01Why anyone is writing rules for AI

Think about why we have safety rules for cars. A car is useful, but it can also hurt people, so we agree on seatbelts, crash tests, and speed limits. AI is reaching the same point. When a piece of software just sorted your photos, nobody needed a law. But today AI helps decide who gets a loan, whose résumé moves forward, or what a doctor sees first — decisions that touch people's safety, money, and rights. That shift is why governments are stepping in.

Three things about AI make regulators want extra care. First, an AI system can be hard to explain — even its makers can't always say exactly why it produced one answer. Second, it learns from data, so it can quietly pick up and repeat bias that was in that data. Third, it runs at huge scale, so a single flaw can affect thousands of people before anyone notices. The goal of regulation isn't to ban AI; it's to keep its use safe, fair, transparent, and accountable while still leaving room to innovate.

• Rules arrive once AI starts affecting people's safety, rights, and opportunities — not for every harmless use.
• AI can be opaque, can amplify bias from its data, and operates at a scale where mistakes spread fast.
• The aim is accountability and trust, not stopping innovation.

02The EU AI Act sorts AI by risk

The EU AI Act — the most far-reaching AI law so far — uses one simple idea: the more risk an AI use poses to people, the stricter the rules. It sorts uses into four tiers. A few uses are considered so harmful they're banned outright (unacceptable risk). Some uses that can seriously affect safety or rights are allowed but carry the heaviest duties (high risk). Others mainly have to be upfront with people (limited risk). And the vast majority pose little risk and face few or no special rules (minimal risk). Pick an example below to see where it tends to land and what that tier asks for.

• The same four tiers — unacceptable, high, limited, minimal — decide how strict the rules are for any given use.
• What matters is how a system is used, not how clever it is: a simple tool in a high-stakes setting can be high-risk.
• These examples are illustrative — real classification depends on the specifics and is a question for qualified counsel.

03Law, framework, standard — not the same thing

People lump "AI rules" together, but three very different kinds of document shape the field, and it matters which is which. One is a binding law you can be required to obey. One is a voluntary framework you follow because it's helpful. One is a certifiable standard an outside auditor can check you against. Switch between them to see how they differ.

• Binding law (EU AI Act) sets what you must do; ignoring it has legal consequences.
• Voluntary framework (NIST AI RMF) helps you organize the work; you adopt it because it's useful.
• Certifiable standard (ISO/IEC 42001) lets you demonstrate a structured approach to others through audit.

04Telling people, and knowing who's on the hook

Two themes run through almost every AI rule. The first is transparency: people should know when AI is involved. If you're chatting with a bot, you should be told it's a bot; if an image or video was generated or altered by AI, that should be disclosed so people can judge what they're seeing. The idea is simple — you can't make an informed choice about something you didn't know was there.

The second is who is responsible. The EU AI Act draws a key line between two roles. The provider is whoever builds an AI system and puts it on the market — they're mainly responsible for how it's built, documented, and made compliant before it ships. The deployer is whoever uses that system in their own work — they're responsible for using it as intended and keeping appropriate human oversight in their own setting. Build a hiring tool and sell it, and you're the provider; buy that tool and screen applicants with it, and you're the deployer. Both carry duties — responsibility is shared, not handed off.

• Transparency: disclose when someone is interacting with AI, and label AI-generated or AI-altered content.
• Provider: develops the system and places it on the market — responsible for how it's built and documented.
• Deployer: uses the system under its own authority — responsible for proper, overseen use in context.

→How teams actually get ready

Whatever rules end up applying, the readiness work tends to look the same — a short, repeatable set of practices teams run no matter which framework or law is in play.

• Inventory where AI is used — you can't classify or document what you can't see.
• Assess and classify each use's risk — so scrutiny scales with impact.
• Document each system — its purpose, data, limitations, and the decisions it informs.
• Build in human oversight for higher-impact uses — a person reviews what matters most.
• Meet transparency duties — tell affected people what the system does.
• Assign ownership and review regularly — readiness is a loop, because rules and systems keep changing.

05Check your understanding

06One important caveat, then go deeper