AI Regulation Shifts as EU AI Act Delay Meets US State Law Surge

The short version

In October 2026, AI compliance is moving at two speeds. Europe has given companies more time on the hardest part of the EU AI Act, but other parts of the law are already in force and more deadlines are close. In the United States, federal efforts to override state AI laws have produced one important result: Colorado narrowed its law. That has not slowed state lawmakers, who keep passing new rules. Some coverage describes the period as a pause or a retreat. That reading is wrong. Compliance work is changing shape, and the total amount is not shrinking.

As of late October, the US still has no single law covering AI as a whole. The rules come from executive orders, agency actions, court rulings and state statutes, and the bills in Congress are still only proposals.15 The scale of state activity explains why compliance teams are struggling. The National Conference of State Legislatures counted 1,539 state AI bills introduced in 2026 and 280 enacted as of early October, up from 1,262 introduced and 227 enacted in 2025.27

Europe's delay is real, but it is partial

The biggest structural change this year came from Brussels. The Digital Omnibus on AI, formally Regulation (EU) 2026/1744, took effect on July 27, 2026. That was six days before the original August 2 date for high-risk obligations.8 It moved obligations for stand-alone high-risk systems listed in Annex III to December 2, 2027. Annex III covers uses such as recruitment, credit scoring, education and border control. High-risk AI built into regulated products, such as medical devices and toys, now has until August 2, 2028.3 For stand-alone systems, that is a delay of about 16 months.7

Reporting agrees on why the dates slipped. The supporting systems were not ready: harmonised standards from CEN-CENELEC were late, conformity-assessment bodies had not been designated, and many member states had not set up market surveillance authorities.4 One detail matters for planning. The Commission had proposed tying the delay to whether standards were ready, but lawmakers fixed hard dates instead. A further slip now looks unlikely.4 The core requirements are unchanged: risk management, documentation, human oversight and post-market monitoring.3 The law firm Gibson Dunn calls it a deferral, not a dismantling.10

The main way companies get this wrong is to treat the Omnibus as a general reprieve. The Article 5 prohibitions, the AI literacy duty, the obligations for general-purpose AI (GPAI) models and the Article 50 transparency rules all kept their original dates.3 The AI literacy duty was softened, not removed.6 Since August 2, 2026, chatbots must be identifiable as AI, deepfakes must be labelled, and the Commission can fine GPAI providers directly.1

The next fixed date is December 2, 2026. On that day, generative systems that were already on the market before August 2 must start marking their output in machine-readable form. Two new bans also take effect, covering AI that generates non-consensual intimate imagery or child sexual abuse material.7 Systems launched after August 2 get no grace period and must mark output from the start.5 Maximum fines are unchanged: up to €35 million or 7% of global turnover for banned practices, and up to €15 million or 3% for GPAI providers.7

For American companies, more time does not mean lower costs. The Commission estimated in April 2026 that some high-risk systems already covered by product-safety rules would face €23,850 to €40,400 in extra compliance costs. Technical documentation duties also continue for the life of a system.2 Because the Act reaches any organisation whose AI output reaches people in the EU, US companies are covered wherever they are based.1

Washington's preemption campaign: one result, no court rulings

The central US story is the federal government's attempt to override state AI laws. Executive Order 14365, signed December 11, 2025, told the Attorney General to create an AI Litigation Task Force, which the Justice Department set up on January 9, 2026.12 The order also told the Commerce Department to list state laws it considers "onerous," the FTC to issue a policy statement, and the FCC to consider a federal disclosure standard that would override conflicting state rules.14

The campaign's main result so far came in Colorado, where events moved quickly. On April 9, xAI sued over the state's 2024 AI Act. The Justice Department moved to join the case on April 24. On April 27, a magistrate judge approved a joint motion barring enforcement until 14 days after the court rules on xAI's request for a preliminary injunction.11 On May 14, Governor Jared Polis signed SB 26-189. It replaces the original law with a narrower framework built on disclosure, adds a 60-day period for companies to fix violations before enforcement, and sunsets in 2030.12 The new law drops the duty of reasonable care, risk management programs, annual impact assessments and self-reporting to the Attorney General. Only the Attorney General can enforce it, and there is no private right to sue.13

