What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Here’s a concise, up‑to‑date snapshot (as of September 15, 2026) of the main rules that govern how AI systems like large language models are built, deployed, and held accountable. If you want this narrowed to a specific country or sector, say the word.

Global and cross‑border (soft law and treaties)

•OECD AI Principles (non‑binding, widely referenced in policy and procurement).[1]

•UNESCO Recommendation on the Ethics of AI (non‑binding guidance adopted by all UNESCO member states).[2]

•Council of Europe Framework Convention on AI, Human Rights, Democracy and the Rule of Law (first binding international AI treaty; opened for signature Sept 5, 2024; now moving toward ratifications).[3]

European Union

•AI Act (Regulation (EU) 2024/1689): risk‑based obligations, with phased application. Key dates: prohibited practices and AI literacy apply from Feb 2, 2025; transparency duties (incl. user disclosures for interactive/generative AI and deepfake labeling) apply from Aug 2, 2026; high‑risk Annex III uses apply from Dec 2, 2027; high‑risk embedded in regulated products apply from Aug 2, 2028. Supervision of general‑purpose models (GPAI) is ramping up under the EU AI Office.[4]

•Digital Services Act (DSA): very large platforms/search engines must assess and mitigate systemic risks (including those from generative AI content) and add recommender‑system transparency; the Commission has issued guidance tying DSA duties to AI‑generated content.[5]

•Updated Product Liability Directive (2024/2853): clarifies that software/AI are “products” and expands no‑fault liability, including for defects introduced via updates or continuous learning.[6]

United States — federal

•Executive Order 14110 (Oct 30, 2023): directs agencies to develop standards, testing, red‑teaming, and content‑authenticity/watermarking guidance; OMB M‑24‑10 implements EO requirements for federal agencies’ AI use (governance, inventories, impact assessments, safety/risk controls).[7]

•NIST: AI Risk Management Framework (AI RMF 1.0) and the U.S. AI Safety Institute’s technical guidance/evaluations (e.g., dual‑use foundation‑model misuse‑risk guidance). These are voluntary but increasingly referenced in contracts and oversight.[8]

•Consumer protection and civil‑rights enforcement using existing laws:

•FTC uses Section 5 to police unfair/deceptive AI claims and harmful deployments (e.g., Rite Aid facial‑recognition settlement and broader sweeps on deceptive “AI” marketing).[9]

•CFPB: lenders using complex/ML models must give specific, accurate adverse‑action reasons under ECOA/Reg B.[10]

•EEOC: guidance on using AI in hiring under Title VII (adverse‑impact analysis still required).[11]

United States — state and local (examples now in force)

•New York City Local Law 144 (AEDTs in hiring): annual independent bias audits, public summaries, and candidate/employee notices for tools that “substantially assist” hiring/promotion.[12]

•California CPPA regulations (effective Jan 1, 2026): new rules on automated decision‑making technology (ADMT) give consumers access/opt‑out rights; also require risk assessments and cybersecurity audits for certain businesses.[13]

•Colorado AI Act (SB24‑205, 2024): first comprehensive state AI law targeting “high‑risk” AI that makes consequential decisions; requires risk‑management programs, impact disclosures, and notice to consumers; statewide rulemaking is underway for implementation beginning in 2026.[14]

•Illinois BIPA (biometric privacy): strict consent and retention rules plus a private right of action—driving significant litigation over face/voice data used by AI.[15]

•Tennessee ELVIS Act (2024): protects voice likeness against unauthorized AI voice‑cloning in commercial contexts.[16]

United Kingdom

•No cross‑cutting AI statute yet; the government’s “pro‑innovation” approach relies on existing regulators applying five cross‑sector principles. The UK AI Safety Institute conducts testing/evaluations; the Online Safety Act 2023 (regulated by Ofcom) adds platform‑safety and transparency duties relevant to AI‑generated content.[17]

