What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Short answer: there isn’t one global rulebook yet. Today it’s a patchwork of binding laws and regulations, sector rules, and widely used standards. Here’s the current landscape (as of November 5, 2026).

European Union

•EU AI Act (Regulation (EU) 2024/1689): risk‑based rules with staged start dates. Key pieces already in force include prohibitions and transparency duties; obligations for general‑purpose AI (GPAI) providers apply, with high‑risk system duties phased in through December 2, 2027 (stand‑alone high‑risk) and August 2, 2028 (high‑risk embedded in products). An EU AI Office coordinates enforcement with national authorities.[1]

•GPAI‑specific duties: providers must keep technical docs, adopt a copyright‑compliance policy (including honoring text‑and‑data‑mining opt‑outs), and publish a “sufficiently detailed summary” of training content using an official template. These obligations apply to open‑source GPAI too.[2]

•Broader digital rules that affect AI deployments:

•Digital Services Act (DSA): risk assessments, transparency for recommender systems/ads, and annual reports; enhanced obligations for very‑large platforms/search engines.[3]

•Updated Product Liability Directive (2024/2853): makes software (including AI systems) expressly in scope of EU‑wide strict liability for defective products.[4]

United States (no single federal AI statute; enforcement relies on existing laws, sector rules, and federal IT policy)

•Federal agencies’ own use of AI: OMB Memorandum M‑24‑10 requires every agency to govern, inventory, and assess “safety‑impacting” and “rights‑impacting” AI, designate a Chief AI Officer, and follow minimum risk‑management practices; a companion memo (M‑24‑18) adds AI‑specific acquisition controls. Executive Order 14110 (Oct 30, 2023) guided this work but was rescinded on Jan 20, 2025; the OMB requirements remain operative.[5]

•Consumer protection and civil‑rights enforcement:

•FTC uses Section 5 (unfair/deceptive acts) against deceptive AI claims (“AI‑washing”), biometric misuses, and misleading performance assertions; it launched “Operation AI Comply” in 2024 and in 2026 proposed a policy statement on AI accuracy claims.[6]

•SEC brought the first “AI‑washing” cases in March 2024 against investment advisers for misleading statements about AI use.[7]

•EEOC has made clear that Title VII and the ADA apply when employers use AI in hiring or employment decisions, with technical assistance on adverse impact and disability‑related screening.[8]

•Sector rules example (health): FDA finalized guidance on Predetermined Change Control Plans so AI‑enabled medical devices can update models under a pre‑cleared plan; additional updates issued in 2025.[9]

•State and local:

•California CPPA regulations (effective Jan 1, 2026) add duties for Automated Decisionmaking Technology (ADMT): pre‑use notice, access rights, opt‑out for significant decisions, plus mandatory risk assessments and annual cyber audits for some businesses.[10]

•Colorado’s Automated Decision‑Making Technology Act (SB 24‑205) targets algorithmic discrimination in “consequential decisions,” with rulemaking ongoing toward 2026; Colorado’s privacy rules also regulate profiling that produces legal or similarly significant effects.[11]

•New York City Local Law 144 (since 2023): bias audits and notices for automated employment decision tools used in NYC.[12]

United Kingdom

•Online Safety Act (2023) now rolling out via Ofcom codes. Platforms must assess and mitigate risks (including from algorithms) related to illegal content and protecting children, maintain records, and publish transparency reports—including information about recommendation systems.[13]

China

•Binding “deep synthesis” rules (in force since Jan 10, 2023) require labeling of synthetic media, real‑name user verification, content review, and algorithm filing for services with public‑opinion reach; generative‑AI measures (effective Aug 15, 2023) set additional provider obligations.[14]

International soft law (widely referenced by companies and governments)

•G7 Hiroshima Process: non‑binding international Guiding Principles and a voluntary Code of Conduct for developers of advanced AI; the OECD runs a public reporting framework to monitor adoption.[15]

•OECD AI Principles (2019; updated 2024): human‑centred, transparency, robustness, accountability; many national policies and standards map to these.[16]

Standards and guidance frequently used to show due care

•NIST AI Risk Management Framework (AI RMF 1.0) and its Generative AI Profile: common U.S. benchmarks for AI governance, risk controls, testing, and monitoring; referenced by OMB and agencies.[17]

•ISO/IEC 42001:2023: certifiable AI management‑system standard that organizes governance, risk, data, transparency, and third‑party controls for organizations building or deploying AI.[18]

•U.S.: the Copyright Office’s 2023 guidance confirms that purely AI‑generated material without human authorship isn’t registrable; applicants must disclose and disclaim AI‑generated portions.[19]

•EU: the AI Act requires GPAI providers to maintain a copyright policy (including honoring opt‑outs) and publish a summary of training content to aid rights‑holder enforcement.[2]

What this usually means in practice for builders and deployers

•Know your role and risk level: in the EU, duties attach differently to “providers” of models/systems vs “deployers,” and increase for high‑risk uses; GPAI providers have specific transparency/copyright duties.[20]

•Perform and document risk/impact assessments, testing, and monitoring proportionate to risk (e.g., EU high‑risk, NYC AEDT audits, California ADMT risk assessments, Colorado profiling assessments).[12]

•Provide notices and user controls where required (e.g., transparency under EU AI Act Art. 50; California ADMT notices/opt‑outs; DSA/UK OSA transparency for recommender systems).[21]

•Avoid deceptive marketing and discrimination: regulators are already enforcing against misleading AI claims and biased outcomes in employment and services.[7]

•In regulated sectors (e.g., medical devices), follow sector‑specific AI guidance (like FDA PCCPs) in addition to general AI/consumer‑protection rules.[9]

If you tell me where you operate and how your system is used (e.g., hiring, lending, healthcare, consumer app), I can map the precise obligations and timelines you’re likely to face.

