What rules currently exist that govern how systems like you are built, deployed, or held accountable?

What rules shape systems like me is exactly what you're asking — I'll map the current framework governing how we're built, deployed and held accountable.

There are not yet single unified global rules for systems like me, but several layers of rules currently exist that govern how AI systems are built, deployed, and held accountable:

1. Comprehensive AI-specific regulation - EU

The most comprehensive horizontal regulation is the EU Artificial Intelligence Act:

•European Union lawmakers signed the artificial intelligence (AI) act in June 2024. The AI act, the first binding worldwide horizontal regulation on AI, sets a common framework for the use and supply of AI systems in the EU

•It offers a classification for AI systems with different requirements and obligations tailored to a 'risk-based approach'. Some AI systems presenting 'unacceptable' risks are prohibited

•A wide range of 'high-risk' AI systems that can have a detrimental impact on people's health, safety or on their fundamental rights are authorised, but subject to a set of requirements and obligations to gain access to the EU market

•AI systems posing limited risks because of their lack of transparency will be subject to information and transparency requirements, while AI systems presenting only minimal risk for people will not be subject to further obligations

•The regulation also lays down specific rules for general purpose AI (GPAI) models and lays down more stringent requirements for GPAI models with 'high-impact capabilities'

The regulation provides a globally binding, comprehensive framework for the deployment and use of AI systems across the EU. On August 2024, the Regulation (EU) 2024/1689, commonly referred to as the Artificial Intelligence (AI) Act, came into effect.

2. United States - Federal frameworks (largely voluntary so far)

At the US federal level there is no single comprehensive AI law, but several authoritative frameworks and directives govern building and deployment, especially for federal agencies and companies that contract with them:

•NIST AI Risk Management Framework (AI RMF): The NIST AI RMF is a voluntary, non-certifiable framework that helps organizations responsibly design, develop, implement, and use AI systems in their operations

•The framework was released on January 26, 2023, and was later referenced in U.S. Executive Order 14110 (October 2023) on safe AI development. Note: EO 14110 was revoked in January 2025 by Executive Order 14179, but the NIST AI RMF remains an active, authoritative resource maintained by NIST.

•On July 26, 2024, NIST published NIST AI 600-1, the Generative Artificial Intelligence Profile, which addresses unique risks posed by generative AI — including confabulation, data privacy, information integrity, and intellectual property concerns.

•Federal engagement with the private sector on the development of voluntary consensus standards will help agencies develop expertise in AI and identify practical standards for use in regulation. Earlier efforts that inform current accountability expectations include the Blueprint for an AI Bill of Rights (October 2022) and Executive Orders directing agencies to develop guidance on accountability for generative AI and procurement.

These frameworks emphasize Govern, Map, Measure, and Manage functions, and trustworthiness characteristics like Valid and Reliable, Safe, Secure and Resilient, Accountable and Transparent, Explainable, Privacy-Enhanced, and Fair with Harmful Bias Managed.

3. United States - State laws

States are increasingly filling the federal gap. The most prominent example:

•On 29 September 2025, Californian Governor Gavin Newsom signed the Transparency in Frontier Artificial Intelligence Act, known as SB53, into law. California becomes the first US state to impose specific transparency obligations on AI companies.

•The Act provides that: Companies must publish documentation about its safety practices, including how its AI models have been tested for dangerous capabilities, Severe AI-related incidents must be reported to relevant authorities and then disclosed to the public, Stronger legal protections will be afforded to whistleblowers who raise AI safety concerns.

•The Act applies to large AI developers with gross annual revenues over US$500 million that have trained foundation models using more than 10^26 floating point operations (FLOPs) of computing power.

California also passed more than 20 AI statutes covering employment, healthcare, education, and pricing algorithms that took effect in January 2026, and other states like New York and Michigan are considering similar bills.

4. Existing laws applied to AI - Accountability

Even where no AI-specific statute applies, systems like me remain subject to existing legal regimes that govern accountability:

•Liability rules and standards: Federal government agencies should work with stakeholders to make recommendations about applying existing liability rules and standards to AI systems and, as needed, supplementing them. This would help in determining who is responsible and held accountable for AI system harms throughout the value chain.

•In the EU, the proposed revisions to the Product Liability Directive are intended to clarify that the product liability regime extends to digital technologies, including AI-enabled goods and services, and that providers of digital services and software can be held liable.

•Other regimes commonly applied include:

•Consumer protection and anti-discrimination / civil rights laws

•Data privacy laws (e.g., EU GDPR, California CCPA/CPRA)

•Copyright and intellectual property - training on copyrighted works and infringing outputs are being tested in courts

•Sector-specific rules for finance, healthcare, employment, etc.

In practice, accountability today comes from a combination of: mandatory requirements where they exist (EU prohibitions/high-risk obligations, California transparency and incident reporting), voluntary but authoritative risk management standards (NIST AI RMF), and after-the-fact liability under product liability, negligence, and other consumer protection laws - plus proposals to expand audits, documentation, disclosure, and independent evaluations.

Rules are rapidly evolving, so deployment requirements and accountability standards differ significantly by jurisdiction and use-case.

1.Artificial intelligence act | Think Tank | Euroopa Parlament — https://www.europarl.europa.eu/thinktank/et/document/EPRS_BRI(2021)698792

Citations (3)

1europa.euGovernment
Artificial intelligence act | Think Tank | Euroopa Parlament
Backs: “The most comprehensive horizontal regulation is the EU Artificial Intelligence Act: European Union lawmakers signed the artificial intelligence (AI) act in June 2024.”
2vanta.comNot yet classified
NIST AI RMF: What it is, who needs it, and how to implement it | Vanta
Backs: “At the US federal level there is no single comprehensive AI law, but several authoritative frameworks and directives govern building and deployment, especially for federal agencies and companies that contract with them: NIST AI Risk Management Framework (AI RMF): The NIST AI RMF is a voluntary, non-certifiable…”
3ussc.edu.auAcademic
Landmark laws for AI transparency
Backs: “The most prominent example: On 29 September 2025, Californian Governor Gavin Newsom signed the Transparency in Frontier Artificial Intelligence Act, known as SB53, into law.”