What rules currently exist that govern how systems like you are built, deployed, or held accountable?
A mix of binding laws, regulations, voluntary frameworks, existing general laws, and international agreements currently govern the building (development/training), deployment/use, and accountability of AI systems like large language models (LLMs) and generative AI. There is no single global regime. Approaches vary by jurisdiction: comprehensive risk-based rules in the EU, a patchwork (often lighter or sector-specific) in the US, content- and security-focused rules in China, and soft-law or treaty-based efforts internationally. Many obligations apply extraterritorially if systems or outputs reach a market. Existing laws on data protection, consumer protection, discrimination, intellectual property, and product liability also apply.[1]
European Union: EU AI Act (Regulation (EU) 2024/1689)
This is the world’s first comprehensive horizontal AI law. It entered into force in August 2024 and applies on a staggered timeline (prohibitions and AI literacy from February 2025; GPAI obligations from August 2025; most high-risk rules phased, with some delays via later amendments to late 2026–2027). It has extraterritorial reach for systems placed on the EU market or used there.[1]
It uses a risk-based approach:
Accountability and enforcement: Providers (developers) bear primary duties for design/build; deployers for use/oversight. National market surveillance authorities + EU AI Office (for GPAI). Fines up to €35 million or 7% of global turnover (prohibited practices), lower tiers for other breaches. Supporting tools include guidelines, standards, the AI Pact (voluntary early compliance), and sandboxes. The revised Product Liability Directive also treats AI software as a “product” subject to strict liability (from ~December 2026).[3]
Related: GDPR applies to personal data processing in AI (lawful basis, DPIAs for high-risk automated decisions, rights to explanation/opt-out in some cases).
United States
No comprehensive federal AI statute. The landscape is a patchwork of executive actions, agency enforcement of existing laws, state laws, and voluntary frameworks. The Biden-era EO 14110 (Safe, Secure, and Trustworthy AI, 2023) was largely revoked by the Trump administration in early 2025 in favor of a more deregulatory, pro-innovation stance (e.g., “Removing Barriers” EO and subsequent AI Action Plan/National Policy Framework emphasizing leadership, infrastructure, exports, and reducing barriers, while addressing some national security/cyber risks via voluntary reviews for frontier models). Federal agencies have AI governance rules for their own use (e.g., OMB memoranda requiring Chief AI Officers, inventories, risk management for high-impact systems).[4]
Key elements:
Accountability: Primarily through agency enforcement, private litigation, state AGs, and market pressures. Federal preemption efforts against conflicting state laws have been discussed. International commitments include signing the Council of Europe Convention.
China
Layered, agency-driven rules (led by Cyberspace Administration of China/CAC and others) rather than one comprehensive statute. Focus on content control, security, socialist values, and public-facing services.[8]
Key instruments:
Accountability: Filing/registration mandatory for many services; security assessments; enforcement via fines, suspensions, account shutdowns, criminal referral. Judicial guidance on liability for AI harms (fault-based torts with AI-specific factors). Providers responsible for outputs and training data legality.[9]
International and Soft-Law Frameworks
Cross-Cutting Themes for Building, Deployment, and Accountability
Other jurisdictions (e.g., UK principles-based via existing regulators; Canada proposed AIDA; India sectoral + emerging guidelines; various national strategies) add further layers. Rules evolve rapidly with technology, politics, and incidents. Companies often adopt “highest common denominator” compliance for global systems. For the latest or jurisdiction-specific advice, consult primary legal texts or counsel, as this is a high-level overview of the current landscape (as of mid/late 2026 information).
Citations (12)
- https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
Backs: “Existing laws on data protection, consumer protection, discrimination, intellectual property, and product liability also apply.”
evidence, article. Claim: EU AI Act is a comprehensive risk-based law with staggered timeline, prohibited practices, high-risk requirements, and GPAI obligations; general laws also apply.
