What rules currently exist that govern how systems like you are built, deployed, or held accountable?
Short answer: There isn’t one single “AI law.” Today’s rules are a patchwork of sector laws, general consumer/data-protection rules, new AI‑specific statutes and regulations in some jurisdictions, and voluntary standards that many organizations use to show due care.
Highlights by jurisdiction (current as of November 6, 2026)
United States (federal)
United States (state/local – examples)
European Union
United Kingdom
China
International frameworks
Standards commonly used to demonstrate governance and due care
If you tell me your context (e.g., employer hiring tools in the U.S., a consumer chatbot in California, foundation‑model development selling into the EU), I can map the exact obligations, dates, and proof you’ll need.
Citations (21)
- https://www.whitehouse.gov/wp-content/uploads/2024/03/M-24-10-Advancing-Governance-Innovation-and-Risk-Management-for-Agency-Use-of-Artificial-Intelligence.pdf?trk=public_post_main-feed-card-text
Backs: “OMB Memorandum M‑24‑10 requires each agency to appoint a Chief AI Officer, inventory AI use cases, and apply minimum safeguards for “rights-impacting” and “safety-impacting” AI. This binds federal agencies, not the private sector.”
- Policy Statement of the Federal Trade Commission on Biometric Information and Section 5 of the Federal Trade Commission Act | Federal Trade Commission
Backs: “FTC enforces the FTC Act; its 2023 biometric policy statement warns companies about unfair/deceptive AI biometrics practices.”
- Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms | Consumer Financial Protection Bureau
Backs: “CFPB says creditors using complex/AI models still must give specific adverse‑action reasons under ECOA/Reg B.”
- EEOC Releases New Resource on Artificial Intelligence and Title VII
Backs: “EEOC reminds employers that Title VII applies to algorithmic hiring; it issued technical assistance on assessing disparate impact.”
- <visual_element id="e1">
Backs: “DOJ/FTC/CFPB/EEOC issued a joint statement: there’s no “AI exemption” from existing laws.”
- Federal Communications Commission FCC 24-17
Backs: “The FCC ruled on Feb 8, 2024 that AI‑generated voices in robocalls are “artificial” under the TCPA—so consent and other TCPA requirements apply.”
- Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence | NIST
Backs: “EO 14110 (Oct 30, 2023) catalyzed federal actions but was rescinded on Jan 20, 2025; agencies continue to operate under extant guidance like OMB M‑24‑10.”
- Artificial Intelligence Risk Management Framework (AI RMF 1.0) | NIST
Backs: “AI Safety Institute at NIST coordinates evals and safety science.”
- California Finalizes Regulations to Strengthen Consumers' Privacy
Backs: “CPPA finalized CCPA regulations on Automated Decisionmaking Technology (ADMT), risk assessments and cybersecurity audits; effective Jan 1, 2026, with ADMT duties (notice, access, opt‑out) applying no later than Jan 1, 2027.”
- Colorado Anti-Discrimination in AI Law (ADAI) Rulemaking | Colorado Attorney General
Backs: “2026–2027 overhaul of AI/automated decision laws; the AG is rulemaking for the new Automated Decision‑Making Technology and Chatbot Safety Acts, effective Jan 1, 2027. (These replace the earlier 2024 SB24‑205 approach.)”
- Automated Employment Decision Tools: Frequently Asked Questions - DCWP
Backs: “Local Law 144 requires bias audits and notices before using automated employment decision tools.”
- Illinois General Assembly - Illinois Compiled Statutes - Full Text
Backs: “Maryland requires applicant consent for facial recognition during interviews.”
- President Trump signs Take It Down Act, addressing nonconsensual deepfakes. What is it?
Backs: “Congress enacted the “Take It Down Act” (Apr 29, 2025) addressing non‑consensual intimate images, including AI deepfakes.”
- Timeline for the Implementation of the EU AI Act | AI Act Service Desk
Backs: “Annex III “high‑risk” obligations from Dec 2, 2027; embedded high‑risk in regulated products from Aug 2, 2028.”
- Digital Services Act | EUR-Lex
Backs: “DSA (platform accountability): very large online platforms/search must assess and mitigate systemic risks, adjust recommenders, and undergo audits; transparency on recommender parameters and ads.”
- Liability for defective products
Backs: “The revised Product Liability Directive clarifies that software and AI systems are “products” for no‑fault liability; entered into force Dec 8, 2024 (Member States to transpose by Dec 9, 2026).”
- AI regulation: a pro-innovation approach - GOV.UK
Backs: “No cross‑cutting AI Act yet; the government runs a “pro‑innovation” framework implemented through sector regulators and a central function. The UK AI Safety Institute evaluates advanced models.”
- Interim Measures for the Management of Generative Artificial Intelligence Servicesii
Backs: “They include filing/labeling, security assessments, and content governance requirements.”
- Council of Europe's Work in progress - Artificial Intelligence
Backs: “Council of Europe Framework Convention on AI, Human Rights, Democracy and Rule of Law (adopted May 17, 2024; opened for signature Sep 5, 2024): first binding international AI treaty; parties commit to risk‑based safeguards.”
- OECD AI Principles - OECD.AI
Backs: “G7 Hiroshima Process issued voluntary guiding principles and a code of conduct for developers of advanced AI (Oct 30, 2023).”
- ISO/IEC 42001:2023 - AI management systems
Backs: “Many organizations certify to 42001 or align to 23894/NIST AI RMF to evidence controls.”