What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Short answer: it’s a patchwork. In 2026 there isn’t one global AI law; instead, builders and deployers of systems like me face a mix of national/state laws, sector rules, executive policies, competition and data‑protection enforcement, plus voluntary standards that many buyers increasingly require. Highlights by region:

United States (federal)

•Executive policy baseline: The 2023 “safe, secure, and trustworthy AI” order (EO 14110) was rescinded on January 20, 2025. It was replaced by EO 14179 (Jan 23, 2025) and EO 14365 (Dec 11, 2025), which emphasize removing federal barriers, coordinating a national AI policy, and exploring preemption of conflicting state AI laws. These orders do not themselves regulate private AI use directly but steer federal agencies’ posture.[1]

•Federal agency use of AI: OMB Memorandum M‑24‑10 (Mar 2024) still sets governance and risk‑management requirements for federal agencies’ “rights‑impacting” and “safety‑impacting” AI (chief AI officers, inventories, testing/red‑teaming, etc.). A follow‑on memo in Oct 2024 addressed AI acquisition. These bind federal agencies, not private firms.[2]

•Enforcement using existing laws: The FTC, DOJ, CFPB and EEOC jointly state that discrimination, unfair/deceptive practices, and credit/fair‑housing/employment laws already apply to automated systems (so vendors can face enforcement even without a new AI statute).[3]

•Federal standards ecosystem (voluntary but influential): NIST’s AI Risk Management Framework (AI RMF 1.0) and its 2024 Generative AI Profile are widely referenced by agencies and industry; NIST also runs the U.S. AI Safety Institute/consortium to advance testing and evaluations.[4]

United States (state and local)

•Colorado AI Act (SB24‑205, signed May 17, 2024): Requires developers and deployers of “high‑risk” AI used for consequential decisions to manage/mitigate algorithmic discrimination and meet disclosure, incident, and documentation duties (AG rulemaking ongoing, including chatbot‑safety add‑ons).[5]

•California CCPA regulations on Automated Decisionmaking Technology (ADMT): Finalized September 2025; effective January 1, 2026, with compliance required for “significant decisions” by January 1, 2027 (access/opt‑out rights, risk assessments, notices).[6]

•NYC Local Law 144 (hiring): Since July 5, 2023, employers using “automated employment decision tools” in NYC must obtain an annual independent bias audit and provide candidate notices and public summaries.[7]

•Deepfakes and election ads: Dozens of states now require disclosures on AI‑generated political content or allow remedies against deceptive deepfakes; see the continuously updated NCSL trackers.[8]

European Union

•EU AI Act (Regulation (EU) 2024/1689): A directly applicable, risk‑based law covering development, placing on the market, and use of AI in the EU. Key dates: general application began August 2, 2026; prohibitions and transparency duties (incl. chatbots and content‑labeling) apply on that date with limited transition; Annex III “high‑risk” system rules phase in on December 2, 2027 (stand‑alone high‑risk) and August 2, 2028 (high‑risk embedded in regulated products). General‑purpose AI (GPAI) model duties apply earlier and include extra requirements for “systemic‑risk” models, presumed above 10^25 FLOPs of training compute.[9]

•Liability and consumer protection: The revised Product Liability Directive (EU) 2024/2853 expressly covers software/AI and applies to products placed on the market after December 8, 2026 (Member States must transpose by December 9, 2026). This eases recovery for harm from defective AI‑enabled products.[10]

•Data protection duties (GDPR): Providers that process personal data must meet GDPR principles and, for solely automated decisions with legal/similar effects, respect Article 22 safeguards. EU data‑protection authorities (through the EDPB’s ChatGPT Taskforce) have already coordinated guidance and enforcement around transparency, accuracy, and user rights for generative AI.[11]

United Kingdom

•No single AI Act; the UK uses a “pro‑innovation” regulator‑led approach (ICO, CMA, Ofcom, etc.) guided by cross‑sector AI principles. The UK’s AI Safety Institute publishes model‑evaluation approaches; the CMA has issued competition/consumer protection principles for foundation models; Ofcom is rolling out Online Safety Act duties and codes. These shape how advanced models are tested, marketed, and deployed in the UK.[12]

