A Field Guide to 2026 Federal, State and EU AI Laws

If you ship AI applications, you have probably noticed that the questions are changing. Enterprise security questionnaires now include AI-specific sections. Requests for proposals (RFPs) require model cards and evaluation reports that didn’t exist six months ago. Procurement teams expect documentation about system behavior and evidence that you have actually tested the system behavior.

Federal large language model (LLM) procurement requirements will land in March, and EU high-risk AI obligations take effect next summer.

The compliance stack is no longer theoretical. Executive orders were initially agency memos, then turned into contract clauses and then became evidence requests landing on your desk. Those questions have regulatory sources, with specific deadlines in 2026. OMB M-26-04, issued in December, requires federal agencies purchasing LLMs to request model cards, evaluation artifacts and acceptable use policies by March. California’s training data transparency law AB 2013 took effect on Jan. 1. Colorado’s algorithmic discrimination requirements in SB 24-205 (delayed by SB25B-004) will arrive on June 30. The EU’s high-risk AI system rules begin phasing in in August.

Here’s a look at the changes that occurred in 2025, impending changes in 2026 and the course of action that practitioners must adopt. Whether you are responding to federal RFPs, navigating state-level algorithmic discrimination requirements or preparing for international obligations, this is your field guide to AI regulation’s new reality.

How Regulation Reaches Your Product

AI regulation rarely arrives as a single requirement. In practice, it cascades:

Executive policy → Agency guidance → Procurement requirements → Contract clauses → Evidence requests

This is why 2025 mattered. Executive orders issued years ago finally worked their way down the stack, into  Office of Management and Budget (OMB) memos, then procurement language, then contract clauses, then the evidence requests now sitting in your inbox.

If you received a security questionnaire with new AI-specific sections or the RFP for model cards that you didn’t have six months ago, the stack has reached your product.

The compliance stack: Executive policy flows down through agency guidance, procurement requirements and contract clauses, ultimately requiring evidence from vendors.

U.S. Federal Policy

The January Transition

The Biden administration issued Executive Order 14110 in October 2023, creating categories for “rights-impacting” and “safety-impacting” AI, requiring federal agencies to implement risk-management practices and using the Defense Production Act to compel reporting from developers of large models. That order was rescinded on Jan.20, 2025. Executive Order 14179 replaced it the same day.

The implementation mechanism stayed the same, with the executive order setting direction, OMB memo operationalizing it, and the procurement office embedding requirements in contracts. What changed:

What did not change are the pre-deployment testing requirements for high-risk AI, impact assessments, human oversight expectations, agency AI inventories and the expectation that vendors provide documentation.

July: LLM Procurement Requirements

Executive Order 14319 added requirements specific to large language models, establishing two “Unbiased AI Principles”:

• Truth-seeking: LLMs should provide accurate responses to factual queries and acknowledge uncertainty when appropriate.
• Ideological neutrality: LLMs should not encode partisan viewpoints into outputs unless specifically prompted.

The December OMB memo implementing these principles specifies what agencies must request:

Agencies must update their procurement policies by March 11. The engineering implication is that the model behavior is now a contractual attribute, and agencies want evidence that you can measure and report on it.

For application builders, this means preparing:

• System card: Which model(s) you use, your prompts/policies, tools, retrieval sources and human review points.
• Evaluation artifacts: Red-team results for tool misuse, prompt injection and data leakage.
• Acceptable use policy: What your user interface (UI) allows, what it blocks, and what your system won’t do.
• Feedback mechanism: A “report output” button plus an internal triage workflow.

December: The Preemption Strategy

On Dec.11, the administration issued an executive order aimed at challenging state AI laws. From Section 4:

“The Secretary shall publish an evaluation that identifies State laws, regulations, or other actions that require AI models to alter their truthful outputs based on protected characteristics or other group-based classifications.”

