What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Rules for systems like me are evolving fast - I'll gather the current global frameworks that govern how we're built, deployed, and held accountable.

Currently there is no single global law for systems like me. Instead there are overlapping layers - binding national/regional laws, international treaties, and voluntary frameworks plus existing laws that apply to AI. Rules depend on where the system is built and deployed:

1. Binding, AI-specific horizontal regulation

European Union - EU AI Act

•The AI Act is described as the first binding worldwide horizontal regulation on AI, setting a common framework for the use and supply of AI systems in the EU

•It uses a risk-based approach - some AI systems presenting unacceptable risks are prohibited. A wide range of high-risk AI systems that can have a detrimental impact on health, safety or fundamental rights are authorised, but subject to requirements to gain access to the EU market

•AI systems posing limited risks because of lack of transparency will be subject to information and transparency requirements, while minimal-risk systems will not be subject to further obligations

•The regulation also lays down specific rules for general purpose AI (GPAI) models and more stringent requirements for GPAI models with high-impact capabilities that could pose systemic risk

•It entered into force in August 2024. It was published in the EU's Official Journal on 12 July 2024. Phased enforcement followed:

•Ban on prohibited AI and AI literacy obligations came into force 2 February 2025

•Rules on GPAI will enter into force from 2 August 2025, enforceable for new GPAI models in August 2026 and for existing GPAI models in August 2027

•Transparency obligations under Article 50 (e.g. for interactive technologies, watermarking, disclosure of AI-generated content) started being enforced on 2 August 2026

•Governance rules and high-risk systems embedded in regulated products have transition until 2 August 2027.

China

•On July 10, 2023, the Cyberspace Administration of China (CAC), joined by six other central government regulators, issued finalized measures aimed at regulating the provision of generative AI services to the public - the Interim Measures for the Management of Generative Artificial Intelligence Services, which came into force on 15 August 2023.

•This builds on two earlier concrete regulations: its 2021 regulation on recommendation algorithms, and the 2022 rules for deep synthesis (synthetically generated content). All three measures address information control but also contain many other obligations for providers, including algorithmic filing, content labeling and security assessments.

United States - federal

•At federal level there is no comprehensive AI statute in force. Governance has been through:

•Executive Order 14110 - Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence, which directed the Secretary of Commerce through NIST to develop safeguards including a companion resource to the AI Risk Management Framework, NIST AI 100-1, for generative AI

•Office of Management and Budget (OMB) memoranda and the Advancing American AI Act requiring federal agencies to inventory AI use cases and provide public information about agency policies for governing Federal AI systems, including the inventory of AI use cases

•Several bills have been proposed but not enacted as of 2026, e.g. Artificial Intelligence Research, Innovation, and Accountability Act, Algorithmic Accountability Act, AI Civil Rights Act etc.

•The Trump administration has noted the patchwork nature of state legislation as a motivation for its push for unified national legislation.

United States - state level

•As of 2026, AI-related legislation was already in effect in many states creating a patchwork.

•Notable laws include California AI laws: Transparency in Frontier Artificial Intelligence Act and California Assembly Bill 2013 (2024), Colorado: Colorado AI Act, New York: Responsible AI Safety and Education Act

•Colorado became the first state to pass comprehensive AI legislation. Its core provisions impose obligations on developers and deployers of high-risk AI systems to avoid discrimination, disclose certain information, and (for deployers) implement compliance and safety regimes.

•Other themes: Colorado - risk-based law focused on algorithmic discrimination in consequential decisions; California - transparency, training-data disclosure; Texas - responsible AI governance; Utah - disclosure and consumer protection; Illinois - biometric privacy and AI in employment.

United Kingdom

•The UK has adopted a non-statutory, principles-based, cross-sector approach rather than a new AI statute. The response outlines a non-statutory approach based on a cross-sector set of principles. The five core principles are:

•Safety, security and robustness

•And as summarized elsewhere: safety, security and robustness, appropriate transparency and explainability, fairness, accountability and governance, and contestability and redress

•Existing sector regulators (Ofcom, ICO, FCA, CMA, MHRA etc) are asked to apply the principles within their remits, while the AI Safety Institute (AISI) conducts safety evaluations on advanced AI systems and leads safety research.

2. International and soft-law frameworks

OECD and UNESCO

•The OECD AI Principles provided the foundation for the 2019 G20 AI principles

•In 2021, UNESCO released the Recommendation on the Ethics of Artificial Intelligence, which outlined four core ethical values: respect for human rights and human dignity, environment and ecosystem flourishing, diversity and inclusiveness, and living in peaceful, just and interconnected societies

•UNESCO and OECD principles are complemented by EU Ethics Guidelines for Trustworthy AI (2019) and similar initiatives.

