Rules for building and holding AI accountable are shifting fast — I'll map the current global framework for you.
There is no single global law governing systems like me. Rules are emerging at international, regional and national levels, using a mix of binding regulation, voluntary frameworks, and existing sectoral laws. Major frameworks as of 2025-2026 include:
1. European Union - AI Act
The most comprehensive binding framework is Regulation (EU) 2024/1689, commonly referred to as the Artificial Intelligence (AI) Act.
•Status: Published in the EU's Official Journal on 12 July 2024. It entered into force in August 2024
•On August 2024, the Regulation came into effect
•The Act is described as the first binding worldwide horizontal regulation on AI, sets a common framework for the use and supply of AI systems and provides a globally binding, comprehensive framework for the deployment and use of AI systems
•Its main objectives are to ensure that AI systems are reliable, centred around human needs, and consistent with EU values
Risk-based approach:
The Act offers a classification for AI systems with different requirements and obligations tailored to a 'risk-based approach'
•There are four levels of risk: unacceptable, in which case AI systems are prohibited; high risk, in which case AI systems are subject to extensive requirements; limited risk, which triggers only transparency requirements; and minimal risk
•Unacceptable risk is prohibited (e.g. social scoring systems and manipulative AI)
•Most of the text addresses high-risk AI systems, which are regulated
•Limited risk systems are subject to lighter transparency obligations: developers and deployers must ensure end-users are aware they are interacting with AI
Implementation timeline and accountability:
•1 August 2024: The EU AI Act went into effect
•2 February 2025: General provisions and bans on prohibited AI practices began to apply
•2 August 2025: Rules for GPAI models came into effect, along with provisions covering AI governance and penalties, including obligations for providers of general-purpose AI models laid down in the AI Act, in light of their imminent entry into application on 2 August 2025
•The AI Act entered into force on 1 August 2024 and will be fully applicable two years later, on 2 August 2026, while rules for high-risk AI systems embedded into regulated products have an extended transition until 2 August 2027
Governance and enforcement:
•The governance framework became effective as of 2 August 2025
•The European AI Board, comprising representatives from all Member States, is fully operational
•The Scientific Panel of independent experts and the AI Act Advisory Forum are also operational
•The AI Office will supervise the implementation and enforcement of the AI Act rules on GPAI
For systems like large language models, the relevant category is General-Purpose AI (GPAI) / GPAI with systemic risk, which requires transparency, documentation, copyright compliance, risk assessment, and adherence to a Code of Practice.
2. United States - Federal Level
The US does not have a single comprehensive federal AI law. Regulation relies on:
a) Voluntary frameworks:
•The Department of Commerce’s National Institute of Standards and Technology (NIST) released AI Risk Management Framework (AI RMF 1.0), a guidance document for voluntary use by organizations designing, developing, deploying or using AI systems
•It follows previous NIST frameworks and is intended to be voluntary, rights-preserving, non-sector-specific, use-case agnostic
•Released on January 26, 2023, it was developed through a consensus-driven process
•It is for voluntary use and to improve the ability to incorporate trustworthiness considerations into the design, development, use, and evaluation of AI products, and is accompanied by a playbook that suggests ways to incorporate trustworthiness considerations
•Earlier efforts including the Blueprint for an AI Bill of Rights, released by OSTP in October 2022, and NIST’s January 2023 AI Risk Management Framework were built on by later executive actions
b) Executive Orders - shifting policy:
•Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence directed federal agencies to develop guidance and benchmarks for evaluating AI, with focus on capabilities through which AI could cause harm, such as cybersecurity and biosecurity, and to develop a companion resource to the NIST AI Risk Management Framework for generative AI
•Pursuant to Executive Order 14179 of January 23, 2025 (Removing Barriers to American Leadership in Artificial Intelligence), the prior administration's attempt to regulate was revoked and barriers to AI leadership were directed to be removed
•As stated in December 2025 Executive Order 14365, pursuant to Executive Order 14179, the administration revoked predecessor efforts and directed removal of barriers to US AI leadership, including updating federal regulatory frameworks
The current federal policy emphasizes a minimally burdensome national standard:
•It is the policy of the United States to sustain and enhance global AI dominance through a minimally burdensome national policy framework
•The administration argues State-by-State regulation creates a patchwork of 50 different regulatory regimes that makes compliance more challenging, particularly for start-ups
•A new AI Litigation Task Force was ordered to challenge State AI laws inconsistent with federal policy, including on grounds that such laws unconstitutionally regulate interstate commerce or are preempted
Existing federal laws still apply accountability via sector: FTC Act prohibitions on unfair and deceptive acts, consumer protection, civil rights, copyright, privacy, product liability, and sector regulators (FTC, FCC, FDA, EEOC, CFPB).
