What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Rules for AI are evolving fast — I'll map the current build, deploy, and accountability frameworks for you.

Rules governing AI systems like me exist at multiple levels - hard law, sector-specific law, and voluntary governance frameworks. No single global law governs all systems; instead obligations depend on where a system is built and deployed.

1. Hard Law: Comprehensive AI-Specific Regulation

European Union - AI Act

The EU Artificial Intelligence Act — officially Regulation (EU) 2024/1689 — entered into force on 1 August 2024. It is the first law of its kind anywhere in the world, and it will affect every developer, startup, and enterprise that builds or deploys AI touching the European market.

It is described as a new set of rules governing the development, deployment, and use of artificial intelligence (AI) systems in the European Union. It introduces a risk-based approach, dividing AI systems into four levels:

•At the heart of the Act is a risk-based framework. Not all AI is treated the same. The regulation groups AI systems into four risk tiers, and your obligations depend entirely on which tier your system falls into.

•Tier 1 - Unacceptable risk: Outright banned. Includes social scoring by governments, subliminal manipulation, and most real-time biometric surveillance in public spaces.

•Tier 2 - High risk: Permitted but heavily regulated. Covers AI in hiring, credit scoring, education, critical infrastructure, and law enforcement tools.

•Tier 3 - Limited risk: Transparency obligations only. Chatbots and deepfake tools must disclose that users are interacting with AI-generated content.

•Tier 4 - Minimal risk: > *These systems typically face minimal regulatory obligations and include applications such as spam filters, recommendation engines, and many consumer-focused AI tools.*

Key accountability requirements for builders and deployers:

•High-risk systems must establish a formal risk management system, maintain detailed technical documentation, implement data governance controls, ensure human oversight mechanisms, and conduct Fundamental Rights Impact Assessments (FRIAs)

•Businesses that deploy AI systems — not just those that build them — also share responsibility. Organizations must monitor system performance, train employees on proper use, and maintain operational records, as liability does not fully transfer to the vendor

•General-Purpose AI (GPAI) models track: GPAI model obligations live — transparency, copyright rules, and systemic-risk assessments apply to general-purpose AI providers. Penalty regime also activated. since Aug 2, 2025. Models considered to carry systemic risk face additional duties including risk evaluation, incident reporting, and mitigation measures

Penalties: Fines for prohibited AI practices: up to €35 million or 7% of global annual turnover — whichever is higher. , violations of other obligations up to €15 million or 3%, and providing incorrect information up to €7.5 million or 1%. The Act has extraterritorial reach - if you deploy in the EU, you comply regardless of where you are based.

Timeline: Act enters into force Aug 1 2024, prohibited practices ban Feb 2 2025, GPAI obligations Aug 2 2025, full application for high-risk systems Aug 2 2026, with extended deadline Aug 2 2027 for embedded products

China

China has not enacted a single comprehensive AI law, but has built an extensive system of AI rules, assessment, filing, technical standards and government oversight.

•The interim measures for generative artificial intelligence services were introduced in August 2023. These added rules for public-facing generative AI, particularly those that can influence public opinion. They apply to legality and quality of training data, users' personal information, intellectual property and discrimination, with services that affect public opinion formation subject to safety assessments and algorithm filing obligations.

•Measures for Labelling AI-Generated and Synthetic Content jointly issued by the Cyberspace Administration of China (CAC) require explicit and watermark labelling of AI-generated outputs and compulsory AI labelling where AI-generated outputs must be tagged as such - both explicitly and via watermarks

•Bans on AI user anonymity: Anyone who uses Generative AI services in China is required to register with their real name to ensure accountability

•Filing requirements for large models and rules governing algorithms and deep synthesis, plus 2026 ethics-review measures adding institutionalized ethical oversight, and AI Safety Governance Framework 3.0 published September 2026

United States - Federal Patchwork, No Comprehensive AI Act

The United States federal government and state governments have developed some regulation of artificial intelligence, including executive orders, federal laws, and state laws. Federal agencies have also developed some sector-specific regulations related to AI.