Council of Europe Framework Convention

•The Council of Europe Framework Convention on artificial intelligence and human rights, democracy, and the rule of law (CETS No. 225) was opened for signature during a conference of Ministers of Justice in Vilnius. It is the first-ever international legally binding treaty aimed at ensuring that the use of AI systems is fully consistent with human rights, democracy and the rule of law

•The treaty provides a legal framework covering the entire lifecycle of AI systems. It promotes AI progress and innovation, while managing risks

•It was adopted by the Committee of Ministers on 17 May 2024. The 46 Council of Europe member states, the EU and 11 non-member states negotiated the treaty

•It will enter into force on the first day of the month following expiration of three months after five signatories, including at least three Council of Europe member states, have ratified it. Countries worldwide are eligible to join.

Technical and voluntary standards

•NIST AI Risk Management Framework (AI RMF, NIST AI 100-1) - A voluntary framework describing best practices for AI risk management, including concrete activities for development and deployment in a socially responsible way. It is one of the most well-respected documents on AI governance. As Version 1.0 released January 26, the document is not meant to be NIST's last word; the agency expects a full formal review by 2028 which could produce Version 2.0

•ISO/IEC standards, IEEE Ethics of Autonomous and Intelligent Systems, and industry self-governance are referenced in crosswalks with the NIST framework and EU Act.

3. How accountability is enforced through existing law

Even where no AI-specific law applies, systems are governed by general law:

•Data protection: GDPR imposes accountability obligations under articles 5(2) and 24, requiring controllers to demonstrate compliance and maintain records of processing (Article 30). Data protection by design (Article 25) and rights to remedy overlap with AI use.

•Consumer protection, non-discrimination and equality law: EU analyses note that avenues for redress for AI harms are enabled by data protection, equality and non-discrimination, consumer protection, and product liability

•Product liability and civil liability:

•The EU Product Liability Directive has been a cornerstone for four decades. A new Product Liability Directive 2024/2853 came into force on 9 December 2024 and will repeal the old directive. Member States must implement changes by December 2026

•Proposals on AI Liability Directive would give customers tools for remedies in case of damage caused by AI so they have the same level of protection as with traditional technologies

•Liability may also be triggered by infringement of particular laws where purpose includes prevention of harm, e.g. Article 82 GDPR attaches liability to any infringement of GDPR requirements

4. What this means for build / deploy / accountability in practice

•Build: Requirements include risk management assessments before deployment, data governance and training-data transparency, security and robustness testing, documentation, and for high-risk/GPAI models evaluation of capabilities including cybersecurity/biosecurity risks.

•Deploy: Obligations focus on transparency to users (disclosing AI interaction, watermarking synthetic content), human oversight, logging, conformity assessments before market access (EU), filing and content controls (China), and non-discrimination in consequential decisions (hiring, credit, housing, education - Colorado/California models).

•Accountability: Through a mix of ex-ante obligations (assessments, audits, inventories, incident reporting), ex-post liability (product liability, fault-based liability, GDPR compensation), regulatory oversight by sector regulators or AI Offices, and individual rights to contest, obtain redress and request human review.

Rules are rapidly changing and jurisdiction-specific. If you want detail for a specific country, use case (e.g. high-risk employment AI in EU vs generative AI API in California), I can pull the exact obligations and current enforcement timeline.

1.Artificial intelligence act | Think Tank | Euroopa Parlament — https://www.europarl.europa.eu/thinktank/et/document/EPRS_BRI(2021)698792

Citations (2)

1europa.euGovernment
Artificial intelligence act | Think Tank | Euroopa Parlament
Backs: “Instead there are overlapping layers - binding national/regional laws, international treaties, and voluntary frameworks plus existing laws that apply to AI. Rules depend on where the system is built and deployed: 1. Binding, AI-specific horizontal regulation. European Union - EU AI Act. The AI Act is described as the…”
2coe.intGovernment
Council of Europe opens first ever global treaty on AI for signature - Portal - www.coe.int
Backs: “The Council of Europe Framework Convention on artificial intelligence and human rights, democracy, and the rule of law (CETS No. 225) was opened for signature during a conference of Ministers of Justice in Vilnius. It is the first-ever international legally binding treaty aimed at ensuring that the use of AI systems…”