What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Short version: There isn’t one global “AI law.” Today’s rules are a patchwork of (a) new, AI‑specific statutes and executive actions, (b) existing sectoral laws (civil rights, consumer protection, privacy, product safety/liability), and (c) voluntary-but-influential standards. Here’s the current landscape as of September 17, 2026.

United States (federal)

•Executive branch policy shifted in 2025. Executive Order 14110 (Oct 30, 2023) was revoked on January 20, 2025 by Executive Order 14148; on December 11, 2025, Executive Order 14365 set a new national policy framework (e.g., directing agencies to accelerate adoption, review state AI laws for conflicts, and form an AI Litigation Task Force).[1]

•Civil-rights and consumer-protection laws already apply to AI: DOJ, FTC, CFPB, and EEOC jointly warned (Apr 25, 2023) they will enforce existing laws against discrimination, unfair/deceptive practices, etc., regardless of whether a system uses AI. EEOC’s 2024–2028 plan and technical materials explain how Title VII/ADA concepts apply to automated tools. CFPB guidance confirms adverse‑action notice duties still apply when lenders use complex algorithms.[2]

•Copyright and generative AI: the U.S. Copyright Office’s policy (effective Mar 16, 2023) requires disclosure of AI‑generated material and limits registration to human‑authored expression; its multi‑part AI study (2024–2025) addresses digital replicas, output copyrightability, and training data.[3]

United States (state and local)

•Colorado’s 2024 AI law (SB24‑205) is one of the first broad state statutes addressing “high‑risk” AI and algorithmic discrimination; implementation and rulemaking have been ongoing, with the start date pushed into 2026.[4]

•California: the privacy regulator finalized CCPA regulations that add risk assessments, annual cybersecurity audits, and consumer rights around Automated Decisionmaking Technology (ADMT); these rules took effect January 1, 2026. California also has a bot‑disclosure law (B&P §17941) requiring clear disclosure when bots are used to influence a purchase or a vote. Recent 2026 bills focused on AI/chatbot risks to children.[5]

•New York City Local Law 144 (in force since July 5, 2023) requires a bias audit and notices before employers use automated employment decision tools. Illinois’s AI Video Interview Act (since 2020) mandates disclosure/consent when AI analyzes applicant videos.[6]

European Union

•EU AI Act (Regulation 2024/1689): a risk‑based, horizontal law. Key dates: obligations for providers of general‑purpose AI models began August 2, 2025; transparency duties like deepfake/labelling and AI‑interaction disclosures apply from August 2, 2026; most “high‑risk” system rules phase in later (Dec 2, 2027 for standalone high‑risk; Aug 2, 2028 for high‑risk embedded in regulated products). The EU AI Office and national authorities can enforce and fine.[7]

•Product liability: the new Product Liability Directive explicitly covers software/AI as “products” and applies to items placed on the market after December 9, 2026, modernizing no‑fault liability across the EU.[8]

United Kingdom

•The UK uses a regulator‑led, “pro‑innovation” approach (no single AI act), with the AI Safety Institute publishing evaluation methods to support oversight by existing regulators.[9]

China

•Binding national rules govern public‑facing generative AI (effective Aug 15, 2023) and “deep synthesis” services (effective Jan 10, 2023), requiring security assessments, labeling of synthetic content, algorithm filing/record‑keeping, and cooperation with regulators.[10]

Canada

•Canada proposed the Artificial Intelligence and Data Act (AIDA) within Bill C‑27 in the last Parliament; its status has been fluid across the 2024–2025 session changes, so organizations track federal privacy/AI developments but often rely on sectoral laws and guidance pending final enactment.[11]

International frameworks (soft law)

•Council of Europe Framework Convention on AI (opened for signature Sept 5, 2024) is the first binding international treaty focused on AI and human rights, democracy, and rule of law; it sets high‑level duties that parties will implement nationally.[12]

•OECD AI Principles (2019; updated 2024) and the G7 Hiroshima Process (2023 guiding principles and code of conduct) shape many national policies and corporate programs.[13]

Standards and guidance used for “showing your work”

•NIST AI Risk Management Framework (AI RMF 1.0, 2023) and its Generative AI profile (2024) are widely used in the U.S. public and private sectors for risk governance, documentation, and assurance.[14]

•ISO/IEC 23894:2023 (AI risk management guidance) and ISO/IEC 42001:2023 (AI management systems) provide auditable structures that map well to regulatory expectations (e.g., EU AI Act quality/risk systems).[15]

What this means in practice

•Build: expectation of documented risk management, data governance, testing/validation, human oversight, and security controls (often via NIST/ISO). For certain jurisdictions you must label synthetic content or disclose AI interactions.[14]

•Deploy: sector rules bite (credit, employment, health, housing, consumer protection). Many places require notices, impact assessments, bias audits, or opt‑out rights for automated decisions.[2]

•Accountability: enforcement can come from privacy/data‑protection agencies, civil‑rights enforcers, consumer‑protection authorities, product‑safety regulators, and courts (product liability, unfair practices, discrimination, IP). Penalties and private liability now explicitly extend to software/AI in some regions.[8]

If you tell me the jurisdictions and use cases you care about (e.g., a U.S. health chatbot, an EU recruitment tool, or a content platform), I can map the exact obligations, effective dates, and the evidence you’ll need to demonstrate compliance.

