AI safety regulation: how the US, EU, India and other governments are responding

At a glance: the same concerns, different legal tools

AI safety regulation is the broad label for rules and public systems intended to reduce harm from artificial intelligence while allowing useful applications to develop. The concerns range from inaccurate outputs and discrimination to privacy, cyber security, manipulated media and the possibility that very capable systems could be misused. There is no single global AI regulator. Instead, governments are mixing new legislation, technical standards, regulator guidance, procurement rules and enforcement under existing laws.

That distinction matters for people using AI at work, in schools, in public services or as customers. A rule may tell a provider to document a model, label synthetic material, test a system before use, or give a human the final say in an important decision. It may also simply recommend good practice. The European Union, United States and India all speak of trustworthy or safe AI, but they are at different points on that spectrum. Their choices also shape companies that operate across borders.

The issue has a clear current policy signal. The EU’s implementation timetable moved into a new phase in August, the White House issued a security order in June, and India has set out national governance guidelines this year. Google Trends data could not be accessed for this report, so this article does not treat those developments as evidence of an exact level of public search interest.

The European Union: a binding, risk-based rulebook

The EU AI Act is the clearest example of a dedicated cross-sector AI law. It classifies systems by risk. Uses considered an unacceptable threat to safety, livelihoods or fundamental rights are prohibited, while systems used in areas such as employment, education, critical infrastructure, migration and justice can fall into a high-risk category. The law also creates transparency duties, including circumstances in which people must be told they are interacting with AI or receiving certain AI-generated content.[1]

The timetable is important. The Act entered into force in 2024 and became broadly applicable on 2 August 2026, but its obligations do not all arrive at once. Eight prohibited practices and AI-literacy duties have applied since February 2025. Rules for general-purpose AI models, including transparency, copyright and, for models with systemic risk, risk-assessment and mitigation duties, have applied since August 2025.[1]

For many high-risk uses, the heaviest requirements are still ahead. Following the EU’s 2026 AI Omnibus changes, rules for specified high-risk areas are scheduled for December 2027 and rules for AI embedded in regulated products for August 2028. The staged design gives authorities, standards bodies and organisations more time to prepare, but it also means that ‘the AI Act applies’ is not a complete answer to what is required of a particular system today.[1]

The United States: security action, standards and existing law

The United States does not have one federal AI Act comparable to the EU’s. Its current federal approach is more distributed: executive policy, agency powers, voluntary technical guidance and laws that already cover issues such as consumer protection, discrimination, privacy in particular contexts and computer misuse. The White House’s July 2025 AI Action Plan set out more than 90 federal actions across innovation, infrastructure, and international diplomacy and security.[2]

A June 2026 executive order illustrates the security emphasis. It directed agencies to prioritise cyber defence, develop an assessment process for advanced cyber capabilities in AI models, and design a voluntary framework through which developers could work with government on models meeting a defined frontier threshold. The order expressly says it does not authorise mandatory licensing, pre-clearance or permits for developing, publishing or distributing new AI models.[3]

Technical guidance remains a practical part of the US picture. The National Institute of Standards and Technology describes its AI Risk Management Framework as voluntary and intended to help organisations incorporate trustworthiness into design, development, use and evaluation. Its generative-AI profile identifies risks and potential management actions; NIST says the framework is being revised as part of the Action Plan.[4] This can influence practice without itself creating a general legal obligation.

India: principles, institutions and sectoral oversight

India’s AI Governance Guidelines take a principle-led, techno-legal route rather than creating a single dedicated AI law. The government’s February backgrounder describes seven ‘Sutras’: trust, people first, innovation over restraint, fairness and equity, accountability, understandability by design, and safety, resilience and sustainability. The framework is intended to apply across sectors and to remain technology-neutral as systems change.[5]

The guidelines envisage a governance structure that includes MeitY as the nodal ministry, an AI Governance Group for coordination, a Technology and Policy Expert Committee, a proposed AI Safety Institute, and sectoral regulators for domain-specific enforcement. They also outline practical guidance for developers, deployers and regulators. The language is significant because it signals expectations around risk management, explanations, human oversight and accountability, even as detailed obligations may depend on the sector and the legal mechanism used.[5]

For an Indian hospital, lender, school or public authority, the immediate question is therefore likely to be more specific than whether an AI law exists. It is whether the use case is governed by applicable sectoral rules, data-protection duties, consumer or other laws, procurement conditions and the new guidance. A principle-based approach can be adaptable, but it can also leave implementation details to regulators and future policy choices.

Other governments show why ‘global rules’ is shorthand

Elsewhere, governments are building different combinations of institutions and controls. The United Kingdom’s AI Security Institute, part of the Cabinet Office, says its mission is to equip governments with a scientific understanding of risks from advanced AI, including through research, mitigations and testing. That is an institutional, evidence-building role; it should not be confused with a single economy-wide AI statute.[6]

China’s approach includes binding rules aimed at public-facing generative-AI services. The 2023 interim measures cover services that generate text, images, audio, video or other content for the public in mainland China. They require certain providers with public-opinion or social-mobilisation attributes to undergo a security assessment and apply algorithm-filing requirements; the measures also address training-data quality and personal-information responsibilities.[7]

The comparison should not flatten these differences. An EU requirement can be directly binding across the bloc; a US framework may be voluntary but paired with agency or state enforcement; India’s guidelines set national direction alongside sectoral governance; and China’s rules focus on public-facing services within its own regulatory system. The OECD’s live Policy Navigator, which covers initiatives from more than 80 jurisdictions and organisations, is a useful reminder that national approaches are numerous and regularly updated.[8]

What happens next

The next test is implementation. In the EU, attention will turn to transparency duties already taking effect, standards and guidance, and preparation for later high-risk obligations. In the US, agencies must translate security directives and voluntary collaboration into usable processes while NIST revises its framework. In India, the practical weight of the guidelines will depend on institutional follow-through, sectoral action and how existing legal duties are applied.

For the public, the most useful questions are concrete: Is a consequential decision being reviewed by a person? Can the provider explain the system’s role and limits? What data is used, who is accountable, and how can an error be challenged? Rules alone cannot answer every question, but they increasingly set the baseline for asking them.