The History of AI Regulation

By Victor Hoang · Updated Oct 24, 2026

The opening problem was small and practical. Governments and credit bureaus were storing files about citizens on computers. Nobody could say who was allowed to read, change or act on them.

Binding law for automated decisions started in 1970, long before anyone called the software "AI." The German state of Hesse passed the first statute aimed at computerized data processing that year. The United States passed the Fair Credit Reporting Act. The rules that followed kept the same instinct: regulate the decision that lands on a person, not the technology behind it. The throughline of this history is that rights for people came first and duties for builders came later. The world then split into rival models once generative AI arrived.

This article follows how that question turned into the EU AI Act, China's layered rules, a shifting US patchwork and the first international treaty. It covers binding law only. Voluntary principles and ethics codes are told in The History of AI Governance, and the technology itself is in The History of AI. This is history, not legal advice.

Timeline at a Glance

The First Data Laws (1970-1994)

Rules for computer files, years before anyone said AI

The first statute in this story regulated files, not algorithms. Hesse's Data Protection Act, adopted on 7 October 1970, covered the official files of the state government and exempted wholly private files. It created a Data Protection Commissioner under the state parliament, whose job was to make sure state files could not be altered, examined or destroyed by unauthorized people, and to watch how computerization shifted power among government bodies. A 1973 report to the US Secretary of Health, Education, and Welfare called it the first legislative act directed specifically at regulating automated data processing. The same appendix records Sweden's Data Law, which took effect on 1 July 1973, with an inspectorate, a licence before any automated personal-data system could be set up, and a right for people to see and correct their data.

The United States went through a different door: credit. The Fair Credit Reporting Act of 1970 is described by the FTC as the 1970 law designed to protect the privacy of credit report information. Today the FTC's page on the statute says it requires users of reports in credit, insurance or employment to notify the consumer when they take adverse action based on a report. That is an early rule about a scored decision reaching a person. In July 1973 a federal advisory committee set up under Secretary Elliot L. Richardson published Records, Computers and the Rights of Citizens, the report that framed the US debate over automated personal data systems.

France then wrote the idea that would last. The final text adopted by the Senate on 21 December 1977 states in Article 2 that no court decision involving an assessment of human conduct may rest on automated processing that defines a person's profile or personality. It adds that no administrative or private decision may rest solely on such processing. Article 3 gives people the right to know and contest the information and reasoning used in automated processing whose results are used against them. Read that again with a modern eye: it is a rule about profiling and human review, written in the 1970s.

Keep precursor and concept apart. None of these laws mentioned artificial intelligence, and they regulated mainframe-era record keeping. What they invented was the unit of regulation that survives today: the decision about a person, plus a right to contest it.

For teams today: the oldest AI rule is still the practical one. If a system scores people, ask who can see the score, who can challenge it, and whether a human reviews the outcome.

The Article 15 Years (1995-2016)

Europe puts automated decisions into a directive, then a regulation

On 24 October 1995 the European Parliament and Council adopted Directive 95/46/EC. Article 15 gave individuals the right not to be subject to a decision that significantly affects them when it is based solely on automated processing that evaluates aspects of their personality, with job performance and creditworthiness named as examples. Member States had three years from adoption to bring national laws into force. A directive works through national legislation, so each Member State wrote its own version.

The regulation that replaced it came after a long negotiation. The GDPR entered into force on 24 May 2016 and applies since 25 May 2018. Its Article 22 carried the 1995 idea forward and sharpened it. The Article 29 Working Party, the advisory body of EU data protection authorities, adopted guidelines on automated decision-making on 3 October 2017 and revised them on 6 February 2018. They read Article 22(1) as a general prohibition on solely automated decisions that have a legal effect or similarly significantly affect someone, with defined exceptions such as explicit consent. Their loan example separates a human deciding on the basis of an automated profile from an algorithm deciding with no meaningful human assessment.

This era solved the problem of patchwork national rules. It created a new one: the text turned on the word "solely," and companies argued over how much human involvement counted. That argument returns in the generative era.

For teams today: record where a human actually reviews a decision. A rubber stamp is not a review, and regulators read the process, not the org chart.

The Algorithm Rules (2017-2022)

Governments start naming algorithms in law

Two jurisdictions moved first, in opposite directions. On 20 July 2017 China's State Council released its New Generation Artificial Intelligence Development Plan. It aimed for initial AI laws, regulations and ethical norms by 2025 and more comprehensive ones by 2030, alongside industrial goals. The plan was a strategy document, not a statute, but it set the schedule for what followed.

Europe took the rights route. On 21 April 2021 the European Commission proposed what it called the first-ever legal framework on AI, paired with a coordinated plan with Member States. Executive Vice-President Margrethe Vestager said the rules would intervene only where the safety and fundamental rights of EU citizens were at stake. That sentence is the whole design philosophy of the later Act: light rules for most systems, hard rules where people can be hurt.

