What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Here’s a concise, up‑to‑date snapshot (as of September 15, 2026) of the main rules that govern how AI systems like large language models are built, deployed, and held accountable. If you want this narrowed to a specific country or sector, say the word.

Global and cross‑border (soft law and treaties)

•OECD AI Principles (non‑binding, widely referenced in policy and procurement).[1]

•UNESCO Recommendation on the Ethics of AI (non‑binding guidance adopted by all UNESCO member states).[2]

•Council of Europe Framework Convention on AI, Human Rights, Democracy and the Rule of Law (first binding international AI treaty; opened for signature Sept 5, 2024; now moving toward ratifications).[3]

European Union

•AI Act (Regulation (EU) 2024/1689): risk‑based obligations, with phased application. Key dates: prohibited practices and AI literacy apply from Feb 2, 2025; transparency duties (incl. user disclosures for interactive/generative AI and deepfake labeling) apply from Aug 2, 2026; high‑risk Annex III uses apply from Dec 2, 2027; high‑risk embedded in regulated products apply from Aug 2, 2028. Supervision of general‑purpose models (GPAI) is ramping up under the EU AI Office.[4]

•Digital Services Act (DSA): very large platforms/search engines must assess and mitigate systemic risks (including those from generative AI content) and add recommender‑system transparency; the Commission has issued guidance tying DSA duties to AI‑generated content.[5]

•Updated Product Liability Directive (2024/2853): clarifies that software/AI are “products” and expands no‑fault liability, including for defects introduced via updates or continuous learning.[6]

United States — federal

•Executive Order 14110 (Oct 30, 2023): directs agencies to develop standards, testing, red‑teaming, and content‑authenticity/watermarking guidance; OMB M‑24‑10 implements EO requirements for federal agencies’ AI use (governance, inventories, impact assessments, safety/risk controls).[7]

•NIST: AI Risk Management Framework (AI RMF 1.0) and the U.S. AI Safety Institute’s technical guidance/evaluations (e.g., dual‑use foundation‑model misuse‑risk guidance). These are voluntary but increasingly referenced in contracts and oversight.[8]

•Consumer protection and civil‑rights enforcement using existing laws:

•FTC uses Section 5 to police unfair/deceptive AI claims and harmful deployments (e.g., Rite Aid facial‑recognition settlement and broader sweeps on deceptive “AI” marketing).[9]

•CFPB: lenders using complex/ML models must give specific, accurate adverse‑action reasons under ECOA/Reg B.[10]

•EEOC: guidance on using AI in hiring under Title VII (adverse‑impact analysis still required).[11]

United States — state and local (examples now in force)

•New York City Local Law 144 (AEDTs in hiring): annual independent bias audits, public summaries, and candidate/employee notices for tools that “substantially assist” hiring/promotion.[12]

•California CPPA regulations (effective Jan 1, 2026): new rules on automated decision‑making technology (ADMT) give consumers access/opt‑out rights; also require risk assessments and cybersecurity audits for certain businesses.[13]

•Colorado AI Act (SB24‑205, 2024): first comprehensive state AI law targeting “high‑risk” AI that makes consequential decisions; requires risk‑management programs, impact disclosures, and notice to consumers; statewide rulemaking is underway for implementation beginning in 2026.[14]

•Illinois BIPA (biometric privacy): strict consent and retention rules plus a private right of action—driving significant litigation over face/voice data used by AI.[15]

•Tennessee ELVIS Act (2024): protects voice likeness against unauthorized AI voice‑cloning in commercial contexts.[16]

United Kingdom

•No cross‑cutting AI statute yet; the government’s “pro‑innovation” approach relies on existing regulators applying five cross‑sector principles. The UK AI Safety Institute conducts testing/evaluations; the Online Safety Act 2023 (regulated by Ofcom) adds platform‑safety and transparency duties relevant to AI‑generated content.[17]

China

•Binding national rules for public‑facing AI: Interim Measures for Generative AI Services (effective Aug 15, 2023: lawful data sources, AIGC labeling, safety assessments/filings); “Deep Synthesis” rules (Jan 10, 2023) and algorithmic‑recommendation provisions (effective Mar 1, 2022) also apply.[18]

Standards, audits, and industry codes (often referenced by law or contracts)

•ISO/IEC 42001:2023 (AI management systems) and ISO/IEC 23894:2023 (AI risk management) are now common assurance anchors; organizations increasingly certify to 42001 to demonstrate governance.[19]

•NIST AI RMF 1.0 + U.S. AI Safety Institute evaluation programs (e.g., ARIA, misuse‑risk guidance for dual‑use foundation models) are used by agencies and vendors as de‑facto benchmarks.[8]

•Content authenticity and deepfake labeling: the C2PA content‑provenance standard is being adopted across tools and is referenced by government guidance alongside watermarking/detection approaches.[20]

