Is AI Regulation Finally Catching Up With the Technology?

Short answer

Yes — but unevenly, and the public isn’t feeling it yet. In the past two years the European Union’s AI Act has come into force with statutory penalties, the U.S. Federal Trade Commission has tightened the rule that governs children’s data, and cross-country surveys show the public’s worry about AI is rising faster than the law’s enforcement. The U.S. is the standout: it has the strongest concentration of concern about under-regulation and the lowest trust in its own government to handle AI of any country surveyed.

Why people are concerned

Across multiple cross-country surveys taken in 2025 and early 2026, a clear pattern repeats: most people think AI regulation is too weak, not too strong.

• A 25-country Pew Research survey published in October 2025 found a median of 53% of adults trust the EU to regulate AI use, versus 37% for the United States and 27% for China (Pew Research, 2025-10-15).
• The Stanford HAI 2026 AI Index Report, which restates Pew’s 25-country data, reports that the United States has the lowest trust in its own government to regulate AI of any country surveyed — 31%, against a global average of 54% (Stanford HAI, 2026).
• Eurobarometer’s Spring 2025 survey of roughly 26,500 people across all 27 EU member states found 84% agree that AI requires careful management to protect privacy and ensure workplace transparency — the highest single concern in that survey (Eurobarometer, Spring 2025).
• KPMG’s 2025 longitudinal study of 47 countries reports the share of adults who say they are worried about AI rose from 49% in 2022 to 62% in 2024, and the share who say the benefits of AI outweigh the risks fell from 50% to 41% over the same period (KPMG, 2025).
• Within the United States, Stanford HAI 2026 reports that across all 50 states, 41% of Americans say federal AI regulation will not go far enough, versus 27% who say it will go too far; more than one-third are unsure.

What is true

Regulation has materially advanced, and the changes are not symbolic.

• The EU AI Act (Regulation 2024/1689) is in force. Article 5 lists prohibited AI practices including untargeted scraping of facial images for biometric identification, emotion inference in the workplace and schools, and real-time remote biometric identification in public spaces. Violations of the prohibited-practices rules carry penalties of up to €35 million or 7% of worldwide annual turnover, whichever is greater (Baker Donelson — Spotlight on Biometrics; European Commission AI Act overview). The biometric provisions apply from 2 December 2027.
• The U.S. Federal Trade Commission’s amended Children’s Online Privacy Protection Act (COPPA) Rule was published in the Federal Register on 22 April 2025, with a compliance date of 22 October 2025. It added explicit obligations for AI and machine-learning systems that process children’s data, including data-retention limits, internal risk assessments and parental notice (FTC, Federal Register 2025-04-22; Loeb & Loeb, 2025).
• Sectoral enforcement is already happening. In January 2025, the FTC announced a $20 million settlement with Cognosphere, the maker of Genshin Impact, for violating COPPA by collecting personal information on children under 13 without parental consent. The settlement requires deletion of data and parental consent for in-game purchases by users under 16 (Loeb & Loeb, 2025).
• Cross-country trust in regulators has been measured in 25+ countries repeatedly since 2022. KPMG’s 2025 report — a survey of 48,340 people across 47 countries — finds that the share of people who view AI systems as trustworthy has fallen in 13 of 17 longitudinal countries since 2022 (KPMG, 2025).

What is exaggerated, misleading, or unsupported

Three common framings do not survive contact with the survey data.

• “AI regulation is universally opposed.” Unsupported. Every cross-country trend line — Pew, Eurobarometer, KPMG — shows the opposite. People are not against AI regulation; they are worried that there is not enough of it.
• “The U.S. has no AI regulation.” Misleading. The U.S. has sectoral regulation (COPPA for children, FTC consumer-protection authority, state-level laws) and active enforcement. What it lacks is a comprehensive federal AI statute analogous to the EU AI Act. Sectoral enforcement and a comprehensive statute are not the same thing, but the U.S. regulatory floor is not empty.
• “Europe has regulated AI so aggressively that innovation has stalled.” Not established. Stanford HAI’s 2026 reporting shows that EU adoption rates trail the U.S. and China modestly, but the EU also has the highest regulator trust of any major region. Whether that tradeoff is desirable is a value judgment, not a finding of fact.

What remains uncertain

Several gaps prevent a clean answer.

• No major EU AI Act enforcement action has been announced as of August 2026. The statute is in force; the precedent-setting penalty cases have not yet arrived. Until they do, the deterrent effect of the €35 million / 7% figure is theoretical.
• U.S. federal AI legislation is still pending. Surveys consistently show bipartisan concern about under-regulation, but no comprehensive federal bill has passed both chambers. The patchwork of state laws and sectoral enforcement is real but uneven.
• Cross-country survey wording varies. Pew, KPMG and Eurobarometer ask slightly different questions about “regulation,” “careful management” and “trust.” Comparisons across surveys should be read as triangulating a direction, not as exact differences between countries.
• Stanford HAI 2026 “restates Pew” rather than running an independent survey. Where this brief compares figures from the two, the underlying data is Pew’s 25-country survey; HAI is summarizing and contextualizing it.

Where we are likely headed

This section is editorial judgment, not a research result.

Over the next two to five years, three trajectories look more likely than not, based on the statutes already in force and the survey trends above:

1. EU AI Act enforcement will become the de facto international floor for serious AI products. Even non-EU companies will need to comply to sell into Europe. The first major penalty announcement, whenever it comes, will reset the seriousness with which executives read the rulebook.
2. U.S. AI policy will remain sectoral and politically contested. Expect continued FTC and state-level action, periodic congressional hearings, and no near-term comprehensive federal statute. Partisan divides (Republicans more likely to trust the U.S. government to regulate AI; Democrats more likely to worry about under-regulation, per Pew’s 2026 short read) will keep the political framing of AI policy live.
3. Public trust in AI will continue to drift downward unless something concrete changes. KPMG’s longitudinal data shows a sustained two-year decline across most developed economies; a single new regulation is unlikely to reverse that on its own. Sustained, visible enforcement is the more plausible trust-restoring mechanism.

What this means for people and small businesses

The practical implications are narrow and concrete.

• For people using consumer AI products. The EU’s prohibited-practices list is the most important thing to know about: if you are building or using face-recognition, workplace-monitoring or emotion-inference systems in the EU, the rules around them have changed. Outside the EU, the rules are looser but the FTC’s amended COPPA Rule does apply to products directed at children under 13.
• For small businesses. If you operate in the EU, or sell to EU customers, the AI Act is now a product-compliance issue, not a future possibility. If you operate only in the U.S., your immediate regulatory exposure is sectoral — children’s products, consumer protection, employment — but the political pressure for a federal floor is real and will keep rising.
• For everyone. The single best signal of whether AI regulation is “catching up” is whether enforcement is producing real consequences. As of mid-2026, the EU has the rules but not the first big penalty; the U.S. has the enforcement but not the comprehensive statute. Watch both, not just one.

Bottom line

Statutes are arriving. The EU AI Act is in force, the FTC has tightened children’s-data rules, and the first major sectoral settlements have already been announced. By the usual yardstick of “is there a law on the books,” yes, AI regulation is catching up.

By the yardstick the public is actually using — “do I trust the regulators to do this well?” — the answer is more sober. Trust in AI is falling in most major economies, and in the U.S. it is the lowest of any country surveyed. Regulation has caught up to the technology; trust has not caught up to the regulation. The next two to five years will be decided by whether visible enforcement arrives fast enough to close that gap.