•At the federal level, the Biden administration released an October 2023 executive order about AI safety and security, Executive Order 14110. President Trump revoked that executive order in January 2025 and issued Executive Order 14179. In December 2025, President Trump signed Executive Order 14365, an executive order directing federal agencies to develop a unified national approach to AI policy, evaluate state AI laws for potential conflicts, challenge them through legal action, and condition certain federal funding on state compliance

Existing laws are applied to AI:

•The FTC announced Operation AI Comply to ensure AI products and marketing claims comply with existing consumer-protection, fair-credit, and truth-in-advertising laws

•Other agencies like FDA created pathways to regulate incorporation of AI in medical imaging, and Congress passed legislation targeting AI-generated deepfakes, the TAKE IT DOWN Act

United States - State Laws (increasingly the main source of binding rules)

Several U.S. states have enacted laws related to artificial intelligence. Some are already in effect, including in California. Other states have AI-related legislation coming into effect in 2026 and 2027.

Examples:

•California’s Transparency in Frontier Artificial Intelligence Act (SB 53) took effect January 1, 2026. New York’s Responsible AI Safety and Education (RAISE) Act and Illinois’s Artificial Intelligence Safety Measures Act (SB 315) take effect January 1, 2027. Each rejects licensing and pre-deployment approval in favor of mandated transparency. Developers of models trained above a compute threshold must publish transparency reports and report critical safety incidents

•In detail: California's SB 53 requires developers of large AI models trained using greater than 10²⁶ FLOPS to publish risk frameworks, report critical safety incidents within 15 days, and implement whistleblower protections, with penalties up to $1 million per violation

•Texas's Responsible Artificial Intelligence Governance Act, which also goes into effect Jan. 1, establishes new expectations around transparency, risk evaluation

•Colorado’s new AI Act mandates impact assessments and oversight for “high-risk” AI systems

•Illinois House Bill 3773 amends the Illinois Human Rights Act to explicitly apply existing anti-discrimination standards to AI used in employment decisions

Proposed federal legislation like the AI Incident Reporting Act would mandate developers of designated “covered models” disclose incidents within seven days.

United Kingdom - Principles-Based, Regulator-Led

The UK’s current approach is built around five broad principles: (1) safety, security, and robustness; (2) appropriate transparency and explainability; (3) fairness; (4) accountability and governance; and (5) contestability and redress. These principles are not set out in a standalone AI Act. Instead, regulators such as the Information Commissioner’s Office (ICO), Office for Communications (Ofcom), the Competition and Markets Authority (CMA), and the Advertising Standards Agency apply them

The facts were checked in October 2026: The UK approach is to have existing regulators apply existing law to AI, guided by a short set of non-statutory principles. The five principles are: safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; and contestability and redress

2. Voluntary / Soft-Law Governance Frameworks That Create Accountability Expectations

Even where not legally binding, these frameworks are widely used in contracts, procurement, and as a standard for negligence.

OECD AI Principles

The OECD AI Principles, first adopted in May 2019 and updated in 2024, represent the foundational document of international AI governance. Adopted by 47 countries representing over 80% of global GDP, the OECD AI Principles consist of five core principles for trustworthy AI and five policy recommendations for governments. The principles emphasize inclusive growth, human-centered values, transparency, robustness, and accountability

The OECD accountability principle requires that AI actors be responsible for the proper functioning of AI systems and for respecting the other principles. Accountability mechanisms should be in place to hold individuals and organizations accountable for the impacts of AI systems. This includes addressing harms, providing redress, and ensuring responsibility for design, development, and deployment. Organisations and individuals developing, deploying, or operating AI systems should be held accountable for their functioning in line with the above principles. This includes mechanisms for responsibility and redress if AI systems cause harm

NIST AI Risk Management Framework (U.S.)

