Your question touches on current AI accountability rules — I'll map what governs how systems like me are built and deployed.
Currently no single global law governs AI systems like me. Instead there is a layered patchwork of binding regulations, phased-in requirements, and voluntary accountability frameworks:
1. Binding, government-enacted regulation
European Union - AI Act (Regulation (EU) 2024/1689)
The most comprehensive binding law. It is described as an EU regulation laying down harmonised rules on artificial intelligence, in force from 1 August 2024 and applying in phases through 2028.
It uses a risk-based approach classifying systems into four categories: unacceptable risk (prohibited), high risk (strictly regulated), limited risk, and minimal risk.
Phased enforcement currently in effect:
•Prohibited practices (Article 5) since 2 February 2025 - The binding today includes the prohibited-practices rules (Article 5, since 2 February 2025)
•The Act bans unacceptable risk systems – such as social scoring and real-time biometric identification – as of February 2025
•Banned uses include deceptive or manipulative AI behavior, exploiting vulnerable populations, social scoring and personality-based profiling, and real-time facial recognition or biometric identification in public spaces
•General-Purpose AI (GPAI) model obligations (Chapter V) since 2 August 2025 - from 2 August 2025, the AI Act’s rules on general-purpose AI (GPAI) will enter into force, also listed as the general-purpose AI obligations (Chapter V, since 2 August 2025)
•Transparency obligations (Article 50) since 2 August 2026 - Article 50 of the EU AI Act came into force on 2 August 2026, introducing transparency obligations for providers and deployers of certain AI systems
•Providers must disclose AI interactions and mark AI-generated or manipulated content, while deployers must disclose deepfakes, certain AI-generated public-interest content, and use of emotion recognition or biometric categorisation systems
•Specifically, providers must ensure AI systems intended to interact directly with natural persons are designed so persons are informed they are interacting with an AI system and where systems generate synthetic audio, image, video or text, outputs are marked in a machine-readable format and detectable as artificially generated
•Deployers must inform persons exposed to emotion recognition or biometric categorisation and disclose where image, audio or video constituting a deep fake has been generated
Enforcement is now active: On 2 August 2026, the European Commission’s Artificial Intelligence Office and national competent authorities started enforcing the Artificial Intelligence Act. Governance rules and high-risk system requirements have an extended transition period until 2 August 2027.
The EU also updated liability: Product Liability Directive 2024/2853 on 23 October 2024 adapts strict liability and expands the concept of "product" to include software and AI systems
United States - No comprehensive federal law
Unlike many other countries, the United States does not yet have a comprehensive federal AI law regulating use of generative or agentic AI systems. The United States, which is home to many companies making the most powerful models, has no national AI regulations, just a patchwork of state-level laws
Instead the US uses sector-specific enforcement of existing laws (consumer protection, anti-discrimination, copyright, etc.) plus:
US State laws - growing patchwork
As of 2025, nearly every state has introduced some form of AI legislation, with more than 100 measures enacted across 38 jurisdictions
•8 states have fully enacted AI legislation
•18 states have both enacted and proposed new AI laws
•22 states currently have AI legislation in development
The leading example is Colorado Artificial Intelligence Act (SB 24-205):
•Signed in May 2024, it was a first-of-its-kind statute in the United States: a risk-based framework that would have required developers and deployers of "high-risk" AI systems to use reasonable care to prevent algorithmic discrimination, conduct annual impact assessments, maintain documented risk management programs, and report discovered discrimination directly to the Colorado Attorney General
•Full Act (effective June 30, 2026) - First comprehensive US state AI accountability law. Requires deployers of high-risk AI to maintain risk management programs, conduct annual impact assessments, and disclose AI interactions - other summaries list effective February 1, 2026 for systems that make or substantially assist "consequential decisions" (employment, housing, lending, education, health care, insurance, government services)
•Establishes a Shared Responsibility Model with parallel obligations for both developers and deployers, recognizing that preventing algorithmic discrimination requires accountability at multiple points in the AI lifecycle
•Scope is high-risk AI systems that make/substantially influence a consequential decision with Developer + deployer duties: reasonable care to avoid algorithmic discrimination
•Includes practical obligations like impact assessments, consumer disclosures, annual reviews and retention of assessments for three years
•The Colorado Attorney General has exclusive authority to enforce. Violations are treated as unfair trade practices with maximum civil penalties of $20,000 per violation, with each consumer or transaction counted separately
China
China has binding, enforcement-heavy laws: Primary legislation includes Algorithmic Recommendation Regulation, Deep Synthesis Regulation, Generative AI Regulation and is enforcing laws on everything from generative AI watermarking to domestic data localization and party-aligned ethical standards
2. Voluntary / standards-based governance that creates accountability
These are not laws but are increasingly used as compliance benchmarks, procurement requirements, and evidence of "reasonable care":
NIST AI Risk Management Framework (AI RMF) - United States
•A voluntary, non-certifiable framework that helps organizations responsibly design, develop, implement, and use AI systems, released on January 26, 2023
•Note: Executive Order 14110 was revoked in January 2025 by Executive Order 14179, but the NIST AI RMF remains an active, authoritative resource maintained by NIST
•It identifies seven key risk areas: validity and reliability, safety, security and resilience, accountability and transparency, explainability and interpretability, privacy and confidentiality, fairness and bias management
•Four core functions create a continuous cycle: Map: Identify and contextualize AI risks, Measure: Assess and monitor impact, Manage: Prioritize and mitigate risks, Govern: Establish organizational culture of responsible AI use and accountability
ISO/IEC 42001:2023 - International
•A global AI management system standard that guides organizations in developing responsible, transparent, and trustworthy AI systems. Although it’s not legally binding, it is influencing how lawmakers draft AI legislation
•Certifiable AI Management System Standard. Voluntary but increasingly referenced in procurement, contracts, and regulatory submissions. Aligns with OECD principles
OECD AI Principles
•Adopted by 46+ countries. Five principles: inclusive growth, human-centered values, transparency, robustness/security, accountability
•Also described as Based on five core value-based pillars - inclusive growth, sustainable development, and well-being; human-centered values and fairness; transparency and explainability; robustness, security, and safety; and accountability
•Most credible frameworks agree on eight core principles: accountability, transparency, fairness, safety, privacy, human oversight, inclusivity and robustness. These originate in the OECD AI Principles and are reflected throughout ISO 42001, the NIST AI Risk Management Framework and the EU AI Act
3. How accountability works in practice
•Built: Requirements for risk management, data governance, technical documentation, human oversight, accuracy and cybersecurity by design for high-risk systems (EU), and risk management programs and impact assessments (Colorado).
•Deployed: Transparency duties (EU Article 50 disclosure and watermarking), consumer notices, and deployer obligations to review deployed systems at least annually.
•Held accountable: EU enforcement by the AI Office + national authorities; US state enforcement by Attorneys General (Colorado exclusive AG authority); US federal reliance on existing regulators (FTC, CFPB, EEOC) applying existing discrimination/consumer protection law; contractual certification against ISO 42001 and adherence to NIST AI RMF used as evidence of reasonable care and due diligence.
In short, if you interact with a system like me in the EU you are currently protected by enforceable prohibitions and transparency rules, with high-risk accountability rules phasing in through 2027; in the US you are protected primarily by state laws like Colorado's plus voluntary frameworks that companies adopt to demonstrate responsible development.