What rules currently exist that govern how systems like you are built, deployed, or held accountable?
Short answer: There isn’t one global law. Systems like me are governed by a patchwork of (1) government rules and enforcement, (2) sectoral and local laws, and (3) widely adopted standards/assurance frameworks. Here are the most relevant, as of September 11, 2026.
United States (federal)
United States (state and local)
European Union
United Kingdom
China
Standards, assurance, and “rules by contract”
What this means if you build or deploy systems like me
If you tell me your industry and where you operate, I can translate this into a concrete “what applies to you now and what’s coming next” checklist with key dates.
Citations (22)
- https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf?_hsmi=393084204
Backs: “Agencies must name a Chief AI Officer, publish AI use-case inventories, implement “minimum risk management practices” for high‑impact uses, and be ready to halt noncompliant systems; procurement guidance streamlines buying AI while keeping basic safeguards.”
evidence, official document. Claim: OMB M-25-21 requires agencies to name Chief AI Officers, publish use-case inventories, and apply minimum risk practices to high-impact AI.
- Federal Register
Backs: “President Biden’s EO 14110 (2023) was rescinded in January 2025; a new EO (14179, Jan 23, 2025) directed OMB to revise agency AI policies and to unwind actions inconsistent with the new policy.”
evidence, official document. Claim: EO 14110 was rescinded and EO 14179 directed OMB to revise agency AI policies.
- Artificial Intelligence Risk Management Framework (AI RMF 1.0) | NIST
Backs: “NIST’s AI Risk Management Framework 1.0 (2023) and its Generative AI Profile (2024) are the U.S. reference playbooks many organizations follow voluntarily (and agencies are encouraged to align to).”
evidence, article. Claim: NIST AI RMF 1.0 and Generative AI Profile are voluntary U.S. reference frameworks.
- FTC Chair Khan and Officials from DOJ, CFPB and EEOC Release Joint Statement on AI | Federal Trade Commission
Backs: “FTC uses Section 5 (unfair/deceptive practices) against misleading or harmful AI claims and issued multi‑agency statements that “there is no AI exemption” from existing laws; the FTC has also launched sweeps targeting deceptive AI claims.”
evidence, article. Claim: FTC and other agencies say there is no AI exemption from existing laws; FTC uses Section 5 against deceptive AI claims.
- Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms | Consumer Financial Protection Bureau
Backs: “CFPB says creditors using complex/AI models must give specific reasons in adverse‑action notices (ECOA/Reg B).”
evidence, official document. Claim: CFPB says creditors using complex AI models must give specific adverse-action reasons under ECOA/Reg B.
- EEOC Hearing Explores Potential Benefits and Harms of Artificial Intelligence and other Automated Systems in Employment Decisions | U.S. Equal Employment Opportunity Commission
Backs: “EEOC enforces Title VII/ADA in AI‑aided employment decisions and has published technical assistance and a 2024–2028 enforcement plan focusing on algorithmic bias.”
evidence, article. Claim: EEOC enforces Title VII/ADA in AI-aided employment decisions and focuses on algorithmic bias.
- HIPAA Security Rule Notice of Proposed Rulemaking to Strengthen Cybersecurity for Electronic Protected Health Information | HHS.gov
Backs: “FDA has finalized guidance on AI‑enabled devices (e.g., Predetermined Change Control Plans, 2025; Clinical Decision Support, 2026).”
evidence, article. Claim: HIPAA Security Rule applies to ePHI regardless of AI use; HHS proposed strengthening it; FDA AI device guidance.
- National Security Presidential Memorandum/NSPM-11 – The White House
Backs: “National security systems: a 2026 national‑security memo references aligning with civilian AI governance where appropriate.”
evidence, official document. Claim: A 2026 national-security memo references aligning with civilian AI governance where appropriate.
- SB24-205 Consumer Protections for Artificial Intelligence | Colorado General Assembly
Backs: “The AG is rulemaking and has proposed “Chatbot Safety Act” protections (e.g., disclosures; youth safeguards).”
evidence, official document. Claim: Colorado SB24-205 regulates high-risk AI with risk programs, transparency, impact monitoring and AG enforcement.
- California Finalizes Regulations to Strengthen Consumers' Privacy
Backs: “California CPPA regulations on Automated Decisionmaking Technology (ADMT) took effect January 1, 2026, adding consumer rights to access and opt out of significant ADMT uses; certain “significant decision” uses must comply no later than January 1, 2027.”
evidence, article. Claim: California ADMT regulations took effect January 2026, adding access and opt-out rights.