- https://www.springlex.eu/en/packages/ai-act/ai-act-regulation/article-50/
Backs: “Generative AI providers must mark synthetic content (machine-readable where possible); deployers must label deepfakes and certain public-interest AI text.”
evidence, official document. Claim: Chatbots must disclose AI interaction; generative AI providers must mark synthetic content; deployers must label deepfakes.
- https://wcr.legal/eu-ai-liability-directive-withdrawn-pld/
Backs: “The revised Product Liability Directive also treats AI software as a “product” subject to strict liability (from ~December 2026).”
evidence, article. Claim: Revised Product Liability Directive treats AI software as a product subject to strict liability; fines and enforcement structure.
- https://www.whitecase.com/insight-our-thinking/ai-watch-global-regulatory-tracker-united-states
Backs: “Federal agencies have AI governance rules for their own use (e.g., OMB memoranda requiring Chief AI Officers, inventories, risk management for high-impact systems).”
evidence, article. Claim: US has no comprehensive federal AI statute; EO 14110 revoked; federal agencies have AI governance rules for own use.
- https://ailegalauthority.com/ftc-ai-enforcement-legal/
Backs: “Product liability and tort law are evolving for AI harms (negligence, defects); courts are testing applicability. SEC scrutinizes AI-related disclosures.”
evidence, article. Claim: FTC Act Section 5 and other existing federal laws are used to enforce against deceptive or biased AI.
- https://www.varnumlaw.com/insights/state-level-ai-regulations-enacted-in-2024/
Backs: “Common themes: notice when AI influences consequential decisions, bias testing, documentation, appeals.”
evidence, article. Claim: US states are enacting a growing patchwork of AI laws such as California, Colorado, Utah, Texas, Illinois.
- https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10
Backs: “NIST AI Risk Management Framework (AI RMF 1.0, 2023) + Generative AI Profile—voluntary, lifecycle approach (Govern, Map, Measure, Manage) focused on trustworthy characteristics (valid/reliable, safe, secure/resilient, accountable/transparent, explainable, privacy-enhanced, fair). Widely referenced. Other NIST work on…”
evidence, official document. Claim: NIST AI RMF is a voluntary lifecycle framework (Govern, Map, Measure, Manage) for trustworthy AI.
- https://reg-intel.com/china-ai-regulation-2026-every-law-rule-and-draft-in-one-place/
Backs: “Focus on content control, security, socialist values, and public-facing services.”
evidence, article. Claim: China regulates AI through layered, agency-driven rules led by CAC focused on content control and security.
- https://aigovernance.com/entry/china-generative-ai-regulations-interim-measures
Backs: “Providers responsible for outputs and training data legality.”
evidence, reference entry. Claim: China's Interim Measures for Generative AI require filing, security assessments, lawful training data, and provider responsibility for outputs.
- https://www.coe.int/en/web/artificial-intelligence/the-framework-convention-on-artificial-intelligence
Backs: “Signed/ratified by EU, US, UK, and others; risk-based and technology-neutral. Implemented in EU largely via the AI Act.”
evidence, official document. Claim: Council of Europe Framework Convention is the first binding international AI treaty on human rights, democracy, rule of law.
- https://digital-strategy.ec.europa.eu/en/library/g7-leaders-statement-hiroshima-ai-process
Backs: “International Guiding Principles + voluntary Code of Conduct for advanced/frontier AI developers (risk identification/mitigation across lifecycle, testing/red-teaming, transparency, incident reporting, cybersecurity, content provenance, bias mitigation, etc.). OECD-supported reporting framework for transparency.”
evidence, official document. Claim: G7 Hiroshima AI Process provides guiding principles and voluntary code of conduct for advanced AI developers.
- https://www.ntia.gov/issues/artificial-intelligence/ai-accountability-policy-report
Backs: “Voluntary frameworks like NIST RMF emphasize organisational governance and continuous risk management.”
background, official document. Claim: Accountability themes include audits, incident reporting, liability, and organisational governance for AI systems.