What rules currently exist that govern how systems like you are built, deployed, or held accountable?
What governs how AI systems are built, deployed and held accountable — I'll map the current rules for you.
There is no single global law for systems like this. Governance is a layered patchwork of binding regulation, executive directives, voluntary frameworks, and application of existing law:
1. Binding AI-specific regulation - EU as most comprehensive
The EU AI Act (Regulation 2024/1689) is the first comprehensive horizontal AI regulation. It uses a risk-based approach:
Unacceptable risk is prohibited (e.g . social scoring systems and manipulative AI)Most of the text addresses highrisk AI systems, which are regulatedA smaller section handles limited risk AI systems, subject to lighter transparency obligations: developers ... and deployers must ensure that endusers are aware that they are interacting with AI (chatbots andKey obligations include:
up to 35 million Euros or, if the offender is a company, up to 7% of its total worldwide annual turnover for the preceding financial year, whichever is highermust assign human oversight over the use of such systems to individuals who have the necessary competence, training, authority and support to do sochatbots, generative AI tools, emotion recognition systems, biometric categorization tools, and deepfake technologies. Enforcement of Article 50 of the EU AI Act went into effect on Aug. 2, 2026, establishing mandatory transparency, labelling and machine-readable marking rules for providers and deployersThe Act is complemented by existing EU law: GDPR for data protection, Product Liability Directive, AI Liability Directive, Digital Services Act, Copyright Directive, Cyber Resilience Act, etc.
2. United States - No comprehensive federal AI statute, executive and agency-led
The U.S. has not passed a comprehensive federal AI law. Congress has debated bills such as the Algorithmic Accountability Act, the Artificial Intelligence Research, Innovation, and Accountability Act of 2024, and the Artificial Intelligence Civil Rights Act, but they remain proposals.
Governance currently relies on:
a) Executive Orders and OMB guidance:
establishes a government-wide effort to guide responsible artificial intelligence (AI) development and deployment through federal agency leadership, regulation of industry, and engagement with international partnerseight overarching policy areas: 1. Safety and security; 2. Innovation and competition; 3. Worker support; 4. Consideration of AI bias and civil rights; 5. Consumer protection; 6. Privacy; 7. Federal use of AI; and 8. International leadershipOMB released a memorandum on Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence whose purpose is to "direct[s] agencies to advance AI governance and innovation while managing risks from the use of AI, particularly those affecting the safety and rights of the public."the Office of Science and Technology Policy's Blueprint for an AI Bill of Rights and the National Institute of Standards and Technology's (NIST) AI Risk Management Framework (AI RMF)Limitations: Unlike acts of Congress, executive actions cannot create new agencies or grant new regulatory powers over private companies and (They can also be undone by the next president.)
is an executive order issued by United States President Donald Trump ... The order establishes a federal policy aimed at promoting a uniform national framework for artificial intelligence (AI) regulation and limiting the impact of conflicting state lawsaimed at thwarting state-level regulation of artificial intelligence through lawsuits and funding cuts, with the stated rationale to counter a patchwork of state-level rules the industry worries will hamper its growthAI Litigation Task Force whose sole responsibility shall be to challenge State AI laws inconsistent with the policy on grounds including interstate commerce and federal preemption.b) Voluntary / standards-based frameworks:
organizes AI risk management into four core functions: Govern (establish policies and accountability), Map (identify AI context and risks), Measure (assess risks quantitatively), and Manage. The framework aims to foster the development of innovative approaches to address characteristics of trustworthiness including accuracy, explainability and interpretability, reliability, privacy, robustness, safetyc) State and local laws:
In the absence of federal preemptive statute, states (e.g., California, Colorado, Illinois, New York) have enacted or proposed laws on automated decision tools, AI disclosure, data privacy, and biometric data. The federal preemption effort described above may yield legal challenges, which would set the stage for a sustained test of the Administration’s preemption efforts in the absence of actual federal statutory enactment.
3. International principles
AI that is inclusive and sustainable, human-centered, transparent and explainable, robust and secure, and for which developers and deployers remain accountableaccountability refers to the expectation that organisations or individuals will ensure the proper functioning, throughout their lifecycle, of the AI systems that they design, develop, operate or deploy, in accordance with their roles4. Existing law applied to AI - Accountability through general legal regimes
Where AI-specific statutes do not exist, agencies apply existing law. The National Telecommunications and Information Administration (NTIA) AI Accountability Policy Report recommends:
Audits and other independent evaluations: Federal agencies should use existing and/or new authorities to require as needed independent evaluations and ... To perform these assessments, agencies may need to require other accountability inputs, including documentation and disclosureLiability rules and standards: Federal government agencies should work with stakeholders to make recommendations about applying existing liability rules and standards to AI systemsCommenters note Legal experts are divided regarding how AI-related harms fit into existing liability regimes like product liability, defamation, intellectual property, and third-party-generated content but agree:
products with inbuilt AI will clearly fall under existing statutory safety and fitness for purpose laws, and the usual norms of product liability law will apply to determine liability, causation and damagesThis creates a distributed accountability model: developers/providers responsible for design, data governance, testing, documentation and risk management; deployers/operators responsible for human oversight, monitoring, transparency and use-case compliance; with auditors, regulators and courts providing independent evaluation and liability determination. The landscape is rapidly evolving, so specific obligations depend on jurisdiction, risk classification, and sector.
This is general information, not legal advice. For a specific use case you should consult current text of the EU AI Act, relevant national law, and agency guidance.
Citations (2)
- Highlights of the 2023 Executive Order on Artificial Intelligence for Congress
Backs: “Congress has debated bills such as the Algorithmic Accountability Act, the Artificial Intelligence Research, Innovation, and Accountability Act of 2024, and the Artificial Intelligence Civil Rights Act, but they remain proposals. Governance currently relies on: a) Executive Orders and OMB guidance: Executive Order…”
evidence, official document. Claim: Executive Order 14110 (Oct 2023) establishes a government-wide effort guiding responsible AI development and deployment through federal agency leadership, industry regulation, and international engagement.
- cert-pepper/examples/secai-plus/practice-questions/domain4-practice.md at 1a9360050a4727fc34bccbbce0ff96b71005bcb7 · cert-pepper/cert-pepper · GitHub
Backs: “It directs creation of an AI Litigation Task Force whose sole responsibility shall be to challenge State AI laws inconsistent with the policy on grounds including interstate commerce and federal preemption. b) Voluntary / standards-based frameworks: NIST AI Risk Management Framework (AI RMF 1.0 + Generative AI…”
evidence, other. Claim: NIST AI Risk Management Framework organizes AI risk management into four core functions: Govern, Map, Measure, and Manage.