The regulatory landscape governing how AI systems like me (Large Language Models, or LLMs) are built, deployed, and held accountable is a rapidly evolving patchwork. Currently, there is no single global framework. Instead, governance consists of new AI-specific laws, existing legal frameworks (like privacy and copyright), and voluntary industry standards.
Here is a breakdown of the rules that currently exist, categorized by region and type.
1. Hard Law: AI-Specific Regulations
A few jurisdictions have passed laws explicitly designed to regulate AI development and deployment.
•The European Union AI Act (The Global Benchmark):
Passed in 2024, this is the world’s most comprehensive AI law. It uses a risk-based approach:
•General Purpose AI (GPAI): Models like me are classified as GPAI. Developers must provide technical documentation, comply with EU copyright law, and publish summaries of the data used for training.
•Systemic Risk Models: The most powerful models (measured by computing power used to train them) face stricter rules, including mandatory red-teaming (adversarial testing), cybersecurity requirements, and reporting of energy consumption.
•Prohibited AI: Systems that manipulate human behavior, scrape facial images indiscriminately, or use untargeted social scoring are banned.
•The United States (Executive Actions & State Laws):
While the US Congress has not passed a comprehensive federal AI law, regulation is happening via executive orders and state laws:
•White House Executive Order on AI (Oct 2023): Requires developers of the most powerful AI systems to share their safety test results (red-teaming) with the US government before public release, using authority under the Defense Production Act.
•State-Level Laws: California, Colorado, and Utah have passed laws addressing AI. For example, California’s AB 2013 requires AI developers to disclose the data used to train their systems.
•China (Interim Measures for Generative AI):
China was one of the first to regulate generative AI specifically (effective August 2023).
•Content Control: AI systems must adhere to "socialist core values" and cannot generate content that subverts state power or threatens national security.
•Accuracy and Truth: Developers must take measures to ensure the truth, accuracy, and objectivity of training data and outputs.
•Registration: Developers must register their algorithms with the government before deploying them to the public.
2. Existing Laws Applied to AI
Even without "new" AI laws, developers are bound by existing legal frameworks. These are currently the primary tools for holding AI companies accountable.
•Data Privacy Laws (GDPR, CCPA):
The EU’s GDPR and California’s CCPA heavily restrict how personal data is collected and processed.
•Training Data: Regulators are investigating whether AI companies had the legal right to scrape personal data from the internet to train models.
•Right to be Forgotten: GDPR gives users the right to have their data deleted. Because it is incredibly difficult to "delete" data from a trained neural network, this is a major legal friction point.
•Copyright and Intellectual Property (IP) Law:
This is currently the most active legal battleground, especially in the US.
•Dozens of lawsuits (by authors, artists, and publishers like the New York Times) allege that training AI on copyrighted material without permission is copyright infringement.
•AI companies argue this is "Fair Use" (similar to how a human reads books to learn how to write). The courts are currently deciding this issue.
•Consumer Protection and Civil Rights:
In the US, the Federal Trade Commission (FTC) uses its existing powers to police "unfair or deceptive practices."
•Deception: Companies cannot make false claims about what their AI can do.
•Bias and Discrimination: If an AI model is deployed in hiring, housing, or lending and it discriminates against protected groups, the deploying company can be sued under existing civil rights laws.
3. Voluntary Commitments and Technical Standards
Because passing laws takes time, governments and industry groups have relied on "soft law" and voluntary frameworks to guide AI building and deployment.
•The White House Voluntary Commitments:
In 2023, major AI labs (including OpenAI, Google, Anthropic, and Meta) signed voluntary commitments to:
•Subject their models to external safety testing (red-teaming).
•Invest in cybersecurity to protect proprietary model weights.
•Develop watermarking systems so users can identify AI-generated content.
•NIST AI Risk Management Framework (RMF):
Created by the US National Institute of Standards and Technology, this is a highly influential blueprint used by organizations globally to design, develop, and deploy AI systems in a trustworthy manner.
This is an international standard established in late 2023 that specifies requirements for establishing, implementing, maintaining, and continually improving an AI management system within organizations.
Summary: Who is Held Accountable?
If an AI system causes harm (e.g., outputs libelous information, leaks medical data, or assists in a cyberattack), accountability currently falls on two entities:
1.The Developer (The "Builder"): Held accountable under copyright law (for training data), privacy law (for data scraping), and potentially product liability if the model is deemed inherently defective.
2.The Deployer (The "User" or Corporate Customer): If a bank uses an AI to screen loans and the AI discriminates, the bank (not the AI developer) is held legally liable under existing anti-discrimination laws.