AI regulation for managers: the 2026 guide.

In short: there is no single AI law. A manager in 2026 deals with the EU AI Act, which applies in stages through 2028;^1,2 a patchwork of US state laws under a federal government that wants to preempt them;³ and national laws and labeling rules in Asia.^4,5 Almost all of them ask for the same five things: tell people when AI affects them, assess the impact before consequential use, document the system, keep a person accountable for decisions that matter, and report serious incidents. Build those five once and each new law becomes a mapping exercise. This guide is educational, not legal advice.

The five duties almost every AI law shares

Read side by side, the instruments differ in reach and penalties but converge on the same obligations. The table shows where each duty appears in the laws covered in this guide.

The dates for every instrument below are kept in one place in the AI regulatory calendar.

The European Union: the AI Act after the Digital Omnibus

The AI Act (Regulation (EU) 2024/1689) entered into force on August 1, 2024 and applies in stages.¹ It reaches beyond Europe: providers that place AI on the EU market, deployers in the EU, and providers and deployers elsewhere whose system output is used in the EU.¹ Most organizations are deployers, and deployers carry real obligations.

• Applying now: prohibited practices (since February 2, 2025), the AI-literacy duty in Article 4, obligations for providers of general-purpose AI models (since August 2, 2025), and transparency duties under Article 50 (from August 2, 2026).¹
• Moved by the Digital Omnibus (Regulation (EU) 2026/1744, in force since July 27, 2026): stand-alone high-risk systems such as those used in employment, credit and access to essential services from December 2, 2027; AI in regulated products from August 2, 2028; machine-readable marking for systems already on the market from December 2, 2026, the same date a new prohibition on generating non-consensual intimate imagery and child sexual abuse material applies.²
• Penalties reach up to 35 million euros or 7 percent of global turnover for prohibited practices.¹

Further reading: the EU AI Act after the Digital Omnibus, what to ask general-purpose model providers, AI literacy after the omnibus and the June record of the provisional delay agreement.

What a deployer owes under the EU AI Act

If you rebrand a high-risk system or substantially modify it, the Act's value-chain rules can make you its provider, with the provider's heavier duties.¹

The United States: federal posture, state rules

There is no comprehensive federal AI statute. Executive Order 14365 of December 11, 2025 set out to build a national framework, created a litigation task force to challenge state laws the administration considers burdensome and tied some federal funding to them;³ on March 20, 2026 the White House sent Congress legislative recommendations for a federal standard that would preempt such laws.¹³ Neither preempts anything by itself: the Senate voted 99 to 1 in July 2025 against a moratorium on state AI laws,¹⁴ and state laws remain enforceable until Congress or a court says otherwise.

Connecticut's Public Act 26-15 is one law with several start dates: on October 1, 2026 its first AI sections apply (a written key-terms notice and the consumer's acceptance before a provider charges for an AI subscription, whistleblower protections at frontier model developers, and a statement in WARN layoff notices of whether the layoffs relate to AI); rules for AI companions follow on January 1, 2027; employers must tell applicants and employees when they interact with an automated employment-related decision technology, with written notice before a decision in which its output is a substantial factor, from October 1, 2027; and duties toward minors on covered online platforms apply from January 1, 2028.⁹ Read the effective date of each section, not the headline.

Further reading: US AI law in 2026, state by state, what Executive Order 14365 does, the White House framework, the January 1, 2026 laws, Colorado SB 26-189, California's automated decision rules, the California AI Transparency Act and the October 2026 member briefing on Connecticut.

Asia and international instruments

• South Korea's AI Basic Act has applied since January 22, 2026: duties for high-impact AI, labels on generative output, and a domestic representative for large foreign providers, with fines (up to 30 million won) expected only after a grace period of at least one year.⁴³⁰ Its impact assessment is a duty to make efforts rather than a strict requirement, while the explanation and user-protection duties for high-impact AI are mandatory.⁴ See the Korea briefing.
• China regulates through targeted measures; its rules on labeling AI-generated content took effect on September 1, 2025.⁵
• Japan's AI Promotion Act (May 2025) sets up a strategy headquarters and a basic plan without penalties;²⁰ Singapore publishes voluntary model frameworks, including one for agentic AI in January 2026²¹ (see the Singapore briefing).
• The Council of Europe Framework Convention, opened for signature in September 2024, is the first binding international AI treaty;²² summit declarations such as New Delhi's (February 2026) bind no one but show where governments agree.²³ See the one-page global map.

Decisions about people: the most litigated ground

Hiring, lending, insurance and access to services are where AI law is most active and where disputes reach court. In Europe, the SCHUFA and Dun & Bradstreet judgments hold that a score can itself be an automated decision and that people are owed an intelligible explanation.^24,25 In the United States, Mobley v. Workday tests whether the vendor of a screening tool can be liable alongside the employer,²⁶ and the 1978 four-fifths rule remains the first screen for adverse impact.²⁷ Further reading: the SCHUFA judgment, Mobley v. Workday, fairness testing and the four-fifths rule and the Rite Aid order.

Existing law still applies

New AI statutes sit on top of laws that already govern decisions, data and claims. Privacy law (the GDPR in Europe, the CCPA and its regulations in California) governs the personal data AI systems use.^6,10 Anti-discrimination law governs hiring, lending and housing decisions whether or not a person or a model made them,¹⁶ and consumer protection law governs what companies tell customers: the FTC's order against Rite Aid (proposed in December 2023, entered in March 2024)²⁸ and a Canadian tribunal's 2024 ruling that Air Canada was bound by what its chatbot said²⁹ both rested on existing law, not on an AI statute. Our briefing on three documented AI failures covers the Air Canada case.

How to run AI compliance without a separate program per law

1. Inventory. Every AI system, who it affects, where those people are, and which decisions it makes or influences.
2. Jurisdiction register. For each system, the instruments that apply, the duty that matters most, and the next date. Review it quarterly.
3. One control set to the strictest rule. One notice template, one impact assessment, one documentation set, one human-review and appeal process, adapted per jurisdiction.
4. Vendor terms. Documentation, logs, cooperation with regulators and incident notice in every AI contract; see five clauses that decide whether an AI contract protects you.
5. Incident procedure. Severity levels and the legal clocks; see AI incident response.
6. Watch list. A monthly look at the regulatory calendar and the Monday briefings, with a named owner.

Law and regulation for managers is taught in Module 6 of the AIMP AI management certification, alongside the governance frameworks in Module 5 that supply most of the evidence regulators ask for. For the governance side of this guide, see AI governance for managers.