Which rules apply to AI?
AI regulation.
EU, Germany, USA: which rules apply today, which are coming and what that means in practice.
In 60 seconds
- The EU regulates AI by risk, Germany enforces this with the KI-MIG, and the USA has a patchwork of state laws.
- High-risk obligations have been postponed to December 2027 and August 2028. Prohibitions and AI literacy already apply.
- The risk class finder shows where your use case lands.
Legal status: 5 November 2026
3 jurisdictions compared.#
The most important differences at a glance.
| EU | Germany | USA | |
|---|---|---|---|
| Basic approach | One law for everyone: rules according to the risk of the intended purpose | Implements and supplements EU law. Data protection, employment and copyright law remain important | No federal law. Executive orders, state laws and sector-specific law |
| Key rules | AI Act (EU) 2024/1689, amended by Regulation (EU) 2026/1744 (Digital Omnibus) | KI-MIG of 22 July 2026 (BGBl. 2026 I No. 223), in force since 28 July 2026 | E.g. California SB 53, AB 2013, SB 942, Texas TRAIGA, Illinois HB 3773, Colorado SB 26-189 (from 2027) |
| Supervision | EU AI Office for AI models, national authorities for systems | Federal Network Agency as the central body, BaFin in the financial sector, data protection authorities | State attorneys general, FTC, Department of Justice, sector regulators |
| Sanctions | Up to €35 million or 7% of worldwide annual turnover for prohibitions, up to €15 million or 3% for other obligations | Fines under the AI Act, imposed by the Federal Network Agency | Depending on the law, e.g. up to US$1 million per violation under California SB 53 |
| Focus | Fundamental rights, safety, trust | Building supervision, promoting innovation (regulatory sandboxes, service desk) | Innovation and competition, transparency for frontier models |
Legal status: 5 November 2026. The law changes constantly.
EU: the AI Act.#
The world's first comprehensive AI law, Regulation (EU) 2024/1689.
Timeline of the AI Act.#
What already applies and what is still to come. As of 5 November 2026.
AI Act enters into force
Regulation (EU) 2024/1689 applies in stages from then on.
Prohibitions and AI literacy
Prohibited practices are banned. Whoever uses AI ensures sufficient AI literacy (Art. 4).
General-purpose AI models
Obligations for providers of such models, plus governance and sanctions.
Digital Omnibus
Regulation (EU) 2026/1744 postpones the high-risk deadlines.
KI-MIG in Germany
The German law regulates supervision and responsibilities.
Transparency and national supervision
Labelling and notices under Art. 50, check individual transitional rules.
High-risk AI under Annex III
For example recruitment, creditworthiness, education.
High-risk AI under Annex I
AI as a safety component in regulated products.
Filled dots already apply. Details and sources are in the AI legal status.
What the AI Act requires.#
6 building blocks.
Prohibited practices (Art. 5)
Prohibited are, among other things, manipulative techniques, exploiting vulnerabilities and social scoring. Also prohibited: predicting crimes based on profiling alone, untargeted scraping of facial images, emotion recognition at work and in schools, and biometric categorisation by sensitive characteristics. Real-time remote identification for law enforcement is only allowed in narrow exceptions. The Digital Omnibus adds prohibitions on AI for creating non-consensual intimate content and abuse material.
High-risk AI (Annex III and I)
Covers, among others, biometrics, critical infrastructure, education, employment and HR management, essential private and public services (e.g. credit), law enforcement, migration, justice and AI as a safety component of regulated products. Obligations: risk management, data quality, documentation, logging, human oversight, robustness and cyber security, conformity assessment. Deployers must use systems as intended, monitor them and inform those affected.
Transparency (Art. 50)
Applies since 2 August 2026; transitional periods may apply to individual labelling obligations. People must be able to recognise that they are interacting with AI. AI-generated or manipulated content must be labelled, and providers must mark it in a machine-readable way. Deepfakes and AI texts on matters of public interest must be disclosed, with exceptions where there is editorial control.
General-purpose AI models
Since 2 August 2025: technical documentation, information for downstream providers, a copyright policy and a summary of the training data. Models with systemic risk (presumed above very high computing power) have additional obligations for evaluation, risk mitigation, incident reporting and cyber security.
