AI Regulation Timeline: Key Laws, Global Frameworks and the Fight to Govern AI
AI regulation timeline from Asilomar 2017 to the EU AI Act, China, India and US orders, with EU deadlines to 2028 and what is binding as of October 2026.
Latest Story
Artificial intelligence now writes text, generates realistic images and voices, screens job applicants, reads medical scans and runs increasingly autonomous agents. Governments first answered with voluntary ethics principles; they are now writing binding rules. This AI regulation timeline follows that shift, from the 2017 Asilomar principles to the EU AI Act, China’s targeted rules, India’s principle-based guidelines and the changing mix of US executive orders, up to the White House safety accord and task force of autumn 2026. It also separates what is law from what is only a promise.
💡 Short Answer
AI regulation has moved from voluntary principles (Asilomar 2017, OECD 2019, UNESCO 2021) to binding law. The EU AI Act entered into force on 1 August 2024; its bans apply from February 2025, most rules from 2 August 2026 and high-risk rules from December 2027 and August 2028. China regulates through targeted rules, India through guidelines and existing laws, and the United States through executive orders and state statutes, with no comprehensive federal AI law as of October 2026.
AI Regulation: Key Questions
AI Governance in Ten Points
- Principles first: Asilomar (2017), the OECD (2019) and UNESCO (2021) set shared values but no legal duties.
- The EU went furthest: its AI Act, in force since August 2024, is the only horizontal AI law of its scale.
- Phased, not instant: EU bans applied from February 2025, model rules from August 2025, most rules from August 2026.
- Then delayed: the 2026 Digital Omnibus moved high-risk duties to December 2027 and August 2028.
- A new ban: AI tools that generate non-consensual intimate imagery or child abuse material are banned in the EU from 2 December 2026.
- US policy swings: Biden’s 2023 order was revoked in 2025; Trump’s orders favour speed, security and one national standard.
- States vs Washington: California, Colorado and Connecticut legislated; a federal task force is challenging state laws in court.
- China is targeted: separate binding rules for algorithms, deepfakes, generative AI and labelling, plus October 2026 safety goals.
- India is principle-based: seven Sutras, proposed new institutions and amended IT Rules for synthetic content.
- Promises are not laws: the September 2026 White House accord and summit declarations are voluntary.
AI Regulation at a Glance
Principles, executive orders, laws and treaties have different legal effects, so the table shows each one’s legal character. Scroll sideways on a phone.
| Milestone | Date | Legal character | Significance |
|---|---|---|---|
| Asilomar AI Principles | January 2017 | Voluntary | Early shared vocabulary for AI safety |
| OECD AI Principles | 22 May 2019 | Non-binding | First intergovernmental AI standard |
| EU AI Act proposed | 21 April 2021 | Proposal | Risk-based model for a horizontal AI law |
| UNESCO Recommendation | 23 November 2021 | Non-binding | Global ethics framework, 193 states |
| China generative AI measures | 15 August 2023 | Binding | Targeted rules for public generative AI |
| US Executive Order 14110 | 30 October 2023 | Executive order | Federal AI safety push; rescinded January 2025 |
| EU AI Act in force | 1 August 2024 | Binding | Phased obligations begin |
| Council of Europe AI Convention | 5 September 2024 | Treaty (not yet in force) | First international AI treaty |
| America’s AI Action Plan | 23 July 2025 | Policy | Innovation and deployment first |
| India AI Governance Guidelines | 5 November 2025 | Guidelines | Principle-based; no standalone AI Act |
| US Executive Order 14409 | 2 June 2026 | Executive order | Advanced-AI cyber security; voluntary model review |
| EU Digital Omnibus on AI | 27 July 2026 | Binding | High-risk deadlines moved to 2027 and 2028 |
| Most EU AI Act rules apply | 2 August 2026 | Binding | Transparency duties and full enforcement |
The Complete AI Regulation Timeline
Newest first, from October 2026 back to Asilomar in 2017. Tags mark binding law, the EU AI Act, US executive action, international steps, non-binding frameworks and contested moves.
