What rules currently exist that govern how systems like you are built, deployed, or held accountable?
There is no single global set of rules governing AI systems like large language models or generative AI. Instead, a rapidly evolving patchwork of binding laws, voluntary frameworks, principles, standards, and existing legal regimes applies, varying by jurisdiction, risk level, use case, and whether one is a developer/provider, deployer, or user. As of late 2026, comprehensive risk-based laws exist in places like the EU and South Korea, while the US relies more on executive actions, agency guidance, state laws, and sector-specific rules; China uses service-specific measures with broader lifecycle legislation in development. International principles and standards provide common reference points. Accountability often draws on product liability, tort, consumer protection, privacy, and IP laws, with growing specific AI provisions.[1][2]
These rules address building (development, training data, safety testing, documentation, risk management), deployment (transparency, human oversight, prohibited uses, monitoring), and accountability (liability, incident reporting, audits, enforcement/fines, governance). Many emphasize risk classification, with heavier duties on high-risk or frontier systems. Existing laws (e.g., GDPR/CCPA for data privacy, copyright for training data, sector rules like FDA for medical devices) continue to apply. Industry self-regulation, company policies, and voluntary commitments also play roles.[3]
European Union: The AI Act (Primary Comprehensive Framework)
The EU Artificial Intelligence Act (Regulation (EU) 2024/1689, amended by the 2026 Digital Omnibus) is the world’s first major horizontal, risk-based AI law. It entered into force in August 2024, with obligations phasing in (prohibitions and literacy from early 2025; GPAI rules from mid-2025; transparency largely from August 2026; high-risk duties deferred to December 2027 for many Annex III uses and August 2028 for product-integrated systems). It applies extraterritorially to providers placing systems on the EU market or whose outputs are used there.[4][5]
Penalties: Up to €35M or 7% of global turnover for prohibited practices; lower for others. Enforced by the AI Office and national authorities. Related: Revised Product Liability Directive (from Dec 2026) treats software/AI as products under strict (no-fault) liability for defects causing injury, property damage, or data loss, with eased proof burdens and disclosure rules. Non-compliance with AI Act safety rules can inform defectiveness findings.[8][3]
United States: Fragmented Federal + State Approach
No comprehensive federal AI statute exists as of late 2026. Regulation is sectoral, via executive orders (EOs), agency guidance, voluntary frameworks, and growing state laws. A March 2026 White House framework recommended federal legislation (including possible preemption of some state laws), and there are ongoing proposals on liability and frontier safety, but nothing fully enacted at the federal level overriding states. Earlier Biden EO 14110 (2023, partially rescinded/superseded) drove safety testing, reporting for powerful models, and standards work; later actions under subsequent administrations emphasize leadership, innovation barriers removal, and superintelligence risk evaluation.[9][10]
China: Service-Specific Rules + Emerging Lifecycle Framework
No single comprehensive AI law yet, but binding measures from the Cyberspace Administration of China (CAC) and others, plus Cybersecurity Law amendments. Focus on public-facing services, content, and algorithms. Full lifecycle safety legislation (data to compute to deployment) is being accelerated as of late 2026.[17][18]
Other Notable National Frameworks
International Principles, Standards, and Soft Law
These are non-binding but highly influential, shaping national laws and company practices:
Building, Deployment, and Accountability in Practice
Additional layers: Privacy laws (data minimization, rights to explanation/access in automated decisions); IP/copyright (training data legality, output ownership/infringement); consumer protection and anti-discrimination; employment laws; critical infrastructure/cyber rules; export controls on advanced tech.
Voluntary/industry: Many developers follow internal safety policies, red-teaming, and commitments (e.g., past White House voluntary pledges). Procurement often requires NIST/ISO alignment or AI Act-like compliance.
Rules continue to evolve quickly with technology (e.g., agents, superintelligence discussions), incidents, and geopolitics. Compliance is multi-jurisdictional for global systems—developers often design to the strictest common standards (EU-inspired). For the latest or specific advice, consult official texts, regulators, or legal experts, as this is a high-level overview based on public sources as of late 2026. Systems like me operate under company policies informed by these broader rules, plus applicable laws in operating jurisdictions.
Citations (29)
- https://thebriefscript.com/artificial-intelligence-regulation/
Backs: “Accountability often draws on product liability, tort, consumer protection, privacy, and IP laws, with growing specific AI provisions.”
- https://theworldofai.org/ai-compliance/global-ai-laws/
Backs: “Accountability often draws on product liability, tort, consumer protection, privacy, and IP laws, with growing specific AI provisions.”
- https://www.aipolicydesk.com/regulations
Backs: “Industry self-regulation, company policies, and voluntary commitments also play roles.”
- https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
Backs: “It applies extraterritorially to providers placing systems on the EU market or whose outputs are used there.”
- https://sysart.consulting/eu-ai-act/timeline/
Backs: “It applies extraterritorially to providers placing systems on the EU market or whose outputs are used there.”
