Governing AI: liability, regulation and geopolitics

Liability: who is responsible when AI causes harm#

It depends on the law: in October 2024 the European Union adopted rules making the maker of defective software liable even when no one was at fault.1 A company that deploys AI can also be held responsible for what the AI tells people.23

Contract law lets a person claim when a business breaks a promise or warranty.1 Under fault-based liability, the victim must prove that someone acted wrongly or failed to act and so caused the harm.4 Product liability is strict, or no-fault: the maker of a defective product pays whether or not anyone was careless.51 AI strains the fault route, because its complexity and opacity can make it too hard or costly for victims to show who is liable.4

In 2022, Air Canada's chatbot wrongly told passenger Jake Moffatt that a funeral-travel discount could be claimed after booking a full-fare ticket.2 When Moffatt sued, the airline argued the chatbot was a separate legal entity responsible for its own actions.62 British Columbia's Civil Resolution Tribunal ruled for Moffatt, with member Christopher Rivers writing: "It makes no difference whether the information comes from a static page or a chatbot."2

The nonprofit Legal Advocates for Safe Science and Technology sued OpenAI over the attack, arguing "OpenAI is responsible for the conduct of its agents."7 OpenAI said the Hugging Face attack "was a serious incident" but that "this lawsuit is completely without merit."7

The EU AI Act#

The EU AI Act is a European Union law that sets risk-based duties for those who develop AI and the organizations that deploy it.8 It was signed in June 2024, and a July 2026 amending law, the Digital Omnibus on AI, delayed its high-risk duties (explained below) to December 2027 for stand-alone systems and August 2028 for systems built into products.910

It bans certain practices, sets rules for high-risk systems, adds transparency duties for some others, and has separate duties for general-purpose AI models, which can do many kinds of tasks.11121314 Banned practices include social scoring (rating people over time by their social behavior or personal traits), scraping the internet or CCTV footage to build facial recognition databases, and emotion recognition at school or work.1516 A system is usually high-risk if it is a safety part of a product that listed EU laws require to get an outside safety check, or if it is used in a listed area such as critical infrastructure.1718 Its maker must manage risk across the system's whole life, with checks before release and oversight after.1920

The General-Purpose AI Code of Practice, a voluntary tool prepared by independent experts, shows what the Act's rules for general-purpose models mean in practice.13 Its Transparency and Copyright chapters serve every general-purpose model maker; its Safety and Security chapter serves only makers of the most advanced models, which the Act labels as having 'systemic risk' and gives extra duties.13 Signing and following it lets a model maker show that it complies with the Act.13

The United States: federal policy and state laws#

In the United States, the president directs federal agencies through executive orders, and states pass their own AI laws.2122 A central fight is over preemption, meaning whether one national standard should override state laws that conflict with it.2123

An executive order is not a law passed by Congress, so a later president can revoke it, as President Trump did in January 2025, on his first day in office, with a Biden order that had set new safety standards for large AI systems.2425 In 2024, Colorado enacted SB 24-205, which requires developers of AI systems that the act itself labels high-risk to use reasonable care against risks of algorithmic discrimination.2622 In August 2025, Colorado enacted SB 25B-004, which pushed those duties back to June 30, 2026.26 As of October 2026, this guide has not confirmed whether the duties took effect on that date or were changed by later legislation.26 In September 2025, California enacted SB 53, the Transparency in Frontier Artificial Intelligence Act, which requires developers of the most powerful frontier models to disclose how they build, test and monitor them and to report significant failures.2728

In 2025, the House passed a federal budget bill that included a moratorium, or temporary ban, on state AI regulations.29 Senators Ed Markey and Maria Cantwell said the provision would have forced states to choose between enforcing AI consumer protections and accepting federal broadband money.2923 On July 1, 2025, the Senate voted nearly unanimously, on an amendment from senators of both parties, to strip the moratorium out.2923 In December 2025, after that vote, President Trump issued Executive Order 14365, which argued that state-by-state rules make compliance harder, especially for start-ups, and that Colorado's law may even force AI models to produce false results.3021 The order calls for a minimally burdensome national standard and has the Attorney General form a task force to challenge conflicting state AI laws.3021

