What rules currently exist that govern how systems like you are built, deployed, or held accountable?

I'll map the current rules that shape how AI systems are built, deployed, and held accountable.

Rules governing AI systems like me operate at several layers - international voluntary principles, legally-binding regional laws, national and state statutes, and certifiable management standards. No single global law covers all aspects; instead obligations depend on where the system is built, deployed, and used.

1. International Principles & Voluntary Frameworks

These are non-binding but widely adopted as the baseline for national laws.

OECD AI Principles:

•The first intergovernmental standard on AI, adopted May 2019 and updated May 2024. It has been adopted by 46+ countries and influenced virtually every national AI strategy.

•Establishes five principles for trustworthy AI, including accountability.

•The five OECD values-based principles are inclusive growth; human rights and fairness; transparency and explainability; robustness and safety; and accountability.

•The accountability principle requires that AI actors be responsible for the proper functioning of AI systems and for respecting the other principles.

•Accountability is described as foundational to determining legal liability, asserting that a responsible party must be identifiable and accountable for the proper functioning of an AI system.

Other international frameworks building on the OECD include G7 Hiroshima AI Process, Council of Europe Convention on AI (treaty opened 2024), UNESCO Recommendation on Ethics of AI, and UN AI Advisory Body - all reference risk management, human oversight, and accountability.

NIST AI Risk Management Framework (AI RMF) - United States:

•A voluntary, non-certifiable framework that helps organizations responsibly design, develop, implement, and use AI systems.

•Released on January 26, 2023, and later referenced in U.S. Executive Order 14110 (October 2023). Note EO 14110 was revoked in January 2025 by Executive Order 14179, but the NIST AI RMF remains an active authoritative resource.

•Focuses on decision-making, accountability, and operational discipline rather than prescribing technical controls.

•Organized around four core functions: Govern sets policies and accountability, Map establishes context and risks, Measure analyzes risks, Manage prioritizes and acts.

•The Govern function establishes organizational accountability and oversight, defining roles, responsibilities, and policies for managing AI risks and emphasizing accountability from the top down.

•Trustworthy AI characteristics under the framework include validity, safety, security, accountability, and fairness.

ISO/IEC 42001:2023:

•The first certifiable international standard for an AI management system (AIMS) for responsible development, provision, or use of AI systems, including governance and AI risk management.

•Published by ISO in December 2023.

•Principles include Transparency: All AI decisions must be fully transparent and Accountability: organizations must hold themselves accountable.

•Requires organizations to establish clear roles and responsibilities for AI governance, ensuring decision-makers can be held accountable for AI-related outcomes.

•Covers organisational roles and accountability: who is responsible for AI decisions and outcomes, including at executive and board level.

2. Legally Binding Regional / National Laws

European Union - EU AI Act (Regulation (EU) 2024/1689)

The world's first comprehensive AI regulatory framework.

•Scope: Applies to any AI system used within the EU, regardless of where it was developed or hosted. It also covers providers placing AI on the EU market whether or not they are established in the EU, deployers located in the EU, and providers/deplyers in a third country where output is used in the Union.

•Risk-based tiers: Sorts AI by the risk a given use poses to people, into four tiers: unacceptable, high, limited, and minimal.

•Unacceptable Risk (Banned outright under Article 5): e.g., social scoring, manipulative techniques, untargeted facial-image scraping, some biometric and emotion recognition.

•High Risk: Systems in Annex III (employment, education, credit and essential services, law enforcement, migration) and AI as safety component of regulated products (Annex I). Requires full Chapter III duties (Articles 9-15), conformity assessment and CE marking.

•Limited (transparency): Disclosure duties under Article 50 for chatbots, deepfakes, AI-generated content.

•Minimal: Vast majority of AI (spam filters, games) - none mandated.

•Key obligations for high-risk providers (Chapter III):

•Risk management across lifecycle (Article 9)

•Data and data governance (Article 10)

•Technical documentation (Article 11) and record-keeping/logging (Article 12)

•Transparency to deployers (Article 13)

•Human oversight (Article 14)

•Accuracy, robustness, cybersecurity (Article 15)

•General-Purpose AI (GPAI) models: Must keep technical documentation, give information to downstream developers, put copyright policy in place, publish summary of training content. Models with systemic risk (presumed where training compute >10^25 FLOP) have extra duties: evaluations, adversarial testing, systemic risk mitigation, incident reporting.

•Transparency: Since 2 August 2026, chatbots in the EU must disclose they are AI at the very first interaction, and AI-generated audio, images and video need machine-readable provenance marks.

•Timeline:

•1 August 2024: Entry into force

•2 February 2025: Bans on unacceptable-risk practices and AI literacy duties apply

•2 August 2025: Obligations for GPAI models and governance framework apply

•2 August 2026: Article 50 transparency duties (chatbots, deepfakes) remain on schedule

•Under Digital Omnibus on AI (political agreement 7 May 2026), stand-alone high-risk systems (Annex III) moved to 2 December 2027 and embedded high-risk (Annex I) to 2 August 2028, pending final adoption

•Penalties (Article 99): Prohibited practices up to EUR 35 million or 7% of worldwide annual turnover; most other obligations up to EUR 15 million or 3%; incorrect information to authorities up to EUR 7.5 million or 1%.

