TAI BUI
Back to curriculum
LearnPython

Regulatory Frameworks — EU, US, UK, Korea

Four primary regulatory regimes define the 2026 AI governance landscape. EU AI Act (in force 1 August 2024): prohibited practices and AI literacy from 2 February 2025; GPAI obligations from 2 August 2025; full applicability and Article 50 transparency 2 August 2026; legacy GPAI and embedded high-risk systems 2 August 2027; penalties up to 15M EUR or 3% of global turnover. GPAI Code of Practice (10 July 2025): three chapters (Transparency, Copyright, Safety and Security) and 12 commitments; enforcement begins August 2026. UK AISI -> AI Security Institute (February 2025): rename signals narrower scope. US AISI -> CAISI (June 2025): Center for AI Standards and Innovation under NIST; shift toward pro-growth posture. Korean AI Framework Act (passed December 2024, effective January 2026): Article 12 establishes AISI under MSIT; mandates local representatives for foreign AI companies, risk assessment, safety measures for high-impact and generative AI.

TIME: ~75 minutesPREREQUISITES: Phase 18 · 18 (frontier frameworks), Phase 18 · 27 (data governance)

Learning Objectives

  • Describe the EU AI Act risk tiers (prohibited, high-risk, general-purpose, limited-risk) and the August 2025 / August 2026 / August 2027 timeline.
  • Describe the three chapters of the GPAI Code of Practice and which providers each binds.
  • Describe the 2025 rebrands: UK AISI -> AI Security Institute; US AISI -> CAISI; what each rebrand implies about policy direction.
  • State the core provision of Korea's AI Framework Act.

The Problem

Lab frameworks (Lesson 18) are voluntary. Regulation is compulsory. The 2024-2026 period saw the first wave of comprehensive AI law enter force, and a deployer has to map its technical controls onto obligations that differ by jurisdiction.

Warm-up0/3
1. How do the lab safety frameworks from Phase 18 · 18 differ from the laws covered in this lesson?Warm-up
Two boxes contrasted: a promise you make to yourself, which you can change whenever you like, next to a rule a referee enforces on you, which someone outside checks and can penalize.
2. A regulation caps fines at 3% of a company's global turnover. What is turnover?Warm-up
A company dashboard with four illustrative year-end tiles (total sales revenue, profit after costs and taxes, customers who canceled, share price change) and a blank chip asking which one is called turnover.
Illustrative figures.
3. Training compute for a large model is often quoted in FLOP. What does FLOP count?Warm-up
A training-run dashboard with four illustrative tiles (data read from disk, parameters in the checkpoint, rented accelerator hours, arithmetic operations performed) and a blank chip asking which one FLOP counts.
Illustrative figures.

The Concept

EU AI Act

In force 1 August 2024. The Act sorts systems into risk tiers:

  • Prohibited practices (Article 5). Social scoring, real-time remote biometric identification in public (with law-enforcement exceptions), and exploitative manipulation of vulnerable groups. Applied 2 February 2025.
  • High-risk systems (Annex III). Employment, education, credit, law enforcement, justice, migration. These require conformity assessment, risk management, logging, and transparency.
  • General-Purpose AI (GPAI) models. Applied 2 August 2025. All GPAI providers have obligations, and systemic-risk GPAI (>1e25 FLOP training compute) carries additional ones.
  • Limited-risk systems. Transparency obligations under Article 50, which covers labelling of AI-generated content. Applied 2 August 2026.

Timeline:

  • 2 Feb 2025: prohibited practices + AI literacy.
  • 2 Aug 2025: GPAI + governance.
  • 2 Aug 2026: full applicability + Article 50 transparency + penalties up to 15M EUR / 3% global turnover.
  • 2 Aug 2027: legacy GPAI + embedded high-risk.

In late 2025 the Commission proposed adjusting the high-risk timeline to 16 months.

GPAI Code of Practice

Published 10 July 2025, in three chapters:

  • Transparency. All GPAI providers.
  • Copyright. All GPAI providers.
  • Safety and Security. Systemic-risk GPAI providers (estimated 5-15 companies).

