What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Short answer: A fast-changing mix of hard law, regulator rules, and voluntary standards governs AI today. Here’s the current (as of September 22, 2026) picture for how systems like me are built, deployed, and held accountable.

1)Binding laws and regulations

•European Union — AI Act (Regulation (EU) 2024/1689)

•In force since August 1, 2024. Key application dates:

•Prohibited AI practices (e.g., certain manipulative or exploitative uses) apply from February 2, 2025.

•Most remaining rules, including enforcement powers and GPAI/transparency duties (e.g., synthetic content marking), apply from August 2, 2026; providers with models already on the market get until December 2, 2026 for some labeling. High‑risk system obligations tied to Article 6(1) start August 2, 2027.[1]

•Fines can reach the higher of €35m or 7% of global turnover for banned practices.[2]

•United States — federal level

•There is no comprehensive federal AI law. The 2023 AI safety Executive Order (EO 14110) was rescinded on January 20, 2025 by EO 14148; the current framework emphasizes innovation and coordination under EO 14179 (January 23, 2025) and a December 11, 2025 order on a national AI policy framework (EO 14365).[3]

•Federal agencies do impose rules on government use and procurement:

•OMB M‑24‑10 (Mar 2024) sets governance, impact assessment, and safeguards for federal agency use of AI; OMB followed with acquisition guidance (M‑25‑22, Feb 2025) and procurement principles aimed at “unbiased AI” (M‑26‑04, Dec 2025).[4]

•Existing consumer‑protection and civil‑rights laws apply to AI:

•FTC uses its unfair/deceptive practices authority and launched “Operation AI Comply” to police deceptive AI claims and uses.[5]

•CFPB has clarified that lenders using complex/ML models must give specific reasons in adverse‑action notices (ECOA/Reg B).[6]

•United States — state and local highlights

•Colorado AI Act (SB24‑205) — first broad state AI law focused on “high‑risk” systems making consequential decisions; duties for both developers and deployers to prevent algorithmic discrimination; effective February 1, 2026; AG rulemaking active.[7]

•California privacy rules on automated decisionmaking (ADMT) — the CPPA finalized CCPA regulations giving consumers rights to access information about, and opt out of, certain ADMT used to make “significant decisions” (employment, credit, housing, education, health), effective January 1, 2026.[8]

•California Frontier AI transparency and verification

•SB 53 (Transparency in Frontier Artificial Intelligence Act) was signed September 29, 2025; core transparency duties for large “frontier” developers took effect January 1, 2026.[9]

•SB 813 (2026) created a framework for designating “independent verification organizations” (IVOs) to assess AI systems/models against state standards; chaptered September 9, 2026.[10]

•NYC Local Law 144 (AEDTs in hiring) — requires an annual independent bias audit and notices to applicants for automated hiring/promotions tools; enforcement began in 2023 and continues.[11]

•Tennessee ELVIS Act (2024) — expands right‑of‑publicity protections to cover AI‑simulated voices/images; creates civil liability for unauthorized cloning.[12]

•Election deepfakes — a fast‑growing patchwork; over 20 states now regulate AI‑generated deceptive political media near elections (disclosures, takedown, and/or remedies). Details vary by state.[13]

•United Kingdom

•No single AI statute; the government pursues a “pro‑innovation” approach by asking existing regulators to apply cross‑cutting AI principles, while the UK AI Safety Institute develops model‑evaluation methods. The CMA has issued competition/consumer‑protection principles for foundation models.[14]

•Canada

•The proposed federal Artificial Intelligence and Data Act (AIDA) did not become law when Parliament was prorogued in January 2025. However, the Government of Canada’s Directive on Automated Decision‑Making remains binding on federal departments, requiring Algorithmic Impact Assessments, testing, human oversight, and transparency for government ADM systems.[15]

•China

•Multiple binding measures regulate AI‑enabled content and services, including: Algorithmic Recommendation Provisions (effective 2022), Deep Synthesis Provisions (deepfake labeling and security duties; effective January 10, 2023), and Interim Measures for Generative AI Services (effective August 15, 2023). These impose real‑name registration, security assessments, watermarking/labeling, and content‑management duties.[16]