2026
China sets AI safety goals in its productive-forces plan Binding law
Guidelines on developing ‘new quality productive forces’, reported by Xinhua, call for full implementation of the ‘AI Plus’ initiative alongside systems for technology monitoring, early risk warning and emergency response, so that AI remains ‘safe, reliable and controllable’. Commentators contrasted the top-down approach with Washington’s task-force model announced the same week.
2026
Trump launches a ‘Super Intelligence Force’ US executive action
President Trump announced an AI task force that also includes Pentagon technology chief Emil Michael and Office of Personnel Management director Scott Kupor, and told federal agencies to say ‘super intelligence’ instead of ‘artificial intelligence’. Its charter gives it 120 days to map AI’s risks and opportunities and the scope of federal responsibility. It does not itself impose binding rules.
2026
Connecticut’s AI law starts to phase in Binding law
Connecticut became the latest US state to legislate on AI, with the first provisions of its 2026 act taking effect on 1 October and others following in 2027. State activity continues despite the federal push for pre-emption described below.
2026
White House Accord on Super Intelligence Contested
At the White House, President Trump and the heads of six AI developers signed the ‘White House Accord on Super Intelligence: Joint Commitment on Frontier Responsibilities’. The firms promised internal controls, an internal team to review safety practices, independent external auditors and board-level committees to examine audit findings, and to meet regularly on standards. Trump said the companies ‘understand that they have to self-police’.
2026
Most of the EU AI Act becomes applicable EU AI Act
Chatbots must tell people they are interacting with AI, providers must mark synthetic audio, images, video and text in a machine-readable way, and deployers must disclose deepfakes and AI-generated text published on matters of public interest, unless it has been editorially reviewed. Providers of content-generating systems placed on the market before this date have until 2 December 2026 to add marking. The high-risk rules did not start, because the Digital Omnibus had already moved them.
2026
India reports on deepfake safeguards Binding law
The government listed the legal tools it uses against deepfakes: the IT Act’s identity-theft, impersonation and privacy offences, Section 353 of the Bharatiya Nyaya Sanhita on false statements, and the amended IT Rules. It also cited advisories to platforms and funding for detection research under the IndiaAI Mission.
2026
EU’s Digital Omnibus on AI enters into force EU AI Act
The amending regulation pushed back the Annex III high-risk deadline from 2 August 2026 to 2 December 2027, and the Annex I deadline for AI in regulated products to 2 August 2028, because harmonised standards and national authorities were not ready. It added a prohibition on AI systems that generate or manipulate non-consensual intimate images, video or audio or child sexual abuse material, applying from 2 December 2026, moved the national sandbox deadline to 2 August 2027 and softened the AI-literacy duty to one of supporting staff literacy. It also gave the Commission’s AI Office stronger investigation and enforcement tools.
2026
Executive Order 14409 on advanced AI security US executive action
The order directs agencies including CISA, the Treasury and the National Security Agency to harden federal systems against AI-enabled cyber threats, sets up an AI cybersecurity clearinghouse and classified benchmarking, and creates a voluntary process for developers to let the government assess the cyber capabilities of covered frontier models before release. It states plainly that it does not create a mandatory licensing or pre-clearance regime.
2026
The EU ratifies the Council of Europe AI treaty International
The European Union became the first party to the treaty. Entry into force requires five ratifications, including at least three Council of Europe member states, followed by a three-month wait, so the first binding international AI treaty remains pending.
Colorado’s AI Act is paused in court Contested
Colorado’s 2024 law, the first broad US state statute on ‘high-risk’ AI decisions, had already been delayed once. After xAI sued and the Justice Department’s AI Litigation Task Force joined, a federal court stayed enforcement in late April 2026. The law has not been struck down.