Colorado’s SB24-205 is named specifically. The order directs:

• The Department of Justice AI Litigation Task Force to challenge state laws (~Jan. 10).
• Commerce evaluation identifying conflicting state laws (~March 11).
• Federal Trade Commission policy statement on when state laws are preempted (~March).
• Federal Communications Commission proceeding on federal disclosure standards that could preempt state requirements (~June).
• Authority to condition federal grants on states not enforcing identified laws.

This isn’t instant preemption. It is an attempt to build legal and administrative pressure toward a single national standard. Whether it succeeds depends on litigation and congressional action, neither of which has happened yet.

Enforcement Without New Laws

Regulators do not need bespoke AI statutes to take action. The FTC’s case against Air AI in August is an example: Deceptive performance claims, earnings claims and refund promises already have enforcement playbooks under Section 5.

The practical implication: Marketing language about “autonomous agents,” “guaranteed savings” or “replaces staff” needs the same rigor as security claims. If you can’t substantiate it, don’t say it.

State Laws

While federal policy shifted, states continued legislating:

Most state laws focus on deployment harms rather than model training: Discrimination, consumer deception, safety for vulnerable users, and transparency in consequential decisions. This means requirements like impact assessments, audit trails, human review pathways and incident response procedures.

The federal preemption order and state laws reflect a disagreement about what AI systems should optimize for. The federal position treats accuracy and non-discrimination as potentially conflicting. The state position treats non-discrimination requirements as consumer protection. Colorado’s law doesn’t require inaccurate outputs; it requires deployers to use “reasonable care” to avoid algorithmic discrimination.

On Dec. 10, 42 state attorneys general sent letters to major AI companies requesting pre-release safety testing, independent audits and incident logging. The litigation that resolves the federal-state tension hasn’t started yet.

International

EU

The EU AI Act (Regulation (EU) 2024/1689) was passed in 2024 and began implementation in 2025 (official timeline):

• February 2025: Prohibited practices (social scoring, certain biometric systems) took effect.
• August 2025: General-purpose AI model obligations took effect.
• August 2026: High-risk AI system requirements were scheduled to apply.

However, under pressure from industry and member states citing competitiveness concerns, the commission proposed a Digital Omnibus package in November 2025 that would delay high-risk obligations by 16 months, to December 2027. The proposal still requires parliament and council approval, but it signals that the original timeline is softening.

If you sell into the EU, you’ll need to determine whether your systems qualify as “high-risk” under the act’s classification scheme. If they do, conformity assessment and documentation requirements apply, though the exact timing is now less certain.

China

China’s AI governance uses administrative filing and content labeling rather than litigation and procurement. Under the Interim Measures for Generative AI Services, public-facing services with “public opinion attributes or social mobilization capacity” must complete security assessments and algorithm filing before launch. As of November 2025, 611 generative AI services and 306 apps had completed this process, and apps must now publicly disclose which filing model they use, including the filing number.

Last September, labeling requirements (English translation) took effect, backed by a mandatory national standard (GB 45438-2025): AI-generated content must include visible labels, metadata identifying the source and provider, and platforms must verify labels before distribution. Tampering is prohibited. The rules include a six-month log retention requirement in specific cases (for example, when explicit labeling is suppressed at a user’s request). In late November, the Cyberspace Administration of China (CAC) took action against apps failing to implement these requirements; enforcement looks like compliance campaigns and removals rather than litigation.

In October, CAC also published guidance for government deployments, pushing agencies toward filed models with stronger risk disclosures and hallucination risk management.

U.S. vs. China comparison: The United States requires documentation alongside the product, while China requires provenance embedded within the product.

Meanwhile, China’s open source AI reached the frontier. DeepSeek’s V3 model matched or exceeded leading proprietary systems on major benchmarks (technical report) and is available as open weights with published licensing terms (GitHub, model license). Qwen, Yi and other Chinese labs released competitive open-weight models. The Chinese AI research community is producing frontier-class work under a regulatory regime that requires registration and provenance, a different set of constraints than disclosure and procurement.