That is 12 commitments in total. A Signatory Taskforce chaired by the AI Office manages implementation. Enforcement begins 2 August 2026, and good-faith compliance is accepted until then.

Transparency Code for Article 50

First draft 17 December 2025, second draft March 2026, final version June 2026. It covers labelling of AI-generated content, deepfakes included. This is the regulatory layer that requires Lesson 23's watermarking technology.

UK AI Security Institute (February 2025)

Renamed from AI Safety Institute. The rebrand narrows scope: it drops the algorithmic bias and free-speech framings and focuses on security of frontier capabilities. The institute open-sourced the Inspect evaluation tool (May 2024) and collaborates with Redwood (Lesson 10) on control safety cases.

US CAISI (June 2025)

The Trump administration turned NIST's AI Safety Institute into the Center for AI Standards and Innovation. The shift toward "pro-growth AI policies" is per VP Vance's remarks at the Paris AI Action Summit. Pre-deployment evaluation gets less emphasis, and standards and innovation support get more. It works as a domestic counterweight to the EU AI Act's regulatory posture.

Korean AI Framework Act

Passed December 2024, enacted January 2025, effective January 2026. It consolidates 19 separate AI bills.

Article 12 establishes an AISI under the Ministry of Science and ICT (MSIT). The Act mandates:

  • Local representatives for foreign AI companies operating in Korea.
  • Risk assessment for "high-impact" AI systems.
  • Safety measures for generative AI and high-impact AI.

It is the first comprehensive horizontal AI regulation in an Asian jurisdiction.

Cross-jurisdiction dynamics

  • EU: strict, risk-tiered, heavy penalties. The benchmark for privacy-adjacent regulation.
  • US: innovation-favouring and decentralized. States fill federal gaps (California AB 2013, covered in Lesson 27).
  • UK: narrow security focus, strong evaluation infrastructure.
  • Korea: MSIT-led, aimed at foreign providers.

These are competing regulatory philosophies. A deployer in several jurisdictions has to comply with the strictest, which in 2026 is typically the EU AI Act.

Where this fits in Phase 18

Lesson 18 covers voluntary lab governance and Lesson 24 covers regulation. Lesson 25 turns to an emerging class of CVEs for AI systems, and Lessons 26-27 cover documentation (cards) and training-data governance.