Canada

•No federal, comprehensive AI statute in force. The proposed Artificial Intelligence and Data Act (AIDA) in Bill C‑27 did not become law in its 2022–2025 form. However, the federal public sector has bound itself since 2019 via the Directive on Automated Decision‑Making, which mandates Algorithmic Impact Assessments and safeguards for automated administrative decisions.[13]

China

•Binding national rules already govern algorithms, deepfakes, and generative AI: the 2022 Algorithmic Recommendation Provisions (filings and transparency for certain recommender systems), 2023 Deep Synthesis Provisions (watermarking/provenance, real‑name rules), and 2023 Interim Measures for Generative AI Services (provider responsibilities, security assessments). These apply to providers serving China’s public.[14]

International instruments (soft law and treaties)

•Council of Europe Framework Convention on AI (CETS No. 225): the first binding international AI treaty, adopted May 17, 2024 and opened for signature September 5, 2024; it commits parties (including the U.S., EU, and several states) to uphold human rights, democracy, and rule of law across AI lifecycles. It enters into force after sufficient ratifications.[15]

•OECD AI Principles (updated May 2024): widely adopted, voluntary principles on trustworthy AI that many governments and buyers incorporate into policy and procurement.[16]

•G7 “Hiroshima Process” (Oct–Dec 2023): voluntary Guiding Principles and a Code of Conduct for developers of advanced AI systems (e.g., risk management, security, content provenance).[17]

Standards buyers increasingly ask for (voluntary but market‑relevant)

•NIST AI Risk Management Framework (and 2024 Generative AI Profile): widely used scaffolding for governance, risk, and controls.[18]

•ISO/IEC 42001:2023 (AI management systems) and ISO/IEC 23894:2023 (AI risk management): certifiable management‑system standard (42001) and companion risk‑management guidance (23894).[19]

What this means in practice

•If you build or fine‑tune models: selling into the EU triggers the AI Act’s provider duties (earliest obligations already in force; more phase in through 2027–2028). U.S. sales face FTC/CFPB/EEOC/DOJ risk under existing laws. China requires compliance with its algorithm/deep‑synthesis/generative‑AI regimes for public‑facing services. Buyers (especially governments and large enterprises) increasingly require NIST/ISO controls evidence.[9]

•If you deploy AI for decisions about people (hiring, lending, housing, healthcare, education): expect sectoral laws and local rules like NYC LL 144, Colorado’s high‑risk AI law, and California’s ADMT rules (from Jan 1, 2026; significant‑decision compliance due Jan 1, 2027), plus GDPR Article 22 if you serve EU/UK users.[7]

•If you communicate at scale: many U.S. states now require disclosures or provide remedies for AI‑generated political deepfakes during election windows; platforms and advertisers also impose provenance/labeling requirements.[20]

If you share your use case (what you’re building, where your users are, and whether your system makes or supports “consequential” decisions), I can map exactly which of these rules likely apply and what evidence, tests, and disclosures you’ll need.

Citations (20)

