From Debate to Deadlines
Much of the AI policy conversation over the past two years has been about what regulation should look like. In 2026, that conversation is being overtaken by a more concrete one: several jurisdictions' AI-specific rules are now reaching their compliance deadlines, shifting the discussion from drafting to actually filing paperwork and changing products.
Who's Actually Covered
The rules that matter most apply narrowly, by design, to a small number of "frontier" model developers — companies training models above specific compute thresholds — plus a separate, broader set of disclosure requirements aimed at any company deploying AI in high-stakes contexts like hiring, lending, or healthcare. Most companies merely using off-the-shelf AI tools for ordinary business tasks fall outside the strictest provisions, despite some of the louder public commentary suggesting otherwise.
What Compliance Actually Looks Like
For covered frontier developers, the core requirements are incident reporting (disclosing serious safety incidents within a fixed window), model evaluation documentation before major releases, and in some jurisdictions, third-party audits of safety testing. For deployers in high-stakes sectors, the emphasis is on disclosure to affected individuals and the ability to explain automated decisions, not on AI development itself.
The Enforcement Reality
Early enforcement has been more about establishing process than issuing large penalties — regulators in this space have generally favored compliance conversations over headline fines in the first deadlines, a pattern consistent with how other new tech regulation has typically rolled out. That's expected to change as the frameworks mature and agencies build out enforcement capacity.
The Practical Read for Businesses
The operational lesson so far isn't "AI is now illegal to use without a license" — it's that companies deploying AI in regulated, high-stakes decisions need a documented basis for those decisions, and the handful of largest model developers face genuinely new reporting obligations. Everyone else's exposure is smaller than the more alarmist coverage has implied, though that could shift as more provisions phase in over the coming year.
Commenting is currently unavailable on this article.