What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Short answer: There isn’t one single “AI law.” Today’s rules are a patchwork of binding laws, agency guidance, procurement rules, platform rules, and voluntary standards that together govern how systems like me are built, deployed, and held accountable. Here are the most important pieces in force now (United States first), with dates so you can see what’s current.

United States (federal)

•Federal agencies’ use of AI: OMB’s M‑24‑10 (Mar 28, 2024) requires every executive agency to inventory “rights- and safety-impacting” AI, apply minimum risk‑management practices, publish use cases, and appoint a Chief AI Officer. OMB’s follow‑on M‑24‑18 (Oct 2024) sets acquisition and contracting expectations so vendors meet those risk‑management requirements.[1]

•Consumer protection and civil‑rights enforcement using existing laws:

•CFPB says lenders using complex/“black‑box” models still must give specific adverse‑action reasons under ECOA/Reg B (2022, updated 2024). This effectively bans inscrutable credit models that can’t explain denials.[2]

•EEOC and DOJ/ADA guidance make clear that employers remain liable under Title VII/ADA when hiring tools cause disparate impact or screen out people with disabilities.[3]

•FTC continues to police unfair or deceptive AI claims under Section 5 and in 2026 proposed a policy statement clarifying how Section 5 applies to AI model marketing and accuracy claims.[4]

•Copyright and AI: The U.S. Copyright Office’s policy (effective Mar 16, 2023; reports updated Jan 29, 2025) says only human‑authored expression is copyrightable; AI‑generated portions must be disclosed and disclaimed on registration.[5]

•Note on “frontier model” reporting: The 2023 Executive Order 14110 (Oct 30, 2023) directed Commerce to propose reporting for very large training runs and compute clusters; it was later rescinded in Jan 2025 and replaced by a new directive to develop an AI policy action plan. Treat any EO‑14110 reporting obligations as no longer in force unless re‑issued.[6]

United States (state and local)

•Colorado AI Act (SB24‑205): first broad U.S. consumer‑protection law for “high‑risk AI” in consequential decisions; duties for developers and deployers to prevent algorithmic discrimination, with an extended effective date to June 30, 2026. The AG has also flagged a 2026 “Chatbot Safety Act” covering disclosures and minor protections.[7]

•California privacy rules for ADMT: The California Privacy Protection Agency adopted Automated Decisionmaking Technology regulations (Board approval July 24, 2025; effective Jan 1, 2026; compliance for “significant decisions” by Jan 1, 2027). They create pre‑use notice, access and opt‑out rights, and require risk assessments.[8]

•NYC Local Law 144 (automated hiring tools): Since July 5, 2023, employers using AEDTs for hiring/promotion in NYC need an annual independent bias audit and candidate notices; audit results must be posted.[9]

•Biometric privacy: Illinois’ BIPA (still the most stringent, with a private right of action) continues to drive compliance and litigation around face/voice/fingerprint data.[10]

•Election deepfakes: Dozens of states now regulate AI‑generated political content (temporary bans near elections or mandatory disclosures). Details vary by state and face First Amendment litigation; check the latest NCSL tracker.[11]

European Union

•EU AI Act (Regulation (EU) 2024/1689): Entered into force Aug 1, 2024. General transparency duties (e.g., chatbot disclosures, deepfake labeling, some GPAI duties) apply from Aug 2, 2026. High‑risk obligations phase in later: Annex III “stand‑alone” high‑risk systems from Dec 2, 2027; high‑risk AI embedded in regulated products from Aug 2, 2028. An EU AI Office coordinates enforcement.[12]

•Transparency for synthetic media: Commission guidance under the AI Act and complementary DSA risk‑mitigation guidelines require labeling of deepfakes and set expectations for VLOPs during elections.[13]

•Product liability update: The new Product Liability Directive (adopted Oct 23, 2024) explicitly covers software and AI systems; Member States must transpose by Dec 9, 2026—strengthening routes to compensation for harm from defective AI.[14]

United Kingdom

•No horizontal AI statute yet; the government’s “pro‑innovation” approach (Feb 2024 response) asks existing regulators (ICO, FCA, CMA, etc.) to apply five cross‑cutting principles (safety, transparency, fairness, accountability, contestability). The UK AI Safety Institute runs evaluations of advanced models but these are not statutory obligations on developers.[15]

