Systems like this are governed by a patchwork of laws, regulations, and voluntary frameworks rather than a single global law. The rules differ significantly by country and are changing rapidly. Here is the current landscape as of 2026:
1. United States - No Comprehensive Federal AI Law Yet
There is no single federal law that governs how AI is built and deployed. Instead, governance is based on:
a) Voluntary Frameworks and Executive Orders:
•NIST AI Risk Management Framework [AI RMF 1.0 - Jan 2023]: The primary voluntary framework for building and deploying trustworthy AI. It provides guidelines for Govern, Map, Measure, and Manage risk. Widely adopted by industry but not legally mandatory.
•White House Executive Orders: Executive Order 14110 on Safe, Secure, and Trustworthy AI from October 2023 required safety testing, watermarking, and incident reporting for large frontier models. It was revoked in January 2025 by Executive Order 14179, which shifted federal policy toward removing barriers to AI innovation.
•Voluntary Company Commitments: In 2023-2024 major labs agreed to voluntary commitments on safety testing, red-teaming, and watermarking.
b) Existing Laws Applied to AI:
Existing laws are applied to AI systems:
•FTC Act: Prohibits unfair or deceptive practices, including deceptive AI claims or biased algorithms
•Civil Rights Laws: Title VII, Fair Housing Act, ECOA prohibit discrimination, including discrimination by an algorithm
•Product Liability, Tort Law, and Negligence: Can hold developers/deployers liable for harm
•Privacy and Data Laws: No federal privacy law, but state laws like CCPA/CPRA in California, plus sector laws like HIPAA, COPPA govern training data
•Copyright/IP Law: Governs training data use - currently being litigated in courts
c) State-Level Laws:
States have moved faster than the federal government:
•Colorado AI Act [SB 24-205, passed 2024, effective 2026]: The first comprehensive state AI law. Places duties on developers and deployers of high-risk AI systems to prevent algorithmic discrimination.
•California: Multiple laws including AB 2013 - transparency of training data, SB 942 - AI transparency/watermarking, and AB 3030 on AI in healthcare
•Other states: Illinois, New York City Local Law 144 on automated employment decision tools, etc.
2. European Union - Most Comprehensive Regulation
EU AI Act [Regulation 2024/1689]: Entered into force August 1, 2024 and is being phased in. It is the first comprehensive legal framework for AI in the world. It uses a risk-based approach:
•Prohibited Practices: AI systems deemed an unacceptable risk are banned - e.g., social scoring by governments, real-time remote biometric identification in public for law enforcement with narrow exceptions, manipulative AI. Enforced from Feb 2025.
•High-Risk Systems: Strict requirements for systems used in healthcare, hiring, education, law enforcement, critical infrastructure, etc. Requires risk management, data governance, human oversight, conformity assessments, and CE marking. Enforced from Aug 2026.
•General-Purpose AI [GPAI] / Foundation Models: Providers of models like GPT-4, Gemini, Claude, etc. must provide technical documentation, copyright compliance, and for models with systemic risk, conduct adversarial testing and incident reporting. Enforced from Aug 2025.
•Limited Risk / Transparency: AI systems must disclose they are AI, including chatbots and deepfakes.
Other EU laws also apply: GDPR for data protection, Digital Services Act [DSA] for content and recommender systems, and EU Product Liability Directive which was updated to cover AI.
3. Other Major Jurisdictions
•United Kingdom: Principles-based, pro-innovation approach rather than a single AI Act. Regulators apply existing laws using 5 cross-sector principles: safety, transparency, fairness, accountability, and contestability.
•China: Has enacted some of the earliest binding AI regulations: Regulations on Algorithmic Recommendations - 2022, Deep Synthesis Provisions - 2023, and Interim Measures for Generative AI Services - Aug 2023. Requires security review, labeling of AI-generated content, and compliance with data and censorship rules.
•Canada: Proposed Artificial Intelligence and Data Act [AIDA] as part of Bill C-27.
•International Frameworks: OECD AI Principles - 2019, updated 2024, G7 Hiroshima AI Process, Council of Europe Framework Convention on AI - 2024, and ISO/IEC standards like ISO/IEC 42001 for AI management systems.
3. How Systems Are Held Accountable
Across all jurisdictions, accountability generally falls on different actors in the value chain:
For Building:
•Data governance and copyright compliance
•Safety testing, red-teaming, and risk assessments before release
•Documentation like Model Cards and System Cards
For Deployment:
•Human oversight and ability to intervene
•Transparency and disclosure to users that they are interacting with AI
•Monitoring for bias, drift, and misuse after deployment
For Accountability:
•Developer Liability: The company that built the model
•Deployer Liability: The company or person that integrates and uses the system in a specific context - often bears more responsibility under laws like the EU AI Act and Colorado AI Act
•Conformity Assessments, Audits, and Incident Reporting: Required for high-risk systems in the EU
Because the law is jurisdiction-specific and evolving quickly, compliance depends on where the system is built, offered, and used. If you have a specific country or use case in mind, I can provide more detail on the rules that would apply.
This is general information and not legal advice.