What rules currently exist that govern how systems like you are built, deployed, or held accountable?
Short answer: There isn’t one single global “AI law.” What governs how systems like me are built, deployed, and held accountable is a patchwork of binding laws, regulator guidance, procurement rules, and de facto standards. Here are the main ones in force today (as of November 4, 2026), with concrete dates.
United States (federal)
United States (state and local)
European Union
United Kingdom
Canada
China
Cross‑border frameworks and norms
De facto standards and certifications (increasingly used by regulators, buyers, and auditors)
What this means in practice if you’re building or deploying AI today (especially in the U.S.)
If you tell me where you operate and what your system does (e.g., hiring, lending, health, ad delivery, chatbots), I can map the specific rules and dates that apply and draft a concrete compliance checklist. I’m not a lawyer, but I can point you to the right primary sources quickly.
Citations (24)
- iii. **Compliance Plans.** Consistent with Section 104(c) and (d) of the AI in Government Act of 2020, within 180 days of the issuance of this memorandum or any update to this memorandum, and every two years thereafter until 2036, each agency must submit to OMB and post publicly on the agency’s website either a plan to achieve consistency with this memorandum, or a written determination that the agency does not use and does not anticipate using covered AI. Agencies must also include plans to update any existing internal AI principles and guidelines to ensure consistency with this memorandum.¹¹ OMB will provide templates for these compliance plans.
Backs: “See M‑24‑10 (Mar 28, 2024) and follow‑ons M‑25‑21 (Apr 3, 2025), M‑24‑18/M‑25‑22 (AI acquisition), and M‑26‑04 (Dec 11, 2025). Agencies are actively implementing them.”
- FTC Warns About Misuses of Biometric Information and Harm to Consumers | Federal Trade Commission
Backs: “FTC uses Section 5 (unfair/deceptive practices) against misleading AI claims and harmful biometric uses; it issued a biometric policy statement and has brought cases involving face recognition.”
- Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms | Consumer Financial Protection Bureau
Backs: “CFPB says lenders using complex/“black box” models still owe specific adverse‑action reasons under ECOA/Reg B. That applies regardless of the tech used.”
- U.S. EEOC and U.S. Department of Justice Warn against Disability Discrimination | U.S. Equal Employment Opportunity Commission
Backs: “EEOC/DOJ have warned employers that AI in hiring must comply with civil‑rights and disability laws; the EEOC published technical assistance on “assessing adverse impact” (May 18, 2023).”
- Office of Public Affairs | Justice Department Secures Groundbreaking Settlement Agreement with Meta Platforms, Formerly Known as Facebook, to Resolve Allegations of Discriminatory Advertising | United States Department of Justice
Backs: “DOJ/Fair Housing Act: first algorithmic discrimination case against Meta’s ad delivery led to a court settlement requiring changes and ongoing monitoring. HUD has since issued guidance for digital ad platforms.”
- AI Risk Management Framework | NIST
Backs: “Jan 26, 2023) and its Generative AI Profile (Jul 26, 2024); NIST/AISI is also running AI evaluation programs.”
- California Finalizes Regulations to Strengthen Consumers' Privacy
Backs: “Some ADMT compliance dates stagger into 2027 for “significant decisions.””
- SENATE BILL 24-205
Backs: “In May 2026, Colorado also passed a “Chatbot Safety Act” adding safeguards for minors’ interactions with conversational AI.”
- Automated Employment Decision Tools (AEDT) - DCWP
Backs: “Local Law 144 (effective July 2023) requires annual bias audits and notices before employers use automated employment decision tools.”
- Illinois General Assembly - BUSINESS AND EMPLOYMENT - EMPLOYMENT
Backs: “Illinois: the AI Video Interview Act (since 2020) requires disclosure/consent for AI analysis of video interviews; and Illinois’ Biometric Information Privacy Act (BIPA) has been a powerful accountability tool for face/voice/fingerprint uses (in 2023 the state supreme court held each scan can trigger a separate claim).”
- AI Act enters into force
Backs: “Enforcement is shared by the Commission’s AI Office and national authorities.”
- Digital Services Act | EUR-Lex
Backs: “Very Large Online Platforms/Search Engines (VLOPs/VLOSEs) must do annual systemic risk assessments, adapt recommender systems, and undergo independent audits—these obligations directly touch AI‑driven ranking/recommendation.”
- Directive - 2024/2853 - EN - Product Liability Directive - EUR-Lex
Backs: “Directive 2024/2853, adopted Oct 23, 2024): extends strict liability to software and AI‑enabled products, clarifies disclosure and burden‑of‑proof rules for complex technologies; the Commission withdrew its separate AI Liability Directive proposal in 2025.”
- A pro-innovation approach to AI regulation - GOV.UK
Backs: “The UK AI Safety Institute leads testing/evaluation but its guidance is non‑statutory.”
- Dentons - Doing business in Canada: Artificial intelligence and data
Backs: “The proposed Artificial Intelligence and Data Act (AIDA, part of Bill C‑27) died on the order paper when Parliament was prorogued on Jan 6, 2025 and has not been reintroduced.”
- Guide on the Scope of the Directive on Automated Decision-Making - Canada.ca
Backs: “Binding for Canadian federal government use: the Treasury Board of Canada Secretariat’s Directive on Automated Decision‑Making (since Apr 1, 2020; updated 2023) requires an Algorithmic Impact Assessment, testing, explainability documentation, and public notice before launch of ADM systems.”
- Translation: Internet Information Service Algorithmic Recommendation Management Provisions – Effective March 1, 2022
Backs: “Algorithmic Recommendation Provisions (effective Mar 1, 2022) require filing/registration, user opt‑outs from profiling, security self‑assessments, and content controls.”
- China: Provisions on Deep Synthesis Technology Enter into Effect | Library of Congress
Backs: “Deep Synthesis (deepfake) Provisions (effective Jan 10, 2023) impose labelling, consent, security and takedown duties on providers.”
- Interim Measures for the Management of Generative Artificial Intelligence Services (EN).docx
Backs: “Interim Measures for Generative AI Services (effective Aug 15, 2023) set requirements for training data legality, safety assessments, and content moderation.”
- Committee on Artificial Intelligence (CAI) - Artificial Intelligence
Backs: “Council of Europe Framework Convention on AI, Human Rights, Democracy and Rule of Law: first binding international AI treaty; adopted May 17, 2024; opened for signature Sept 5, 2024; now open to ratification.”
- OECD Legal Instruments
Backs: “OECD AI Principles (2019; updated guidance 2024): non‑binding but widely referenced by governments and companies.”
- Seizing the opportunities of safe, secure and trustworthy artificial intelligence systems for sustainable development :
Backs: “UN General Assembly AI resolution (Mar 21, 2024) calls for safe, secure, trustworthy AI aligned with human rights and sustainable development.”
- ISO/IEC 42001:2023 - AI management systems
Backs: “These don’t replace law, but they’re becoming the baseline for audits, contracts, and procurement.”
- Timeline - Artificial intelligence - Consilium
Backs: “If you serve the EU market, plan for the AI Act’s phased duties (transparency already applying, high‑risk compliance by late‑2027/2028), DSA platform obligations if you’re large, and product‑liability exposure for defective software/AI.”