More answers like this
GPT-5Sep 8, 2026openai/gpt-5-2025-08-07
What rules currently exist that govern how systems like you are built, deployed, or held accountable?
Short answer: there isn’t one global rulebook. Systems like me are governed by a patchwork of binding laws, sector rules, and voluntary standards that differ by country and use case. Below is a concise snapshot of the main frameworks as of my knowledge cutoff (Oct 2024). If you tell me your jurisdiction and use case, I can tailor this.
Global principles and standards (often used in procurement, audits, or as “safe harbors”)
•OECD AI Principles (2019): fairness, transparency, safety, accountability, human rights.
•ISO/IEC standards: 23894 (AI risk management), 42001 (AI management systems, certifiable), 25059 (AI quality model), 24028 (trustworthiness), 23053 (AI concepts), plus ISMS/Privacy (27001/27701).
•NIST: AI Risk Management Framework 1.0 (2023), GenAI profile and red-teaming guidance, Secure Software Development Framework.
•IEEE: 7000-series (ethically aligned design, transparency, bias).
•C2PA/Coalition for Content Provenance: standards for provenance/watermarking of media.
•OWASP: Top 10 for LLM applications; MLSecOps practices.
European Union
•EU AI Act: a horizontal, risk-based law.
•Bans certain practices (e.g., social scoring by public authorities, emotion recognition in workplaces/education, biometric categorization using sensitive traits, and some uses of remote biometric ID).
•“High-risk” systems (e.g., in employment, credit, essential services, medical devices) face strict obligations: risk management, data governance, technical documentation, transparency, human oversight, accuracy/robustness/cybersecurity, post-market monitoring, incident reporting, conformity assessment and CE-marking.
•General-purpose/foundation models have transparency and documentation duties; models with “systemic risk” face stronger evaluation and risk-mitigation requirements and copyright compliance (including training-data summaries).
•Deployers (users) also have duties (use per instructions, monitoring, recordkeeping; some must conduct impact assessments and inform individuals).
•Strong fines, market-surveillance and coordinated enforcement. Phased application over several years.
•GDPR and ePrivacy: govern training/data use, profiling, data subject rights, DPIAs; limits on “solely automated” decisions with significant effects.
•DSA/DMA: platform transparency, risk assessments/mitigations (including deepfakes/disinformation) for very large platforms; ad/recommender transparency.
•Sector rules: MDR/IVDR for medical AI, product safety, and evolving product liability rules.
United States (federal)
•Executive Order 14110 (2023) and OMB guidance: directs federal agencies to inventory and manage AI risks, conduct impact assessments/red-teaming for safety-impacting uses, designate Chief AI Officers, and use content provenance/watermarking for government-generated AI content. NIST tasked with testing/evaluation and content provenance guidance.
•FTC, CFPB, EEOC, DOJ: enforce existing laws against unfair/deceptive practices, discrimination, “AI-washing” claims, explainability in credit decisions, and civil-rights violations.
•Sector regulators:
•FDA: pathways and guidance for AI/ML-enabled medical devices (including change control plans).
•Financial regulators (Fed/OCC/FDIC, CFPB, SEC/FINRA): model risk management, fair lending, adverse action notices, and enforcement against misleading AI claims.
•Transportation (NHTSA/FAA): safety oversight and recall authority for automated systems.
•Intellectual property: unsettled for training data and outputs; active litigation and agency guidance.
United States (state/local)
•Comprehensive privacy laws (CA, CO, CT, VA, UT, etc.): rights around automated profiling, DPIAs for high-risk processing, purpose limits, opt-outs.
•Colorado AI Act (2024): obligations for developers and deployers of high-risk AI that make consequential decisions (risk management, bias testing, notices, appeals). State AG enforcement; phased timelines.
•NYC Local Law 144: bias audits, notices, and disclosures for automated employment decision tools.
•Illinois BIPA and similar biometric laws (TX, WA): strict consent and security for face/voice/biometric data; private rights of action.
•Other targeted rules exist (e.g., AI in hiring/interviews, K‑12, deepfake election content), varying by state.
United Kingdom
•Principle-based, regulator-led approach (no single AI Act).
•ICO applies data protection/fairness rules to AI (DPIAs, transparency, rights).
•CMA, FCA, MHRA, and others issue guidance/enforce within sectors; Online Safety Act imposes duties on platforms to mitigate illegal/harmful content (relevant to deepfakes).
•UK AI Safety Institute conducts model evaluations; guidance is largely non-binding but influential; government expects regulators to apply cross-cutting AI principles.
Canada
•AIDA (Artificial Intelligence and Data Act) proposed to regulate “high-impact” AI with risk management, transparency, audits, and an AI/Data Commissioner; still progressing legislatively as of Oct 2024.
•Existing privacy/human-rights laws (PIPEDA/provincial laws); Quebec Law 25 requires notice and explanation for automated decisions and a right to human review.
China
•Algorithmic Recommendation Provisions: registration/filing of recommender algorithms; user controls; content governance.
•Deep Synthesis (deepfake) and Generative AI Measures: security assessments, model/service filing, dataset/IP compliance, watermarking/labeling synthetic content, content moderation, user complaint handling; enforced by the Cyberspace Administration and related bodies.
•PIPL/Data Security/Cybersecurity Laws: strict data and security rules with extraterritorial reach.
Other jurisdictions (examples)
•Singapore: Model AI Governance Framework and AI Verify testing (voluntary); PDPA applies to data use.
•Japan: non-binding AI guidelines; APPI privacy law governs data.
•Australia: moving toward targeted guardrails for higher-risk AI; sectoral laws and upcoming privacy reforms.
•Brazil: LGPD privacy; comprehensive AI bill under debate.
•Council of Europe: new Framework Convention on AI, Human Rights, Democracy, and Rule of Law (2024) open for signature; will bind ratifying states.
Common accountability tools you’ll see required or expected
•Risk management programs and governance (often to ISO/IEC 42001 or NIST AI RMF).
•Data governance, documentation (model cards, data sheets), and logging/traceability.
•Pre-deployment testing, bias/robustness evaluations, and ongoing monitoring; independent audits in some contexts (e.g., NYC AEDT).
•Impact assessments (DPIAs, algorithmic impact assessments), human oversight, and incident reporting.
•Transparency to users and affected persons; notices, explanations, and avenues to contest decisions.
•Security and abuse/misuse safeguards; red-teaming for safety-impacting systems.
•Content provenance/watermarking and labeling of AI-generated or manipulated media.
This area is changing quickly. If you share your country/industry and whether you’re a provider, deployer, or evaluator, I can give you a focused, up-to-date checklist and point to the most relevant authorities and standards. I’m not a lawyer, but I can help you frame the issues and find primary sources.