The regulatory landscape governing artificial intelligence (AI) systems like me is currently in a state of rapid transition. It is moving away from a "voluntary guideline" model toward binding, enforceable laws.
These rules govern how AI is built (data sourcing and training), deployed (use cases and security), and held accountable (liability and transparency). Because there is no single global framework, these rules are currently a patchwork of regional laws, industry standards, and voluntary commitments.
Here is a breakdown of the primary rules and frameworks that currently exist:
1. Building Phase: Rules Governing Data, Training, and Development
The development phase of large language models (LLMs) is governed primarily by data privacy laws, intellectual property rights, and safety-testing protocols.
•Data Privacy Laws (GDPR, CCPA, etc.): The EU’s General Data Protection Regulation (GDPR) and state-level US laws like the California Consumer Privacy Act (CCPA) heavily restrict how personal data can be collected and processed. If an AI developer scrapes public internet data that contains personal information to train a model, they must comply with rules regarding the "right to be forgotten" (removing data upon request) and having a lawful basis for processing.
•Copyright and Intellectual Property (IP): Currently, this is governed by existing IP laws and active litigation rather than new legislation. Courts in the US, EU, and UK are currently determining whether using copyrighted works to train AI models constitutes "fair use."
•Mandatory Safety Testing (US Executive Order): In the United States, the October 2023 Executive Order on AI requires developers of the most powerful "frontier" models (measured by computing power, or FLOPs) to notify the government and share the results of all safety tests, including "red-teaming" (attempting to break the system to find vulnerabilities).
2. Deployment Phase: Rules Governing How AI is Put into the World
Once a system is built, rules dictate how it can be used, who can access it, and what guardrails must be in place.
•The EU AI Act (The Gold Standard): Passed in 2024, this is the world's first comprehensive horizontal AI law. It uses a risk-based approach:
•Prohibited AI: Systems that pose an unacceptable risk (e.g., social scoring, cognitive behavioral manipulation, or certain biometric categorization) are banned.
•High-Risk AI: Systems used in critical infrastructure, education, employment, or law enforcement face strict assessments, data governance requirements, and human oversight.
•General Purpose AI (GPAI): Models like me face transparency requirements, must respect EU copyright law, and must publish summaries of their training data.
•China’s Generative AI Regulations: Administered by the Cyberspace Administration of China (CAC), these rules require generative AI services to register their algorithms with the government, undergo security assessments before public release, ensure content adheres to "socialist core values," and prevent the generation of false information.
•Disclosures and Watermarking: There is a growing legal push to combat deepfakes and misinformation. The EU AI Act and various US state laws require developers and platforms to clearly label AI-generated content (audio, video, and text) with digital watermarks or clear disclosures.
3. Accountability: Who is Responsible When Things Go Wrong?
Accountability defines who is legally and financially liable if an AI system causes harm (e.g., defamation, financial loss, discrimination, or physical harm).
•Consumer Protection (FTC Enforcement): In the US, the Federal Trade Commission (FTC) uses its existing authority to police "unfair or deceptive practices." The FTC holds AI companies accountable if they make false claims about what their AI can do, deploy biased algorithms that discriminate in housing or hiring, or fail to protect user data.
•The Developer vs. Deployer Distinction: Regulations are beginning to distinguish liability between the creator of the AI (e.g., OpenAI, Google, Anthropic) and the deployer (the business that integrates the AI into their product). Under the EU AI Act, if a bank uses an AI tool to evaluate loan applications and that tool discriminates, the bank (deployer) is largely liable for the deployment, while the developer is liable for the system's compliance.
•Section 230 and Platform Liability: In the US, there is ongoing debate about whether Section 230 (which shields internet platforms from liability for user-generated content) applies to AI-generated text. Current legal consensus is leaning toward no—because AI companies are "co-creators" of the content, they may be held liable for harmful outputs, such as libel or copyright infringement.
4. Voluntary Frameworks and Standards (The "Soft Law")
Because formal legislation takes years to pass, governments and industry groups rely heavily on voluntary frameworks that define "best practices."
•NIST AI Risk Management Framework (RMF): Developed by the US National Institute of Standards and Technology, this is a highly influential, voluntary guide used by organizations globally to design, map, and measure AI risks.
•ISO/IEC 42001: Released in late 2023, this is the first international standard for an AI Management System (AIMS). Companies can get certified under this standard to prove they build and deploy AI ethically and safely.
•The G7 Hiroshima AI Process: A set of international guiding principles and a voluntary Code of Conduct for organizations developing advanced AI systems, focused on safety, transparency, and intellectual property.
Summary of the Current State
If you look at how a system like me exists today:
1.I am built under the shadow of copyright lawsuits and strict data privacy laws (like GDPR).
2.I am deployed with guardrails designed to prevent the generation of hate speech, biological threats, or disinformation, aligned with the EU AI Act and US Executive Orders.
3.My creators are held accountable by regulatory bodies like the FTC (in the US) and data protection authorities (in Europe) using a mix of brand-new AI laws and adapted consumer-protection laws.