Check: The Concept0/29
1. What is the EU AI Act?Define
A card named EU AI Act noting only that it has been in force since 1 August 2024, with a blank chip asking what kind of thing it is.
2. What does GPAI mean in the EU AI Act?Define
A card named GPAI, noted only as a term used in the EU AI Act, with a blank chip asking what it refers to.
3. What does Article 50 of the EU AI Act require?Define
A card named Article 50, noted only as a provision of the EU AI Act, with two blank chips asking when it applies and what it requires.
4. What is the UK AISI today?Define
A card named UK AISI with no other detail, and a blank chip asking what it is today.
5. What is CAISI?Define
A card named CAISI with no other detail, and a blank chip asking what it is.
6. What is Korea's AI Framework Act?Define
A card named Korean AI Framework Act noting only that it was passed in December 2024 and takes effect in January 2026, with a blank chip asking its core nature.
7. What makes a GPAI model systemic-risk under the EU AI Act?Define
A card named systemic-risk GPAI, noted only as a subset of GPAI models, with a blank chip asking what defines that subset.
8. Which three chapters make up the GPAI Code of Practice (10 July 2025)?Define
The GPAI Code of Practice as a closed box, published 10 July 2025, above three unopened chapter slots labeled Chapter 1, 2 and 3, asking what the three chapters are.
9. Besides prohibited practices, which tiers does the EU AI Act sort systems into?Define
A box labeled prohibited practices (Article 5) with an arrow into a single dashed, unlabeled region captioned '+ more tiers...', noting the Act sorts systems into several tiers besides the prohibited one.
10. What takes effect on 2 August 2027 under the EU AI Act timeline?Define
A bare number line with five dated points (2024-08 through 2027-08) and no event text, with the final point highlighted and a blank chip asking what starts there.
11. What is the core content of Korea's AI Framework Act (effective January 2026)?Define
A card named Korean AI Framework Act noting only that it takes effect in January 2026, with a blank chip asking its core content.
12. Why is 2 August 2026 the main EU AI Act date to scope a deployment against?Explain
The same bare five-point number line, this time with the 2026-08 point highlighted and a blank chip asking why that one is singled out.
13. Why does only the Safety and Security chapter of the GPAI Code bind a subset of providers?Explain
The GPAI Code of Practice above three chapter boxes, two left as generic Chapter A and Chapter B and the third named Safety and Security and visually set apart, with a blank chip asking why it is narrower.
14. What does the February 2025 rename of the UK AISI to 'AI Security Institute' signal?Explain
A card named UK AISI noting only that it was renamed in February 2025, with a blank chip asking what that signals.
15. Which activity fits the UK AI Security Institute's narrowed focus?Explain
A card named AI Security Institute with no other detail, and a blank chip asking what its typical activity is.
16. What does the US CAISI rebrand (June 2025) signal about policy direction?Explain
A horizontal slider between two labeled ends, pre-deployment evaluation and standards & innovation support, with a neutral marker sitting exactly in the middle and a blank chip asking which way the CAISI rebrand moved.
17. Why does Korea's local-representative requirement matter for a US company serving Korean users?Explain
A US company serving Korean users, with a chip already marked EU AI Act compliance done, and a blank chip asking what Korea additionally requires.
18. What role does the Transparency Code play for Article 50?Explain
A card named Transparency Code noting only its three drafting dates (December 2025, March 2026, June 2026), with a blank chip asking its role for Article 50.
19. Which description matches how the four regimes differ in posture?Explain
Four small cards labeled EU, US, UK and Korea in a row, each paired with its own blank chip asking its posture.
20. In main.py's TIMELINE, which line prints immediately before 'UK AISI renamed -> AI Security Institute'?Apply
A captured terminal excerpt of main.py's TIMELINE showing the UK AISI rename line and the line after it, with the line immediately before it replaced by a masked placeholder.
Captured by running the real main.py, not typed.
21. main.py loops over TIMELINE and prints each tuple. How many printed event lines have a date starting with 2025?Apply
All 14 dates main.py's TIMELINE prints, shown as scattered tiles in a scrambled order with no event text, and a blank chip asking how many start with 2025.
Real dates from main.py's TIMELINE, order scrambled here so it does not also answer a different question about their sequence.
22. A provider trains a model with 3e25 FLOP of compute and sells it in the EU. Which GPAI Code chapters bind it?Apply
A provider box noting it trains a model at 3x10^25 FLOP and sells it in the EU, with an arrow into a blank chip asking which Code chapters bind it.
The scenario's compute figure is given; the systemic-risk threshold it is compared against is not shown here.
23. A startup sells a tool that screens job applicants in the EU. Which tier and obligations apply?Apply
A hiring-screen tool box sold to employers in the EU, with an arrow into a blank chip asking its tier and duties.
24. On 15 September 2026 a provider serves EU users with a new chatbot that generates images. Which EU AI Act milestones already apply?Apply
The same bare five-point EU AI Act number line with a dashed marker for 15 September 2026 placed between the fourth and fifth points, and a blank chip asking how many milestones are already past.
25. A team says: 'We comply with the EU AI Act, and the strictest regime wins, so Korea is covered.' Korean authorities flag a missing local representative. Which assumption failed?Analyze
A reasoning chain from EU AI Act compliance through 'strictest regime wins' to 'Korea covered?', under a warning chip stating the Korean regulator flagged a missing local representative, with a blank chip asking which assumption broke.
26. A provider reads 'GPAI Code enforcement begins 2 August 2026' and concludes it has no GPAI duties yet. What is wrong?Analyze
A quoted claim, 'Code enforcement begins 2 August 2026,' with an arrow into a blank chip asking whether that means no GPAI duties exist yet.
27. An analyst argues the UK rename shows the UK has abandoned AI model evaluation. Which evidence from the lesson answers this best?Analyze
A quoted claim in a warning-colored card: 'The UK rename ended model evaluation,' with a blank chip asking for the best rebuttal.
28. A US company ships an AI image generator on EU infrastructure to Korean users and has no Korean presence. Which plan fits best?Design
A chain of three boxes, a US company building an image generator, EU infrastructure, and Korean users with no local presence noted, with a blank chip asking the best plan.
29. You must scope compliance work for a model sold in the EU and Korea with limited time. Which plan fits best?Design
A box describing a model sold in the EU and Korea with limited time to scope compliance, with an arrow into a blank chip asking how to approach it.

