- China’s Cyberspace Administration (CAC) intensified AI enforcement in 2026, sanctioning apps including Jianying and Jimeng AI for labeling violations, and publishing its “AI Safety Governance Framework 3.0” in September 2026, which extends oversight to AI agents and open-source models.
- The EU AI Act’s transparency obligations took effect on August 2, 2026, but the “Digital Omnibus on AI” (July 2026) pushed high-risk system deadlines to December 2027 and August 2028, giving operators an extended window to build compliance infrastructure.
- California’s SB 53, in force since January 1, 2026, imposes penalties up to $1 million per violation on frontier model developers, while President Trump’s June 2026 Executive Order 14409 relies on voluntary model-sharing rather than binding standards, leaving US compliance obligations fragmented by state and sector.
Three major AI regulatory regimes are now in active, concurrent operation, and they pull in fundamentally different directions. China sanctioned consumer AI apps in April 2026 for content labeling failures, the EU shifted its high-risk compliance deadlines out by a year or more under industry pressure, and the US federal government issued an executive order that relies on voluntary participation rather than enforceable rules. For any company operating across jurisdictions, these are not abstract policy differences: they produce real, conflicting obligations.
China Moves to Active Enforcement
China’s approach to AI governance has matured into a comprehensive, top-down system that prioritizes state control and societal stability. The Cyberspace Administration of China (CAC) moved from policy implementation to active enforcement throughout 2026. In April, the CAC directed local authorities to sanction applications including Jianying, Maoxiang and Jimeng AI for failing to meet AI-generated content labeling requirements, issuing rectification orders and warnings against some of the country’s most widely used consumer AI products.
The labeling regime itself is now well-established. The “Measures for Labelling AI-Generated and Synthetic Content,” which took effect on September 1, 2025, alongside mandatory national standard GB 45438-2025, require explicit, visible labels on AI-generated text, images, audio, video and virtual scenes. Those labels must persist when content is downloaded or exported. Content distribution platforms are also required to check for implicit labels and add prominent warnings to content suspected of being AI-generated.
Regulatory scope expanded significantly in 2026 to cover the behavior and decision-making of AI systems, not only their outputs. The “AI Safety Governance Framework 3.0,” published in September 2026, addresses risks across the full AI lifecycle: model and data risks, vulnerabilities in open-source models, employment impacts and the growing autonomy of AI agents. It includes a dedicated mechanism for managing risks from AI agents, defined as systems designed to carry out complex tasks in response to user instructions.
New “Interim Measures for the Administration of Anthropomorphic AI Interaction Services,” in effect from July 15, 2026, target human-like AI companion services specifically. Providers must inform users they are interacting with an AI rather than a human, and virtual intimate relationship services for minors are prohibited outright. The amended Cybersecurity Law, effective January 1, 2026, added a dedicated AI provision and raised maximum fines for serious violations to RMB 10 million (approximately $1.49 million). Service providers must complete security assessments and file algorithm details with Chinese authorities.
The EU’s Phased Rollout Extends Further
The EU AI Act has been in phased application since 2025, with some key deadlines now shifting again. Bans on prohibited AI practices and general-purpose AI (GPAI) rules were already in force by August 2025. Significant transparency obligations under Article 50 began to apply on August 2, 2026, including requirements to inform individuals when interacting with an AI system and to disclose deepfakes. Providers of generative AI must mark AI-generated content in a machine-readable format, with a December 2, 2026 deadline for systems placed on the market before August 2, 2026.
The more consequential shift came via Regulation (EU) 2026/1744, known as the “Digital Omnibus on AI,” published July 24, 2026 and in force from July 27, 2026. This regulation pushed the application date for standalone high-risk AI systems listed in Annex III, covering areas including education, employment and law enforcement, to December 2, 2027. High-risk systems integrated into products regulated under Annex I, such as medical devices, will face obligations from August 2, 2028. The deferral followed industry pressure and concerns about the readiness of supporting technical frameworks.
The EU AI Act remains a rights-centric, risk-tiered framework requiring extensive technical documentation, conformity assessments and human oversight for high-risk systems. Significant fines for non-compliance apply to global companies operating within EU borders. The extended deadlines give operators more time to build compliance infrastructure, but the obligations themselves have not been diluted, and the compliance costs for high-risk AI systems remain substantial.
The US Patchwork: Federal Orders, Voluntary Standards
The United States has maintained a fragmented approach, relying on executive actions and voluntary frameworks rather than comprehensive federal legislation. In June 2026, President Trump issued Executive Order 14409, “Promoting Advanced Artificial Intelligence Innovation and Security,” directing federal agencies to strengthen cybersecurity and establish a voluntary framework for the secure deployment of frontier AI models. The order encourages private AI developers to voluntarily share certain new models with the federal government for security assessments up to 30 days before broader release. It also mandates creation of an AI cybersecurity clearinghouse by the Secretary of the Treasury, developed in collaboration with industry, to coordinate vulnerability scanning and patch distribution. None of this imposes binding regulatory standards across the private sector.
The National Institute of Standards and Technology (NIST) continues to advance its AI Risk Management Framework (AI RMF), released in January 2023. Voluntary in design, the AI RMF has become an operational baseline for AI governance in the US, with federal contractors increasingly expected to align with its four core functions: Govern, Map, Measure and Manage. NIST also released an initial public draft of guidance and templates for public-facing AI documentation on July 29, 2026, seeking to accelerate voluntary consensus standards.
State law adds further complexity. California’s Transparency in Frontier AI Act (SB 53), effective January 1, 2026, requires developers of large frontier models, defined as those trained with over 10^26 FLOPS, to publish risk frameworks, report safety incidents and implement whistleblower protections, with penalties potentially reaching $1 million per violation for large companies. Texas enacted the Responsible AI Governance Act (TRAIGA) on the same date, focusing primarily on government use of AI and including categorical bans on systems designed for behavioral manipulation or unlawful discrimination. The Trump administration has repeatedly criticized this state-by-state proliferation, threatening to challenge laws it considers burdensome through an AI Litigation Task Force established in December 2025.
What Divergence Means for Compliance
For companies operating across all three jurisdictions, the divergence produces concrete, conflicting requirements. China demands proactive content moderation, data localization and algorithm filing for state review, under an enforcement regime that has already shown it will act against major consumer platforms. The EU requires extensive documentation and conformity assessments for high-risk systems, with deadlines now extended but obligations unchanged. In the US, compliance obligations depend on industry sector, federal contract requirements and the state in which an organization operates rather than a single federal standard.
The calls for international cooperation on AI governance have not produced convergence at the implementation level. The three regimes reflect genuinely different assumptions about the relationship between state authority, market freedom and individual rights, and those differences are now embedded in active law and enforcement practice. Companies building global AI compliance programs face the task of satisfying three frameworks that were not designed to be compatible with each other.