2026
White House sends Congress a national AI framework US executive action
Following the December 2025 order, the administration published legislative recommendations for a single federal standard that would override state AI laws it regards as unduly burdensome. Congress had not passed such a law by mid-October 2026, and state statutes remain on their own timelines.
2026
India showcases its AI governance model Non-binding
On the eve of the summit, the Press Information Bureau set out the framework first released in November 2025: seven Sutras, and new bodies including an AI Governance Group, a Technology and Policy Expert Committee and an AI Safety Institute. It noted that MeitY had set up the drafting committee in July 2025. The summit was the first in the global AI summit series hosted in the Global South.
2026
India amends the IT Rules for synthetic content Binding law
The amendment defines ‘synthetically generated information’ and requires platforms to label lawful AI-generated content, deploy tools to stop unlawful synthetic content, and act fast: removal within 3 hours of a valid government or court order (previously 36 hours), grievances within 36 hours (previously 72) and 2 hours for nudity or impersonation complaints. Platforms that fail lose their safe-harbour protection under Section 79 of the IT Act.
2026
South Korea’s AI Basic Act takes effect Binding law
South Korea’s Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust came into force, combining industry support with duties for ‘high-impact’ AI, notice and labelling for generative AI, and a requirement for some foreign companies to name a local representative.
2026
California’s frontier AI law takes effect Binding law
The law requires large developers of frontier models to publish safety frameworks, report critical safety incidents to the state and protect whistleblowers. It replaced the broader SB 1047, which Newsom vetoed in 2024.
2025
Executive Order 14365 targets state AI laws Contested
President Trump ordered the Attorney General to challenge state AI laws on constitutional and pre-emption grounds and asked advisers to draft a uniform federal standard. The order criticised Colorado’s AI Act by name. An executive order cannot itself repeal a state law, so the fight moved to the courts and Congress.
2025
Commission proposes the Digital Omnibus EU AI Act
Facing industry pressure and delayed technical standards, the Commission proposed changes to the AI Act alongside data and privacy rules. Supporters called it pragmatic; critics said it weakened protections before they had even started.
2025
India releases its AI Governance Guidelines Non-binding
India chose not to write a horizontal AI law. The guidelines rely on existing statutes, sector regulators, technical standards and sandboxes, and call for clearer liability across the AI value chain. They are a governance framework, not binding legislation.
2025
China requires labels on AI-generated content Binding law
Providers and platforms in China must add visible labels and embedded metadata to AI-generated text, images, audio, video and virtual scenes, with a national standard setting the technical method. It builds on the 2023 deep synthesis rules.
2025
UN creates a scientific panel and global dialogue on AI International
The General Assembly agreed to set up a 40-member independent scientific panel to report on AI’s risks and impacts, and an annual Global Dialogue where governments discuss governance. Neither creates binding rules.
2025
EU rules for general-purpose AI models begin EU AI Act
Providers of models such as GPT, Gemini, Claude and Llama took on obligations to document their models, share information with downstream developers, adopt a copyright-compliance policy and publish a summary of training content. Models with systemic risk must also assess and mitigate those risks and report serious incidents. Most major developers signed the voluntary Code of Practice; Meta declined.
2025
America’s AI Action Plan US executive action
The plan, ordered by Executive Order 14179, set out policies to speed data-centre construction, cut regulatory barriers, promote exports of US AI technology and guard against ‘ideological bias’ in federal AI procurement. It is a policy strategy, not a statute.
2025
Paris AI Action Summit International
The third summit in the series shifted the language from ‘safety’ to ‘action’. Vice President JD Vance warned Europe against ‘excessive regulation’, and the refusal of Washington and London to sign the final declaration underlined the transatlantic split.
