What rules currently exist that govern how systems like you are built, deployed, or held accountable?

AI systems like large language models (LLMs) and general-purpose AI (GPAI) are governed by a growing but fragmented patchwork of binding laws, voluntary frameworks, sectoral rules, and soft-law principles. There is no single global statute. Regulation focuses on risk classification, transparency, safety/security, human oversight, data quality/privacy, documentation, post-market monitoring, and liability/accountability. Rules apply differently to developers/providers (building/training), deployers (putting into use), and users, often with extraterritorial reach. Existing laws on data protection (e.g., GDPR, CCPA/CPRA), consumer protection, anti-discrimination, product liability, intellectual property, and cybersecurity also apply.[1]

As of late 2026, key regimes emphasize risk-based approaches (prohibiting certain uses, imposing strict duties on high-risk or high-impact systems, lighter transparency for others). Deadlines and details continue to evolve (e.g., via EU amendments). Below is an overview of major rules governing building, deployment, and accountability.

European Union: AI Act (Most Comprehensive Binding Framework)

The EU AI Act (Regulation (EU) 2024/1689, entered into force August 2024, with phased application) is the world’s first horizontal, risk-based AI law. It applies to providers placing systems/models on the EU market or deployers using them in the EU (extraterritorial). It was amended by the Digital Omnibus on AI (2026) to adjust timelines and add provisions.[2]

Risk categories and rules:

Accountability/enforcement: AI Office (for GPAI) + national authorities. Fines up to €35 million or 7% of global turnover (higher for prohibited practices). Market surveillance, databases for high-risk systems, post-market monitoring. Supports innovation via sandboxes. AI literacy duties apply. Existing GDPR and revised Product Liability Directive also relevant.[1]

United States: Fragmented Federal Guidance + State Laws + Existing Statutes

No comprehensive federal AI statute exists as of late 2026. Policy emphasizes innovation and U.S. leadership, with voluntary frameworks, agency guidance, procurement rules, and a push against burdensome state laws. Congress has not passed broad preemption.[3]

Federal:

State laws (patchwork; federal efforts seek to limit “onerous” ones; no broad preemption yet):

Accountability: Primarily via existing tort/product liability, FTC enforcement, state AGs, contract terms, and proposed strict liability ideas. Incident reporting and safety frameworks for frontier models in some states. Whistleblower protections emerging.

China: Technology- and Service-Specific Measures (Content/Security Focus)

No single comprehensive AI law yet (full lifecycle legislation accelerating as of late 2026, covering data/compute/algorithms/applications, risk disclosure, incident reporting, sandboxes). Layered administrative measures led by Cyberspace Administration of China (CAC) and others, plus Cybersecurity Law amendments (AI provision effective 2026) and Personal Information Protection Law (PIPL).[8]

Key rules (apply to public-facing services in China; filing/security assessments common):

Enforcement: Filing required before launch for many services; active crackdowns (e.g., labeling non-compliance); fines, suspensions, criminal referrals. Courts issuing guidance on AI disputes (torts, IP).

South Korea: AI Basic Act (In Force January 2026)

Comprehensive framework balancing promotion and trust. Applies extraterritorially if impacting Korean market/users. Covers developers and utilizers.[10]

International Soft Law, Standards, and Other Frameworks

These influence national rules and corporate practices but are generally non-binding:

Common Themes for Building, Deployment, and Accountability

For systems like conversational LLMs/GPAI: Primary duties often involve transparency (user notification of AI interaction, content labeling), safety evaluations (especially if frontier-scale), content safeguards, and avoiding prohibited manipulations. High-risk classification depends on specific use (e.g., employment decisions vs. general chat). Providers outside a jurisdiction can still be covered if serving its market.

Regulations are dynamic—check official sources (e.g., EUR-Lex for EU AI Act, NIST.gov, White House/Federal Register, CAC for China, MSIT for Korea) and legal counsel for applicability, as enforcement, amendments, and guidance evolve rapidly. Many organizations map controls to the strictest overlapping requirements (e.g., EU + key US states + China labeling) for global systems. Voluntary international principles and standards provide a baseline for trustworthy AI even where hard law is light.