy for a protected class . This prohibition covers recruitment, hiring, promotions, training, discipline, discharge, and other employment terms.

Illinois takes a broader approach than New York by covering all AI use in employment decisions, not just hiring tools. The state requires employers to provide notice when using AI for employment purposes but doesn’t mandate the detailed auditing requirements found in New York City or California.

European Union’s Risk-Based Global Standard

The European Union AI Act represents the world’s first comprehensive legal framework for artificial intelligence regulation. The AI Act entered into force on 1 August 2024, and will be fully applicable 2 years later on 2 August 2026, with some exceptions: prohibitions and AI literacy obligations entered into application from 2 February 2025 .

The EU approach categorizes AI systems into four risk levels: unacceptable risk (banned), high risk (strict requirements), limited risk (transparency obligations), and minimal risk (light regulation). The legislation treats employers’ use of AI in the workplace as potentially high-risk and imposes obligations for their use and potential penalties for violations .

For employment applications, employers should avoid using prohibited AI systems effective Feb. 2, 2025, including those that evaluate emotions in the workplace, infer sensitive attributes from biometric data, or score people based on social behavior or personal traits .

The EU’s extraterritorial reach means the EU AI Regulation applies to all providers and deployers based in the EU, as well as those that place an AI system on the EU market or use the results of an AI system in the EU , affecting global companies regardless of location.

AI Regulation Around the World

Geographic Coverage and Extraterritorial Effects

The global reach of AI regulations varies dramatically, with some frameworks extending far beyond their jurisdictional boundaries to create worldwide compliance obligations. The EU AI Act demonstrates the most aggressive approach, applying to any organization that provides AI systems in the EU market or uses AI outputs within the EU. This expansive scope means that a US-based company developing AI tools for European customers, or a multinational corporation using AI systems that process EU citizen data, must comply with European standards regardless of where their primary operations are located. The practical effect transforms the EU AI Act into a de facto global standard, similar to how GDPR reshaped worldwide data protection practices.

Within the United States, California’s regulations carry outsized influence due to the state’s economic significance and concentration of major technology companies. As home to Google, Meta, OpenAI, and other AI development leaders, California’s transparency requirements for generative AI directly impact systems used by millions globally. When these companies modify their practices to comply with California law, those changes often extend to their entire user base rather than being geographically limited. New York City’s employment AI law, while technically limited to city boundaries, affects hiring practices at major corporations with significant presences in Manhattan’s business district. Many companies find it operationally simpler to adopt uniform AI policies that meet the strictest applicable standard rather than maintaining separate compliance frameworks for different locations.

How Are AI Regulations Enforced?

The severity and structure of enforcement mechanisms reveal fundamental differences in regulatory philosophy across jurisdictions. The EU AI Act establishes the most punitive penalty structure globally, with fines reaching up to 35 million euros or 7% of global annual revenue for the most serious violations. These penalties dwarf most corporate budgets for regulatory compliance, creating existential risks that force companies to prioritize AI governance at the highest executive levels. The EU’s approach reflects a precautionary principle that views AI risks as potentially catastrophic and worthy of correspondingly severe deterrents.

American jurisdictions demonstrate more varied enforcement approaches that reflect different regulatory traditions and political philosophies. California integrates AI oversight into existing civil rights enforcement mechanisms, allowing both government agencies and private individuals to pursue violations through established legal channels. This dual-track approach creates multiple pathways for accountability while leveraging existing expertise in discrimination law. New York City opts for a transparency-focused model with relatively modest financial penalties but mandatory public disclosure of audit results, recognizing that reputational damage often proves more effective than fines for large corporations. Colorado and Illinois exemplify the American tendency to work within existing legal frameworks, treating AI violations as unfair trade practices and civil rights violations respectively rather than creating entirely new regulatory structures.

Innovation vs. Protection Balance for AI Policies

The tension between promoting technological innovation and protecting individuals from algorithmic harm manifests differently across regulatory approaches, reflecting deeper cultural and economic priorities. The EU’s comprehensive precautionary framework prioritizes human rights protection and democratic values, implementing broad prohibitions on certain AI applications and extensive compliance requirements for high-risk systems. This approach accepts potential innovation costs as necessary trade-offs for preventing societal harm, particularly given Europe’s recent experience with digital platform regulation and data protection.