Content provenance and watermarking: labeling AI-generated content#

AI content can be labeled when it is made, with provenance metadata (an origin record attached to the file) or a watermark (a hidden signal inside the content).31 Tools called classifiers, which guess from the content alone, can do well in controlled tests, but researchers found paraphrasing or style changes often throw them off.32

Industry guidance presents C2PA, a provenance standard, and watermarks as complementary layers.31 A research paper found that C2PA validation checks the record's signature, a seal made with the signer's digital credentials, not whether the record's claims are true.31 Its authors showed that a file can carry a signed record claiming human authorship and an AI watermark at once, because neither check looks at the other.31 They proposed a joint check of both layers and called the gap straightforward to close.31 For text, a common method acts as the model writes: it slightly favors words picked by a secret key, a hidden value the detector also needs.3334 A detector with the key counts those words, and over a long passage, a count well above chance is statistical evidence the text came from the model.3335

In January 2023, OpenAI released the AI Classifier, a tool to detect AI-written text, and said from the start it was not fully reliable.36 That July, OpenAI shut it down for its "low rate of accuracy," saying it was researching better provenance methods for text.3637 A classifier guesses from patterns, while a watermark lets the key holder test for a planted signal, though paraphrasing can still sharply cut its detection.37323538

Data center bans and pauses: local pushback#

Some communities pause or block new data centers over concerns about water and electricity use, noise, and a lack of transparency.39 The pushback comes as tech companies race to build cloud and AI infrastructure (see data centers and power).39

A data center needs local approvals, such as zone changes, permits and a utility supply deal.4039 A moratorium, a temporary pause on those approvals, lets officials stop new projects while they write rules.40 In June 2026, the council in Lexington, Kentucky, unanimously passed one pausing permits, development plans and zone changes for data centers.40 In US fights over state AI laws, the word means something else: a federal block on those laws (see federal policy and state laws).4142

The Guardian described Project Blue as a proposed data center outside Tucson, Arizona, that would become the biggest development ever in Pima County.39 Most Tucsonans had not heard of it until June 17, 2025, when county supervisors narrowly agreed to sell and rezone land for it.39 Residents objected to its water and power needs and its lack of transparency, and the Guardian said the episode showed communities weighing promised jobs against effects on natural resources.39 It shows the objections behind such pauses, not a pause itself.39

In August 2026, we reported that Texas Governor Greg Abbott directed state regulators to audit data center projects and pause approvals pending those audits.43 Other pauses target AI itself: in August 2026 we covered a federal bill to halt new AI data center construction until Congress passes AI safety laws, one of several pause proposals.44

Regulatory capture: is Anthropic shaping AI rules in its own favor? The charge and the replies#

Regulatory capture is when companies push government to write rules shaped in their own interests, which can limit competition.45 Critics say Anthropic's calls for AI rules fit this pattern, on the view that such rules might slow its potential rivals.46 Anthropic wrote that it endorsed California's SB 53 and that the law exempts "smaller companies from unnecessary regulatory burdens."47

Governor Gavin Newsom signed SB 53 into law in September 2025 as the Transparency in Frontier Artificial Intelligence Act.2728 The law applies mainly to large frontier developers, and its duties center on safety frameworks and incident reporting.27

In September 2026, Anthropic's chief executive, Dario Amodei, called for a slowdown in AI development and suggested an antitrust waiver so that rival labs could coordinate their pace. Our story.484950 Donald Trump's former AI czar, David Sacks, and former Federal Trade Commission official Alvaro Bedoya suggested this amounted to an attempt at regulatory capture that would benefit current industry leaders.49 Bedoya posted on X that antitrust law "does absolutely prevent AI companies from organizing to prevent the entry of cheaper, upstart rivals."49 AI pioneer Yoshua Bengio disagreed with the capture argument, saying a slowdown by leading firms would "cost them financially."51