Elsewhere

Other jurisdictions moved in 2025, generally converging on familiar control families: South Korea’s AI Basic Act takes effect this month with risk assessment and local representative requirements. Japan passed an AI Promotion Act in May. Australia published 10 guardrails that read like a procurement checklist. India proposed specific labeling thresholds for AI-generated content (10% of a visual, first 10% of audio). The UK rebranded its AI Safety Institute as the AI Security Institute. Separately, the UK continues fighting over copyright and training data. The pattern: documentation, evaluation, oversight and provenance are becoming baseline expectations everywhere.

Technical Context

The center of gravity shifted in 2025 from single-prompt completion to agentic systems that plan over many steps, call tools, maintain state across long interactions and take actions in external environments. This happened across U.S. labs and Chinese labs simultaneously.

Three patterns stand out:

• Hybrid “fast vs. think” modes became standard. Frontier vendors now ship paired variants trading latency for deeper reasoning: GPT-5.2’s Instant/Thinking/Pro tiers, Claude 4 and 4.5’s extended thinking, Gemini 3’s Deep Think mode and similar options in Chinese open-weight families.
• Tool use became the product. Claude 4 explicitly interleaves reasoning and tool calls. GPT-5.2 emphasizes long-horizon reasoning with tool calling. Google’s Gemini 3 launched alongside Antigravity, an agent-first environment operating across editor, terminal and browser.
• Open weights reached the frontier. In 2025, “open” stopped meaning “two generations behind.” OpenAI released gpt-oss under Apache 2.0. Meta shipped Llama 4. Mistral 3 arrived with Apache 2.0 multimodal models. DeepSeek and Qwen continued releasing competitive open-weight models.

The compliance implication: Regulations written for text-in-text-out systems don’t map cleanly to systems that choose tools, interpret tool output, recover from errors and mutate external state. Evaluating whether a model hallucinates is different from evaluating whether an agent selects the right tool, handles its errors appropriately and takes actions aligned with user intent. Impact assessments and audits need to cover the deployed stack: Prompts, tool inventory, tool permissions, retrieval, memory and logging, not just base models.

2026 Timeline

Key AI regulation deadlines in 2026: Q1 brings federal task forces and state laws, Q2 brings FCC/FTC statements and Colorado compliance, Q3 brings EU AI Act enforcement

What This Means for Builders

Documentation Is Now Structural

Whether you are responding to a federal RFP, complying with a state law or filling out an enterprise security questionnaire, you will be asked for documentation about how your system works and how you tested it: Model cards, evaluation results, acceptable use policies, and incident response processes. If this exists but is scattered across internal wikis and Slack threads, you’ll need to consolidate it.

Testing Needs To Cover Deployed Systems

Regulatory requirements focus on use cases and deployments, the combination of model, prompts, tools, retrieval and guardrails that users interact with. If your application uses retrieval, test the retrieval quality. If it uses tools, test tool selection and error handling. If it maintains context across turns, test behavior at different context lengths. If it reads untrusted input, test adversarial conditions, not just cooperative ones. We built Promptfoo for exactly this: system-level red teaming and evaluation that produces the artifacts regulators and procurement officers now ask for: exportable results, regression tests and audit trails that document what you tested and what you found.

If Your AI Can Take Actions, Regulators Will Evaluate the Actions

If your system can issue refunds, send emails, modify records or execute code, compliance requirements apply to the action path, not just the text output. This is why agentic systems need testing that covers tool selection, error handling and rollback behavior.

The Regulatory Landscape Is Unsettled

The federal-state conflict isn’t resolved. Preemption litigation hasn’t started. International requirements continue to diverge. Building a compliance infrastructure that adapts to different requirements is more practical than optimizing for any single regime.

If you only do one thing before 2026: Make your AI system’s behavior measurable, repeatable and explainable to someone outside your team.

The post A Field Guide to 2026 Federal, State and EU AI Laws appeared first on The New Stack.