What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Short answer: There isn’t one single global “AI law.” Instead, a fast‑moving mix of binding laws, agency rules, and soft‑law standards governs how advanced systems are built, deployed, and held to account. As of November 7, 2026, here are the most consequential ones.

United States (federal)

•Federal agency use of AI: OMB’s governmentwide policies M‑25‑21 (governance, inventories, waivers, agency CAIOs) and M‑25‑22 (acquisition) now govern federal AI programs; they replaced earlier Biden‑era guidance. EO 14110 (Oct 2023) was rescinded on Jan 20, 2025 and superseded by EO 14179 (Jan 23, 2025), which led to the M‑25‑21/M‑25‑22 updates.[1]

•Consumer protection and advertising: the FTC enforces Section 5 (unfair/deceptive practices) against false AI claims and harmful uses, and has recently reiterated this policy in Federal Register notices and enforcement sweeps.[2]

•Financial services (credit): the CFPB says “black‑box” models don’t excuse lenders from giving specific adverse‑action reasons under ECOA/Reg B.[3]

•Employment discrimination: EEOC guidance explains how Title VII disparate‑impact rules apply to AI‑based selection tools; DOJ/ADA guidance covers disability‑related risks in hiring tech.[4]

United States (state and local)

•Colorado AI Act (SB 24‑205): a comprehensive, risk‑based law for “high‑risk” AI used in areas like employment, credit, housing. Developers and deployers must run risk‑management programs and mitigate algorithmic discrimination starting Feb 1, 2026.[5]

•New York City Local Law 144 (AEDT): employers can’t use automated hiring/promotion tools unless they undergo an annual bias audit and provide notices (enforced since July 5, 2023).[6]

•Insurance (New York): NYDFS final guidance requires insurers to control, document, test, and disclose use of AI/external consumer data, and to avoid unfair discrimination in underwriting/pricing.[7]

•Illinois: AI Video Interview Act requires disclosure/consent for AI analysis of applicant video interviews.[8]

•California:

•Transparency in Frontier AI Act (SB 53): effective Jan 1, 2026. Large frontier‑model developers must publish a safety framework and transparency reports, and report “critical safety incidents”; it also adds whistleblower protections.[9]

•Generative AI Training Data Transparency (AB 2013): developers making GenAI available in CA must post documentation about training data (high‑level dataset summaries and related details) by Jan 1, 2026 and before major updates.[10]

European Union

•EU AI Act (Regulation 2024/1689): risk‑based obligations across the lifecycle (bans, duties for high‑risk uses, transparency for some systems, and rules for general‑purpose models). Entered into force Aug 1, 2024; GPAI and governance provisions apply since Aug 2, 2025; most rules apply from Aug 2, 2026 with phased dates for high‑risk systems.[11]

•Revised Product Liability Directive (2024/2853): clarifies that software, including AI systems, can trigger strict product‑liability claims; Member States must transpose by Dec 9, 2026.[12]

United Kingdom

•No single AI statute yet; the government uses a “pro‑innovation” approach via sector regulators (ICO, Ofcom, MHRA, etc.) guided by cross‑sector principles; the Online Safety Act 2023 imposes duties (including recommender/transparency‑related provisions) on user‑to‑user and search services.[13]

China

•Binding rules on algorithms and GenAI: providers must file certain recommendation algorithms, label deep‑synthesis content, comply with security/ethics/data‑protection obligations, and—if services have “public opinion”/mobilization capacity—undergo security assessments.[14]

International instruments (soft law but widely referenced)

•OECD AI Principles (2019; updated May 3, 2024) inform many national frameworks.[15]

•G7 Hiroshima AI Process: voluntary Guiding Principles and a Code of Conduct for developers of advanced AI systems.[16]

•UN General Assembly Resolution A/RES/78/265 (Mar 21, 2024) calls for safe, secure, trustworthy AI consistent with human rights and sustainable development.[17]

•Council of Europe Framework Convention on AI, Human Rights, Democracy and Rule of Law (opened for signature Sept 5, 2024): first binding international AI treaty (parties choose how to implement).[18]

Standards and assurance (increasingly used by regulators and buyers)

•ISO/IEC 42001:2023 (AI management systems) – a certifiable governance standard many organizations are adopting.[19]

•NIST AI Risk Management Framework 1.0 (2023) + Generative AI Profile (2024) – voluntary, but often referenced in procurement and compliance programs.[20]

What “accountability” typically looks like across these rules

•Risk management and impact assessments (before and after deployment).[5]

•Independent testing/audits for certain uses (e.g., NYC hiring tools).[6]

•Transparency to users and the public (model/system documentation, training‑data summaries, notices).[10]

•Incident reporting and human oversight/appeal paths (e.g., EU AI Act, CA SB 53).[21]

•Enforcement via consumer‑protection, civil‑rights, sectoral, and product‑liability laws (FTC, EEOC/ADA, CFPB; EU PLD).[2]

If you tell me your sector (e.g., hiring, healthcare, finance) and where you operate, I can map the specific rules, deadlines, and must‑dos for your situation.

