More answers like this
GPT-5Sep 18, 2026openai/gpt-5-2025-08-07

What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Here’s the short, current snapshot (as of September 18, 2026). The rules are a patchwork of binding laws, public‑sector policies, liability and data‑protection rules, plus voluntary standards and industry pledges.

European Union

•EU Artificial Intelligence Act: in force since August 1, 2024 with phased application through 2028; bans on certain practices arrive first, followed by obligations for “high‑risk” AI and general‑purpose models. Official text and timeline are published by the EU.[1]
•EU Product Liability Directive (2024/2853): updates strict‑liability rules to expressly cover software and AI systems; Member States have two years from late 2024 to transpose.[2]
•Related frameworks affecting AI use: GDPR rights (including limits on solely automated decisions) and the Digital Services Act’s transparency/risk‑mitigation duties for large platforms and their recommender systems.[3]

United States

•Federal executive policy and guidance (no comprehensive federal AI statute yet):
•Executive Order 14110 (Oct 30, 2023) directs a government‑wide approach to safe, secure AI and tasks NIST with standards and testing work.[4]
•OMB M‑24‑10 (Mar 2024) requires every federal agency to inventory, govern, and risk‑manage “rights‑ or safety‑impacting” AI, with documented impact assessments; agencies have published compliance plans.[5]
•NIST AI Risk Management Framework (AI RMF 1.0, 2023) and a Generative AI Profile (July 2024) are the key voluntary, government‑endorsed playbooks.[6]
•State and local laws:
•Colorado AI Act (SB24‑205): effective February 1, 2026; imposes duties on developers and deployers of “high‑risk” AI (risk management, impact assessments, disclosures) and authorizes AG enforcement.[7]
•NYC Local Law 144 (AEDT): requires annual independent bias audits and notices before using automated hiring tools.[8]
•Dozens of states have enacted election “deepfake” or AI‑disclosure rules for political content; the National Conference of State Legislatures tracks these measures.[9]

United Kingdom

•The UK has not enacted a horizontal AI law; instead it uses a “pro‑innovation,” regulator‑led approach. Government set out principles in a 2023 white paper and a February 2024 response, plus guidance to regulators on implementation.[10]

Canada

•Public‑sector rule: the Treasury Board’s Directive on Automated Decision‑Making (in effect since 2019; updated 2023) mandates Algorithmic Impact Assessments and transparency for federal automated systems, with updated compliance timelines through 2026.[11]
•Proposed federal AI law (AIDA within Bill C‑27) did not receive Royal Assent; Canada continues to rely on sectoral laws and the public‑sector directive.[12]

China

•Binding national rules govern public‑facing generative AI and deep‑synthesis tools: the Generative AI Measures (effective Aug 15, 2023) and the Deep Synthesis Provisions (effective Jan 10, 2023) require, among other things, security assessments, content controls, and labeling.[13]

Council of Europe

•Framework Convention on AI, Human Rights, Democracy and the Rule of Law: the first binding international AI treaty, opened for signature on September 5, 2024; it will bind only those states that sign and ratify.[14]

International principles and voluntary commitments

•OECD AI Principles (2019; updated materials in 2024): widely adopted, high‑level principles for trustworthy AI.[15]
•G7 Hiroshima AI Process (Oct 2023): non‑binding international guiding principles and a code of conduct for organizations developing advanced AI.[16]
•UN General Assembly (Mar 2024): first AI resolution urging safe, secure, trustworthy AI for sustainable development.[17]

Technical standards you’ll see referenced in laws, contracts, and audits

•ISO/IEC 42001: AI Management System (certifiable governance standard).[18]
•ISO/IEC 23894: AI risk‑management guidance (pairs with ISO 31000 and often mapped to the EU AI Act and NIST AI RMF).[19]
•NIST AI RMF 1.0 and the NIST Generative AI Profile (voluntary but increasingly used as de‑facto benchmarks).[6]

What these rules mean in practice

•Build: Expect documented risk management, data‑governance controls, security testing (including “red‑teaming” for some contexts), and traceability. EU providers of high‑risk systems will need a full risk‑management system and technical documentation; ISO 42001/23894 can operationalize this.[20]
•Deploy: Impact/risk assessments and notices are becoming common (mandatory for many public‑sector uses in Canada; required for “high‑risk” AI in Colorado from Feb 2026; and for EU high‑risk systems as those provisions phase in).[11]
•Accountability: Remedies and enforcement flow through multiple channels—consumer protection and anti‑discrimination laws (U.S.), GDPR and DSA duties (EU), AI‑specific supervisory and market‑surveillance powers (EU AI Act), and sector regulators. Product‑liability exposure in the EU now explicitly includes software/AI.[21]

If you tell me the jurisdictions and sectors you care about (e.g., HR tech in the U.S., medical AI in the EU, or foundation models offered globally), I can translate this into a concrete obligation checklist and a rollout timeline.

Citations (21)

  1. 1europa.euGovernment
    AI Act enters into force - European Commission

    Backs: “EU Artificial Intelligence Act: in force since August 1, 2024 with phased application through 2028; bans on certain practices arrive first, followed by obligations for “high‑risk” AI and general‑purpose models. Official text and timeline are published by the EU.”