1nist.govGovernment
Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence | NIST
Backs: “These orders do not themselves regulate private AI use directly but steer federal agencies’ posture.”
2whitehouse.govGovernment
EXECUTIVE OFFICE OF THE PRESIDENT
Backs: “A follow‑on memo in Oct 2024 addressed AI acquisition. These bind federal agencies, not private firms.”
3ftc.govGovernment
Joint Statement on Enforcement Efforts Against Discrimination and Bias in Automated Systems | Federal Trade Commission
Backs: “The FTC, DOJ, CFPB and EEOC jointly state that discrimination, unfair/deceptive practices, and credit/fair‑housing/employment laws already apply to automated systems (so vendors can face enforcement even without a new AI statute).”
4nist.govGovernment
Artificial Intelligence Risk Management Framework (AI RMF 1.0) | NIST
Backs: “AI Safety Institute/consortium to advance testing and evaluations.”
5colorado.govGovernment
SB24-205 Consumer Protections for Artificial Intelligence | Colorado General Assembly
Backs: “Requires developers and deployers of “high‑risk” AI used for consequential decisions to manage/mitigate algorithmic discrimination and meet disclosure, incident, and documentation duties (AG rulemaking ongoing, including chatbot‑safety add‑ons).”
6ca.govGovernment
California Finalizes Regulations to Strengthen Consumers' Privacy
Backs: “Finalized September 2025; effective January 1, 2026, with compliance required for “significant decisions” by January 1, 2027 (access/opt‑out rights, risk assessments, notices).”
7nyc.govGovernment
Automated Employment Decision Tools (AEDT) - DCWP
Backs: “Since July 5, 2023, employers using “automated employment decision tools” in NYC must obtain an annual independent bias audit and provide candidate notices and public summaries.”
8ncsl.orgNonprofits and think tanks
Artificial Intelligence (AI) in Elections and Campaigns
Backs: “Dozens of states now require disclosures on AI‑generated political content or allow remedies against deceptive deepfakes; see the continuously updated NCSL trackers.”
9europa.euGovernment
Regulation - EU - 2024/1689 - EN - EUR-Lex
Backs: “General‑purpose AI (GPAI) model duties apply earlier and include extra requirements for “systemic‑risk” models, presumed above 10^25 FLOPs of training compute.”
10europa.euGovernment
Directive (EU) 2024/2853 of the European Parliament and of the Council of 23 October 2024 on liability for defective products and repealing Council Directive 85/374/EEC (Text with EEA relevance)
Backs: “This eases recovery for harm from defective AI‑enabled products.”
11europa.euGovernment
Regulation - 2016/679 - EN - gdpr - EUR-Lex
Backs: “EU data‑protection authorities (through the EDPB’s ChatGPT Taskforce) have already coordinated guidance and enforcement around transparency, accuracy, and user rights for generative AI.”
12gov.ukGovernment
Implementing the UK’s AI regulatory principles: initial guidance for regulators - GOV.UK
Backs: “These shape how advanced models are tested, marketed, and deployed in the UK.”
13sencanada.caNot yet classified
Treasury Board of Canada Secretariat / Secrétariat du Conseil du Trésor du Canada
Backs: “However, the federal public sector has bound itself since 2019 via the Directive on Automated Decision‑Making, which mandates Algorithmic Impact Assessments and safeguards for automated administrative decisions.”
14stanford.eduAcademic
Translation: Internet Information Service Algorithmic Recommendation Management Provisions – Effective March 1, 2022
Backs: “Binding national rules already govern algorithms, deepfakes, and generative AI: the 2022 Algorithmic Recommendation Provisions (filings and transparency for certain recommender systems), 2023 Deep Synthesis Provisions (watermarking/provenance, real‑name rules), and 2023 Interim Measures for Generative AI Services…”
15coe.intGovernment
Committee on Artificial Intelligence (CAI) - Artificial Intelligence
Backs: “225): the first binding international AI treaty, adopted May 17, 2024 and opened for signature September 5, 2024; it commits parties (including the U.S., EU, and several states) to uphold human rights, democracy, and rule of law across AI lifecycles. It enters into force after sufficient ratifications.”
16oecd.orgGovernment
OECD updates AI Principles to stay abreast of rapid technological developments | OECD
Backs: “OECD AI Principles (updated May 2024): widely adopted, voluntary principles on trustworthy AI that many governments and buyers incorporate into policy and procurement.”
17g7g20-documents.orgNot yet classified
Hiroshima Process International Guiding Principles for Organizations Developing Advanced AI System (30/10/2023) - G7/G20 Documents Database
Backs: “G7 “Hiroshima Process” (Oct–Dec 2023): voluntary Guiding Principles and a Code of Conduct for developers of advanced AI systems (e.g., risk management, security, content provenance).”
18nist.govGovernment
AI Risk Management Framework | NIST
Backs: “NIST AI Risk Management Framework (and 2024 Generative AI Profile): widely used scaffolding for governance, risk, and controls.”
19iso.orgNonprofits and think tanks
ISO/IEC 42001:2023 - AI management systems
Backs: “ISO/IEC 42001:2023 (AI management systems) and ISO/IEC 23894:2023 (AI risk management): certifiable management‑system standard (42001) and companion risk‑management guidance (23894).”
20ncsl.orgNonprofits and think tanks
Artificial Intelligence Legislation Database
Backs: “If you communicate at scale: many U.S. states now require disclosures or provide remedies for AI‑generated political deepfakes during election windows; platforms and advertisers also impose provenance/labeling requirements.”