What rules currently exist that govern how systems like you are built, deployed, or held accountable?
A mix of binding laws, regulations, voluntary frameworks, existing general laws, and international agreements currently govern the building (development/training), deployment/use, and accountability of AI systems like large language models (LLMs) and generative AI. There is no single global regime. Approaches vary by jurisdiction: comprehensive risk-based rules in the EU, a patchwork (often lighter or sector-specific) in the US, content- and security-focused rules in China, and soft-law or treaty-based efforts internationally. Many obligations apply extraterritorially if systems or outputs reach a market. Existing laws on data protection, consumer protection, discrimination, intellectual property, and product liability also apply.[1]
European Union: EU AI Act (Regulation (EU) 2024/1689)
This is the world’s first comprehensive horizontal AI law. It entered into force in August 2024 and applies on a staggered timeline (prohibitions and AI literacy from February 2025; GPAI obligations from August 2025; most high-risk rules phased, with some delays via later amendments to late 2026–2027). It has extraterritorial reach for systems placed on the EU market or used there.[1]
It uses a risk-based approach:
Accountability and enforcement: Providers (developers) bear primary duties for design/build; deployers for use/oversight. National market surveillance authorities + EU AI Office (for GPAI). Fines up to €35 million or 7% of global turnover (prohibited practices), lower tiers for other breaches. Supporting tools include guidelines, standards, the AI Pact (voluntary early compliance), and sandboxes. The revised Product Liability Directive also treats AI software as a “product” subject to strict liability (from ~December 2026).[3]
Related: GDPR applies to personal data processing in AI (lawful basis, DPIAs for high-risk automated decisions, rights to explanation/opt-out in some cases).
United States
No comprehensive federal AI statute. The landscape is a patchwork of executive actions, agency enforcement of existing laws, state laws, and voluntary frameworks. The Biden-era EO 14110 (Safe, Secure, and Trustworthy AI, 2023) was largely revoked by the Trump administration in early 2025 in favor of a more deregulatory, pro-innovation stance (e.g., “Removing Barriers” EO and subsequent AI Action Plan/National Policy Framework emphasizing leadership, infrastructure, exports, and reducing barriers, while addressing some national security/cyber risks via voluntary reviews for frontier models). Federal agencies have AI governance rules for their own use (e.g., OMB memoranda requiring Chief AI Officers, inventories, risk management for high-impact systems).[4]
Key elements:
Accountability: Primarily through agency enforcement, private litigation, state AGs, and market pressures. Federal preemption efforts against conflicting state laws have been discussed. International commitments include signing the Council of Europe Convention.
China
Layered, agency-driven rules (led by Cyberspace Administration of China/CAC and others) rather than one comprehensive statute. Focus on content control, security, socialist values, and public-facing services.[8]
Key instruments:
Accountability: Filing/registration mandatory for many services; security assessments; enforcement via fines, suspensions, account shutdowns, criminal referral. Judicial guidance on liability for AI harms (fault-based torts with AI-specific factors). Providers responsible for outputs and training data legality.[9]
International and Soft-Law Frameworks
Cross-Cutting Themes for Building, Deployment, and Accountability
Other jurisdictions (e.g., UK principles-based via existing regulators; Canada proposed AIDA; India sectoral + emerging guidelines; various national strategies) add further layers. Rules evolve rapidly with technology, politics, and incidents. Companies often adopt “highest common denominator” compliance for global systems. For the latest or jurisdiction-specific advice, consult primary legal texts or counsel, as this is a high-level overview of the current landscape (as of mid/late 2026 information).
Citations (12)
- https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
Backs: “Existing laws on data protection, consumer protection, discrimination, intellectual property, and product liability also apply.”
- https://www.springlex.eu/en/packages/ai-act/ai-act-regulation/article-50/
Backs: “Generative AI providers must mark synthetic content (machine-readable where possible); deployers must label deepfakes and certain public-interest AI text.”
- https://wcr.legal/eu-ai-liability-directive-withdrawn-pld/
Backs: “The revised Product Liability Directive also treats AI software as a “product” subject to strict liability (from ~December 2026).”
- https://www.whitecase.com/insight-our-thinking/ai-watch-global-regulatory-tracker-united-states
Backs: “Federal agencies have AI governance rules for their own use (e.g., OMB memoranda requiring Chief AI Officers, inventories, risk management for high-impact systems).”
- https://ailegalauthority.com/ftc-ai-enforcement-legal/
Backs: “Product liability and tort law are evolving for AI harms (negligence, defects); courts are testing applicability. SEC scrutinizes AI-related disclosures.”
- https://www.varnumlaw.com/insights/state-level-ai-regulations-enacted-in-2024/
Backs: “Common themes: notice when AI influences consequential decisions, bias testing, documentation, appeals.”
- https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10
Backs: “NIST AI Risk Management Framework (AI RMF 1.0, 2023) + Generative AI Profile—voluntary, lifecycle approach (Govern, Map, Measure, Manage) focused on trustworthy characteristics (valid/reliable, safe, secure/resilient, accountable/transparent, explainable, privacy-enhanced, fair). Widely referenced. Other NIST work on…”
- https://reg-intel.com/china-ai-regulation-2026-every-law-rule-and-draft-in-one-place/
Backs: “Focus on content control, security, socialist values, and public-facing services.”
- https://aigovernance.com/entry/china-generative-ai-regulations-interim-measures
Backs: “Providers responsible for outputs and training data legality.”
- https://www.coe.int/en/web/artificial-intelligence/the-framework-convention-on-artificial-intelligence
Backs: “Signed/ratified by EU, US, UK, and others; risk-based and technology-neutral. Implemented in EU largely via the AI Act.”
- https://digital-strategy.ec.europa.eu/en/library/g7-leaders-statement-hiroshima-ai-process
Backs: “International Guiding Principles + voluntary Code of Conduct for advanced/frontier AI developers (risk identification/mitigation across lifecycle, testing/red-teaming, transparency, incident reporting, cybersecurity, content provenance, bias mitigation, etc.). OECD-supported reporting framework for transparency.”
- https://www.ntia.gov/issues/artificial-intelligence/ai-accountability-policy-report
Backs: “Voluntary frameworks like NIST RMF emphasize organisational governance and continuous risk management.”