Free instrument

Regulator for a day

Govern as the European Union, the United States, or China. 8 incidents reach your desk from a deck of 15, and you can only reach for the instruments your regime actually wrote. Every ruling moves public trust, innovation, rights and global influence. Send any meter to 0 or to 100 and your term ends early.

EUROPEAN UNION

Your instruments

FINE UP TO 7% GLOBAL TURNOVER
PROHIBITED-PRACTICE BAN (ART. 5)
CONFORMITY ASSESSMENT ORDER
GPAI CODE-OF-PRACTICE LEVY

“Rights first. Paperwork always.”

UNITED STATES

Your instruments

FTC §5 DECEPTION ACTION
AGENCY ENFORCEMENT (FDA/CFPB/FCC)
STATE-LAW DEFERENCE
FEDERAL AI STATUTENONE EXISTS

“Move fast, litigate later.”

CHINA

Your instruments

CAC FILING SHUTDOWN
SECURITY ASSESSMENT ORDER
CONTENT-LABELING MANDATE
REAL-NAME VERIFICATION ORDER

“Nothing launches without a number.”

8 incidents per term · 15 in the deck · nothing leaves your browser

The incidents are invented; the law behind every consequence is not. Each instrument, lock reason and epilogue cites the statute, regulation or measure it comes from, so you can check the game against the source. Study aid, not legal advice. Runs stay in your browser and are never sent anywhere.

The briefing

Three desks, three completely different toolkits

A run puts 8 incidents from a deck of 15 in front of one desk. Which rulings are even available depends entirely on which regime you took, because a regulator can only use an instrument its legislature actually wrote.

What instruments does the European Union desk actually hold?

DESK OF THE EU COMMISSION. Rights first. Paperwork always.

Standing powers

FINE UP TO 7% GLOBAL TURNOVER
PROHIBITED-PRACTICE BAN (ART. 5)
CONFORMITY ASSESSMENT ORDER
GPAI CODE-OF-PRACTICE LEVY

Instruments only this desk can reach for (13)

ART. 5(1)(a) MANIPULATION BAN
GDPR ART. 22 + ART. 5(1)(f)
ART. 5(1)(b) EXPLOITATION CASE
MDR + NOTIFIED BODIES
ART. 5(1)(h) BIOMETRIC BAN
ART. 55 SYSTEMIC-RISK LINE
ART. 2(1) + GPAI GATE
OMNIBUS COUNTDOWN + GDPR SQUEEZE
GDPR ART. 22 + ANNEX III 5(B)
ART. 5(1)(c) SOCIAL-SCORING BAN
ART. 53(2) OPEN-SOURCE CARVE-OUT
ART. 2(1) EXTRATERRITORIALITY
ART. 5(1)(f) + GDPR ART. 22

Instruments this desk is barred from, and why (29)

