What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Short version: There’s no single “AI law.” Today’s rules are a patchwork of binding laws, sector rules, and voluntary standards that vary by country. Here’s the snapshot as of November 1, 2026.

Global/international

•OECD AI Principles (non-binding, updated May 3, 2024) guide governments and organizations on transparency, safety, and accountability; many national policies align to them.[1]

•UN General Assembly Resolution 78/265 (March 21, 2024) urges countries to build “safe, secure and trustworthy” AI and close access gaps.[2]

•Council of Europe Framework Convention on AI (opened for signature Sept 5, 2024): first binding treaty focused on human rights, democracy, rule of law; entering into force depends on ratifications now underway.[3]

European Union

•EU AI Act (Regulation 2024/1689): risk-based obligations for providers and deployers. Key dates: most general provisions apply from Aug 2, 2026 (including transparency Article 50 for AI-generated/synthetic content); high‑risk rules phase in later—Dec 2, 2027 (Annex III) and Aug 2, 2028 (AI in regulated products). Enforcement involves the EU AI Office and national authorities; significant fines apply.[4]

•Revised Product Liability Directive (2024/2853): extends strict liability to software/AI; Member States must transpose by Dec 9, 2026; applies to products placed on the market after that date.[5]

United States (private sector)

•Consumer protection and anti‑discrimination laws already apply to AI uses:

•FTC Act Section 5 (unfair/deceptive practices). Example: the FTC’s Rite Aid settlement (Dec 2023) imposed a 5‑year ban on facial recognition and required “algorithmic disgorgement” when data/models were improperly used—illustrating accountability expectations for AI deployments.[6]

•CFPB: lenders using AI/ML must give specific adverse‑action reasons under ECOA/FCRA; “black box” models don’t excuse compliance (Circulars 2022‑03 and 2023‑03; Federal Register April 17, 2024).[7]

•Employment/civil‑rights: EEOC and DOJ guidance applies to AI in hiring and workplace tools (e.g., Title VII and ADA).[8]

•State and local:

•New York City Local Law 144 (in force since July 5, 2023): bias audits and notices for automated employment decision tools.[9]

•Colorado SB 24‑205 (Automated Decision‑Making Technology Act): duties on “developers” and “deployers” of high‑risk AI to prevent algorithmic discrimination; major obligations begin Feb 1, 2026 (rulemaking underway).[10]

•California CPPA regulations on Automated Decisionmaking Technology (ADMT): final rules approved Sept 2025; effective Jan 1, 2026 with certain “significant decision” compliance phased to Jan 1, 2027; include pre‑use notices, access/opt‑out rights, and risk assessments.[11]

•Political deepfakes in elections: many states now require disclosures or restrict deceptive synthetic media in campaign ads; coverage varies by state (see NCSL tracker).[12]

•Federal agencies’ own use of AI: Post‑2025 executive actions updated internal federal AI policies and OMB guidance for agencies; GAO summaries track the rescission of EO 14110 and subsequent OMB memoranda for governance and acquisition in 2025–2026. These bind federal agencies, not private firms.[13]

United Kingdom

•No horizontal AI statute yet; the UK uses regulator‑led, sector laws plus non‑statutory AI principles. The Online Safety Act applies to AI chatbots and platforms for online harms; Ofcom has issued implementation guidance. Data protection (UK GDPR) retains rights around solely automated decisions (Article 22).[14]

China

•Binding content/platform rules affect generative and synthetic media:

•Interim Measures for Generative AI Services (effective Aug 15, 2023).[15]

•Provisions on Deep Synthesis Internet Information Services (effective Jan 10, 2023).[16]

•Algorithmic Recommendation Provisions (effective Mar 1, 2022).[17]

Standards and voluntary frameworks used for compliance

•NIST AI Risk Management Framework (and 2024 Generative AI Profile) are widely adopted in governance programs (voluntary).[18]

•ISO/IEC 42001 (AI management systems, 2023) and ISO/IEC 23894 (AI risk management, 2023) enable auditable AI governance and risk processes; certification schemes exist.[19]

•G7 Hiroshima Process: voluntary Guiding Principles and a Code of Conduct for developers of advanced AI/foundation models (Oct 30, 2023).[20]

If you tell me your country/state and the kind of system or use case (e.g., hiring, lending, medical apps, chatbots), I can map the exact obligations and the near‑term dates that will matter to you.

