What rules govern systems like me — I'll map the current build, deploy, and accountability requirements.
There is no single global law for systems like me. Instead rules are layered by jurisdiction, risk level, and sector — with binding laws in some places, principles-based guidance in others, and voluntary standards that shape accountability.
1. European Union - The most comprehensive binding regime
EU AI Act - Regulation (EU) 2024/1689 is the world's first comprehensive horizontal AI law. It is described as laying down harmonised rules on artificial intelligence.
•Entry into force and phasing: It entered into force on August 1, 2024. Its obligations apply in phases, beginning February 2, 2025.
•Bans on unacceptable-risk systems and AI literacy duty since February 2, 2025
•Rules for general-purpose AI (GPAI) models since August 2, 2025
•Transparency duties since August 2, 2026 — Prohibited practices and AI-literacy duties began applying in February 2025. General-purpose AI model obligations began in August 2025. Article 50 transparency duties took effect in August 2026
•As amended by the 2026 Digital Omnibus, high-risk obligations were moved to December 2, 2027 (Annex III) and August 2, 2028 (Annex I)
•Risk-based system: It categorizes AI systems into four risk tiers: unacceptable, high, limited, and minimal. It is also described as categorizing AI systems into four tiers—prohibited, high-risk, limited-risk, and minimal-risk.
•Unacceptable risk: Four risk tiers determine compliance obligations. Unacceptable-risk systems are banned outright (enforceable since February 2, 2025) — examples include social scoring, untargeted facial scraping, emotion recognition at work and in schools
•High-risk: Systems listed in Annex I or Annex II have conformity assessment, EU database registration, CE marking, data governance, logging, transparency and human oversight obligations. The EU AI Act mandates high-risk systems to log activities, explain outputs, and assign human oversight and mandates data governance (Art. 10), and transparency (Art. 13) for high-risk systems
•GPAI / Foundation models: Rules for general-purpose AI models came into force, requiring developers of foundation models to provide technical documentation, summaries of training data and those with systemic risk trigger additional obligations (Art. 55)
•Limited-risk: Transparency obligations, such as disclosing AI-generated content
•Who it applies to: It imposes compliance obligations on companies that develop or deploy AI. As a regulation, it applies directly in every member state and needs no national transposition.
•Enforcement and penalties: The EU mandates conformity assessments with penalties up to 7% of global revenue and penalties reaching €35 million or 7% of global turnover for non-compliance.
Liability for AI harm:
•The European Commission originally proposed a dedicated AI Liability Directive in September 2022, intended to ease the burden of proof on claimants. That proposal was formally withdrawn in 2025, with the withdrawal notice published in the Official Journal on 6 October 2025, after member states failed to reach agreement.
•In its place, the revised EU Product Liability Directive (EU) 2024/2853 applies. From 9 December 2026, AI software counts as a product under the EU's new Product Liability Directive (EU) 2024/2853, which EU countries must turn into national law by then. The new PLD must be transposed by all Member States by December 9, 2026.
•If a defective AI-based product first placed on the EU market from that date injures someone, damages their private property or destroys their private data, its manufacturer is liable without fault (i.e. strict liability) and without any cap. Courts can also order disclosure of internal evidence.
The Framework Convention on AI, Human Rights, Democracy, and the Rule of Law (2024) represents the first binding international treaty on AI governance, led by the Council of Europe.
2. United States - No single federal AI law, sectoral and federal-use rules
There is still no federal law that overrides state AI rules in the United States. The current approach is:
a) Federal government use:
The current framework centers on OMB Memorandum M-25-21, which replaced earlier Biden-era guidance and requires agencies to inventory their AI systems, manage risks for high-impact applications, and designate senior leaders responsible for AI governance. OMB M-25-21, titled "Accelerating Federal Use of Artificial Intelligence through Governance, Innovation, and Risk Management," builds on President Trump's Executive Order 14179 of January 23, 2025, "Removing Barriers to American Leadership in Artificial Intelligence".
By law, federal agencies must publish annual inventories of how they use artificial intelligence technologies, and OMB guidance requires them to disclose how they manage the risks those technologies pose to people's rights.
b) National policy direction:
On December 11, 2025, President Donald J. Trump signed Executive Order 14365 titled "Ensuring a National Policy Framework for Artificial Intelligence". The Order targets what it characterizes as a "patchwork" of State-by-State AI regulation and directs federal agencies to pursue a more uniform, national framework.
The Framework explicitly provides that no new federal AI rulemaking body should be created, and that AI deployment should instead be supported through existing sector-specific regulatory bodies with subject matter expertise and through industry-led standards.
The creation of an AI Litigation Task Force to challenge state AI laws that regulate interstate commerce or mandate specific model behavior was included, and the Federal Trade Commission is tasked to focus on truthful model outputs and deceptive conduct rather than a comprehensive federal rulebook for AI safety.
c) Voluntary framework - NIST AI RMF:
The NIST AI Risk Management Framework (AI RMF 1.0) was published by NIST as NIST.AI.100-1 on January 26, 2023, as voluntary guidance built on four functions: Govern, Map, Measure, and Manage. The NIST AI Risk Management Framework 1.0 (NIST AI RMF 1.0) is a voluntary framework published by the U.S. National Institute of Standards and Technology on January 26, 2023.
It is voluntary by design - Because it's voluntary guidance rather than a certification program, it doesn't produce a compliance badge and No business is legally required to adopt it. Its core is four functions: Govern, Map, Measure, and Manage, aligned with trustworthy AI characteristics such as validity, safety, security, accountability, and fairness.