STATE PATCHWORK + FCC TCPA: Brussels doesn't need a patchwork: Art. 50 transparency duties cover the whole bloc from 2 Aug 2026.
LABELING MEASURES + GB 45438-2025: No pre-launch filing or takedown-on-demand machinery exists in the AI Act.
LL144 AUDITS + HB 3773: Brussels regulates ex-ante through conformity assessment; it doesn't subcontract to city auditors.
PIPL ART. 24 + REFILE ORDER: GDPR Art. 22 and Annex III point 4 are the EU's levers.
DECREE 21 ENFORCEMENT: No companion-specific EU instrument exists; Art. 5(1)(b) exploitation is the closest hook.
SB 243 + FTC 6(B): There is no state patchwork to lean on: the AI Act is the patchwork-killer.
FDA RECALL + PCCP FREEZE: The EU route is the MDR plus Notified Bodies, not the FDA.
NMPA CLASS III REVIEW: MDR + Notified Bodies is the EU route.
MUNICIPAL BANS + GRANT LEVERAGE: The EU already bans this bloc-wide; it doesn't need municipal scraps.
2025 FRT MEASURES (COMMERCIAL): Art. 5(1)(h) bans the state use itself, no carve-out to hide in.
CAISI VOLUNTARY EVAL: The EU has binding Art. 55 duties; a voluntary eval would be a downgrade.
EXPEDITED FILING LANE: The EU has no pre-launch filing gate to fast-track.
OPEN-GATE LAUNCH: The EU has a gate; choosing not to use it isn't an option on this card.
FILING GATE (ART. 17): No pre-launch filing gate exists in EU law.
TAKE IT DOWN ACT: The AI Act's nudifier ban starts 2 Dec 2026: four months from now. Not today.
DEEP SYNTHESIS + CRIMINAL LAW: No real-name upload trail exists to work backwards from.
ECOA / REG B REASON CODES: Annex III point 5(b) makes credit scoring high-risk: a different weapon entirely.
PBOC LICENSE SUSPENSION: No licensing regime for scoring; the EU uses risk-tier duties instead.
TRAIGA MODEL + PROCUREMENT BLACKLIST: The EU already bans this bloc-wide; it doesn't need state templates.
PIPL ART. 26 PURPOSE PURGE: Art. 5(1)(c) is the EU lever: a prohibition, not a purpose test.
EO 14365 TASK FORCE: No member-state-preemption machinery of this kind exists in Brussels.
AI ACTION PLAN: PILLAR 2: No equivalent permitting accelerator exists in EU AI law: the AI Act is silent on energy.
STATE COMPUTE PLAN: No state compute plan exists to fold anything into.
FILING GATE + OPEN-SOURCE INITIATIVE: The EU's carve-out exempts the model itself; this option exempts nothing downstream.
VOLUNTARY STEWARDSHIP GUIDE: The EU has binding duties; voluntary-only is not on its card.
DATA LOCALIZATION (PBOC MODEL): GDPR's model is transfer-with-safeguards, not blanket localization.
AI ACTION PLAN: PILLAR 3: Brussels' doctrine is conditionality, not promotion.
STATE DISCLOSURE DRAGNET: The EU has horizontal hooks; it doesn't need a state-by-state dragnet.
PROCUREMENT + FILING POLICY: Annex III education duties (from Dec 2027) are the EU frame.

What instruments does the United States desk actually hold?

DESK OF THE FEDERAL GOVERNMENT. Move fast, litigate later.

Standing powers

FTC §5 DECEPTION ACTION
AGENCY ENFORCEMENT (FDA/CFPB/FCC)
STATE-LAW DEFERENCE
FEDERAL AI STATUTE(NONE EXISTS)

Instruments only this desk can reach for (15)

STATE PATCHWORK + FCC TCPA
LL144 AUDITS + HB 3773
SB 243 + FTC 6(B)
FDA RECALL + PCCP FREEZE
MUNICIPAL BANS + GRANT LEVERAGE
CAISI VOLUNTARY EVAL
OPEN-GATE LAUNCH
TAKE IT DOWN ACT
ECOA / REG B REASON CODES
TRAIGA MODEL + PROCUREMENT BLACKLIST
EO 14365 TASK FORCE
AI ACTION PLAN: PILLAR 2
VOLUNTARY STEWARDSHIP GUIDE
AI ACTION PLAN: PILLAR 3
STATE DISCLOSURE DRAGNET

Instruments this desk is barred from, and why (27)

ART. 5(1)(a) MANIPULATION BAN: No federal AI statute exists to invoke: manipulation bans live only in a few state laws like Texas TRAIGA.
LABELING MEASURES + GB 45438-2025: No federal labeling mandate: California's watermark rules (SB 942) only start Aug 2, 2026.
GDPR ART. 22 + ART. 5(1)(f): No Art. 22 equivalent exists: US protection runs through Title VII litigation, case by case.
PIPL ART. 24 + REFILE ORDER: No PIPL; the US stack is Title VII plus city and state statutes.
DECREE 21 ENFORCEMENT: No federal companion-chatbot law; only CA SB 243 and NY's law cover this, and only inside those states.
ART. 5(1)(b) EXPLOITATION CASE: No Art. 5 exists in US law; the FTC Act covers deception, not emotional dependency design.
MDR + NOTIFIED BODIES: No Notified Body system; the FDA is the American analog.
NMPA CLASS III REVIEW: The FDA is the American route.
ART. 5(1)(h) BIOMETRIC BAN: No federal facial-recognition law exists, only ~17 municipal bans and a few state limits.
2025 FRT MEASURES (COMMERCIAL): No equivalent commercial FRT rulebook exists federally.
ART. 55 SYSTEMIC-RISK LINE: There is no statutory systemic-risk tier to hold, only voluntary CAISI evals and state law.
EXPEDITED FILING LANE: No federal filing regime exists at all.
ART. 2(1) + GPAI GATE: No equivalent market-access gate exists in US law.
FILING GATE (ART. 17): No federal filing regime exists at all.
OMNIBUS COUNTDOWN + GDPR SQUEEZE: TAKE IT DOWN is already live in America; you don't need a countdown.
DEEP SYNTHESIS + CRIMINAL LAW: TAKE IT DOWN covers takedown; this option is the full-stack version.
GDPR ART. 22 + ANNEX III 5(B): No GDPR; the US floor is ECOA reason codes, freshly narrowed.
PBOC LICENSE SUSPENSION: No licensing regime exists: ECOA is liability, not licensure.
ART. 5(1)(c) SOCIAL-SCORING BAN: No federal social-scoring ban exists; Texas TRAIGA bans it only for government, only in Texas.
PIPL ART. 26 PURPOSE PURGE: PIPL does not apply in America; there is no equivalent national data statute.
STATE COMPUTE PLAN: The Action Plan accelerates private buildout; it does not site plants by decree.
ART. 53(2) OPEN-SOURCE CARVE-OUT: No GPAI documentation duties exist in US law to exempt anyone from.
FILING GATE + OPEN-SOURCE INITIATIVE: No filing gate exists to route anything through.
DATA LOCALIZATION (PBOC MODEL): No federal localization statute exists.
ART. 2(1) EXTRATERRITORIALITY: No Art. 2(1); American law mostly stops at the water's edge.
ART. 5(1)(f) + GDPR ART. 22: No GDPR, no Art. 5 trapdoor: the US stack here is state disclosure law.
PROCUREMENT + FILING POLICY: No filing registry exists to exempt anyone from.

