The transatlantic split is hardening into specifics. Brussels finalized its GPAI Code of Practice in late April, with U.S. labs splitting on whether to sign, while a hastily released EU age-verification app was broken by researchers within hours. In Washington, the Trump administration missed March deadlines on its order curbing state AI laws, leaving Colorado's chatbot bill and Maine's data-center moratorium to advance. The Pentagon signed AI deals with eight firms but excluded Anthropic, which is litigating its supply-chain designation after refusing 'any lawful use' terms covering surveillance and autonomous weapons. The open question is whether voluntary codes and contract carve-outs become the actual rulebook.