What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Systems like Claude currently sit at the intersection of a patchwork of binding laws, proposed frameworks, and voluntary industry commitments. Here's a breakdown of what currently governs their development, deployment, and accountability:

1. The EU AI Act (the most comprehensive binding law globally)

Adopted in 2024, the EU Artificial Intelligence Act lays down harmonized rules on artificial intelligence and is the first-ever comprehensive legal framework on AI worldwide, founded on a graduated, risk-oriented structure that differentiates AI systems by the potential harm they may pose. As of 2026, it's in active rollout:

•Transparency rules: The transparency duties (Article 50) and the AI Office's enforcement powers over general-purpose AI (GPAI) providers took effect exactly as scheduled on 2 August 2026 and were not delayed. This means providers must clearly disclose their AI's nature before or during interaction, unless it is already obvious to a reasonable user.

•GPAI model obligations: Providers of general-purpose models like Claude must maintain detailed technical documentation covering model architecture and training procedures, provide documentation to downstream integrators, publish a summary of training data content, and comply with EU copyright law including text-and-data-mining opt-outs.

•High-risk system deadlines were pushed back: The Omnibus confirms two fixed dates for the Act's toughest tier: high-risk obligations for stand-alone systems are deferred to 2 December 2027, and high-risk AI embedded in already-regulated products is deferred to 2 August 2028.

2. US Federal Approach: Deregulation + Preemption, Not New Binding Rules

Unlike the EU, the US federal government has taken an anti-regulatory stance:

•On taking office, on the first day of his second term, President Trump revoked President Biden's 2023 AI safety order (EO 14110).

•In December 2025, the Administration issued Executive Order 14365, "Ensuring a National Policy Framework for Artificial Intelligence," seeking to curtail state AI regulation, directing the DOJ to establish an "AI Litigation Task Force" and instructing agencies to assess whether funding could discourage state AI regulation.

•A June 2026 follow-up order establishes new cybersecurity mandates and a voluntary framework for the secure deployment of frontier AI models, but explicitly does not create a mandatory licensing or preclearance requirement for AI development or distribution. It does call for AI developers to voluntarily share certain new models with the federal government up to 30 days before providing access to other partners.

•This federal preemption push faces real legal uncertainty: the Executive Order asserts broad federal authority to preempt state AI laws, but it remains far from certain that the push will succeed, and aggressive efforts could provoke considerable resistance from states and face significant obstacles in court.

3. US State Laws (the actual binding rules for most AI companies right now)

With no comprehensive federal law, states have moved first:

•California's SB 53 (TFAIA): Making California the first state to require public, standardized safety disclosures from developers of advanced AI models, covering how developers manage safety risks with new mechanisms for transparency, accountability, and enforcement. It applies to models trained above 10^26 floating-point operations, and requires disclosure of critical safety incidents including unauthorized access to model weights, catastrophic-risk harms, or models using deceptive methods to bypass controls. It also establishes whistleblower protections for those working for frontier developers.

•Colorado's AI Act: Focuses on high-risk AI systems that make "consequential decisions", though it's being revised, including retaining attorney-general-only enforcement with a notice-and-cure period while removing the stand-alone duty to "avoid algorithmic discrimination."

•New York's RAISE Act and Illinois's AI Safety Measures Act follow similar frontier-model tracks, requiring developers to create safety protocols, report significant safety incidents, evaluate models for "unreasonable risk of critical harm," and undergo independent third-party audits.

4. Voluntary Frameworks (widely referenced but not legally binding)

•NIST AI Risk Management Framework: Voluntary guidance for managing risks across the AI lifecycle, built around four functions—Govern, Map, Measure, and Manage—aligned with trustworthy AI characteristics like validity, safety, and accountability. Congress directed NIST to develop this voluntary framework to balance innovation with accountability.

•International commitments: Frontier labs' safety policies trace back to the G7 Hiroshima Process International Code of Conduct and the AI Seoul Summit's Frontier AI Safety Commitments.

5. Company-Specific Voluntary Self-Governance

Since binding law hasn't caught up to frontier model risks, companies including Anthropic self-impose accountability structures:

•Anthropic's Responsible Scaling Policy (RSP): A voluntary framework for managing catastrophic risks from advanced AI systems, establishing how the company identifies and evaluates risks, makes decisions about development and deployment, and aims to ensure benefits exceed costs. It's explicitly a living document, continually updated as understanding of AI capabilities and risks improves.

