What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Short answer: There isn’t one global “AI law.” What exists today is a patchwork of binding laws, agency rules and enforcement, sectoral and state/local laws, plus standards and soft‑law guidance that many organizations follow. Here’s the current picture (as of September 21, 2026), with the items most likely to affect how systems like me are built, deployed, and held to account.

United States (federal)

•Federal agencies’ own use of AI: OMB’s M‑24‑10 requires every cabinet agency to inventory AI uses, appoint a Chief AI Officer, publish use‑case inventories, and apply minimum risk‑management practices for “rights‑impacting” and “safety‑impacting” AI; M‑24‑18 adds procurement/contracting requirements so vendors meet those safeguards. These bind federal agencies, but also flow down to vendors that sell AI to government.[1]

•Consumer finance and credit: The CFPB has made clear that adverse‑action notice duties under ECOA/Reg B apply even when lenders use complex or “black‑box” models. You still have to give specific reasons for denials or limit decreases.[2]

•Employment discrimination: The EEOC’s Title VII technical assistance explains how using algorithms in hiring can trigger disparate‑impact liability and how to assess adverse impact. (ADA guidance exists as well.)[3]

•FTC enforcement: The FTC uses its deception/unfairness authority against risky or misleading AI deployments and claims (e.g., Rite Aid’s five‑year ban on store facial recognition; repeated warnings to “keep your AI claims in check”). Remedies can include deleting ill‑gotten data/models.[4]

•Securities/markets: The SEC finalized a rule (June 12, 2025) addressing conflicts of interest when brokers/advisers use predictive data analytics to interact with investors.[5]

United States (state and local)

•Colorado AI Act (SB24‑205): Effective Feb 1, 2026. Developers and deployers of “high‑risk” AI that make consequential decisions must use reasonable care to prevent algorithmic discrimination, keep documentation, provide notices, and cooperate with the AG. The AG has now filed implementing rules.[6]

•New York City Local Law 144 (AEDTs): Since July 5, 2023, employers using automated employment decision tools for hiring/promotion in NYC need an independent annual bias audit, public posting of the audit summary, and applicant/employee notices. Enforcement continues.[7]

•California privacy rulemaking (ADMT): The California Privacy Protection Agency finalized CCPA regulations on Automated Decision‑Making Technology, cybersecurity audits, and risk assessments (effective Jan 1, 2026). They create opt‑out and access rights around significant automated decisions and require documented risk assessments.[8]

•Biometric privacy: Illinois’ BIPA (private right of action; consent, retention, and purpose limits) and Texas’ CUBI (notice/consent; retention and sale limits) govern many facial/voice/fingerprint uses common in AI systems.[9]

•California frontier‑AI oversight (new in 2025–2026): The Governor’s office reports new laws creating a framework for certifying independent AI verification organizations and a registry/standards for AI auditors, plus a September 18, 2026 executive order to accelerate independent oversight and explore an emergency “kill switch” requirement for frontier models. (Expect implementing details via rulemaking.)[10]

European Union

•EU AI Act (Regulation 2024/1689): In force since Aug 1, 2024 with phased application. Key dates: prohibitions (e.g., certain manipulative or social‑scoring systems) from Feb 2, 2025; general‑purpose AI (GPAI) duties from Aug 2, 2025; transparency duties (e.g., AI‑generated content labeling under Article 50) from Aug 2, 2026; Annex III “high‑risk” systems from Dec 2, 2027; embedded high‑risk in regulated products by Aug 2, 2028. Obligations include risk management, data governance, documentation, human oversight, post‑market monitoring, and incident reporting.[11]

•Product liability: The revised Product Liability Directive (EU) 2024/2853 extends no‑fault liability to software and AI, modernizing defect and disclosure rules; Member States must transpose it into national law.[12]

•Data and platform rules that also bite AI: GDPR’s Article 22 limits solely automated decisions with significant effects; DSA imposes transparency and risk‑mitigation duties on recommender systems (and added reporting/formats from 2025).[13]

