If you run AI in production, you’re likely aware that AI regulations are regularly evolving. Some EU dates have already moved, US state laws keep getting rewritten, and in our customer reviews, buyers treat voluntary frameworks as mandatory. Here’s where each one stands this fall and what’s still coming before the end of 2027.

The EU AI Act hit its biggest date so far, and EU lawmakers pushed back the next one

August 2, 2026 was the general application date for the EU AI Act. From that date, the Article 50 transparency rules apply. In short:

  • AI interactions: providers must design systems like chatbots so people know they’re talking to an AI, unless that’s already obvious.
  • Synthetic content: providers of AI that generates audio, images, video, or text must mark the output in a machine-readable format so it can be detected as AI-generated.
  • Emotion recognition and biometric categorization: deployers must tell people when these systems are being used on them.
  • Deepfakes and public-interest text: deployers must disclose deepfakes, and label AI-generated text published to inform the public on matters of public interest, unless a human has reviewed it and holds editorial responsibility.

Providers of generative AI systems already on the market before August 2, 2026 have until December 2, 2026 to meet the Article 50(2) marking requirement. As of August 2, the European AI Office, the European Commission body that oversees general-purpose AI models, has the power to enforce the rules for those models.

The high-risk obligations didn’t arrive on schedule. The EU’s “Digital Omnibus on AI” (Regulation (EU) 2026/1744, in force since July 27, 2026) delayed the heaviest requirements, including conformity assessments, risk management systems, and human oversight. They now apply from December 2, 2027 for Annex III high-risk systems and August 2, 2028 for Annex I systems embedded in products.

Annex III covers AI used for specific sensitive purposes, such as hiring, credit scoring, education, biometrics, and access to essential services. Annex I covers AI built into products already regulated under EU safety law, such as medical devices or machinery. To see where your systems fall, map each one’s purpose against those lists. For a step-by-step walkthrough, see How to Navigate the EU AI Act.

The obligations are delayed, not cancelled. The delay has drawn criticism from both industry and civil society. Industry association DIGITALEUROPE says the delay alone isn’t enough and the rules still need deeper fixes. In a joint statement, digital-rights groups EDRi, Access Now, and the European Center for Not-for-Profit Law (ECNL), with Amnesty International, say the final deal “delays key protections, weakens transparency and creates a dangerous precedent for the EU digital rulebook.” For compliance teams, the useful part is that the dates are now written into law, so you can plan against them.

NIST is becoming the common reference point

The National Institute of Standards and Technology (NIST) AI Risk Management Framework can’t be enforced on its own, but laws and frameworks keep pointing to it. Two developments to watch:

  • AI Agent Standards Initiative. On February 17, 2026, NIST’s Center for AI Standards and Innovation (CAISI) launched this initiative to close the gap left by governing agents the same way as regular generative AI. It rests on three pillars: industry-led standards, community-led open-source protocols, and technical research into agent security and identity.
  • Critical infrastructure profile. In April 2026, NIST published a concept note for an AI Risk Management Framework (RMF) Profile on Trustworthy AI in Critical Infrastructure. It’s meant to guide critical infrastructure operators on risk management practices when they use AI. It’s still under discussion with a NIST-convened community of interest, and no draft has been published.

Neither effort has produced finished guidance yet. What they show is where NIST is putting its attention: agents and high-stakes sectors.

State laws show NIST’s influence more directly. Colorado’s original AI Act (SB 24-205) gave organizations an affirmative defense if they found and fixed violations, for example through red teaming or internal review, and otherwise followed a recognized framework such as the NIST AI RMF or ISO/IEC 42001. The replacement law, SB 26-189 (signed May 14, 2026, effective January 1, 2027), swapped that defense for a 60-day cure period and dropped the risk management program and impact assessment requirements. Texas took a different approach. The Texas Responsible Artificial Intelligence Governance Act (TRAIGA), signed in June 2025 and in effect since January 1, 2026, gives companies a defense if they discover violations through feedback, adversarial or red-team testing, or state agency guidelines. A separate defense covers internal review, where a company substantially complies with NIST’s Generative AI Profile or another recognized AI risk framework.

OWASP and MITRE ATLAS: the technical baseline under the legal one

The Open Worldwide Application Security Project’s (OWASP) Top 10 for Large Language Model (LLM) Applications and MITRE ATLAS give security and compliance teams a shared technical vocabulary. OWASP lists vulnerability classes like prompt injection, improper output handling, and data and model poisoning. ATLAS lists the tactics and techniques attackers use against AI systems.

