EU AI Act vs. California SB 53 vs. China Generative AI Measures
Side-by-side comparison of three closely watched AI laws: the EU's risk-based act, California's frontier-model transparency law and China's rules for generative AI services. Scope, obligations, enforcement, penalties and timeline.
In Force (Amended)
EU AI Act
European Union
Effective: 1 Aug 2024, applied in phases to Aug 2028
Read full breakdown →In Force
California SB 53
California, USA
Effective: 1 Jan 2026 (signed 29 Sept 2025)
Read full breakdown →In Force
China Generative AI Measures
People's Republic of China
Effective: 15 Aug 2023
Read full breakdown →Table is wide — swipe right to see all jurisdictions
| Question | EU AI Act | California SB 53 | China Generative AI Measures |
|---|---|---|---|
| Scope & coverage | |||
| What does it regulate? | AI systems placed on the EU market or whose output is used in the EU, sorted by risk: prohibited practices, high-risk systems and transparency duties, plus a separate set of rules for general-purpose AI models. | Only 'frontier models': foundation models trained with more than 10^26 computing operations, later fine-tuning included. Its duties concern catastrophic risk, not everyday uses of AI. | Generative AI services that offer text, images, audio or video to the public in mainland China. Research and internal use that is not offered to the public is outside it (Article 2). |
| Who is the duty-bearer? | Providers (developers) and deployers (users) of AI systems, each with its own obligations. Providers of general-purpose AI models have their own. | Frontier developers: whoever trained, or started training, a frontier model. The heavier duties fall on 'large frontier developers', those with more than $500 million in annual revenue, affiliates included. Nothing falls on users of the models. | Providers of generative AI services, including those that offer them through an API (Article 22). |
| Extraterritorial reach? | Yes. It applies to providers and deployers outside the EU when the system is placed on the EU market or its output is used in the EU. | The Act does not say. It puts duties on frontier developers without a territorial clause, and the California Attorney General enforces it. | Yes. Services offered into mainland China from abroad are covered, and the regulator can have non-compliant ones blocked (Article 20). |
| Key obligations | |||
| Pre-deployment risk assessment? | Yes for high-risk systems: a risk-management system (Article 9) and a conformity assessment before market. Providers of general-purpose models with systemic risk must evaluate and adversarially test the model (Article 55). | Yes for large frontier developers: they assess whether a model could pose a catastrophic risk under their own published framework, and publish a summary of the assessment and its results before or when they deploy a new frontier model. | A security assessment and an algorithm filing, for services with public-opinion attributes or the capacity to mobilise the public (Article 17). |
| Documentation requirements? | For high-risk systems: technical documentation (Annex IV), risk-management records, a post-market monitoring plan and data-governance records. | A published 'frontier AI framework' for large developers, reviewed at least once a year, and a transparency report for every new frontier model. Redactions are allowed for trade secrets, security and public safety; the unredacted version must be kept for five years. | A service agreement with users, the algorithm filing, and on request an account to the authorities of training-data sources, scale and types, labelling rules and how the algorithm works (Articles 9, 17 and 19). |
| Transparency to users? | Tell people when they are interacting with AI, and label AI-generated or manipulated content (Article 50). | Aimed at the public, not at individual users: the framework and each model's transparency report (release date, intended uses, restrictions, languages and output types) go on the developer's website. | Label generated images, video and other content as the deep-synthesis rules require (Article 12), and state who and what the service is for (Article 10). |
| Incident reporting? | Providers of high-risk systems report serious incidents to market surveillance authorities within 15 days; within 10 days after a death, and within 2 days for a widespread infringement or a serious disruption of critical infrastructure (Article 73). | Critical safety incidents go to the Office of Emergency Services within 15 days of discovery, and within 24 hours to an appropriate authority if there is an imminent risk of death or serious injury. Large developers also send the Office a summary of catastrophic-risk assessments from internal use every three months. | A provider that finds illegal content must stop it, correct the model and report to the authorities, and must do the same when users use the service for illegal activity (Article 14). |
| Third-party audits? | For some high-risk systems a notified body carries out the conformity assessment. | Not required. The framework must say how the developer uses third parties to assess catastrophic risk, and the transparency report must say how far outside evaluators were involved. | No audit by an independent party. The security assessment under national rules does the gatekeeping (Article 17). |
| Specific bans | |||
| Prohibited practices? | Social scoring, manipulative or exploitative techniques, untargeted scraping of faces, most real-time remote biometric identification in public spaces and, from 2 December 2026, AI that generates sexually explicit images of identifiable people without their consent. | None. It bans no model and no use. It forbids materially false or misleading statements about catastrophic risk or about compliance with the developer's own framework. | Generating content that incites subversion of state power, endangers national security, promotes terrorism, extremism, ethnic hatred, violence or obscenity, or is false and harmful (Article 4). |
| Enforcement | |||
| Who enforces it? | National market surveillance authorities, and the EU AI Office for general-purpose AI models. | The California Attorney General, in civil court. The Office of Emergency Services receives the incident and risk reports. | The Cyberspace Administration of China with other ministries, each within its remit: development and reform, education, science and technology, industry, public security and broadcasting (Article 16). |
| Maximum penalty? | Up to EUR 35 million or 7% of worldwide annual turnover, whichever is higher, for prohibited practices; EUR 15 million or 3% for most other breaches, with the same ceiling for providers of general-purpose models (Article 101). | A civil penalty of up to $1 million per violation, scaled to its severity, against a large frontier developer. | Penalties under the cybersecurity, data-security and personal-information laws. Where those are silent: a warning, public criticism and an order to correct, then suspension of the service (Article 21). |
| Private right of action? | No. People can complain to a market surveillance authority. The proposed AI Liability Directive, which would have added a civil route, was withdrawn. | No. Only the Attorney General can sue for the penalties. Employees who report catastrophic risk are protected against retaliation, and one who wins in court can be awarded attorney's fees. | No. Users can complain or report to the authorities (Article 18), and providers must run a complaints channel (Article 15). |
| Timeline | |||
| When does it take effect? | In force since 1 August 2024 and applied in phases: prohibitions 2 Feb 2025, general-purpose AI 2 Aug 2025, most other rules 2 Aug 2026, high-risk systems listed in Annex III 2 Dec 2027, high-risk AI in regulated products 2 Aug 2028. The two high-risk dates were pushed back in July 2026. | Signed 29 September 2025 and in effect since 1 January 2026. The state's first yearly reports, on incidents and on whether the definitions still fit, are due from 1 January 2027. | In force since 15 August 2023. |
Key takeaways
Three different hooks
The EU AI Act regulates by what a system is used for and how risky that use is, with a separate track for the most capable general-purpose models. SB 53 regulates by training compute and company size, and only for catastrophic risk. China's measures regulate any generative AI service offered to the public in China.
SB 53 is what California passed after SB 1047
SB 1047, the broader bill vetoed on 29 September 2024, would also have required a shutdown capability and independent audits. SB 53, signed a year later, requires neither. It asks the largest developers to publish how they manage catastrophic risk, to report what goes wrong, and not to mislead.
Who has to act today
The EU AI Act reaches the most companies, and its rules for general-purpose models have applied since August 2025. SB 53 binds only the few developers that train the largest models. China's measures apply to anyone offering generative AI to the Chinese public, wherever the provider is based.
Not sure which of these applies to your situation?
Answer 5 quick questions and we'll match you to the AI regulations that apply to your jurisdiction, AI use case, and users.
Start the 60-second wizard →Comparison updated 2026-11-15. Hand-curated by Regulations.ai — not legal advice. For specific compliance decisions, consult qualified counsel in the relevant jurisdiction.