Citations (21)

1europa.euGovernment
Timeline - Artificial intelligence - Consilium
Backs: “An EU AI Office coordinates enforcement with national authorities.”
2europa.euGovernment
Article 53: Obligations for providers of general-purpose AI models | AI Act Service Desk
Backs: “GPAI‑specific duties: providers must keep technical docs, adopt a copyright‑compliance policy (including honoring text‑and‑data‑mining opt‑outs), and publish a “sufficiently detailed summary” of training content using an official template. These obligations apply to open‑source GPAI too.”
3europa.euGovernment
Regulation - 2022/2065 - EN - DSA - EUR-Lex
Backs: “Digital Services Act (DSA): risk assessments, transparency for recommender systems/ads, and annual reports; enhanced obligations for very‑large platforms/search engines.”
4europa.euGovernment
Directive - 2024/2853 - EN - Product Liability Directive - EUR-Lex
Backs: “Updated Product Liability Directive (2024/2853): makes software (including AI systems) expressly in scope of EU‑wide strict liability for defective products.”
5whitehouse.govGovernment
EXECUTIVE OFFICE OF THE PRESIDENT
Backs: “Executive Order 14110 (Oct 30, 2023) guided this work but was rescinded on Jan 20, 2025; the OMB requirements remain operative.”
6ftc.govGovernment
FTC Announces Crackdown on Deceptive AI Claims and Schemes | Federal Trade Commission
Backs: “FTC uses Section 5 (unfair/deceptive acts) against deceptive AI claims (“AI‑washing”), biometric misuses, and misleading performance assertions; it launched “Operation AI Comply” in 2024 and in 2026 proposed a policy statement on AI accuracy claims.”
7sec.govGovernment
SEC.gov | SEC Charges Two Investment Advisers with Making False and Misleading Statements About Their Use of Artificial Intelligence
Backs: “SEC brought the first “AI‑washing” cases in March 2024 against investment advisers for misleading statements about AI use.”
8govdelivery.comCompanies
EEOC Releases New Resource on Artificial Intelligence and Title VII
Backs: “EEOC has made clear that Title VII and the ADA apply when employers use AI in hiring or employment decisions, with technical assistance on adverse impact and disability‑related screening.”
9govdelivery.comCompanies
Final Guidance: PCCPs for AI-Enabled Devices
Backs: “FDA finalized guidance on Predetermined Change Control Plans so AI‑enabled medical devices can update models under a pre‑cleared plan; additional updates issued in 2025.”
10ca.govGovernment
California Finalizes Regulations to Strengthen Consumers' Privacy
Backs: “California CPPA regulations (effective Jan 1, 2026) add duties for Automated Decisionmaking Technology (ADMT): pre‑use notice, access rights, opt‑out for significant decisions, plus mandatory risk assessments and annual cyber audits for some businesses.”
11coag.govGovernment
Colorado Anti-Discrimination in AI Law (ADAI) Rulemaking | Colorado Attorney General
Backs: “Colorado’s privacy rules also regulate profiling that produces legal or similarly significant effects.”
12nyc.govGovernment
Automated Employment Decision Tools: Frequently Asked Questions - DCWP
Backs: “New York City Local Law 144 (since 2023): bias audits and notices for automated employment decision tools used in NYC.”
13legislation.gov.ukGovernment
Online Safety Act 2023
Backs: “Platforms must assess and mitigate risks (including from algorithms) related to illegal content and protecting children, maintain records, and publish transparency reports—including information about recommendation systems.”
14loc.govGovernment
China: Provisions on Deep Synthesis Technology Enter into Effect | Library of Congress
Backs: “Binding “deep synthesis” rules (in force since Jan 10, 2023) require labeling of synthetic media, real‑name user verification, content review, and algorithm filing for services with public‑opinion reach; generative‑AI measures (effective Aug 15, 2023) set additional provider obligations.”
15bundesregierung.deGovernment
Hiroshima Process International
Backs: “G7 Hiroshima Process: non‑binding international Guiding Principles and a voluntary Code of Conduct for developers of advanced AI; the OECD runs a public reporting framework to monitor adoption.”
16oecd.aiGovernment
AI Principles Overview - OECD.AI
Backs: “OECD AI Principles (2019; updated 2024): human‑centred, transparency, robustness, accountability; many national policies and standards map to these.”
17nist.govGovernment
AI Risk Management Framework | NIST
Backs: “NIST AI Risk Management Framework (AI RMF 1.0) and its Generative AI Profile: common U.S. benchmarks for AI governance, risk controls, testing, and monitoring; referenced by OMB and agencies.”
18iso.orgNonprofits and think tanks
ISO/IEC 42001:2023 - AI management systems
Backs: “ISO/IEC 42001:2023: certifiable AI management‑system standard that organizes governance, risk, data, transparency, and third‑party controls for organizations building or deploying AI.”
19govinfo.govGovernment
Federal Register / Vol. 88, No. 51 / Thursday, March 16, 2023 / Rules and Regulations 16193
Backs: “U.S.: the Copyright Office’s 2023 guidance confirms that purely AI‑generated material without human authorship isn’t registrable; applicants must disclose and disclaim AI‑generated portions.”
20europa.euGovernment
What are the obligations for high-risk, transparency-risk, and minimal-risk AI systems? | AI Act Service Desk
Backs: “Know your role and risk level: in the EU, duties attach differently to “providers” of models/systems vs “deployers,” and increase for high‑risk uses; GPAI providers have specific transparency/copyright duties.”
21europa.euGovernment
Article 50: Transparency obligations for providers and deployers of certain AI systems | AI Act Service Desk
Backs: “California ADMT notices/opt‑outs; DSA/UK OSA transparency for recommender systems).”