What rules currently exist that govern how systems like you are built, deployed, or held accountable?

The rules governing how systems like large language models are built, deployed, and held accountable have transitioned from voluntary guidelines into a legally binding patchwork of international, national, and state laws.

These regulations are structured around ensuring safety, preventing algorithmic bias, protecting intellectual property, and guaranteeing user transparency.

1. The European Union: The EU AI Act (The Global Benchmark)

The EU AI Act is the world’s first comprehensive, risk-tiered AI law. It classifies AI systems based on their potential for harm and enforces compliance in staggered phases:

•General-Purpose AI (GPAI) Rules (In effect since August 2025): Large models (such as those powering conversational AIs) must comply with transparency requirements. This includes disclosing technical documentation, complying with EU copyright law, and providing detailed summaries of the data used for training.

•Systemic Risk Models: The most capable frontier models are subject to stricter requirements, including model evaluations, adversarial testing (red-teaming), tracking energy consumption, and reporting cybersecurity incidents to the EU AI Office.

•General Application & Transparency (In effect since August 2026): Basic transparency requirements now require systems to clearly disclose when a user is interacting with an AI (unless it is obvious). Additionally, synthetic or AI-generated media must be watermarked or labeled.

•Prohibited Practices: Applications that pose "unacceptable risks"—such as untargeted scraping of facial images from the internet, emotion recognition in workplaces, or social scoring systems—are banned.

2. United States: State-Level Rules

Because there is no single, comprehensive federal AI statute in the U.S., states have stepped in to pass their own pioneering laws, creating a complex compliance landscape:

•California:

•The Artificial Intelligence Training Data Transparency Act (AB 2013) requires developers to post public summaries of the datasets used to train models.

•The Transparency in Frontier AI Act (SB 53) forces developers of frontier models to publish risk frameworks, establish whistleblower protections, and report safety incidents.

•The California AI Transparency Act mandates that AI providers watermark and label AI-generated content.

•Illinois: The Artificial Intelligence Safety Measures Act requires frontier AI developers to establish catastrophic-risk management safety frameworks, assess potential extreme risks, and report critical safety incidents.

•Colorado: The Colorado AI Act (repealed and replaced by SB 26-189) requires developers and deployers of AI systems to exercise reasonable care to prevent algorithmic discrimination, particularly when AI is used to make decisions regarding employment, housing, insurance, or education.

•Chatbot-Specific Laws: Dozens of states require conversational AIs to actively state that they are bots. In addition, many of these laws forbid chatbots from impersonating licensed professionals (like therapists) and mandate strict safety filters to protect minors from harmful or manipulative conversations.

3. United States: Federal Action and Agency Enforcement

While Congress has mostly passed targeted, sector-specific laws (such as the TAKE IT DOWN Act, which criminalizes the creation of non-consensual AI deepfakes), the executive branch and federal agencies drive U.S. policy:

•Executive Orders: Executive Order 14409 (Promoting Advanced AI Innovation and Security) established a voluntary 30-day pre-release review where developers can grant the federal government early access to frontier models before releasing them to the public. It also created "Gold Eagle," a federal cybersecurity clearinghouse to scan software for vulnerabilities using advanced AI.

•FTC (Federal Trade Commission): The FTC actively prosecutes companies for "AI washing" (making deceptive claims about what their AI can do), deploying biased algorithms, and creating AI-generated fake consumer reviews.

•EEOC (Equal Employment Opportunity Commission): The EEOC enforces strict liability against employers who use automated hiring tools that result in algorithmic discrimination against protected classes.

4. China: Content Management and Synthetic Control

China relies on targeted regulations that prioritize content alignment, national security, and explicit labeling:

•Generative AI Services Measures: Providers must register their algorithms with the government, ensure that training data is legally sourced, and prevent the generation of content that is false, discriminatory, or violates state security.

•Labelling AI-Generated and Synthetic Content: Regulations mandate that all AI-generated content (including images, text, and audio) must carry clear digital watermarks and labels, making it impossible for platforms to host unlabeled synthetic media.

5. Technical Standards and Industry Frameworks

Beyond strict legal penalties, developers rely on standardized technical frameworks to show compliance and build trust:

•NIST AI Risk Management Framework (RMF): A widely adopted framework in the U.S. that maps, measures, and manages the risks associated with building and deploying AI.

•ISO/IEC 42001: The international standard for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System (AIMS) within an organization. It is used as a foundation for auditing companies' AI safety and security procedures.

Citations (11)

1gunder.comLow provenance
gunder.com
Backs: “The rules governing how systems like large language models are built, deployed, and held accountable have transitioned from voluntary guidelines into a legally binding patchwork of international, national, and state laws.”
2collibra.comCompanies
collibra.com
Backs: “The rules governing how systems like large language models are built, deployed, and held accountable have transitioned from voluntary guidelines into a legally binding patchwork of international, national, and state laws.”
3europa.euGovernment
europa.eu
Backs: “These regulations are structured around ensuring safety, preventing algorithmic bias, protecting intellectual property, and guaranteeing user transparency.”
4drata.comCompanies
drata.com
Backs: “These regulations are structured around ensuring safety, preventing algorithmic bias, protecting intellectual property, and guaranteeing user transparency.”
5alicelabs.aiCompanies
alicelabs.ai
Backs: “The European Union: The EU AI Act (The Global Benchmark). The EU AI Act is the world’s first comprehensive, risk-tiered AI law. It classifies AI systems based on their potential for harm and enforces compliance in staggered phases:”
6europa.euGovernment
europa.eu
Backs: “It classifies AI systems based on their potential for harm and enforces compliance in staggered phases: General-Purpose AI (GPAI) Rules (In effect since August 2025): Large models (such as those powering conversational AIs) must comply with transparency requirements. This includes disclosing technical documentation,…”
7dataguard.comNot yet classified
dataguard.com
Backs: “This includes disclosing technical documentation, complying with EU copyright law, and providing detailed summaries of the data used for training. Systemic Risk Models: The most capable frontier models are subject to stricter requirements, including model evaluations, adversarial testing (red-teaming), tracking energy…”
8hinshawlaw.comCompanies
hinshawlaw.com
Backs: “General Application & Transparency (In effect since August 2026): Basic transparency requirements now require systems to clearly disclose when a user is interacting with an AI (unless it is obvious). Additionally, synthetic or AI-generated media must be watermarked or labeled.”
9verifywise.aiCompanies
verifywise.ai
Backs: “United States: State-Level Rules. Because there is no single, comprehensive federal AI statute in the U.S., states have stepped in to pass their own pioneering laws, creating a complex compliance landscape: California:”
10wikipedia.orgEncyclopedias and referencequality 0.83
wikipedia.org
Backs: “United States: State-Level Rules. Because there is no single, comprehensive federal AI statute in the U.S., states have stepped in to pass their own pioneering laws, creating a complex compliance landscape: California: The Artificial Intelligence Training Data Transparency Act (AB 2013) requires developers to post…”
11mindfoundry.aiCompanies
mindfoundry.ai
Backs: “Colorado: The Colorado AI Act (repealed and replaced by SB 26-189) requires developers and deployers of AI systems to exercise reasonable care to prevent algorithmic discrimination, particularly when AI is used to make decisions regarding employment, housing, insurance, or education. Chatbot-Specific Laws: Dozens of…”