What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Short answer: There isn’t one global “AI law.” Instead, systems like me are governed by a patchwork of hard law (statutes and regulations), soft law (standards and codes), and sector‑specific rules. Here’s the current (as of September 20, 2026) map of the big, operative frameworks and timelines you should know.

United States (federal)

•Federal agency use of AI: OMB Memorandum M‑24‑10 requires U.S. agencies to inventory AI use, designate Chief AI Officers, and apply minimum risk‑management practices to AI that affects safety or rights. This is binding on federal agencies, not private firms.[1]

•Executive Order 14110 (Oct 30, 2023) spurred a lot of NIST work (e.g., red‑teaming and watermarking guidance), but it was rescinded on January 20, 2025; agencies now rely on standing laws and OMB/NIST outputs.[2]

•Consumer protection and civil‑rights enforcement (applies to AI uses):

•FTC: Section 5 (unfair/deceptive practices) plus a new Impersonation Rule (effective 2024) targeting scams (important for deepfakes/voice cloning); the FTC has also proposed extending it to impersonation of individuals.[3]

•CFPB: lenders using complex/AI models must still give specific, accurate adverse‑action reasons under ECOA/Reg B.[4]

•EEOC: Title VII applies to AI in hiring; guidance explains adverse‑impact assessment for algorithmic tools.[5]

•Standards the federal government promotes and many companies follow:

•NIST AI Risk Management Framework 1.0 (Jan 26, 2023) and the Generative AI Profile (July 26, 2024). Voluntary, but influential for audits, controls, and documentation.[6]

United States (state/local)

•California: The CPPA has adopted CCPA regulations that add rights to opt out of and access “automated decisionmaking technology” (ADMT) and require risk assessments/cybersecurity audits. The ADMT rules include detailed disclosures; compliance for certain “significant decisions” phases in by January 1, 2027.[7]

•Colorado: SB24‑205 (signed May 17, 2024) imposes duties on developers and deployers of “high‑risk” AI to prevent algorithmic discrimination (effective February 1, 2026), with impact assessments, notices, and documentation; enforced by the state AG.[8]

•New York City: Local Law 144 (effective July 5, 2023) requires annual independent bias audits and notices for Automated Employment Decision Tools used in hiring/promotion.[9]

•Illinois: Biometric Information Privacy Act (BIPA) governs collection/use of biometrics (e.g., face/voice), with private rights of action—often relevant to AI.[10]

European Union

•EU AI Act (Regulation (EU) 2024/1689): in force since August 1, 2024; phased application:

•Prohibited AI practices and AI literacy obligations apply from February 2, 2025.

•Obligations for general‑purpose AI (GPAI) models apply from August 2, 2025; providers of GPAI placed on the market before August 2, 2025 must comply by August 2, 2027.

•High‑risk AI obligations (Annex III) apply from December 2, 2027 (and for high‑risk AI embedded in regulated products from August 2, 2028).[11]

•EU Digital Services Act (DSA): already applies (since Feb 17, 2024) with transparency/risk‑mitigation duties for online platforms, including rules on recommender systems (especially for VLOPs/VLOSEs).[12]

•EU Product Liability Directive 2024/2853: updates strict‑liability rules so “products” expressly include software and AI; relevant for accountability if AI causes damage. Adopted Oct 23, 2024.[13]

United Kingdom

•The UK has a “pro‑innovation,” regulator‑led approach (no omnibus AI act yet). Regulators are implementing cross‑cutting AI principles; the UK also created the AI Safety Institute (Nov 2023) and the CMA set competition/consumer‑protection principles for foundation models (updated April 2024).[14]

Canada

•No federal AI statute currently in force. The proposed Artificial Intelligence and Data Act (AIDA) in Bill C‑27 lapsed when Parliament was prorogued in January 2025; work continues under existing privacy/consumer laws and provincial regimes (e.g., Quebec’s Law 25).[15]

China

•Binding, service‑level rules for public‑facing AI:

•Algorithmic Recommendation Provisions (effective Mar 1, 2022);

