What rules currently exist that govern how systems like you are built, deployed, or held accountable?
Here’s the short version of what’s in force (or about to be) as of September 16, 2026, that governs how AI systems are built, deployed, and held accountable.
Global/soft-law baselines and standards
European Union (binding)
United States (federal)
United States (state and local)
United Kingdom
China
Canada and Brazil (in motion)
What these rules mean in practice
If you tell me your jurisdiction(s) and use case (e.g., a public chatbot, hiring tool, medical software, or foundation model), I can map the exact obligations and deadlines that apply and draft a short compliance checklist.
Citations (23)
- AI principles | OECD
Backs: “OECD AI Principles (values-based and policy recommendations), adopted 2019 and updated in May 2024 to address general‑purpose and generative AI. Governments often map national measures to these.”
- ISO/IEC 42001:2023 - AI management systems
Backs: “ISO/IEC 23894:2023 (AI risk management) – companion guidance on AI‑specific risk processes.”
- Committee on Artificial Intelligence (CAI) - Artificial Intelligence
Backs: “Council of Europe Framework Convention on AI (human rights, democracy, rule of law): adopted May 17, 2024; opened for signature Sept 5, 2024; enters into force after five ratifications (status: not yet in force; EU approved conclusion in 2026).”
- General Assembly Adopts Landmark Resolution on Steering Artificial Intelligence towards Global Good, Faster Realization of Sustainable Development | Meetings Coverage and Press Releases
Backs: “UN General Assembly resolution on safe, secure, trustworthy AI for sustainable development (non‑binding), adopted March 21, 2024.”
- AI Act enters into force - European Commission
Backs: “Enforcement is led by the AI Office (requests for information/evaluations/fines), with GPAI codes of practice used to operationalize duties in year one.”
- EUR-Lex - 52024XC03014 - DE - EUR-Lex
Backs: “Very Large Online Platforms/Search Engines must assess and mitigate systemic risks, including those from generative‑AI content (labelling/controls around deepfakes, elections, etc.); the Commission has already compelled Microsoft for information on Bing’s generative‑AI risks.”
- Liability for defective products - Internal Market, Industry, Entrepreneurship and SMEs
Backs: “The separate “AI Liability Directive” proposal was withdrawn in 2025.”
- Understanding the standardisation of the AI Act | Shaping Europe’s digital future
Backs: “Standards to support presumption of conformity under the AI Act are being developed (CEN/CENELEC JTC 21), with first waves expected/published during 2026; these will matter for high‑risk compliance and, to some extent, GPAI.”
- Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence | 88 FR 75191
Backs: “OMB’s AI acquisition memo (M‑24‑18, Oct 2024) extends these controls into federal procurement.”
- AI Risk Management Framework | NIST
Backs: “NIST AI Risk Management Framework (AI RMF 1.0) and Generative‑AI Profile (July 26, 2024) guide builders and are referenced by agencies and industry; the AI Safety Institute/consortium at NIST advances evaluation/red‑teaming guidance.”
- Framework for Artificial Intelligence Diffusion, 4544-4584 [2025-00636] :: Department Of Commerce :: Regulation Tracker :: Justia
Backs: “Commerce/BIS export controls: an interim final rule on Jan 15, 2025 added controls on model weights for the most advanced closed‑weight AI models (not open‑weight) alongside chip controls; analysis in 2026 noted those model‑weights controls were not being actively enforced at that time.”
- Approaches to Address AI-enabled Voice Cloning | Federal Trade Commission
Backs: “EEOC pursues discrimination tied to automated hiring/screening.”
- California Finalizes Regulations to Strengthen Consumers' Privacy
Backs: “California privacy regulator (CPPA) finalized rules on Automated Decision‑Making Technology (ADMT) with consumer opt‑out/notice and “meaningful information” about logic; rules took effect Jan 1, 2026, with certain “significant decision” compliance deadlines on/after Jan 1, 2027.”
- SB26-189 Automated Decision-Making Technology | Colorado General Assembly
Backs: “HB26‑1263 (“Conversational AI Service Operator Requirements”/“Chatbot Safety Act”) – kid‑safety, disclosure, and crisis‑response protocols; effective Jan 1, 2027. Rulemaking is underway.”
- Automated Employment Decision Tools (AEDT) - DCWP
Backs: “AEDTs used in hiring/promotion require an annual independent bias audit, public posting, and candidate notices.”
- Utah Legislature SB0149
Backs: “Utah SB 149 (Artificial Intelligence Policy Act) and 2025 amendments: disclosure when consumers interact with AI in covered settings and for regulated occupations; Utah created an AI Office and related rules.”
- New California laws aim to protect kids from social media harms | AP News
Backs: “California (additional 2026 tech‑safety package): new laws aimed at protecting minors from social‑media and AI‑chatbot risks, plus groundwork for independent AI model safety evaluations/auditor registry.”
- Implementing the UK’s AI regulatory principles: initial guidance for regulators - GOV.UK
Backs: “UK AI Safety/Security Institute (AISI) conducts evaluations and collaborates with the U.S. via an April 1, 2024 MoU.”
- Translation: Internet Information Service Algorithmic Recommendation Management Provisions – Effective March 1, 2022
Backs: “Interim Measures for Generative AI Services (effective Aug 15, 2023) – security assessments/filings for certain public‑facing gen‑AI, data/privacy duties.”
- C-27 (44-1) - LEGISinfo - Parliament of Canada
Backs: “Canada: the federal AI bill (AIDA within Bill C‑27) did not become law before Parliament’s 2025 reset; the government tabled new privacy legislation (Bill C‑36) on June 15, 2026, but no federal AI‑specific statute is in force yet.”
- Marco da Inteligência Artificial é aprovado em Plenário e vai à Câmara — Senado Notícias
Backs: “Brazil: the Senate‑approved AI bill (PL 2338/2023) advanced to the Chamber in Dec 2024 and remains under consideration in 2026 (not yet enacted).”
- When does enforcement start? | AI Act Service Desk
Backs: “Deployment time: transparency to users (labels for AI‑generated content; chatbots disclosures), human‑in‑the‑loop and logging for high‑risk uses (EU), notice/opt‑out for automated decisions (CA CPPA rules), and bias audits in hiring (NYC).”
- The enforcement framework of the AI Act | Shaping Europe’s digital future
Backs: “Accountability: enforcement can come via AI‑specific regimes (EU AI Act/AI Office), platform rules (DSA), product liability (EU 2024/2853), data‑protection authorities (EU/UK), consumer protection and civil rights agencies (FTC, CFPB, EEOC in the U.S.), and state attorneys general.”