What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Short answer: there isn’t a single “AI law.” Today’s rules are a layered mix of general laws that already apply to AI, sector‑specific regulations, a few horizontal AI statutes or rules (especially in the EU and at U.S. state/local levels), and voluntary standards that many organizations use to show due care. Here’s a high‑level map as of September 23, 2026.

Cross‑cutting standards and norms used for “how to build and run AI”

•NIST AI Risk Management Framework (AI RMF 1.0, Jan 2023) and its Generative AI Profile (July 2024) are widely used playbooks in the U.S. and internationally for governance, risk, testing, measurement, and controls.[1]

•ISO/IEC standards: 42001:2023 (certifiable AI management system requirements) and 23894:2023 (AI risk management guidance). Many firms use these to operationalize governance and show conformity.[2]

•OECD AI Principles (first adopted 2019; refreshed materials in 2024) shape many countries’ policies and corporate programs.[3]

•Council of Europe Framework Convention on AI (adopted May 17, 2024; opened for signature Sept 5, 2024) is the first binding international treaty on AI for signatories, centered on human rights, democracy, and rule of law.[4]

United States – federal

•Executive branch policy: Executive Order 14110 (Oct 30, 2023) catalyzed NIST and agency work but was revoked on Jan 20, 2025 (EO 14148). The NIST guidance it triggered remains available and in use.[5]

•Federal agencies’ own use of AI: OMB Memorandum M‑24‑10 (Mar 2024) requires every civilian agency to stand up AI governance, inventory and manage “rights‑impacting” and “safety‑impacting” AI, and meet procurement and risk‑management duties.[6]

•General consumer‑ and civil‑rights enforcement (applies whether or not AI is used):

•FTC enforces against unfair or deceptive acts, including misleading “AI” claims or unsafe deployments (e.g., “Operation AI Comply” actions).[7]

•CFPB/Regulation B (ECOA): lenders using complex models must still give specific adverse‑action reasons; updates to Reg B were finalized in 2026.[8]

•EEOC/DOJ/FTC/CFPB joint statement (Apr 25, 2023): no “AI exemption” from anti‑discrimination and consumer‑protection laws.[9]

•Sector rules (examples):

•FDA finalized guidance on “predetermined change control plans” (PCCPs) for AI‑enabled medical devices, defining how adaptive models can be safely updated post‑market (finals in Dec 2024 and Aug 2025).[10]

United States – state and local

•Colorado AI Act (SB24‑205): from Feb 1, 2026, “developers” and “deployers” of high‑risk AI used for consequential decisions must exercise reasonable care to prevent algorithmic discrimination and meet documentation, impact‑assessment, and notice duties.[11]

•California privacy regulations (CPPA): Automated Decision‑Making Technology (ADMT) rules were approved in 2025, effective Jan 1, 2026, with compliance for “significant decisions” no later than Jan 1, 2027; they add access/opt‑out rights, risk assessments, and audit/cyber requirements.[12]

•New York City Local Law 144 (AEDT): since July 5, 2023, employers using automated hiring/promotion tools in NYC need an independent bias audit, public posting of audit results, and candidate notice.[13]

•Illinois: Biometric Information Privacy Act (BIPA) imposes consent, disclosure, and retention duties for biometric data; the AI Video Interview Act requires notice, explanation, consent, and deletion options when AI is used to score recorded interviews for Illinois roles.[14]

European Union

•EU AI Act: entered into force Aug 1, 2024; the first big tranche of obligations applies from Aug 2, 2026, ramping in over several years. It bans certain practices; sets strict duties for “high‑risk” AI (risk management, data governance, logging, human oversight, transparency, post‑market monitoring); and adds obligations for general‑purpose AI (GPAI) providers. The European AI Office and national authorities coordinate enforcement.[15]

•Digital Services Act (DSA): already in force; imposes transparency for recommender systems and ads, and systemic‑risk management for very large platforms/search engines.[16]

•GDPR: long‑standing constraints on profiling and automated decision‑making (including Article 22) still apply; see EDPB guidance.[17]

United Kingdom

•No single horizontal AI statute; the government uses a “pro‑innovation” principles‑based approach carried out by existing regulators. The UK AI Safety/Security Institute publishes evals and methods for model testing but these are not binding law.[18]

China

•Binding rules aimed at public‑facing AI services: the Interim Measures for the Management of Generative AI Services (effective Aug 15, 2023) and earlier rules on algorithmic recommender systems and “deep synthesis” impose filing/labeling, content, data, and security obligations on providers.[19]

