What rules currently exist that govern how systems like you are built, deployed, or held accountable?

The regulatory landscape for artificial intelligence has rapidly shifted from voluntary guidelines to binding, enforceable legal frameworks. Diverse regional rules govern how large language models (LLMs) and generative AI systems are built, deployed, and held legally accountable.

1. How AI Systems are Built (Training, Compute, and Data)

Regulators are placing strict requirements on the foundational stages of AI development—specifically targeting training data, computing thresholds, and risk-modeling.

•Training Data Transparency:

•California (AB 2013): Effective January 1, 2026, developers of generative AI models must publish public summaries of their training datasets. This must include the sources of the data, the types of data used, intellectual property details, and whether personal information was included.

•EU AI Act (Chapter V): Under the General-Purpose AI (GPAI) provisions, model providers must comply with EU copyright laws, supply detailed summaries of the content used for training, and submit technical documentation to the EU AI Office.

•Frontier Model Compute Thresholds:

•California (SB 53 / Transparency in Frontier AI Act): Taking effect on January 1, 2026, this law targets "frontier" models trained using more than $10^{26}$ integer or floating-point operations (FLOPs) of compute. Developers of these highly powerful systems are legally required to publish safety and risk-mitigation frameworks and report critical safety incidents to state authorities.

•Mandatory Safety Assessments:

•China's Safety Standards: In November 2026, China officially launched mandatory safety standards requiring all AI firms (both domestic and foreign) to implement rigorous pre-deployment risk assessments, document safety testing results, and maintain detailed data lineage records to align with national data laws.

2. How AI Systems are Deployed (Interacting with the Public)

Deploying AI to the public—whether as chatbots, image generators, or automated decision-makers—is heavily regulated to prevent deception and protect vulnerable users.

•Mandatory "AI Disclosure" and Watermarking:

•EU AI Act (Article 50): In force since August 2, 2026, this rule mandates that users must be clearly informed when they are interacting with an AI system (like a chatbot). Additionally, any synthetic text, audio, or video generated by the system must be marked with machine-readable metadata (watermarks).

•California (SB 942 / AI Transparency Act): Operating since August 2026, this law requires providers of generative AI systems with over one million monthly users in California to offer free AI-detection tools and embed latent, machine-readable provenance markers in generated media.

•South Korea (Basic Act on AI): Effective January 22, 2026, this law requires developers to label deepfakes and clearly inform users in advance when they are interacting with generative or high-impact AI systems.

•Behavior and Companion AI Restrictions:

•China's Anthropomorphic Rules: In response to the rapid rise of emotional companion chatbots and digital avatars, China enacted rules in July 2026 targeting human-like AI interactions. These regulations mandate anti-addiction controls, explicit "Digital Human" identifiers, and strict bans on simulating intimacy with minors.

•Use-Case Prohibitions:

•EU AI Act Bans: Certain deployments are strictly prohibited. The EU has banned "unacceptable risk" systems—including social scoring, manipulative AI, and biometric categorization. In December 2026, explicit bans also took effect targeting AI used to generate non-consensual intimate imagery or child sexual abuse material.

3. How AI is Held Accountable (Liability and Compliance)

Who is responsible when an AI system hallucinates, discriminates, or causes harm? Laws are actively dividing liability between developers (who build the models) and deployers (who use them).

•Fines and Enforcement Bodies:

•In the EU, the EU AI Office (active since August 2026) oversees GPAI models. Non-compliance with core bans or GPAI transparency rules can result in astronomical fines of up to €35 million or 7% of a company’s global annual turnover—surpassing even GDPR penalty thresholds.

•Civil Product Liability:

•The EU Approach: Under the updated EU Product Liability Directive, the definition of a "product" was expanded to explicitly include software and cloud-accessed AI. This subjects standalone AI to a no-fault product liability standard.

•The Chinese Approach: In September 2026, China’s Supreme People's Court issued unified judicial guidance drawing a different boundary: strict product liability is reserved for AI embedded in physical goods (like self-driving cars), while claims involving standalone software or cloud-based AI services remain fault-based.

•High-Risk Deployments (Employment, Credit, and Education):

•EU Postponement (The Digital Omnibus): While high-risk deployment categories (Annex III) were originally slated for mid-2026, the EU passed the Digital Omnibus on AI (Regulation (EU) 2026/1744). This officially delayed high-risk compliance deadlines to December 2, 2027 to give the industry and regulators more time to finalize technical compliance standards.

•US State Patchwork: With no federal US law yet, states are acting independently. For example, California’s CCPA rules require mandatory algorithmic risk assessments. Colorado repealed its broad 2024 AI Act in May 2026, replacing it with SB 26-189 (effective January 2027), which replaces general "duties of care" with highly specific transparency rules for automated decision-making technology (ADMT) in high-stakes areas like hiring and lending.