China's binding rules arrived next. The Provisions on algorithmic recommendation, signed on 31 December 2021, took effect on 1 March 2022. They require providers to offer users a convenient option to switch off algorithmic recommendation. Providers with public opinion attributes or social mobilization capability must file with the regulator within 10 working days of providing service. Notice the model: it is rights for users plus registration for providers, with the Cyberspace Administration of China coordinating.

This era solved the vocabulary problem, since laws began to name algorithms directly. It created a split in design. The EU wrote horizontal rules by risk. China wrote targeted rules by application, one technology at a time.

For teams today: if you sell into more than one region, expect separate definitions of the same system. Keep one inventory of what each AI feature does, so each rulebook can be checked against it.

The Generative Shock (2022-2023)

A chat box forces every regulator to act on existing law

When generative AI reached the public in late 2022 (see The History of Generative AI), no AI statute was in force anywhere in a major market. Regulators used what they had. On 31 March 2023 Italy's data protection authority, the Garante, ordered a provisional limitation on OpenAI's processing of Italian users' data with immediate effect and opened an investigation. Its stated grounds were no notice to users, no legal basis for mass collection of data to train the algorithms, possible inaccuracy of outputs and no age verification. The tool was a privacy regulator, not an AI law.

In the United States, one early AI-specific rule came from a city. New York City's Local Law 144 prohibits employers and employment agencies from using an automated employment decision tool unless it has had a bias audit within one year of use and the required notices are given. The city's consumer and worker protection department began enforcement on 5 July 2023.

China moved faster. Its deep synthesis provisions, promulgated on 25 November 2022, took effect on 10 January 2023, with labeling duties for synthetic content. Then the generative AI interim measures were adopted at a CAC meeting on 23 May 2023, dated 10 July 2023 and effective 15 August 2023. Article 17 requires providers of generative services with public opinion attributes or social mobilization capability to carry out security assessments and complete algorithm filing.

The US federal answer came as an executive order, not a statute. On 30 October 2023 President Biden issued Executive Order 14110, which used the Defense Production Act to require developers of the most powerful AI systems to share safety test results with the government. An executive order binds federal agencies and, through them, certain contractors and reporters. It does not create a general private-sector code, and a later president could rewrite it. Hold that thought for 2025.

This era solved the legal vacuum, by improvisation. It created a record of what stretched law could and could not do. The Garante could act on privacy grounds, but nothing in the GDPR was written for a model trained on the open web. For the technology behind these moves, see The History of Large Language Models.

For teams today: privacy, consumer protection and employment law already apply to AI features. The newest AI statute is rarely the first rule a regulator reaches for.

The Act Passes (2024)

Brussels finishes the first broad AI statute

The year opened with a deal and ended with a calendar. Parliament and Council negotiators reached a provisional agreement on 8 December 2023, with a list of banned applications including social scoring, untargeted scraping of facial images, emotion recognition in workplaces and schools, and AI that manipulates behavior. Parliament adopted the law on 13 March 2024, by 523 votes to 46, with 49 abstentions. The Council gave final approval on 21 May 2024. The regulation carries the date 13 June 2024, was published in the Official Journal on 12 July 2024 and entered into force on 1 August 2024. Signing, publication and entry into force are three different dates, and each is used in different documents. The concept is explained in our guide to the EU AI Act.

The Act's structure follows the 2021 proposal's logic: prohibited practices, high-risk systems, transparency duties for some systems, and rules for general-purpose AI models. The Commission's page sets out a phased calendar. Prohibited practices and AI literacy obligations began to apply on 2 February 2025. Governance rules and obligations for general-purpose models followed on 2 August 2025.

Other jurisdictions moved in the same year. In the United States, Colorado's governor signed Senate Bill 24-205, "Consumer Protections for Artificial Intelligence," on 17 May 2024. And on 5 September 2024 the Council of Europe opened its Framework Convention on AI for signature. It was signed on opening day by 10 states, among them Israel and the United States, and by the European Commission for the EU, and it takes effect once five parties, including at least three Council of Europe members, consent to be bound.

Courts shaped the picture too. On 7 December 2023, according to the advocacy group noyb, the EU Court of Justice held in the SCHUFA case (C-634/21) that producing a credit score can itself count as an automated decision under Article 22 GDPR. The case concerned the German credit reference agency SCHUFA and a score it generated.

This era solved the question of whether a democracy could pass a broad AI statute at all. It created an implementation problem: standards, authorities and guidance had to exist before the deadlines did. For where the Act sits in the wider story of the 2020s, see The Future of AI History.

For teams today: treat the AI Act's dates as a project calendar. Which date applies to you depends on what your system does, so map features to risk categories first.