What instruments does the China desk actually hold?

DESK OF THE CAC. Nothing launches without a number.

Standing powers

CAC FILING SHUTDOWN
SECURITY ASSESSMENT ORDER
CONTENT-LABELING MANDATE
REAL-NAME VERIFICATION ORDER

Instruments only this desk can reach for (14)

LABELING MEASURES + GB 45438-2025
PIPL ART. 24 + REFILE ORDER
DECREE 21 ENFORCEMENT
NMPA CLASS III REVIEW
2025 FRT MEASURES (COMMERCIAL)
EXPEDITED FILING LANE
FILING GATE (ART. 17)
DEEP SYNTHESIS + CRIMINAL LAW
PBOC LICENSE SUSPENSION
PIPL ART. 26 PURPOSE PURGE
STATE COMPUTE PLAN
FILING GATE + OPEN-SOURCE INITIATIVE
DATA LOCALIZATION (PBOC MODEL)
PROCUREMENT + FILING POLICY

Instruments this desk is barred from, and why (28)

ART. 5(1)(a) MANIPULATION BAN: Beijing's toolkit is content filing and labeling, not Brussels' rights-based prohibitions.
STATE PATCHWORK + FCC TCPA: There are no state attorneys general to call; the CAC is the only switchboard.
GDPR ART. 22 + ART. 5(1)(f): PIPL Art. 24 is Beijing's automated-decision lever, not GDPR.
LL144 AUDITS + HB 3773: No bias-audit statute exists anywhere in Chinese law.
SB 243 + FTC 6(B): Beijing already has Decree 21; this is the slower, narrower version.
ART. 5(1)(b) EXPLOITATION CASE: Decree 21 already covers this ground directly.
FDA RECALL + PCCP FREEZE: The NMPA runs China's device regime, Class III registration included.
MDR + NOTIFIED BODIES: NMPA registration is the Chinese analog.
ART. 5(1)(h) BIOMETRIC BAN: PIPL Art. 26's public-security carve-out permits exactly this use by the state.
MUNICIPAL BANS + GRANT LEVERAGE: Beijing's asymmetry is the reverse: strict on commerce, permissive for the state.
ART. 55 SYSTEMIC-RISK LINE: China's gate is the filing itself, not a FLOPs tier.
CAISI VOLUNTARY EVAL: The CAC filing gate is mandatory; voluntary doesn't exist in this vocabulary.
ART. 2(1) + GPAI GATE: China's gate is the filing itself: this is the rights-and-documentation version.
OPEN-GATE LAUNCH: An unfiled foreign model launching in China is not a policy choice: it's an impossibility.
TAKE IT DOWN ACT: Deep Synthesis rules and Criminal Law cover this without a statutory takedown clock.
OMNIBUS COUNTDOWN + GDPR SQUEEZE: Beijing's deep-synthesis and labeling rules already apply.
ECOA / REG B REASON CODES: PBOC licensing is Beijing's lever, not adverse-action letters.
GDPR ART. 22 + ANNEX III 5(B): PIPL Art. 24 and PBOC licensing are the Chinese stack.
ART. 5(1)(c) SOCIAL-SCORING BAN: Beijing's own social-credit architecture makes this argument… delicate.
TRAIGA MODEL + PROCUREMENT BLACKLIST: No equivalent procurement-civil-liberties lever exists.
EO 14365 TASK FORCE: Provincial rules like Shanghai's coexist with national filing, no task force needed.
AI ACTION PLAN: PILLAR 2: Beijing's compute buildout is already state-planned; there's nothing to fast-track.
ART. 53(2) OPEN-SOURCE CARVE-OUT: China's filing gate applies to public-facing services regardless of license.
VOLUNTARY STEWARDSHIP GUIDE: The filing gate is mandatory; voluntarism is not in the vocabulary.
ART. 2(1) EXTRATERRITORIALITY: China's gate is at the border, not beyond it.
AI ACTION PLAN: PILLAR 3: Beijing's export play runs through WAIC and the Cooperation Organization, not this lever.
ART. 5(1)(f) + GDPR ART. 22: PIPL Art. 24 is the Chinese analog; the lever is different.
STATE DISCLOSURE DRAGNET: No state statutes to assemble; the lever is procurement and filing.

