AI: what the gap between Washington and Brussels changes for your products

What was signed in Washington

On 29 September, Donald Trump signed a "joint commitment" with Sundar Pichai (Google), Dario Amodei (Anthropic), Mark Zuckerberg (Meta), Greg Brockman (OpenAI), Jensen Huang (Nvidia) and Elon Musk. CBS News lists the four layers of control it sets out: internal controls, an internal verification team, an external audit and review by a board committee. The text says that "over time, it may make sense to codify these steps into laws or regulations". The president called it "morally binding". According to The Guardian, the document carries no enforcement mechanism.

In Congress, nothing is moving. The DC/ai Decoded newsletter of 5 October reports that several AI bills were blocked before the election recess. The midterm elections take place on 3 November.

The Colorado story

In 2024 Colorado passed the most ambitious AI law in the United States. It imposed a duty of care and impact assessments on developers and deployers of high-risk systems. CrossGov traces what happened next.

In December 2025, an executive order set up a Justice Department task force to challenge state laws, and tied roughly $21 billion of broadband funding to the states' approach. The Commerce Department was to list laws it considered onerous, and the order named Colorado's. In April 2026, xAI sued to block the law and the federal government moved to join the case. The state attorney general suspended enforcement. On 14 May, the governor signed a replacement. It drops the duty of care and the impact assessments. Instead, it gives people rights to notice, access, correction and human review of automated decisions, from 1 January 2027.

What I take from this episode: a state law can be rewritten within months under federal pressure. A European company selling in the United States therefore has to track a moving target, state by state. California's SB 53, in force since 1 January 2026, targets the largest model developers and remains in place.

The European timeline

In Europe, the framework is set and the timeline has moved. The AI omnibus came into force on 27 July 2026. It postpones the rules for the high-risk systems in Annex III to 2 December 2027, and those for physical products in Annex I to 2 August 2028. The transparency obligations of Article 50 have applied since 2 August 2026: inform people who interact with an AI system, mark generated content, label deepfakes.

To help companies, the Commission published a code of practice on the transparency of AI-generated content on 10 June. It is voluntary. According to the Commission, about 190 organisations had signed it by the end of July. On 30 September, more than 90 signatories set up two task forces, on marking and on labelling, chaired by the AI Office.

In France, cybersecurity adds uncertainty. The bill that is meant to transpose the NIS2 directive was again removed from the National Assembly's agenda on 6 October, with no new date, according to Leto. As of 19 October, it is still absent from the bills scheduled up to 29 October. Its obligations therefore do not yet apply under French law.

What I recommend

1. Use the AI Act as your baseline specification. A product that informs users, marks its content and documents its uses meets the strictest rule in your markets.
2. Classify your uses now. List every AI feature in your products and record whether it falls under Article 50, the high-risk regime or no obligation. Date that classification.
3. Use the 2027 delay. The postponement leaves a little over a year to prepare the documentation for high-risk systems. I would start this quarter, before teams are taken up by other priorities.
4. Track the US states where you sell. Colorado's new law takes effect on 1 January 2027. Plan human review of automated decisions if your customers are there.
5. Read your suppliers' commitments. The 29 September pledge creates no contractual obligation towards you. Ask your model providers for their written commitments on safety, audit and incident notification.
6. Prepare for NIS2 without waiting for the law. Check whether your organisation falls within scope, as an essential or important entity, and name now the person who will own cyber-risk governance.

This is the kind of roadmap I build with teams in a digital project management assignment.

Action timeline

My takeaway

Europe has settled the question of who sets the rule and is now arguing about timing. The United States is still debating who should regulate. I think this gap will last until at least 2027. I will come back to the subject after the 3 November elections.