There is no single global AI law. The binding instrument is the European Union's AI Act, Regulation (EU) 2024/1689, in force since 2024; the United States anchors its approach in NIST's voluntary AI Risk Management Framework, released January 26, 2023; and the OECD's Recommendation on AI, the first intergovernmental AI standard, counts 47 adherents (regulatory and institutional records).
What does the EU AI Act actually do?
It creates harmonized, enforceable rules across EU member states. The regulation's own text states that it ensures the free movement of AI-based goods and services cross-border, preventing member states from imposing their own restrictions unless the regulation explicitly allows it — a single-market mechanism, not merely a policy statement.
Its central device is risk tiering: obligations scale with the danger a system poses, from prohibited practices through high-risk requirements to lighter duties for general-purpose models. Because it is a regulation rather than a directive, it applies directly in every member state, which is what makes the EU the reference point whenever someone asks whether AI is regulated, restricted, or banned somewhere.
The cost of that enforceability is compliance overhead, borne longest by the smallest developers, and definitional drift — edge cases that courts and regulators will spend years resolving. A binding law must draw lines; every line becomes litigation.
General-purpose models got their own layer of duties in the final text — documentation, transparency, and copyright-related obligations that attach regardless of the use case a downstream deployer chooses. That choice is why foundation-model developers watch Brussels even when their customers, not they, sit in the high-risk tiers.
Enforcement is also layered: a dedicated AI Office inside the Commission coordinates, national authorities execute, and penalties scale with the severity class of the violation. In practice, the first years of any such regime are dominated by guidance documents more than fines.
How does the US approach differ?
By being voluntary at the federal baseline. NIST's AI Risk Management Framework, published by the US standards institute, is explicitly intended for voluntary use, to improve the ability of organizations to incorporate trustworthiness considerations into the design, development, use, and evaluation of AI products, services, and systems (NIST).
Voluntary does not mean unserious. The framework was built through a consensus-driven public process — requests for information, multiple draft versions, workshops — and is accompanied by a playbook and roadmap. It functions as shared vocabulary that procurement rules, contracts, and sector regulators increasingly reference: soft power hardening at the edges, without statutory penalties at the center.
Its structure matters for how it gets used. The framework separates its core from a playbook of suggested actions, letting organizations adopt the vocabulary without signing up to a fixed checklist. That modularity is why it travels well across industries that would never accept a single uniform procedure — and why its uptake, not its enforcement, is the metric of its success.
The practical difference shows up in enforcement. An EU high-risk system's failures can trigger legal consequences under the regulation; a US framework gap is a governance finding, not a violation, unless some other law — consumer protection, civil rights, sector regulation — happens to apply.
What role does the OECD standard play?
The connective tissue between jurisdictions. The OECD Recommendation on AI is the first intergovernmental standard on AI, with 47 adherents — countries committed to its principles for trustworthy, human-centered AI. Its definition of an AI system, a machine-based system that infers from inputs how to generate outputs influencing environments, has been copied into other frameworks, including the EU's.
The OECD layer matters because national rules only interoperate if they share concepts. When the EU, the US, and Asian regulators can point to a common definition and principle set, cross-border AI products get one compliance conversation instead of thirty contradictory ones. The principles are not enforceable; they are the grammar the enforceable rules are written in.
Its work programs extend the same grammar into practice — policy trackers, incident monitors, and reporting frameworks for advanced AI developers — which keeps the standard updating faster than treaty-level law could move. For smaller countries without the capacity to write their own AI rules from scratch, adherence is a shortcut to a credible position; that is a quiet but real form of regulatory influence.
| Instrument | Legal force | Key fact |
|---|---|---|
| EU AI Act (Reg. 2024/1689) | Binding regulation | Harmonized rules; ensures free movement of AI goods and services |
| NIST AI RMF (2023) | Voluntary framework | Released Jan 26, 2023; trustworthiness by design |
| OECD AI Principles | Intergovernmental standard | First of its kind; 47 adherents; shared AI system definition |
Which regime governs a product you use?
Follow the market, not the headquarters. An AI product sold into the EU meets the AI Act regardless of where its developer sits; the same product in the US meets NIST-style expectations mostly through procurement and sector rules; the OECD layer describes what all participating governments have agreed AI should look like.
For teams building AI tools, the working sequence is practical:
- Map markets: EU exposure triggers the regulation's tiering analysis first.
- Adopt the vocabulary: NIST's categories and the OECD definition translate across regimes.
- Document choices: every framework rewards evidence of considered risk decisions over assertions of good intent.
Multi-market products therefore converge on the strictest applicable tier as their engineering baseline — a de facto Brussels-effect dynamic that makes EU compliance architecture useful everywhere.
Where the approaches may still diverge is speed. A regulation changes by amendment; a framework changes by revision and adoption; an intergovernmental standard changes by consensus of adherents. The voluntary instruments will track new model classes faster, while the binding one delivers what only law can — consequences that do not depend on goodwill.
Where do the approaches converge?
On process. All three regimes, despite their different legal force, ask the same underlying questions: what is the system's purpose, what risks follow from that purpose, who is accountable, and what evidence documents the answers. A team that can answer those questions well is, almost incidentally, compliant-adjacent in every regime; a team that cannot will fail the voluntary frameworks as surely as the binding one.
They also converge on lifecycle thinking. Each instrument treats AI governance as continuous — design, test, deploy, monitor — rather than a one-time certification, which is a meaningful shared conclusion given how differently the three bodies work. Whatever the next decade of AI regulation adds, the assumption that systems must be watched after release appears settled on all three tracks.
The divergence that remains is consequence. Europe legislates, America standardizes, the OECD harmonizes — and the difference stops mattering only for products that never cross a border.