Neither one comes with a fine, but in our work with enterprise customers, both come up regularly in vendor security questionnaires and procurement reviews. If you can’t map your system’s risks to at least one of them, your testing probably hasn’t gone deep enough.

Enkrypt AI, which joined Anaconda in August 2026, runs this kind of testing before and after deployment, red-teaming models and agents across more than 300 attack categories. Enkrypt AI was recognized as a Gartner® Cool Vendor in AI Security, 2025.

The US: no comprehensive federal law, a growing state patchwork

The US still has no comprehensive federal AI law. A December 2025 executive order pushes for a single national standard and challenges state AI laws, but Congress hasn’t passed preemption. For now, the states set the rules:

  • Texas’s TRAIGA has been in effect since January 1, 2026.
  • California’s Transparency in Frontier Artificial Intelligence Act (SB 53), in effect since January 1, 2026, requires large frontier model developers to publish safety frameworks and transparency reports and to report critical safety incidents to the state.
  • Illinois’s HB 3773, in effect since January 1, 2026, makes it a civil rights violation for employers to use AI that discriminates against protected groups, and requires them to tell workers and applicants when AI is used in employment decisions.
  • Colorado’s SB 26-189 takes effect January 1, 2027.
  • New York City’s Local Law 144 still requires bias audits for automated hiring tools.

These laws differ from one another. Many multinationals choose to build to the EU AI Act’s higher bar and adapt for US operations instead of running separate compliance programs.

What to watch heading into 2027

The deadlines still ahead, and who each one affects:

  • December 2, 2026: providers of generative AI systems already on the EU market before August 2, 2026 must meet the Article 50(2) content-marking requirement.
  • January 1, 2027: Colorado’s Automated Decision-Making Technology (ADMT) law takes effect.
  • December 2, 2027: EU high-risk obligations apply to Annex III systems, such as AI used in hiring, credit scoring, or education.
  • August 2, 2028: EU high-risk obligations apply to Annex I systems embedded in regulated products.

Building an evidence trail before enforcement starts is easier than doing it under a deadline. Waiting for enforcement to force the issue tends to compress a process that benefits from more runway.

We’ve written about why a policy-driven approach holds up better than working through frameworks one at a time: you translate the frameworks into enforceable rules specific to your company. Read more in Safely Scaling Generative AI, and see how that approach supports continuous evidence collection in AI Compliance Management.

Explore AI security & guardrails to see how Enkrypt AI by Anaconda tests, protects, and documents AI models and agents across their lifecycle.

To see how these frameworks could translate into rules for your own deployment, try the AI Policy Builder. Answer a few questions about your agent’s purpose, data access, and risk priorities, and you’ll receive a draft policy, framework mapping, and guardrail rules by email. It’s a starting point for your team’s review, not a compliance assessment or legal advice.

(The AI Policy Builder is not endorsed by or affiliated with NIST, the European AI Office, OWASP, or MITRE.)

FAQ

When do EU AI Act high-risk obligations take effect?

December 2, 2027 for Annex III (standalone) high-risk systems and August 2, 2028 for Annex I (product-embedded) systems. The Digital Omnibus on AI set both dates in 2026. The Article 50 transparency obligations have applied since August 2, 2026.

Is the NIST AI RMF legally required?

No, it’s voluntary. But laws increasingly reference it. Texas’s TRAIGA, for example, ties a liability defense to NIST’s Generative AI Profile or a comparable framework.

How is OWASP’s LLM Top 10 different from MITRE ATLAS?

OWASP lists vulnerability classes in LLM applications, such as prompt injection and improper output handling. MITRE ATLAS lists the tactics and techniques attackers use against AI systems. They complement each other.

Is there a US federal AI law?

Not a comprehensive one. Regulation is happening state by state, including Texas’s TRAIGA, Colorado’s SB 26-189 (effective January 1, 2027), and New York City’s Local Law 144. The result is a patchwork, with no single national standard. Try building a policy mapped to these frameworks yourself.

Disclaimer

This article is for general informational purposes only and does not constitute legal advice. Regulatory dates and requirements are current as of October 2026 and may change. Consult qualified counsel for guidance specific to your organization.