Does the EU AI Act apply to companies outside the EU?

Yes. The EU AI Act is a risk-tiered regime with extraterritorial reach. It applies regardless of where the provider is established when a system is placed on the EU market or its output is used in the EU. Transparency duties have applied since August 2026; high-risk obligations now apply from December 2027 under the 2026 Digital Omnibus.

What are US federal regulators doing on AI?

There is no omnibus US AI law yet. The SEC scrutinizes overstated AI claims, known as AI washing, and material-incident disclosure. The FTC pursues deceptive or unfair AI practices. State laws are filling the gap, including California's frontier AI law, Texas's TRAIGA, Colorado's automated decision-making law from January 2027, NYC Local Law 144 and Illinois BIPA. A December 2025 executive order directs the DOJ to challenge state AI laws, but they remain in force unless a court or Congress says otherwise.

What is the NIST AI Risk Management Framework?

The NIST AI Risk Management Framework is the de facto US reference for managing AI risk. It organizes AI risk into four functions — Govern, Map, Measure and Manage — and is widely cited in policy and in contracts.

What is the difference between ISO/IEC 42001 and ISO/IEC 23894?

ISO/IEC 42001 is the first certifiable AI management-system standard. ISO/IEC 23894 provides AI risk-management guidance and is not certifiable. Certification against 42001 is becoming a procurement signal.

Regulations & Standards

Know what your board is accountable for.

AI oversight has become a board-level duty. This is the landscape of obligations, standards, and exposure, in board language, not legalese.

Updated October 2026

AI didn't change your duties. It raised the stakes.

The fiduciary duties boards already hold extend directly to AI. The novelty is the speed, opacity, and reach of the decisions now being made below the boardroom.

Duty of Care

Decide on an informed basis.

Directors must understand the AI systems the company deploys well enough to oversee them, not to code, but to ask the right questions and weigh the risks before approving.

Duty of Loyalty

Act in good faith.

Oversight in good faith means ensuring information and reporting systems exist for the risks that matter. For many companies, AI is now one of them.

Duty of Oversight

Mind the mission-critical.

Under the Caremark line of cases and Marchand, courts expect a good-faith effort to oversee mission-critical risks, and to document that the board did.

A widening, uneven map.

There is no single AI rulebook. Obligations arrive by jurisdiction, by sector, and by use case, and they are moving.

European Union

EU AI Act

A risk-tiered regime with extraterritorial reach. Transparency duties for chatbots and deepfakes have applied since August 2026. The 2026 Digital Omnibus moved high-risk obligations (hiring, credit, education, critical infrastructure) to December 2027, and AI in regulated products to August 2028.

Regulation (EU) 2024/1689 — EUR-Lex

United States · Federal

SEC, FTC & preemption

No omnibus law yet. The SEC scrutinizes overstated AI claims ("AI washing") and material-incident disclosure; the FTC pursues deceptive or unfair AI practices. A December 2025 executive order created a DOJ task force to challenge state AI laws, but state laws remain in force unless a court or Congress says otherwise.

SEC FTC on AI claims

United States · State

A patchwork, accelerating

Colorado replaced its 2024 AI Act with a narrower law on automated decisions, effective January 2027. California's frontier AI law and Texas's TRAIGA took effect in January 2026, and New York amended its RAISE Act in March 2026. NYC Local Law 144 (hiring bias audits) and Illinois BIPA (biometrics) still apply.

Sector-specific

Where AI is already regulated

Model-risk management in banking (SR 11-7), fair lending (ECOA / FHA), medical AI as a device (FDA), and the NAIC model bulletin for insurers.

What changed in 2026.

The dates boards were planning around have moved. These are the changes worth knowing by name.

Jan 2026
California and Texas laws take effect. California’s Transparency in Frontier AI Act (SB 53) requires the largest model developers to publish safety frameworks and report critical incidents. Texas’s Responsible AI Governance Act (TRAIGA) also applies. For most companies they are useful yardsticks for vendor diligence.
Jan 2026
DOJ AI Litigation Task Force formed. Set up under a December 2025 executive order to challenge state AI laws. It has intervened against Colorado, but no state AI law has been struck down.
Mar 2026
New York amends the RAISE Act. It now centres on transparency and incident reporting for frontier model developers, with a shorter reporting window than California.
May 2026
Colorado repeals and replaces its AI Act. The new automated decision-making law drops the duty of care and impact assessments in favour of notices, explanations of adverse decisions and human-review rights, from January 1, 2027.
Jul 2026
EU Digital Omnibus enters into force. High-risk obligations move to December 2, 2027, and AI in regulated products to August 2, 2028. Transparency duties applied from August 2026 as planned.
Dec 2026
EU AI-content marking applies. Machine-readable marking of AI-generated content is due from December 2, 2026.

Standards worth knowing by name.

Voluntary frameworks increasingly set the baseline regulators, insurers, and courts measure against.

NIST

AI Risk Management Framework

The de facto US reference. Organizes AI risk into four functions, Govern, Map, Measure, Manage, and is widely cited in policy and contracts.

NIST AI RMF 1.0

ISO / IEC

42001 & 23894

ISO/IEC 42001 is the first certifiable AI management-system standard; 23894 provides AI risk-management guidance. Certification is becoming a procurement signal.

ISO/IEC 42001 ISO/IEC 23894

OECD · DOJ

Principles & enforcement

The OECD AI Principles set widely adopted values; the DOJ's evaluation of corporate compliance programs now probes how firms manage AI and emerging-tech risk.

OECD AI Principles

Where boards are exposed.

The same capability that creates value concentrates liability. These are the fault lines.

Securities & disclosure

Overstating AI capability to investors, or failing to disclose a material AI incident, draws SEC scrutiny and shareholder litigation.

Discrimination

Biased hiring, lending, and pricing models create exposure under Title VII, the ADEA, ECOA, and the Fair Housing Act, vendor opacity is no defense.

IP & copyright

Training data of uncertain provenance, and unclear ownership of AI-generated output, can impair assets and trigger injunctions.

Privacy & data

Biometric, personal-data, and cross-border data flows through AI systems carry their own fast-moving statutory regimes.

Vendor & agentic

Dependency on a third-party model, and autonomous agents acting without human review, shift risk the board may not have priced.

Safety & product

AI-enabled products that cause harm raise recall, disclosure, and liability questions that reach the board.

What "good" looks like on the record.

Defensible oversight is evidenced, not assumed. These are the artifacts that show a board did its job.

AI on the agenda with a named committee or director who owns oversight.
A current inventory of where AI is deployed and what each system depends on.
An acceptable-use policy with clear human-in-the-loop thresholds.
Escalation and disclosure pathways for AI incidents, tested before they're needed.
Regular, documented education so the board can ask informed questions.
A written record that the board asked the hard questions, and what it decided.

This page is a general orientation for directors, not legal advice. Regulations and standards referenced here evolve quickly and vary by jurisdiction and industry. Consult qualified counsel about your board's specific obligations.