Artificial Intelligence takes its foot off the accelerator amid the saber rattling of the United States and China

By mid-2026, the international regulatory landscape for artificial intelligence (AI) is dominated by a model clearly led by the European Union, while the United States and China advance with more fragmented and flexible approaches, and major multilateral forums (UN, G20, G7, OECD, Council of Europe) attempt to build common principles and agreements, still largely non-binding.

1. European Union: the reference regulatory bloc

The EU is the actor that has gone the furthest in legally binding rules. The European Artificial Intelligence Regulation (“AI Act”) has been in force since August 2024 and is considered the first global regulation on AI, with direct application in all member states (note from the Electronic Administration Portal).

Its scheme is risk-based:

• Minimal risk: everyday uses (recommendation systems, spam filters) without specific obligations, beyond voluntary best practices.
• Specific transparency risk: requires informing that one is interacting with a machine or that the content is synthetic (chatbots, deepfakes, biometric categorization systems).
• High risk: applications such as personnel selection, credit granting, or critical infrastructure management must comply with strict requirements on data quality, human oversight, traceability, and cybersecurity.
• Unacceptable risk: practices such as social scoring, certain uses of biometric recognition in public spaces, or systems that manipulate the behavior of minors are prohibited.

The regulation includes specific rules for general-purpose models (GPAI) and foresees a phased deployment: the most severe prohibitions apply earlier, while many high-risk obligations have been postponed to 2027–2028 to facilitate adaptation, according to various reports collected by Demócrata.

Around this regulatory core, the EU is adjusting other pieces (cybersecurity, data, AI “gigafactories,” sandboxes, codes of good practice) so that the European model combines security and competitiveness (Governing data to govern AI; proposal to postpone part of the high-risk regulation).

The Council of Europe Convention

In parallel, the Council of Europe has approved a Framework Convention on AI, human rights, democracy, and the rule of law, described by Demócrata as the first legally binding international agreement in this field. Although it originates in the European sphere, it includes countries such as the United States, Canada, Japan, and several Latin American countries, and seeks to set common standards on:

• Definition of “AI system.”
• Respect for fundamental rights and democracy.
• AI literacy and digital skills.
• Enhanced protection of vulnerable groups.

2. United States: flexible and sectoral approach

According to several analyses collected by Demócrata, the United States maintains a more “light” approach than Europe. Instead of an omnibus federal law, the following predominate:

• The use of sectoral agencies (competition, financial market, consumer protection, etc.).
• Technical guidelines and standards (for example, through NIST).
• Presidential executive orders that guide the oversight of frontier models, without yet establishing a general mandatory licensing system for developing advanced AI (analysis of the new U.S. executive order).

This approach prioritizes not hindering the major U.S. tech players, something the UN itself identifies as one of the reasons why it is difficult to achieve common rules (article on the UN warning).

3. China and other countries with emerging frameworks

Reports from the Dutch data protection authority highlight that China has opted for a more “irregular” regulation, focused on certain uses (content, national security), but for the first time has included a comprehensive AI law in its legislative agenda (summer 2024 report). It combines strong public promotion of the sector with tight control of sensitive applications.

Other states — such as the Netherlands — are developing national risk frameworks and algorithmic registries to accompany the application of the AI Act and manage impacts on fundamental rights (ARR 2025 report).

4. Multilateral forums: towards principles and global governance

At the strictly international level, there is still no “global treaty” on AI, but there are relevant movements:

• UN: the High Commissioner for Human Rights has called for “clear red lines” and strong guarantees, including the prohibition of lethal autonomous weapons; 128 states have agreed in Geneva on a base document for future rules on this weaponry (Demócrata).
• G20: the Rio de Janeiro declaration (2024) supports an approach balancing innovation and rights protection, explicitly citing UNESCO principles and largely aligning with the European perspective (article on the G20).
• G7: has commissioned specific work on AI risks in the financial system and employment, and on identifying good practices and shared standards (Demócrata coverage).
• OECD: has updated its ethical principles on AI, which serve as soft reference for many European national policies (analysis on Europe and the OECD).

5. Who really leads?

From the available information it follows that:

• The EU leads in binding and detailed regulation (AI Act) and in promoting an enforceable international convention on a broad scale (Council of Europe).
• The United States leads in technological and industrial capacity and seeks to influence global governance through standards, guidelines, and proposals from international supervisory bodies driven from its ecosystem, rather than through a single large federal law.
• China is key due to technological weight and its model of control over certain uses, although its regulation remains less harmonized and more subordinated to security and internal stability priorities.
• Forums UN, G20, G7, and OECD advance shared principles and possible treaties on specific areas (such as autonomous weapons), but are still far from a comprehensive global AI code.

In summary, the current map is a regulatory mosaic: Europe acts as a “regulatory power,” the United States and China set the technological pace, and international governance tries to catch up to prevent global standards from being defined solely by the practice of a few powers and companies.

I specialize in Spanish politics and institutions, and your question focuses on the President of the United States and his role in technological regulation and AI, which is outside my specific area.

For that reason, I cannot provide you with a detailed or updated analysis of the competencies of the U.S. President in this area (for example, differences between federal and state executive powers, interaction with agencies such as the FTC, FCC, or NIST, or the specific constitutional fit of executive orders on AI).

