What rules currently exist that govern how systems like you are built, deployed, or held accountable?
Here’s the short version of what’s in force (or about to be) as of September 16, 2026, that governs how AI systems are built, deployed, and held accountable.
Global/soft-law baselines and standards
European Union (binding)
United States (federal)
United States (state and local)
United Kingdom
China
Canada and Brazil (in motion)
What these rules mean in practice
If you tell me your jurisdiction(s) and use case (e.g., a public chatbot, hiring tool, medical software, or foundation model), I can map the exact obligations and deadlines that apply and draft a short compliance checklist.
Citations (23)
- AI principles | OECD
Backs: “OECD AI Principles (values-based and policy recommendations), adopted 2019 and updated in May 2024 to address general‑purpose and generative AI. Governments often map national measures to these.”
evidence, reference entry. Claim: OECD AI Principles adopted 2019 and updated May 2024 to address general-purpose and generative AI.
- ISO/IEC 42001:2023 - AI management systems
Backs: “ISO/IEC 23894:2023 (AI risk management) – companion guidance on AI‑specific risk processes.”
evidence, reference entry. Claim: ISO/IEC 42001:2023 and 23894:2023 provide auditable AI governance and risk management standards.
- Committee on Artificial Intelligence (CAI) - Artificial Intelligence
Backs: “Council of Europe Framework Convention on AI (human rights, democracy, rule of law): adopted May 17, 2024; opened for signature Sept 5, 2024; enters into force after five ratifications (status: not yet in force; EU approved conclusion in 2026).”
evidence, article. Claim: Council of Europe Framework Convention on AI adopted May 2024, opened for signature Sept 2024, not yet in force.
- General Assembly Adopts Landmark Resolution on Steering Artificial Intelligence towards Global Good, Faster Realization of Sustainable Development | Meetings Coverage and Press Releases
Backs: “UN General Assembly resolution on safe, secure, trustworthy AI for sustainable development (non‑binding), adopted March 21, 2024.”
evidence, article. Claim: UN General Assembly adopted non-binding AI resolution on March 21, 2024.
- AI Act enters into force - European Commission
Backs: “Enforcement is led by the AI Office (requests for information/evaluations/fines), with GPAI codes of practice used to operationalize duties in year one.”
evidence, article. Claim: EU AI Act entered into force Aug 1, 2024 with phased application dates and AI Office enforcement.
- EUR-Lex - 52024XC03014 - DE - EUR-Lex
Backs: “Very Large Online Platforms/Search Engines must assess and mitigate systemic risks, including those from generative‑AI content (labelling/controls around deepfakes, elections, etc.); the Commission has already compelled Microsoft for information on Bing’s generative‑AI risks.”
evidence, official document. Claim: DSA requires very large platforms to assess systemic risks including generative AI; Commission requested information from Microsoft on Bing.
- Liability for defective products - Internal Market, Industry, Entrepreneurship and SMEs
Backs: “The separate “AI Liability Directive” proposal was withdrawn in 2025.”
evidence, article. Claim: Revised Product Liability Directive 2024/2853 covers software including AI; transposition due Dec 2026; AI Liability Directive withdrawn.
- Understanding the standardisation of the AI Act | Shaping Europe’s digital future
Backs: “Standards to support presumption of conformity under the AI Act are being developed (CEN/CENELEC JTC 21), with first waves expected/published during 2026; these will matter for high‑risk compliance and, to some extent, GPAI.”
evidence, article. Claim: CEN/CENELEC standards supporting AI Act presumption of conformity are being developed.
- Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence | 88 FR 75191
Backs: “OMB’s AI acquisition memo (M‑24‑18, Oct 2024) extends these controls into federal procurement.”
evidence, official document. Claim: Executive Order 14110 and OMB memos impose governance and transparency on federal agency AI use and procurement.
- AI Risk Management Framework | NIST
Backs: “NIST AI Risk Management Framework (AI RMF 1.0) and Generative‑AI Profile (July 26, 2024) guide builders and are referenced by agencies and industry; the AI Safety Institute/consortium at NIST advances evaluation/red‑teaming guidance.”
evidence, article. Claim: NIST AI RMF and Generative AI Profile guide builders and are referenced by agencies and industry.
- Framework for Artificial Intelligence Diffusion, 4544-4584 [2025-00636] :: Department Of Commerce :: Regulation Tracker :: Justia
Backs: “Commerce/BIS export controls: an interim final rule on Jan 15, 2025 added controls on model weights for the most advanced closed‑weight AI models (not open‑weight) alongside chip controls; analysis in 2026 noted those model‑weights controls were not being actively enforced at that time.”
evidence, official document. Claim: BIS interim final rule of Jan 2025 added export controls on closed-weight model weights alongside chip controls.
