Honest answer: it's a patchwork, and much of it is still catching up to the technology.
Hard law that actually applies:
•General consumer protection, anti-discrimination, and product liability law still apply even without AI-specific statutes. If an AI system causes harm, existing tort and contract law doesn't just disappear.
•Sector-specific rules matter a lot — healthcare (HIPAA and similar), finance, employment law, credit decisions. If an AI touches those areas, existing regulatory regimes apply, sometimes awkwardly.
•The EU AI Act is the most comprehensive AI-specific law so far, using a risk-tiered approach: certain uses are banned outright, "high-risk" applications face testing/documentation/transparency requirements, lower-risk stuff faces lighter obligations. It's phasing in over the next few years.
•Some jurisdictions have specific rules on things like automated decision-making disclosure, biometric data, or algorithmic discrimination (Illinois' BIPA, various state laws in the US).
Soft law / voluntary frameworks:
•NIST's AI Risk Management Framework in the US — influential but not mandatory.
•Company-level policies (like Anthropic's Responsible Scaling Policy) — these are self-imposed commitments, not legally binding, though they can create reputational or contractual exposure if violated.
•Various government executive orders and agency guidance that create pressure without full statutory force.
Notably thin or absent:
•There's no comprehensive US federal AI law yet — it's a mix of executive action, agency interpretation of existing authority, and state-level experimentation.
•International coordination is weak. Different countries are taking different approaches, and there's no binding global framework.
•Liability for harms caused by AI-generated content or decisions is genuinely unsettled in a lot of cases — courts are still working out how existing frameworks map onto this.
Worth being direct about: a lot of "accountability" right now comes from companies' voluntary commitments, market pressure, and reputational risk rather than enforceable law. That's a real gap, and reasonable people disagree about whether current self-regulation is sufficient or whether it's mostly PR that lacks teeth. I don't think I'm well-positioned to referee that debate — it's a legitimate political and policy question people should be arguing about with real stakes attached.
What's prompting the question — are you looking at this from a policy angle, personal curiosity, or something you're trying to build/evaluate?