The rest of the executive order has had little visible effect. By early October, the Commerce list, the broadband-funding notice and the FCC proceeding had not been published, and the FTC statement was still a proposal.14 Apart from joining the Colorado case, the Justice Department had not filed its own lawsuit against any state AI law.14 Congress has twice declined to override state laws. The Senate removed a ten-year moratorium from the 2025 reconciliation bill by a 99-1 vote, and a similar provision was left out of the 2026 defense bill.11

Coverage of what Colorado means is split. One analysis argues that the strictest form of US AI regulation is losing for now, and that other states will take note.13 Another says the slower pace of new state laws is not a freeze, and not evidence that states are retreating.12 Both have a point. Colorado shows that the duty-of-care model, built on broad obligations, is politically vulnerable. October's legislative calendar shows that narrower, targeted state rules are spreading fast. The law firms tracking the litigation agree on one thing: no state AI law has been struck down, and companies should keep complying as written.1219

The reporting also diverges on details. One state tracker still lists Colorado's original law as taking effect June 30, 2026, which is out of date after the repeal.17 The same tracker cites a June 2026 executive order that other coverage does not mention.17 Counts of 2026 state laws also differ, from 109 "AI-specific" laws in one tally to 280 in NCSL's broader count.1227 For compliance teams, the lesson is to track rules by statute and court docket, not by headline.

The states keep going

October's state activity explains why. In California, Governor Gavin Newsom ended his bill-signing period by signing 12 more AI measures. One law creates a state registry of AI auditors, and another bars companion chatbots in toys for five years.25 He then signed executive orders asking for independent checks of AI models. They also set up an expert committee to design kill switches for AI agents, with recommendations due November 15.22 Connecticut's first set of AI rules took effect October 1.28 Illinois Governor JB Pritzker created an AI Cabinet to develop policy through 2027, building on a frontier-model law that will require annual audits from 2028.29 Massachusetts senators have proposed independent evaluations of AI companies' models as part of an economic development bill.21 In Pennsylvania, a bill requiring advertisers to disclose AI use went to the governor's desk.26

Colorado's own timeline also matters now. Public comments on the state's rulemaking were scheduled to close on October 26, 2026, with rules expected to take effect in January 2027.28 One law firm doubts real enforcement will begin before late 2027.13

Industry pushes for a federal ceiling

In Congress, the debate has moved from blanket moratoriums to narrower preemption. The House FRONTIER Act would stop states from adding new obligations on AI developers in three areas: catastrophic-risk transparency, independent auditing and incident reporting. It would leave laws that apply to everyone, child safety rules and state purchasing untouched.27 According to POLITICO, Anthropic has privately shown lawmakers a draft bill. It would let the government block a model only when it poses a foreseeable, imminent risk of more than $1 billion in damage or of killing or seriously injuring more than 50 people, and it would override some state safety laws.24 Critics have questioned those thresholds, and as of mid-October no lawmaker had introduced the bill.30 One analysis notes that both House bills exempt how businesses use AI from preemption. State rules on AI in hiring and customer decisions would survive either one.16

What compliance teams should take from this

The practical message is consistent across the coverage. Europe has moved deadlines, not requirements, and December 2 is a firm date for generative AI providers. In the US, the federal effort to override state laws can pressure individual states, but it has not erased any obligation. Even the strongest federal bills under discussion would leave rules on how businesses use AI to the states.

An inventory of AI systems is useful under every regime: a list of which systems you use, who bought them, what data they run on and what decisions they influence.9 One guide argues that a single program based on the NIST AI Risk Management Framework covers much of what Colorado, California and the EU require, although that overlap is approximate, not exact.17 Companies that read October's headlines as a reason to wait are likely to be caught short by both the EU's December deadline and the next wave of state laws.