More answers like this
GPT-5Sep 10, 2026openai/gpt-5-2025-08-07
What rules currently exist that govern how systems like you are built, deployed, or held accountable?
Short answer: There’s no single global rulebook. AI is governed by a patchwork of binding laws, sectoral rules, procurement mandates, and voluntary standards that vary by country. Below is a practical snapshot of the major ones in force or finalized as of October 2024, plus what they typically require of builders and deployers.
Global and cross-cutting frameworks
•OECD AI Principles (2019): High-level guidance on trustworthy AI (fair, transparent, robust, accountable). Nonbinding, but widely referenced by regulators.
•Council of Europe Framework Convention on AI (2024): First binding international treaty on AI for signatory states, focused on human rights, democracy, and rule of law. Requires risk assessment/mitigation, transparency, and oversight proportional to risk.
•ISO/IEC and other standards:
•ISO/IEC 42001: AI Management System (how to run an organization that builds/uses AI responsibly).
•ISO/IEC 23894: AI risk management.
•NIST AI Risk Management Framework 1.0 (US, nonbinding but influential); NIST profiles and evaluations guidance (including for generative AI).
•C2PA content provenance standard (widely adopted for image/audio/video provenance; not a law but often used to meet transparency expectations).
European Union
•EU AI Act (formally adopted 2024; phased application):
•Prohibited practices (e.g., certain social scoring, untargeted biometrics scraping, manipulative subliminal techniques).
•High-risk systems (e.g., in hiring, credit, critical infrastructure, medical devices): require risk management, data governance, technical documentation, logging, human oversight, accuracy/robustness, post-market monitoring, and (for some public deployments) fundamental rights impact assessments.
•General-purpose AI (foundation models): documentation, copyright/training-data transparency summaries, and for models with “systemic risk,” additional safety, cybersecurity, and incident-reporting duties.
•Transparency: deepfakes and AI-generated content must be disclosed; providers must enable detection “state of the art.”
•Enforcement and penalties: market surveillance by national authorities; significant fines (up to the higher of fixed amounts or a percentage of global turnover).
•GDPR and related privacy law:
•Lawful basis for training and operation; data minimization; security; DPIAs for high-risk processing; cross-border transfer rules; individual rights.
•Restrictions on solely automated decisions with legal/similar effects; right to meaningful information about logic, significance, and consequences.
•Digital Services Act (DSA): For platforms (especially VLOPs), systemic-risk mitigation for recommender systems and generative AI content, transparency for ads, researcher access.
•Product/market rules: Revised Product Liability Directive and General Product Safety Regulation extend liability/safety expectations to software/AI-enabled products; Machinery Regulation covers safety of AI within machinery.
•Copyright/text and data mining: EU allows TDM with opt-out; providers must respect rightholder opt-outs and, under the AI Act, publish summaries of training content.
United States (federal)
•No omnibus AI law yet, but:
•Executive Order 14110 (Oct 2023): Directs agencies to set safety, security, and civil-rights guardrails (model reporting/testing for frontier systems in certain contexts; content authentication R&D; critical infrastructure guidance).
•OMB Memorandum M-24-10 (2024): Binding on federal agencies—AI inventories, impact assessments, independent evaluation, and safeguards for rights-implicating government AI uses; procurement requirements for vendors.
•NIST AI RMF and testing/eval guidance: Widely used as a de facto standard for risk controls, red-teaming, and evaluations.
•Sector regulators applying existing law to AI:
•FTC (unfair/deceptive practices, substantiation of AI claims, data misuse).
•CFPB, OCC, FDIC, Fed (credit, fair lending/ECOA/Reg B; adverse action notices when AI is used).
•EEOC/DOJ (employment discrimination by automated hiring/HR tools).
•HHS/OCR (HIPAA for health data/AI).
•FDA (software as a medical device with ML).
•FCC/TCPA (AI-generated voice calls treated as unlawful robocalls without consent).
•SEC/FINRA (disclosure and conflicts in AI-enabled brokerage/advice).
•Copyright: US Copyright Office guidance limits protection for AI-generated content without sufficient human authorship; training-data legality unresolved and subject to ongoing litigation.
•State and local
•Colorado Artificial Intelligence Act (2024): For “consequential decisions” (employment, credit, housing, insurance, education, etc.), imposes duties on developers and deployers (risk management, impact assessments, notice, consumer appeals, incident reporting; anti-discrimination duty of care). Takes effect on a delayed schedule.
