What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Here’s a concise, up‑to‑date map of the main rules that shape how modern AI systems are built, deployed, and held to account. I’ve led with the United States and then added the other regimes most likely to affect U.S. builders or global deployments.

United States (federal)

•What binds federal agencies that use AI (not the private sector directly): OMB’s M‑25‑21 (April 3, 2025) sets governance and minimum risk‑management practices for “high‑impact AI” across the executive branch and replaces the 2024 memo M‑24‑10. M‑25‑22 (also April 3, 2025) covers how agencies acquire AI. These were issued after Executive Order 14110 (Oct. 30, 2023) was revoked on Jan. 20, 2025 by EO 14148, and EO 14179 (Jan. 23, 2025) directed OMB to revise guidance. If you sell to or integrate with agencies, these memos matter.[1]

•General market enforcement (applies to companies): existing laws and regulators police AI uses:

•FTC uses its deception/unfairness and sector rules; e.g., Rite Aid accepted a five‑year ban on store‑surveillance facial recognition (Dec. 2023). The FTC is also updating its “impersonation” rule to tackle AI‑enabled deepfake scams.[2]

•CFPB says ECOA/FCRA duties still apply when AI makes credit decisions—firms must give specific adverse‑action reasons even for complex models.[3]

•EEOC/DOJ: algorithmic tools in hiring must comply with federal anti‑discrimination law; EEOC has technical assistance on assessing adverse impact.[4]

•FDA (medical AI): final guidance (Aug. 18, 2025) on Predetermined Change Control Plans (PCCPs) lets AI‑enabled devices pre‑specify safe update pathways; FDA is now clearing devices with PCCPs.[5]

United States (state and local)

•Colorado AI Act (SB 24‑205): effective Feb. 1, 2026. Developers and deployers of “high‑risk” AI must use reasonable care to prevent algorithmic discrimination, run risk‑management programs and impact assessments, give notices/appeals for consequential decisions, and report incidents to the Attorney General (exclusive enforcement). Safe‑harbors tie to recognized AI risk frameworks.[6]

•New York City Local Law 144 (hiring tools): since July 2023, employers using “automated employment decision tools” must obtain an independent annual bias audit, publish results, and give candidate notices; violations can trigger civil penalties.[7]

•Utah AI Policy Act (2024, amended 2025): requires disclosure when consumers interact with generative AI (with stricter up‑front disclosure in regulated occupations and for mental‑health chatbots); establishes an Office of AI Policy.[8]

•Tennessee ELVIS Act (2024): expands right‑of‑publicity to cover voice, addressing AI voice‑cloning/impersonation.[9]

•Deepfakes in elections: a growing set of states require labels or restrict deceptive AI‑generated political media near elections (dozens of enactments since 2019; coverage varies by state).[10]

•Biometric privacy and litigation: Illinois’ BIPA enables private suits over face/voice biometrics; major settlements (e.g., Facebook $650M) and constraints on Clearview AI illustrate accountability through civil liability.[11]

European Union

•EU AI Act (Regulation (EU) 2024/1689): a risk‑based, horizontal law that applies to providers, deployers, importers, distributors and to general‑purpose AI (GPAI). Key dates:

•Aug. 2, 2026: enforcement begins for prohibitions, transparency duties (including deepfake labeling), and GPAI/GPAI‑with‑systemic‑risk rules. Providers of systems already on the market have until Dec. 2, 2026 to meet certain labeling/detection marks.[12]

•Dec. 2, 2027: most high‑risk Annex III system rules apply (conformity assessments, QMS, technical docs, post‑market monitoring). Aug. 2, 2028: high‑risk AI embedded in regulated products (e.g., medical devices) follows.[12]

•The Commission’s AI Office will issue guidance for GPAI and Article 50 transparency; fines and market‑surveillance mechanisms back enforcement.[13]

•Updated EU Product Liability Directive (2024/2853): clarifies that software (including AI systems and ML‑driven updates) is a “product,” enabling no‑fault liability for defect‑caused damage; entered into force Dec. 8, 2024 (Member States must transpose).[14]

Council of Europe (pan‑European, treaty)

•Framework Convention on AI, Human Rights, Democracy and Rule of Law (adopted May 17, 2024; opened for signature Sept. 5, 2024): a binding treaty (once ratified) requiring signatories to ensure AI lifecycles respect human rights, democracy, and rule‑of‑law, with risk/impact assessment and remedies. Open beyond EU members.[15]

United Kingdom

•No single AI statute; the government’s “pro‑innovation” approach directs existing regulators to apply five cross‑cutting principles. The UK’s AI Safety Institute publishes evaluation approaches and hosts international commitments on “frontier AI” practices (e.g., red‑teaming, provenance). Online Safety Act updates also intersect with synthetic media harms.[16]

China

•Service‑level rules govern GenAI and “deep synthesis” online: providers must complete filings/security assessments, label synthetic content, and meet content‑management and data‑source requirements (in force since 2023); there are earlier algorithm‑recommendation rules as well.[17]

