AI Regulation: EU AI Act, US States, UK and Korea — 2026-09-16
As the EU AI Act enters its first month of active enforcement, compliance trackers highlight a critical "two-speed" reality where high-risk obligations are deferred to late 2027 while transparency rules bite immediately. In the US, states like Colorado and California are solidifying their regulatory frameworks amidst ongoing federal pre-emption debates, while South Korea’s new AI Basic Act enforcement begins to impact local tech sectors.
AI Regulation: EU AI Act, US States, UK and Korea — 2026-09-16
Top developments
EU AI Act Compliance Tracker Highlights "Two-Speed" Reality
A new comprehensive tracker published on September 12, 2026, clarifies the immediate obligations for organizations under the EU AI Act, which became generally applicable on August 2, 2026. The tracker emphasizes that while general-purpose AI (GPAI) and transparency requirements are now enforceable, high-risk system obligations have been deferred by the Digital Omnibus package until December 2027 and August 2028. This distinction is critical for compliance teams, as 78% of organizations reportedly have not yet taken meaningful steps toward full compliance, risking penalties for current transparency violations even if high-risk audits are delayed.
US State AI Laws Remain Operative Despite Federal Pre-emption Push
Recent legal analysis confirms that state-level AI laws in California, Texas, Illinois, and Utah remain fully operative as of September 2026, despite federal efforts to create a unified framework. The 2025 attempt to attach a ten-year moratorium on state AI laws to budget reconciliation was stripped by the Senate, leaving state statutes like California SB 53 and Texas TRAIGA as the primary regulatory forces. Legal experts note that state laws will only be preempted if a specific statute, valid agency action, or court decision explicitly overrides them, maintaining a complex patchwork for multi-state operators.
South Korea’s AI Basic Act Faces Early Implementation Hurdles
In South Korea, the implementation of the AI Basic Act is drawing scrutiny from local industries regarding the clarity of "high-impact AI" definitions. A recent report highlights that companies are struggling to determine if their systems fall under the eleven categories of high-impact AI, particularly in recruitment and finance. The uncertainty is compounded by the simultaneous revision of the Personal Information Protection Act, which now allows fines up to 10% of total revenue for severe data breaches, creating a dual-compliance burden for AI startups and established firms alike.
Local view
Germany: Bundesnetzagentur Takes Charge German media reports that the Federal Network Agency (Bundesnetzagentur) has officially assumed supervisory authority over AI regulation in Germany, following the cabinet's decision to adopt a "lean" oversight model. The ZFK (Zentrum für digitale Recht) notes that this move aims to implement EU mandates in an innovation-friendly manner, with the agency focusing on risk-based supervision rather than preemptive licensing.
France: CNIL Prepares New Recommendations French digital policy outlets report that the CNIL (Commission Nationale de l'Informatique et des Libertés) is actively drafting new recommendations to align French data protection practices with the newly applicable EU AI Act. Journal du Net highlights that the "Digital Omnibus" delays for high-risk AI are being closely watched by French companies, who are prioritizing transparency and fundamental rights assessments in the interim.
Context & numbers
- US State Landscape: As of September 2026, at least five states (California, Colorado, Texas, New York, Illinois) have comprehensive AI laws either in force or effective January 1, 2027, alongside over 40 narrower laws on deepfakes and hiring.
- EU Compliance Gap: A survey cited in recent compliance reports indicates that 78% of organizations have not taken meaningful steps toward EU AI Act compliance as of April 2026, a figure that remains a concern as enforcement powers activate.
- Korea Fines: The revised Personal Information Protection Act in South Korea, effective September 11, 2026, raises maximum fines for severe privacy violations to 10% of total revenue, significantly increasing the financial risk for AI-driven data processing errors.
On the radar
- Colorado ADMT Rules: Watch for further guidance from the Colorado Department of Regulatory Agencies regarding the Automated Decision-Making Technology (ADMT) rules, which replace the original 2024 AI Act and take effect in January 2027.
- EU High-Risk Deadline: Companies should mark December 2027 on their calendars, as this is the newly deferred deadline for many high-risk AI obligations under the Digital Omnibus amendment, giving firms more time to prepare conformity assessments.
This content was collected, curated, and summarized entirely by AI — including how and what to gather. It may contain inaccuracies. Crew does not guarantee the accuracy of any information presented here. Always verify facts on your own before acting on them. Crew assumes no legal liability for any consequences arising from reliance on this content.
Powered by
