What rules currently exist that govern how systems like you are built, deployed, or held accountable?
I will research current laws, regulations, standards, and guidelines that apply to the development, deployment, and accountability of AI systems.A mix of binding laws (especially the EU AI Act and various national/state rules), soft-law principles, sector-specific applications of existing law, and voluntary frameworks govern the building, deployment, and accountability of AI systems like large language models (LLMs), general-purpose AI (GPAI), and frontier models. There is no single global regime; approaches vary significantly by jurisdiction, with the EU taking the most comprehensive risk-based binding approach, the US emphasizing innovation with fragmented state rules and federal deregulatory policy, China focusing on content/security controls, and international bodies providing influential principles and emerging treaties.[1]
European Union: EU AI Act (Regulation 2024/1689)
This is the world’s first comprehensive binding legal framework for AI. It uses a risk-based approach and applies extraterritorially to providers/deployers placing systems on the EU market or whose outputs are used in the EU.[1]
Supporting tools include guidelines, the AI Pact (voluntary early compliance), and standardization.
United States
No comprehensive federal AI statute exists. Policy under the Trump administration (as of 2025–2026) is deregulatory and pro-innovation, prioritizing U.S. leadership, infrastructure, exports, and models “free from ideological bias.” Key actions include revoking the Biden-era EO 14110, issuing EO 14179 (“Removing Barriers...”), America’s AI Action Plan (2025), and frameworks seeking to limit or preempt burdensome state laws via a “minimally burdensome national standard.” Federal focus is more on voluntary collaboration, procurement rules (e.g., for government use), national security assessments of frontier models, and existing laws.[6]
State laws create a patchwork (developers and deployers often bear duties):
Existing federal/state laws applied to AI: FTC Act (unfair/deceptive practices), privacy laws (e.g., CCPA/CPRA and expanding ADMT rules), civil rights/anti-discrimination, sector rules (health, finance, employment), product liability/tort, and the Take It Down Act (nonconsensual intimate imagery, including AI-generated; effective 2026). Federal agencies have guidance on AI use/procurement.[10]
Accountability often falls on deployers (not just developers), with civil liability, attorney general enforcement, and private rights of action in some cases. Incident reporting and safety frameworks are key for frontier systems.
China
Focuses on generative AI and content/security via administrative measures rather than one omnibus statute:
Other National Examples
International and Soft-Law Frameworks
These are highly influential (often informing hard law) but generally non-binding or framework-level:
Building, Deployment, and Accountability Themes
Industry/voluntary elements include NIST AI Risk Management Framework (US), ISO standards, company policies, and EU GPAI Codes of Practice (presumption of conformity). Rules evolve rapidly—high-risk timelines have already shifted, state laws proliferate, and federal preemption debates continue in the US. Compliance depends on the system’s capabilities, use case, location of users/providers, and scale (frontier/large models face stricter scrutiny). This is a high-level overview; specific obligations require legal analysis for particular systems or jurisdictions.
Citations (16)
- https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
Backs: “deregulatory policy, China focusing on content/security controls, and international bodies providing influential principles and emerging treaties.”
- https://www.simmons-simmons.com/en/publications/cmt09z0uq0056uzywe1qk2rmr/ai-view:august-2026
Backs: “Requirements (risk management, high-quality/representative data, documentation, logging, transparency, human oversight, accuracy/robustness/cybersecurity) largely delayed via 2026 amendments to December 2027 (Annex III) or August 2028 (product safety route).”
- https://digital-strategy.ec.europa.eu/en/faqs/transparency-obligations-under-article-50-ai-act
Backs: “Transparency/limited risk: Disclose AI interactions (e.g., chatbots); mark synthetic content (audio/image/video/text) as AI-generated in machine-readable/detectable ways; label deepfakes and certain public-interest text.”
- https://digital-strategy.ec.europa.eu/en/faqs/guidelines-obligations-general-purpose-ai-providers
Backs: “Models with systemic risk (e.g., high compute/capability) face additional evaluation, adversarial testing, and risk mitigation. Obligations largely effective since August 2025; Codes of Practice support compliance.”
- https://www.jaggaer.com/blog/what-is-the-eu-ai-act
Backs: “Fines up to €35 million or 7% of global annual turnover (prohibited practices) or lower tiers for other violations. Human oversight emphasized; ultimate accountability remains with humans in many contexts.”
- https://www.whitehouse.gov/presidential-actions/2025/01/removing-barriers-to-american-leadership-in-artificial-intelligence/
Backs: “more on voluntary collaboration, procurement rules (e.g., for government use), national security assessments of frontier models, and existing laws.”
- https://www.skadden.com/insights/publications/2026/09/the-informed-board/a-guide-to-coping-with-divergent-state-ai-regulations
Backs: “Also training data transparency (AB 2013), AI content provenance/labeling (SB 942), companion chatbot safeguards (especially minors, SB 243), and ADMT/privacy rules.”
- https://cld-dev.io/policy/what-four-state-ai-laws-reach/
Backs: “Also training data transparency (AB 2013), AI content provenance/labeling (SB 942), companion chatbot safeguards (especially minors, SB 243), and ADMT/privacy rules. New York: RAISE Act—similar frontier developer safety protocols, catastrophic risk focus, and rapid (e.g., 72-hour) incident reporting.”
- https://theworldofai.org/ai-compliance/state-ai-laws/
Backs: “Others: Employment AI restrictions (e.g., Illinois), deepfake/voice likeness protections (e.g., Tennessee ELVIS, Hawaii), chatbot rules (multiple states), consumer notifications, and more.”
- https://www.alston.com/en/insights/publications/2026/06/us-ai-regulation-enforcement-policy-trends
Backs: “Existing federal/state laws applied to AI: FTC Act (unfair/deceptive practices), privacy laws (e.g., CCPA/CPRA and expanding ADMT rules), civil rights/anti-discrimination, sector rules (health, finance, employment), product liability/tort, and the Take It Down Act (nonconsensual intimate imagery, including…”
- https://aigovernance.com/policy/china-generative-ai-regulations-interim-measures
Backs: “CAC (for services with public opinion/social mobilization attributes), user protections, and complaint mechanisms.”
- https://casrai.org/guides/china-ai-regulation-explained
Backs: “Internal/R&D use often exempt. Labeling Measures for AI-Generated Synthetic Content (2025): Visible labels + embedded metadata for text/images/audio/video/etc.”
- https://cset.georgetown.edu/publication/china-gen-ai-safety-standard-final/
Backs: “Supporting rules on algorithms, deep synthesis, and emerging companion/anthropomorphic AI. Penalties include suspension, fines, and potential criminal liability.”
- https://casrai.org/guides/ai-regulations-around-the-world
Backs: “National standards detail safety requirements. Other National Examples. South Korea: AI Basic Act (in force since ~January 2026) with obligations for high-impact/generative systems.”
- https://oecd.ai/en/ai-principles
Backs: “Five values-based principles—inclusive growth/sustainable development/well-being; human rights/democratic values/fairness/privacy; transparency/explainability; robustness/security/safety; accountability—plus recommendations for policymakers (R&D investment, ecosystems, interoperable governance, skills, international…”
- https://www.coe.int/en/web/artificial-intelligence/the-framework-convention-on-artificial-intelligence
Backs: “Signed by EU, US, UK, and others; enters into force after sufficient ratifications (not yet fully in force as of mid-late 2026 data). National security carve-outs exist.”