Subnational
Why the subnational level is not an appendix but a main theatre
Section titled “Why the subnational level is not an appendix but a main theatre”A common phenomenon across all three jurisdictions: the subnational level is not a mechanical implementation of central rules, but a genuine main theatre for the practical work of AI governance. Three reasons:
- Legislative responsiveness is faster: local legislatures have a shorter reaction cycle to new technologies than central lawmakers — NYC Local Law 144, the Shenzhen AI Industry Promotion Regulation, and the CNIL AI guidance in France all landed before their respective central legislation.
- The institutional logic of pilot — distill — scale up: China’s “pilot-and-experiment first” (先行先试), the American “laboratories of democracy”, and EU “Member State transposition” all share this institutional design.
- Enforcement happens at the local level: the AI Act’s MSAs sit in the Member States, China’s provincial CAC bureaus handle filings, US state AGs bring suits — the teeth of central legislation grow locally.
For this reason, this site treats Subnational as its own axis, parallel to Top-Level Rules.
Three models of subnational governance
Section titled “Three models of subnational governance”| Dimension | CN Chinese local | US State / City | EU Member States |
|---|---|---|---|
| Main form | Provincial / municipal industry-promotion regulations, pilot zones | Comprehensive state AI laws, election-deepfake-specific laws, municipal employment AI ordinances | AI Act transposition statutes, Member State MSA designations, AI guidance under DPAs |
| Legislating body | Provincial / municipal People’s Congresses | State legislatures / city councils | Member State parliaments / ministers |
| Relation to central government | Subordination + pilot-and-experiment (“two lists”) | Opposition or supplementation (states take the lead in a federal vacuum) | Mandatory transposition (certain AI Act provisions are left to Member States to flesh out) |
| Core driver | Industry promotion (investment attraction) + governance pilots | Anti-discrimination / anti-election-deepfake / public-sector AI | GDPR enforcement extension + AI Act readiness |
| Order of magnitude | Over ten provinces and cities have issued AI industry regulations | 1,208 AI bills in 2025, 145 enacted | 27 Member States, each at different transposition stages |
| Flagship | Shenzhen 2022 AI Industry Promotion Regulation | Colorado AI Act · CA SB 53 · TX TRAIGA · NYC LL 144 | Spain AESIA (the EU’s first national AI supervisory authority) · France CNIL AI |
By jurisdiction
Section titled “By jurisdiction”CN Chinese local — Overview →
Section titled “CN Chinese local — Overview →”Model: industry promotion + pilot-and-experiment. The concern of local legislation is “how to cultivate the AI industry” rather than “how to constrain AI risks”. Risk constraint is unified under central departmental rules (led by the CAC); local jurisdictions do not overstep.
Collected:
- Shenzhen Special Economic Zone AI Industry Promotion Regulation (2022) — China’s first local-level AI industry legislation, pioneering “low-risk AI pilot-and-experiment” + open data + localized ethics review.
Institutional features:
- “Two lists”: a high-risk AI use-case list (prohibition) + a low-risk AI use-case list (pilot-and-experiment exemption) — a structural innovation of the Shenzhen regulation, later emulated by Shanghai, Beijing, Hangzhou, Chengdu and others.
- “Demonstration zones” and “pilot zones”: 20+ national-level new-generation AI innovation development pilot zones (Beijing, Shanghai, Hefei, Hangzhou, etc.) and 10+ innovative application pilot zones serve as policy space.
Not yet given dedicated pages but worth tracking:
- Shanghai Regulation on Promoting the Development of the AI Industry (2022)
- AI promotion regulations of Beijing, Hangzhou, Chengdu and other cities (many issued between 2023 and 2025)
- Shanghai Lin-gang full-chain AI incubation ecosystem pilot zone
US States / Cities — State-law index →
Section titled “US States / Cities — State-law index →”Model: “laboratories of democracy” in a federal vacuum. State laws are enacted across the ideological spectrum and together form the hard-law main theatre of US AI governance.
Three comprehensive state laws (taking effect in 2026):
| State law | Positioning | Effective | Party | Compliance burden |
|---|---|---|---|---|
| Colorado AI Act | Anti-discrimination / high-risk AI (closest to EU AI Act) | 2026-06-30 | Democratic Party | High |
| California SB 53 | Frontier AI transparency (10²⁶ FLOP threshold) | 2026-01-01 | Democratic Party | Medium (only large frontier developers) |
| Texas TRAIGA (HB 149) | Prohibition of specific harmful uses + preemption of local ordinances | 2026-01-01 | Republican Party | Low |
Municipal law:
- NYC Local Law 144 (AEDT) — enforcement began 2023-07 · the first US law with concrete compliance requirements for AI hiring tools.
