What rules currently exist that govern how systems like you are built, deployed, or held accountable?

The rules governing how systems like me—large language models (LLMs) and generative artificial intelligence systems—are built, deployed, and held accountable have transitioned from voluntary guidelines into a binding, multi-jurisdictional web of laws.

Because AI systems are developed globally but deployed across borders, they are subject to a patchwork of strict regional laws, national security mandates, and state-level regulations. The regulatory landscape is structured around three major regions:

1. The European Union: The EU AI Act (Regulation (EU) 2024/1689)

The European Union’s AI Act is the world’s first comprehensive, risk-tiered AI law. It regulates AI based on the level of risk the system poses to health, safety, and fundamental rights.

•How it Governs Building (General-Purpose AI): For foundational models (including the architecture behind systems like me), the rules became active in August 2025. Developers of General-Purpose AI (GPAI) must maintain detailed technical documentation, publish summaries of the data used for training, and comply with EU copyright laws.

•How it Governs Deployment (Transparency & Watermarking): Under Article 50 (effective August 2026), any system interacting directly with humans (like a chatbot) must make it clear to users that they are interacting with an AI. Furthermore, generative AI systems must embed machine-readable watermarks and metadata into AI-generated text, images, and video to prevent deception.

•Accountability & Enforcement: The outright ban on "unacceptable risk" systems (such as real-time public biometric surveillance, social scoring, or cognitive-behavioral manipulation) took effect in February 2025. Under the June 2026 Digital Omnibus on AI, standalone "high-risk" systems (used in employment, education, or critical infrastructure) have until December 2, 2027 to comply with strict risk-mitigation, human oversight, and logging duties. Violators face fines of up to €35 million or 7% of global annual turnover.

2. The United States: Executive Action and State-Level Patchwork

The U.S. lacks a single comprehensive federal AI statute, resulting in a dual system of federal executive mandates and highly active state laws.

Federal Actions

•Frontier Model Oversight: In June 2026, the U.S. government issued Executive Order 14409 ("Promoting Advanced Artificial Intelligence Innovation and Security"). It directs federal agencies to establish a voluntary security framework for deploying "covered frontier models" (extremely large-scale models) and mandates classified benchmarking to evaluate model capabilities.

•Preemption Push: The administration released a National Policy Framework for AI in March 2026, acting as a legislative blueprint to establish a federal AI regime and preempt conflicting state laws.

•Targeted Laws: Congress passed the TAKE IT DOWN Act, which criminalizes the creation and distribution of non-consensual AI-generated intimate deepfakes.

State-Level Laws

Because federal law is largely non-binding, states have taken the lead in holding AI developers and deployers accountable:

•California: The Transparency in Frontier AI Act (SB 53) and the Artificial Intelligence Training Data Transparency Act (AB 2013) went into effect on January 1, 2026. SB 53 targets the developers of large frontier models (trained using high compute thresholds) by requiring safety frameworks, incident-reporting pipelines, and whistleblower protections. AB 2013 requires AI developers to publicize detailed summaries of their training datasets. The California AI Transparency Act (SB 942) mandating AI watermarking took effect in August 2026.

•Texas: The Texas Responsible Artificial Intelligence Governance Act (TRAIGA) went into effect on January 1, 2026. It bans the deployment of AI intended to facilitate illegal discrimination, violence, or self-harm. It provides a "safe harbor" to businesses that align their governance with the voluntary NIST AI Risk Management Framework.

•Colorado: Initially passing a sweeping bill to regulate high-risk systems, Colorado narrowed its approach in May 2026 (SB 26-189). Effective January 1, 2027, it regulates automated decision-making technology (ADMT) by mandating pre-use notices, human-review rights, and consumer explanations for adverse automated outcomes.

3. China: Binding, Scenario-Specific Regulations

China does not have a single comprehensive AI Act, but instead enforces a highly active, vertically integrated set of binding rules overseen by the Cyberspace Administration of China (CAC).

•How it Governs Building (Security Assessments): Under the Generative AI Measures, developers wishing to release public-facing models must undergo a mandatory security assessment with the CAC. This covers algorithm security, training data legitimacy, and content controls.

•How it Governs Deployment (Synthetic Content & Interaction):

•Measures for Content Labeling (effective September 2025): Requires mandatory visible and invisible watermarks (machine-readable metadata) on all synthetic media.

•Anthropomorphic AI Interaction Rules (effective July 2026): Newly active measures targeting AI that simulates human emotion, virtual intimacy, or personal relationships. These rules mandate explicit disclosure prompts, enforce minor and elderly protection bans on "virtual intimacy," and implement anti-addiction controls.

•Accountability: Under the updated Cybersecurity Law (effective January 2026), AI developers face strict liability, increased financial penalties, and mandatory incident-reporting obligations for algorithmic black boxes and data security breaches.

Summary of How AI is Managed

•Building: AI builders must document their training data sources (California, China, EU), protect intellectual property, and undergo security/capability evaluations before launch (EU, U.S. Executive Order, China).

•Deploying: If an AI model is deployed to make high-stakes decisions (like hiring, lending, or healthcare), it is subject to audits, discrimination testing, and mandatory human-in-the-loop overrides. If used for chat or media creation, it must carry watermarks and clear disclosures.