Use It

There is no code to run here. Read the primary sources: the EU AI Act text, the GPAI Code of Practice, and the UK AISI Inspect framework. Then map your own deployment to the obligations that apply in each jurisdiction.

Check: Use It0/2
1. A developer runs main.py hoping it reports which obligations apply to their chatbot. What does it print?Apply
A developer's three hoped-for outputs (obligations per jurisdiction, a tier classification, a deadline countdown) next to a card describing main.py's real structure only as one header block, its dated lines, and one closing paragraph, with a blank chip asking whether it maps obligations.
2. A developer sorts main.py's TIMELINE by date string, and the '2025-02-00' UK rename now precedes the '2025-02-02' EU entry. What does this show?Analyze
A captured terminal excerpt showing main.py's two TIMELINE lines for 2025-02-02 and 2025-02-00 in their original printed order, noting that sorting by date string puts 2025-02-00 first, with a blank chip asking what the 00 means.

Ship It

This lesson produces outputs/skill-regulatory-map.md. Given a deployment description, it maps the applicable jurisdictions, the tier classification in each, the per-jurisdiction obligations, and the deadline structure.

Check: Ship It0/1
1. You are designing the regulatory-map skill for a deployment description. Which output structure fits?Design
Four empty dashed slots marked only with question marks under the heading asking what a regulatory-map skill should output.
Author's Note

If I were scoping a deployment, I'd start from 2 August 2026. That date carries full applicability, Article 50 transparency, penalties, and the start of GPAI Code enforcement, so most of the work lands there. I'd read the 2027 date as a tail for legacy GPAI and embedded high-risk systems.

I'd also treat the Korean and EU rules as separate checklists. Korea's local-representative requirement applies to foreign providers, and nothing in the EU tiers replaces it. The cross-jurisdiction section says the strictest regime usually wins, but that only helps on questions both regimes answer.

main.py is stdlib Python and only prints a timeline. It maps nothing to obligations, and that job belongs to the skill in Ship It. Some entries carry 00 as the day, like 2025-02-00 for the UK rename, because the source gives only a month. The list is in rough order, not sorted: 2025-02-02 comes before 2025-02-00. If I extended it, I'd sort it and flag the month-only entries explicitly.

Exercises

  1. Read the EU AI Act (regulation 2024/1689) and the GPAI Code of Practice (10 July 2025). Identify three obligations that apply to every GPAI provider and three that apply only to systemic-risk GPAI.

  2. A deployment is made by a US company, runs on EU infrastructure, and serves Korean users. Which three jurisdictions' rules apply, and which rule binds on each substantive question?

  3. The UK AI Security Institute's rename narrows scope. Argue for and against the narrower framing. Identify the policy assumption each position depends on.

  4. CAISI's "pro-growth" framing is a departure from the 2022-2024 AI safety institute model. Identify two measurable policy shifts that would follow from this framing.

  5. Korea's AI Framework Act requires local representatives for foreign providers. Describe the operational implications for a Bay Area company serving Korean users.

Key Terms

TermWhat people sayWhat it actually means
EU AI Act"the regulation"Risk-tier-based horizontal AI regulation; in force Aug 2024
GPAI"general-purpose AI"Large foundation models; systemic-risk subset has additional obligations
Article 50"transparency obligations"AI-generated content labelling; applies Aug 2026
UK AISI"AI Security Institute"Renamed Feb 2025; narrower frontier-security focus
CAISI"US center for AI standards"Renamed Jun 2025 from AI Safety Institute; pro-growth posture
Korean AI Framework Act"MSIT horizontal regulation"First Asian comprehensive AI law; effective Jan 2026
Systemic-risk GPAI"the 1e25 FLOP threshold"Additional obligations tier; estimated 5-15 companies bound

Further Reading

Code

Ships With