Artificial intelligence is becoming part of the infrastructure businesses depend on. It supports customer interactions, informs decisions, generates code, and increasingly takes actions across connected systems. As its role expands, governments are facing a difficult question: how much control is needed, and who should be responsible for exercising it?

The European Union, the United States, and China are answering differently. Europe has built a binding framework around risk. Washington is prioritising development and infrastructure, alongside voluntary industry commitments and a growing patchwork of state legislation. China combines support for innovation with extensive government oversight.

For companies building AI-enabled products, these differences affect product scope, architecture, market access, and the evidence teams need to demonstrate that their systems are safe to operate.

Europe: obligations shaped by the use case

The EU AI Act takes a risk-based approach. Requirements depend on what a system does and how it could affect people.

Applications with minimal risk face few AI Act-specific restrictions. Other uses require transparency, including informing people when they interact with a chatbot. High-risk applications, such as certain recruitment and creditworthiness systems, face requirements covering risk management, documentation, traceability, human oversight, and security.

Some practices are prohibited. These include social scoring and certain harmful forms of manipulation. The restrictions are specific: emotion recognition, for example, is prohibited in workplaces and educational institutions, subject to limited exceptions, rather than banned in every context.

Implementation has also changed. The Council’s June 2026 approval of the AI simplification package moved the application dates for high-risk rules to December 2027 for stand-alone systems and August 2028 for high-risk systems embedded in products. Those changes do not amount to a blanket postponement of the entire AI Act.

For engineering teams, the practical implication is to classify the intended use early. An assistant that retrieves internal documentation and a system that influences access to credit can require very different controls, even when they use the same underlying model.

The United States: accelerating development, with multiple layers of oversight

The US federal approach places strong emphasis on technological leadership. The White House’s July 2025 AI Action Plan set out more than 90 policy actions across innovation, infrastructure, and international diplomacy and security, including measures intended to remove barriers to development.

Voluntary commitments also play a prominent role. On September 29, 2026, leading technology companies signed an agreement covering AI safety measures, including independent assessments and protections against unauthorised access. This reflects an approach that gives industry substantial responsibility for implementing safeguards.

However, businesses should not interpret federal support for deregulation as an absence of binding obligations. States are developing their own requirements. California, for example, has enacted measures addressing frontier AI safety, transparency, and independent oversight.

The resulting challenge for product teams is fragmentation. Launch planning needs to account for the jurisdictions a product serves, its intended users, and the activities it performs. A single assumption about “US AI rules” is unlikely to provide enough detail for those decisions.

China: innovation within extensive state oversight

China’s approach combines encouragement of domestic AI development with detailed rules governing how services operate and what content they produce.

Its rules for AI services that simulate sustained emotional interaction took effect on July 15, 2026. They address risks including emotional dependency, manipulation, harmful content, and threats to minors. They also require providers to establish safety, content management, and emergency response processes.

The scope matters. Ordinary customer service, knowledge retrieval, and workplace assistants that do not provide sustained emotional interaction are explicitly excluded from these particular rules.

The same framework encourages technical innovation while imposing restrictions related to national security and politically sensitive content. The policy direction is continued development within closely supervised boundaries.

For businesses, this illustrates why a product’s behaviour matters as much as its technical category. Adding persistent personalities or relationship-building features can change the risks and regulatory questions a team needs to assess.

What this means for AI delivery

These approaches create different obligations, but they point to a shared engineering challenge: teams need to understand and control the systems they deploy.

At Control F5, we see several practical priorities for AI initiatives:

Define the operating boundaries. Identify what the system can access, recommend, change, or execute.
Assign responsibility. Establish who approves sensitive actions, investigates failures, and owns release decisions.
Build traceability. Record the information needed to investigate outcomes, while respecting privacy and retention requirements.
Test the complete workflow. Evaluate permissions, integrations, exceptions, and human handoffs alongside model output quality.
Plan for change. Make it possible to update models, policies, and safeguards without destabilising core operations.

An AI feature becomes a business responsibility the moment people rely on it. Regulatory approaches will continue to evolve, but clear ownership, controlled access, meaningful testing, and reliable intervention mechanisms already belong in the delivery plan.

Source