No single global statute comprehensively governs the building, deployment, or accountability of AI systems like large language models. Instead, a patchwork of binding laws, sector-specific rules, executive actions, soft-law principles, and emerging liability doctrines applies, varying significantly by jurisdiction and use case. These are evolving rapidly.
Binding and Quasi-Binding Rules by Jurisdiction
•European Union (most comprehensive framework): The EU AI Act (Regulation 2024/1689) establishes a risk-based regime. It prohibits certain practices (e.g., social scoring by governments, real-time remote biometric identification in public spaces with narrow exceptions, untargeted scraping of facial images for recognition databases, and AI that manipulates behavior or exploits vulnerabilities in harmful ways). High-risk systems (many in employment, education, critical infrastructure, law enforcement, etc.) face requirements for risk management, data governance, technical documentation, transparency, human oversight, accuracy/robustness, and conformity assessments before deployment. General-purpose AI (GPAI) models, including systemic-risk ones like frontier LLMs, face transparency obligations (training data summaries, energy use), copyright compliance measures, and—for the most capable—evaluations, adversarial testing, incident reporting, and cybersecurity. Providers and deployers have post-market monitoring duties. Penalties can reach 6–7% of global turnover. The Act interacts with the GDPR (data protection for training/inference), Digital Services Act, and product liability rules. Full applicability phases in through 2026–2027.
•United States (sectoral + executive, no comprehensive federal AI law):
•Biden-era Executive Order 14110 (2023) imposed safety/security testing and reporting for dual-use foundation models above compute thresholds, red-teaming, watermarking/synthetic content provenance, and agency guidance; parts have been altered or under review under subsequent administrations, but related agency work continues.
•NIST AI Risk Management Framework (voluntary but influential) and agency-specific rules (FDA for medical devices, FTC Act Section 5 against unfair/deceptive practices including biased or unsubstantiated AI claims, EEOC/DOJ on discrimination, CFPB on credit, etc.).
•State laws (e.g., California’s various AI/transparency/privacy bills, Colorado AI Act for high-risk automated decisions, Illinois biometric rules).
•Existing law applies: copyright (training data fair use disputes ongoing in courts), Section 230 (platform immunity debates for AI outputs), product liability/tort, fraud, export controls (e.g., Commerce Department restrictions on advanced chips/models to certain countries), and national security reviews.
•China: Generative AI Interim Measures and algorithm recommendation regulations require security assessments, content controls (socialist core values, no disruption of order), real-name elements, labeling of synthetic content, and filing for public-facing services. Deep synthesis and recommendation algorithm rules add transparency and user-rights obligations. Data security and personal information laws heavily constrain training data and cross-border flows.
•Other notable regimes: UK (pro-innovation white papers + sector regulators, Online Safety Act elements); Canada (proposed Artificial Intelligence and Data Act elements); Singapore, Japan, Brazil, and others with guidelines or emerging bills. Council of Europe Framework Convention on AI (human rights, democracy, rule of law) is a binding treaty for parties.
Development (Building) Constraints
•Data protection and IP: GDPR/CCPA-style rules, copyright/fair use (unsettled for scraping), and dataset transparency mandates (EU GPAI).
•Safety and security: Testing, risk management, and (for advanced models) reporting under EU AI Act systemic-risk rules and residual US EO/agency expectations. Export controls and compute/reporting thresholds affect frontier training.
•Prohibited or restricted techniques in some places (e.g., certain biometric or manipulative systems).
•Voluntary but widely referenced: OECD AI Principles, voluntary industry commitments on safety testing, and standards (ISO/IEC 42001 AI management systems).
Deployment Constraints
•Transparency and labeling: AI-generated content disclosure (EU, parts of US/China), user notices for high-risk or interaction systems.
•High-risk use restrictions and conformity (EU); sector bans or conditions (hiring tools, credit, housing, healthcare).
•Human oversight, accuracy, and non-discrimination requirements for regulated uses.
•Platform and intermediary rules (DSA, Online Safety Act) for hosting or recommending AI outputs.
Accountability and Liability
•Regulatory: Fines, bans, conformity failures, incident reporting (EU AI Act, FTC, etc.). Providers (developers), deployers, and sometimes users have distinct duties.
•Civil: Product liability (updating in EU), negligence/tort, consumer protection, discrimination statutes, and contract. Copyright infringement suits over training or outputs are active. No general “AI personhood”; liability attaches to companies/people.
•Criminal: Existing fraud, IP, child safety, weapons, or misuse statutes; some jurisdictions expanding deepfake/non-consensual intimate image rules.
•Audit/oversight: Documentation, logging, and (high-risk) third-party assessment expectations. Corporate governance and director duties increasingly consider AI risk.
•Soft accountability: Model cards, system cards, red-team reports, and public principles (many labs publish these). Insurance markets and procurement standards (government contracts) add pressure.
Soft Law, Standards, and Gaps
OECD AI Principles, G7 Hiroshima Process, UNESCO Recommendation on AI Ethics, and UN efforts provide non-binding norms (human-centric, transparent, accountable, robust). Industry consortia and standards bodies fill gaps. Major limitations include: uneven enforcement, rapid technical change outpacing rules, cross-border issues, open-source complexities, and limited specific rules for pure foundation-model training vs. downstream applications. Courts are actively shaping copyright, liability, and speech issues.
In short: The EU AI Act is the clearest binding horizontal regime; the US relies on existing law + targeted interventions; China emphasizes content/security control; international principles guide but rarely bind. Accountability still largely flows through traditional corporate, tort, consumer, and IP channels plus new regulatory duties. For the latest, check primary sources (EU Official Journal, Federal Register, etc.) as rules and guidance update frequently. Organizations building or deploying typically combine legal counsel, risk frameworks (NIST/ISO), and technical mitigations.