What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Short answer: It’s a patchwork. There isn’t one universal AI law; instead, several layers of binding laws, agency rules, and voluntary standards govern how systems are built, deployed, and held to account. Here’s the current picture as of September 12, 2026.

United States (federal)

•Executive branch policy for federal agencies: The Biden-era EO 14110 (Oct 30, 2023) was rescinded on Jan 20, 2025. The current framework is EO 14179 “Removing Barriers to American Leadership in AI” (Jan 23, 2025) and OMB M‑25‑21 (Apr 3, 2025), which replaced OMB M‑24‑10. Agencies must designate Chief AI Officers, publish AI use‑case inventories, and implement minimum risk‑management practices for “high‑impact” AI they use.[1]

•No comprehensive federal AI statute: Congress has not enacted a single, cross‑sector AI law; policy largely comes from executive actions, sector laws, and enforcement by agencies (FTC, CFPB, EEOC, DOJ). CRS and major outlets continue to note the absence of a comprehensive federal AI law as of 2026.[2]

•Consumer protection and civil rights enforcement: The FTC has used existing authority (e.g., Section 5) against unfair/deceptive AI uses (e.g., Rite Aid facial recognition order). The CFPB requires specific, accurate reasons for credit denials even when using complex models; the EEOC has issued Title VII guidance on algorithmic hiring.[3]

•Standards and testing infrastructure: NIST’s voluntary AI Risk Management Framework (AI RMF 1.0) and the U.S. AI Safety Institute/Consortium support risk management and evaluations for developers and deployers.[4]

•Rulemaking and reports in progress: Commerce/NTIA has pushed AI accountability policy (independent audits for high‑risk AI) and examined open‑weight models; BIS proposed reporting requirements for frontier model development and compute clusters in 2024 (rule not yet finalized).[5]

United States (state and local)

•State privacy and biometric laws: Comprehensive consumer‑privacy laws (and targeted biometric statutes like Illinois BIPA) impose data‑governance, notice/choice, and security duties relevant to AI training and use. Trackers provide up‑to‑date coverage of enacted state laws.[6]

•Hiring and employment AI: New York City Local Law 144 requires independent bias audits and notices for automated employment decision tools used in hiring or promotion. Enforcement began July 5, 2023.[7]

•Political deepfakes: A growing number of states require labels or restrict deceptive AI in election ads. NCSL summarizes enacted disclosure and deceptive‑media laws.[8]

European Union

•EU AI Act (Regulation (EU) 2024/1689): In force since Aug 1, 2024, with phased application. Key dates: prohibitions and general provisions from Feb 2, 2025; general‑purpose AI (GPAI) obligations and governance from Aug 2, 2025; core rules (incl. transparency, innovation measures) from Aug 2, 2026; Annex III “high‑risk” systems apply from Dec 2, 2027; embedded high‑risk systems (Annex I) by Aug 2, 2028.[9]

•Digital Services Act (DSA): Very Large Online Platforms/Search Engines must assess and mitigate systemic risks, increase recommender‑system transparency, and offer at least one non‑profiling recommender option—relevant where AI drives ranking and personalization.[10]

•Updated Product Liability Directive (Directive (EU) 2024/2853): Modernizes strict‑liability rules to explicitly cover software and AI systems; Member States must transpose by 2026–2026/2027 windows.[11]

United Kingdom

•“Pro‑innovation” approach (no cross‑cutting AI statute yet): UK relies on existing regulators applying cross‑cutting principles; the government’s 2023 White Paper and 2024 response outline expectations. The UK AI Safety Institute develops evaluation methods for frontier models.[12]

Canada

•No federal AI statute in force: The proposed Artificial Intelligence and Data Act (AIDA) within Bill C‑27 did not become law before the 2025 prorogation; as of 2026, Canada still lacks a binding, cross‑sector AI act at the federal level.[13]

China

•Binding, service‑level rules: CAC regulations cover algorithmic recommendation (effective Mar 1, 2022), deep synthesis/deepfakes (effective Jan 10, 2023), and generative‑AI services (effective Aug 15, 2023), including filing, security assessments, identity verification, and content labeling.[14]

International and multilateral instruments

•Council of Europe AI Convention: First binding international treaty on AI and human rights/democracy/rule of law; adopted May 17, 2024 and opened for signature Sept 5, 2024 (signed by multiple states and the EU; enters into force after ratifications).[15]

•UN General Assembly resolution (Mar 21, 2024): Non‑binding call to steer AI toward “safe, secure and trustworthy” use for sustainable development.[16]

•G7 Hiroshima Process Code of Conduct (Oct 30, 2023): Voluntary guidance for organizations developing advanced AI (incl. frontier/GPAI), covering risk management, security, and content provenance.[17]

Standards you’ll see in procurement, audits, and contracts

•NIST AI Risk Management Framework (AI RMF 1.0) and profiles (incl. generative‑AI profile) used widely as “state of practice” in risk management.[4]

•ISO/IEC 42001:2023 (AI management systems): A certifiable management‑system standard many organizations adopt to show governance over AI lifecycle risks.[18]

What this means in practice

•Build: Even without a single U.S. AI law, developers are expected to implement risk management (NIST AI RMF), data‑protection/compliance (state privacy and biometric laws), and sectoral controls (finance, health, employment). EU‑facing products must align to the AI Act’s risk‑based requirements and DSA duties for platform AI.[4]

•Deploy: Disclose and label where required (e.g., EU AI Act Article 50 transparency; U.S. state political‑ad disclaimers), audit “high‑risk” uses (NYC hiring tools; EU high‑risk categories), and provide user notices and opt‑outs where applicable (DSA recommender options; state privacy laws).[19]

•Accountability: Expect enforcement via existing consumer‑protection and anti‑discrimination laws (e.g., FTC/CFPB/EEOC actions), product‑liability exposure (EU PLD update), and, in the EU, administrative penalties under the AI Act once applicable provisions bite.[3]

If you want, tell me:

•Where you operate (countries, sectors).