- https://artificialintelligenceact.eu/high-level-summary/
Backs: “Subliminal/manipulative techniques causing harm, exploitation of vulnerabilities, social scoring, certain predictive policing, untargeted facial scraping for databases, emotion recognition in workplaces/education (limited exceptions), most real-time remote biometric ID in public for law enforcement (narrow…”
- https://aisafetyassociation.org/european-ai-act
Backs: “Chatbots must disclose they are AI; deepfakes and certain AI-generated content (especially public interest) must be labeled/marked (machine-readable for generative systems, with transition for older ones to Dec 2026). Emotion recognition/biometrics disclosures apply.”
- https://www.twobirds.com/en/insights/2026/what-the-new-product-liability-directive-means-for-manufacturers-of-ai-based-products-and-services
Backs: “Non-compliance with AI Act safety rules can inform defectiveness findings.”
- https://insightassurance.com/insights/blog/u-s-ai-regulation-explained/
Backs: “Earlier Biden EO 14110 (2023, partially rescinded/superseded) drove safety testing, reporting for powerful models, and standards work; later actions under subsequent administrations emphasize leadership, innovation barriers removal, and superintelligence risk evaluation.”
- https://www.nist.gov/artificial-intelligence/ai-congressional-mandates-executive-orders-and-actions
Backs: “Earlier Biden EO 14110 (2023, partially rescinded/superseded) drove safety testing, reporting for powerful models, and standards work; later actions under subsequent administrations emphasize leadership, innovation barriers removal, and superintelligence risk evaluation.”
- https://www.nist.gov/itl/ai-risk-management-framework
Backs: “Applies across the lifecycle; used by industry and referenced in policy.”
- https://quality.arc42.org/standards/nist-ai-rmf
Backs: “Applies across the lifecycle; used by industry and referenced in policy.”
- https://iaim.ai/ai-regulatory-calendar/
Backs: “Also transparency/labeling for generative AI, training data disclosures, and more.”
- https://nhimg.org/us-state-ai-laws-tracker-guide
Backs: “Employment bias audits (e.g., NYC), chatbot rules for minors, etc.”
- https://a16zpolicy.substack.com/p/icymi-ai-policy-november-update
Backs: “Federal agencies ban certain foreign models (e.g., DeepSeek) and focus on national security testing via AI Safety Institute.”
- https://www.justsecurity.org/162331/liability-rein-in-rogue-ai-agents/
Backs: “Federal agencies ban certain foreign models (e.g., DeepSeek) and focus on national security testing via AI Safety Institute.”
- https://superintelligencecompliance.ai/guides/china-ai-regulations
Backs: “Full lifecycle safety legislation (data to compute to deployment) is being accelerated as of late 2026.”
- https://www.bloomberg.com/news/articles/2026-11-03/china-plans-broad-ai-guardrails-after-global-security-lapses
Backs: “Full lifecycle safety legislation (data to compute to deployment) is being accelerated as of late 2026.”
- https://nhimg.org/china-generative-ai-measures-and-ai-labelling-rules-guide
Backs: “Foreign providers may need domestic representatives. Enforcement includes rectification orders and discipline.”
- https://www.china-briefing.com/news/china-ai-regulations-2026-enforcement-guidance-compliance/
Backs: “Foreign providers may need domestic representatives. Enforcement includes rectification orders and discipline.”
- https://www.cooley.com/news/insight/2026/2026-01-27-south-koreas-ai-basic-act-overview-and-key-takeaways
Backs: “Lighter penalties (fines up to ~KRW 30M); emphasis on promotion alongside trust. Grace periods for enforcement.”
- https://polityatlas.org/observatory/korea-ai-basic-act-takes-effect
Backs: “Lighter penalties (fines up to ~KRW 30M); emphasis on promotion alongside trust. Grace periods for enforcement.”
- https://www.mofa.go.jp/files/100950813.pdf
Backs: “Recommendations on R&D investment, ecosystems, policy environments, skills, and cooperation. Adopted/endorsed widely (including G20).”
- https://nhimg.org/oecd-ai-principles-guide
Backs: “Recommendations on R&D investment, ecosystems, policy environments, skills, and cooperation. Adopted/endorsed widely (including G20).”
- https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence
Backs: “Values (human rights/dignity, environment, diversity, peace/justice) and principles (proportionality/do no harm, safety, fairness, sustainability, privacy, human oversight, transparency, responsibility, literacy, multi-stakeholder governance). Policy areas include impact assessment and data.”
- https://www.ey.com/en_uk/insights/ai/g7-ai-principles-and-code-of-conduct
Backs: “Guiding principles and code of conduct for advanced AI developers (risk identification/mitigation across lifecycle, misuse monitoring/reporting, transparency on capabilities/limitations, incident sharing, governance/risk management, security controls).”
- https://www.iso.org/standard/81230.html
Backs: “Other ISO standards cover terminology, risk management, impact assessment.”
- https://aipolicytracker.org/policies/iso-iec-42001-2023-ai-management-system
Backs: “Other ISO standards cover terminology, risk management, impact assessment.”
- https://www.gamingtechlaw.com/2026/10/ai-agent-liability-governance-model/
Backs: “Enforcement mixes specialized AI offices/agencies with general regulators.”