In 2024 AI law was a timetable. In 2025 the first dates arrived.
From 2 February 2025, the EU AI Act's prohibitions on certain AI practices and its AI literacy requirement applied. The banned list in Article 5 covers practices such as manipulative techniques that cause harm and social scoring.
On 2 August 2025 the rules for general-purpose AI models began to apply [1]. To help providers meet them, the Commission published the General-Purpose AI Code of Practice on 10 July 2025, covering transparency, copyright and safety.
In the United States the picture stayed a patchwork. Colorado, the first state with a broad AI law, pushed its requirements back to 30 June 2026 in a bill approved in August 2025. Delays like this did not remove the work; they gave teams time to do it properly.
The lesson most companies took away was practical. Regulators and customers rarely ask "is your AI ethical?". They ask for documents: which systems you run, what data they use, who can override them, and what happened last time something went wrong. If those answers live in people's heads, compliance is a scramble every time.
What to do about it
Make the evidence a by-product of how you work: an AI system register, decision logs, and a named owner for each system, kept current rather than assembled for an audit. Our Govern service puts audit trails and stop controls around your agents. See Govern.