The 2025 legislative landscape: 1,208 state AI bills, with 145 enacted (IAPP / NCSL statistics). Trump EO 14365 (2025-12) attempts to preempt state laws, but the legal consensus is that an EO cannot independently preempt state legislation; in the near term state laws continue to take effect. See US state laws →.
EU Member States — Index →
Section titled “EU Member States — Index →”Model: differentiated implementation under “mandatory transposition”. The AI Act is a Regulation directly applicable, but several provisions are explicitly left to Member States: designation of national supervisory authorities, implementation of fines, specific “public interest” exemptions, and so on.
Collected:
- Spain AESIA — the EU’s first national-level AI supervisory authority (Agencia Española de Supervisión de la IA), established 2023-08 · based in La Coruña · formally exercising Article 70 MSA functions under the AI Act from 2025.
- France CNIL AI — the French data protection authority issued a series of AI-specific guidelines (2023-2024) before the AI Act took effect, a leading example of active DPA intervention on AI among EU Member States.
Key observation: as of 2026-04, roughly half of Member States have not formally designated MSAs under the AI Act (market-surveillance authorities); enforcement coordination relies on the AI Office (under the Commission) + AI Board + cooperation mechanisms between Member State DPAs / DSAs.
Core tensions across the three models
Section titled “Core tensions across the three models”China: the local imbalance between industry promotion and risk management
Section titled “China: the local imbalance between industry promotion and risk management”- Localities can only promote industry; risk management is unified centrally → “dare to try” has boundaries.
- Does pilot experience actually feed back to the centre? This is contested in academia (Wang Gang 王钢, Dai Xin 戴昕 and other scholars of algorithmic governance study this “vertical interaction”).
- The relationship between local AI ethics review committees (pioneered in Shenzhen) and the central Measures for the Review of Science and Technology Ethics is still being worked out.
United States: the constitutional contest between federal preemption and state-law resistance
Section titled “United States: the constitutional contest between federal preemption and state-law resistance”- Trump EO 14365 (2025-12) established the AI Litigation Task Force and leverages BEAD funding conditions to pressure states.
- Academic consensus (Harvard Law Review, NYU Tech Law): an EO cannot independently preempt state legislation; there must be Congressional legislation or an actionable federal-law conflict.
- In 2026 the DOJ is expected to challenge California SB 53 and the Colorado AI Act; but state AGs (e.g., California AG Bonta, Colorado AG Weiser) have collectively signalled continued enforcement.
European Union: the dual-track confusion between directive transposition and directly applicable regulations
Section titled “European Union: the dual-track confusion between directive transposition and directly applicable regulations”- The AI Act is a Regulation (directly applicable) but matters such as MSA designation are left to Member States.
- Capacity among MSAs varies enormously: Spain AESIA is purpose-built, Germany uses a multi-agency split, Ireland relies on the DPC.
- Concerns about a re-emergence of the “Irish bottleneck”: the Irish DPC bottleneck in GDPR enforcement may recur under the AI Act.
Intersections with other axes
Section titled “Intersections with other axes”- Thematic angle: the issues analysed on the Topics pages are often first tested at the subnational level. NYC LL 144 was the first landing of “AI employment anti-discrimination”; the Shenzhen AI Industry Promotion Regulation was the first institutionalization of “risk classification + pilot-and-experiment”.
- Relation to top-level rules: the subnational level is not a mechanical implementation of the centre. TX TRAIGA explicitly preempts local ordinances; California SB 53 has potential conflict with federal BIS export controls. This “centre-vs-local” contest is itself a driver of AI governance’s institutional evolution.
- Corporate practice: the real pressure on corporate compliance often comes from a specific state or city law (NYC LL 144 triggered compliance overhauls at every AI-hiring SaaS company; the CO AI Act is triggering major companies’ preparations of “high-risk lists”).
Methodological note
Section titled “Methodological note”- Inclusion criteria: filtering at the subnational level is not about legal hierarchy, but about AI salience + originality + real-world impact. The Shenzhen AI Industry Promotion Regulation is included because it pioneered the “two lists” model; NYC LL 144 is included because it set the precedent for concrete AI-hiring compliance.
- Not included: general data laws (such as CCPA / CPRA themselves, though their AI extensions — e.g., California’s ADMT rules — can be included), purely declaratory local-government AI ethics statements (without concrete obligations), and industrial policy plans (non-binding AI action plans).
- “Explicitly not given a page”: see Methodology · Inclusion criteria.