•The RSP operates through capability thresholds: as AI models become more powerful, they require stronger protections, and when models reach certain capability thresholds, additional safeguards around security and deployment are implemented, with thresholds currently defined for CBRN weapons and autonomous AI research and development risks.

•Similar frameworks exist industry-wide: frontier AI labs also publish their own safety policies—Anthropic's RSP, OpenAI's Preparedness Framework, and Google DeepMind's Frontier Safety Framework—all defining what tests a model must pass before release.

•Importantly, these are self-imposed, not legally enforceable: where the RSP is a self-imposed deployment gate, the EU AI Act is a binding regulatory regime—the two can be complementary, but one is a company commitment and the other is enforceable regulation.

Bottom line

Right now, the accountability landscape for systems like me is genuinely fragmented: binding law exists mainly through the EU AI Act (transparency, documentation, copyright compliance) and a growing set of US state laws (especially California's frontier-model disclosure regime and Colorado's high-risk-system rules); federal US policy is actively trying to preempt those state laws rather than replace them with comparable federal rules; and much of what actually shapes day-to-day model safety practice — red-teaming, deployment thresholds, capability evaluations — comes from voluntary frameworks (NIST AI RMF) and company-specific commitments (like Anthropic's RSP) that carry no legal force but are increasingly referenced by regulators and expected by customers as a de facto standard.

Citations (27)