What this tends to mean in practice for systems like me

•Disclose AI interactions and label AI‑generated/manipulated media in the EU starting August 2, 2026; GPAI model providers face additional obligations and supervision.[21]

•If your AI tool influences employment, credit, housing, insurance, or other “consequential” decisions in the U.S., expect audits/impact assessments, consumer notices, and civil‑rights/consumer‑protection scrutiny (NYC LL 144, California ADMT rules, Colorado AI Act, plus FTC/CFPB/EEOC enforcement).[12]

•Platforms hosting or amplifying AI content in the EU must mitigate risks from generative AI under the DSA (e.g., recommender transparency, election‑risk measures).[22]

•Product liability in the EU now clearly covers software/AI, including defects from updates or continuous learning.[23]

If you tell me your jurisdiction and use case (e.g., hiring, customer service, healthcare, finance, education), I can map the exact obligations, timelines, and what “good compliance” looks like there.

1.[OECD

Organisation for Economic Co-operation and](https://one.oecd.org/document/C/MIN%282019%293/FINAL/en/pdf?utm_source=openai)

14.[SB 24-205

Legislative Council Staff
Nonpartisan](https://leg.colorado.gov/bill_files/47798/download?utm_source=openai)

Citations (23)

1oecd.orgGovernment
OECD Organisation for Economic Co-operation and
Backs: “OECD AI Principles (non‑binding, widely referenced in policy and procurement).”
evidence, official document. Claim: OECD AI Principles are non-binding but widely referenced in policy and procurement.
2unesco.orgGovernment
381137eng.pdf
Backs: “UNESCO Recommendation on the Ethics of AI (non‑binding guidance adopted by all UNESCO member states).”
evidence, official document. Claim: UNESCO Recommendation on the Ethics of AI is non-binding guidance adopted by all member states.
3coe.intGovernment
Committee on Artificial Intelligence (CAI) - Artificial Intelligence
Backs: “Council of Europe Framework Convention on AI, Human Rights, Democracy and the Rule of Law (first binding international AI treaty; opened for signature Sept 5, 2024; now moving toward ratifications).”
evidence, other. Claim: Council of Europe Framework Convention on AI is the first binding international AI treaty, opened for signature Sept 2024.
4europa.euGovernment
Timeline for the Implementation of the EU AI Act | AI Act Service Desk
Backs: “Supervision of general‑purpose models (GPAI) is ramping up under the EU AI Office.”
evidence, official document. Claim: EU AI Act risk-based obligations with phased application dates from 2025 to 2028.
5europa.euGovernment
Digital Services Act - Consilium
Backs: “Digital Services Act (DSA): very large platforms/search engines must assess and mitigate systemic risks (including those from generative AI content) and add recommender‑system transparency; the Commission has issued guidance tying DSA duties to AI‑generated content.”
evidence, other. Claim: DSA requires very large platforms to assess and mitigate systemic risks including generative AI content.
6europa.euGovernment
Directive (EU) 2024/2853 of the European Parliament and of the Council of 23 October 2024 on liability for defective products and repealing Council Directive 85/374/EEC (Text with EEA relevance)
Backs: “Updated Product Liability Directive (2024/2853): clarifies that software/AI are “products” and expands no‑fault liability, including for defects introduced via updates or continuous learning.”
evidence, official document. Claim: Updated Product Liability Directive treats software/AI as products and expands no-fault liability.
7govinfo.govGovernment
Executive Orders EO 14110
Backs: “OMB M‑24‑10 implements EO requirements for federal agencies’ AI use (governance, inventories, impact assessments, safety/risk controls).”
evidence, official document. Claim: Executive Order 14110 directs agencies to develop AI standards, testing, red-teaming and content authenticity guidance.
8nist.govGovernment
Artificial Intelligence Risk Management Framework (AI RMF 1.0) | NIST
Backs: “These are voluntary but increasingly referenced in contracts and oversight.”
evidence, other. Claim: NIST AI RMF and AI Safety Institute programs are used as de facto benchmarks.
9ftc.govGovernment
Rite Aid Banned from Using AI Facial Recognition After FTC Says Retailer Deployed Technology without Reasonable Safeguards | Federal Trade Commission
Backs: “FTC uses Section 5 to police unfair/deceptive AI claims and harmful deployments (e.g., Rite Aid facial‑recognition settlement and broader sweeps on deceptive “AI” marketing).”
evidence, article. Claim: FTC used Section 5 against Rite Aid's facial-recognition deployment.
10consumerfinance.govGovernment
Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms | Consumer Financial Protection Bureau
Backs: “CFPB: lenders using complex/ML models must give specific, accurate adverse‑action reasons under ECOA/Reg B.”
evidence, official document. Claim: CFPB: lenders using complex models must give specific accurate adverse-action reasons under ECOA/Reg B.