2)Sectoral and cross‑cutting laws that already apply to AI

•Privacy/data protection and consumer laws (e.g., GDPR/UK GDPR/CCPA/CPRA), anti‑discrimination (e.g., Title VII, state civil‑rights laws), financial services (ECOA/FCRA), product safety, advertising and unfair/deceptive practices (FTC Act) all apply to AI uses and marketing claims. Agencies are actively enforcing these in AI contexts.[5]

•Many jurisdictions also now regulate specific AI risks:

•Hiring: NYC LL 144 bias audits.[17]

•Political deepfakes: growing state‑level disclosure/takedown regimes.[13]

•Voice/likeness: Tennessee’s ELVIS Act.[18]

3)Government and industry standards that shape “how to build”

•NIST AI Risk Management Framework 1.0 (Jan 2023) and a Generative AI profile (July 2024) are widely referenced by U.S. agencies and industry to operationalize AI risk controls.[19]

•ISO/IEC 42001 (AI management systems) and ISO/IEC 23894 (AI risk management) are the leading international standards organizations use to structure governance and audits; 42001 is certifiable.[20]

•OECD AI Principles (2019; updated materials 2024) and the G7 Hiroshima Process Code of Conduct (2023) provide internationally recognized, voluntary guardrails (human‑centric, transparency, accountability, risk management), often baked into corporate policies and procurement.[21]

What this means in practice for builders and deployers

•Expect risk‑based obligations and documentation: data governance, pre‑deployment testing, ongoing monitoring, incident/issue reporting, and clear user disclosures. The EU AI Act and Colorado’s law split duties between “providers/developers” and “deployers,” while California’s CCPA rules add user rights around automated decisions.[22]

•Independent scrutiny is rising: required bias audits (NYC) and emerging independent verification regimes (California SB 813) point to third‑party assessment becoming normal for higher‑risk use cases.[17]

•Enforcement is real: EU regulators can levy significant AI‑Act fines; U.S. regulators (FTC/CFPB and state AGs) are already bringing cases using existing laws.[2]

If you tell me your industry and where you operate, I can map the specific obligations and timelines that apply to you.

Citations (22)

