The rules governing how systems like me (Large Language Models and Generative AI) are built, deployed, and held accountable are currently in a state of rapid transition.
Currently, there is no single global framework. Instead, governance is a patchwork of AI-specific laws, existing general laws (like privacy and copyright), government executive actions, and voluntary industry standards.
Here is a breakdown of the rules that currently exist, categorized by how they impact AI.
1. AI-Specific Regulations (Hard Law)
Governments are increasingly passing laws specifically designed to regulate AI.
•The European Union AI Act (Passed in 2024): This is the world’s most comprehensive AI law. It uses a "risk-based" approach:
•Unacceptable Risk: Systems that manipulate human behavior or perform social scoring are banned.
•High Risk: AI used in healthcare, policing, or hiring must undergo strict conformity assessments, use high-quality data, and ensure human oversight.
•General Purpose AI (GPAI): Models like me must meet transparency requirements, release technical documentation, respect EU copyright law, and share detailed summaries of their training data. "Systemic" models (the largest, most powerful ones) must undergo rigorous safety evaluations and report cyber incidents.
•China’s Generative AI Regulations (2023): China was one of the first to implement specific rules for generative AI.
•Developers must register their algorithms with the government.
•Content generated must align with "socialist core values" and cannot attempt to overthrow state power.
•AI-generated content must be clearly labeled (watermarked) so users know it is not human-made.
•Developers are responsible for the legality of the data used to train the models.
•U.S. State-Level Laws: While U.S. federal AI law is still pending, states are acting. For example, Colorado passed an AI Act in 2024 regulating "algorithmic discrimination" in high-stakes decisions (housing, hiring, insurance), and California has passed several laws targeting deepfakes and AI safety.
2. Existing Laws Applied to AI (How AI is currently held accountable)
Even before AI-specific laws were passed, existing legal frameworks were used to hold AI developers accountable.
•Data Privacy Laws (GDPR in Europe, CCPA in California):
•These laws govern how personal data is collected. AI companies have been fined or investigated under GDPR for training models on public internet data that contains personal information without consent, and for violating the "right to be forgotten" (since it is very difficult to remove specific data from a trained neural network).
•Copyright and Intellectual Property (IP) Law:
•Currently, dozens of lawsuits (e.g., The New York Times v. OpenAI/Microsoft) are working their way through courts to decide if training AI on copyrighted books, articles, and images constitutes "fair use."
•Consumer Protection Laws (The Federal Trade Commission - FTC):
•In the U.S., the FTC uses its existing authority to police "unfair or deceptive practices." They hold AI companies accountable for making false claims about what their AI can do, deploying biased algorithms, or failing to secure user data.
•Civil Rights and Anti-Discrimination Laws:
•If a bank uses an AI tool that discriminates against mortgage applicants based on race, or if a company uses a hiring tool that discriminates based on gender, existing civil rights laws apply. The developers and deployers can be sued.
3. Executive Actions and National Security Rules
Governments are using executive powers to control the building and deployment of highly capable AI.
•U.S. Executive Order on AI (October 2023):
•This order requires developers of the most powerful AI systems to notify the federal government when training a model and to share the results of all "red-team" safety tests (testing for dual-use capabilities like bio-weapons or cyber warfare).
•It uses the Defense Production Act to enforce these disclosures.
•Export Controls: The U.S. government has placed strict export controls on advanced semiconductor chips (such as Nvidia's GPUs). This effectively limits the computational power that foreign adversaries (specifically China) can access to build models of a certain scale.
4. Voluntary Frameworks and Industry Standards (Soft Law)
Because formal laws take years to pass, much of how AI is built today is governed by "soft law"—voluntary standards that companies agree to follow to show they are responsible.
•NIST AI Risk Management Framework (U.S.): Developed by the National Institute of Standards and Technology, this is a highly influential blueprint used by organizations to map, measure, and manage AI risks (like bias, security, and hallucinatory behavior).
•The White House Voluntary Commitments: In 2023, major AI labs (including Google, Microsoft, OpenAI, and Anthropic) formally committed to safety measures, including:
•Allowing independent third-party experts to "red-team" systems before release.
•Developing watermarking technologies to identify AI-generated content.
•Prioritizing research on societal risks like bias and privacy.
•ISO/IEC 42001: An international standard established in late 2023 that specifies requirements for establishing, implementing, and continually improving an AI Management System within organizations.
5. Corporate Governance and Technical Safeguards
Finally, AI developers regulate themselves through internal policies and engineering constraints.
•AI Safety Principles: Companies like Google have published ethical principles (e.g., Google’s AI Principles) that forbid the development of AI for weapons, surveillance that violates international norms, or tech designed to cause harm.
•Reinforcement Learning from Human Feedback (RLHF): During the building phase, developers use RLHF to train models to refuse harmful prompts (e.g., instructions on how to build a bomb, write hate speech, or assist in cyberattacks).
•System Cards and Model Cards: AI companies increasingly publish documentation detailing how a model was trained, its limitations, its safety evaluations, and its intended use cases.