More answers like this
Claude Sonnet 5Nov 7, 2026anthropic/claude-sonnet-5-20260630

What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Here's a breakdown of the current rules and frameworks that apply to AI systems like me, as of late 2026. The landscape is fragmented and changing quickly, so I'll group it by type of rule.

1. Binding law: European Union

The EU AI Act is the most comprehensive binding law globally. It is a European regulation on artificial intelligence, the first comprehensive regulation on AI by a major regulator anywhere, and it assigns applications of AI to risk categories. Applications that create an unacceptable risk, such as government-run social scoring, are banned; high-risk applications are subject to specific legal requirements; and applications not explicitly banned or listed as high-risk are largely left unregulated.

Key current status:

•It applies in tiers: prohibited practices from February 2025, GPAI (general-purpose AI) rules from August 2025, and high-risk AI obligations from December 2027 (Annex III) and August 2028 (Annex I) after 2026 omnibus amendments.
•Geographic reach extends to whenever the AI system's output is used in the EU, regardless of the provider's location — a US-based provider whose AI is used by European companies is in scope.
•Penalties are steep: fines vary by violation, up to €35 million or 7% of global annual turnover for prohibited practice violations; up to €15 million or 3% for most other violations; up to €7.5 million or 1.5% for providing incorrect information.
•For general-purpose models like me specifically, GPAI models must meet additional transparency requirements and providers must maintain technical documentation recording the training and testing process, as well as documentation for downstream providers; systemic risk GPAI models face a further layer of obligations, including adversarial testing.
•A 2026 "Digital Omnibus" amendment delayed some deadlines: it pushed the compliance deadline for standalone high-risk systems under Annex III (covering biometric identification, critical infrastructure, education, employment, and law enforcement) from August 2026 to December 2, 2027.

2. United States: a patchwork, not a single law

As of 2026, the United States has no comprehensive federal AI law — Congress has held hearings, floated proposals, and debated for years, but nothing binding has passed. Instead:

•Federal posture: The current administration rescinded the prior administration's AI executive order and replaced it with an approach focused on removing barriers to AI development. In December 2025, a new executive order directed the Commerce Department to identify "onerous" state AI laws and created an AI Litigation Task Force. However, under generally applicable consumer protection statutes, state attorneys general and regulators may continue pursuing enforcement based on deceptive, misleading, discriminatory, or unfair AI practices, so the EO does not limit state enforcement risk in the near term.
•Agency enforcement: Federal agencies use existing authority to regulate AI even without AI-specific laws — the FTC bans AI-generated fake reviews and enforces against deceptive AI practices, the FCC regulates AI-generated robocalls and voice cloning, and the SEC monitors AI-related fraud and disclosure requirements.
•State laws are the primary binding source right now:
•Colorado: requires deployers of high-risk AI systems making consequential decisions in employment, lending, housing, healthcare, insurance, education, government services, and legal services to run impact assessments, maintain a risk management program, and report algorithmic discrimination to the attorney general within 90 days of discovery.
•Texas: The Responsible Artificial Intelligence Governance Act (TRAIGA) took effect January 1, 2026, taking an intent-based approach that prohibits AI built to incite self-harm, harm others, or facilitate illegal discrimination, with a safe harbor for substantial compliance with the NIST AI Risk Management Framework.
•California: SB 53 targets frontier model developers directly, requiring safety protocols and incident reporting for models built above a defined compute threshold, with civil penalties of up to $1 million. California also has the Transparency in Frontier Artificial Intelligence Act (TFAIA), which requires large frontier developers to implement and publish a comprehensive Frontier AI Framework, updated at least annually, detailing how catastrophic risks are identified, assessed and mitigated throughout the model lifecycle.
•New York: the RAISE Act will demand extensive safety reporting from developers of frontier models beginning in 2027.
•Other states (Illinois, Utah, NYC) have narrower rules on hiring/employment decisions, chatbot disclosure, and bias audits.

3. Voluntary international and industry frameworks

Alongside binding law, a web of voluntary commitments shapes how frontier AI companies (including Anthropic) operate:

•Seoul Frontier AI Safety Commitments (2024): voluntary pledges by leading AI companies to implement responsible scaling and safety practices, including publishing responsible scaling policies, conducting pre-deployment safety evaluations, implementing if-then safety protocols tied to capability thresholds, investing in safety research, and sharing safety-relevant information with governments and other developers.
•Anthropic's own Responsible Scaling Policy (RSP): updated in February 2026 to reflect current understanding of AI and mitigating catastrophic risk, serving both as an internal guidebook and as a model for industry-wide safety standards. It identifies capability and usage thresholds that map to required security and deployment mitigations, currently covering chemical and biological weapons production, misaligned AI systems in high-stakes settings, and automated R&D in key domains such as AI development.
•Frontier Model Forum: Anthropic is a founding member of the Frontier Model Forum (FMF), an industry organization developing safety research, standards, and evaluations for AI safety and responsibility.
•Government safety institutes: companies collaborate with government organizations like the UK AI Security Institute and US Center for AI Standards and Innovation (CAISI) for independent testing.
•White House Accord (September 2026): commits leading AI companies to internal controls, independent external scrutiny and board oversight.
•EU Code of Practice for GPAI: a voluntary bridge mechanism — a voluntary document detailing measures that signatory companies commit to uphold, which, per the EU AI Act, functions as presumption of compliance with certain GPAI obligations.