2025
The EU’s first AI bans apply EU AI Act
Social scoring, manipulative or exploitative AI that causes significant harm, crime prediction based solely on profiling, untargeted scraping of facial images, emotion recognition in workplaces and schools, and most real-time remote biometric identification by police in public became illegal in the EU. Breaches carry the Act’s highest fines, up to 35 million euros or 7% of global turnover.
2025
Executive Order 14179 orders a new AI plan US executive action
The order set the goal of sustaining and enhancing US ‘AI dominance’ and told officials to review and, where needed, undo actions taken under the 2023 order.
2025
Biden’s AI order is rescinded US executive action
On his first day back in office, President Trump revoked his predecessor’s AI order. Some work it started, including at the US AI Safety Institute, continued in modified form; the institute was later renamed the Center for AI Standards and Innovation.
2024
First international AI treaty opens for signature International
The treaty requires parties to ensure that AI activities respect human rights, democracy and the rule of law, with obligations on transparency, oversight and remedies. It is technology-neutral and leaves parties room in how they apply it to the private sector. It binds only states that ratify it.
2024
The EU AI Act enters into force EU AI Act
Entry into force started the clock; it did not make every rule apply. The Act sorts AI by risk: prohibited practices, high-risk systems with strict duties, limited-risk systems with transparency duties, and general-purpose models with their own chapter. It also created the European AI Office.
2024
Council gives final approval EU AI Act
The Council’s vote completed the ordinary legislative procedure. On 21 and 22 May, governments meeting in Seoul for the second AI safety summit agreed to build a network of national AI safety institutes, and 16 companies made voluntary frontier-AI safety commitments.
2024
European Parliament approves the AI Act EU AI Act
MEPs backed the deal by a wide margin. The text had grown during negotiations to cover general-purpose AI, which barely featured in the 2021 proposal written before ChatGPT.
2023
Provisional deal on the AI Act EU AI Act
Negotiators from the Parliament, the Council and the Commission settled the two hardest issues: how far police could use real-time facial recognition, and how to regulate powerful foundation models. France, Germany and Italy had pushed for lighter, self-regulatory rules for those models.
2023
Bletchley Declaration on AI safety International
Governments acknowledged that frontier AI could cause ‘serious, even catastrophic, harm’ and agreed to cooperate on research into those risks. The summit started a series that continued in Seoul (2024), Paris (2025) and New Delhi (2026).
2023
Biden signs Executive Order 14110 US executive action
Using the Defense Production Act, the order required developers of the most powerful models to share safety-test results with the government, and tasked NIST and other agencies with standards on red-teaming, watermarking and AI in critical infrastructure. It was the most far-reaching US federal AI action to that point, and it lasted 15 months.
2023
China’s generative AI rules take effect Binding law
Providers must use lawfully sourced training data, respect intellectual property and personal information, label generated content and uphold ‘core socialist values’. The final text was softer than an April 2023 draft and exempted research and internal use.
2023
NIST AI Risk Management Framework 1.0 Non-binding
The framework gave US organisations a shared vocabulary for AI risk. Though voluntary, it is cited by regulators and by state laws as a benchmark for reasonable care.
2023
China regulates deep synthesis Binding law
Weeks after ChatGPT’s launch, China’s rules for synthetic faces, voices and text came into force, requiring labels on synthetic media and consent before editing someone’s biometric features.
2022
US Blueprint for an AI Bill of Rights Non-binding
The blueprint set out safe and effective systems, protection from algorithmic discrimination, data privacy, notice and explanation, and human alternatives. It shaped later agency guidance but carried no legal force.
2022
China’s algorithm rules take effect Binding law
China became one of the first countries to regulate recommendation algorithms directly, requiring companies to file their algorithms with the Cyberspace Administration of China and to let users opt out of profiling-based recommendations.
2021
UNESCO Recommendation on the Ethics of AI Non-binding
The first global standard on AI ethics covered policy areas from education and health to gender and the environment, and asked governments to run ethical impact assessments. It remains a guide, not a treaty.