The Rollout Years (2025-present)

Deadlines slip, statutes multiply, and the US reverses course

The first months of 2025 moved in opposite directions on two continents. In the EU, the first obligations began to apply on 2 February 2025. In Washington, an order signed on 20 January 2025, Executive Order 14148, listed Executive Order 14110 among the actions it rescinded. Three days later Executive Order 14179 set a policy of maintaining US leadership in AI and told officials to review actions taken under the rescinded order, suspending or revising any that conflicted. The first federal executive framework had lasted about fifteen months.

States and the federal government then began to pull against each other. On 29 September 2025 California's governor signed Senate Bill 53, the Transparency in Frontier Artificial Intelligence Act, which requires large frontier developers to publish a safety framework and creates incident reporting to the state. On 11 December 2025 the White House issued an order that, per its fact sheet, would have the Attorney General form a task force to challenge state AI laws, ask Commerce to review them, and allow certain broadband funds to be withheld from states with conflicting laws. Colorado shows how unsettled the ground is. A special-session bill signed on 28 August 2025 extended the effective date of SB 24-205 to 30 June 2026. Then SB 26-189, signed on 14 May 2026, repeals and reenacts those provisions with new requirements for automated decision-making technology used in consequential decisions, with some obligations starting on 1 January 2027.

China kept adding targeted rules. Measures for labeling AI-generated synthetic content, issued on 14 March 2025 by four agencies, took effect on 1 September 2025, requiring explicit labels on generated text, images, audio, video and virtual scenes plus implicit labels in file metadata. South Korea's AI Basic Act took effect on 22 January 2026, and the ministry has indicated a one-year window before administrative fines are imposed.

The EU's own calendar moved. The Commission states that the AI Act became applicable on 2 August 2026, with some exceptions. It also reports that the Digital Omnibus on AI, a proposal the Commission adopted on 19 November 2025, reached political agreement on 7 May 2026 and entered into force on 27 July 2026. Under the amended calendar, rules for high-risk uses listed in Annex III apply from 2 December 2027, and rules for high-risk AI embedded in regulated products under Annex I apply from 2 August 2028. The Commission's timeline also lists 2 December 2026 for the new prohibitions on AI that generates non-consensual sexual deepfakes and child sexual abuse material, and 2 August 2027 for each Member State to have at least one regulatory sandbox operating.

This era solved the question of whether AI law could exist in practice. It created three new ones: how long a legislature can hold a deadline, how much room states and nations keep under federal or EU rules, and who supervises models that cross borders. Rules in each market change, so read the official source for the places you operate. For the sales side of this story, see The History of AI in Sales and Revenue Operations, and for AI that acts on its own, see The History of AI Agents.

For teams today: build a short register of the AI rules that touch your product, with an owner and a review date. Dates in this field have already moved more than once.

Key People

Key Facts

• Hesse adopted the first data protection act on 7 October 1970, covering state government files.
• Article 2 of France's 1970s data law barred decisions based solely on automated profiles of a person in administrative and private settings.
• The GDPR has applied since 25 May 2018, with Article 22 covering solely automated decisions.
• The EU AI Act entered into force on 1 August 2024 and, per the Commission, became applicable on 2 August 2026 with exceptions.
• China's generative AI measures took effect on 15 August 2023, after the algorithm rules of 1 March 2022.
• The Council of Europe AI convention opened for signature on 5 September 2024.

The Pattern Behind the History

Across five decades, the same five moves recur. We call this the Rights-Then-Rules Ladder. It is our synthesis of the record above, not a research finding.

1. Regulate the decision, not the machine. Hesse, the FCRA, France and Article 15 each targeted what a system did to a person.
2. Rights arrive first. Access, correction, contest and human review came decades before duties for model builders.
3. Existing law moves first. Privacy authorities and courts applied old statutes to new systems before any AI statute applied.
4. Regimes branch by purpose. The EU wrote horizontal risk rules, China wrote application-by-application rules with registration, and the US wrote executive orders and state laws.
5. Calendars slip, categories stay. Colorado and the EU both moved dates while keeping the core idea of consequential decisions.

What It Teaches Teams Today

• Start with the decision. List every place an AI system affects a person: hiring, credit, pricing, support, access.
• Keep a human who can actually change the outcome. The word "solely" in 1995 and 2018 turned on this.
• Expect old law first. Data protection, consumer protection and employment law are the usual entry points.
• Run one inventory for many rulebooks. Different regions define the same system differently.
• Track dates with an owner. Both the EU and Colorado revised timelines after passing laws.
• Pair this history with policy work. See The History of AI Governance and our summary of AI governance.

AI regulation grew from rules about files into rules about decisions, and then into rules about models. The next chapter will be written by courts, regulators and legislatures still adjusting their calendars. For the technology side of the story, return to The History of AI.