What are the emerging regulations to rein in AI harms?

SINGAPORE – Global artificial intelligence (AI) regulations are rapidly evolving, with the European Union already establishing its pioneering laws and US lawmakers debating the need for a mandatory AI “kill switch”. The Straits Times looks at how these rules compare to rules and frameworks in China and Singapore.

European Union

The world’s first comprehensive AI law came into force in the EU in 2024. The EU AI Act governs the development, deployment, distribution and use of AI systems in all member states of the bloc. It takes a risk-based approach to regulation.

Enforcement of the AI Act is carried out by the European Commission’s AI Office, the European Data Protection Supervisor and authorities designated by EU member states.

The Act classifies AI systems according to four risk categories: minimal, limited, high and unacceptable.

AI systems with minimal risks do not need to meet specific requirements. They include spam filters and AI-enabled video games.

AI systems with limited risks include chatbots, and they need to meet transparency requirements. For instance, AI-generated content must be clearly labelled and companies must be upfront when users are interacting with AI chatbots.

High-risk AI systems are those that pose serious risks to health, safety or fundamental rights, including AI recruitment tools for sorting resumes and AI safety features in critical infrastructure. From late 2027, AI systems sold must have activity logs so results can be traced, and they must ensure a high level of robustness, cybersecurity and accuracy.

AI systems with unacceptable risks pose a clear threat to the safety, livelihoods and rights of people. The Act bans such AI, including systems that can manipulate and deceive, and those that generate non-consensual sexually explicit material and child sexual abuse content.

United States

The US does not have a comprehensive national AI law, but several states have their own rules. At the same time, the White House is pushing for light-touch, market-driven regulations through federal moves that run counter to state AI laws.

There is no single federal AI regulator in the US. Several federal authorities, such as the Federal Trade Commission and the Department of Justice, do cover software and algorithmic processes, which include AI.

Notable state-level AI regulations include the first comprehensive US law in Colorado in 2024 that applies to developers and deployers of high-risk AI in the state. These organisations must, for instance, protect consumers from risks arising from algorithms discriminating against people.

But the Colorado Act was repealed and replaced with a more limited law that replaces “high-risk AI systems” with “automated decision-making technology” and avoids mentioning discrimination.

This has been seen as a response to industry complaints and a federal executive order that takes aim against “onerous” state AI laws with threats of withholding certain types of federal funding.

The White House has also issued a national policy framework for AI to eventually establish a “minimally burdensome national standard” that prevents state AI laws from hampering innovation in the technology. It suggests relying on existing agencies and industry standards instead of setting up new federal regulators.

The framework suggests protecting vulnerable groups like children, such as with tools for parents to manage their children’s privacy settings and requiring AI platforms to have features to lower risks of sexual exploitation and self-harm among minors.

Other rules proposed by lawmakers include an AI “kill switch” legislation that would mandate businesses to be able to shut down dangerous AI tools.

China

China does not have a single AI law but instead relies on various regulations, binding rules, targeted measures and non-binding technical standards with government oversight. They include the Cybersecurity Law for AI security and interim measures for governing generative AI, including data privacy issues.

The main regulator is the Cyberspace Administration of China, with supporting authorities such as the Ministry of Public Security and the State Administration for Market Regulation.

AI services considered by regulators as shaping public opinion or mobilising society must be registered with the authorities before they can be publicly launched.

Data used to train generative AI models must be legally obtained and cannot infringe on third-party intellectual property rights. Personal information can be used only for training with a person’s consent.

AI-generated content needs to be clearly labelled, and prohibited content cannot be generated.

Prohibited content includes that which endangers national security and interests, or propagates ethnic discrimination, terrorism, pornography, violence and fake and harmful information.

There are also safeguards for AI companions, including mandatory anti-addiction breaks and reminders that the bot is not a real person. Age verification of users is required as there are time limits for minors. Intimate virtual relationships for minors are not allowed.

Singapore

Singapore does not have a single AI regulation but instead relies on voluntary best practices, targeted efforts for high-risk sectors and existing laws. They include the Personal Data Protection Act for AI use of personal information, and a voluntary framework for governing AI agents.

There is no single AI regulator in Singapore. Several agencies are involved, including the Infocomm Media Development Authority, Monetary Authority of Singapore and Cyber Security Agency of Singapore.

Singapore has a voluntary governance framework for AI to guide responsible deployment of the tech. It has been updated over time to cover generative AI and AI agents.

For example, on generative AI, the framework recommends transparency on AI training data sources and how users’ data will be protected. For AI agents, there are suggestions to require human approvals for high-risk actions agents may take, to prevent the AI from going rogue.

Specific sectors have targeted measures for AI, such as detailed and practical guidance for financial institutions on implementing AI risk management frameworks.

Guidelines to clarify AI use under existing laws have also been issued, including measures that require organisations in Singapore to inform consumers when they use personal data to train generative AI models.