11govdelivery.comCompanies
EEOC Releases New Resource on Artificial Intelligence and Title VII
Backs: “EEOC: guidance on using AI in hiring under Title VII (adverse‑impact analysis still required).”
evidence, article. Claim: EEOC guidance on AI in hiring under Title VII, adverse-impact analysis still required.
12nyc.govGovernment
Automated Employment Decision Tools (AEDT) - DCWP
Backs: “New York City Local Law 144 (AEDTs in hiring): annual independent bias audits, public summaries, and candidate/employee notices for tools that “substantially assist” hiring/promotion.”
evidence, official document. Claim: US consequential-decision AI faces audits, notices and enforcement scrutiny, e.g. NYC LL 144.
13ca.govGovernment
California Finalizes Regulations to Strengthen Consumers' Privacy
Backs: “California CPPA regulations (effective Jan 1, 2026): new rules on automated decision‑making technology (ADMT) give consumers access/opt‑out rights; also require risk assessments and cybersecurity audits for certain businesses.”
evidence, article. Claim: California CPPA regulations on automated decision-making technology, risk assessments and cybersecurity audits effective 2026.
14colorado.govGovernment
SB 24-205 Legislative Council Staff Nonpartisan
Backs: “Colorado AI Act (SB24‑205, 2024): first comprehensive state AI law targeting “high‑risk” AI that makes consequential decisions; requires risk‑management programs, impact disclosures, and notice to consumers; statewide rulemaking is underway for implementation beginning in 2026.”
evidence, official document. Claim: Colorado AI Act targets high-risk AI with risk-management programs, impact disclosures and consumer notice.
15ilga.govGovernment
740 ILCS 14/20
Backs: “Illinois BIPA (biometric privacy): strict consent and retention rules plus a private right of action—driving significant litigation over face/voice data used by AI.”
evidence, official document. Claim: Illinois BIPA imposes consent and retention rules with a private right of action.
16tn.govGovernment
PHOTOS: Gov. Lee Signs ELVIS Act Into Law
Backs: “Tennessee ELVIS Act (2024): protects voice likeness against unauthorized AI voice‑cloning in commercial contexts.”
evidence, article. Claim: Tennessee ELVIS Act protects voice likeness against unauthorized AI voice cloning.
17gov.ukGovernment
A pro-innovation approach to AI regulation: government response - GOV.UK
Backs: “The UK AI Safety Institute conducts testing/evaluations; the Online Safety Act 2023 (regulated by Ofcom) adds platform‑safety and transparency duties relevant to AI‑generated content.”
evidence, official document. Claim: UK has no cross-cutting AI statute; relies on existing regulators applying five cross-sector principles.
18comparativeai.orgLow provenance
Interim Measures for the Management of Generative AI Services | Comparative AI
Backs: ““Deep Synthesis” rules (Jan 10, 2023) and algorithmic‑recommendation provisions (effective Mar 1, 2022) also apply.”
evidence, reference entry. Claim: China's Interim Measures for Generative AI Services require lawful data, labeling, safety assessments and filings.
19iso.orgNonprofits and think tanks
ISO - ISO 42001 explained
Backs: “ISO/IEC 42001:2023 (AI management systems) and ISO/IEC 23894:2023 (AI risk management) are now common assurance anchors; organizations increasingly certify to 42001 to demonstrate governance.”
evidence, article. Claim: ISO/IEC 42001 AI management systems standard is a common assurance anchor with growing certification.
20c2pa.orgNonprofits and think tanks
Content Credentials : C2PA Technical Specification :: C2PA Specifications
Backs: “Content authenticity and deepfake labeling: the C2PA content‑provenance standard is being adopted across tools and is referenced by government guidance alongside watermarking/detection approaches.”
evidence, official document. Claim: C2PA content-provenance standard is being adopted and referenced in government guidance.
21europa.euGovernment
Transparency obligations under Article 50 of the AI Act | Shaping Europe’s digital future
Backs: “GPAI model providers face additional obligations and supervision.”
evidence, article. Claim: EU requires disclosure of AI interactions and labeling of AI-generated media from August 2, 2026.
22europa.euGovernment
EUR-Lex - 52024XC03014 - SV - EUR-Lex
Backs: “Platforms hosting or amplifying AI content in the EU must mitigate risks from generative AI under the DSA (e.g., recommender transparency, election‑risk measures).”
evidence, official document. Claim: Platforms must mitigate generative AI risks under the DSA, such as recommender transparency and election-risk measures.
23europa.euGovernment
Directive - 2024/2853 - EN - Product Liability Directive - EUR-Lex
Backs: “Product liability in the EU now clearly covers software/AI, including defects from updates or continuous learning.”
evidence, official document. Claim: EU product liability covers software/AI including defects from updates or continuous learning.