AI literacy (Art. 4)
Since 2 February 2025, providers and deployers must take measures to ensure their staff have sufficient AI literacy. The Digital Omnibus does not change this. It applies to every professional use of AI, even with minimal risk.
Penalties and roles
Up to €35 million or 7% for prohibitions, up to €15 million or 3% for other obligations, up to €7.5 million or 1% for incorrect information. For SMEs, the lower amount applies. Roles: provider, deployer, importer, distributor. Anyone who substantially modifies a system or sells it under their own name can become a provider themselves.
The Digital Omnibus: what has changed.#
Regulation (EU) 2026/1744, in force since July 2026.
- High-risk under Annex III (e.g. HR, credit, education, critical infrastructure): obligations only apply from 2 December 2027 instead of from 2 August 2026.
- High-risk under Annex I (AI in regulated products): from 2 August 2028.
- Unchanged: Prohibitions (since February 2025), AI literacy (Art. 4), obligations for general-purpose AI models (since August 2025).
- New: Additional prohibitions in Art. 5 and a restored registration obligation for providers who classify their own system as not high-risk.
A delay, not a free pass
It is the date that has been postponed, not the content. Anyone buying or developing systems now should already plan for risk management, documentation and human oversight. National supervision has also been operating since August 2026.
GDPR and AI.#
The General Data Protection Regulation applies alongside the AI Act. The two sets of rules complement each other.
Legal basis
Anyone processing personal data with AI needs a legal basis under Art. 6 GDPR. In practice this is often legitimate interest with a documented balancing test, and often stricter for employees and special cases.
EDPB Opinion 28/2024
The European Data Protection Board clarifies: AI models trained on personal data are not automatically anonymous. Legitimate interest is examined in a three-step test. Unlawful training can also taint later use.
DSK guidance
The German Data Protection Conference has published guidance: "Artificial intelligence and data protection" (May 2024) and one on knowledge bases with language models (RAG, 2025).
Contracts and third countries
A data processing agreement under Art. 28 is usually required with AI providers. For providers outside the EU, the rules on transfers to third countries apply.
Data protection impact assessment
Where there is a high risk to those affected, such as extensive profiling or sensitive data, an impact assessment under Art. 35 is required.
Automated decisions (Art. 22)
People generally have the right not to be subject to a purely automated decision with significant effects. Transparency and data subject rights also apply to AI.
Germany: KI-MIG and more.#
Who supervises the AI Act, and which other rules apply?
The AI Market Surveillance and Innovation Promotion Act (KI-MIG) was signed on 22 July 2026 (BGBl. 2026 I No. 223) and has been in force since 28 July 2026. It regulates who supervises, not what companies must do. The obligations are in the AI Act.
- Federal Network Agency: central market surveillance and notifying authority, as well as coordination and competence centre.
- BaFin: remains responsible in the financial sector. Other sector authorities keep their areas.
- AI service desk of the Federal Network Agency as a contact point for small and medium-sized enterprises and start-ups.
- AI regulatory sandbox: a protected space to test AI under supervision.
- Complaints office and an independent market surveillance chamber for high-risk systems.
Works council
When AI is used in the workplace, the works council has information and co-determination rights (including Sections 80, 87(1) no. 6, 90, 95 BetrVG). Involve it early.
Copyright
Text and data mining is permitted under certain conditions (Sections 44b, 60d UrhG), and rights holders can reserve their rights in machine-readable form. Purely AI-generated works are usually not protected.
Trade secrets and cyber security
The German Trade Secrets Act requires appropriate protective measures. For many companies, NIS2 and the KRITIS rules also apply.
Guidance without legal advice. Legal text: gesetze-im-internet.de/ki-mig.
USA: a patchwork instead of a federal law.#
There is no comprehensive federal AI act. States, executive orders and sector-specific law are decisive.
Federal level
In 2025 the administration revoked the previous administration's executive order and presented an AI action plan. An executive order from December 2025 instructs the Department of Justice to challenge state laws, but cannot repeal them itself. Further orders in 2026 apply mainly to federal agencies. A comprehensive federal law is missing.
NIST AI Risk Management Framework
A voluntary framework with the functions Govern, Map, Measure, Manage. In practice an important guide, and partly taken into account in state laws.