Canada

•No general AI law currently in force. The proposed Artificial Intelligence and Data Act (AIDA, in Bill C‑27) did not become law. The federal government instead issued a voluntary Code of Conduct for advanced generative AI (Sept 2023) and detailed implementation guidance.[16]

•Public‑sector AI: Since 2019, the Treasury Board’s Directive on Automated Decision‑Making requires federal departments to complete Algorithmic Impact Assessments, publish them, and add safeguards (human review, explanations) scaled to risk before using automated decision systems.[17]

China

•Binding, AI‑specific internet rules include: Algorithmic Recommendation Provisions (effective Mar 1, 2022), Deep Synthesis Provisions (effective Jan 10, 2023), and Measures for Generative AI Services (2023). They impose filing, identity verification, content labeling, security, and other duties on providers.[18]

Cross‑cutting privacy and anti‑discrimination rules that bite AI

•EU GDPR limits solely automated, consequential decisions and requires transparency and human intervention rights; similar provisions remain under UK GDPR.[19]

•U.S. sectoral laws (ECOA/Reg B, FCRA, COPPA, HIPAA, etc.) and state privacy laws (e.g., California CCPA/CPRA with ADMT rules) already govern data use, explanations, adverse actions, and children’s privacy when AI is involved.[8]

Assurance frameworks and standards used for compliance

•NIST AI Risk Management Framework 1.0 (Jan 2023) and its Generative AI Profile (2025) are widely referenced by regulators and buyers as “how‑to” for trustworthy AI.[20]

•ISO/IEC 42001:2023 (AI management systems) and ISO/IEC 23894:2023 (AI risk management) provide auditable governance/risk frameworks; many organizations are certifying to 42001 to show due diligence.[21]

International soft law (non‑binding but influential)

•OECD AI Principles (2019, updated materials 2024) underpin many national policies.[22]

•G7 Hiroshima Process (2023) produced non‑binding guiding principles and a Code of Conduct for developers of advanced AI; OECD now runs a reporting framework.[23]

•UN General Assembly Resolution A/RES/78/265 (Mar 21, 2024) calls for safe, secure, trustworthy AI aligned with human rights—symbolically important but not binding.[24]

What this means in practice if you build or deploy AI in 2026

•Expect to do risk assessments, document your system, and give clear notices and rights (access/opt‑out/human review) at least in California, the EU, and for U.S. federal agency customers.[8]

•If you hire with algorithms in NYC, get an annual independent bias audit and publish the summary.[9]

•Label deepfakes/synthetic media in the EU, and check U.S. state election‑deepfake laws before political or public‑interest campaigns.[13]

•For credit, housing, employment, or health uses, be ready to explain decisions and show your model doesn’t unlawfully discriminate.[2]

•Consider aligning with NIST AI RMF and ISO/IEC 42001/23894 to demonstrate governance and due care to customers and regulators.[20]

If you want, tell me your sector and where you operate, and I’ll translate this into a concrete compliance checklist and timeline.

Citations (24)