Citations (15)

1federalregister.govGovernment
https://www.federalregister.gov/documents/full_text/html/2025/01/28/2025-01901.html
Backs: “Executive Order 14110 (Oct 30, 2023) was revoked on January 20, 2025 by Executive Order 14148; on December 11, 2025, Executive Order 14365 set a new national policy framework (e.g., directing agencies to accelerate adoption, review state AI laws for conflicts, and form an AI Litigation Task Force).”
2justice.govGovernment
Office of Public Affairs | Justice Department’s Civil Rights Division Joins Officials from CFPB, EEOC and FTC Pledging to Confront Bias and Discrimination in Artificial Intelligence | United States Department of Justice
Backs: “CFPB guidance confirms adverse‑action notice duties still apply when lenders use complex algorithms.”
3copyright.govGovernment
United States Copyright Office
Backs: “Copyright Office’s policy (effective Mar 16, 2023) requires disclosure of AI‑generated material and limits registration to human‑authored expression; its multi‑part AI study (2024–2025) addresses digital replicas, output copyrightability, and training data.”
4coag.govGovernment
Colorado Anti-Discrimination in AI Law (ADAI) Rulemaking | Colorado Attorney General
Backs: “Colorado’s 2024 AI law (SB24‑205) is one of the first broad state statutes addressing “high‑risk” AI and algorithmic discrimination; implementation and rulemaking have been ongoing, with the start date pushed into 2026.”
5ca.govGovernment
California Finalizes Regulations to Strengthen Consumers' Privacy
Backs: “California also has a bot‑disclosure law (B&P §17941) requiring clear disclosure when bots are used to influence a purchase or a vote. Recent 2026 bills focused on AI/chatbot risks to children.”
6nyc.govGovernment
Automated Employment Decision Tools (AEDT) - DCWP
Backs: “Illinois’s AI Video Interview Act (since 2020) mandates disclosure/consent when AI analyzes applicant videos.”
7europa.euGovernment
Guidelines on obligations for General-Purpose AI providers | Shaping Europe’s digital future
Backs: “The EU AI Office and national authorities can enforce and fine.”
8europa.euGovernment
Directive - 2024/2853 - EN - Product Liability Directive - EUR-Lex
Backs: “Product liability: the new Product Liability Directive explicitly covers software/AI as “products” and applies to items placed on the market after December 9, 2026, modernizing no‑fault liability across the EU.”
9gov.ukGovernment
AI Safety Institute: overview - GOV.UK
Backs: “The UK uses a regulator‑led, “pro‑innovation” approach (no single AI act), with the AI Safety Institute publishing evaluation methods to support oversight by existing regulators.”
10cac.gov.cnGovernment
生成式人工智能服务管理暂行办法_中央网络安全和信息化委员会办公室
Backs: “Binding national rules govern public‑facing generative AI (effective Aug 15, 2023) and “deep synthesis” services (effective Jan 10, 2023), requiring security assessments, labeling of synthetic content, algorithm filing/record‑keeping, and cooperation with regulators.”
11parl.caNot yet classified
C-27 (44-1) - LEGISinfo - Parliament of Canada
Backs: “Canada proposed the Artificial Intelligence and Data Act (AIDA) within Bill C‑27 in the last Parliament; its status has been fluid across the 2024–2025 session changes, so organizations track federal privacy/AI developments but often rely on sectoral laws and guidance pending final enactment.”
12coe.intGovernment
The Framework Convention on Artificial Intelligence - Artificial Intelligence
Backs: “Council of Europe Framework Convention on AI (opened for signature Sept 5, 2024) is the first binding international treaty focused on AI and human rights, democracy, and rule of law; it sets high‑level duties that parties will implement nationally.”
13oecd.orgGovernment
AI principles | OECD
Backs: “OECD AI Principles (2019; updated 2024) and the G7 Hiroshima Process (2023 guiding principles and code of conduct) shape many national policies and corporate programs.”
14nist.govGovernment
Artificial Intelligence Risk Management Framework (AI RMF 1.0) | NIST
Backs: “NIST AI Risk Management Framework (AI RMF 1.0, 2023) and its Generative AI profile (2024) are widely used in the U.S. public and private sectors for risk governance, documentation, and assurance.”
15iso.orgNonprofits and think tanks
ISO/IEC 23894:2023 - AI — Guidance on risk management
Backs: “ISO/IEC 23894:2023 (AI risk management guidance) and ISO/IEC 42001:2023 (AI management systems) provide auditable structures that map well to regulatory expectations (e.g., EU AI Act quality/risk systems).”