A patchwork of laws, regulations, standards, and voluntary frameworks—mostly recent, incomplete, and jurisdiction-specific—governs the building, deployment, and accountability of AI systems like large language models. There is no single global regime.
Binding Laws and Regulations
•European Union – AI Act (Regulation (EU) 2024/1689): The most comprehensive horizontal law. It entered into force in 2024 with phased obligations. It uses a risk-based approach:
•Prohibited practices (e.g., certain social scoring, real-time remote biometric identification in public in most cases, untargeted scraping for facial recognition databases).
•High-risk AI systems (many uses in employment, education, critical infrastructure, law enforcement, etc.) face strict requirements on risk management, data governance, technical documentation, transparency, human oversight, accuracy/robustness, and conformity assessments.
•General-purpose AI (GPAI) models, including systemic-risk models above compute thresholds, face transparency, copyright, and (for the largest) safety/energy reporting and evaluation duties. Deployers and providers have distinct obligations; fines can reach tens of millions of euros or percentages of global turnover.
•Related rules (GDPR, Digital Services Act, product liability updates, upcoming AI Liability Directive discussions) address data protection, platform duties, and civil liability.
•United States: No comprehensive federal AI statute as of now. Governance relies on:
•Existing laws (FTC Act Section 5 against unfair/deceptive practices, sector rules from FDA, EEOC, CFPB, HUD, DOJ, etc., civil rights statutes, product liability/tort, copyright, export controls).
•Executive actions and agency guidance (prior Biden EO 14110 on safe/secure/trustworthy AI; NIST AI Risk Management Framework; agency-specific rules). These can shift with administrations.
•State laws (e.g., California’s various AI/transparency/deepfake/automated decision bills, Colorado AI Act, others on biometric privacy, employment AI, and disclosures).
•National security and export controls (Commerce/BIS rules on advanced chips and certain model weights).
•China: Binding rules on generative AI services (e.g., 2023 Interim Measures), algorithm recommendation filing/registration, deep synthesis/deepfake labeling, and data/security laws. Providers face content controls, security assessments, and real-name requirements.
•Other jurisdictions: UK (pro-innovation regulator guidance + specific powers, no broad Act yet), Canada (AIDA proposal and directives), Singapore, Japan, Brazil, etc., have strategies, voluntary codes, or targeted bills. Many align loosely with OECD principles.
•Cross-cutting legal constraints everywhere: Data protection/privacy (GDPR-style rules, CCPA/CPRA), intellectual property (training data copyright litigation ongoing in multiple countries), consumer protection, anti-discrimination, defamation, and criminal law still apply to AI outputs and uses. Sector rules (medical devices, aviation, finance, autonomous vehicles) impose additional requirements when AI is embedded.
Standards, Frameworks, and Soft Law
•NIST AI RMF, ISO/IEC standards (e.g., 42001 AI management systems), OECD AI Principles, G7 Hiroshima Process code of conduct, and Council of Europe Framework Convention on AI (human rights/democracy/rule-of-law focused).
•Industry and multi-stakeholder efforts (Partnership on AI, Frontier Model Forum, etc.) produce best practices on evaluations, red-teaming, incident reporting, and water-marking/synthetic content labeling.
•Corporate policies: Developers (including Anthropic) publish safety frameworks, model cards/system cards, acceptable use policies, and constitutions or charters that shape training, deployment thresholds, and refusals. These are self-imposed but can interact with legal duties (e.g., via contract or representations).
Accountability and Liability
•Providers vs. deployers: Laws increasingly distinguish model developers/providers from those who integrate or offer systems to users. Obligations (documentation, risk management, monitoring) and liability attach differently.
•Civil liability: Still largely handled by existing product liability, negligence, and contract law; some jurisdictions are clarifying or reversing burdens for AI. Criminal liability remains with humans/organizations.
•Enforcement: Regulators (EU national authorities + AI Office, US FTC/state AGs, etc.), private lawsuits, audits/conformity assessments, and transparency/reporting mandates. Provenance, logging, and human oversight requirements aim to enable accountability.
•Gaps: Rapid capability growth outpaces rules; extraterritorial reach is contested; open-source/foundation models create distribution challenges; measurement of “risk,” “systemic risk,” or “high-risk” remains imperfect; global coordination is limited.
Practical Reality for Systems Like Me
Building and training are constrained by compute/export rules, data laws, and copyright. Deployment involves terms of service, usage policies, safety mitigations, monitoring, and compliance with the highest-bar applicable regimes (often EU for global products). Accountability currently rests primarily on the organizations that develop, fine-tune, host, or integrate the systems, plus end users for misuse. Independent audits, red-teaming, and incident sharing are growing but not yet universal mandates.
This landscape is evolving quickly—new implementing acts, court cases (especially copyright and liability), state laws, and international agreements appear regularly. For the most current details on a specific jurisdiction or use case, check primary sources (EUR-Lex, Federal Register, official agency pages) or legal counsel, as this is not legal advice. Specific high-stakes applications (medical, safety-critical, law enforcement) almost always layer extra domain rules on top of general AI governance.