A UK board selling into Europe should plan around the EU AI Act, because it is binding law with fixed dates and fines, while current US federal policy relies mainly on voluntary cooperation and investment. Build one AI governance baseline to the EU standard, then adjust for US customers and UK regulators, rather than running separate programmes.
This question is now being asked openly by AI investors and technology leaders. US federal AI policy has moved quickly, and Michael Kratsios has set out the US approach in recent interviews. What follows is AIPEX’s own comparison for UK boards, drawn from the primary texts. It is governance guidance, not legal advice.
What has the US actually done?
Two executive orders matter most for a board trying to read the direction of US policy.
Executive Order 14409, “Promoting Advanced Artificial Intelligence Innovation and Security”, was signed on 2 June 2026 and published in the Federal Register on 5 June 2026 at 91 FR 34565 (Federal Register, Executive Order 14409, 5 June 2026; White House, 2 June 2026). It sets up a voluntary framework under which developers of the most capable models can give the federal government access to them for up to 30 days before release, asks the National Security Agency to develop cyber-capability benchmarks for identifying “covered frontier models”, and creates an AI cybersecurity clearinghouse in voluntary collaboration with industry. The order states that nothing in that section authorises “a mandatory governmental licensing, preclearance, or permitting requirement”.
Executive Order 14363, “Launching the Genesis Mission”, was signed on 24 November 2025 and published on 28 November 2025 at 90 FR 55035 (Federal Register, Executive Order 14363, 28 November 2025; White House, 24 November 2025). It directs the Department of Energy to build a national platform for AI-accelerated science. It is an investment programme, not a rulebook for business.
Read together, the orders point one way: US federal policy is aimed at frontier developers, national security and scientific capability. They place no new compliance duties on an ordinary company that buys or deploys AI. That can change with a new order, a statute or state law, so the position needs checking each year.
How is the EU approach different?
The EU AI Act is a regulation with direct legal effect, obligations by risk tier and fines of up to EUR 35 million or 7% of worldwide annual turnover for the most serious breaches (Regulation (EU) 2024/1689, 13 June 2024). It reaches beyond the EU: a UK company is in scope if it places an AI system on the EU market or its AI output is used in the EU.
Its timetable, as amended by Regulation (EU) 2026/1744 (Regulation (EU) 2026/1744, the Digital Omnibus on AI), is now:
- 2 August 2026: Article 50 transparency duties apply, so people must be told when they deal with AI.
- 2 December 2026: marking duties for generative AI systems already on the market, and the ban on AI that produces non-consensual intimate imagery or child sexual abuse material.
- 2 December 2027: duties for high-risk systems listed in Annex III, such as AI used in recruitment or credit decisions.
- 2 August 2028: duties for AI in products already regulated under EU product law.
Our analysis of EU AI Act fines and enforcement sets out how penalties are calculated and who enforces them.
Where does the UK sit?
At the time of writing the UK has no AI-specific statute. The government’s published approach, set out in its 2023 white paper, asks existing regulators to apply cross-sector principles within their own remits (UK Government, A pro-innovation approach to AI regulation, March 2023). In practice, a UK board already answers for AI through data protection, consumer, employment, equality, competition and financial services law, enforced by the regulators it deals with today.
How do the three approaches compare?
| Question for the board | United States (federal) | European Union | United Kingdom |
|---|---|---|---|
| Main instrument | Executive orders, mainly voluntary | Binding regulation | Existing law, applied by sector regulators |
| Who carries duties | Mainly frontier developers and federal agencies | Providers, deployers, importers and distributors | Whoever the existing law already covers |
| Fixed deadlines for deployers | None from these orders | Yes, 2026 to 2028 | None AI-specific |
| Penalties | None created by these orders | Up to EUR 35 million or 7% of turnover | Existing regulators’ powers |
| Applies to a UK company when | Its AI touches US federal work or state law applies | Its AI or AI output reaches the EU | It operates in the UK |
What should a UK board plan around?
The pragmatic answer is to govern to the highest standard you are actually subject to, once. For most UK businesses with European customers, suppliers or staff, that is the EU AI Act. An inventory, a risk classification, named owners, human oversight and supplier documentation built for the EU will also answer most of what UK regulators and US enterprise customers ask for. Running a light-touch US programme alongside a heavy EU one wastes effort and creates gaps where the two meet.
Three cautions apply. First, US state law is developing separately from federal policy, and a business with US operations needs its own advice on the states it serves. Second, US customers often impose contractual AI requirements that go further than federal policy. Third, the EU dates have already moved once; they could move again, so plan to the current text and review it each quarter.
- Which of our AI systems, or their outputs, reach the EU, the US or both?
- For each, are we provider, deployer or both under the EU AI Act?
- Do our largest US customers impose AI terms that go beyond US federal policy?
- Who reviews changes in US, EU and UK AI rules, and how often does the board hear about them?
Where to start
Our briefing on the EU AI Act deadline and what boards must do before December 2027 sets out five actions for the board this quarter. The first, Find it, is where every jurisdiction’s question begins: a full inventory of the AI in use, including AI inside the software you already pay for. Without it, no board can say which rules apply. The EU AI Act Board Checklist below turns the five actions into questions for management. AIPEX provides governance guidance and does not certify compliance.
Frequently asked questions
Does the US have an AI law like the EU AI Act?
Not at federal level at the time of writing. Executive Order 14409 of 2 June 2026 sets up a voluntary framework for frontier model testing and states it creates no mandatory licensing. The EU AI Act, by contrast, is binding law with deadlines and fines.
Should a UK company follow US or EU AI rules?
Both may apply, but for most UK businesses with European customers the EU AI Act sets the higher bar. Building one governance baseline to the EU standard usually covers most UK regulator and US customer expectations too. This is governance guidance, not legal advice.
Does the UK have its own AI law?
At the time of writing, no AI-specific statute. Existing regulators apply current law, such as data protection, consumer and equality law, to AI. For the EU side, see Has Anyone Been Fined Under the EU AI Act? →
Correct as of 28 September 2026. This content reflects the law, official guidance and deadlines as published on that date. The EU AI Act and its guidance, standards and deadlines are still being amended and clarified. If you are reading this after 28 September 2026, check for later amendments, European Commission guidance and harmonised standards before relying on it. It is general information, not legal advice, and AIPEX accepts no liability for decisions taken on it without specific professional advice.