Cohort: enforceable law (statutes / regulations), not voluntary frameworks. Comparing a statute to a lab policy is apples-to-oranges, so frameworks (NIST, ISO) and frontier-lab policies live in separate crosswalks. Cell convention: concise obligation +
[source §].—= instrument is silent / not its focus. ⚠ = drawn from a source stillprovisional claim.
| Obligation | 🇪🇺 EU AI Act (Reg 2024/1689) | 🇺🇸 Colorado ADMT Act (SB 26-189) | 🇺🇸 Illinois SB 315 (Frontier Safety) |
|---|---|---|---|
| Who is bound | Providers & deployers placing AI systems on the EU market; separate regime for GPAI models [EU §Art 6, 51–55] | Developers & deployers of "Covered ADMT" that materially influences consequential decisions; no inference required [CO §6-1-1701(2)] | ⚠ "Large frontier developers" only: frontier model >10²⁶ FLOP and >$500M annual revenue [IL §Sec 5] |
| Risk model | 4 tiers (unacceptable/high/limited/minimal) + GPAI-systemic >10²⁵ FLOP [EU §Art 5,6,50,51] | No tiers; triggers on "consequential decision" in 8 covered domains [CO §6-1-1701(3)] (SB 205's "high-risk" framing repealed) | ⚠ Single compute+revenue threshold; centered on "critical safety incidents" [IL §Sec 5] |
| Pre-deployment assessment | Conformity assessment + technical docs for high-risk [EU §Art 6–49] | Eliminated: impact assessments removed when SB 189 repealed SB 205 [CO §repeal note] | ⚠ Safety & security protocol; no per-decision impact assessment [IL §Sec 10] |
| Consumer transparency / notice | Notice of AI interaction; label AI-generated content (deadline 2026-12-02) [EU §Art 50] | Pre-use notice and post-adverse-decision plain-language notice [CO §6-1-1702–1705] | : (developer-side regime, not consumer-notice) |
| Human oversight | Human oversight required for high-risk [EU §Art 14] | Statutorily-defined right to "meaningful human review" after adverse decision [CO §6-1-1701(15)] | : ("loss of model control" treated as a reportable incident) [IL §Sec 5] |
| Docs to downstream parties | Technical documentation; GPAI training-data summary [EU §Art 51–53] | Developer must supply deployers: intended/known-harmful uses, training-data categories, limitations, human-review instructions [CO §6-1-1702] | ⚠ Published safety & security protocol [IL §Sec 10] |
| Incident reporting | Serious-incident reporting, ~15 days [EU §Art 73] | , (no safety-incident regime; consumer-rights model) | ⚠ Critical safety incident within 72 hours: tightest of the three [IL §Sec 15(c)] |
| Third-party audit | Notified-body conformity assessment for some high-risk [EU §Art 43] | , (no audit mandate) | ⚠ Annual independent third-party audit from 2027-01-01: first US mandatory-audit regime [IL §Sec 10(d)] |
| Record retention | Documentation retained (multi-year) [EU §Art 18] | 3 years after a consequential decision [CO §6-1-1702] | ⚠, (not specified in current text) |
| Enforcement / penalties | Fines up to €35M or 7% global turnover [EU §Art 99] | AG-exclusive; deceptive trade practice; 60-day cure (sunsets 2030-01-01) [CO §6-1-1706] | ⚠ Civil penalty ≤$1M first / ≤$3M subsequent; AG action only [IL §Sec 25] |
| Private right of action | No: public enforcement | No [CO §6-1-1706(4)] | ⚠ No: AG only [IL §Sec 25] |
| Effective date | Phased: most rules 2026-08-02; Art 50 2026-12-02; sandboxes 2027-08 [EU §timeline] | 2027-01-01 [CO §Section 5] | ⚠ 2027-01-01 (awaiting Governor's signature) [IL §Sec 99] |
| Evidence limits | Structure only; consult primary text | Signed statute | Provisional; pre-enrollment |
How to read this
- The trans-Atlantic divergence is the headline. The EU is risk-tiered, ex-ante, conformity-assessment-based. Colorado (post-SB 189) pivoted to a lighter notice-and-consumer-rights model: impact assessments and risk-management duties gone. Illinois went a third way: frontier-developer safety (compute thresholds, mandatory audit, 72-hour incident reporting) rather than consumer protection.
- Tightest single obligations: Illinois on incident reporting (72h vs EU's ~15 days) and third-party audit (mandatory vs voluntary elsewhere).
- Every column is AG-/public-enforced with no private right of action in the US instruments: a consistent US design choice worth flagging for any client comparison.
Sources
- EU AI Act: key articles
- Colorado SB 26-189 ADMT Act (supersedes SB 24-205)
- Illinois SB 315: AI Safety Measures Act ⚠ provisional