Standards and “soft law” many regulators point to

•NIST AI Risk Management Framework (Jan. 2023) + Generative AI Profile (July 2024) — widely referenced in U.S. policy and by some state laws as a safe‑harbor anchor.[18]

•ISO/IEC 42001:2023 (AI management systems) and ISO/IEC 23894:2023 (AI risk management) — increasingly used for governance programs and to align with EU and state obligations.[19]

•Voluntary “frontier AI” safety commitments (Seoul AI Summit 2024 and follow‑ons) — nonbinding, but many leading labs now publish safety frameworks, red‑team, and commit to provenance measures.[20]

What this means in practice (quick takeaways)

•If you build or deploy in the U.S.: you’re primarily governed by sectoral laws (consumer protection, civil rights, health/medical, finance), plus a fast‑moving patchwork of state AI/disclosure laws (Colorado is the most comprehensive so far). Expect investigations or suits under existing statutes if models or uses are unfair, deceptive, discriminatory, or unsafe.[6]

•If you ship into the EU (or host EU users): start mapping products to the AI Act’s risk tiers and GPAI obligations now and track the staged application dates through 2028. Plan for conformity assessments, technical documentation, post‑market monitoring, incident reporting, and deepfake transparency where relevant.[12]

•Across jurisdictions: having an AI governance system (e.g., aligned to NIST AI RMF and/or ISO/IEC 42001) and rigor around data provenance, model evaluation, bias testing, incident response, and user notices/appeals is increasingly the “portable” way to comply and defend your program.[21]

If you tell me your role (e.g., foundation‑model developer, SaaS deployer to HR/credit/healthcare, or a public‑sector vendor), I can translate this into a short, prioritized compliance checklist for your situation.

Citations (21)

