By structure more than by aim. The EU has one horizontal law, the EU AI Act, that classifies AI systems by risk. The US has no single federal AI law; agents are governed by sector regulators applying existing rules, by state laws such as Colorado's AI act and California's privacy law, and by voluntary frameworks like the NIST AI RMF.
How are the two systems built?
The EU AI Act (Regulation (EU) 2024/1689) regulates AI as a category. It bans certain practices, sets detailed duties for high-risk systems such as credit scoring of individuals, requires transparency when people interact with AI, and splits duties between providers and deployers. A summary is in what the EU AI Act is.
In the US, the rules come from the activity:
- Banking: the OCC, Federal Reserve and FDIC supervise banks, applying model risk guidance SR 11-7 to AI.
- Consumer credit: ECOA and Regulation B require specific reasons when credit is denied, including when a model is used. The CFPB enforces consumer financial law.
- Securities: the SEC and FINRA apply existing conduct and supervision rules.
- Insurance: state insurance regulators, coordinated by the NAIC.
- Privacy: GLBA for financial data, HIPAA for health information, and state laws such as the CCPA as amended by the CPRA.
- State AI law: Colorado has passed an AI act aimed at high-risk systems that make consequential decisions.
- Frameworks: the NIST AI Risk Management Framework, voluntary.
The full list is in which US laws apply to AI agents.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where do the differences show up for an agent?
| Topic | EU AI Act | United States |
|---|---|---|
| Trigger | Listed uses and practices | The activity: lending, insurance, securities, health |
| Credit decisions | High-risk system with oversight, logs and documentation | ECOA and Regulation B adverse action reasons; model risk guidance; fair lending |
| Telling people about AI | Article 50 transparency duties | Depends on state law and sector rules |
| Banned practices | A defined list | No federal list; unfair or deceptive practices law applies |
| Who carries duties | Providers and deployers, defined | Mostly the regulated firm using the agent |
| Framework status | Binding law | NIST AI RMF voluntary |
The agent-specific reading of the EU side is in the EU AI Act and agents that act.
Concrete examples: what stays with a person?
Both systems reach a similar place for high-impact decisions, through different routes.
A credit decision agent. In the EU, it is high-risk: assigned human oversight, logs, information to applicants, and a fundamental rights impact assessment for the deployer. In the US, the lender must give specific principal reasons for a denial. "The agent declined you" is not a reason; the lender needs to know which factors drove the outcome, which means recording what the agent relied on. A credit officer making the adverse decision is the safe pattern in both.
A customer service agent. In the EU, the main duty is telling customers they are dealing with AI. In the US, the duty comes from conduct and privacy rules: no deceptive statements, protection of customer data under GLBA, and complaint handling under sector rules.
An illustrative example
Take a lender operating in Germany and Texas with one underwriting agent. For German applicants, the agent's credit capability is high-risk under the Act, and the lender holds the provider's technical documentation, keeps logs, assigns trained staff to oversee it and completes the Article 27 assessment.
For Texas applicants, none of those documents is required by an AI law. But the lender's bank partner applies SR 11-7, so the agent is validated as a model, and adverse action notices must state specific reasons. The lender finds that one decision record, listing every factor the agent used and the officer's final decision, serves both: the Act's logging and oversight duties and Regulation B's reasons.
Which controls work on both sides?
- Classify capabilities under the Act; list the US sector rules for the same activity.
- Record every factor an agent relies on in decisions about people.
- Hold adverse decisions for a person.
- Validate agents as models where banking rules apply.
- Test for unfair outcomes across groups.
- Disclose AI use where either side requires it.
The EU AI Act compliance checklist for AI agents covers the EU list in full, and the UK comparison is in how AI rules differ between the UK and the EU. The cross-regulation map is in AI agent regulation, mapped to controls.
Questions people ask
Is there a federal AI law in the US?
No single federal AI law applies across sectors. Agents are governed by existing federal sector rules, state laws and voluntary frameworks.
Does the EU AI Act apply to US companies?
It can, when they place AI systems on the EU market or when their agents' outputs are used in the EU, for example decisions about EU customers.
Which is stricter for AI agents?
It depends on the use. The EU Act sets more documented duties for listed high-risk uses. US sector rules can be as demanding in specific areas, such as adverse action reasons in credit.