We wrote this briefing for UK politicians, to help them quickly get their heads around the AI safety laws that already exist in the US and EU. We found that it was also clarifying for us and we hope it will be useful for others. These laws are too long and complex to be perfectly distilled without losing some nuances, but this is our best attempt.

The laws

Three jurisdictions have enacted laws addressing extreme dangers from AI:

EU - AI Act (May 2024)
California - SB 53 (Sept 2025)
New York - RAISE Act (Dec 2025).

For advanced general purpose AI models (language models trained with lots of ‘compute’ - like ChatGPT), all three laws have two basic requirements:

Safety protocols. AI companies are required to develop and follow their own safety and testing framework to mitigate severe risks of AI.^[1]
Reporting requirements. AI companies must report their safety protocols, various details about their models and critical incidents of harm caused by their AIs.

	EU AI Act	CA SB 53	NY RAISE
Max penalties	€15M / 3% turnover (GPAI tier)	$1M	$1M - $3M
Audits	Internal (details TBC)	Not required	Internal review
Critical harm incident threshold	Death, irreversible critical infrastructure disruption, fundamental rights violationor serious property harm.	- 50 deaths or $1B in damage. - Increased risk of the above from the model deceiving the developer. - Injury caused by theft / escape or loss of control of a model.	- 100 deaths or $1B in damage. - Increased risk of the above caused by the theft / escape or loss of control of a model.
Incident reporting deadline	2 - 15 days (depending on nature of incident)	15 days	72 hours

SB 53 also includes whistleblower protections for employees of AI companies. The other two acts don't, although the EU already has strong general protections for whistleblowers.

The US laws stop there. The EU AI Act is broader, also governing non-frontier models. It sets:

Prohibited practices: The use of AI is prohibited fully for social scoring and partly for emotion inference and biometrics
Requirements for AI in high-risk domains: critical infrastructure, education, etc.

To more easily demonstrate compliance with the EU AI Act, companies can follow the Code of Practice. The Code of Practice isn't part of the law itself, but the law explicitly recognises it as a way to show you're compliant.

Strengths and limitations

Penalties in the US laws are small. Note that these are administrati

...

Posts

Wikitag Contributions

Comments

Posts

Wikitag Contributions

Comments