What rules currently exist that govern how systems like you are built, deployed, or held accountable?
A mix of binding laws, voluntary frameworks, executive actions, and international principles currently govern the building, deployment, and accountability of AI systems (including large language models and general-purpose AI like me). These vary significantly by jurisdiction, with a risk-based approach common in many places. There is no single global binding regime; instead, a fragmented landscape emphasizes safety, transparency, fairness, human oversight, risk management, and fundamental rights. Regulations often distinguish providers/developers (who build models) from deployers (who use them), and target high-risk or frontier systems more heavily.[1]
European Union: The Most Comprehensive Binding Framework
The EU AI Act (Regulation (EU) 2024/1689) is the world’s first major horizontal, risk-based AI law. It entered into force on 1 August 2024, with phased application: prohibitions and AI literacy from February 2025; general-purpose AI (GPAI) model rules from August 2025; most other rules (including transparency) from August 2026; and high-risk system obligations later (e.g., Annex III from December 2027, with some adjustments via later Omnibus amendments).[2][2]
It classifies AI by risk:
GPAI models (including those with systemic risk, presumed for models trained with >10²⁵ FLOPs or equivalent high-impact capabilities) face transparency obligations (technical documentation, training data summaries, copyright compliance, info for downstream providers). Systemic-risk models require additional evaluations, adversarial testing, risk assessment/mitigation, and incident reporting. The AI Office enforces GPAI rules; national authorities and market surveillance handle others. Fines can reach €35 million or 7% of worldwide annual turnover.[5][6]
Exemptions exist for military/defence, pure research, and certain open-source cases. Standards and codes of practice support compliance.
United States: Patchwork of Federal Guidance, State Laws, and Sectoral Rules
There is no comprehensive federal AI statute. Governance relies on executive orders, voluntary frameworks, existing laws (e.g., FTC Act against unfair/deceptive practices, civil rights laws against bias/discrimination, sector-specific rules in finance/health/employment), and a growing set of state laws. Federal policy has shifted toward innovation and security with voluntary elements, alongside efforts to address state-level fragmentation.[7][8]
China: Sectoral Binding Rules Focused on Content, Algorithms, and Public Services
China has extensive binding rules (no single comprehensive AI law yet, though drafts exist) via the Cyberspace Administration of China (CAC) and others, layered on cybersecurity, data security, and personal information laws. Key instruments:[18]
Focus is on content safety, social stability, filing, and labelling rather than broad risk categories like the EU.
United Kingdom and Other Approaches
The UK uses a pro-innovation, principles-based approach without a comprehensive AI Act. Five non-statutory principles (safety/security/robustness; transparency/explainability; fairness; accountability/governance; contestability/redress) are applied by existing regulators (ICO for data protection, FCA/PRA for finance, MHRA for medical devices, etc.). Binding elements include UK GDPR automated decision-making rules (with safeguards), Online Safety Act updates, and voluntary AI Cyber Security Code of Practice (now a European standard). Sector-specific guidance, sandboxes, and an AI Security Institute address frontier risks. Calls exist for stronger dedicated legislation.[22][23]
Other countries have national strategies, sectoral rules, or deepfake laws. Many align with international norms.
International Soft Law and Principles
Accountability Mechanisms
Accountability typically involves:
In practice for systems like me (general-purpose/frontier LLMs): Providers face documentation, risk mitigation (especially catastrophic/systemic), labelling of outputs, copyright/data compliance, and incident reporting in major jurisdictions (EU GPAI, CA/NY frontier rules, China generative measures). Deployers handle use-case-specific risks (e.g., high-risk decisions). Existing laws on defamation, privacy, bias, and consumer protection apply universally. Rules evolve rapidly with technology, court cases, and geopolitics; voluntary frameworks like NIST RMF often guide “best practices” even where not mandated. For the latest or jurisdiction-specific advice, consult primary sources or legal experts, as this is a high-level overview of the current landscape (as of late 2026 information).
Citations (26)
- https://eur-lex.europa.eu/EN/legal-content/summary/rules-for-trustworthy-artificial-intelligence-in-the-eu.html
Backs: “Regulations often distinguish providers/developers (who build models) from deployers (who use them), and target high-risk or frontier systems more heavily.”
- https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
Backs: “It entered into force on 1 August 2024, with phased application: prohibitions and AI literacy from February 2025; general-purpose AI (GPAI) model rules from August 2025; most other rules (including transparency) from August 2026; and high-risk system obligations later (e.g., Annex III from December 2027, with some…”
- https://artificialintelligenceact.eu/high-level-summary/
Backs: “Deployers have duties like following instructions, human oversight, logging, and (in some cases) fundamental rights impact assessments.”
- https://sysart.consulting/eu-ai-act/high-risk-ai-systems/
Backs: “Deployers have duties like following instructions, human oversight, logging, and (in some cases) fundamental rights impact assessments.”
- https://docs.modulos.ai/frameworks/eu-ai-act/general-purpose-ai-models
Backs: “Fines can reach €35 million or 7% of worldwide annual turnover.”
- https://www.aigl.blog/european-union-artificial-intelligence-act-a-guide/
Backs: “Fines can reach €35 million or 7% of worldwide annual turnover.”