What these rules usually require in practice

•Governance and risk management: documented processes, roles, and controls; risk/impact assessments; incident response; post‑deployment monitoring. (NIST AI RMF; ISO/IEC 42001/23894.)[1]

•Safety, testing, and change control: pre‑release evaluation/red‑teaming; transparent update plans for adaptive systems (e.g., FDA PCCPs).[20]

•Data controls: quality, provenance, and privacy safeguards; special care for biometrics and sensitive attributes (e.g., BIPA; GDPR).[14]

•Fairness/non‑discrimination: audits or impact testing in high‑stakes uses (hiring, credit, housing, healthcare); specific duties vary by jurisdiction (e.g., NYC AEDT, Colorado AI Act, EU AI Act).[13]

•Transparency and user rights: user notices, explanation/disclosure for automated decisions, and sometimes opt‑outs (e.g., DSA recommender transparency; California ADMT rights).[16]

•Accountability and enforcement: general consumer‑protection and civil‑rights laws (FTC, EEOC, CFPB/Reg B) apply regardless of tech used.[9]

If you share your industry and where you operate, I can turn this into a concrete checklist for building and deploying systems like me under the rules that actually bind you.

Citations (20)

1nist.govGovernment
Artificial Intelligence Risk Management Framework (AI RMF 1.0) | NIST
Backs: “NIST AI Risk Management Framework (AI RMF 1.0, Jan 2023) and its Generative AI Profile (July 2024) are widely used playbooks in the U.S. and internationally for governance, risk, testing, measurement, and controls.”
evidence, official document. Claim: NIST AI RMF 1.0 and Generative AI Profile are widely used playbooks for AI governance, risk, testing, and controls.
2iso.orgNonprofits and think tanks
ISO/IEC 42001:2023 - AI management systems
Backs: “Many firms use these to operationalize governance and show conformity.”
evidence, reference entry. Claim: ISO/IEC 42001:2023 is a certifiable AI management system standard that firms use to operationalize governance.
3oecd.orgGovernment
AI principles | OECD
Backs: “OECD AI Principles (first adopted 2019; refreshed materials in 2024) shape many countries’ policies and corporate programs.”
evidence, article. Claim: OECD AI Principles shape many countries' policies and corporate programs.
4coe.intGovernment
Committee on Artificial Intelligence (CAI) - Artificial Intelligence
Backs: “Council of Europe Framework Convention on AI (adopted May 17, 2024; opened for signature Sept 5, 2024) is the first binding international treaty on AI for signatories, centered on human rights, democracy, and rule of law.”
evidence, home page. Claim: Council of Europe Framework Convention on AI is the first binding international AI treaty for signatories.
5nist.govGovernment
Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence | NIST
Backs: “The NIST guidance it triggered remains available and in use.”
evidence, article. Claim: Executive Order 14110 catalyzed NIST and agency work but was revoked in January 2025; NIST guidance remains.
6whitehouse.govGovernment
EXECUTIVE OFFICE OF THE PRESIDENT
Backs: “OMB Memorandum M‑24‑10 (Mar 2024) requires every civilian agency to stand up AI governance, inventory and manage “rights‑impacting” and “safety‑impacting” AI, and meet procurement and risk‑management duties.”
evidence, official document. Claim: OMB M-24-10 requires civilian agencies to establish AI governance, inventory rights- and safety-impacting AI, and manage risk.
7ftc.govGovernment
FTC Announces Crackdown on Deceptive AI Claims and Schemes | Federal Trade Commission
Backs: “FTC enforces against unfair or deceptive acts, including misleading “AI” claims or unsafe deployments (e.g., “Operation AI Comply” actions).”
evidence, article. Claim: FTC enforces against deceptive AI claims, such as through Operation AI Comply actions.
8consumerfinance.govGovernment
Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms | Consumer Financial Protection Bureau
Backs: “CFPB/Regulation B (ECOA): lenders using complex models must still give specific adverse‑action reasons; updates to Reg B were finalized in 2026.”
evidence, official document. Claim: Lenders using complex models must give specific adverse-action reasons under ECOA/Regulation B; updates finalized in 2026.
9ftc.govGovernment
Joint Statement on Enforcement Efforts Against Discrimination and Bias in Automated Systems | Federal Trade Commission
Backs: “EEOC/DOJ/FTC/CFPB joint statement (Apr 25, 2023): no “AI exemption” from anti‑discrimination and consumer‑protection laws.”
evidence, official document. Claim: Agencies' joint statement says no AI exemption from anti-discrimination and consumer-protection laws.