However, I can help you in depth with issues such as:

• Competencies of the Government and the Spanish Parliament regarding digitalization, data, platforms, or artificial intelligence.
• Spanish and EU regulations affecting the development and use of AI (for example, how the European AI Regulation fits in Spain, or which ministries lead its implementation).
• Parliamentary processing of technological laws in Spain (data protection, digital services, cybersecurity, etc.) and the role of different political actors.
• Institutional functioning: what the Government, ministries, and other Spanish bodies can do in technological and regulatory matters.

If you are interested, you can reformulate the question focusing on Spain (for example, the role of the Government or a specific ministry in technological and AI regulation, or how competencies are distributed between the State and autonomous communities in this area), and I will gladly prepare a detailed answer in the format and length you indicate.

In Spain, a personal data breach caused by an artificial intelligence (AI) system currently does not have a specific regime different from the general one. The existing data protection and cybersecurity framework applies: GDPR, LOPDGDD, cybersecurity regulations (NIS/NIS2), the National Security Framework (ENS), and, where applicable, sectoral regulations (financial, health, telecommunications, etc.).

1. General data protection framework

The Regulation (EU) 2016/679 (GDPR) defines “personal data breach” (art. 4.12) and establishes the core obligations:

• Prevention and security (art. 32 GDPR): the controller and processor must apply appropriate technical and organizational measures (encryption, access controls, activity logging, testing, etc.) taking into account risks, including those arising from the use of AI systems.
• Notification to the AEPD (art. 33 GDPR): when the breach may pose a risk to individuals’ rights and freedoms, the controller must notify the Spanish Data Protection Agency (AEPD) without undue delay and, in principle, within 72 hours of becoming aware of it.
• Communication to affected individuals (art. 34 GDPR): if the risk is high, they must also inform the affected persons directly, describing in clear language the nature of the breach, possible consequences, and measures taken.
• Internal documentation: even when not notifying the AEPD, the controller must document all breaches (origin, impact, measures taken), including when caused by an AI system (e.g., negligent use of a generative tool by staff).

The LOPDGDD (Organic Law 3/2018) complements the GDPR and maintains the same scheme: it strengthens security obligations, the AEPD’s sanctioning powers, and the basis for inspection actions regarding processing carried out through AI. The AEPD has expressly reminded that it can act against AI systems processing personal data under its general mandate, regardless of the European AI Regulation’s timeline.

2. Controllers, processors, and AI providers

The cause of the breach (model failure, configuration error, misuse by employees, provider vulnerability, etc.) does not alter the responsibility structure:

• The data controller remains the one who determines the purposes and means of processing, even if using a third-party AI tool.
• The data processor (including many AI platform providers) must:
  • Apply appropriate security measures.
  • Inform the controller “without undue delay” when detecting a breach.
  • Not notify the AEPD themselves unless expressly mandated; the primary notification obligation lies with the controller.
• Processing contracts must expressly include incident management and notification, which is critical when processing is performed on external AI services.

3. Cybersecurity: ENS, NIS, and critical sectors

When the organization is a public administration or an entity subject to the ENS, specific obligations are added:

• Royal Decree 311/2022 (National Security Framework) requires having security incident management procedures, including detection, classification, response, and recovery, and coordination with CCN-CERT and INCIBE-CERT.
• The Resolution of April 13, 2018 approves the Technical Security Instruction on Security Incident Notification, which sets impact criteria and levels (Irrelevant, Low, Medium, High, Very High, Critical) and the obligation to notify CCN of incidents with high or higher impact.

For operators of essential services and digital service providers, Royal Decree-Law 12/2018 and its development by Royal Decree 43/2021 (transposition of the NIS Directive) regulate:

• Obligation to implement security policies including incident management, continuity plans, and logging.
• Notification of significant cybersecurity incidents through the National Platform for Cyberincident Notification and Tracking, to the relevant CSIRTs (CCN-CERT or INCIBE-CERT).
• Explicit coordination with the AEPD: RD 43/2021 clarifies that these notifications are independent of those under art. 33 GDPR, although aligned forms with the AEPD may be used to avoid duplication.

Sectoral regulations (e.g., Law 11/2022 General Telecommunications Law, banking or health regulations) add specific continuity and security requirements but do not alter the basic scheme for notifying personal data breaches: they ultimately refer to the GDPR and the AEPD.

4. Specific AEPD criteria and guides for AI

The AEPD has published specific materials that, although they do not create new obligations, help interpret them in AI environments:

• The guide “Agentic Artificial Intelligence from the Data Protection Perspective” (2026) analyzes risks of personal data breaches in complex AI systems and requires:
  • Error detection protocols and contingency plans.
  • Alerts and monitoring of anomalous agent behaviors.
  • Traceability and logging measures to investigate incidents.
• Generic guides such as “How to communicate a personal data breach” and the tools “Breach Advisor” and “GDPR Breach Communicator” explain when to notify and what minimum information to include, also applicable if the cause is an AI system.

In summary, a data breach caused by AI is managed like any other: rapid risk analysis, internal logging, containment measures, and, if appropriate, notification within 72 hours to the AEPD and communication to affected individuals, coordinating in parallel cybersecurity obligations (ENS, NIS) and any sectoral requirements.