ZetrixwebThree philosophies
The United States has no comprehensive federal AI statute and no enacted preemption of state laws, so obligations come from state laws, sector regulators, and general consumer protection and securities law. The European Union has a horizontal law, the AI Act, with risk tiers, and has recently moved the high-risk deadlines to 2027 and 2028 while transparency duties and enforcement over general-purpose AI providers are live. Singapore relies largely on voluntary governance frameworks and technical guidance, with sector regulators such as MAS issuing supervisory expectations and general laws such as the PDPA applying.
These differences shape what you must do, who you must show evidence to, and how fast things change.
| United States | European Union | Singapore | |
|---|---|---|---|
| Core approach | State laws and enforcement under existing law | Horizontal AI Act with risk tiers | Voluntary frameworks plus sector supervision |
| Binding AI-specific rules | Varies by state, for example chatbot and ADMT laws | Yes, phased in | Mostly sector-specific guidelines |
| Key recent item | Colorado replacement law; California ADMT rules | Omnibus moved high-risk dates; GPAI enforcement live | MAS final guidelines; CSA and IMDA agentic guidance |
| Most uncertain | Federal preemption | GDPR half of the omnibus | Phased dates reported by secondary sources |
| Who asks for evidence | Regulators, plaintiffs, enterprise buyers | Regulators, notified bodies, buyers | Regulators, financial clients, buyers |
What is live and what is coming
In the US, California's frontier-model transparency law and several chatbot laws are live, Colorado's replacement framework is reported for January 2027, and California's ADMT dates run through 2027 and 2028. In the EU, the AI Office can fine general-purpose model providers, transparency duties apply, and high-risk obligations come in December 2027 and August 2028, alongside product liability, Data Act, and Cyber Resilience Act milestones. In Singapore, the IMDA agentic framework, CSA agentic addendum, and Online Safety Commission are in place, MAS's AI guidelines are final, and ASEAN's digital agreement is targeted for signing in November.
Many of these items have their own article in this series, linked from our calendars.
What to build once
Despite the different forms, the underlying asks overlap. Build a system inventory with risk tiers. Keep documentation and evidence for data, testing, and oversight. Design logging and traceability. Embed human oversight that reviewers can exercise. Run adversarial testing, and keep vendor diligence files on model providers. Make disclosures configurable by market.
Layer market specifics on top: state notices and requests in the US, AI Act classification and conformity in the EU, and sector overlays and agentic guidance in Singapore.
Selling AI in all three markets? Talk to us about a shared governance foundation.
Key takeaways
- The US relies on state laws and existing law, the EU on a phased horizontal AI Act, and Singapore on voluntary frameworks plus sector supervision.
- Live items and pending items differ by market; mark and confirm reported dates.
- Shared foundations: inventory and tiering, evidence, logging, human oversight, adversarial testing, and vendor files.
- Layer market-specific requirements on one common program.