Statute catches up: the EU AI Act, two executive orders and NIST

The domestic reversal

President Biden signed Executive Order 14110 on Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence on 30 October 2023. President Trump revoked that order on returning to office on 20 January 2025, and signed a replacement, 'Removing Barriers to American Leadership in Artificial Intelligence,' on 23 January 2025.

Between those two poles, the durable American artefact has been technical rather than political. NIST published the Generative AI Profile of the AI Risk Management Framework, NIST AI 600-1, on 26 July 2024. It is voluntary, and it has nevertheless become the default vocabulary in US procurement documents because it survives changes of administration.

“No framework, voluntary or statutory, can be satisfied retrospectively. The record has to be kept as the work is done.”

The European reach

Regulation (EU) 2024/1689, the AI Act, entered into force on 1 August 2024. Its general provisions on definitions and AI literacy, together with the bans on prohibited practices, took effect on 2 February 2025. Transparency obligations covering AI disclosure and the labelling of synthetic media are scheduled for 2 August 2026.

In July 2026 the European Union adopted a 'Digital Omnibus on AI' that defers certain high-risk system deadlines while, on the reporting available, leaving the August 2026 transparency obligations in place. Members should confirm current deadlines against the consolidated text on EUR-Lex before relying on any secondary compliance tracker, including this one — the deferral landscape has moved more than once.

• 30 Oct 2023 — EO 14110 signed; revoked 20 Jan 2025.
• 23 Jan 2025 — 'Removing Barriers to American Leadership in AI' signed.
• 26 July 2024 — NIST AI 600-1, the Generative AI Profile, published.
• 1 Aug 2024 — EU AI Act enters into force; prohibitions apply 2 Feb 2025.
• 2 Aug 2026 — EU transparency and synthetic-media labelling obligations scheduled.

What to write down now

Regardless of jurisdiction, four records will be asked for and are expensive to reconstruct after the fact: the intended purpose and out-of-scope uses of the system, the provenance and licensing of training and evaluation data, the evaluation results against that stated purpose, and the identity of the competent person who accepted residual risk.

Members who maintain those four records continuously are compliant with most of what any of these regimes asks, in any order they arrive. Members who do not will find that no framework, voluntary or statutory, can be satisfied retrospectively.