I'll map the current rules governing how AI systems are built, deployed, and held accountable.
There is no single global law governing AI systems like me. Rules are a patchwork of binding laws, sectoral regulations, and voluntary frameworks that vary by jurisdiction. Most impose obligations on both developers (build) and deployers (use), with accountability through documentation, risk assessment, transparency, and enforcement.
1. European Union - EU AI Act
The most comprehensive binding framework.
•Regulation (EU) 2024/1689, sets common rules for AI across the European Union. It entered into force on 1 August 2024 and became applicable on 2 August 2026, although some obligations took effect earlier.
•Risk-based classification:
•Unacceptable risk is prohibited (e.g. social scoring systems and manipulative AI)
•High-risk AI systems, which are regulated - most of the text addresses these
•Limited risk - subject to lighter transparency obligations
•Also regulates types of models:
•The Act regulates different types of AI systems based on their risk level, outright prohibiting some uses while establishing stricter requirements for those who deploy AI systems classified as "high-risk." Additionally, the act sets rules for the use of "general-purpose" AI models, as well as generative AI tools capable of producing deepfakes.
•Requirements for high-risk systems include risk management systems, data governance, technical documentation, human oversight, accuracy and robustness.
•Transparency obligations for all systems:
•Article 50 guidance, effective August 2026, expands compliance obligations for enterprises using foundation model chatbots and AI-generated content, requiring transparent disclosure of AI interactions and machine-readable marking of synthetic outputs.
•Deployers will also have to inform people when they are exposed to deep fakes, to AI-generated content on matters of public interests without human review or editorial control, and to emotion recognition or biometric categorisation systems.
•Unlike high-risk rules elsewhere in the regulation, these obligations apply broadly across sectors and business models, covering any organisation that uses AI in areas such as chatbots, content generation, or biometric analysis.
Enforced by the EU AI Office and national supervisory authorities, with penalties up to 7% of global turnover.
2. United States - No single federal AI law, but multiple overlapping regimes
> The regulations are here. The EU AI Act is in force. Colorado's AI Act applies to high-risk decisions. California's ADMT rules under CPRA are taking shape. South Korea's Basic AI Act is on the books. And the FTC has made clear that unfair or deceptive AI practices are fair game for enforcement, regardless of whether a dedicated AI law exists.
A. Existing laws applied to AI:
•The Federal Trade Commission (FTC) continues case-by-case enforcement - no exemptions from existing law apply to AI and ethical responsibility must operate in tandem with legal accountability. FTC Act (unfair/deceptive practices), civil rights laws, consumer protection, product liability, copyright, and sectoral laws (HIPAA, FCRA, ECOA) all apply.
B. Voluntary federal framework:
•The NIST Artificial Intelligence Risk Management Framework (AI RMF) provides organizations with a structured, flexible, and repeatable process to identify, measure, and manage the unique risks posed by AI systems. This voluntary framework was released in January of 2023 and has become the most widely adopted AI governance standard in the US.
•Its core is four functions: Govern, Map, Measure, and Manage, aligned with trustworthy AI characteristics such as validity, safety, security, accountability, and fairness.
•The framework defines trustworthy AI through seven characteristics: 1) valid and reliable, 2) safe, 3) secure and resilient, 4) accountable and transparent, 5) explainable and interpretable, 6) privacy-enhanced, and 7) fair with harmful bias managed.
•It is intended for voluntary use and to improve the ability to incorporate trustworthiness considerations into the design, development, use, and evaluation of AI products.
•It can be integrated with ISO/IEC 42001, ISO/IEC 27001, enterprise risk management, cybersecurity, privacy, and other governance mechanisms.
C. Executive Orders:
•Biden Executive Order 14110 (Safe, Secure and Trustworthy AI, Oct 2023) directed the National Institute for Standards and Technology ("NIST") in coordination with other relevant agencies to establish guidelines and best practices for developing and deploying safe, secure and trustworthy AI systems, including guidelines applicable to generative AI models and "dual-use foundation models".
•Trump Executive Order 14179 of January 23, 2025 (Removing Barriers to American Leadership in Artificial Intelligence), revoked the Biden order to "paralyze this industry and directed my Administration to remove barriers to United States AI leadership".
•Executive Order 14365 directs federal authorities to challenge certain state-level artificial intelligence laws and contemplates limiting federal funding to states maintaining regulations deemed inconsistent with federal policy.
Congress has proposed but not passed comprehensive bills, including requirements that:
•Each critical-impact AI organization shall not later than 30 days before deployment perform a risk management assessment
3. US State Laws - Growing Patchwork
States are passing their own AI laws governing the technology's use.