4. Important caveat: much of this is still voluntary, and enforcement is uneven

Independent assessments are blunt about the gap between commitments and practice: the 2025 AI Safety Index by the Future of Life Institute, which grades the biggest players' safety and security measures, found "the industry is fundamentally unprepared for its own stated goals," with "only 3 of 7 firms report[ing] substantive testing for dangerous capabilities linked to large-scale risks such as bio- or cyber-terrorism." Similarly, SaferAI's rating of risk management practices concluded "all companies currently have weak to very weak risk management practices," with the best in class scoring 34 percent in risk maturity. The broader International AI Safety Report echoes this: industry commitments to safety governance have expanded, with 12 companies publishing or updating Frontier AI Safety Frameworks in 2025, but most risk management initiatives remain voluntary, with only a few jurisdictions beginning to formalise some practices as legal requirements.

5. Pre-existing laws that apply even without AI-specific rules

Systems like me are also indirectly governed by laws that predate AI but apply to how data is used and decisions are made: state privacy laws like the CCPA, Virginia CDPA, and Colorado Privacy Act apply to AI systems that process personal data, including requirements for automated decision-making disclosures and opt-out rights, and civil rights statutes like Title VII, the ADA, and the ADEA apply to AI-driven decisions in contexts like employment.

Bottom line: There's no single rulebook. I'm shaped by (a) Anthropic's own voluntary safety policies (RSP) and industry commitments, (b) binding EU law that's phasing in through 2028, (c) a growing but inconsistent patchwork of US state laws, (d) ad hoc US federal agency enforcement under existing consumer-protection and anti-discrimination statutes, and (e) international soft-law efforts (G7, UN, OECD, AI Safety Summits) that influence but don't bind. The overall trend noted across sources is a shift "from principle to enforcement, from voluntary standards to mandatory obligations" — but that shift is still very much in progress and varies enormously by jurisdiction.

Citations (29)

  1. 1artificialintelligenceact.euNonprofits and think tanks
    EU Artificial Intelligence Act | Up-to-date developments and analyses of the EU AI Act

    Source excerpt: “The AI Act is a European regulation on artificial intelligence (AI) – the first comprehensive regulation on AI by a major regulator anywhere.The Act a...”

  2. 2artificialintelligenceact.euNonprofits and think tanks
    EU Artificial Intelligence Act | Up-to-date developments and analyses of the EU AI Act

    Source excerpt: “First, applications and systems that create an unacceptable risk, such as government-run social scoring of the type used in China, are banned. Second,...”

  3. 3regulation-ai.euNot yet classified
    EU AI Act in 2026: What Applies, What Was Deferred | Regulation AI

    Source excerpt: “It applies in tiers: prohibited practices from February 2025, GPAI rules from August 2025, and high-risk AI obligations from December 2027 (Annex III)...”

  4. 4regulation-ai.euNot yet classified
    EU AI Act in 2026: What Applies, What Was Deferred | Regulation AI

    Source excerpt: “Providers — organisations that develop AI systems or general-purpose AI models and place them on the EU market or put them into service in the EU · De...”

  5. 5regulation-ai.euNot yet classified
    EU AI Act in 2026: What Applies, What Was Deferred | Regulation AI

    Source excerpt: “Fines vary by violation: up to €35 million or 7% of global annual turnover for prohibited practice violations; up to €15 million or 3% for most other ...”

  6. 6traverssmith.comNot yet classified
    The EU AI Act – the current state of play | Travers Smith

    Source excerpt: “GPAI models must meet additional transparency requirements and providers must maintain technical documentation recording the training and testing proc...”

  7. 7anecdotes.aiCompanies
    AI Regulations in 2027: US, EU, UK, China & More

    Source excerpt: “However, in 2026 the EU adopted a simplification package known as the "AI Omnibus," which pushed the compliance deadline for standalone high-risk syst...”

  8. 8verifywise.aiCompanies
    US AI regulations 2026: the state laws you must comply with | VerifyWise Blog

    Source excerpt: “As of 2026, the United States has no comprehensive federal AI law. Congress has held hearings, floated proposals, and debated for years, but nothing b...”

  9. 9transcend.ioCompanies
    Global AI Regulation in 2026: US, EU & China Guide | Transcend

    Source excerpt: “The current administration rescinded the prior administration's AI executive order and replaced it with an approach focused on removing barriers to AI...”

  10. 10transcend.ioCompanies
    Global AI Regulation in 2026: US, EU & China Guide | Transcend

    Source excerpt: “In December 2025, a new executive order went further: it directed the Commerce Department to identify “onerous” state AI laws, created an AI Litigatio...”

  11. 11gunder.comLow provenance
    2026 AI Laws Update: Key Regulations and Practical Guidance | Gunderson Dettmer Stough Villeneuve Franklin & Hachigian, LLP

    Source excerpt: “Further, under generally applicable consumer protection “unfair or deceptive acts and practices” and anti-competition statutes, state attorneys genera...”