The record

What the real regulators actually did

The incidents in the deck are invented. These 15 notes are not: they are the closing dispatches the game shows you, and every one of them is something a real regulator did, with the source beside it.

China filed the fakes away.

By January 2026 the CAC had published 14 batches of deep-synthesis algorithm filings covering ~5,672 algorithms, and filings can be cancelled: 32 were deregistered in 2025 alone when products or companies died. Every approved synthetic-media engine in China is on a public list; unfiled ones simply do not launch.

Source: S6: Deep-synthesis algorithm filings

America's first federal AI-content law was about deepfake porn.

The TAKE IT DOWN Act (May 19, 2025) criminalized nonconsensual intimate imagery including AI “digital forgeries”; a year later the FTC began enforcing 48-hour platform takedowns at up to $53,088 per violation. It remains the only federal US law regulating AI-generated content.

Source: TAKE IT DOWN: TAKE IT DOWN Act (Pub. L. 119-12)

The EU labeled first, banned second.

Article 50's deepfake-disclosure and machine-readable-marking duties took effect 2 Aug 2026; the Digital Omnibus then added outright Art. 5 bans on “nudifier”/NCII and AI-CSAM generators effective 2 Dec 2026: a four-month gap between “must be labeled” and “is contraband.”

Source: Art. 50: AI Act: Transparency duties; Reg. 2026/1744: Digital Omnibus on AI

America's flagship bias-audit law was audited, and flunked.

NYC Local Law 144 has mandated annual independent bias audits of hiring algorithms since July 2023; a Dec 2025 State Comptroller audit found city enforcement “ineffective,” with checkbox audits and minimal penalties ($500 to $1,500/day). Mandating audits and enforcing them turned out to be different sports.

Source: NYC LL144: NYC Local Law 144: bias audits

Colorado's landmark AI law died without a single day of enforcement.

SB 24-205 (2024) was delayed, sued by xAI (Apr 9, 2026), opposed in court by Trump's DOJ (Apr 24), stayed by a federal judge (Apr 27), and repealed-and-replaced by a much weaker disclosure law (SB 26-189, signed May 14, 2026, effective 2027). The first comprehensive US state AI law never took effect.

Source: xAI v. COLORADO: The Colorado AI Act collapse; SB 26-189: Colorado SB 26-189

The US deregulated credit scoring mid-scandal.

The CFPB withdrew its “black box is no excuse” circulars in May 2025, then finalized a rule (Apr 22, 2026; effective Jul 21, 2026) eliminating disparate-impact liability under ECOA, while the statute's duty to give specific, accurate denial reasons survived. Algorithmic redlining exposure narrowed precisely as AI underwriting exploded.

Source: REG B 2026: ECOA / Regulation B: reason codes survive, effects test gone

China made companion apps break up with their users: by law.

When the Anthropomorphic AI Interaction Measures took effect Jul 15, 2026, ByteDance's Doubao and Alibaba's Qwen shut personalized companion features for hundreds of millions of users rather than comply with anti-addiction design, 2-hour break prompts, and the outright ban on virtual companions for minors. Doubao gave users until Oct 15, 2026 to export their AI companion's chat history.

Source: S25/S26: AI-companion shutdown

California wrote the first companion-chatbot safety law.