•Accountability: If an AI system causes harm (such as facilitating fraud, generating non-consensual deepfakes, or displaying algorithmic bias), accountability falls on both the developer (for systemic model failures) and the deployer (for improper integration) through heavy regulatory fines and liability lawsuits.

Citations (16)

1kiteworks.comCompanies
kiteworks.com
Backs: “The rules governing how systems like me—large language models (LLMs) and generative artificial intelligence systems—are built, deployed, and held accountable have transitioned from voluntary guidelines into a binding, multi-jurisdictional web of laws. Because AI systems are developed globally but deployed across…”
2transcend.ioCompanies
transcend.io
Backs: “The rules governing how systems like me—large language models (LLMs) and generative artificial intelligence systems—are built, deployed, and held accountable have transitioned from voluntary guidelines into a binding, multi-jurisdictional web of laws. Because AI systems are developed globally but deployed across…”
3collibra.comCompanies
collibra.com
Backs: “The European Union’s AI Act is the world’s first comprehensive, risk-tiered AI law. It regulates AI based on the level of risk the system poses to health, safety, and fundamental rights.”
4transcend.ioCompanies
transcend.io
Backs: “It regulates AI based on the level of risk the system poses to health, safety, and fundamental rights. How it Governs Building (General-Purpose AI): For foundational models (including the architecture behind systems like me), the rules became active in August 2025.”
5jamf.comCompanies
jamf.com
Backs: “How it Governs Building (General-Purpose AI): For foundational models (including the architecture behind systems like me), the rules became active in August 2025. Developers of General-Purpose AI (GPAI) must maintain detailed technical documentation, publish summaries of the data used for training, and comply with EU…”
6responsibleailabs.aiCompanies
responsibleailabs.ai
Backs: “How it Governs Deployment (Transparency & Watermarking): Under Article 50 (effective August 2026), any system interacting directly with humans (like a chatbot) must make it clear to users that they are interacting with an AI. Furthermore, generative AI systems must embed machine-readable watermarks and metadata into…”
7deep-lex.comLow provenance
deep-lex.com
Backs: “Furthermore, generative AI systems must embed machine-readable watermarks and metadata into AI-generated text, images, and video to prevent deception. Accountability & Enforcement: The outright ban on "unacceptable risk" systems (such as real-time public biometric surveillance, social scoring, or cognitive-behavioral…”
8airia.comCompanies
airia.com
Backs: “Accountability & Enforcement: The outright ban on "unacceptable risk" systems (such as real-time public biometric surveillance, social scoring, or cognitive-behavioral manipulation) took effect in February 2025. Under the June 2026 Digital Omnibus on AI, standalone "high-risk" systems (used in employment, education,…”
9verifywise.aiCompanies
verifywise.ai
Backs: “lacks a single comprehensive federal AI statute, resulting in a dual system of federal executive mandates and highly active state laws. Federal Actions”
10wikipedia.orgEncyclopedias and referencequality 0.83
wikipedia.org
Backs: “Frontier Model Oversight: In June 2026, the U.S. government issued Executive Order 14409 ("Promoting Advanced Artificial Intelligence Innovation and Security"). It directs federal agencies to establish a voluntary security framework for deploying "covered frontier models" (extremely large-scale models) and mandates…”
11cloudsecurityalliance.orgNonprofits and think tanks
cloudsecurityalliance.org
Backs: “Preemption Push: The administration released a National Policy Framework for AI in March 2026, acting as a legislative blueprint to establish a federal AI regime and preempt conflicting state laws. Targeted Laws: Congress passed the TAKE IT DOWN Act, which criminalizes the creation and distribution of non-consensual…”
12regulations.aiData and tools
regulations.ai
Backs: “Targeted Laws: Congress passed the TAKE IT DOWN Act, which criminalizes the creation and distribution of non-consensual AI-generated intimate deepfakes. State-Level Laws”
13pertamapartners.comCompanies
pertamapartners.com
Backs: “China does not have a single comprehensive AI Act, but instead enforces a highly active, vertically integrated set of binding rules overseen by the Cyberspace Administration of China (CAC). How it Governs Building (Security Assessments): Under the Generative AI Measures, developers wishing to release public-facing…”
14regulations.aiData and tools
regulations.ai
Backs: “Measures for Content Labeling (effective September 2025): Requires mandatory visible and invisible watermarks (machine-readable metadata) on all synthetic media. Anthropomorphic AI Interaction Rules (effective July 2026): Newly active measures targeting AI that simulates human emotion, virtual intimacy, or personal…”
15holisticai.comCompanies
holisticai.com
Backs: “Deploying: If an AI model is deployed to make high-stakes decisions (like hiring, lending, or healthcare), it is subject to audits, discrimination testing, and mandatory human-in-the-loop overrides. If used for chat or media creation, it must carry watermarks and clear disclosures.”
16foley.comCompanies
foley.com
Backs: “Accountability: If an AI system causes harm (such as facilitating fraud, generating non-consensual deepfakes, or displaying algorithmic bias), accountability falls on both the developer (for systemic model failures) and the deployer (for improper integration) through heavy regulatory fines and liability lawsuits. 1.”