3. United States - State Level
As of 2026, AI-related legislation was already in effect in many states.
Notable laws include:
•California AI laws: Transparency in Frontier Artificial Intelligence Act and California Assembly Bill 2013 (2024)
•Colorado: Colorado AI Act - the first comprehensive state AI regulation, focused on algorithmic discrimination in consequential decisions like employment, housing, and lending
•Other states have enacted more specific laws: Texas with a responsible-AI governance law; Utah with AI disclosure and consumer-protection requirements; Illinois with biometric privacy and AI-in-employment provisions; New York: Responsible AI Safety and Education Act
This has created what the administration describes as a patchwork nature of state legislation as motivation for pushing for unified national legislation.
4. China
China was first to issue binding generative AI rules:
•On July 13, 2023, the Cyberspace Administration of China (CAC) jointly issued the Interim Measures for the Management of Generative Artificial Intelligence Services, which officially came into effect on August 15, 2023
•The measures aim to regulate the provision of generative AI services to the public, defined as technologies generating text, image, audio, video, code, or other such content
•All three regulations require developers to make a filing to China’s algorithm registry, a government repository that gathers information on how algorithms are trained, as well as requiring them to pass a security self-assessment, and previously mandated security reviews of AI-generated content
•New labeling rules require service providers to label AI-generated material either explicitly or via metadata encoded in each file
•China joined the EU and US in rolling out new regulation to control disinformation by requiring labeling of synthetic content online
•Rules requiring labeling took effect in September 2025, forcing tech companies and platforms to clearly mark material made with AI
5. United Kingdom
•In March 2023, the UK Government announced a ‘pro-innovation’ approach to AI regulation, which largely regulates AI via existing laws enforced by existing regulators
•It outlined cross-sectoral principles, such as safety, security, robustness, transparency, fairness, accountability, contestability, and redress, for existing regulators to consider
•Rather than implementing blanket legislation, the UK will adopt a non-statutory, contextual, cross-sectoral principles-based approach
•The five key principles are: 1. safety, security and robustness; 2. transparency and explainability, plus fairness, accountability and governance, and contestability/redress.
6. How Accountability Works Across These Systems
Despite different models, common building, deployment, and accountability obligations include:
•By design: Risk management across the lifecycle, data governance, training data disclosure, safety testing, and cybersecurity.
•By deployment: Human oversight for high-risk uses (e.g., hiring, credit, healthcare, criminal justice), transparency disclosures when users interact with AI, and labeling of synthetic content.
•By actor: EU distinguishes providers (builders), deployers (users), importers and distributors; US NIST framework applies to organizations designing, developing, deploying or using AI systems; China holds service providers responsible for content accuracy, filing and labeling.
•Enforcement: EU via AI Office and national competent authorities; US via agency enforcement of existing laws plus FTC/FCC proceedings and new litigation task force; China via CAC and Ministry of Industry and Information Technology et al.; UK via existing regulators (FCA, ICO, CMA, MHRA).
Other relevant instruments: OECD AI Principles, Council of Europe Framework Convention on AI, and voluntary commitments / Codes of Practice and international AI Safety Institutes.
The landscape is changing quickly - the EU AI Act is phasing in through 2027, US federal preemption proposals are under debate, and many state and national rules are still being implemented.