- https://www.jdsupra.com/legalnews/ai-watch-global-regulatory-tracker-2931403/
Backs: “Federal policy has shifted toward innovation and security with voluntary elements, alongside efforts to address state-level fragmentation.”
- https://gaeedu.org/ai-governance-profiles/united-states
Backs: “Federal policy has shifted toward innovation and security with voluntary elements, alongside efforts to address state-level fragmentation.”
- https://www.nist.gov/itl/ai-risk-management-framework
Backs: “Crosswalks exist to other frameworks (EU AI Act, OECD). It is being revised.”
- https://quality.arc42.org/standards/nist-ai-rmf
Backs: “Crosswalks exist to other frameworks (EU AI Act, OECD). It is being revised.”
- https://www.whitehouse.gov/presidential-actions/2025/12/eliminating-state-law-obstruction-of-national-artificial-intelligence-policy/?query-11-page=5&trk=article-ssr-frontend-pulse_little-text-block
Backs: “Later Trump administration orders (e.g., 2025–2026) emphasize innovation, removing barriers, national policy frameworks to counter conflicting state laws (via litigation task forces and legislative recommendations for preemption), cybersecurity hardening, and voluntary pre-release engagement/frameworks for “covered…”
- https://www.congress.gov/crs-product/IF13268
Backs: “Later Trump administration orders (e.g., 2025–2026) emphasize innovation, removing barriers, national policy frameworks to counter conflicting state laws (via litigation task forces and legislative recommendations for preemption), cybersecurity hardening, and voluntary pre-release engagement/frameworks for “covered…”
- https://www.cognativ.com/blog/us-pre-release-ai-model-reviews/
Backs: “Later Trump administration orders (e.g., 2025–2026) emphasize innovation, removing barriers, national policy frameworks to counter conflicting state laws (via litigation task forces and legislative recommendations for preemption), cybersecurity hardening, and voluntary pre-release engagement/frameworks for “covered…”
- https://www.reuters.com/practical-law-the-journal/transactional/state-ai-laws-assessing-regulatory-risk-2025-01-06/
Backs: “Duties for developers/deployers of high-risk systems making consequential decisions (e.g., employment, lending, housing, healthcare); risk management, notices, explanations, human review, documentation.”
- https://nhimg.org/us-state-ai-laws-tracker-guide
Backs: “Duties for developers/deployers of high-risk systems making consequential decisions (e.g., employment, lending, housing, healthcare); risk management, notices, explanations, human review, documentation.”
- https://www.aei.org/wp-content/uploads/2026/10/Regulating-the-Frontier.pdf?x95787
Backs: “Also AI content transparency/disclosure (SB 942), government AI accountability, deepfake/election integrity rules, and more.”
- https://www.mondaq.com/unitedstates/new-technology/1689308/california-adopts-landmark-ai-law-new-transparency-safety-and-reporting-requirements-for-frontier-model-developers
Backs: “Also AI content transparency/disclosure (SB 942), government AI accountability, deepfake/election integrity rules, and more.”
- https://www.deep-lex.com/ai-regulation-tracker/china
Backs: “China has extensive binding rules (no single comprehensive AI law yet, though drafts exist) via the Cyberspace Administration of China (CAC) and others, layered on cybersecurity, data security, and personal information laws. Key instruments:”
- https://iapp.org/resources/article/global-ai-governance-china/
Backs: “For public-facing generative AI—security assessments, algorithm filing/registration with CAC, training data legality/quality, content compliance with “core socialist values” (no prohibited content), labelling, user protections, IP/privacy safeguards, transparency. Thousands of services filed.”
- https://casrai.org/guides/china-ai-regulation-explained
Backs: “Explicit (visible/audible) and implicit (metadata/watermarks) labels required; platforms must detect/preserve them. Active enforcement.”
- https://www.china-briefing.com/news/china-ai-regulations-2026-enforcement-guidance-compliance/
Backs: “Algorithmic recommendation rules, cybersecurity law updates (AI provisions effective 2026), export controls on advanced models/tech, and judicial opinions on AI disputes (tort, IP, liability, notice-and-takedown).”
- https://www.flowingmind.co.uk/insights/uk-ai-regulation-2026/
Backs: “Sector-specific guidance, sandboxes, and an AI Security Institute address frontier risks. Calls exist for stronger dedicated legislation.”
- https://nhimg.org/uk-ai-regulation-guide
Backs: “Sector-specific guidance, sandboxes, and an AI Security Institute address frontier risks. Calls exist for stronger dedicated legislation.”
- https://regulations.ai/regulations/RAI-XO-GO-SUMMARY-2026
Backs: “Influential on national policies and the EU AI Act; includes due diligence guidance. Adhered to by dozens of countries.”
- https://unctad.org/system/files/non-official-document/ppt_ai-g_04_tou.pdf
Backs: “These promote cooperation, risk-based approaches, and standards but are non-binding.”
- https://www.actuia.com/en/news/ai-regulation-the-global-situation/
Backs: “These promote cooperation, risk-based approaches, and standards but are non-binding.”