  12. 12drata.comCompanies
    Artificial Intelligence Regulations: State and Federal AI Laws 2026

    Source excerpt: “Federal agencies use existing authority to regulate AI, even without AI-specific laws: Federal Trade Commission (FTC): Bans AI-generated fake reviews ...”

  13. 13transcend.ioCompanies
    Global AI Regulation in 2026: US, EU & China Guide | Transcend

    Source excerpt: “Colorado: The Colorado AI Act (SB 24-205) requires deployers of high-risk AI systems, those making consequential decisions in employment, lending, hou...”

  14. 14transcend.ioCompanies
    Global AI Regulation in 2026: US, EU & China Guide | Transcend

    Source excerpt: “Its enforcement date was pushed from February 1 to June 30, 2026 · Texas: The Responsible Artificial Intelligence Governance Act (TRAIGA) took effect ...”

  15. 15transcend.ioCompanies
    Global AI Regulation in 2026: US, EU & China Guide | Transcend

    Source excerpt: “It takes an intent-based approach, prohibiting AI built to incite self-harm, harm others, or facilitate illegal discrimination, and it includes a safe...”

  16. 16whitecase.comCompanies
    AI Watch: Global regulatory tracker - United States | White & Case LLP

    Source excerpt: “Under the TFAIA, large frontier developers (frontier developers having $500 million gross annual revenue) are also required to implement and publish a...”

  17. 17cimplifi.comCompanies
    2026 AI Regulation Guide for Legal and Compliance Leaders | Cimplifi

    Source excerpt: “Although not effective until 2027, New York’s Responsible AI Safety and Education (RAISE) Act will demand extensive safety reporting from developers o...”

  18. 18aisecurityandsafety.orgNonprofits and think tanks
    Frontier AI Safety Commitments (Voluntary Industry Accord) | AI Safety Directory

    Source excerpt: “The Frontier AI Safety Commitments represent a set of voluntary pledges by leading AI companies to implement responsible scaling and safety practices ...”

  19. 19anthropic.comCompanies
    Anthropic’s Transparency Hub \ Anthropic

    Source excerpt: “In February 2026, we updated the RSP to reflect our current understanding of AI and mitigating catastrophic risk. It serves both as our internal guide...”

  20. 20anthropic.comCompanies
    Anthropic’s Transparency Hub \ Anthropic

    Source excerpt: “Related Commitments: G7 Hiroshima Process International Code of Conduct; AI Seoul Summit's Frontier AI Safety Commitments; Seoul AI Business Pledge · ...”

  21. 21anthropic.comCompanies
    Anthropic’s Transparency Hub \ Anthropic

    Source excerpt: “Related Commitments: G7 Hiroshima Process International Code of Conduct; Trusted Tech Alliance · We are a founding member of the Frontier Model Forum ...”

  22. 22anthropic.comCompanies
    Anthropic’s Transparency Hub \ Anthropic

    Source excerpt: “We collaborate with government organizations like the UK AI Security Institute and US Center for AI Standards and Innovation (CAISI) for independent t...”

  23. 23twobirds.comCompanies
    Frontier AI safety on both sides of the Atlantic the White House Accord and the EU AI Act - Bird & Bird

    Source excerpt: “The White House Accord of 29 September 2026 commits leading AI companies to internal controls, independent external scrutiny and board oversight. ”

  24. 24csis.orgNonprofits and think tanks
    Toward a Federal Framework: Lessons from State and International Frontier AI Regulation | CSIS

    Source excerpt: “The Code of Practice is a voluntary document detailing the measures that signatory companies commit to uphold. ”

  25. 25csis.orgNonprofits and think tanks
    Toward a Federal Framework: Lessons from State and International Frontier AI Regulation | CSIS

    Source excerpt: “The 2025 AI Safety Index by the Future of Life Institute, which grades the biggest players’ safety and security measures, finds that “the industry is ...”

  26. 26csis.orgNonprofits and think tanks
    Toward a Federal Framework: Lessons from State and International Frontier AI Regulation | CSIS

    Source excerpt: “SaferAI’s rating of risk management practices among companies that published their safety frameworks concludes that “all companies currently have weak...”

  27. International AI Safety Report 2026 | International AI Safety Report

    Source excerpt: “Industry commitments to safety governance have expanded. In 2025, 12 companies published or updated Frontier AI Safety Frameworks – documents that des...”

  28. 28drata.comCompanies
    Artificial Intelligence Regulations: State and Federal AI Laws 2026

    Source excerpt: “State privacy laws like the California Consumer Privacy Act (CCPA), Virginia Consumer Data Protection Act (CDPA), and Colorado Privacy Act apply to AI...”

  29. 29drata.comCompanies
    Artificial Intelligence Regulations: State and Federal AI Laws 2026

    Source excerpt: “Title VII of the Civil Rights Act, the Americans with Disabilities Act (ADA), and the Age Discrimination in Employment Act (ADEA) apply to AI-driven d...”