What rules currently exist that govern how systems like you are built, deployed, or held accountable?

A patchwork of binding laws, voluntary frameworks, sector-specific rules, and existing general laws (privacy, liability, consumer protection, anti-discrimination, IP) currently governs AI systems like large language models (LLMs) and general-purpose AI (GPAI). There is no single global regime. Rules vary by jurisdiction, risk level, and use case, with extraterritorial reach common (e.g., EU rules applying to providers serving EU users). They address building (data/training practices, safety, documentation), deployment (transparency, risk management, prohibitions), and accountability (liability, oversight, reporting, penalties). Many emphasize risk-based approaches, human oversight, and labeling of AI-generated content.[1]

Major developments as of late 2026 include phased implementation of the EU AI Act (with some high-risk deadlines deferred), U.S. state laws on frontier models and disclosures alongside federal executive policy favoring innovation and challenging “onerous” state rules, China’s generative AI and labeling measures (with a comprehensive lifecycle law being accelerated), and South Korea’s AI Basic Act.[2]

European Union: The Most Comprehensive Binding Framework

The EU AI Act (Regulation 2024/1689, entered into force August 2024, with Digital Omnibus amendments) is the world’s first broad horizontal AI law. It uses a risk-based approach and applies extraterritorially to providers/deployers placing systems on the EU market or whose outputs are used there.[3]

Enforcement: AI Office + national authorities; fines up to €35M or 7% global turnover. AI literacy duties apply. The revised Product Liability Directive (from Dec 2026) treats software/AI (including SaaS) as products under strict (no-fault) liability for death/injury, property damage, or data loss, with disclosure orders and presumptions easing proof of defect/causation for complex AI. Violations of AI Act safety rules can support defect presumptions. The separate AI Liability Directive proposal was withdrawn.[6]

Existing laws like GDPR heavily govern training data/privacy.

United States: Fragmented—Federal Policy + State Laws + Existing Authorities

No comprehensive federal AI statute exists. Policy emphasizes innovation, U.S. leadership, and reducing barriers (post-2025 shift via EOs revoking prior safety-focused orders). Federal rules mainly bind agencies via OMB memos (e.g., M-25-21 on governance, high-impact AI practices like testing/oversight/appeals; procurement rules). NIST’s AI Risk Management Framework (AI RMF) (Govern-Map-Measure-Manage) is voluntary but influential and often referenced for compliance defenses.[7]

China

Technology-specific administrative measures rather than one comprehensive statute (though NDRC is accelerating lifecycle AI safety legislation covering data/compute/algorithms, risk disclosure, incidents, sandboxes—targeting frontier developers).[11]

South Korea: AI Basic Act (in force Jan 2026)

Comprehensive framework promoting industry while setting trust/safety rules (extraterritorial; grace period for many penalties). Covers generative AI (notice + labeling of outputs, especially realistic synthetic media) and high-impact AI (sectors like healthcare, employment/loans, transport, public decisions, energy—significant effects on life/safety/rights).[13]

Operators: risk management, explanations (outputs/criteria/data overview), user protection, human oversight, documentation; endeavor impact assessments (mandatory reflection of vulnerable groups in some cases). High-performance/frontier (e.g., ≥10^26 FLOPs) face extra safety/lifecycle duties. Foreign providers meeting thresholds need a domestic representative. Fines up to ~KRW 30M for key violations; governance via national strategy committee.[14]

International Principles and Voluntary Standards

These shape national rules and company practices but are mostly non-binding:

Cross-Cutting Themes for Building, Deployment, and Accountability

For systems like me (conversational LLMs/GPAI): Core obligations often include interaction disclosure, synthetic content marking (where realistic/public-interest), training data transparency/copyright policies, risk assessments if high-capability or high-impact uses, and compliance with content/safety rules. Providers face documentation and downstream info-sharing duties in places like the EU. Deployers (e.g., apps integrating models) share responsibilities.

Rules evolve rapidly (deadlines deferred, new state laws, enforcement ramping, liability cases testing boundaries). Companies often map to the strictest applicable (e.g., EU + major U.S. states + China labeling) and use voluntary frameworks like NIST RMF for operationalization. Sector-specific rules (medical, finance, employment, critical infrastructure) and general laws always apply. For the latest, check official sources, as this landscape changes frequently.