- Approaches to Address AI-enabled Voice Cloning | Federal Trade Commission
Backs: “EEOC pursues discrimination tied to automated hiring/screening.”
evidence, article. Claim: FTC uses Section 5 and related authorities against AI harms; CFPB and EEOC also enforce against AI-driven decisions.
- California Finalizes Regulations to Strengthen Consumers' Privacy
Backs: “California privacy regulator (CPPA) finalized rules on Automated Decision‑Making Technology (ADMT) with consumer opt‑out/notice and “meaningful information” about logic; rules took effect Jan 1, 2026, with certain “significant decision” compliance deadlines on/after Jan 1, 2027.”
evidence, article. Claim: California CPPA finalized ADMT rules with opt-out and notice, effective Jan 2026 with later compliance deadlines.
- SB26-189 Automated Decision-Making Technology | Colorado General Assembly
Backs: “HB26‑1263 (“Conversational AI Service Operator Requirements”/“Chatbot Safety Act”) – kid‑safety, disclosure, and crisis‑response protocols; effective Jan 1, 2027. Rulemaking is underway.”
evidence, official document. Claim: Colorado 2026 ADMT and chatbot laws impose duties on developers and deployers effective Jan 1, 2027.
- Automated Employment Decision Tools (AEDT) - DCWP
Backs: “AEDTs used in hiring/promotion require an annual independent bias audit, public posting, and candidate notices.”
evidence, official document. Claim: NYC Local Law 144 requires annual bias audits, public posting, and notices for automated hiring tools.
- Utah Legislature SB0149
Backs: “Utah SB 149 (Artificial Intelligence Policy Act) and 2025 amendments: disclosure when consumers interact with AI in covered settings and for regulated occupations; Utah created an AI Office and related rules.”
evidence, official document. Claim: Utah SB 149 requires AI disclosure in covered consumer settings and created an AI Office.
- New California laws aim to protect kids from social media harms | AP News
Backs: “California (additional 2026 tech‑safety package): new laws aimed at protecting minors from social‑media and AI‑chatbot risks, plus groundwork for independent AI model safety evaluations/auditor registry.”
evidence, article. Claim: California 2026 laws protect minors from social media and AI chatbot risks and lay groundwork for AI safety auditing.
- Implementing the UK’s AI regulatory principles: initial guidance for regulators - GOV.UK
Backs: “UK AI Safety/Security Institute (AISI) conducts evaluations and collaborates with the U.S. via an April 1, 2024 MoU.”
evidence, official document. Claim: UK uses a regulator-led, context-specific approach with non-statutory AI principles and AISI collaboration with the US.
- Translation: Internet Information Service Algorithmic Recommendation Management Provisions – Effective March 1, 2022
Backs: “Interim Measures for Generative AI Services (effective Aug 15, 2023) – security assessments/filings for certain public‑facing gen‑AI, data/privacy duties.”
evidence, article. Claim: China has binding rules on algorithmic recommendation, deep synthesis, and generative AI services.
- C-27 (44-1) - LEGISinfo - Parliament of Canada
Backs: “Canada: the federal AI bill (AIDA within Bill C‑27) did not become law before Parliament’s 2025 reset; the government tabled new privacy legislation (Bill C‑36) on June 15, 2026, but no federal AI‑specific statute is in force yet.”
evidence, official document. Claim: Canada's AIDA in Bill C-27 did not become law; no federal AI statute in force.
- Marco da Inteligência Artificial é aprovado em Plenário e vai à Câmara — Senado Notícias
Backs: “Brazil: the Senate‑approved AI bill (PL 2338/2023) advanced to the Chamber in Dec 2024 and remains under consideration in 2026 (not yet enacted).”
evidence, article. Claim: Brazil's Senate-approved AI bill PL 2338/2023 advanced to the Chamber and is not yet enacted.
- When does enforcement start? | AI Act Service Desk
Backs: “Deployment time: transparency to users (labels for AI‑generated content; chatbots disclosures), human‑in‑the‑loop and logging for high‑risk uses (EU), notice/opt‑out for automated decisions (CA CPPA rules), and bias audits in hiring (NYC).”
evidence, article. Claim: Deployment-time obligations include user transparency, AI content labels, and chatbot disclosures under the AI Act.
- The enforcement framework of the AI Act | Shaping Europe’s digital future
Backs: “Accountability: enforcement can come via AI‑specific regimes (EU AI Act/AI Office), platform rules (DSA), product liability (EU 2024/2853), data‑protection authorities (EU/UK), consumer protection and civil rights agencies (FTC, CFPB, EEOC in the U.S.), and state attorneys general.”
evidence, article. Claim: Accountability can come via the AI Act/AI Office and other enforcement regimes.