Intermediate level8 min readTo learn at another level, choose it before you start the course.
After this lesson you canFind the AI rules that apply to you by asking where you are, what you use AI for, and what your role is.
The short answerIt depends on three things: where you are, what you use AI for, and whether you build the AI tool or use it. Rules from bigger places add up, so a business in New York City follows city, state and US federal rules.
In simple words
- First ask: where do you work or sell?
- Then ask: what do you use AI for?
- Rules add up: your city, your state or country, and the wider area.
- Last, ask: do you build the AI tool, or use it?
The short answerTo find your AI rules, combine place, use and role. Places nest, so the rules of your city, your state or country, and the US or the EU can all apply. Your role as builder, user or employer decides which duties are yours.
In simple words
- Place: rules from every level above you apply too.
- Use: hiring, chatbots, content, decisions and pricing each have their own rules.
- Role: providers build AI; deployers use it; platforms host content.
- Dates: check whether a rule is in force or starts later.
The short answerApplicability runs on four axes: territorial scope, regulated activity, legal role and timing, plus overlaps with general law such as the GDPR or anti-discrimination statutes. Extraterritorial reach means a US company can owe EU duties.
Key points
- Territorial scope: the AI Act reaches providers abroad, and their outputs used in the EU.
- Roles: provider, deployer, importer, distributor; general-purpose AI provider; platform; employer.
- Timing: in force, applies later, transition periods for systems already on the market.
- Overlaps: GDPR Article 22, anti-discrimination and labour law often matter as much.
10 rules apply to hiring or promotion here: 7 in force, 3 coming.
- Tell job candidates before using AI to assess themFrance In force
- Tell the works council before AI hiring or tracking toolsFrance In force
- Do not let AI alone make big decisions about peopleEU In force
- Explain your automated decision rules when askedFrance In force
- Help your staff understand the AI they useEU In force
Words to know
- Provider
- A company that makes an AI tool, or has one made, and offers it under its own name.
- Deployer
- A business that uses an AI tool in its work, such as a recruiter.
- In force
- Already applying today. Many laws are passed first and apply only later.
Two questions
AI rules are not the same everywhere. A rule in California may not apply in Germany, and a rule about hiring may not matter if you only use AI to write emails.
So start with two questions: where are you, and what do you use AI for? The answers turn a long list of rules into the few that matter to you.
Rules add up
Places sit inside bigger places, and their rules stack. A company in Paris follows French law and EU law. A company in New York City follows city, New York State and US federal rules.
EU laws such as the AI Act apply in every EU country. US federal laws apply in every state, and state laws add to them.
Who does what
Rules also depend on a third thing: your role. The law calls the company that builds an AI tool the provider, and the company that uses it the deployer.
They have different duties, and both differ from a person who just chats with it. Most duties fall on businesses. As a person, you mainly gain rights, such as being told when AI judges you.
Check the date too. A rule is in force only once it applies, and many laws are passed first and apply later.
Try it yourself
Answer the two questions in the diagram for your own work. Note which rules are in force, then open them in the full checker and add a second use.
Check yourself
A café owner in Lisbon wants to know which AI rules matter for the café. Which two questions come first?
A company in Paris already follows every French rule on AI. Can an EU rule such as the AI Act still apply to it?
A hotel uses an AI hiring tool that a software firm built. The hotel says: “The firm made it, so all the duties are theirs.” Is that right?
Words to know
- Provider
- A company that makes an AI tool, or has one made, and offers it under its own name.
- Deployer
- A business that uses an AI tool in its work, such as a recruiter.
- In force
- Already applying today. Many laws are passed first and apply only later.
Place: rules nest
EU regulations such as the AI Act apply directly in every member state, and national laws can add duties. Germany, for example, backs the EU right to an explanation with fines of up to €50,000.
In the US, federal rules apply in every state, and state rules add to them. New York State’s rules also apply in New York City, on top of the city’s own law on AI hiring tools.
Use: what the AI does
Our checker sorts rules by a dozen uses, from chatbots and AI-made content to hiring, layoffs, pricing and building models. One business can have several uses.
A shop in New York that sets prices with personal data, for example, must label those prices. Connecticut goes further: shops may not set personal prices from tracking data at all, with a few exceptions.
Role and dates
The AI Act separates providers, who make AI or have it made and offer it under their own name, from deployers, who use it under their authority. A recruiter using an AI screening tool is a deployer; the tool’s maker is a provider.
Check the start date of every rule. Many rules are passed long before they apply: California passed its No Robo Bosses Act in 2026, but it applies only from July 1, 2027.
What the checker leaves out
Our checker covers binding AI laws in 11 places, plus a few general laws that are the main rule for an AI use. It leaves out sector rules, guidance and most general laws.
It is a summary, not legal advice. For important decisions, read the official text linked with each rule, or ask a lawyer.
Try it yourself
Answer the two questions in the diagram for your own work. Note which rules are in force, then open them in the full checker and add a second use.
Check yourself
A recruiter in Berlin uses an AI screening tool made by a US company. Under the AI Act, what is the recruiter?
A shop in New York lets an algorithm use customers’ personal data to set the prices it shows them. What must it do?
In October 2026, a California employer reads about the No Robo Bosses Act, which is already law. When must it follow it?
Territorial reach
The AI Act applies to providers placing AI on the EU market, wherever they are established, and to providers and deployers abroad when the system’s output is used in the EU.
US state laws reach companies by where the affected people live or work, not only where the company sits. New York City’s hiring rule covers jobs located in the city, and its notices go to candidates who live there.
Roles and duties
Providers carry design duties: documentation, conformity assessment and marking outputs. Deployers carry use duties: oversight, logs, notices and, for some uses, impact assessments.
A deployer that substantially modifies a high-risk system or puts its own name on it can become a provider. Contracts with vendors should allocate these duties explicitly.
Timing and transitions
Distinguish entry into force, application dates and transition periods. General-purpose models on the market before August 2, 2025 have until August 2, 2027; older generative systems have until December 2, 2026 for marking.
High-risk duties for AI types already on the market apply only after a significant design change. Colorado’s SB 26-189 replaced the 2024 Colorado AI Act, so check which version a summary describes.
General law still applies
AI-specific rules sit on top of general law. GDPR Article 22 limits solely automated decisions with significant effects, and anti-discrimination law applies whatever tool made the decision.
Our checker lists binding AI rules in 11 places and states its limits on the page. Use it to scope the question, then read the official texts.
Try it yourself
Answer the two questions in the diagram for your own work. Note which rules are in force, then open them in the full checker and add a second use.
Check yourself
A US company with no EU office sells an AI tool to a client in Milan, which uses its output there. Does the AI Act reach the US company?
A bank in Brussels puts its own brand on a vendor’s high-risk credit-scoring system and changes it substantially. What follows?
A general-purpose model went on the EU market in March 2025. By when must its provider meet the GPAI duties?
Sources
- AI Act, Article 2: scope (EU AI Act Service Desk)
- AI Act, Article 25: responsibilities along the value chain (EU AI Act Service Desk)
- General Business Law section 349-a (New York State Senate)
- GDPR, Regulation (EU) 2016/679 (EUR-Lex)
This lesson was generated by AI systems under the editorial rules of Silicon AI News and checked against the sources it lists. The live parts come from our checked stories, trackers, model comparison and rules checker.