What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Short answer: It’s a patchwork. In the U.S. there’s no single federal AI law, so a mix of executive-branch rules, sector laws, and state/local statutes apply. Outside the U.S., the EU’s AI Act is now in force with staged obligations, China has binding rules for public generative AI, and several international standards and treaties are emerging.

Here’s the current landscape (as of November 8, 2026):

United States (federal)

•Executive branch policy for federal agencies: In January 2025, Executive Order 14148 revoked the 2023 AI executive order; in its place, EO 14179 (“Removing Barriers to American Leadership in AI,” Jan 23, 2025) set a new federal approach. OMB then replaced its 2024 AI memo with M‑25‑21 (Apr 3, 2025), which requires every agency to stand up AI governance, do inventories, designate a Chief AI Officer, and publish compliance plans. These rules bind federal agencies (how government builds/buys/uses AI), not private industry directly.[1]

•Risk-management standards the feds lean on: NIST’s AI Risk Management Framework (AI RMF 1.0) and its Generative AI Profile are the government’s primary voluntary benchmarks that contractors and many companies follow. The Commerce Department’s U.S. AI Safety Institute at NIST also publishes testing/evaluation guidance and coordinates with peer institutes abroad.[2]

•Accountability via existing laws and enforcement:

•FTC: deceptive/unfair AI uses can trigger Section 5 enforcement (e.g., Rite Aid banned from using facial recognition for 5 years and required model/data deletion).[3]

•EEOC/DOJ: discriminatory hiring tools can violate Title VII/ADA; agencies have published technical guidance on AI in employment decisions.[4]

•CFPB/ECOA: lenders using AI must give specific, accurate adverse‑action reasons; “black‑box” models don’t excuse this.[5]

United States (state/local)

•Colorado: SB 26‑189 (signed May 14, 2026) repealed and reenacted the 2024 law; it regulates “automated decision‑making technology” used for consequential decisions (e.g., jobs, credit, housing), enforced by the AG under the Consumer Protection Act. Effective dates are phased.[6]

•California (privacy regulator rules): CPPA regulations on Automated Decisionmaking Technology (ADMT), risk assessments, and cybersecurity audits took effect Jan 1, 2026; businesses making “significant decisions” must meet ADMT requirements by Jan 1, 2027.[7]

•Texas: The Texas Responsible Artificial Intelligence Governance Act (HB 149) effective Jan 1, 2026 requires standardized notices for public‑facing AI used by state/local entities and health‑care disclosures; it also sets governance baselines tied to NIST AI RMF for “heightened scrutiny” AI in government.[8]

•Utah: The Artificial Intelligence Policy Act (SB 149, 2024; amended 2025) requires disclosures in defined consumer and regulated‑occupation interactions and created an Office of AI Policy and a regulatory sandbox.[9]

•New York City: Local Law 144 has, since July 5, 2023, required annual independent bias audits and notices for automated employment decision tools used in NYC hiring/promotion.[10]

•Connecticut: 2025–2026 legislation phases in “high‑risk” AI duties (reasonable‑care/risk‑management and consumer disclosures) beginning in late 2026.[11]

European Union

•EU AI Act (Regulation (EU) 2024/1689): In force since Aug 1, 2024; most rules apply from Aug 2, 2026, with staged timelines. Prohibited practices and some literacy duties started earlier (Feb 2025). High‑risk obligations and some GPAI duties phase in through 2027–2028, with additional timing adjustments adopted in 2026. Expect conformity assessment, documentation, post‑market monitoring, and transparency (e.g., content labeling in some cases).[12]

•DSA/DMA already apply alongside the AI Act: very large platforms must perform systemic‑risk assessments, undergo independent audits, increase recommender‑system transparency, and meet data‑access rules; “gatekeepers” face additional interoperability and fairness obligations. These rules increasingly touch AI‑driven ranking/recommendation.[13]

•Council of Europe Framework Convention on AI (treaty): Opened for signature Sept 5, 2024; once ratified and in force for a Party, it obliges human‑rights‑respecting, transparent, and accountable AI governance across the AI lifecycle.[14]

China

•Binding national rules for public‑facing AI: the CAC’s Generative AI Measures (effective Aug 15, 2023) require lawful training data, content controls, transparency, and security assessments for services with “public‑opinion or social‑mobilisation” capacity. China also has earlier rules for algorithmic recommendations (2022) and deep‑synthesis (2023).[15]

Standards and soft‑law (widely referenced by regulators and companies)

•NIST AI RMF 1.0 and its Generative AI Profile (U.S.): lifecycle risk‑management guidance many organizations now map to their controls and audits.[2]

•ISO/IEC 42001:2023: the first certifiable AI management‑system standard; some regulators (and state laws) reference or align with ISO and NIST frameworks.[16]

•OECD AI Principles (2019; updated guidance 2024): non‑binding, but influential across national policies and corporate governance.[17]

What this means in practice if you build or deploy systems like me (LLMs/GPAI)

•You’ll likely answer to sector laws first (consumer protection, credit, employment, health, civil‑rights/ADA), plus privacy/security laws; regulators increasingly say “AI is no excuse”—you must explain decisions, avoid discrimination, and be truthful about AI capabilities.[5]

•If you operate in the EU, plan for AI Act classifications, technical documentation, risk controls, data governance, logging, human oversight, and transparency on a rolling timeline through 2028, and remember DSA/DMA apply now to the largest platforms.[18]

•If you sell to or integrate with U.S. federal agencies, you’ll be asked to align with OMB M‑25‑21 and NIST AI RMF/GenAI Profile. Private companies increasingly adopt the same controls (e.g., impact assessments, evaluation/red‑teaming, incident response, content provenance).[19]

•In China, public‑facing generative AI providers must meet content, data, and safety filing requirements; foreign models made available there must comply.[15]

•In certain U.S. states/cities (e.g., CA, CO, NYC, TX, UT), expect specific duties such as bias audits, user disclosures, or documented risk programs for consequential decisions.[10]

If you want, tell me your sector and where you operate, and I’ll map the concrete obligations and dates you face.

