AI regulation in 2026: what the European Union, the United States and Spain require

Which rules apply to the AI your company uses? It depends on where you offer products or services and on whom the AI is used. This guide gathers what official sources say and is clear about what we could not verify.

A note: every fact comes from an official text or page cited at the end, consulted in November 2026. Rules change often (the EU regulation itself was amended in July 2026), so confirm the current version before deciding. This is not legal advice; what is Cyrrus’s judgment, we say so.

European Union: the AI Act

According to the European Commission, the AI Act entered into force on August 1, 2024 and defines four levels of risk: unacceptable risk (prohibited practices), high risk, transparency risk (for example, telling a person they are interacting with a chatbot) and minimal or no risk, for which no rules are introduced.

Application is staged. The Commission states that the AI Omnibus, an amendment to the regulation, entered into force on July 27, 2026 and extended the deadlines for high-risk systems. The table summarizes the dates published by the Commission and the consolidated text as of July 27, 2026.

Do you know which AI rules apply to you?

We design your organization’s AI Governance framework: what can be automated, what needs human oversight, and who is accountable for each decision.

• Risk map by use case, not a generic policy
• Defined roles between business, IT, and legal

Learn about AI Governance

Penalties under the EU regulation

Article 99, in the text published by the European Commission’s AI Act Service Desk, sets these maximums: for prohibited practices, up to EUR 35 million or 7% of total worldwide annual turnover for the preceding financial year, whichever is higher; for other operator obligations, up to EUR 15 million or 3%; and for incorrect, incomplete or misleading information to authorities, up to EUR 7.5 million or 1%. For SMEs, including start-ups, the lower of the two figures applies.

United States: two state examples

We did not review U.S. federal rules for this guide. The two examples below were read from each state’s official text or page.

Texas: H.B. 149, short title Texas Responsible Artificial Intelligence Governance Act, states that it “takes effect January 1, 2026.” The attorney general has exclusive authority to enforce it, and the law says it gives no private right of action. Before suing, the attorney general must give notice and wait 60 days for the violation to be cured. Civil penalties are $10,000 to $12,000 per curable violation, $80,000 to $200,000 per uncurable violation and $2,000 to $40,000 for each day a violation continues.

Colorado: the official page for bill SB26-189, “Automated Decision-Making Technology,” shows it as a law signed on May 14, 2026. Per that summary, it repeals and reenacts provisions of SB 24-205 and regulates automated decision-making technology in consequential decisions about education, employment, housing, financial or lending services, insurance, health care and essential government services. Developers must give technical documentation to those who deploy the technology; deployers must notify people, explain an adverse outcome in plain language and recognize rights of access, correction and human review. The attorney general enforces it and it creates no new private right of action. The page states that developer documentation requirements start on January 1, 2027 and that the attorney general must adopt rules by that date.

Define who tracks AI regulatory changes

We help your leadership team decide what to delegate, what to supervise, and what to never automate — before adoption outruns control.

• Governance committee with business, IT, legal, and security
• Clear criteria for approving new AI use cases

Schedule a conversation about AI Governance

Spain: a supervisory agency

Royal Decree 729/2023 of August 22, published in the BOE no. 210 of September 2, 2023, created the Spanish Agency for the Supervision of Artificial Intelligence (AESIA) as a public-law entity headquartered in A Coruña. Its Article 4.1 assigns it supervision, advisory, awareness-raising and training tasks. We did not review what powers the EU regulation gives it or any rules after 2023; for its current status, check with the agency itself.

Colombia: a national policy

Colombia’s DNP describes CONPES document 4144, the National Artificial Intelligence Policy, approved on February 14, 2025. Per that page, it aims to make Colombia a reference in the use, development and adoption of AI, with more than 100 actions through 2030 and an investment of $479,000 million (as written by the DNP); MinTIC, DAPRE, MinCiencias and the DNP lead its implementation. It is an explanatory article by the DNP, not the text of the CONPES. We did not review the full document, so we do not state whether it imposes obligations on companies.

What leadership should review

Three questions, from Cyrrus’s judgment. First, in which countries you offer products or services that use AI, or use AI on people, because that determines which rules apply. Second, whether any of your systems make or support decisions on employment, credit, health or insurance, which are examples that appear in Colorado’s law, and whether they could fall into a high-risk category under the EU regulation. Third, who in the company follows regulatory changes and how often.

To move from rules to practice, read what evidence your company should be able to show and how to evaluate governance tools.