•What your system does (use cases, users, data).

•Whether you touch EU users or U.S. government work.

I can then map your concrete obligations and “must‑do next” list.

Citations (19)

1whitehouse.govGovernment
Removing Barriers to American Leadership in Artificial Intelligence – The White House
Backs: “Agencies must designate Chief AI Officers, publish AI use‑case inventories, and implement minimum risk‑management practices for “high‑impact” AI they use.”
2everycrsreport.comEncyclopedias and referencequality 0.91
Regulating Artificial Intelligence: U.S. and International Approaches and Considerations for Congress
Backs: “CRS and major outlets continue to note the absence of a comprehensive federal AI law as of 2026.”
3ftc.govGovernment
Rite Aid Banned from Using AI Facial Recognition After FTC Says Retailer Deployed Technology without Reasonable Safeguards | Federal Trade Commission
Backs: “The CFPB requires specific, accurate reasons for credit denials even when using complex models; the EEOC has issued Title VII guidance on algorithmic hiring.”
4nist.govGovernment
AI Risk Management Framework | NIST
Backs: “AI Safety Institute/Consortium support risk management and evaluations for developers and deployers.”
5ntia.govGovernment
NTIA Artificial Intelligence Accountability Policy Report MARCH 2024
Backs: “BIS proposed reporting requirements for frontier model development and compute clusters in 2024 (rule not yet finalized).”
6iapp.orgNonprofits and think tanks
US State Privacy Legislation Tracker | IAPP
Backs: “Comprehensive consumer‑privacy laws (and targeted biometric statutes like Illinois BIPA) impose data‑governance, notice/choice, and security duties relevant to AI training and use. Trackers provide up‑to‑date coverage of enacted state laws.”
7nyc.govGovernment
Automated Employment Decision Tools (AEDT) - DCWP
Backs: “New York City Local Law 144 requires independent bias audits and notices for automated employment decision tools used in hiring or promotion. Enforcement began July 5, 2023.”
8ncsl.orgNonprofits and think tanks
Artificial Intelligence (AI) in Elections and Campaigns
Backs: “NCSL summarizes enacted disclosure and deceptive‑media laws.”
9europa.euGovernment
AI Act enters into force - European Commission
Backs: “Annex III “high‑risk” systems apply from Dec 2, 2027; embedded high‑risk systems (Annex I) by Aug 2, 2028.”
10europa.euGovernment
Regulation - 2022/2065 - EN - DSA - EUR-Lex
Backs: “Very Large Online Platforms/Search Engines must assess and mitigate systemic risks, increase recommender‑system transparency, and offer at least one non‑profiling recommender option—relevant where AI drives ranking and personalization.”
11europa.euGovernment
Directive - 2024/2853 - EN - Product Liability Directive - EUR-Lex
Backs: “Modernizes strict‑liability rules to explicitly cover software and AI systems; Member States must transpose by 2026–2026/2027 windows.”
12gov.ukGovernment
A pro-innovation approach to AI regulation - GOV.UK
Backs: “The UK AI Safety Institute develops evaluation methods for frontier models.”
13parl.caNot yet classified
C-27 (44-1) - LEGISinfo - Parliament of Canada
Backs: “The proposed Artificial Intelligence and Data Act (AIDA) within Bill C‑27 did not become law before the 2025 prorogation; as of 2026, Canada still lacks a binding, cross‑sector AI act at the federal level.”
14cac.gov.cnGovernment
互联网信息服务算法推荐管理规定_中央网络安全和信息化委员会办公室
Backs: “CAC regulations cover algorithmic recommendation (effective Mar 1, 2022), deep synthesis/deepfakes (effective Jan 10, 2023), and generative‑AI services (effective Aug 15, 2023), including filing, security assessments, identity verification, and content labeling.”
15coe.intGovernment
Committee on Artificial Intelligence (CAI) - Artificial Intelligence
Backs: “First binding international treaty on AI and human rights/democracy/rule of law; adopted May 17, 2024 and opened for signature Sept 5, 2024 (signed by multiple states and the EU; enters into force after ratifications).”
16un.orgGovernment
Seizing the opportunities of safe, secure and trustworthy artificial intelligence systems for sustainable development :
Backs: “Non‑binding call to steer AI toward “safe, secure and trustworthy” use for sustainable development.”
17g7g20-documents.orgNot yet classified
Hiroshima Process International Code of Conduct for Organizations Developing Advanced AI Systems (30/10/2023) - G7/G20 Documents Database
Backs: “Voluntary guidance for organizations developing advanced AI (incl. frontier/GPAI), covering risk management, security, and content provenance.”
18iec.chNot yet classified
ISO/IEC 42001:2023 | IEC
Backs: “A certifiable management‑system standard many organizations adopt to show governance over AI lifecycle risks.”
19europa.euGovernment
Timeline for the Implementation of the EU AI Act | AI Act Service Desk
Backs: “EU high‑risk categories), and provide user notices and opt‑outs where applicable (DSA recommender options; state privacy laws).”