United Kingdom

•The UK has no single omnibus AI Act. It relies on sector regulators and has created the AI Safety Institute to evaluate frontier models and publish evaluation approaches/tools informing regulation and procurement.[14]

China

•Binding national rules specific to AI include the 2023 Interim Measures for Generative AI Services (content controls, data quality, security assessments, complaint handling) and 2025 rules on labeling AI‑generated synthetic content. Providers offering public‑facing gen‑AI must meet those requirements.[15]

International instruments (soft law that many jurisdictions/companies align to)

•OECD AI Principles (2019; updated 2024): inclusive growth; human‑rights/fairness; transparency/explainability; robustness/safety; accountability, with government recommendations on R&D, skills, and interoperable governance.[16]

•UNESCO Recommendation on the Ethics of AI (2021): a nonbinding global standard many governments reference when drafting policy.[17]

•Council of Europe Framework Convention on AI (opened for signature Sept 5, 2024): the first binding treaty on AI and human rights, democracy, and rule of law; it enters into force after ratifications.[18]

Standards many builders use (often required by customers or regulators)

•NIST AI Risk Management Framework 1.0 (2023) and its Generative AI Profile (2024): widely used by U.S. agencies and vendors; increasingly referenced in procurement and audits.[19]

•ISO/IEC 42001:2023 (AI management systems) and ISO/IEC 23894:2023 (AI risk management): certifiable or guidance standards for governance, risk, and controls across the AI lifecycle.[20]

•IEEE 7000/7001/7003 series (ethics in design, transparency of autonomous systems, algorithmic‑bias considerations).[21]

What this adds up to in practice

•Before and during deployment: risk assessments, bias testing, documentation, human‑oversight design, transparency to users, audit trails, security controls, and sometimes third‑party audits are expected or required (sector‑specific in the U.S.; horizontal in the EU; specific areas in China). Failing to do so can trigger regulator actions (FTC/EEOC/CFPB/SEC), civil liability (e.g., under BIPA or EU product liability), or blocks on use (NYC AEDT, EU AI Act prohibitions).[7]

If you tell me your sector and where you operate, I can map exactly which obligations apply and what “good practice” looks like for build, deploy, and accountability.

Citations (21)