•Federal vs. State Friction: State-level rules in the US face ongoing legal friction; a federal executive order and the DOJ have actively tried to preempt conflicting state-level AI regulations to prioritize nationwide innovation and competitiveness.

To navigate this highly fragmented and rapidly evolving legal reality, AI developers generally adopt a "highest common denominator" posture, aligning their designs with international frameworks like the NIST AI Risk Management Framework (AI RMF) and the ISO/IEC 42001 AI management standard.

Citations (15)

1worldairegulation.orgNonprofits and think tanks
worldairegulation.org
Backs: “The regulatory landscape for artificial intelligence has rapidly shifted from voluntary guidelines to binding, enforceable legal frameworks.”
2verifywise.aiCompanies
verifywise.ai
Backs: “California (AB 2013): Effective January 1, 2026, developers of generative AI models must publish public summaries of their training datasets. This must include the sources of the data, the types of data used, intellectual property details, and whether personal information was included.”
3glacis.ioCompanies
glacis.io
Backs: “California (AB 2013): Effective January 1, 2026, developers of generative AI models must publish public summaries of their training datasets. This must include the sources of the data, the types of data used, intellectual property details, and whether personal information was included.”
4questa-ai.comCompanies
questa-ai.com
Backs: “EU AI Act (Chapter V): Under the General-Purpose AI (GPAI) provisions, model providers must comply with EU copyright laws, supply detailed summaries of the content used for training, and submit technical documentation to the EU AI Office. Frontier Model Compute Thresholds:”
5pitch.lawNot yet classified
pitch.law
Backs: “EU AI Act (Chapter V): Under the General-Purpose AI (GPAI) provisions, model providers must comply with EU copyright laws, supply detailed summaries of the content used for training, and submit technical documentation to the EU AI Office. Frontier Model Compute Thresholds:”
6alicelabs.aiCompanies
alicelabs.ai
Backs: “EU AI Act (Chapter V): Under the General-Purpose AI (GPAI) provisions, model providers must comply with EU copyright laws, supply detailed summaries of the content used for training, and submit technical documentation to the EU AI Office. Frontier Model Compute Thresholds:”
7gc.aiCompanies
gc.ai
Backs: “California (SB 53 / Transparency in Frontier AI Act): Taking effect on January 1, 2026, this law targets "frontier" models trained using more than $10^{26}$ integer or floating-point operations (FLOPs) of compute. Developers of these highly powerful systems are legally required to publish safety and risk-mitigation…”
8emergent.shCompanies
emergent.sh
Backs: “China's Safety Standards: In November 2026, China officially launched mandatory safety standards requiring all AI firms (both domestic and foreign) to implement rigorous pre-deployment risk assessments, document safety testing results, and maintain detailed data lineage records to align with national data laws.”
9china-briefing.comCompanies
china-briefing.com
Backs: “China's Anthropomorphic Rules: In response to the rapid rise of emotional companion chatbots and digital avatars, China enacted rules in July 2026 targeting human-like AI interactions. These regulations mandate anti-addiction controls, explicit "Digital Human" identifiers, and strict bans on simulating intimacy with…”
10iapp.orgNonprofits and think tanks
iapp.org
Backs: “China's Anthropomorphic Rules: In response to the rapid rise of emotional companion chatbots and digital avatars, China enacted rules in July 2026 targeting human-like AI interactions. These regulations mandate anti-addiction controls, explicit "Digital Human" identifiers, and strict bans on simulating intimacy with…”
11regulations.aiData and tools
regulations.ai
Backs: “These regulations mandate anti-addiction controls, explicit "Digital Human" identifiers, and strict bans on simulating intimacy with minors. Use-Case Prohibitions:”
12lyceum.technologyNot yet classified
lyceum.technology
Backs: “Non-compliance with core bans or GPAI transparency rules can result in astronomical fines of up to €35 million or 7% of a company’s global annual turnover—surpassing even GDPR penalty thresholds. Civil Product Liability:”
13responsibleailabs.aiCompanies
responsibleailabs.ai
Backs: “Non-compliance with core bans or GPAI transparency rules can result in astronomical fines of up to €35 million or 7% of a company’s global annual turnover—surpassing even GDPR penalty thresholds. Civil Product Liability:”
14ox.ac.ukAcademic
ox.ac.uk
Backs: “The EU Approach: Under the updated EU Product Liability Directive, the definition of a "product" was expanded to explicitly include software and cloud-accessed AI. This subjects standalone AI to a no-fault product liability standard.”
15verifywise.aiCompanies
verifywise.ai
Backs: “To navigate this highly fragmented and rapidly evolving legal reality, AI developers generally adopt a "highest common denominator" posture, aligning their designs with international frameworks like the NIST AI Risk Management Framework (AI RMF) and the ISO/IEC 42001 AI management standard. 1.”