•Deep Synthesis Provisions (effective Jan 10, 2023);

•Interim Measures for Generative AI Services (effective Aug 15, 2023) with obligations on content management, security assessment/filings, and data/IP compliance.[16]

Cross‑border “soft law” and standards you’ll see in contracts, audits, or certifications

•ISO/IEC 42001:2023 (AI Management System) — a certifiable governance standard for how organizations operate AI responsibly; adopted as a European standard in 2026. Companion standards include ISO/IEC 23894:2023 (AI risk management) and ISO/IEC 42005:2025 (AI impact assessment).[17]

•OECD AI Principles (2019; updated 2024) — widely referenced, values‑based principles that many laws and regulators align with.[18]

•G7 Hiroshima AI Process (Oct 30, 2023) — voluntary Guiding Principles and a Code of Conduct for developers of advanced AI/foundation models; the OECD supports a reporting framework to operationalize this.[19]

Sector‑specific safety and accountability examples

•Medical devices:

•U.S. FDA finalized guidance (Aug 2025) on “Predetermined Change Control Plans” for AI/ML-enabled device software functions—defining how learning models can be safely updated; the EU has MDCG guidance aligning AI/MDR/IVDR obligations.[20]

•Employment, credit, housing, etc.: Existing civil‑rights/consumer‑finance laws apply to AI uses (anti‑discrimination; explainability for adverse actions), enforced by EEOC/CFPB/DOJ/FTC.[5]

International treaty

•Council of Europe Framework Convention on AI (CAI) — adopted May 17, 2024; opened for signature Sept 5, 2024. It will bind only ratifying states once in force, and centers human rights, democracy, and rule of law across the AI lifecycle.[21]

What this means in practice if you build/deploy LLMs today

•Expect baseline duties to document risks and controls (NIST AI RMF/ISO 42001), expand transparency around automated decisions (California ADMT; DSA recommender transparency), and run regular impact/bias testing where decisions affect people (NYC AEDT; Colorado SB24‑205; EU AI Act high‑risk uses). Timelines in the EU matter a lot if you sell there (GPAI by Aug 2, 2025; high‑risk by Dec 2, 2027).[6]

If you want, tell me where you operate and your AI use cases (e.g., hiring, lending, healthcare, content platforms). I can convert this map into a concrete, jurisdiction‑specific checklist with the right citations and dates.

Citations (21)

