How do risk approaches and enforcement compare across the EU, UK and US?

What does this comparison cover, and what does it not cover?

This comparison covers risk approach and enforcement structure only, at a high level, for the EU, UK and US as checked on 29 October 2026. It covers how risk is categorised or approached in each jurisdiction, who enforces, and what kind of enforcement powers exist in outline. It does not cover the detailed duties that follow from the risk approach, such as the high risk requirements in Chapter III, the transparency duties in Article 50, or the sector duties in the UK and US, which are dealt with in the scope comparison guide and in the sector guides. It does not cover fine levels, penalty calculations or enforcement practice in detail, and it does not state any fine ceiling, because fine ceilings must be verified in the consolidated text for the EU and in the statute for each UK and US authority, and because stating a figure without the provision and the conditions would be misleading. It does not cover private litigation, collective redress or liability law, except to note that those routes exist alongside administrative enforcement in each jurisdiction. Stating those limits is part of the comparison, because a reader who assumes that a risk approach comparison is an enforcement comparison will draw conclusions about penalties that the comparison does not support.

What is the EU risk approach?

The EU risk approach in the AI Act is statutory and tiered. Article 5 prohibits defined practices, subject to conditions and exceptions that must be checked in the Article. Article 6 classifies defined AI systems as high risk through the Annex I product route and the Annex III use case route, subject to the Article 6(3) filter for narrow procedural tasks. Article 50 imposes transparency duties for defined systems, including interaction, emotion recognition, biometric categorisation and synthetic content. Chapter V imposes duties for general purpose AI models, with additional duties for models with systemic risk. The duties that follow from each tier are set out in the Regulation, with conformity assessment, registration, post market monitoring and incident reporting for high risk systems, and with documentation, copyright and summary duties for general purpose models. The approach is therefore prescriptive in its categories and in its duties, with guidance and standards supporting the application of the categories. A company can work from the Regulation text to identify its tier, its duties and its conformity route, subject to the guidance and to the sector law that applies alongside the Act. That prescriptive structure is the distinctive feature of the EU approach.

For the broader regulatory framework, see non-EU and international overview.

What is the UK risk approach?

The UK risk approach is principles based and regulator led, under existing law. The five principles, safety, security and robustness, appropriate transparency and explainability, fairness, accountability and governance, and contestability and redress, guide regulators in applying their existing duties to AI uses within their remits. There is no statutory tiering of AI systems into prohibited, high risk and transparency categories in the way the AI Act tiers them, and there is no single conformity assessment or CE marking route for AI in the UK. Risk is assessed through the existing frameworks: data protection impact assessments for personal data, model risk and governance for financial services, clinical and device risk for medical devices, safety risk for online services, and competition and consumer risk for markets and consumers. The approach is therefore flexible and sector specific, but it is also fragmented, because a single system can be assessed under several risk frameworks at once, with different evidence and different regulators. A UK company should record the risk assessment for each framework separately, with the regulator guidance cited, rather than recording a single UK AI risk assessment that is assumed to satisfy all frameworks.

What is the US risk approach?

The US risk approach is sector and state based, with voluntary frameworks providing a common risk language. At federal level, risk is assessed through sector statutes and agency guidance, such as consumer protection risk for the FTC, device risk for the FDA, and model and credit risk for financial regulators. At state level, risk is assessed through the state statute concerned, such as the Colorado consequential decision and algorithmic discrimination framework in its original enactment, or the narrower employment, biometric and disclosure frameworks in other states. Voluntary frameworks, notably NIST AI RMF 1.0 with its Govern, Map, Measure and Manage functions, provide a risk management language that can be used across sectors and states, and ISO/IEC 42001 provides a management system framework that can be certified. Those voluntary frameworks do not set legal risk tiers, and alignment with them does not by itself satisfy a legal duty, although a state law can give a presumption or a defence for alignment in defined circumstances. The US approach is therefore a combination of legal sector and state risk duties and voluntary risk management frameworks, with the legal duties varying by jurisdiction and the voluntary frameworks providing the common language. A US company should record the legal risk duties and the voluntary framework use separately, with gaps noted.

How does enforcement differ?

Enforcement differs in authority, powers and procedure. In the EU, market surveillance authorities enforce the high risk, transparency and product provisions, national competent authorities enforce the provisions within their remits, and the AI Office enforces the general purpose model provisions, with administrative fines set in Articles 99 to 101 and with corrective action, withdrawal and recall powers. In the UK, each regulator enforces within its remit, through its own powers, which can include warnings, directions, fines, licence action and court proceedings, depending on the statute, and through the courts for equality, consumer and other claims. In the US, federal agencies enforce within their remits through administrative and court action, state Attorneys General enforce state law, including as unfair or deceptive practices in some states, and private litigation can arise under sector, consumer, employment and biometric statutes. No fine figure is stated in this guide, because fines depend on the provision, the tier, the size of the undertaking, the gravity and the conditions in the statute, and because a figure stated without those conditions would be misleading. Enforcement practice, including priorities, guidance and published decisions, must be checked on the authority sites for each jurisdiction, with the date recorded.

Continue with scope comparison across jurisdictions.

What does this comparison not decide?

This comparison does not decide whether any named system is prohibited, high risk or subject to transparency duties in any jurisdiction, does not state any fine level, and does not describe enforcement practice for any authority. Risk and enforcement decisions need the system, the jurisdiction, the statute and the authority guidance, checked on the date of the decision. A company operating across jurisdictions should obtain local legal advice on risk and enforcement in each jurisdiction, with the comparison used only to orient the advice. This guide compares approaches, not outcomes for a named system.

Frequently asked questions

Continue through this AI Act cluster

• non-EU and international overview
• scope comparison across jurisdictions
• enforcement and market surveillance overview
• prohibited practices in Article 5
• general purpose AI
• high risk AI systems