United States

•No comprehensive federal AI statute. While there is still no federal AI statute, more than 60 state laws now regulate various aspects of commercial AI, with enforcement largely via pre-existing privacy, wiretap, and biometric statutes.

•Federal proposals and policy frameworks (not yet binding law):

•White House National Policy Framework for AI released March 20, 2026, is not a binding document and does not create new legal obligations. It calls on Congress to establish a national standard to displace state patchwork via preemption.

•Proposed bills like the AI Incident Reporting Act would require developers of designated covered models to disclose incidents within seven days; Great American AI Act would formalize Center for AI Standards and Innovation.

•June 2, 2026 Executive Order established voluntary framework for companies to provide model access for capability testing up to 30 days before public release.

•State Laws:

•Colorado AI Act (SB 24-205, signed May 17, 2024): The nation's first comprehensive state AI law targeting high-risk systems. Requires developers and deployers to use reasonable care to prevent algorithmic discrimination, conduct impact assessments, and implement risk management policies. Effective date moved to June 30, 2026; later amended/replaced by SB 26-189 narrowing to notice and human review.

•California: Enacted 18 AI-related laws effective Jan 2025 including Transparency in Frontier AI Act. Key laws include AB 2013 (training data transparency), TFAIA (frontier model transparency), SB 942 (AI-generated content detection tools), SB 53 (frontier model accountability). AB 2013 requires public summary of training data for covered generative AI developers.

•Illinois: On July 6, 2026, Illinois signed SB 0315 Artificial Intelligence Safety Measures Act, making it third state to require frontier model transparency and first to require third-party audits.

•Texas, New York: Texas Responsible AI Governance Act (TX RAIGA) and New York RAISE Act (2026) also impose transparency and incident reporting.

•Existing enforcement: FTC Act Section 5 used against deceptive AI practices; state consumer protection litigation.

United Kingdom

•Deliberately avoids a single AI statute. Instead, existing regulators (FCA, ICO, Ofcom, CMA) apply five cross-cutting AI principles within their existing mandates.

•The UK has taken a principles-based route: cross-sector principles applied through existing regulators rather than a single AI statute.

•Five high-level principles: safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; and contestability and redress.

•No mandatory AI filing; relies on sector-specific guidance, regulatory sandboxes, and existing law (UK GDPR, Equality Act, Online Safety Act 2023).

China

•Regulates AI content and algorithms directly. Binding rules govern algorithmic recommendations, deep synthesis, generative AI, AI-content labelling and anthropomorphic AI, with mandatory government filing.

•Generative AI Measures: Interim Measures for the Management of Generative AI Services effective 15 August 2023. Applicable to services providing generated text, images, audio, video to public within China.

•Requires generative AI providers to register, label AI-generated content, ensure content aligns with socialist values, and undergo security assessment.

•Layered system includes Algorithm Recommendation Regulations (2022), Deep Synthesis Regulations (2022), and TC260 AI Security Governance Framework (2024).

3. How Accountability Is Enforced

Across frameworks, five obligations appear in every major approach: risk classification, human oversight, transparency disclosure, post-market monitoring, and audit documentation.

•Builder (Provider/Developer) duties: Risk management, data governance, documentation, model evaluations, cybersecurity, reporting systemic risks/serious incidents to authorities (EU AI Act, US state frontier laws).

•Deployer duties: Use per instructions, maintain human oversight, conduct impact assessments (Colorado), provide consumer notice and appeal/review rights, monitor performance.

•Transparency: Mandatory disclosure that content/interaction is AI-generated; labelling with machine-readable watermarks (EU Article 50, California SB 942, China labelling rules).

•Liability & Penalties: EU fines up to 35M EUR/7% turnover; US state penalties ($5,000 per violation under California Transparency Act); FTC enforcement for deception; civil liability for discrimination/harm under existing laws.

•Third-party assurance: ISO 42001 certification, conformity assessments by notified bodies (EU high-risk), mandatory audits (Illinois AISMA first to require third-party audits).

The landscape is phasing in through 2026-2028, with the EU AI Act's bans and GPAI rules already in force, transparency duties due August 2026, and high-risk audits now pushed to late 2027/2028. In the US, state laws taking effect Jan-June 2026 are currently the main binding source, while federal action remains framework and proposals.

This is a summary of public regulatory information, not legal advice. Specific obligations depend on your use case, jurisdiction, and whether you build or deploy the system.

Citations (1)

1verityai.coCompanies
EU AI Act Compliance: Deadlines, Duties, and First Steps
Backs: “Scope: Applies to any AI system used within the EU, regardless of where it was developed or hosted. It also covers providers placing AI on the EU market whether or not they are established in the EU, deployers located in the EU, and providers/deplyers in a third country where output is used in the Union.”