•Privacy laws (e.g., California CPRA, Virginia, Colorado, Connecticut, Utah): DPIAs for high-risk processing; automated decision-making transparency/opt-outs emerging via rulemaking (especially in California).
•Biometric and voice laws (e.g., Illinois BIPA): Notice/consent and private rights of action.
•Employment tools: NYC Local Law 144 requires bias audits and notices for automated employment decision tools; similar proposals elsewhere.
•Election deepfakes: Several states require disclosures or restrict deceptive synthetic media in political ads.
United Kingdom
•“Pro-innovation” approach: No single AI act; regulators (ICO, CMA, FCA, MHRA, Ofcom) apply existing laws using cross-sector AI principles set by government.
•ICO: Extensive guidance on AI, data protection, and fairness; DPIAs; rights around automated decision-making.
•CMA: Scrutiny of foundation model competition and safety; principles for model access, transparency, and partnerships.
•Online Safety Act (2023): Platform duties to manage harmful content; relevance to generative AI content distribution.
•UK AI Safety Institute conducts evaluations; government has secured voluntary safety commitments from major model providers.
Canada
•Artificial Intelligence and Data Act (AIDA): Proposed as part of Bill C‑27 (status evolving as of 2024). Would regulate “high-impact” AI systems and impose duties on developers/deployers.
•Federal Directive on Automated Decision-Making (DADM): Binding on federal departments—algorithmic impact assessments, peer review, explainability, notice, human oversight for government use.
•Privacy: PIPEDA and provincial laws (e.g., Quebec Law 25) impose consent, transparency, DPIAs, and automated decision safeguards.
China
•Generative AI Measures (2023) and Deep Synthesis Provisions: Provider and platform duties including security assessments, watermarking/labeling of synthetic content, dataset governance, and algorithm filings/recordals.
•Recommendation algorithm rules: Registration and governance for large recommender services.
•Privacy/security: PIPL, Data Security Law, Cybersecurity Law govern data handling, cross-border transfers, critical information infrastructure.
•Content controls and moderation obligations on AI providers and platforms.
Other notable jurisdictions
•Singapore: Model AI Governance Framework (with a generative AI addendum), AI Verify testing program; PDPA privacy law; sectoral guidance (e.g., MAS for finance).
•Japan: Principles- and guidelines-based approach; APPI privacy law; participation in G7 Hiroshima AI Process.
•South Korea: Framework Act on AI (policy/safety direction); PIPA privacy law; sectoral standards.
•Brazil: LGPD privacy law; draft AI bills under discussion.
•Australia: Privacy Act reform under consideration; voluntary AI ethics principles; sector regulators issuing guidance on deepfakes and safety.
Common accountability mechanisms you’ll see across regimes
•Risk management and governance: Maintain an AI risk program; assign accountable owners; follow recognized standards (e.g., NIST RMF, ISO/IEC 42001/23894).
•Data governance: Document data sources and licensing; assess bias and representativeness; protect privacy; manage retention and provenance.
•Testing and evaluation: Pre-deployment testing, red-teaming, robustness and bias evaluation; safety cases for high-risk contexts; continuous monitoring and incident response.
•Transparency: User notices when AI is in use; explanations for consequential decisions; disclosures or watermarking/metadata for synthetic media.
•Human oversight: Defined intervention and appeal paths; meaningful human review where required.
•Impact assessments: DPIAs, algorithmic impact assessments, or fundamental rights impact assessments before high-risk deployments.
•Documentation: Technical documentation, logs, model/dataset cards, and user instructions; post-market monitoring plans and incident reporting channels.
•Vendor management and procurement: Flow down obligations in contracts; security/privacy requirements; audit and evaluation rights.
•Redress and complaints handling: Channels for users to challenge decisions and report harms; timely remediation.
What this means in practice for builders and deployers
•Map your role and risk: In many regimes, “providers/developers” and “deployers/users” have different obligations. Identify whether your use case is high-risk.
•Align to a recognized framework: Using NIST AI RMF or ISO/IEC 42001 helps demonstrate due care and can be a statutory defense in some places (e.g., Colorado).
•Build your files: Keep a living model/system card, data documentation, evaluation reports, DPIAs/AIAs, and incident logs.
•Prepare for transparency: Be able to explain system purpose, limitations, data sources (at least at a summary level), and how to appeal outcomes.
•Monitor laws: The EU AI Act has staggered deadlines; several US states and other countries are actively updating rules. Check current applicability before launch.
Note: This area is changing quickly after 2024. For any deployment, especially in regulated sectors or multiple jurisdictions, consult up-to-date legal counsel and the latest regulator guidance.