American approaches demonstrate greater variation and experimentation in balancing these competing interests. California attempts to thread the needle by providing safe harbors for companies that proactively conduct bias testing while maintaining robust enforcement mechanisms for discriminatory outcomes. This carrot-and-stick approach encourages voluntary compliance while preserving accountability for bad actors. Colorado’s “reasonable care” standard offers even greater flexibility, allowing companies to demonstrate compliance through various methods while maintaining clear accountability for discriminatory results. New York’s transparency-focused model represents another balance point, permitting continued AI innovation while ensuring public oversight through mandatory auditing and disclosure requirements.

Emerging AI Policy Trends

The regulatory landscape continues evolving rapidly as additional jurisdictions observe early implementation results and adapt approaches to their specific contexts. Multiple US states including Maryland, New Jersey, Utah, and Washington have introduced AI legislation that builds upon the foundational models established in California, Colorado, and Illinois. This pattern suggests emerging consensus around certain core principles—transparency, bias testing, human oversight—while allowing for local variation in implementation details and enforcement mechanisms.

However, significant uncertainty clouds the federal regulatory landscape following major policy shifts in early 2025. President Trump’s executive order “Removing Barriers to American Leadership in Artificial Intelligence Issues” explicitly called for rescinding previous Biden administration guidance and removing regulatory barriers to AI development. Federal agencies have begun withdrawing previously issued AI guidance, creating a regulatory vacuum that increases the relative importance of state and local initiatives. This federal retreat transforms states like California, New York, Colorado, and Illinois into crucial laboratories for testing different regulatory approaches, with their experiences likely to influence future federal policy and international frameworks.

Compliance Strategies

Organizations operating across multiple jurisdictions face increasingly complex compliance landscapes that require sophisticated legal and operational strategies. The most effective approach often involves adopting the strictest applicable standards across all operations, a strategy known as “compliance convergence.” For employment AI systems, this means implementing bias testing protocols that satisfy California’s requirements, conducting annual audits meeting New York City’s standards, maintaining comprehensive notice procedures compliant with Illinois law, and ensuring human oversight mechanisms sufficient for Colorado’s reasonable care standards. While this approach may exceed requirements in some jurisdictions, it provides operational simplicity and reduces the risk of non-compliance as regulations continue evolving.

Companies serving global markets must navigate additional complexity from the EU AI Act’s extraterritorial reach, which effectively sets minimum global standards for AI systems used internationally. Organizations find themselves designing AI governance frameworks that accommodate European risk classification requirements, transparency obligations, and prohibited use cases regardless of their primary jurisdiction. Documentation requirements present particular challenges, with California’s training data transparency mandate for generative AI creating disclosure obligations that extend far beyond traditional business reporting. The result is an emerging compliance framework that blends elements from multiple jurisdictions, requiring legal teams to master an increasingly complex web of overlapping and sometimes conflicting requirements.

Key Takeaways

• California leads US states with comprehensive AI regulation covering employment bias testing, training data transparency, and judicial system oversight across multiple implementation dates.
• EU AI Act sets global standards with risk-based regulation and extraterritorial reach, creating compliance obligations for companies worldwide serving European markets.
• Different jurisdictions emphasize varying approaches: EU focuses on risk classification, New York on audit transparency, Colorado on reasonable care standards, Illinois on employment protection.

FAQs

Do Companies Need to Comply with Multiple AI Regulations?

Yes, companies operating in multiple jurisdictions must comply with all applicable AI regulations. The EU AI Act has extraterritorial reach affecting global companies. US businesses may face overlapping state and local requirements in California, New York, Colorado, and Illinois, requiring comprehensive compliance strategies covering all relevant jurisdictions.

Which AI Regulation Framework Is Most Comprehensive?

The EU AI Act provides the most comprehensive framework, covering all AI applications with risk-based regulation and severe penalties. California offers the broadest US state coverage across employment, transparency, and judicial applications. New York City focuses specifically on employment with detailed audit requirements, while Colorado and Illinois target algorithmic discrimination in employment contexts.

How Do These Regulations Affect AI Development Globally?

EU AI Act requirements effectively set global standards due to extraterritorial reach and market size. California’s transparency requirements impact major AI developers. Companies increasingly design systems meeting the strictest applicable standards to ensure global compliance, with EU and California requirements driving worldwide AI development practices toward greater transparency and bias testing.

Keep Reading

• EU AI Act Requirements for US Companies – Navigate European compliance obligations for high-risk AI systems, prohibited applications, and transparency rules affecting American technology businesses.
• United States AI Laws in 2025-2026 – Track emerging artificial intelligence regulations across US states including pending employment and consumer protection bills nationwide.
• Future AI Regulation Expert Predictions – Analyze emerging trends in AI governance including federal preemption debates, international coordination, and evolving enforcement mechanisms.