€35 million. Or 7% of global turnover. Whichever is larger.
That is the top rung of the European Union's enforcement ladder under the AI Act — and it hangs over any provider that places a general-purpose model on the European market, regardless of where that provider is incorporated. The obligations attach to a fixed calendar, not a sentiment. Transparency duties, training-data summaries, copyright policies, systemic-risk evaluations for anything trained above the 10^25 floating-point-operation threshold.
Washington has no comparable date. It has no comparable statute. Not for models. Not for agents. Not for the on-chain wallets that agents are already being handed.
I spent eleven weeks this year building one of those agents — a large language model wired into a multi-signature wallet, executing rebalancing logic across three chains. It worked. That was the problem. The only binding constraint on that prototype was the multi-signature threshold I configured myself. Not a regulator. Not a statute. A number I typed into a config file.
That is the shape of the gap. And the gap is not an American political story. It is an infrastructure story, and it lands hardest on the part of the stack that has no legal personality at all.
The Clock vs. The Void
Start with the asymmetry, because the asymmetry is the whole trade.
The AI Act entered into force on 1 August 2024. Prohibitions on unacceptable-risk practices applied from 2 February 2025. General-purpose AI obligations — the ones that touch foundation models, the ones that touch anything an agent runs on — apply from 2 August 2025. High-risk systems under Annex III follow in August 2026; Annex I systems in August 2027. Three years, phased, statutory, with a penalty schedule attached.
The United States produced, over the same window, an executive order and a standards document.
Executive Order 14110, signed 30 October 2023, invoked the Defense Production Act to compel reporting from developers training models above 10^26 FLOP, with a lower 10^25 threshold for specific dual-use tasks. It created reporting lines to the Commerce Department, safety-testing expectations, and a compute-cluster notification regime. It was, technically, real governance. It was also a document that the next occupant of the Oval Office could rescind in a paragraph, and it was.
The standards side was the NIST AI Risk Management Framework, published in January 2023, and the AI Safety Institute stood up under NIST in late 2023. Both are competent. Both are voluntary. In American practice, a voluntary framework becomes binding only when procurement contracts or market access make it binding — which is to say, when someone else's regulation does the enforcing for you.
Congress, meanwhile, ran the Senate's AI Insight Forums through late 2023 and into 2024, published a roadmap in May 2024 that was heavy on research funding and light on binding obligations, and adjourned without a floor vote on a comprehensive AI statute. The House ran a parallel task force. Both produced paper.
The states filled the space unevenly. Colorado passed SB 24-205, a consequential-decision regime with duties on developers and deployers, signed in May 2024. California passed AB 2013, a training-data transparency requirement, and then vetoed SB 1047, the frontier-model safety bill, in September 2024. Utah and Texas layered on narrower rules covering government procurement and disclosure. The result is not a framework. It is a map with fifteen different legends.
I have watched this exact movie in crypto. The United States has never passed a federal market-structure statute for digital assets either. What it passed instead was a decade of enforcement actions, a BitLicense in one state, a special-purpose charter in another, and a set of court opinions that function as law until the next court opinion overturns them. Every builder in this industry has priced that fragmentation. It shows up as legal spend, as delayed listings, as geofenced products, as engineers relocating to Lisbon. The AI sector is now being handed the same invoice, with the same payment terms.
What the Act Actually Regulates — And What It Cannot Touch
Here is where the technical detail matters more than the politics, because the AI Act's scope article is doing work that most coverage skips.
Article 2 reaches providers established in third countries where the output of the system is used in the Union. That is extraterritorial, and it is aggressive. But it reaches providers. Persons. Legal or natural. Entities with an address, an officer, a registered agent, and a place to serve process.
Now look at what is actually being deployed in the crypto stack.
An autonomous agent that holds a key, signs transactions, and executes a strategy has no provider in the sense the Act contemplates. The model weights were published by one entity. The inference is run by another. The prompting logic was written by a pseudonymous contributor on a forum. The wallet is controlled by a smart contract. The contract was deployed by an address that has never touched a fiat ramp and may be a proxy pointing at an implementation that can be swapped by a four-of-seven multisig. Every layer is separable, and the Act's obligation architecture assumes they are not.