1whitehouse.govGovernment
EXECUTIVE OFFICE OF THE PRESIDENT
Backs: “OMB’s follow‑on M‑24‑18 (Oct 2024) sets acquisition and contracting expectations so vendors meet those risk‑management requirements.”
2consumerfinance.govGovernment
Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms | Consumer Financial Protection Bureau
Backs: “This effectively bans inscrutable credit models that can’t explain denials.”
3govdelivery.comCompanies
EEOC Releases New Resource on Artificial Intelligence and Title VII
Backs: “EEOC and DOJ/ADA guidance make clear that employers remain liable under Title VII/ADA when hiring tools cause disparate impact or screen out people with disabilities.”
4thefederalregister.orgLow provenance
Policy Statement Concerning the Suppression of Accuracy in Artificial Intelligence Systems | 91 FR 41638
Backs: “FTC continues to police unfair or deceptive AI claims under Section 5 and in 2026 proposed a policy statement clarifying how Section 5 applies to AI model marketing and accuracy claims.”
5govinfo.govGovernment
88 FR 16190 - Copyright Registration Guidance: Works Containing Material Generated by Artificial Intelligence - Content Details - 2023-05321
Backs: “AI‑generated portions must be disclosed and disclaimed on registration.”
6nist.govGovernment
Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence | NIST
Backs: “Treat any EO‑14110 reporting obligations as no longer in force unless re‑issued.”
7colorado.govGovernment
Overview of Artificial Intelligence
Backs: “The AG has also flagged a 2026 “Chatbot Safety Act” covering disclosures and minor protections.”
8ca.govGovernment
CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology (ADMT), and Insurance Regulations - California Privacy Protection Agency (CPPA)
Backs: “They create pre‑use notice, access and opt‑out rights, and require risk assessments.”
9nyc.govGovernment
Automated Employment Decision Tools (AEDT) - DCWP
Backs: “Since July 5, 2023, employers using AEDTs for hiring/promotion in NYC need an annual independent bias audit and candidate notices; audit results must be posted.”
10ilga.govGovernment
Illinois General Assembly - Illinois Compiled Statutes - Full Text
Backs: “Illinois’ BIPA (still the most stringent, with a private right of action) continues to drive compliance and litigation around face/voice/fingerprint data.”
11ncsl.orgNonprofits and think tanks
Artificial Intelligence (AI) in Elections and Campaigns
Backs: “Details vary by state and face First Amendment litigation; check the latest NCSL tracker.”
12europa.euGovernment
AI Act | Shaping Europe’s digital future
Backs: “Annex III “stand‑alone” high‑risk systems from Dec 2, 2027; high‑risk AI embedded in regulated products from Aug 2, 2028. An EU AI Office coordinates enforcement.”
13europa.euGovernment
Guidelines on transparency obligations for providers and deployers of certain AI systems | Shaping Europe’s digital future
Backs: “Commission guidance under the AI Act and complementary DSA risk‑mitigation guidelines require labeling of deepfakes and set expectations for VLOPs during elections.”
14europa.euGovernment
Directive - 2024/2853 - EN - Product Liability Directive - EUR-Lex
Backs: “Member States must transpose by Dec 9, 2026—strengthening routes to compensation for harm from defective AI.”
15gov.ukGovernment
A pro-innovation approach to AI regulation: government response - GOV.UK
Backs: “The UK AI Safety Institute runs evaluations of advanced models but these are not statutory obligations on developers.”
16dentons.comCompanies
Dentons - Doing business in Canada: Artificial intelligence and data
Backs: “The federal government instead issued a voluntary Code of Conduct for advanced generative AI (Sept 2023) and detailed implementation guidance.”
17canada.caGovernment
Directive on Automated Decision-Making- Canada.ca
Backs: “Since 2019, the Treasury Board’s Directive on Automated Decision‑Making requires federal departments to complete Algorithmic Impact Assessments, publish them, and add safeguards (human review, explanations) scaled to risk before using automated decision systems.”
18cac.gov.cnGovernment
互联网信息服务算法推荐管理规定_中央网络安全和信息化委员会办公室
Backs: “They impose filing, identity verification, content labeling, security, and other duties on providers.”
19europa.euGovernment
Information for individuals - European Commission
Backs: “EU GDPR limits solely automated, consequential decisions and requires transparency and human intervention rights; similar provisions remain under UK GDPR.”
20nist.govGovernment
Artificial Intelligence Risk Management Framework (AI RMF 1.0) | NIST
Backs: “NIST AI Risk Management Framework 1.0 (Jan 2023) and its Generative AI Profile (2025) are widely referenced by regulators and buyers as “how‑to” for trustworthy AI.”
21iso.orgNonprofits and think tanks
ISO/IEC 42001:2023 - AI management systems
Backs: “ISO/IEC 42001:2023 (AI management systems) and ISO/IEC 23894:2023 (AI risk management) provide auditable governance/risk frameworks; many organizations are certifying to 42001 to show due diligence.”
22oecd.orgGovernment
OECD Legal Instruments
Backs: “OECD AI Principles (2019, updated materials 2024) underpin many national policies.”
23mofa.go.jpGovernment
G7 Leaders' Statement on the Hiroshima AI Process | Ministry of Foreign Affairs of Japan
Backs: “G7 Hiroshima Process (2023) produced non‑binding guiding principles and a Code of Conduct for developers of advanced AI; OECD now runs a reporting framework.”
24un.orgGovernment
Seizing the opportunities of safe, secure and trustworthy artificial intelligence systems for sustainable development :
Backs: “UN General Assembly Resolution A/RES/78/265 (Mar 21, 2024) calls for safe, secure, trustworthy AI aligned with human rights—symbolically important but not binding.”