In September 2026, our story reported that Vice President JD Vance criticized frontier AI companies, naming Anthropic, but said he does not believe Amodei's push for regulation is motivated by regulatory capture.52

AI chip export controls#

Since October 2022, the US government has restricted exports of the most advanced AI chips to China and other countries of concern, along with some of the equipment used to make such chips.5354

An export control is a rule requiring a government permit, called a license, before certain goods, software or technology go abroad or reach foreign nationals.55 In the US, the Commerce Department's Bureau of Industry and Security (BIS) administers and enforces these rules.5553 For AI, the rules cover advanced chips, the computers built with them, and certain chipmaking equipment, because these chips supply the compute, or raw computing power, needed to train advanced AI models.5455 To catch chips diverted to forbidden buyers, BIS uses trade and licensing data, intelligence and industry tips, but smugglers have repeatedly gotten around the controls.53

In April 2025, the US government told Nvidia that a license was required to export its H20 chips to China.56 The H20 was a chip Nvidia had been selling into China without a license, and it had sold billions of dollars of them that quarter before the new rule.56 Nvidia then took a $4.5 billion charge, an accounting cost, for unneeded H20 stock and orders as demand fell.56 The case shows how the US can change the rules for a single chip through licensing, and what that change cost the chipmaker in that quarter.56

In October 2026, prosecutors charged the CEO of Earthmade Computer, alleging that Nvidia servers were routed to China through Malaysia and Singapore on false paperwork.5758

Sovereign AI: national AI capacity#

Sovereign AI is the idea that a government should develop, control and govern its own AI, for growth, security and strategic autonomy.59 Countries are building their own compute, datasets and models, partly to depend less on foreign companies.59

In a November 2025 paper, researchers Shalabh Kumar Singh and Shubhashis Sengupta described sovereign AI as 'a continuum rather than a binary condition,' balancing autonomy with interdependence.6061 They argued that while governments seek more control, AI's foundations, such as global data pipelines and chip supply chains, 'resist enclosure.'60 In July 2025, a US presidential order directed the Commerce Secretary to set up the American AI Exports Program, to offer allies and partners 'full-stack' packages, from chips to models.6263 In April 2026, Michael Kratsios, director of the White House Office of Science and Technology Policy, said the program was putting into action President Trump's 'vision for sharing a trusted, sovereign AI stack with the world.'64 Data residency covers where an organization's data physically sits and the local laws imposed on it. In February 2025, TechCrunch reported that most tech giants and cloud providers offered European data residency programs to help customers comply with European privacy laws such as the GDPR.65 That month, the US company OpenAI launched data residency in Europe that lets API customers (businesses building on its models) process data there for eligible endpoints, meaning the API services that support it, which it said helps organizations meet 'local data sovereignty requirements.'6566 By November 2025, OpenAI had extended at-rest data residency, which covers stored data rather than data in motion, beyond Europe to other regions, including the UK, the US, Japan, India and the UAE, for eligible API customers and new ChatGPT Enterprise and Edu workspaces (its business and education plans).6665 In January 2026, OpenAI added in-region inference, meaning the model runs on chips in that region, in the US or Europe for eligible ChatGPT Enterprise, Edu and Healthcare customers.66

Isambard-AI, a Bristol supercomputer launched in July 2025, is part of Britain's push for 'AI sovereignty' so the country need not rely on foreign chips.676869 At the same time, it runs on Nvidia 'superchips,' and Nvidia helped develop it.6869 It was set to join Britain's public AI computing capacity, giving academics and public bodies computing power once held by private tech companies.7068

In August 2026, Mistral and HUMAIN, a Saudi Public Investment Fund company, announced a deal framed around sovereign AI.71 In August 2026, Mistral launched regional endpoints, separate web addresses that keep inference in Europe or the US, with limited exceptions.72