FTC and sector law
The consumer protection agency FTC takes action against misleading AI claims. Sector law (e.g. employment, credit, health) also applies to AI decisions.
| State and law | Effect | Applies since / from |
|---|---|---|
| California SB 53 | Transparency for developers of very large AI models: safety frameworks, incident reporting, whistleblower protection. Penalties up to US$1 million per violation | 1 January 2026 |
| California AB 2013 | Disclosure of summaries of the training data of generative AI | 1 January 2026 |
| California SB 942 | AI Transparency Act: detection and labelling tools for generative AI with a large number of users | 2 August 2026 |
| Texas TRAIGA (HB 149) | Prohibition of certain intentional misuses (manipulation, unlawful biometric capture, fraudulent deepfakes), enforced by the attorney general | 1 January 2026 |
| Illinois HB 3773 | Protection against discrimination by AI in hiring and employment | 1 January 2026 |
| Colorado SB 26-189 | Replaces the original AI law (SB 24-205) with a narrower law on automated decisions. Litigation and implementation still open | planned 1 January 2027 |
| New York RAISE Act | Safety obligations for developers of very large models | planned 2027 |
Sources: public summaries by law firms and compliance providers, as of summer and autumn 2026. A lot is changing in the USA, and courts are reviewing several laws. Check the current status before making decisions.
What this means for you.#
Private individuals
Private, non-professional use of AI is exempt from most obligations of the AI Act. However, protective rights apply, such as labelling and data protection.
Companies that use AI (deployers)
AI literacy, transparency, additional deployer obligations for high-risk systems, GDPR, involvement of the works council and contracts with providers.
Companies that offer or integrate AI
Provider obligations depending on the risk class: documentation, testing, conformity. Anyone who substantially modifies a third-party system can become a provider themselves.
Users of US services
Check the contract, data location, transfers to third countries and certifications. The AI Act also applies to providers outside the EU if their systems are used in the EU.
Liability and other EU rules.#
New product liability
The new Product Liability Directive (EU) 2024/2853 explicitly covers software and AI. Member states must transpose it by 9 December 2026. It applies to products placed on the market after that date.
AI Liability Directive
The Commission is no longer pursuing the proposal for a separate AI liability directive. National liability law and the new product liability remain.
Cyber security
The Cyber Resilience Act applies to connected products, and NIS2 to many companies. Both affect AI systems running as part of a product or service.
Risk class finder.#
How is your use case classified under the AI Act?
Rough classification without legal advice. Function, exceptions and the individual case are decisive.
Standards and frameworks.#
They help put rules into practice.
| Framework | What it is about | Benefit |
|---|---|---|
| ISO/IEC 42001 | Management system for AI (policies, roles, risks, improvement) | Certifiable, creates structure and evidence |
| ISO/IEC 23894 | Guidance on risk management for AI | Helps with risk assessment |
| NIST AI RMF | Voluntary US framework with the functions Govern, Map, Measure, Manage | Widely used internationally and easy to combine |
| OWASP Top 10 for LLM | List of the ten biggest security risks for language model applications | Practical for development and testing |
| Harmonised EU standards | European standards for the AI Act (in preparation) | Intended to simplify conformity |
Further reading: EUR-Lex (regulations), Federal Network Agency, European Data Protection Board, NIST AI RMF.
Check: are you prepared?#
7 questions on AI regulation.
Guidance, not legal advice. Your selection stays in your browser.
Frequently asked questions.#
Does the AI Act also apply to me as a user of ChatGPT and similar tools?
At work, yes, as a so-called deployer, especially through the AI literacy obligation, transparency rules and data protection. Purely private, non-professional use is exempt from most obligations.
What happens in case of violations?
Authorities can order measures and impose fines, in Germany mainly the Federal Network Agency. The amount depends on the type of violation and can reach millions.
Do I have to label AI-generated images?
Deepfakes, meaning realistic-looking, artificially generated or manipulated content, must be disclosed. Providers of generators must mark content in a machine-readable way. Exceptions apply in other cases, for example for obviously artistic works.
How up to date is this information?
As of 5 November 2026. Laws change, especially in the USA and with EU standards. Have important decisions checked legally.
Keeping regulation under control?
Tell me which rule is still open for you, and we will add it to this page.
Sources and further reading
Was this page helpful?
Found a mistake? Let me know.
Suggested citation: Russo, K.: "AI regulation". sicherheitsdenker.de/en/ki-regulierung/, as of 6 November 2026.