Citations (19)

1govinfo.govGovernment
Federal Register, Volume 90 Issue 17 (Tuesday, January 28, 2025)
Backs: “These rules bind federal agencies (how government builds/buys/uses AI), not private industry directly.”
2nist.govGovernment
Artificial Intelligence Risk Management Framework (AI RMF 1.0)
Backs: “AI Safety Institute at NIST also publishes testing/evaluation guidance and coordinates with peer institutes abroad.”
3ftc.govGovernment
Rite Aid Banned from Using AI Facial Recognition After FTC Says Retailer Deployed Technology without Reasonable Safeguards | Federal Trade Commission
Backs: “FTC: deceptive/unfair AI uses can trigger Section 5 enforcement (e.g., Rite Aid banned from using facial recognition for 5 years and required model/data deletion).”
4aclum.orgNonprofits and think tanks
Select Issues: Assessing Adverse Impact in Software, Algorithms, and Artificial Intelligence Used in Employment Selection Procedures Under Title VII of the Civil Rights Act of 1964 | U.S. Equal Employment Opportunity Commission
Backs: “EEOC/DOJ: discriminatory hiring tools can violate Title VII/ADA; agencies have published technical guidance on AI in employment decisions.”
5consumerfinance.govGovernment
Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms | Consumer Financial Protection Bureau
Backs: “CFPB/ECOA: lenders using AI must give specific, accurate adverse‑action reasons; “black‑box” models don’t excuse this.”
6colorado.govGovernment
SB26-189 Automated Decision-Making Technology | Colorado General Assembly
Backs: “SB 26‑189 (signed May 14, 2026) repealed and reenacted the 2024 law; it regulates “automated decision‑making technology” used for consequential decisions (e.g., jobs, credit, housing), enforced by the AG under the Consumer Protection Act. Effective dates are phased.”
7ca.govGovernment
California Finalizes Regulations to Strengthen Consumers' Privacy
Backs: “CPPA regulations on Automated Decisionmaking Technology (ADMT), risk assessments, and cybersecurity audits took effect Jan 1, 2026; businesses making “significant decisions” must meet ADMT requirements by Jan 1, 2027.”
8texas.govGovernment
89(R) History for HB 149 | Texas Legislature Online
Backs: “The Texas Responsible Artificial Intelligence Governance Act (HB 149) effective Jan 1, 2026 requires standardized notices for public‑facing AI used by state/local entities and health‑care disclosures; it also sets governance baselines tied to NIST AI RMF for “heightened scrutiny” AI in government.”
9utah.govGovernment
Enrolled Copy S.B. 149
Backs: “The Artificial Intelligence Policy Act (SB 149, 2024; amended 2025) requires disclosures in defined consumer and regulated‑occupation interactions and created an Office of AI Policy and a regulatory sandbox.”
10nyc.govGovernment
Automated Employment Decision Tools (AEDT) - DCWP
Backs: “Local Law 144 has, since July 5, 2023, required annual independent bias audits and notices for automated employment decision tools used in NYC hiring/promotion.”
11ct.govGovernment
AN ACT CONCERNING ARTIFICIAL INTELLIGENCE.
Backs: “2025–2026 legislation phases in “high‑risk” AI duties (reasonable‑care/risk‑management and consumer disclosures) beginning in late 2026.”
12europa.euGovernment
AI Act enters into force
Backs: “Expect conformity assessment, documentation, post‑market monitoring, and transparency (e.g., content labeling in some cases).”
13europa.euGovernment
Digital Services Act | EUR-Lex
Backs: “These rules increasingly touch AI‑driven ranking/recommendation.”
14coe.intGovernment
The Framework Convention on Artificial Intelligence - Artificial Intelligence
Backs: “Opened for signature Sept 5, 2024; once ratified and in force for a Party, it obliges human‑rights‑respecting, transparent, and accountable AI governance across the AI lifecycle.”
15loc.govGovernment
China: Generative AI Measures Finalized
Backs: “China also has earlier rules for algorithmic recommendations (2022) and deep‑synthesis (2023).”
16iec.chNonprofits and think tanks
ISO/IEC 42001:2023 | IEC
Backs: “ISO/IEC 42001:2023: the first certifiable AI management‑system standard; some regulators (and state laws) reference or align with ISO and NIST frameworks.”
17oecd.orgGovernment
OECD Legal Instruments
Backs: “OECD AI Principles (2019; updated guidance 2024): non‑binding, but influential across national policies and corporate governance.”
18europa.euGovernment
AI Act | Shaping Europe’s digital future
Backs: “If you operate in the EU, plan for AI Act classifications, technical documentation, risk controls, data governance, logging, human oversight, and transparency on a rolling timeline through 2028, and remember DSA/DMA apply now to the largest platforms.”
19whitehouse.govGovernment
EXECUTIVE OFFICE OF THE PRESIDENT
Backs: “Private companies increasingly adopt the same controls (e.g., impact assessments, evaluation/red‑teaming, incident response, content provenance).”