China

•Binding national rules for public‑facing AI: Interim Measures for Generative AI Services (effective Aug 15, 2023: lawful data sources, AIGC labeling, safety assessments/filings); “Deep Synthesis” rules (Jan 10, 2023) and algorithmic‑recommendation provisions (effective Mar 1, 2022) also apply.[18]

Standards, audits, and industry codes (often referenced by law or contracts)

•ISO/IEC 42001:2023 (AI management systems) and ISO/IEC 23894:2023 (AI risk management) are now common assurance anchors; organizations increasingly certify to 42001 to demonstrate governance.[19]

•NIST AI RMF 1.0 + U.S. AI Safety Institute evaluation programs (e.g., ARIA, misuse‑risk guidance for dual‑use foundation models) are used by agencies and vendors as de‑facto benchmarks.[8]

•Content authenticity and deepfake labeling: the C2PA content‑provenance standard is being adopted across tools and is referenced by government guidance alongside watermarking/detection approaches.[20]

What this tends to mean in practice for systems like me

•Disclose AI interactions and label AI‑generated/manipulated media in the EU starting August 2, 2026; GPAI model providers face additional obligations and supervision.[21]

•If your AI tool influences employment, credit, housing, insurance, or other “consequential” decisions in the U.S., expect audits/impact assessments, consumer notices, and civil‑rights/consumer‑protection scrutiny (NYC LL 144, California ADMT rules, Colorado AI Act, plus FTC/CFPB/EEOC enforcement).[12]

•Platforms hosting or amplifying AI content in the EU must mitigate risks from generative AI under the DSA (e.g., recommender transparency, election‑risk measures).[22]

•Product liability in the EU now clearly covers software/AI, including defects from updates or continuous learning.[23]

If you tell me your jurisdiction and use case (e.g., hiring, customer service, healthcare, finance, education), I can map the exact obligations, timelines, and what “good compliance” looks like there.

1.[OECD

Organisation for Economic Co-operation and](https://one.oecd.org/document/C/MIN%282019%293/FINAL/en/pdf?utm_source=openai)

14.[SB 24-205

Legislative Council Staff
Nonpartisan](https://leg.colorado.gov/bill_files/47798/download?utm_source=openai)

Citations (23)