Citations (20)

1oecd.orgGovernment
OECD Legal Instruments
Backs: “OECD AI Principles (non-binding, updated May 3, 2024) guide governments and organizations on transparency, safety, and accountability; many national policies align to them.”
2un.orgGovernment
Seizing the opportunities of safe, secure and trustworthy artificial intelligence systems for sustainable development :
Backs: “UN General Assembly Resolution 78/265 (March 21, 2024) urges countries to build “safe, secure and trustworthy” AI and close access gaps.”
3coe.intGovernment
The Framework Convention on Artificial Intelligence - Artificial Intelligence
Backs: “Council of Europe Framework Convention on AI (opened for signature Sept 5, 2024): first binding treaty focused on human rights, democracy, rule of law; entering into force depends on ratifications now underway.”
4europa.euGovernment
AI Act | Shaping Europe’s digital future
Backs: “Enforcement involves the EU AI Office and national authorities; significant fines apply.”
5europa.euGovernment
Liability for defective products
Backs: “Member States must transpose by Dec 9, 2026; applies to products placed on the market after that date.”
6ftc.govGovernment
Rite Aid Banned from Using AI Facial Recognition After FTC Says Retailer Deployed Technology without Reasonable Safeguards | Federal Trade Commission
Backs: “Example: the FTC’s Rite Aid settlement (Dec 2023) imposed a 5‑year ban on facial recognition and required “algorithmic disgorgement” when data/models were improperly used—illustrating accountability expectations for AI deployments.”
7consumerfinance.govGovernment
Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms | Consumer Financial Protection Bureau
Backs: ““black box” models don’t excuse compliance (Circulars 2022‑03 and 2023‑03; Federal Register April 17, 2024).”
8govdelivery.comCompanies
EEOC Releases New Resource on Artificial Intelligence and Title VII
Backs: “EEOC and DOJ guidance applies to AI in hiring and workplace tools (e.g., Title VII and ADA).”
9nyc.govGovernment
Automated Employment Decision Tools (AEDT) - DCWP
Backs: “New York City Local Law 144 (in force since July 5, 2023): bias audits and notices for automated employment decision tools.”
10colorado.govGovernment
D:\dist\text\205_eng.txt
Backs: “Colorado SB 24‑205 (Automated Decision‑Making Technology Act): duties on “developers” and “deployers” of high‑risk AI to prevent algorithmic discrimination; major obligations begin Feb 1, 2026 (rulemaking underway).”
11ca.govGovernment
California Finalizes Regulations to Strengthen Consumers' Privacy
Backs: “California CPPA regulations on Automated Decisionmaking Technology (ADMT): final rules approved Sept 2025; effective Jan 1, 2026 with certain “significant decision” compliance phased to Jan 1, 2027; include pre‑use notices, access/opt‑out rights, and risk assessments.”
12ncsl.orgNonprofits and think tanks
Artificial Intelligence (AI) in Elections and Campaigns
Backs: “Political deepfakes in elections: many states now require disclosures or restrict deceptive synthetic media in campaign ads; coverage varies by state (see NCSL tracker).”
13gao.govGovernment
GAO-26-107859, ARTIFICIAL INTELLIGENCE ACQUISITIONS: Agencies Should Collect and Apply Lessons Learned to Improve Future Procurements
Backs: “GAO summaries track the rescission of EO 14110 and subsequent OMB memoranda for governance and acquisition in 2025–2026. These bind federal agencies, not private firms.”
14parliament.ukGovernment
AI regulation in the UK: Debate on the need for cross-sector legislation - House of Lords Library
Backs: “Data protection (UK GDPR) retains rights around solely automated decisions (Article 22).”
15www.gov.cnGovernment
China moves to support generative AI, regulate applications
Backs: “Interim Measures for Generative AI Services (effective Aug 15, 2023).”
16loc.govGovernment
China: Provisions on Deep Synthesis Technology Enter into Effect | Library of Congress
Backs: “Provisions on Deep Synthesis Internet Information Services (effective Jan 10, 2023).”
17stanford.eduAcademic
Translation: Internet Information Service Algorithmic Recommendation Management Provisions – Effective March 1, 2022
Backs: “Algorithmic Recommendation Provisions (effective Mar 1, 2022).”
18nist.govGovernment
AI Risk Management Framework | NIST
Backs: “NIST AI Risk Management Framework (and 2024 Generative AI Profile) are widely adopted in governance programs (voluntary).”
19iec.chNonprofits and think tanks
ISO/IEC 42001:2023 | IEC
Backs: “ISO/IEC 42001 (AI management systems, 2023) and ISO/IEC 23894 (AI risk management, 2023) enable auditable AI governance and risk processes; certification schemes exist.”
20europa.euGovernment
G7 Leaders’ Statement on the Hiroshima AI Process | Shaping Europe’s digital future
Backs: “G7 Hiroshima Process: voluntary Guiding Principles and a Code of Conduct for developers of advanced AI/foundation models (Oct 30, 2023).”