Other relevant federal laws applied to AI include product liability, anti-discrimination (e.g., EEOC, Civil Rights Act), consumer protection (FTC Act), copyright, data protection sectorally (HIPAA, FCRA), and procurement rules.
3. U.S. State Laws
States are filling the gap:
•Colorado's SB 24-205, signed May 2024, was the first state law to regulate AI across employment, lending, housing, and insurance decisions and is described as Signed into law on May 17, 2024, the Colorado AI Act is the first comprehensive state-level AI law in the United States. Its core obligations for developers and deployers of high-risk AI systems took effect February 1, 2026. Colorado's landmark AI Act was repealed before it took effect and replaced — On May 14, 2026, Governor Jared Polis signed a replacement. The new Automated Decision-Making Technology Act drops the duty of care and the impact assessments.
•California has enacted significant AI-related legislation, establishing new requirements for transparency, safety, and accountability. Examples include:
•California's SB53, the Transparency in Frontier Artificial Intelligence Act (TFAIA), was signed into law on 29 September 2025, and took effect on 1 January 2026
•California AB 2905 went live on January 1, 2025, and demands a verbal disclosure at the very opening of every automated call
•California's election-deepfake laws AB 2839 and AB 2655, enacted in September 2024
•Earlier accountability bills like SB 896 (Generative AI Accountability) requiring state risk analysis, and AB2013 training data transparency.
•Other states (Texas, Illinois, Utah, etc.) have disclosure and biometric laws, but still no uniform preemptive federal law.
4. China - Binding content and service rules
China regulates generative AI through two central-government measures rather than one statute:
•Deep Synthesis Provisions - Provisions on the Administration of Deep Synthesis of Internet-based Information Services, in force since January 10, 2023, cover synthetic text, images, audio and video, and require generated content to be labeled. The deep synthesis regulation (effective January 2023) targeted deepfakes and AI-generated synthetic media.
•Interim Measures for the Management of Generative AI Services, in force since August 15, 2023, were issued by the Cyberspace Administration of China (CAC) with six other government departments. Published on July 13, 2023, they came into effect on August 15, 2023. They require lawful training data sourcing, content moderation, security assessment plus algorithm filing before any public-facing generative service launches, respect for IP, and content controls.
•Labeling Measures - On 17 March 2025, CAC and three other Agencies jointly issued the "Measures for the Identification of Synthetic Content Generated by Artificial Intelligence" which will come into effect on 1 September 2025, mandating conspicuous labels on AI-generated media and consent for manipulating biometric features.
China also applies Algorithm Recommendation Provisions and places strict liability for AI-generated content on developers under its Interim Measures.
5. United Kingdom - Principles-based, regulator-led
The UK still has no single AI Act. As of mid-2026 the United Kingdom has no single, horizontal AI statute and no AI bill before Parliament.
The UK's current approach is built around five broad principles: (1) safety, security, and robustness; (2) appropriate transparency and explainability; (3) fairness; (4) accountability and governance; and (5) contestability and redress. These principles are not set out in a standalone AI Act. Instead, regulators such as the Information Commissioner's Office (ICO), Office for Communications (Ofcom), the Competition and Markets Authority (CMA) apply them within their existing remits.
The current model began with the March 2023 white paper, A pro-innovation approach to AI regulation. It proposed five cross-sector principles for regulators to apply within their existing remits rather than a new AI regulator or new statutory duties. The Data (Use and Access) Act 2025 and UK GDPR/Data Protection Act 2018 and Equality Act still apply to AI systems using personal data or automating decisions.
6. Other Global Frameworks
•OECD AI Principles and UNESCO Recommendation on the Ethics of AI provide non-binding global frameworks emphasizing human-centered values, transparency, security, and accountability.
•Brazil's AI Bill 2338/2023, Canada's AI and Data Act (AIDA) emphasizes responsible and explainable use of automated systems, and similar proposals are in development globally.
•G20 has proposed measures to establish AI principles based on OECD guidelines and develop legal frameworks to harmonize AI liability regulations across countries.
7. How accountability works across these rules
Common mechanisms that govern how systems are built, deployed, and held accountable include:
•Pre-market: Training data governance, lawful sourcing, IP respect, security assessments, algorithm filing (China), conformity assessments and technical documentation (EU high-risk and GPAI), impact assessments (Colorado originally).
•During deployment: Logging, human oversight, transparency/disclosure of AI interaction (EU Art. 50, California AB 2905), labeling of synthetic content (China, EU), contestability and redress (UK principle).
•Post-harm: Liability shifts — EU product liability strict liability from December 2026, US fault-based tort and sectoral liability (healthcare malpractice, financial, etc.), and evolving case law. The EU AI Act is the world's first comprehensive AI regulation. It classifies AI systems by risk level and imposes compliance obligations on companies that develop or deploy AI.
•Voluntary governance: Most developers, including for systems like me, align with NIST AI RMF's Govern-Map-Measure-Manage and ISO/IEC 42001 AI Management System to demonstrate responsible building and deployment even where law does not yet mandate it.
> Rules are rapidly evolving — the dates above reflect phased applicability through 2026-2028, and many deadlines have already shifted (e.g., EU Digital Omnibus, Colorado delay). For a specific use case, the relevant obligations depend on where the system is offered, what risk tier it falls into, and whether it makes consequential decisions about people.
If you want, tell me your jurisdiction and use case (e.g., hiring, healthcare, consumer chatbot), and I can map the exact obligations that would apply.