Which AI rules apply, and when?

You read that an AI law "takes effect today." Does a product have to change today too? Usually there is a schedule: when the law exists, when particular duties begin, and sometimes a later deadline for products already on sale.

Examples from the European Union, the United States, and South Korea show how to read that schedule. Dates come from official sources checked on October 28, 2026. Recheck before relying on them. This is a reading guide, not legal advice.

AI rules come in 3 broad kinds. Binding law, such as the EU AI Act or Colorado's state law, comes from a legislature and carries penalties. Executive policy comes from government leaders and directs their own departments. A US executive order can tell departments to act but cannot change state law by itself.

Voluntary frameworks are guidance organizations choose to follow. The NIST AI Risk Management Framework, released January 26, 2023, is "intended for voluntary use," and NIST is revising it. The OECD AI Principles, adopted in May 2019 and updated in May 2024, are a recommendation, not a law, with 47 adherents including the EU.

When a product "complies with AI rules," ask which kind.

Read a rule with 4 questions in mind:

1. Where? A law covers a place, or the people and products in it. An EU rule can reach an American company that offers its system in the EU.
2. Who? Laws assign duties by role. In the EU AI Act, a provider develops an AI system, or has one developed, and offers it under its own name. A deployer uses an AI system under its authority. The definitions in Article 3 leave out a person using AI "in the course of a personal non-professional activity."
3. What kind of use? Many duties attach to a category of use, not to AI in general. The EU's list of high-risk uses includes hiring, education, and credit scoring, among others.
4. When? Separate 3 dates: when the law enters into force (it exists), when a duty applies (someone must comply), and any transition date for systems already on the market.

Consider a fictional neighborhood book swap in the EU. It adds a chat assistant to its page for opening-hours questions. The company that built and sells the assistant under its own name is the provider. The swap may be a deployer, unless its use counts as personal and non-professional. Settle that by checking the facts against the text. The duty most likely to matter is transparency: Article 50 requires providers to design chat systems so people know they are talking to an AI, unless that is already obvious.

The AI Act entered into force on August 1, 2024, with duties beginning in stages. Regulation (EU) 2026/1744, the Digital Omnibus on AI, moved some dates and added bans. It entered into force on July 27, 2026.

The Commission's implementation timeline, which reflects the amendment, lists these dates:

• February 2, 2025: bans on certain practices, and the duty to build staff AI literacy.
• August 2, 2025: rules for general-purpose AI models, the large models many products are built on.
• August 2, 2026: most of the rest, including the Article 50 transparency rules. Enforcement starts.
• December 2, 2026: new bans on AI systems that generate non-consensual sexual deepfakes or child sexual abuse material. Also a transition deadline: some providers of systems that generate synthetic content, already on the market before August 2, 2026, have until this date to mark that content as AI-made under Article 50(2).
• August 2, 2027: each member state should have at least 1 regulatory sandbox running, a supervised space for testing AI systems.
• December 2, 2027: rules for the high-risk uses listed in Annex III, such as hiring and credit scoring.
• August 2, 2028: rules for high-risk AI built into products that already have their own EU safety law.

Before the amendment, the 2024 text set August 2, 2026, for most high-risk rules and August 2, 2027, for those built into products. A 2025 article can now give wrong dates. Compare its publication date with the rule's last change.

The US combines executive orders, government department actions, and state laws, without a single national AI law like the EU's.

Executive Order 14365, signed December 11, 2025, and published December 16, 2025, sets a policy of a "minimally burdensome national policy framework for AI." It directs the Attorney General to form a task force to challenge state AI laws in court, and the Commerce Department to name, within 90 days, state laws it finds onerous. It ties some national grant money to those findings and asks for a proposed national law that would override conflicting state rules, except state laws on child safety, computing and data center infrastructure, and a state's own use of AI.

The order does not void any state law by itself; a court, Congress, or a later government rule would have to. This guide did not track which follow-up steps have happened since, so check each department's own announcements.

Colorado repealed its 2024 AI law and replaced it with Senate Bill 26-189, signed May 14, 2026. The legislature lists that as the effective date for a few sections, including the attorney general's rule-writing duty. The signed text says the rest takes effect January 1, 2027, and applies to decisions made on or after that date. Both dates are correct for different parts of the law.

South Korea's AI Basic Act took effect on January 22, 2026, according to the US International Trade Administration. The Ministry of Science and ICT leads, and it said it would generally hold off on fines for at least a year. A law can apply before anyone faces a fine under it.

The Council of Europe's Framework Convention on AI is a treaty that starts only after enough countries ratify it. Whether it had entered into force could not be confirmed from an official page on October 28, 2026.

When choosing what to follow, start with binding law where you operate, then your sector regulators' rules, then a voluntary framework such as NIST's to organize the work.

These 3 products are fictional. Each is offered in the EU. Which date from the timeline above matters most for each?

1. The book swap's chat assistant from earlier, answering questions about opening hours.
2. A tool a company uses to rank job applicants.
3. An image generator that has been on sale since 2025.

Answer:

1. August 2, 2026. The transparency rules in Article 50 apply then. The software company, as provider, must make clear that people are talking to an AI, unless that is obvious.
2. December 2, 2027. Hiring is on the Annex III high-risk list. August 2, 2026, is a reasonable guess, since that was the original date and most rules apply then. The 2026 amendment moved this category back.
3. December 2, 2026. August 2, 2026, is the reasonable first reading, since Article 50 applies then. The detail that changes it is "on sale since 2025." Some generators already on the market before August 2, 2026, get until December 2, 2026, to mark their output as AI-made. Whether a given product qualifies depends on the text.

To apply this elsewhere, pick a rule in the news and write down its 4 answers: where, who, what kind of use, and which date. Add the day you checked. If one is missing, ask that next. The guide to reading AI news covers the same habit for product claims.

• Timeline for the implementation of the EU AI Act, European Commission AI Act Service Desk. Current dates, including the 2026 amendment.
• AI Act Article 50, European Commission. The transparency duties, with a plain-language summary.
• Executive Order 14365, GovInfo, US Government Publishing Office. The full order, about 3 pages.
• Colorado SB 26-189, Colorado General Assembly. Bill history and the signed act.
• NIST AI Risk Management Framework, NIST. A voluntary risk framework, under revision.