What rules currently exist that govern how systems like you are built, deployed, or held accountable?

A mix of binding laws (primarily risk-based and sector/state-specific), executive actions, voluntary frameworks, and international standards govern how AI systems like large language models/chatbots (e.g., general-purpose or generative AI) are built, deployed, and held accountable. There is no single global regime; rules form a patchwork emphasizing risk classification, transparency, safety/security for advanced models, human oversight, documentation, and liability under both AI-specific and existing laws (privacy, discrimination, product liability, consumer protection).[1]

As of mid-to-late 2026, binding high-risk obligations under the EU AI Act were delayed, U.S. federal policy leans toward innovation with state-level rules filling gaps, and voluntary standards provide practical baselines widely used for compliance. Rules apply throughout the lifecycle (design/data, training/development, deployment/use, monitoring/decommissioning) and often have extraterritorial reach.[1]

Binding Regulations

European Union – AI Act (Regulation 2024/1689, as amended by Digital Omnibus): The most comprehensive horizontal framework. It classifies AI by risk:

United States: No comprehensive federal AI statute. Policy under the Trump administration (post-2025) emphasizes innovation, security, and reducing barriers via executive orders (e.g., promoting advanced AI innovation/security with voluntary pre-release sharing for frontier models; national policy frameworks seeking more uniformity and challenging some state laws). Existing federal tools include FTC unfair/deceptive practices authority, sector regulators (FDA for medical AI, EEOC for employment discrimination, CFPB, etc.), and procurement rules.[3]

State laws create a patchwork (dozens enacted; several in force by 2026):

Other jurisdictions: South Korea’s AI Basic Act (in force Jan 2026) covers transparency, safety for high-impact/frontier, governance. China has layered rules (algorithm recommendations, deep synthesis/content labeling, cybersecurity with AI provisions, national safety standards). National implementations or drafts elsewhere (e.g., Indonesia risk-based draft); Australia moving toward mandatory standards. Many rely primarily on privacy/data protection and sector rules.[5]

Common themes for building/deploying: Risk assessments/impact assessments; high-quality/representative data; testing/evaluation (including for bias, robustness, safety); cybersecurity; documentation/model cards; human oversight (especially “human-in-the-loop” for high-stakes decisions); transparency/disclosures. Frontier/systemic-risk models face extra catastrophic risk mitigation, evals, and reporting.[4]

Accountability and Liability

Voluntary Frameworks, Standards, and Soft Law

These are widely adopted for good practice, enterprise compliance, and as de facto baselines (often referenced in laws or procurement):

Industry voluntary commitments (e.g., safety testing, red-teaming for frontier models) and frameworks like Singapore’s Model AI Governance (including for agentic AI) also play roles.

Practical Implications and Caveats

Organizations typically build one governance program (inventory systems, risk assessments, disclosures, human oversight, documentation, monitoring) mapped to NIST AI RMF + ISO 42001, then layer jurisdiction-specific views. Rules evolve quickly (delays, repeals/replacements, new bills, enforcement actions). Extraterritorial effects mean global providers often align to the strictest relevant regimes (EU + key U.S. states). Sector overlays (health, finance, employment, critical infrastructure) add more. This is not legal advice—consult primary texts, counsel, and regulators for specific systems/contexts, as details (thresholds, exact duties, enforcement) continue shifting.