1whitehouse.govGovernment
EXECUTIVE OFFICE OF THE PRESIDENT
Backs: “OMB Memorandum M‑24‑10 requires U.S. agencies to inventory AI use, designate Chief AI Officers, and apply minimum risk‑management practices to AI that affects safety or rights. This is binding on federal agencies, not private firms.”
2govinfo.govGovernment
Executive Orders EO 14110
Backs: “Executive Order 14110 (Oct 30, 2023) spurred a lot of NIST work (e.g., red‑teaming and watermarking guidance), but it was rescinded on January 20, 2025; agencies now rely on standing laws and OMB/NIST outputs.”
3ftc.govGovernment
FTC Announces Impersonation Rule Goes into Effect Today | Federal Trade Commission
Backs: “Section 5 (unfair/deceptive practices) plus a new Impersonation Rule (effective 2024) targeting scams (important for deepfakes/voice cloning); the FTC has also proposed extending it to impersonation of individuals.”
4consumerfinance.govGovernment
Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms | Consumer Financial Protection Bureau
Backs: “CFPB: lenders using complex/AI models must still give specific, accurate adverse‑action reasons under ECOA/Reg B.”
5govdelivery.comCompanies
EEOC Releases New Resource on Artificial Intelligence and Title VII
Backs: “Title VII applies to AI in hiring; guidance explains adverse‑impact assessment for algorithmic tools.”
6nist.govGovernment
Artificial Intelligence Risk Management Framework (AI RMF 1.0) | NIST
Backs: “Voluntary, but influential for audits, controls, and documentation.”
7ca.govGovernment
CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology (ADMT), and Insurance Regulations - California Privacy Protection Agency (CPPA)
Backs: “The ADMT rules include detailed disclosures; compliance for certain “significant decisions” phases in by January 1, 2027.”
8colorado.govGovernment
SB24-205 Consumer Protections for Artificial Intelligence | Colorado General Assembly
Backs: “SB24‑205 (signed May 17, 2024) imposes duties on developers and deployers of “high‑risk” AI to prevent algorithmic discrimination (effective February 1, 2026), with impact assessments, notices, and documentation; enforced by the state AG.”
9nyc.govGovernment
Automated Employment Decision Tools (AEDT) - DCWP
Backs: “Local Law 144 (effective July 5, 2023) requires annual independent bias audits and notices for Automated Employment Decision Tools used in hiring/promotion.”
10lexlint.orgNot yet classified
Biometric Information Privacy Act (BIPA) · LexLint
Backs: “Biometric Information Privacy Act (BIPA) governs collection/use of biometrics (e.g., face/voice), with private rights of action—often relevant to AI.”
11europa.euGovernment
AI Act | Shaping Europe’s digital future
Backs: “High‑risk AI obligations (Annex III) apply from December 2, 2027 (and for high‑risk AI embedded in regulated products from August 2, 2028).”
12europa.euGovernment
Digital Services Act starts applying to all online platforms in the EU | Shaping Europe’s digital future
Backs: “EU Digital Services Act (DSA): already applies (since Feb 17, 2024) with transparency/risk‑mitigation duties for online platforms, including rules on recommender systems (especially for VLOPs/VLOSEs).”
13europa.euGovernment
Directive - 2024/2853 - EN - Product Liability Directive - EUR-Lex
Backs: “EU Product Liability Directive 2024/2853: updates strict‑liability rules so “products” expressly include software and AI; relevant for accountability if AI causes damage. Adopted Oct 23, 2024.”
14gov.ukGovernment
Implementing the UK’s AI regulatory principles: initial guidance for regulators - GOV.UK
Backs: “Regulators are implementing cross‑cutting AI principles; the UK also created the AI Safety Institute (Nov 2023) and the CMA set competition/consumer‑protection principles for foundation models (updated April 2024).”
15gowlingwlg.comNot yet classified
Bill C27 timeline of developments | Gowling WLG
Backs: “The proposed Artificial Intelligence and Data Act (AIDA) in Bill C‑27 lapsed when Parliament was prorogued in January 2025; work continues under existing privacy/consumer laws and provincial regimes (e.g., Quebec’s Law 25).”
16stanford.eduAcademic
Translation: Internet Information Service Algorithmic Recommendation Management Provisions – Effective March 1, 2022
Backs: “Interim Measures for Generative AI Services (effective Aug 15, 2023) with obligations on content management, security assessment/filings, and data/IP compliance.”
17iec.chNot yet classified
ISO/IEC 42001:2023 | IEC
Backs: “Companion standards include ISO/IEC 23894:2023 (AI risk management) and ISO/IEC 42005:2025 (AI impact assessment).”
18oecd.orgGovernment
AI principles | OECD
Backs: “OECD AI Principles (2019; updated 2024) — widely referenced, values‑based principles that many laws and regulators align with.”
19mofa.go.jpGovernment
G7 Leaders' Statement on the Hiroshima AI Process | Ministry of Foreign Affairs of Japan
Backs: “G7 Hiroshima AI Process (Oct 30, 2023) — voluntary Guiding Principles and a Code of Conduct for developers of advanced AI/foundation models; the OECD supports a reporting framework to operationalize this.”
20fda.govGovernment
Guidances with Digital Health Content | FDA
Backs: “FDA finalized guidance (Aug 2025) on “Predetermined Change Control Plans” for AI/ML-enabled device software functions—defining how learning models can be safely updated; the EU has MDCG guidance aligning AI/MDR/IVDR obligations.”
21coe.intGovernment
Committee on Artificial Intelligence (CAI) - Artificial Intelligence
Backs: “It will bind only ratifying states once in force, and centers human rights, democracy, and rule of law across the AI lifecycle.”