1whitehouse.govGovernment
https://www.whitehouse.gov/wp-content/uploads/2024/03/M-24-10-Advancing-Governance-Innovation-and-Risk-Management-for-Agency-Use-of-Artificial-Intelligence.pdf
Backs: “These bind federal agencies, but also flow down to vendors that sell AI to government.”
2consumerfinance.govGovernment
Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms | Consumer Financial Protection Bureau
Backs: “You still have to give specific reasons for denials or limit decreases.”
3govdelivery.comCompanies
EEOC Releases New Resource on Artificial Intelligence and Title VII
Backs: “The EEOC’s Title VII technical assistance explains how using algorithms in hiring can trigger disparate‑impact liability and how to assess adverse impact. (ADA guidance exists as well.)”
4ftc.govGovernment
Rite Aid Banned from Using AI Facial Recognition After FTC Says Retailer Deployed Technology without Reasonable Safeguards | Federal Trade Commission
Backs: “The FTC uses its deception/unfairness authority against risky or misleading AI deployments and claims (e.g., Rite Aid’s five‑year ban on store facial recognition; repeated warnings to “keep your AI claims in check”). Remedies can include deleting ill‑gotten data/models.”
5sec.govGovernment
SEC.gov | Conflicts of Interest Associated with the Use of Predictive Data Analytics by Broker-Dealers and Investment Advisers
Backs: “The SEC finalized a rule (June 12, 2025) addressing conflicts of interest when brokers/advisers use predictive data analytics to interact with investors.”
6colorado.govGovernment
SB24-205 Consumer Protections for Artificial Intelligence | Colorado General Assembly
Backs: “Developers and deployers of “high‑risk” AI that make consequential decisions must use reasonable care to prevent algorithmic discrimination, keep documentation, provide notices, and cooperate with the AG. The AG has now filed implementing rules.”
7nyc.govGovernment
Automated Employment Decision Tools (AEDT) - DCWP
Backs: “Since July 5, 2023, employers using automated employment decision tools for hiring/promotion in NYC need an independent annual bias audit, public posting of the audit summary, and applicant/employee notices. Enforcement continues.”
8ca.govGovernment
California Finalizes Regulations to Strengthen Consumers' Privacy
Backs: “They create opt‑out and access rights around significant automated decisions and require documented risk assessments.”
9ilga.govGovernment
Illinois General Assembly - Illinois Compiled Statutes - Full Text
Backs: “Illinois’ BIPA (private right of action; consent, retention, and purpose limits) and Texas’ CUBI (notice/consent; retention and sale limits) govern many facial/voice/fingerprint uses common in AI systems.”
10ca.govGovernment
Governor Newsom issues executive order to accelerate independent oversight and advance the creation of an AI kill switch | Governor of California
Backs: “The Governor’s office reports new laws creating a framework for certifying independent AI verification organizations and a registry/standards for AI auditors, plus a September 18, 2026 executive order to accelerate independent oversight and explore an emergency “kill switch” requirement for frontier models. (Expect…”
11europa.euGovernment
Timeline for the Implementation of the EU AI Act | AI Act Service Desk
Backs: “Obligations include risk management, data governance, documentation, human oversight, post‑market monitoring, and incident reporting.”
12europa.euGovernment
Directive (EU) 2024/2853 of the European Parliament and of the Council of 23 October 2024 on liability for defective products and repealing Council Directive 85/374/EEC (Text with EEA relevance)
Backs: “The revised Product Liability Directive (EU) 2024/2853 extends no‑fault liability to software and AI, modernizing defect and disclosure rules; Member States must transpose it into national law.”
13europa.euGovernment
Information for individuals - European Commission
Backs: “DSA imposes transparency and risk‑mitigation duties on recommender systems (and added reporting/formats from 2025).”
14gov.ukGovernment
Introducing the AI Safety Institute - GOV.UK
Backs: “It relies on sector regulators and has created the AI Safety Institute to evaluate frontier models and publish evaluation approaches/tools informing regulation and procurement.”
15cac.gov.cnGovernment
生成式人工智能服务管理暂行办法_中央网络安全和信息化委员会办公室
Backs: “Providers offering public‑facing gen‑AI must meet those requirements.”
16oecd.orgGovernment
AI principles | OECD
Backs: “OECD AI Principles (2019; updated 2024): inclusive growth; human‑rights/fairness; transparency/explainability; robustness/safety; accountability, with government recommendations on R&D, skills, and interoperable governance.”
17unesco.orgGovernment
Ethics of Artificial Intelligence - AI | UNESCO
Backs: “UNESCO Recommendation on the Ethics of AI (2021): a nonbinding global standard many governments reference when drafting policy.”
18coe.intGovernment
The Framework Convention on Artificial Intelligence - Artificial Intelligence
Backs: “Council of Europe Framework Convention on AI (opened for signature Sept 5, 2024): the first binding treaty on AI and human rights, democracy, and rule of law; it enters into force after ratifications.”
19nist.govGovernment
Artificial Intelligence Risk Management Framework (AI RMF 1.0) | NIST
Backs: “NIST AI Risk Management Framework 1.0 (2023) and its Generative AI Profile (2024): widely used by U.S. agencies and vendors; increasingly referenced in procurement and audits.”
20iec.chNot yet classified
ISO/IEC 42001:2023 | IEC
Backs: “ISO/IEC 42001:2023 (AI management systems) and ISO/IEC 23894:2023 (AI risk management): certifiable or guidance standards for governance, risk, and controls across the AI lifecycle.”
21ieee.orgNot yet classified
7000-2021 - IEEE Standard Model Process for Addressing Ethical Concerns during System Design | IEEE Standard | IEEE Xplore
Backs: “IEEE 7000/7001/7003 series (ethics in design, transparency of autonomous systems, algorithmic‑bias considerations).”