1oecd.orgGovernment
OECD Organisation for Economic Co-operation and
Backs: “OECD AI Principles (non‑binding, widely referenced in policy and procurement).”
2unesco.orgGovernment
381137eng.pdf
Backs: “UNESCO Recommendation on the Ethics of AI (non‑binding guidance adopted by all UNESCO member states).”
3coe.intGovernment
Committee on Artificial Intelligence (CAI) - Artificial Intelligence
Backs: “Council of Europe Framework Convention on AI, Human Rights, Democracy and the Rule of Law (first binding international AI treaty; opened for signature Sept 5, 2024; now moving toward ratifications).”
4europa.euGovernment
Timeline for the Implementation of the EU AI Act | AI Act Service Desk
Backs: “Supervision of general‑purpose models (GPAI) is ramping up under the EU AI Office.”
5europa.euGovernment
Digital Services Act - Consilium
Backs: “Digital Services Act (DSA): very large platforms/search engines must assess and mitigate systemic risks (including those from generative AI content) and add recommender‑system transparency; the Commission has issued guidance tying DSA duties to AI‑generated content.”
6europa.euGovernment
Directive (EU) 2024/2853 of the European Parliament and of the Council of 23 October 2024 on liability for defective products and repealing Council Directive 85/374/EEC (Text with EEA relevance)
Backs: “Updated Product Liability Directive (2024/2853): clarifies that software/AI are “products” and expands no‑fault liability, including for defects introduced via updates or continuous learning.”
7govinfo.govGovernment
Executive Orders EO 14110
Backs: “OMB M‑24‑10 implements EO requirements for federal agencies’ AI use (governance, inventories, impact assessments, safety/risk controls).”
8nist.govGovernment
Artificial Intelligence Risk Management Framework (AI RMF 1.0) | NIST
Backs: “These are voluntary but increasingly referenced in contracts and oversight.”
9ftc.govGovernment
Rite Aid Banned from Using AI Facial Recognition After FTC Says Retailer Deployed Technology without Reasonable Safeguards | Federal Trade Commission
Backs: “FTC uses Section 5 to police unfair/deceptive AI claims and harmful deployments (e.g., Rite Aid facial‑recognition settlement and broader sweeps on deceptive “AI” marketing).”
10consumerfinance.govGovernment
Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms | Consumer Financial Protection Bureau
Backs: “CFPB: lenders using complex/ML models must give specific, accurate adverse‑action reasons under ECOA/Reg B.”
11govdelivery.comCompanies
EEOC Releases New Resource on Artificial Intelligence and Title VII
Backs: “EEOC: guidance on using AI in hiring under Title VII (adverse‑impact analysis still required).”
12nyc.govGovernment
Automated Employment Decision Tools (AEDT) - DCWP
Backs: “New York City Local Law 144 (AEDTs in hiring): annual independent bias audits, public summaries, and candidate/employee notices for tools that “substantially assist” hiring/promotion.”
13ca.govGovernment
California Finalizes Regulations to Strengthen Consumers' Privacy
Backs: “California CPPA regulations (effective Jan 1, 2026): new rules on automated decision‑making technology (ADMT) give consumers access/opt‑out rights; also require risk assessments and cybersecurity audits for certain businesses.”
14colorado.govGovernment
SB 24-205 Legislative Council Staff Nonpartisan
Backs: “Colorado AI Act (SB24‑205, 2024): first comprehensive state AI law targeting “high‑risk” AI that makes consequential decisions; requires risk‑management programs, impact disclosures, and notice to consumers; statewide rulemaking is underway for implementation beginning in 2026.”
15ilga.govGovernment
740 ILCS 14/20
Backs: “Illinois BIPA (biometric privacy): strict consent and retention rules plus a private right of action—driving significant litigation over face/voice data used by AI.”
16tn.govGovernment
PHOTOS: Gov. Lee Signs ELVIS Act Into Law
Backs: “Tennessee ELVIS Act (2024): protects voice likeness against unauthorized AI voice‑cloning in commercial contexts.”
17gov.ukGovernment
A pro-innovation approach to AI regulation: government response - GOV.UK
Backs: “The UK AI Safety Institute conducts testing/evaluations; the Online Safety Act 2023 (regulated by Ofcom) adds platform‑safety and transparency duties relevant to AI‑generated content.”
18comparativeai.orgLow provenance
Interim Measures for the Management of Generative AI Services | Comparative AI
Backs: ““Deep Synthesis” rules (Jan 10, 2023) and algorithmic‑recommendation provisions (effective Mar 1, 2022) also apply.”
19iso.orgNonprofits and think tanks
ISO - ISO 42001 explained
Backs: “ISO/IEC 42001:2023 (AI management systems) and ISO/IEC 23894:2023 (AI risk management) are now common assurance anchors; organizations increasingly certify to 42001 to demonstrate governance.”
20c2pa.orgNot yet classified
Content Credentials : C2PA Technical Specification :: C2PA Specifications
Backs: “Content authenticity and deepfake labeling: the C2PA content‑provenance standard is being adopted across tools and is referenced by government guidance alongside watermarking/detection approaches.”
21europa.euGovernment
Transparency obligations under Article 50 of the AI Act | Shaping Europe’s digital future
Backs: “GPAI model providers face additional obligations and supervision.”
22europa.euGovernment
EUR-Lex - 52024XC03014 - SV - EUR-Lex
Backs: “Platforms hosting or amplifying AI content in the EU must mitigate risks from generative AI under the DSA (e.g., recommender transparency, election‑risk measures).”
23europa.euGovernment
Directive - 2024/2853 - EN - Product Liability Directive - EUR-Lex
Backs: “Product liability in the EU now clearly covers software/AI, including defects from updates or continuous learning.”