1europa.euGovernment
The timeline of implementation of the AI Act
Backs: “High‑risk system obligations tied to Article 6(1) start August 2, 2027.”
2europa.euGovernment
Regulation - EU - 2024/1689 - EN - EUR-Lex
Backs: “Fines can reach the higher of €35m or 7% of global turnover for banned practices.”
3govinfo.govGovernment
DCPD-202500115 - Executive Order 14148—Initial Rescissions of Harmful Executive Orders and Actions - DCPD-202500115 | Content Details | GovInfo
Backs: “The 2023 AI safety Executive Order (EO 14110) was rescinded on January 20, 2025 by EO 14148; the current framework emphasizes innovation and coordination under EO 14179 (January 23, 2025) and a December 11, 2025 order on a national AI policy framework (EO 14365).”
4whitehouse.govGovernment
EXECUTIVE OFFICE OF THE PRESIDENT
Backs: “OMB followed with acquisition guidance (M‑25‑22, Feb 2025) and procurement principles aimed at “unbiased AI” (M‑26‑04, Dec 2025).”
5ftc.govGovernment
FTC Announces Crackdown on Deceptive AI Claims and Schemes | Federal Trade Commission
Backs: “FTC uses its unfair/deceptive practices authority and launched “Operation AI Comply” to police deceptive AI claims and uses.”
6consumerfinance.govGovernment
Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms | Consumer Financial Protection Bureau
Backs: “CFPB has clarified that lenders using complex/ML models must give specific reasons in adverse‑action notices (ECOA/Reg B).”
7colorado.govGovernment
SB24-205 Consumer Protections for Artificial Intelligence | Colorado General Assembly
Backs: “Colorado AI Act (SB24‑205) — first broad state AI law focused on “high‑risk” systems making consequential decisions; duties for both developers and deployers to prevent algorithmic discrimination; effective February 1, 2026; AG rulemaking active.”
8ca.govGovernment
California Finalizes Regulations to Strengthen Consumers' Privacy
Backs: “California privacy rules on automated decisionmaking (ADMT) — the CPPA finalized CCPA regulations giving consumers rights to access information about, and opt out of, certain ADMT used to make “significant decisions” (employment, credit, housing, education, health), effective January 1, 2026.”
9ca.govGovernment
Governor Newsom signs SB 53, advancing California’s world-leading artificial intelligence industry | Governor of California
Backs: “SB 53 (Transparency in Frontier Artificial Intelligence Act) was signed September 29, 2025; core transparency duties for large “frontier” developers took effect January 1, 2026.”
10legiscan.comData and tools
Votes: CA SB813 | 2025-2026 | Regular Session | LegiScan
Backs: “SB 813 (2026) created a framework for designating “independent verification organizations” (IVOs) to assess AI systems/models against state standards; chaptered September 9, 2026.”
11nyc.govGovernment
The New York City Council - File #: Int 1894-2020
Backs: “NYC Local Law 144 (AEDTs in hiring) — requires an annual independent bias audit and notices to applicants for automated hiring/promotions tools; enforcement began in 2023 and continues.”
12tn.govGovernment
Tennessee First in the Nation to Address AI Impact on Music Industry
Backs: “Tennessee ELVIS Act (2024) — expands right‑of‑publicity protections to cover AI‑simulated voices/images; creates civil liability for unauthorized cloning.”
13ncsl.orgNonprofits and think tanks
Artificial Intelligence (AI) in Elections and Campaigns
Backs: “Election deepfakes — a fast‑growing patchwork; over 20 states now regulate AI‑generated deceptive political media near elections (disclosures, takedown, and/or remedies). Details vary by state.”
14gov.ukGovernment
A pro-innovation approach to AI regulation: government response - GOV.UK
Backs: “The CMA has issued competition/consumer‑protection principles for foundation models.”
15parl.caNot yet classified
C-27 (44-1) - LEGISinfo - Parliament of Canada
Backs: “However, the Government of Canada’s Directive on Automated Decision‑Making remains binding on federal departments, requiring Algorithmic Impact Assessments, testing, human oversight, and transparency for government ADM systems.”
16cac.gov.cnGovernment
互联网信息服务算法推荐管理规定_中央网络安全和信息化委员会办公室
Backs: “These impose real‑name registration, security assessments, watermarking/labeling, and content‑management duties.”
17nyc.govGovernment
Automated Employment Decision Tools (AEDT) - DCWP
Backs: “Hiring: NYC LL 144 bias audits.”
18justia.comEncyclopedias and reference
Tennessee Code § 47-25-1101 (2024) - Short title :: 2024 Tennessee Code :: U.S. Codes and Statutes :: U.S. Law :: Justia
Backs: “Voice/likeness: Tennessee’s ELVIS Act.”
19nist.govGovernment
Artificial Intelligence Risk Management Framework (AI RMF 1.0) | NIST
Backs: “NIST AI Risk Management Framework 1.0 (Jan 2023) and a Generative AI profile (July 2024) are widely referenced by U.S. agencies and industry to operationalize AI risk controls.”
20iso.orgNonprofits and think tanks
ISO/IEC 42001:2023 - AI management systems
Backs: “ISO/IEC 42001 (AI management systems) and ISO/IEC 23894 (AI risk management) are the leading international standards organizations use to structure governance and audits; 42001 is certifiable.”
21oecd.orgGovernment
AI principles | OECD
Backs: “OECD AI Principles (2019; updated materials 2024) and the G7 Hiroshima Process Code of Conduct (2023) provide internationally recognized, voluntary guardrails (human‑centric, transparency, accountability, risk management), often baked into corporate policies and procurement.”
22europa.euGovernment
The enforcement framework of the AI Act | Shaping Europe’s digital future
Backs: “The EU AI Act and Colorado’s law split duties between “providers/developers” and “deployers,” while California’s CCPA rules add user rights around automated decisions.”