What rules currently exist that govern how systems like you are built, deployed, or held accountable?
Short answer: There’s no single global “AI law.” Instead, systems like me are governed by a stack of rules that depend on who is building or deploying the system, where it’s offered, and what it’s used for. Here’s the current (as of September 19, 2026) picture most U.S. organizations run into.
United States — federal (no comprehensive AI statute)
United States — state and local (key, enforceable obligations)
European Union (applies if you provide/deploy in the EU, or sell into EU supply chains)
United Kingdom
China
International principles and treaties (soft law and coordination that often shape procurement and audits)
What this means in practice if you build or deploy AI in 2026
If you want, tell me your industry and where you operate. I can translate this into a concise, jurisdiction‑by‑jurisdiction compliance checklist with the exact dates and artifacts you’ll need.
Citations (18)
- iii. **Compliance Plans.** Consistent with Section 104(c) and (d) of the AI in Government Act of 2020, within 180 days of the issuance of this memorandum or any update to this memorandum, and every two years thereafter until 2036, each agency must submit to OMB and post publicly on the agency’s website either a plan to achieve consistency with this memorandum, or a written determination that the agency does not use and does not anticipate using covered AI. Agencies must also include plans to update any existing internal AI principles and guidelines to ensure consistency with this memorandum.¹¹ OMB will provide templates for these compliance plans.
Backs: “These requirements stand on statutory authority (AI in Government Act; Advancing American AI Act) and remain in force.”
- Federal Register / Vol. 90, No. 17 / Tuesday, January 28, 2025 / Presidential Documents
Backs: “Many practical agency requirements continue via OMB M‑24‑10.”
- Rite Aid Banned from Using AI Facial Recognition After FTC Says Retailer Deployed Technology without Reasonable Safeguards | Federal Trade Commission
Backs: “FTC uses its Section 5 authority (unfair/deceptive acts) for AI claims and misuse (e.g., banning Rite Aid’s retail facial recognition for five years).”
- EEOC Releases New Resource on Artificial Intelligence and Title VII
Backs: “DOJ/CFPB/FTC/EEOC also issued a joint statement that automated systems don’t excuse discrimination.”
- Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions; Guidance for Industry and Food and Drug Administration Staff; Availability | 89 FR 96259
Backs: “FDA: final guidance allows “Predetermined Change Control Plans” for AI‑enabled medical devices so models can lawfully update post‑market under a pre‑approved plan.”
- AI Risk Management Framework | NIST
Backs: “Certification options are emerging around ISO/IEC 42001 (AI management systems).”
- California Finalizes Regulations to Strengthen Consumers' Privacy
Backs: “ADMT‑specific rights (pre‑use notice, access and opt‑out) attach to “significant decisions” no later than Jan 1, 2027.”
- SB26-189 Automated Decision-Making Technology | Colorado General Assembly
Backs: “It grants consumers rights to data access/correction and meaningful human review after adverse, consequential decisions; enforced by the AG under the Colorado Consumer Protection Act.”
- Automated Employment Decision Tools (AEDT) - DCWP
Backs: “Local Law 144 (AEDT) bars use of automated hiring/promotion tools unless they pass an independent bias audit within the past year; employers must post audit summaries and give notices.”
- 740 ILCS 14/20
Backs: “Recent amendments curb “per scan” stacking, but exposure remains significant.”
- Bill Information - Tennessee General Assembly
Backs: “Tennessee: the ELVIS Act (effective July 1, 2024) updates right‑of‑publicity law to cover voice and penalize tools primarily designed to create unauthorized voice/likeness clones—relevant to generative AI.”
- When does enforcement start? | AI Act Service Desk
Backs: ““high‑risk” Annex III obligations start December 2, 2027; for high‑risk AI embedded in regulated products they start August 2, 2028.”
- The enforcement framework under the Digital Services Act | Shaping Europe’s digital future
Backs: “Digital Services Act (DSA): platform‑facing transparency, recommender‑system controls, risk assessments, data‑access to regulators and vetted researchers; fully applicable to most platforms since February 17, 2024.”
- Directive - 2024/2853 - EN - Product Liability Directive - EUR-Lex
Backs: “This affects how AI defects and updates (e.g., missed security patches) can trigger liability.”
- Implementing the UK’s AI regulatory principles: initial guidance for regulators - GOV.UK
Backs: “Separate Online Safety Act duties affect recommender systems and safety by design.”
- 互联网信息服务算法推荐管理规定_中央网络安全和信息化委员会办公室
Backs: “They require filing/assessments, content controls, labelling, and user‑rights disclosures.”
- OECD updates AI Principles to stay abreast of rapid technological developments | OECD
Backs: “OECD AI Principles (updated 2024) guide many national strategies and corporate programs; the Council of Europe’s Framework Convention on AI (opened 2024) is the first binding international treaty on AI and has begun to secure ratifications, including by the EU.”
- Frequently Asked Questions | AI Act Service Desk
Backs: “If you touch EU users or markets, map uses to the AI Act now (is it prohibited, limited‑risk, or high‑risk?); prepare transparency workflows for Aug 2, 2026 and plan high‑risk compliance for 2027–2028.”