Open weights make this sharper. Article 53(2) exempts free and open-source general-purpose models from the technical documentation and downstream-information duties — but only absent systemic risk, and the copyright-policy and training-content-summary obligations survive the exemption. So the Act does reach open weights, partially, through the copyright and data-transparency door. What it does not have is an enforcement surface. You cannot fine a repository. You can fine the person who uploaded it, if you can find them, if the jurisdiction will act, and if you can establish which of the eighteen fine-tunes derived from it is the one that caused the harm.
Compare the enforcement precedent that actually exists, because it is on the crypto side. In August 2022, OFAC sanctioned Tornado Cash — not a company, a set of smart contracts. It was the first serious attempt by a major jurisdiction to regulate code directly rather than the people operating it. Two years later, the Fifth Circuit held in Van Loon v. Treasury that OFAC had exceeded its statutory authority by sanctioning immutable contracts. The legal foundation cracked under appellate review. The lesson generalizes: code-level regulation is legally fragile in the common-law world, and the EU AI Act did not attempt it. It regulated entities, and left the code alone.
So the honest read of the Act's coverage is this: it governs the centralized layer of the AI stack — the labs, the enterprise deployers, the model cards, the conformity paperwork — and it governs perhaps the visible fifth of what is actually running in production. The rest is a key, a contract, and a block explorer.
Compute Is the Chokepoint Washington Never Needed Congress For
The "vacuum" framing collapses the moment you look at the hardware layer.
American control over frontier AI does not run through a statute. It runs through the Bureau of Industry and Security. The October 2022 export controls restricted advanced accelerators to China. The October 2023 update replaced the original connectivity-bandwidth test with a performance-density test — Total Processing Performance above 4,800 combined with a density above 5.92 — precisely because the industry had engineered around the first threshold. Licensing requirements extended to roughly forty additional jurisdictions. None of it required a floor vote. It required a Federal Register notice and an effective date.
Now apply that to decentralized compute.
Networks like Akash, Render, io.net, and Gensyn aggregate heterogeneous GPU supply and sell it against a token. The pitch is that compute becomes a market — permissionless, globally priced, immune to single-jurisdiction rationing. The question a surveillance analyst actually has to ask is whether that market is a sanctions-evasion vector.
Technically, not for frontier training. A 10^26 FLOP training run is not assembled from consumer 4090s over a gossip network. The interconnect bandwidth, the memory coherency requirements, and the failure-rate curve make it impossible today, and probably for a while. The export-control thresholds sit above what decentralized supply can physically reach, which means the DePIN narrative of "democratizing frontier compute" is, for now, a narrative.
But inference is a different problem, and inference is where the money is. Serving a frontier model under an export license is a controlled act. Serving it from a permissionless GPU market, fronted by an API that settles to a wallet, is a routing problem — and routing problems get solved. The AI Act's transparency obligations attach to the output regardless of where the compute ran. The export controls attach to the chip regardless of who leases it. Neither regime was drafted for a market where the chip lessor and the model deployer never share a jurisdiction, a legal identity, or a time zone.
I have run this class of test at smaller scale. When Arbitrum shipped Nitro in 2023, I benchmarked finality collapsing from roughly twenty seconds to under one, using a thousand programmatic transactions and a latency harness I wrote in a weekend. The infrastructure improved by an order of magnitude and not one regulator noticed, because there was nothing to notice — no rule touched the latency change. That is what a permissionless layer feels like from the inside. It moves faster than the statutes aimed at it, and the statutes are written as if it does not move at all.
Litigation Is Already Regulating What Legislatures Won't
Strip the legislation out and something still binds.
The New York Times filed against OpenAI and Microsoft in December 2023 over training data. The Authors Guild filed in September 2023. Getty filed against Stability AI in both the UK and the US. Andersen v. Stability has been grinding through the Northern District of California since 2022. None of these are side shows. They are the functional regulator.
When a legislature declines to specify what a model may be trained on, the question migrates to a courtroom, and the answer arrives as an injunction, five years later, applied to one defendant in one district. Crypto ran this experiment to completion. The SEC built a decade of policy out of enforcement actions rather than rulemaking, and the industry's compliance posture was set not by statute but by settlement terms and district court holdings that disagreed with each other by circuit.
I have spent nights tracing on-chain flows to figure out, in real time, whether a counterparty was solvent, because no registry would tell me and no regulator would return a call. I traced $2.1 billion in stablecoin outflows through wallets labeled to Alameda and its satellites, cross-referenced against protocol-level liquidity drains, and published the map before the major financial desks ran their versions. That is what an unlegislated market looks like operationally. You become your own regulator, and you are bad at it, because you have no subpoena power, no depositions, and no ability to compel a single document.
