AI regulation 2026: a guide for companies sourcing products from China.

This page was compiled as of 31 October 2026 and is not legal advice. Its purpose is to show, on one page, how regulation touches the supply chain of companies that source products or components from China and sell them in Türkiye, the EU or the US. For the process side, see End-to-end AI automation.

Where does the EU AI Act stand?

The Act entered into force on 1 August 2024 and applies in phases. Prohibited practices and AI literacy have applied since 2 February 2025, and rules for general-purpose AI models since 2 August 2025.

The Digital Omnibus adopted in 2026 changed the timeline:

• High-risk systems in Annex III (for example hiring and credit scoring): 2 December 2027.
• Product-embedded high-risk systems (Annex I, for example machinery and medical devices): 2 August 2028.
• The Machinery Regulation moved to the lighter section of Annex I, and the definition of a "safety component" was narrowed.
• Marking of AI-generated content (Article 50): systems placed on the market before 2 August 2026 have until 2 December 2026.
• Mid-sized companies with fewer than 750 employees get SME-style relief.

Which other EU rules apply to companies importing from China?

The AI Act is not alone. If you import a connected, software-based or AI-enabled product, these rules also apply:

• Cyber Resilience Act (CRA): since 11 September 2026, actively exploited vulnerabilities and severe incidents must be reported to the ENISA platform with an early warning within 24 hours and a notification within 72 hours. The main obligations apply from 11 December 2027. If you sell the product under your own brand, you carry the manufacturer's obligations. Fines can reach 2.5% of worldwide turnover.
• General Product Safety Regulation (GPSR): since 13 December 2024, products sold in the EU need a responsible economic operator established in the EU.
• New Product Liability Directive: software and AI count as "products". Member states transpose it by 9 December 2026. If the manufacturer is outside the EU, the importer can be held liable.
• Machinery Regulation: applies from 20 January 2027 and includes new requirements for self-evolving behaviour and safety functions.
• GDPR: there is no EU adequacy decision for China. If a Chinese supplier's app or cloud processes personal data, you need standard contractual clauses and a transfer assessment.

Where does AI regulation stand in China?

China has no single comprehensive AI law, but targeted rules are strictly enforced:

• Interim measures for generative AI services (2023): filing and security assessment for providers serving the public.
• AI content labelling measures and standard GB 45438-2025: since 1 September 2025, visible labels and labels embedded in file metadata are mandatory. Enforcement actions were taken against major apps in April 2026.
• Personal Information Protection Law (PIPL): exporting personal data from China requires a security assessment, standard contract or certification.
• Supreme People's Court opinion of September 2026: fault-based liability for AI-related harm; documentation of training data sources can be decisive in disputes.

What is the situation in the US?

There is no comprehensive federal AI law. An executive order of 11 December 2025 aims at a federal framework against state laws, but as of September 2026 no federal statute preempting state laws has passed.

States apply their own rules: the Colorado AI Act was rewritten and takes effect on 1 January 2027 (with duties such as user notification and meaningful human review). California's transparency law for large models (SB 53) is in force.

What is the situation in Türkiye?

Türkiye has no law that regulates AI comprehensively yet. Bills on topics such as labelling AI content have been submitted to parliament but not enacted.

What applies in practice today:

• KVKK: the data protection authority published its "Generative AI and Personal Data Protection" guide in November 2025. Cross-border transfers follow the standard contract regime introduced in 2024.
• Türkiye AI Action Plan (2026-2030): published in the Official Gazette on 18 August 2026; a policy document for public bodies that takes the EU's risk-based approach into account.
• The EU market: EU rules apply directly to Turkish companies selling products or services in the EU. Because of the Customs Union and CE marking, most manufacturers already work to EU rules in practice.

What should a company sourcing from China do today?

Six steps that work best in practice:

• Clarify your role: for each product, record in writing who is the manufacturer, importer, brand owner and EU responsible person. If you sell under your own brand, you are the manufacturer.
• Build a product inventory: which products contain software, connectivity, a radio module or an AI component?
• Update supplier contracts: include software updates, vulnerability notification (for the CRA's 24 hours), access to the technical file and a description of any AI component.
• Map the data flow: where does data from the product or the supplier's app go? Set up GDPR and KVKK transfer terms accordingly.
• Keep one technical file: store CE, GPSR, CRA and AI Act documents in one place with version control.
• Rehearse incident reporting: register with the ENISA platform and decide in advance who runs the 24- and 72-hour reporting flow.

How does AI automation help with compliance?

Most compliance work is collecting documents, checking for gaps and following up with suppliers. That is exactly what AI agents do well: reading supplier test reports and certificates against a checklist and listing what is missing, drafting follow-up emails, tracking technical file versions, preparing a first draft of an incident report.

The decision and the signature always stay with the responsible person. The agent prepares, a person approves.

What should regulation include, in my view?

Having worked on both the manufacturer and the importer side, I think the rules should move in this direction:

• Traceability along the supply chain: the source, model and version of an AI component in a product should be visible in product documentation and the digital product passport.
• One file, many regulations: shared standards and a single technical file for the AI Act, CRA, Machinery Regulation and GDPR. The Omnibus provision on shared standards is a step in the right direction.
• Proportionality: internal productivity agents that draft and leave the decision to a person should not carry the same burden as systems that affect people's lives or rights.
• Human approval for critical decisions: for hiring, credit, safety and quality release decisions, the final say should explicitly stay with a person.
• Predictable data transfers: clear, workable rules for data flows between the EU, Türkiye and China that SMEs can also use.
• Interoperable labelling: China's visible and embedded labels and the EU's marking rule should be satisfiable with the same technical standard; otherwise the same product needs two separate efforts.
• A single reporting channel: the CRA's single-platform approach should be a model for other markets, Türkiye included.

Sources and note

I compiled this as someone who has prepared CE, FDA and GDPR roadmaps for the EU market and led a quality assurance team in China, with a focus on the supply chain impact. Regulation changes fast; check the official texts and a lawyer's opinion before making decisions.

Sources: Orrick, EU AI Act and the Digital Omnibus (July 2026) · Kirkland & Ellis, The EU Cyber Resilience Act (September 2026) · China Briefing, China AI regulation in 2026 · CASRAI, US federal and state AI rules (2026) · Türkiye'de yapay zekâ kanunu: 2026 durumu