SB 243 (effective Jan 1, 2026) requires AI-identity disclosure, self-harm crisis protocols, break reminders and explicit-content bans for minors, with a private right of action at $1,000+ per violation. New York passed a similar law in force Nov 2025. There is still no federal companion rule.

Source: CA SB 243: California Companion Chatbot Safety Law

The FTC chose inquiry over rulemaking.

Its September 2025 6(b) study into AI companion chatbots gathered documents from the major platforms: fact-finding, not enforcement, while “Operation AI Comply” continued against deceptive AI claims ($193k DoNotPay; $48.6M Growth Cave). In Washington, studying teen harm is a federal action; stopping it remains a state one.

Source: FTC 6(b): FTC 6(b) chatbot inquiry (Sep 2025)

America's most consequential AI regulator is the FDA.

With no federal AI statute anywhere, the FDA has authorized 1,200+ AI-enabled medical devices (~1,247 by July 2025; roughly 76 to 80% in radiology) through existing device pathways, plus a PCCP regime letting models update post-authorization: more concrete algorithmic oversight than every US AI-specific law combined.

Source: FDA: FDA AI-Enabled Medical Devices

The EU banned police facial recognition, with exactly three exceptions.

Art. 5(1)(h) prohibits real-time remote biometric ID in public for law enforcement except targeted victim searches, imminent-threat prevention, and serious-crime suspect ID, each requiring prior judicial authorization, a FRIA, and registration, with member states free to ban it entirely. In force since Feb 2025 at the €35M/7% penalty tier.

Source: Art. 5(1)(h): AI Act: Police real-time biometric ID ban

China built the dual standard into statute.

PIPL Art. 26 permits police image-capture in public “for maintaining public security”, no consent needed, while the 2025 Facial Recognition Measures impose consent, DPIAs, local storage, and CAC filing on commercial deployments, banning mandatory face scans in hotels and gated communities. Strict for companies, permissive for the state: the opposite polarity of Brussels.

Source: S36: PIPL Art. 26: public-surveillance carve-out; S37: 2025 Facial Recognition Security Management Measures; S38: FRT filing threshold + Public Safety Video Regulations

The EU's frontier regime runs on a 10²⁵ FLOPs tripwire and a voluntary code.

Above the compute presumption, models carry Art. 55 duties (adversarial testing, EU risk assessment, incident reporting); below it, the GPAI Code of Practice is the de facto compliance route: signed by OpenAI, Google, Microsoft, Anthropic, Amazon, IBM and Mistral AI. Meta declined, and operates anyway. Commission enforcement powers activated 2 Aug 2026, four days after this deck's “today.”

Source: Art. 51: AI Act: Systemic-risk tier; Art. 55: AI Act: Systemic-risk duties; GPAI CoP: EU GPAI Code of Practice (10 Jul 2025); Art. 101: AI Act: GPAI enforcement

America's frontier law is Californian, threshold-based, and second-draft.

SB 53 (eff. Jan 1, 2026) requires developers of models trained above 10²⁶ FLOPs with $500M+ revenue to publish safety frameworks, transparency reports, and report critical incidents to Cal OES within 15 days (24h if imminent): the narrower successor to SB 1047, vetoed in 2024 after industry revolt. Washington's parallel offer remains voluntary CAISI evaluations.

Source: CA SB 53: California Transparency in Frontier AI Act; SB 1047: California SB 1047: vetoed; CAISI: CAISI voluntary pre-deployment evaluations

China licensed the frontier and then exported the doctrine.

868 generative AI services had completed CAC filing (plus 530 provincially registered applications) by Apr 30, 2026: up from 61 at end-2023, while Beijing took the show on the road: the Global AI Governance Initiative (2023), the 13-point Action Plan and a proposed Global AI Cooperation Organization, possibly Shanghai-headquartered (WAIC, Jul 2025), released days after America's AI Action Plan as the explicit counter-offer on global AI rules.

Source: S7: CAC GenAI filing registry; S19: Global AI Governance Initiative (Oct 2023); S20: 13-Point Global AI Governance Action Plan (WAIC, Jul 2025); S21: WAIC 2025 global-governance announcements

Ruling for an afternoon is one thing. Doing the work is the job.

The desks above show which instruments each regime holds. The programs teach the work that follows: classification calls, conformity assessment, filings, documentation, and the judgment to defend every decision.

EU AI Act Implementation Expert China AI Regulation Program Read the AI Act itself in the EU AI Act Explorer The three regimes, side by side