•Colorado: Recently became the first U.S. state to pass comprehensive AI legislation applicable to both AI system developers and deployers. Colorado's AI Act (SB 205, amended, now effective January 1, 2027) requires developers and deployers of high-risk AI (used for consequential decisions in employment, lending, housing, healthcare, education) to exercise reasonable care, complete impact assessments, mitigate algorithmic discrimination, and provide transparency and appeal rights.
•Connecticut: On May 1, 2026, the Connecticut General Assembly passed Senate Bill 5, the Artificial Intelligence Responsibility and Transparency Act. It regulates use in employment decisions and immediate obligations with operationally intensive obligations taking effect in October 2027.
•California, Illinois, New York City, Texas: Among jurisdictions that comprehensively regulate use of AI that impacts employment. California has the Transparency in Frontier AI Act, AB 2013, and ADMT rules under the California Privacy Rights Act.
•Companion chatbot laws: Twelve states now have passed laws aimed at reducing potential risks associated with "companion chatbots," particularly for minors. Already in effect in New York, California, and Hawaii, while similar laws in Colorado, Connecticut, Georgia, Iowa, Idaho, Nebraska, Oregon, Rhode Island, and Washington will take effect in 2027.
•Data privacy / profiling laws: About a third of states have enacted a comprehensive data privacy law, and most of them — California, Colorado, Connecticut, Delaware, Indiana, Montana, New Hampshire, New Jersey, Oregon, Tennessee, Texas and Virginia — include a provision that in some way regulates the use of AI in profiling.
•Task forces: In March 2024, Washington enacted ESSB 5838 to establish an AI task force to examine development and use of AI and make recommendations regarding guidelines and potential legislation to protect safety, privacy, and civil and intellectual property rights. Similar research obligations exist in eleven states including Alabama, California, Colorado, Connecticut, Illinois, Louisiana, New Jersey etc.
4. United Kingdom - Principles-Based, Non-Statutory
Rather than introducing a standalone AI Act, the UK government is currently opting for a contextual and decentralised framework through leveraging existing regulators.
The 2023 White Paper A Pro-Innovation Approach to AI Regulation outlines 5 principles for regulators:
•safety and security; transparency; fairness (i.e. no bias or discrimination); accountability for AI outcomes; contestability and redress (people need ways to dispute harmful outcomes).
Restated as: safety, security and robustness, appropriate transparency and explainability, fairness, accountability and governance, and contestability and redress.
Regulators (FCA, ICO, CMA, MHRA etc) apply these principles within existing law, e.g. Equality Act 2010, UK GDPR, product safety. The Competition and Markets Authority's overarching principle is accountability for AI outputs.
5. China - Content Control Focused
China's three most concrete and impactful regulations on algorithms and AI are its 2021 regulation on recommendation algorithms, the 2022 rules for deep synthesis (synthetically generated content), and the 2023 draft rules on generative AI.
•Interim Measures for the Management of Generative Artificial Intelligence Services (effective Aug 15, 2023): Jointly published by the Cyberspace Administration of China (CAC) and other regulators, China's first comprehensive regulations on generative AI.
•Core obligations: Providers must ensure content is consistent with "social order and societal morals," adopt measures to avoid discrimination, and ensure content is true, accurate, and free of fraudulent information.
•Labeling requirement: Requires service providers to label AI-generated material as such, either explicitly or via metadata encoded in each file and requiring providers to add visible marks to their content in appropriate locations throughout production and dissemination.
Algorithm registry/filing is also required (940 deep synthesis services completing filing).
6. How Accountability is Enforced Across Systems
| Stage | Typical Rules |
|---|
| Build | Risk management system, data governance, model evaluation and red-teaming, documentation, human oversight by design (EU high-risk), NIST Govern function |
| Deploy | Impact assessments before deployment (e.g. 30 days before for critical-impact systems), transparency/disclosure to users when interacting with AI or receiving AI-generated content, monitoring and annual review |
| Hold Accountable | Clear roles and accountability for outcomes; liability under existing tort/consumer protection law; FTC enforcement against unfair/deceptive AI; EU fines; Chinese administrative penalties; state attorney-general enforcement; right to appeal to human and contestability; algorithmic disgorgement |
In addition, international soft-law instruments guide development: OECD AI Principles, Council of Europe AI Convention, and ISO/IEC 42001 AI Management System standard (which NIST notes can be integrated with its RMF).
Rules are evolving quickly - in the US especially, businesses must track both federal guidance (NIST, FTC) and the state patchwork, while in the EU and China compliance is already mandatory.