1legalnodes.comCompanies
EU AI Act 2026 Updates: Compliance Requirements and Business Risks
Source excerpt: “Adopted on 21 May 2024, the EU Artificial Intelligence Act lays down harmonized rules on artificial intelligence and is the first-ever comprehensive l...”
2softwareimprovementgroup.comCompanies
A comprehensive EU AI Act Summary [August 2026 update] - SIG
Source excerpt: “Meanwhile, the transparency duties (Article 50) and the AI Office’s enforcement powers over general-purpose AI (GPAI) providers took effect exactly as...”
3decodethefuture.orgBlogs and newsletters
EU AI Act 2026: Penalties, Risk Tiers & New Deadlines
Source excerpt: “For developers building chatbots or NLP-powered interfaces: this means your system must clearly disclose its AI nature before or during interaction, u...”
4decodethefuture.orgBlogs and newsletters
EU AI Act 2026: Penalties, Risk Tiers & New Deadlines
Source excerpt: “Every provider of a GPAI model placed on the EU market must: maintain detailed technical documentation covering model architecture, training procedure...”
5softwareimprovementgroup.comCompanies
A comprehensive EU AI Act Summary [August 2026 update] - SIG
Source excerpt: “The Omnibus confirms two fixed dates for the Act’s toughest tier: high-risk obligations for stand-alone systems (Annex III, covering hiring, credit sc...”
6lathropgpm.comCompanies
New Executive Order Signals Evolving Federal Approach to AI - Lathrop GPM
Source excerpt: “On the first day of his second term in office, President Trump revoked President Biden’s 2023 AI safety order (EO 14110). ”
7wilmerhale.comNot yet classified
White House Releases National Policy Framework for Artificial Intelligence
Source excerpt: “Shortly thereafter, in December 2025, the Administration issued Executive Order 14365, Ensuring a National Policy Framework for Artificial Intelligenc...”
8lathropgpm.comCompanies
New Executive Order Signals Evolving Federal Approach to AI - Lathrop GPM
Source excerpt: “This EO establishes new cybersecurity mandates and a voluntary framework for the secure deployment of frontier AI models. ”
9stackcyber.comCompanies
Colorado AI Act Compliance Guide | STACK Cybersecurity
Source excerpt: “The order expressly states it does not create a mandatory licensing or preclearance requirement for AI development or distribution... ”
10mcdermottlaw.comCompanies
New executive order shifts US AI policy toward national security
Source excerpt: “The EO calls for AI developers to voluntarily share certain new models with the federal government up to 30 days before providing access to other part...”
11ropesgray.comNot yet classified
Examining the Landscape and Limitations of the Federal Push to Override State AI Regulation | Insights | Ropes & Gray LLP
Source excerpt: “The Trump administration’s recent executive order, titled “Ensuring a National Policy Framework for Artificial Intelligence,” asserts broad federal au...”
12wilmerhale.comNot yet classified
Transparency in Frontier Artificial Intelligence Act (SB-53): California Requires New Standardized AI Safety Disclosures
Source excerpt: “Developers who are not in compliance with the law when it takes effect in January 2026 face civil ... On September 29, California Governor Gavin News...”
13wilmerhale.comNot yet classified
Transparency in Frontier Artificial Intelligence Act (SB-53): California Requires New Standardized AI Safety Disclosures
Source excerpt: “TFAIA requires developers to disclose how they manage safety risks and introduces new mechanisms for transparency, accountability, and enforcement. ”
14wilmerhale.comNot yet classified
Transparency in Frontier Artificial Intelligence Act (SB-53): California Requires New Standardized AI Safety Disclosures
Source excerpt: “The bill defines a “frontier model” as a foundation model trained on a quantity of computing power greater than 10^26 integer or floating-point operat...”
15kslaw.comCompanies
New State AI Laws are Effective on January 1, 2026, But a New Executive Order Signals Disruption | King & Spalding
Source excerpt: “The California TFAIA also requires “critical safety incident” management and reporting, which include · unauthorized access or modification of frontie...”
16crowell.comNot yet classified
California’s Landmark AI Law Demands Transparency From Leading AI Developers | Crowell & Moring LLP
Source excerpt: “The law establishes whistleblower protections for those working for frontier developers.”
17crowell.comNot yet classified
California’s Landmark AI Law Demands Transparency From Leading AI Developers | Crowell & Moring LLP
Source excerpt: “For example, the Colorado Artificial Intelligence Act, which will go into effect on June 30, 2026, imposes various obligations related to documentatio...”
18cooley.comNot yet classified
State AI Laws – Where Are They Now? // Cooley // Global Law Firm
Source excerpt: “Retaining Colorado attorney general-only enforcement but adding a 90-day notice-and-cure period and clarifying developer versus deployer liability. Re...”
19crowell.comNot yet classified
California’s Landmark AI Law Demands Transparency From Leading AI Developers | Crowell & Moring LLP
Source excerpt: “In New York, a bill awaiting Governor Kathy Hochul’s signature, the Responsible AI Safety and Education (RAISE) Act, would require developers of front...”
20orca.securityNot yet classified
NIST AI Risk Management Framework (AI RMF) Explained: What It Is and How Organizations Use It
Source excerpt: “The NIST AI Risk Management Framework (AI RMF 1.0) is voluntary guidance for managing risks across the AI lifecycle, from design through deployment an...”
21orca.securityNot yet classified
NIST AI Risk Management Framework (AI RMF) Explained: What It Is and How Organizations Use It
Source excerpt: “116-283), Congress directed NIST to develop a voluntary framework that could balance innovation with accountability. ”
22anthropic.comCompanies
Anthropic’s Transparency Hub:
Source excerpt: “Related Commitments: G7 Hiroshima Process International Code of Conduct; AI Seoul Summit's Frontier AI Safety Commitments; Seoul AI Business Pledge R...”
23anthropic.comCompanies
www-cdn.anthropic.com
Source excerpt: “Governance Appendix A: Commitments Related to Competitors Appendix B: Notes on ASLs Changelog September 19, 2023 (RSP v1.0) October 15, 2024 (RS...”
24anthropic.comCompanies
www-cdn.anthropic.com
Source excerpt: “We have always intended for our RSP to be a living document. We will continually update the RSP as we learn more about AI capabilities and risks, deve...”
25anthropic.comCompanies
Anthropic’s Transparency Hub:
Source excerpt: “As AI models become more powerful, they require stronger protections. When models reach certain capability thresholds, we will implement additional sa...”
26layer3labs.ioCompanies
AI Model Safety Rules (2026): NIST, ISO 42001, EU AI Act
Source excerpt: “Frontier AI labs also publish their own safety policies. Anthropic's Responsible Scaling Policy, OpenAI's Preparedness Framework, and Google DeepMind'...”
27techjacksolutions.comNot yet classified
AI Safety Levels Explained: Anthropic's 2026 AI Risk Framework
Source excerpt: “Where the RSP is a self-imposed deployment gate, the AI Act is a binding regulatory regime. The two can be complementary, but they are different in na...”