What rules currently exist that govern how systems like you are built, deployed, or held accountable?

I'll research the current regulatory landscape for AI systems to give you an accurate, up-to-date picture.Here's a picture of the current landscape of rules governing AI systems like me, as of September 2026. It's a patchwork of binding law, semi-binding regulation, and voluntary frameworks—none of it fully settled, and several pieces are actively being renegotiated right now.

1. European Union — the most comprehensive binding law

The EU AI Act is the world's first comprehensive AI law. The AI Act entered into force on 1 August 2024 and became applicable on 2 August 2026, with some exceptions: prohibited AI practices and AI literacy obligations entered into application from 2 February 2025. It uses a risk-tiered structure: a proportionate, risk-based approach that tailors regulatory obligations based on the level of risk an AI system poses to health, safety, and fundamental rights, with a four-tiered framework — Unacceptable Risk systems are banned outright (e.g., social scoring). These include practices such as social scoring and certain forms of cognitive or behavioral manipulation that could cause harm.

Enforcement has begun: from 2 August 2026, the AI Office and authorities of the Member States are responsible for implementing, supervising and enforcing the AI Act, and the AI Office holds enforcement powers over GPAI models, able to request technical documentation, evaluate models, require corrective measures and issue fines for non-compliance.

However, implementation has been slipping. The primary driver is the slower than expected development of harmonised technical standards and guidance, with European standardisation bodies facing delays, many now expected towards the end of 2026. As a result, the high-risk obligations originally due in August 2026 did not take effect; rules for stand-alone high-risk AI systems now apply Dec 2, 2027, and rules for high-risk AI embedded into regulated products apply Aug 2, 2028.

2. United States — a fractured, contested landscape

There's no comprehensive federal AI statute. Instead, three layers are colliding:

State laws have moved fastest. California's SB 53 / TFAIA is the flagship example: it makes California the first state to require public, standardized safety disclosures from developers of advanced artificial intelligence models. It applies to "frontier models" — foundation models trained on a quantity of computing power greater than 10^26 integer or floating-point operations (FLOPs), including compute used in subsequent fine-tuning, reinforcement learning, or other material modifications. Large frontier developers must publish an accessible general safety framework showing how they incorporate national and international standards and industry-consensus best practices, and explain how they assess and mitigate catastrophic-risk capabilities. They also face incident-reporting duties: a frontier developer must report any critical safety incident pertaining to its frontier models to Cal OES within 15 days of discovering the critical safety incident. Nationally, as of July 1, states have enacted 109 AI and 28 data center laws.

Federal preemption push: In December 2025, the administration moved to override this state patchwork. Executive Order 14365 directs federal agencies to develop a unified national approach to AI policy, evaluate state AI laws for potential conflicts, challenge them through legal action, and condition certain federal funding on state compliance, while exempting state laws related to child safety, data center infrastructure, and state government procurement. The order created enforcement teeth: an AI Litigation Task Force within the Department of Justice, responsible for challenging state AI laws in federal court beginning January 10, 2026, plus authorizing federal agencies to condition discretionary grants on states refraining from enacting, or agreeing not to enforce, AI laws deemed inconsistent with the Executive Order's policy. In March 2026 the White House escalated this into a legislative ask: a National Policy Framework outlining recommendations for Congress to establish a unified federal approach, proposing that Congress adopt legislation broadly preempting state AI laws deemed to impose "undue burdens."

This is unresolved litigation territory: the validity of targeted state laws will likely be determined through prolonged litigation that could reach the Supreme Court, testing the power of the executive and the strength of the Dormant Commerce Clause.

Voluntary federal baseline: Absent binding federal law, agencies lean on the NIST AI Risk Management Framework, which is a voluntary framework — there is no legal mandate requiring its adoption — but several factors make it a de facto standard for US organizations. Notably, the FTC, CFPB, FDA, SEC, and EEOC all reference NIST AI RMF principles in their enforcement guidance.

3. International/industry voluntary standards

ISO/IEC 42001 provides an auditable management-system standard: it is a certifiable international standard that establishes formal requirements for managing AI systems within an organization, complementary to NIST's flexible, principle-driven approach.

Frontier-lab self-governance fills gaps regulation hasn't reached: frontier AI labs also publish their own safety policies — Anthropic's Responsible Scaling Policy, OpenAI's Preparedness Framework, and Google DeepMind's Frontier Safety Framework all define what tests a model must pass before release. These voluntary commitments cover standards, laws, and voluntary commitments that govern how AI models are tested before release, covering risks like cyberattack capability, biological and chemical risk, autonomy, and large-scale misuse.

Bottom line

For a system like me, the operative rules today are a mix of: (1) binding EU law (with high-risk provisions delayed to 2027–2028), (2) a small number of binding US state laws like California's TFAIA focused on frontier-model transparency and incident reporting, (3) an active federal-vs-state legal fight over who gets to regulate AI in the US, and (4) voluntary frameworks (NIST AI RMF, ISO 42001) and company-specific safety policies that fill the gaps where hard law hasn't yet landed. Given the pace of litigation and EU delays, this picture is likely to shift again within months.