10fda.govGovernment
FDA Roundup: December 3, 2024 | FDA
Backs: “FDA finalized guidance on “predetermined change control plans” (PCCPs) for AI‑enabled medical devices, defining how adaptive models can be safely updated post‑market (finals in Dec 2024 and Aug 2025).”
evidence, article. Claim: FDA finalized guidance on predetermined change control plans for AI-enabled medical devices.
11colorado.govGovernment
SB24-205 Consumer Protections for Artificial Intelligence | Colorado General Assembly
Backs: “Colorado AI Act (SB24‑205): from Feb 1, 2026, “developers” and “deployers” of high‑risk AI used for consequential decisions must exercise reasonable care to prevent algorithmic discrimination and meet documentation, impact‑assessment, and notice duties.”
evidence, official document. Claim: Colorado AI Act requires developers and deployers of high-risk AI to prevent algorithmic discrimination and meet documentation and notice duties.
12ca.govGovernment
California Finalizes Regulations to Strengthen Consumers' Privacy
Backs: “Automated Decision‑Making Technology (ADMT) rules were approved in 2025, effective Jan 1, 2026, with compliance for “significant decisions” no later than Jan 1, 2027; they add access/opt‑out rights, risk assessments, and audit/cyber requirements.”
evidence, article. Claim: California ADMT regulations add access/opt-out rights, risk assessments, and audit requirements, with phased compliance dates.
13nyc.govGovernment
Automated Employment Decision Tools (AEDT) - DCWP
Backs: “New York City Local Law 144 (AEDT): since July 5, 2023, employers using automated hiring/promotion tools in NYC need an independent bias audit, public posting of audit results, and candidate notice.”
evidence, official document. Claim: NYC Local Law 144 requires independent bias audits, public posting, and candidate notice for automated hiring tools.
14ilga.govGovernment
Illinois General Assembly - Illinois Compiled Statutes - Full Text
Backs: “Biometric Information Privacy Act (BIPA) imposes consent, disclosure, and retention duties for biometric data; the AI Video Interview Act requires notice, explanation, consent, and deletion options when AI is used to score recorded interviews for Illinois roles.”
evidence, official document. Claim: Illinois BIPA imposes consent, disclosure, and retention duties for biometric data; also cited for data controls.
15europa.euGovernment
AI Act | Shaping Europe’s digital future
Backs: “The European AI Office and national authorities coordinate enforcement.”
evidence, article. Claim: EU AI Act bans certain practices, sets high-risk and GPAI obligations, and is phased in from 2024 through 2026 and beyond.
16europa.euGovernment
Regulation - 2022/2065 - EN - DSA - EUR-Lex
Backs: “Digital Services Act (DSA): already in force; imposes transparency for recommender systems and ads, and systemic‑risk management for very large platforms/search engines.”
evidence, official document. Claim: Digital Services Act imposes recommender and ad transparency and systemic-risk management for very large platforms.
17europa.euGovernment
Automated decision-making and profiling | European Data Protection Board
Backs: “GDPR: long‑standing constraints on profiling and automated decision‑making (including Article 22) still apply; see EDPB guidance.”
evidence, official document. Claim: GDPR constrains profiling and automated decision-making, including Article 22, per EDPB guidance.
18gov.ukGovernment
AI regulation: a pro-innovation approach - GOV.UK
Backs: “The UK AI Safety/Security Institute publishes evals and methods for model testing but these are not binding law.”
evidence, official document. Claim: UK has no single AI statute and uses a principles-based approach via existing regulators.
19loc.govGovernment
China: Generative AI Measures Finalized | Library of Congress
Backs: “Binding rules aimed at public‑facing AI services: the Interim Measures for the Management of Generative AI Services (effective Aug 15, 2023) and earlier rules on algorithmic recommender systems and “deep synthesis” impose filing/labeling, content, data, and security obligations on providers.”
evidence, article. Claim: China's Generative AI Measures impose filing, labeling, content, data, and security obligations on providers.
20fda.govGovernment
Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions | FDA
Backs: “Safety, testing, and change control: pre‑release evaluation/red‑teaming; transparent update plans for adaptive systems (e.g., FDA PCCPs).”
evidence, official document. Claim: FDA PCCP guidance supports pre-release testing and transparent update plans for adaptive AI systems.