2021
The European Commission proposes the AI Act EU AI Act
The Commission’s draft set the template the rest of the world would react to: regulate uses of AI by the risk they pose to health, safety and fundamental rights, rather than regulating the technology itself.
2019
OECD AI Principles adopted Non-binding
Member and partner countries agreed five values-based principles, including human-centred values, transparency, robustness and accountability, plus recommendations for governments. The OECD’s definition of an AI system later fed into the EU AI Act.
2017
The Asilomar AI Principles Non-binding
Researchers and industry leaders agreed principles on research goals, safety, transparency, value alignment and long-term risks, including avoiding an arms race in lethal autonomous weapons. They were voluntary but helped frame later policy debates.
The EU AI Act Calendar After the 2026 Changes
Entry into force in 2024 started a clock that runs until 2028.
| Category | Examples | Status |
|---|---|---|
| Unacceptable risk | Social scoring, manipulative AI, facial scraping | Banned since 2 Feb 2025 |
| AI-generated intimate abuse | Non-consensual intimate images, child abuse material | Banned from 2 Dec 2026 |
| High risk (Annex III) | Hiring, education, credit, biometrics, policing and more | From 2 Dec 2027 |
| High risk (Annex I) | AI as a safety component of regulated products | From 2 Aug 2028 |
| Transparency risk | Chatbots, synthetic media, deepfakes, emotion recognition | From 2 Aug 2026 |
| General-purpose AI models | Foundation models; extra duties for systemic-risk models | From 2 Aug 2025 |
| Minimal risk | Spam filters, video-game AI and most other uses | No new duties beyond AI literacy |
Pick a type of AI. When do the EU rules bite?
Dates follow the AI Act as amended by the 2026 Digital Omnibus. The countdown uses today’s date on your device. A simplified guide, not legal advice: the exact duties depend on your role, the system’s purpose and transitional rules.
How Major Jurisdictions Approach AI Regulation
There is no single global AI law. Each jurisdiction mixes different tools.
| Jurisdiction or body | Main approach | Legal character |
|---|---|---|
| European Union | Horizontal, risk-based law with bans, high-risk duties, transparency and model rules | Binding regulation, phased to 2028 |
| United States (federal) | Executive orders, agency action, voluntary frameworks; push to pre-empt state laws | Mixed; can change with each administration |
| US states | California frontier-model law, Colorado and Connecticut AI acts, many deepfake laws | Binding state statutes, some under legal challenge |
| China | Separate rules for algorithms, deep synthesis, generative AI and labelling | Binding, targeted administrative rules |
| India | Seven Sutras plus existing laws; IT Rules on synthetic content | Guidelines plus binding rules for platforms |
| South Korea | AI Basic Act with high-impact and generative AI duties | Binding national law since January 2026 |
| United Kingdom | Principles applied by existing sector regulators; AI Security Institute | No AI-specific statute |
| Council of Europe | Human rights, democracy and rule of law | Treaty for parties; not yet in force |
| UNESCO and OECD | Ethics and trustworthy-AI principles | Non-binding recommendations |
| NIST | Risk management functions and profiles | Voluntary technical framework |
Pick a rule. Is it actually binding?
AI governance mixes statutes, executive orders, treaties, guidelines and voluntary pledges. They carry very different legal weight. Status as of 15 October 2026.
The US Fight: Washington Versus the States
Without a federal AI statute, US rules have come from two directions. The White House has set policy by executive order, which each new president can rewrite: Biden’s 2023 safety order lasted 15 months, and President Trump’s orders since January 2025 have favoured speed, infrastructure and security over reporting duties. EO 14409 in June 2026 added a voluntary pre-release review of frontier models’ cyber capabilities, and the September 2026 White House accord relies on company pledges.