The NIST AI Risk Management Framework, released in January 2023, is a voluntary framework developed by the U.S. National Institute of Standards and Technology to help organizations manage risks associated with AI systems throughout their lifecycle.

•NIST itself describes it as voluntary and use-case agnostic, so no auditor scores you against it directly. It is voluntary guidance, not a regulation like GDPR or the EU AI Act.

•Structured around four core functions: Govern, Map, Measure, and Manage. Govern is the cross-cutting function that sets accountability and policy. Map identifies context and risk for a given system

•Published as NIST AI 100-1 on 26 January 2023. It is voluntary, it is not a regulation, and there is no RMF certification: nobody can audit you and declare you compliant

•Despite voluntary status, it is increasingly referenced in federal contracts and several state AI laws cite the RMF as a reasonableness baseline.

ISO/IEC 42001 - AI Management System Standard

ISO 42001 provides an internationally recognized standard for implementing an AI management system (AIMS) for the responsible development, provision, or use of AI systems, including governance and AI risk management.

•ISO 42001 is the first global standard for establishing, implementing, maintaining, and continually improving an AIMS. Like many ISO standards, this voluntary framework takes a risk-based approach

•It can be implemented to coordinate and document an organization's AI governance program across other voluntary frameworks and mandatory regulations, most notably the EU AI Act, NIST AI RMF, and OECD AI Principles. It does not replace legal compliance requirements, but it provides a structured, auditable management system

•Core principles include: Transparency: All AI decisions must be fully transparent; Accountability: To build user trust, organizations must hold themselves accountable by explaining the reasoning behind AI-related decisions; plus Fairness, Explainability, Data privacy, Reliability.

•Establishes mechanisms to identify who is responsible for AI systems and their outcomes. This includes setting clear lines of responsibility, creating processes to address issues, and managing human oversight

3. How Accountability Is Generally Enforced Across These Rules

Across jurisdictions, common accountability mechanisms include:

•Pre-deployment obligations: risk assessments, technical documentation, data governance, human oversight (EU high-risk) and Frontier-model transparency reports and risk frameworks (CA, NY, IL)

•Transparency to users: EU limited-risk disclosure that users are interacting with AI, China labelling, U.S. watermarking commitments

•Post-deployment monitoring: performance monitoring, record-keeping, and incident reporting (EU systemic-risk incident reporting, California 15-day critical safety incident reports)

•Liability through existing law: consumer protection, anti-discrimination, product liability, data protection (GDPR, UK GDPR), and FTC Act enforcement remain applicable even without AI-specific statutes.

•Governance requirements: named owners, AI inventories, auditability, and contestability/redress channels - reflected in UK accountability and governance principle, OECD accountability, NIST Govern function, and ISO 42001 clauses on leadership and accountability.

If you tell me where you are deploying or what type of system you are building (e.g., hiring, healthcare, generative AI chatbot, internal productivity tool), I can map which of these tiers and obligations would most directly apply to you.

Citations (3)

1medium.comBlogs and newsletters
What the EU AI Act means for developers and businesses
Backs: “The EU Artificial Intelligence Act — officially Regulation (EU) 2024/1689 — entered into force on 1 August 2024. It is the first law of its kind anywhere in the world, and it will affect every developer, startup, and enterprise that builds or deploys AI touching the European market.”
2wikipedia.orgEncyclopedias and referencequality 0.83
Regulation of artificial intelligence in the United States - Wikipedia
Backs: “The United States federal government and state governments have developed some regulation of artificial intelligence, including executive orders, federal laws, and state laws.”
3vanta.comNot yet classified
What is ISO 42001? Everything you need to know
Backs: “Despite voluntary status, it is increasingly referenced in federal contracts and several state AI laws cite the RMF as a reasonableness baseline. ISO/IEC 42001 - AI Management System Standard. ISO 42001 provides an internationally recognized standard for implementing an AI management system (AIMS) for the responsible…”