  2. 2europa.euGovernment
    Directive (EU) 2024/2853 of the European Parliament and of the Council of 23 October 2024 on liability for defective products and repealing Council Directive 85/374/EEC (Text with EEA relevance)

    Backs: “EU Product Liability Directive (2024/2853): updates strict‑liability rules to expressly cover software and AI systems; Member States have two years from late 2024 to transpose.”

  3. 3europa.euGovernment
    Automated decision-making and profiling | European Data Protection Board

    Backs: “GDPR rights (including limits on solely automated decisions) and the Digital Services Act’s transparency/risk‑mitigation duties for large platforms and their recommender systems.”

  4. 4govinfo.govGovernment
    Executive Orders  EO 14110

    Backs: “Executive Order 14110 (Oct 30, 2023) directs a government‑wide approach to safe, secure AI and tasks NIST with standards and testing work.”

  5. 5whitehouse.govGovernment
    EXECUTIVE OFFICE OF THE PRESIDENT

    Backs: “OMB M‑24‑10 (Mar 2024) requires every federal agency to inventory, govern, and risk‑manage “rights‑ or safety‑impacting” AI, with documented impact assessments; agencies have published compliance plans.”

  6. 6nist.govGovernment
    Artificial Intelligence Risk Management Framework (AI RMF 1.0) | NIST

    Backs: “NIST AI Risk Management Framework (AI RMF 1.0, 2023) and a Generative AI Profile (July 2024) are the key voluntary, government‑endorsed playbooks.”

  7. 7colorado.govGovernment
    SB24-205 Consumer Protections for Artificial Intelligence | Colorado General Assembly

    Backs: “Colorado AI Act (SB24‑205): effective February 1, 2026; imposes duties on developers and deployers of “high‑risk” AI (risk management, impact assessments, disclosures) and authorizes AG enforcement.”

  8. 8nyc.govGovernment
    Automated Employment Decision Tools (AEDT) - DCWP

    Backs: “NYC Local Law 144 (AEDT): requires annual independent bias audits and notices before using automated hiring tools.”

  9. 9ncsl.orgNonprofits and think tanks
    Artificial Intelligence (AI) in Elections and Campaigns

    Backs: “Dozens of states have enacted election “deepfake” or AI‑disclosure rules for political content; the National Conference of State Legislatures tracks these measures.”

  10. 10gov.ukGovernment
    A pro-innovation approach to AI regulation - GOV.UK

    Backs: “Government set out principles in a 2023 white paper and a February 2024 response, plus guidance to regulators on implementation.”

  11. 11canada.caGovernment
    Directive on Automated Decision-Making- Canada.ca

    Backs: “Public‑sector rule: the Treasury Board’s Directive on Automated Decision‑Making (in effect since 2019; updated 2023) mandates Algorithmic Impact Assessments and transparency for federal automated systems, with updated compliance timelines through 2026.”

  12. 12sencanada.caNot yet classified
    Treasury Board of Canada Secretariat / Secrétariat du Conseil du Trésor du Canada

    Backs: “Canada continues to rely on sectoral laws and the public‑sector directive.”

  13. 13cac.gov.cnGovernment
    生成式人工智能服务管理暂行办法_中央网络安全和信息化委员会办公室

    Backs: “Binding national rules govern public‑facing generative AI and deep‑synthesis tools: the Generative AI Measures (effective Aug 15, 2023) and the Deep Synthesis Provisions (effective Jan 10, 2023) require, among other things, security assessments, content controls, and labeling.”

  14. 14coe.intGovernment
    The Framework Convention on Artificial Intelligence - Artificial Intelligence

    Backs: “Framework Convention on AI, Human Rights, Democracy and the Rule of Law: the first binding international AI treaty, opened for signature on September 5, 2024; it will bind only those states that sign and ratify.”

  15. 15oecd.orgGovernment
    AI principles | OECD

    Backs: “OECD AI Principles (2019; updated materials in 2024): widely adopted, high‑level principles for trustworthy AI.”

  16. 16mofa.go.jpGovernment
    G7 Leaders' Statement on the Hiroshima AI Process | Ministry of Foreign Affairs of Japan

    Backs: “G7 Hiroshima AI Process (Oct 2023): non‑binding international guiding principles and a code of conduct for organizations developing advanced AI.”

  17. 17un.orgGovernment
    General Assembly Adopts Landmark Resolution on Steering Artificial Intelligence towards Global Good, Faster Realization of Sustainable Development | Meetings Coverage and Press Releases

    Backs: “UN General Assembly (Mar 2024): first AI resolution urging safe, secure, trustworthy AI for sustainable development.”

  18. 18iso.orgNonprofits and think tanks
    ISO/IEC 42001:2023 - AI management systems

    Backs: “ISO/IEC 42001: AI Management System (certifiable governance standard).”

  19. 19iec.chNot yet classified
    ISO/IEC 23894:2023 | IEC

    Backs: “AI risk‑management guidance (pairs with ISO 31000 and often mapped to the EU AI Act and NIST AI RMF).”

  20. 20europa.euGovernment
    Regulation - EU - 2024/1689 - FR - EUR-Lex

    Backs: “EU providers of high‑risk systems will need a full risk‑management system and technical documentation; ISO 42001/23894 can operationalize this.”

  21. 21europa.euGovernment
    Digital Services Act: Questions and Answers | Shaping Europe’s digital future

    Backs: “Product‑liability exposure in the EU now explicitly includes software/AI.”