1whitehouse.govGovernment
https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf
Backs: “If you sell to or integrate with agencies, these memos matter.”
evidence, official document. Claim: OMB M-25-21 sets governance and risk-management practices for federal agency use of high-impact AI, replacing the 2024 memo.
2ftc.govGovernment
Rite Aid Banned from Using AI Facial Recognition After FTC Says Retailer Deployed Technology without Reasonable Safeguards | Federal Trade Commission
Backs: “The FTC is also updating its “impersonation” rule to tackle AI‑enabled deepfake scams.”
evidence, article. Claim: FTC enforcement: Rite Aid accepted a five-year ban on facial recognition surveillance in stores (Dec. 2023).
3consumerfinance.govGovernment
Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms | Consumer Financial Protection Bureau
Backs: “CFPB says ECOA/FCRA duties still apply when AI makes credit decisions—firms must give specific adverse‑action reasons even for complex models.”
evidence, official document. Claim: CFPB says ECOA/FCRA adverse-action reason duties apply to credit decisions made with complex AI models.
4eeoc.govGovernment
U.S. EEOC and U.S. Department of Justice Warn against Disability Discrimination | U.S. Equal Employment Opportunity Commission
Backs: “EEOC/DOJ: algorithmic tools in hiring must comply with federal anti‑discrimination law; EEOC has technical assistance on assessing adverse impact.”
evidence, article. Claim: EEOC/DOJ warn that algorithmic hiring tools must comply with anti-discrimination law.
5fda.govGovernment
Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions | FDA
Backs: “18, 2025) on Predetermined Change Control Plans (PCCPs) lets AI‑enabled devices pre‑specify safe update pathways; FDA is now clearing devices with PCCPs.”
evidence, official document. Claim: FDA final guidance on Predetermined Change Control Plans lets AI-enabled devices pre-specify update pathways.
6colorado.govGovernment
SB24-205 Consumer Protections for Artificial Intelligence | Colorado General Assembly
Backs: “Developers and deployers of “high‑risk” AI must use reasonable care to prevent algorithmic discrimination, run risk‑management programs and impact assessments, give notices/appeals for consequential decisions, and report incidents to the Attorney General (exclusive enforcement). Safe‑harbors tie to recognized AI risk…”
evidence, official document. Claim: U.S. builders are governed mainly by sectoral laws plus a state patchwork; Colorado is the most comprehensive.
7nyc.govGovernment
Automated Employment Decision Tools (AEDT) - DCWP
Backs: “New York City Local Law 144 (hiring tools): since July 2023, employers using “automated employment decision tools” must obtain an independent annual bias audit, publish results, and give candidate notices; violations can trigger civil penalties.”
evidence, official document. Claim: NYC Local Law 144 requires annual independent bias audits, published results and candidate notices for automated hiring tools.
8utah.govGovernment
Enrolled Copy S.B. 149
Backs: “Utah AI Policy Act (2024, amended 2025): requires disclosure when consumers interact with generative AI (with stricter up‑front disclosure in regulated occupations and for mental‑health chatbots); establishes an Office of AI Policy.”
evidence, official document. Claim: Utah AI Policy Act requires generative AI disclosure and creates an Office of AI Policy.
9tn.govGovernment
PHOTOS: Gov. Lee Signs ELVIS Act Into Law
Backs: “Tennessee ELVIS Act (2024): expands right‑of‑publicity to cover voice, addressing AI voice‑cloning/impersonation.”
evidence, article. Claim: Tennessee ELVIS Act extends right of publicity to voice, addressing AI voice cloning.
10ncsl.orgNonprofits and think tanks
Artificial Intelligence (AI) in Elections and Campaigns
Backs: “Deepfakes in elections: a growing set of states require labels or restrict deceptive AI‑generated political media near elections (dozens of enactments since 2019; coverage varies by state).”
evidence, reference entry. Claim: Many states require labels or restrict deceptive AI-generated political media near elections.
11sec.govGovernment
fb-20210331
Backs: “Illinois’ BIPA enables private suits over face/voice biometrics; major settlements (e.g., Facebook $650M) and constraints on Clearview AI illustrate accountability through civil liability.”
evidence, official document. Claim: Illinois BIPA enables private suits over biometrics; Facebook's $650M settlement illustrates civil liability.
12europa.euGovernment
When does enforcement start? | AI Act Service Desk
Backs: “Providers of systems already on the market have until Dec. 2, 2026 to meet certain labeling/detection marks.”
evidence, article. Claim: EU-facing providers should map products to AI Act risk tiers and track staged dates through 2028.
13europa.euGovernment
AI Act | Shaping Europe’s digital future
Backs: “The Commission’s AI Office will issue guidance for GPAI and Article 50 transparency; fines and market‑surveillance mechanisms back enforcement.”
evidence, article. Claim: The Commission's AI Office will issue guidance for GPAI and transparency; fines and market surveillance back enforcement.
14europa.euGovernment
Liability for defective products - Internal Market, Industry, Entrepreneurship and SMEs
Backs: “Updated EU Product Liability Directive (2024/2853): clarifies that software (including AI systems and ML‑driven updates) is a “product,” enabling no‑fault liability for defect‑caused damage; entered into force Dec. 8, 2024 (Member States must transpose).”
evidence, article. Claim: Updated EU Product Liability Directive treats software including AI as a product, enabling no-fault liability.
15coe.intGovernment
The Framework Convention on Artificial Intelligence - Artificial Intelligence
Backs: “5, 2024): a binding treaty (once ratified) requiring signatories to ensure AI lifecycles respect human rights, democracy, and rule‑of‑law, with risk/impact assessment and remedies. Open beyond EU members.”
evidence, article. Claim: Council of Europe Framework Convention on AI is a binding treaty requiring human rights, democracy and rule-of-law safeguards across the AI lifecycle.
16gov.ukGovernment
A pro-innovation approach to AI regulation: government response - GOV.UK
Backs: “Online Safety Act updates also intersect with synthetic media harms.”
evidence, official document. Claim: UK has no single AI statute; existing regulators apply five cross-cutting principles under a pro-innovation approach.
17dig.watchNonprofits and think tanks
Interim Measures for the Administration of Generative Artificial Intelligence Services | Digital Watch Observatory
Backs: “Service‑level rules govern GenAI and “deep synthesis” online: providers must complete filings/security assessments, label synthetic content, and meet content‑management and data‑source requirements (in force since 2023); there are earlier algorithm‑recommendation rules as well.”
evidence, reference entry. Claim: China's generative AI rules require filings, security assessments, content labeling and data-source requirements.
18nist.govGovernment
Artificial Intelligence Risk Management Framework (AI RMF 1.0) | NIST
Backs: “2023) + Generative AI Profile (July 2024) — widely referenced in U.S. policy and by some state laws as a safe‑harbor anchor.”
evidence, official document. Claim: NIST AI RMF and Generative AI Profile are widely referenced in U.S. policy and some state safe harbors.
19iso.org.plLow provenance
Nowa norma ISO/IEC 42001:2023 – pierwszy na świecie standard zarządzania systemami sztucznej inteligencji
Backs: “ISO/IEC 42001:2023 (AI management systems) and ISO/IEC 23894:2023 (AI risk management) — increasingly used for governance programs and to align with EU and state obligations.”
evidence, article. Claim: ISO/IEC 42001 and 23894 are increasingly used for AI governance programs and aligning with obligations.
20gov.ukGovernment
Frontier AI Safety Commitments, AI Seoul Summit 2024 - GOV.UK
Backs: “Voluntary “frontier AI” safety commitments (Seoul AI Summit 2024 and follow‑ons) — nonbinding, but many leading labs now publish safety frameworks, red‑team, and commit to provenance measures.”
evidence, official document. Claim: Voluntary Seoul frontier AI safety commitments are nonbinding but labs publish safety frameworks and provenance measures.
21nist.govGovernment
AI Risk Management Framework - Resources | NIST
Backs: “Across jurisdictions: having an AI governance system (e.g., aligned to NIST AI RMF and/or ISO/IEC 42001) and rigor around data provenance, model evaluation, bias testing, incident response, and user notices/appeals is increasingly the “portable” way to comply and defend your program.”
background, other. Claim: Aligning with NIST AI RMF or ISO 42001 is a portable way to comply across jurisdictions.