Citations (21)

1federalreserve.govGovernment
The Fed - Board of Governors of the Federal Reserve System Compliance Plan for OMB Memorandum M-25-21
Backs: “EO 14110 (Oct 2023) was rescinded on Jan 20, 2025 and superseded by EO 14179 (Jan 23, 2025), which led to the M‑25‑21/M‑25‑22 updates.”
2thefederalregister.orgLow provenance
Policy Statement Concerning the Suppression of Accuracy in Artificial Intelligence Systems | 91 FR 41638
Backs: “Consumer protection and advertising: the FTC enforces Section 5 (unfair/deceptive practices) against false AI claims and harmful uses, and has recently reiterated this policy in Federal Register notices and enforcement sweeps.”
3consumerfinance.govGovernment
Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms | Consumer Financial Protection Bureau
Backs: “Financial services (credit): the CFPB says “black‑box” models don’t excuse lenders from giving specific adverse‑action reasons under ECOA/Reg B.”
4aclum.orgNonprofits and think tanks
Select Issues: Assessing Adverse Impact in Software, Algorithms, and Artificial Intelligence Used in Employment Selection Procedures Under Title VII of the Civil Rights Act of 1964 | U.S. Equal Employment Opportunity Commission
Backs: “DOJ/ADA guidance covers disability‑related risks in hiring tech.”
5colorado.govGovernment
SB24-205 Consumer Protections for Artificial Intelligence | Colorado General Assembly
Backs: “Developers and deployers must run risk‑management programs and mitigate algorithmic discrimination starting Feb 1, 2026.”
6nyc.govGovernment
Automated Employment Decision Tools (AEDT) - DCWP
Backs: “New York City Local Law 144 (AEDT): employers can’t use automated hiring/promotion tools unless they undergo an annual bias audit and provide notices (enforced since July 5, 2023).”
7ny.govGovernment
Insurance Circular Letter No. 7 (2024): Use of Artificial Intelligence Systems and External Consumer Data and Information Sources in Insurance Underwriting and Pricing | Department of Financial Services
Backs: “NYDFS final guidance requires insurers to control, document, test, and disclose use of AI/external consumer data, and to avoid unfair discrimination in underwriting/pricing.”
8ilga.govGovernment
Official Government Website of the Illinois General Assembly
Backs: “AI Video Interview Act requires disclosure/consent for AI analysis of applicant video interviews.”
9ca.govGovernment
Governor Newsom signs SB 53, advancing California’s world-leading artificial intelligence industry | Governor of California
Backs: “Large frontier‑model developers must publish a safety framework and transparency reports, and report “critical safety incidents”; it also adds whistleblower protections.”
10legiscan.comData and tools
Bill Text: CA AB2013 | 2023-2024 | Regular Session | Chaptered | LegiScan
Backs: “Generative AI Training Data Transparency (AB 2013): developers making GenAI available in CA must post documentation about training data (high‑level dataset summaries and related details) by Jan 1, 2026 and before major updates.”
11europa.euGovernment
Navigating the AI Act | Shaping Europe’s digital future
Backs: “GPAI and governance provisions apply since Aug 2, 2025; most rules apply from Aug 2, 2026 with phased dates for high‑risk systems.”
12europa.euGovernment
Directive - 2024/2853 - EN - Product Liability Directive - EUR-Lex
Backs: “Revised Product Liability Directive (2024/2853): clarifies that software, including AI systems, can trigger strict product‑liability claims; Member States must transpose by Dec 9, 2026.”
13parliament.ukGovernment
AI regulation in the UK
Backs: “No single AI statute yet; the government uses a “pro‑innovation” approach via sector regulators (ICO, Ofcom, MHRA, etc.) guided by cross‑sector principles; the Online Safety Act 2023 imposes duties (including recommender/transparency‑related provisions) on user‑to‑user and search services.”
14stanford.eduAcademic
Translation: Internet Information Service Algorithmic Recommendation Management Provisions – Effective March 1, 2022
Backs: “Binding rules on algorithms and GenAI: providers must file certain recommendation algorithms, label deep‑synthesis content, comply with security/ethics/data‑protection obligations, and—if services have “public opinion”/mobilization capacity—undergo security assessments.”
15oecd.orgGovernment
OECD Legal Instruments
Backs: “OECD AI Principles (2019; updated May 3, 2024) inform many national frameworks.”
16g7g20-documents.orgAcademic
Hiroshima Process International Guiding Principles for Organizations Developing Advanced AI System (30/10/2023) - G7/G20 Documents Database
Backs: “G7 Hiroshima AI Process: voluntary Guiding Principles and a Code of Conduct for developers of advanced AI systems.”
17un.orgGovernment
A/RES/78/265
Backs: “UN General Assembly Resolution A/RES/78/265 (Mar 21, 2024) calls for safe, secure, trustworthy AI consistent with human rights and sustainable development.”
18coe.intGovernment
The Framework Convention on Artificial Intelligence - Artificial Intelligence
Backs: “Council of Europe Framework Convention on AI, Human Rights, Democracy and Rule of Law (opened for signature Sept 5, 2024): first binding international AI treaty (parties choose how to implement).”
19iso.orgNonprofits and think tanks
ISO/IEC 42001:2023 - AI management systems
Backs: “ISO/IEC 42001:2023 (AI management systems) – a certifiable governance standard many organizations are adopting.”
20nist.govGovernment
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
Backs: “NIST AI Risk Management Framework 1.0 (2023) + Generative AI Profile (2024) – voluntary, but often referenced in procurement and compliance programs.”
21europa.euGovernment
Regulation - EU - 2024/1689 - EN - EUR-Lex
Backs: “Incident reporting and human oversight/appeal paths (e.g., EU AI Act, CA SB 53).”