States, meanwhile, have legislated. California’s SB 53 requires frontier developers to publish safety frameworks and report incidents; Colorado passed the first broad law on high-risk AI decisions; Connecticut’s act began phasing in on 1 October 2026. The December 2025 order created a Justice Department task force to challenge such laws, and Colorado’s was paused by a federal court in April 2026. Whether Congress passes one national standard that pre-empts state laws is the biggest open question in US AI policy.
What AI Laws Try to Fix
Six problems recur across almost every framework.
Personal data
AI systems are trained on and process vast amounts of personal information. Laws such as the GDPR and India’s Digital Personal Data Protection Act 2023 apply alongside AI-specific rules.
Bias and discrimination
Models can repeat patterns in their training data. High-risk rules require testing, data governance and monitoring where AI affects jobs, credit or public services.
Deepfakes
The EU, China and India now require labels on AI-generated content, and the EU and India target non-consensual intimate imagery directly.
Training data
The EU requires model providers to publish a training-content summary and respect copyright opt-outs. Courts, not AI laws, are settling most disputes.
Safety and cyber risk
Frontier models raise concerns about cyberattacks and misuse. EO 14409, California’s SB 53 and the EU’s systemic-risk rules all focus on testing and incident reporting.
Who is responsible?
Rules increasingly separate developers, providers and deployers, and require human oversight and a route to challenge important automated decisions.
What AI Regulation Means for Businesses and Developers
- Map your AI use: list each system, what decisions it influences and which jurisdictions it reaches.
- Know your role: model provider, application developer, integrator and deployer carry different duties.
- Check the date, not the headline: separate rules already in force from future deadlines, proposals and voluntary guidance.
- Label synthetic content: the EU, China and India all now expect AI-generated media to be identifiable.
- Keep evidence: documentation, test results, human-oversight procedures and incident records.
- Review third-party tools: check vendors’ terms, data handling and compliance information.
These are general governance practices, not a substitute for jurisdiction-specific legal advice.
Explore More Timelines
People Also Ask
Frequently Asked Questions
From Principles to Enforcement
In under a decade AI governance has moved from conference principles to fines, registries and labelling rules. The EU has a comprehensive risk-based law, though it has already pushed back its toughest deadlines; China uses targeted controls and now frames AI safety as a national goal; India relies on principles, institutions and platform rules; and the United States keeps changing its federal mix while its states legislate.
The question in 2026 is no longer whether AI should be regulated, but who writes the rules, how binding they are, and whether they can keep pace with models that change every few months.
Related AiTimeline Stories
⚠️ Editorial Note
This article draws on the European Commission and Council of the EU AI Act pages, the Official Journal text of Regulation (EU) 2024/1689, law-firm analyses of the 2026 Digital Omnibus on AI, the Federal Register and White House texts of US executive orders, the Congressional Research Service, Press Information Bureau releases of 15 February and 30 July 2026, the Cyberspace Administration of China, the OECD, UNESCO, NIST and the Council of Europe, plus news reports for September and October 2026 events. Dates are those of signature, publication, entry into force or application as stated. Treaty-ratification counts and court proceedings change; check the latest position. Nothing here is legal advice. Last checked 15 October 2026.
Sources & further reading
Every dated entry above was checked against these references. Last reviewed 15 October 2026.
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), Official Journal
- AI Act: regulatory framework for artificial intelligence
- Artificial intelligence act: timeline
- Executive Order 14409: Promoting Advanced Artificial Intelligence Innovation and Security (Federal Register)
- Controlling Advanced Artificial Intelligence: Executive Order 14409 Explained
- AI congressional mandates, executive orders and actions
- India AI Governance Guidelines: Enabling Safe and Trusted AI Innovation (PIB backgrounder, 15 Feb 2026)
- Government steps against AI deepfakes, IT Rules amendment (PIB, 30 Jul 2026)
- Interim Measures for the Management of Generative AI Services
- Framework Convention on Artificial Intelligence
- OECD AI Principles
- Recommendation on the Ethics of Artificial Intelligence
- AI Risk Management Framework