Transatlantic AI Regulatory Split: EU Enforces, UK Guides, US Fragments

The week's regulatory news crystallizes a three-way divergence that law firms with transatlantic practices need to operationalize, not merely monitor. The EU is in an enforcement sprint: GPAI fines activate August 2, Article 50 transparency obligations apply the same day, the AI Cybersecurity Action Plan is live, and the Cloud and AI Development Act (CADA) introduces a four-tier EU sovereignty framework for cloud and AI that will affect data residency decisions for law firm infrastructure. The UK is building guidance infrastructure: the ICO/SRA/LSB AI Growth Lab is the primary regulatory touchpoint, formal legislation is not expected until Spring 2027, and Ofcom's capacity constraints mean enforcement will lag even further. The US operates a patchwork: no federal AI statute, California transparency duties activating in August 2026, Colorado's replacement framework starting January 2027, and 42 state AGs now coordinating on AI consumer protection. For law firm CIOs and general counsel overseeing firm AI governance, TLT's July brief noted explicitly that "a UK-compliant setup no longer automatically works for your EU pipeline" — the practical operationalization of divergence is a documented compliance decision, not an assumption. Firms advising clients on AI deployment across all three jurisdictions face a genuine tripling of compliance track management.