- Automated Employment Decision Tools (AEDT) - DCWP
Backs: “New York City Local Law 144 requires bias audits and notices before employers use Automated Employment Decision Tools; in force since July 2023.”
evidence, article. Claim: NYC Local Law 144 requires bias audits and notices for automated employment decision tools.
- Chapter 57 - Department of Administrative Services
Backs: “Connecticut requires annual inventories and impact assessments for state‑agency AI systems and publishes an inventory.”
evidence, official document. Claim: Connecticut requires inventories and impact assessments for state-agency AI systems.
- PHOTOS: Gov. Lee Signs ELVIS Act Into Law
Backs: “Voice/likeness “deepfake” protections: e.g., Tennessee’s 2024 ELVIS Act extends right‑of‑publicity law to AI voice cloning.”
evidence, article. Claim: Tennessee's ELVIS Act extends right-of-publicity protection to AI voice cloning.
- AI Act | Shaping Europe’s digital future
Backs: “It also creates obligations for general‑purpose AI (GPAI) providers.”
evidence, article. Claim: EU AI Act timeline, prohibited practices, high-risk phase-in and GPAI obligations.
- Directive (EU) 2024/2853 of the European Parliament and of the Council of 23 October 2024 on liability for defective products and repealing Council Directive 85/374/EEC (Text with EEA relevance)
Backs: “Product liability: the revised Product Liability Directive (EU) 2024/2853 updates strict‑liability rules to explicitly cover software and AI, tightening accountability for harm from defective digital products.”
evidence, official document. Claim: Revised Product Liability Directive covers software and AI under strict liability.
- The enforcement framework under the Digital Services Act | Shaping Europe’s digital future
Backs: “Platform transparency (affecting recommender systems and AI‑driven curation): the Digital Services Act imposes risk assessments, audits, and recommender‑system transparency, especially for VLOPs/VLOSEs.”
evidence, article. Claim: Digital Services Act imposes risk assessments, audits and recommender transparency, especially for very large platforms.
- Automated decision-making and profiling | European Data Protection Board
Backs: “GDPR limits solely automated decisions with legal/similar significant effects and requires safeguards; the EDPB’s guidance explains how Article 22 applies to AI.”
evidence, official document. Claim: GDPR limits solely automated decisions; EDPB guidance explains Article 22.
- AI regulation: a pro-innovation approach – policy proposals - GOV.UK
Backs: “The UK uses a principles‑based, “pro‑innovation” approach: central government set cross‑sector AI principles and asked existing regulators (ICO, CMA, MHRA, FCA, etc.) to implement them within their remits; regulators have published their AI strategies and guidance.”
evidence, official document. Claim: UK uses principles-based approach with existing regulators implementing cross-sector AI principles.
- 国家互联网信息办公室等四部门发布《互联网信息服务算法推荐管理规定》_中央网络安全和信息化委员会办公室
Backs: “National rules governing algorithms and synthetic media include the 2022 Provisions on Algorithmic Recommendation for Internet Information Services and the 2022 Provisions on Deep Synthesis Services, which require provider filings/records, disclosures, content controls, and special protections for minors and workers;…”
evidence, official document. Claim: China's 2022 algorithmic recommendation and deep synthesis rules require filings, disclosures, and content controls.
- ISO/IEC 42001:2023 - AI management systems
Backs: “In the U.S., NIST’s AI RMF and Generative AI Profile are the leading voluntary frameworks used in policy and procurement.”
evidence, reference entry. Claim: ISO/IEC 42001:2023 is a certifiable AI management system standard.
- EXECUTIVE OFFICE OF THE PRESIDENT
Backs: “Procurement clauses, audits, and model/system cards are increasingly required by public buyers (see OMB M‑25‑22) and large private customers; failure to meet contractual AI representations can trigger liability under existing consumer‑protection, privacy, product‑liability, or unfair‑competition laws.”
evidence, official document. Claim: Public buyers increasingly require procurement clauses, audits and model cards per OMB M-25-22.
- AI Risk Management Framework | NIST
Backs: “Adopting recognized frameworks (NIST AI RMF, ISO/IEC 42001/23894) can reduce risk and, in some places (e.g., Colorado), serve as part of a compliance defense.”
background, article. Claim: Adopting recognized frameworks like NIST AI RMF can reduce risk and support compliance defenses.