AI is entering the same phase. The difference is that AI's version of a discovery request is a training-data disclosure, and the defendant's version of a settlement is a licensing deal with a publisher. That is not a compliance regime. It is a series of tolls, priced retroactively, collected from whoever happened to be in the room when the music stopped.
Two Regimes, One Agent
Here is the overlap that is being priced by nobody.
MiCA's full application landed at the end of 2024. Every crypto-asset service provider serving EU clients now operates under a licensing regime with capital, custody, governance, and complaint-handling requirements. Simultaneously, the AI Act's Article 50 imposes transparency duties on AI systems that interact directly with natural persons — a disclosure obligation, plus marking requirements for generated content.
A trading agent that chats with a user and signs transactions sits inside both.
Is it a CASP? If it executes orders or safeguards crypto-assets on behalf of clients, under MiCA's definitions, plausibly yes. Is it a limited-risk AI system under the AI Act? It interacts with natural persons, so yes. Does it have a provider with an EU establishment or a legal representative? Usually not. Is the deployer identifiable? Often the deployer is a four-of-seven multisig across three jurisdictions. Is the model open-weight? Then the documentation exemption may apply, and the copyright disclosure does not.
I built a version of this in early 2025, months before the agent-token sector became a headline. LLM controller, policy engine, multisig execution, three chains. The technical failure modes I found were not in the model. They were in the policy engine — specifically, in the gap between what the model intended and what the transaction did. That is an authorization problem, not an intelligence problem, and the authorization layer is exactly where neither regime has anything to say. The AI Act asks who is accountable. MiCA asks who is licensed. Neither asks who holds the key, and neither has a procedure for the case where the answer is a contract.
That gap is where the next incident comes from. Not from a model that knows too much. From a wallet that answers to nothing but its own threshold.
"Ceding Leadership" Is the Wrong Frame
The consensus read on America's stalled AI legislation is that the EU wins and the US loses — Brussels sets the standard, Washington watches, American firms pay compliance rent. It is a tidy story. It is also mostly wrong, for three reasons that matter technically.
First, the EU has legislated the enforceable part of the stack and left the rest untouched. Entity-based documentation regimes are effective against labs and enterprise vendors. They have no purchase on open weights, on-chain agents, or decentralized compute. The Act governs where a legal person exists to be governed. That is not global leadership in AI governance. It is governance of the AI that was already easy to see — which is a real achievement, and a bounded one.
Second, the United States never needed Congress for the instrument it actually uses. Export controls on accelerators are administrative. Sanctions are administrative. The performance-density threshold that gates chip flows is a Federal Register entry, not a statute. The narrative of a vacuum confuses legislative inaction with regulatory absence. Power did not evaporate in Washington. It migrated from the Capitol to the agencies — which means it also became less durable, less predictable, and accountable to elections rather than to deliberation.
Third, and this is the one that gets missed: what the US forfeits is the certification layer. The conformity-assessment market, the notified bodies, the audit standards, the entities that decide what "safe" means in practice and charge for the privilege of saying so. That is a genuine rent stream. But it is not model capability and it is not compute. The compliance industry relocates to wherever the rules are written. The training runs do not. Anyone who has watched liquidity mining incentives migrate between chains every quarter knows exactly how portable that kind of capital is.
The genuinely bad outcome is neither American nor European. It is that the first serious autonomous-agent incident — a wallet drained, a market moved, a model that lied in a way a court cannot adjudicate — produces a panic statute drafted in three weeks with an enforcement architecture as unenforceable as everything that came before it. Emergency legislation is always the worst legislation. We got the Bank Secrecy Act's crypto provisions that way. We are going to get the agent version the same way, and the entities with the best lawyers will be the ones writing the comment letters.
What to Watch
Three dates. 2 August 2025, when the general-purpose obligations bite and the first enforcement actions become legally possible. 2 August 2026, when the high-risk annexes apply and the notified-body market has to actually exist in sufficient numbers to certify anything. And whenever a state legislature — Colorado, California, Texas — passes something with teeth and a private right of action attached, because private rights of action are what turn a statute into a litigation industry.
One question. When an autonomous agent with a funded wallet executes a transaction that a regulator, a court, or a user considers harmful, who gets served?
The Act assumes there is a name on the door. On-chain, there is a key. That difference is going to cost someone a great deal of money, and almost nobody has priced which side of it they are standing on.