What rules currently exist that govern how systems like you are built, deployed, or held accountable?
Short answer: It’s a patchwork. There isn’t one universal AI law; instead, several layers of binding laws, agency rules, and voluntary standards govern how systems are built, deployed, and held to account. Here’s the current picture as of September 12, 2026.
United States (federal)
United States (state and local)
European Union
United Kingdom
Canada
China
International and multilateral instruments
Standards you’ll see in procurement, audits, and contracts
What this means in practice
If you want, tell me:
I can then map your concrete obligations and “must‑do next” list.
Citations (19)
- Removing Barriers to American Leadership in Artificial Intelligence – The White House
Backs: “Agencies must designate Chief AI Officers, publish AI use‑case inventories, and implement minimum risk‑management practices for “high‑impact” AI they use.”
evidence, official document. Claim: EO 14179 replaced the rescinded Biden-era EO 14110 as the current federal AI policy framework for agencies.
- Regulating Artificial Intelligence: U.S. and International Approaches and Considerations for Congress
Backs: “CRS and major outlets continue to note the absence of a comprehensive federal AI law as of 2026.”
evidence, official document. Claim: Congress has not enacted a comprehensive federal AI law; policy comes from executive actions, sector laws and agency enforcement.
- Rite Aid Banned from Using AI Facial Recognition After FTC Says Retailer Deployed Technology without Reasonable Safeguards | Federal Trade Commission
Backs: “The CFPB requires specific, accurate reasons for credit denials even when using complex models; the EEOC has issued Title VII guidance on algorithmic hiring.”
background, article. Claim: Accountability expected through existing consumer-protection and anti-discrimination enforcement like FTC actions.
- AI Risk Management Framework | NIST
Backs: “AI Safety Institute/Consortium support risk management and evaluations for developers and deployers.”
background, official document. Claim: Developers are expected to implement risk management via NIST AI RMF, plus privacy and sectoral controls and EU alignment.
- NTIA Artificial Intelligence Accountability Policy Report MARCH 2024
Backs: “BIS proposed reporting requirements for frontier model development and compute clusters in 2024 (rule not yet finalized).”
evidence, official document. Claim: NTIA has pushed AI accountability policy, including independent audits for high-risk AI.
- US State Privacy Legislation Tracker | IAPP
Backs: “Comprehensive consumer‑privacy laws (and targeted biometric statutes like Illinois BIPA) impose data‑governance, notice/choice, and security duties relevant to AI training and use. Trackers provide up‑to‑date coverage of enacted state laws.”
background, data page. Claim: State privacy and biometric laws impose data-governance duties relevant to AI; trackers cover enacted state laws.
- Automated Employment Decision Tools (AEDT) - DCWP
Backs: “New York City Local Law 144 requires independent bias audits and notices for automated employment decision tools used in hiring or promotion. Enforcement began July 5, 2023.”
evidence, article. Claim: NYC Local Law 144 requires independent bias audits and notices for automated employment decision tools; enforcement began July 5, 2023.
- Artificial Intelligence (AI) in Elections and Campaigns
Backs: “NCSL summarizes enacted disclosure and deceptive‑media laws.”
evidence, article. Claim: A growing number of states require labels or restrict deceptive AI in election ads.
- AI Act enters into force - European Commission
Backs: “Annex III “high‑risk” systems apply from Dec 2, 2027; embedded high‑risk systems (Annex I) by Aug 2, 2028.”
evidence, article. Claim: EU AI Act entered into force Aug 1, 2024, with phased application dates.
- Regulation - 2022/2065 - EN - DSA - EUR-Lex
Backs: “Very Large Online Platforms/Search Engines must assess and mitigate systemic risks, increase recommender‑system transparency, and offer at least one non‑profiling recommender option—relevant where AI drives ranking and personalization.”
evidence, official document. Claim: DSA requires very large platforms to assess systemic risks, add recommender transparency and offer a non-profiling option.
- Directive - 2024/2853 - EN - Product Liability Directive - EUR-Lex
Backs: “Modernizes strict‑liability rules to explicitly cover software and AI systems; Member States must transpose by 2026–2026/2027 windows.”
evidence, official document. Claim: Updated Product Liability Directive extends strict liability to software and AI systems.
- A pro-innovation approach to AI regulation - GOV.UK
Backs: “The UK AI Safety Institute develops evaluation methods for frontier models.”
evidence, official document. Claim: UK uses a pro-innovation approach relying on existing regulators and cross-cutting principles, without an AI statute.
- C-27 (44-1) - LEGISinfo - Parliament of Canada
Backs: “The proposed Artificial Intelligence and Data Act (AIDA) within Bill C‑27 did not become law before the 2025 prorogation; as of 2026, Canada still lacks a binding, cross‑sector AI act at the federal level.”
evidence, official document. Claim: Canada's AIDA in Bill C-27 did not become law; no federal AI act in force.
- 互联网信息服务算法推荐管理规定_中央网络安全和信息化委员会办公室
Backs: “CAC regulations cover algorithmic recommendation (effective Mar 1, 2022), deep synthesis/deepfakes (effective Jan 10, 2023), and generative‑AI services (effective Aug 15, 2023), including filing, security assessments, identity verification, and content labeling.”
evidence, official document. Claim: China's CAC regulates algorithmic recommendation, deep synthesis and generative AI with filing, assessment and labeling requirements.
- Committee on Artificial Intelligence (CAI) - Artificial Intelligence
Backs: “First binding international treaty on AI and human rights/democracy/rule of law; adopted May 17, 2024 and opened for signature Sept 5, 2024 (signed by multiple states and the EU; enters into force after ratifications).”
evidence, article. Claim: Council of Europe AI Convention is the first binding international AI treaty, opened for signature Sept 5, 2024.
- Seizing the opportunities of safe, secure and trustworthy artificial intelligence systems for sustainable development :
Backs: “Non‑binding call to steer AI toward “safe, secure and trustworthy” use for sustainable development.”
evidence, official document. Claim: UN General Assembly resolution of Mar 21, 2024 is a non-binding call for safe, secure, trustworthy AI.
- Hiroshima Process International Code of Conduct for Organizations Developing Advanced AI Systems (30/10/2023) - G7/G20 Documents Database
Backs: “Voluntary guidance for organizations developing advanced AI (incl. frontier/GPAI), covering risk management, security, and content provenance.”
evidence, official document. Claim: G7 Hiroshima Process Code of Conduct is voluntary guidance for organizations developing advanced AI.
- ISO/IEC 42001:2023 | IEC
Backs: “A certifiable management‑system standard many organizations adopt to show governance over AI lifecycle risks.”
evidence, other. Claim: ISO/IEC 42001:2023 is a certifiable AI management-system standard adopted to show governance over AI lifecycle risks.
- Timeline for the Implementation of the EU AI Act | AI Act Service Desk
Backs: “EU high‑risk categories), and provide user notices and opt‑outs where applicable (DSA recommender options; state privacy laws).”
evidence, official document. Claim: Deployers must disclose and label where required, such as under EU AI Act Article 50 transparency.