What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Here’s a concise, up-to-date snapshot of the main rules that govern how modern AI systems are built, deployed, and held accountable as of September 25, 2026. I’ve grouped them by where they bind and what they cover.

Global and regional “hard law”

•European Union – AI Act (Regulation (EU) 2024/1689): Risk-based obligations for AI systems and added duties for general-purpose AI (GPAI) models. Entered into force on August 1, 2024; most obligations start August 2, 2026, with later dates for some high‑risk rules (Annex III by Dec 2, 2027; embedded high‑risk by Aug 2, 2028). GPAI “systemic risk” models (e.g., very large compute) have extra security, documentation, and evaluation duties and must notify the EU AI Office.[1]

•European product liability: the recast Product Liability Directive (EU) 2024/2853 explicitly covers software/AI; Member States must transpose by December 9, 2026, modernizing no‑fault liability for defective AI-enabled products.[2]

•Council of Europe – Framework Convention on AI, Human Rights, Democracy and Rule of Law: first binding international treaty on AI, opened for signature Sept 5, 2024; enters into force after sufficient ratifications.[3]

•China – content and service rules: binding “Deep Synthesis” regulation (effective Jan 10, 2023) imposes labeling, safety, and governance duties for synthetic media; “Interim Measures for Generative AI Services” (effective Aug 15, 2023) set additional provider obligations (e.g., security assessments, content controls).[4]

United States – federal levers (cross‑sector)

•Executive actions and federal use: Executive Order 14110 (Oct 30, 2023) launched a government‑wide AI safety program in 2023; it was rescinded in January 2025, but its downstream outputs (e.g., NIST work, OMB policy) continue unless separately withdrawn. OMB Memorandum M‑24‑10 (Mar 2024) still requires federal agencies to inventory AI use, apply minimum risk controls where rights/safety are affected, and report governance progress.[5]

•Standards and guidance referenced by government:

•NIST AI Risk Management Framework (AI RMF 1.0) and the Generative AI Profile (NIST AI 600‑1, July 2024) provide widely used, nonbinding risk controls that agencies and companies map to.[6]

•NTIA’s AI Accountability Policy Report (Mar 27, 2024) recommends independent evaluations/audits for high‑risk systems and outlines accountability inputs (documentation, red‑teaming, incident reporting, etc.).[7]

•Existing federal laws enforced against AI uses:

•Credit and lending: CFPB says ECOA/Reg B adverse‑action notice duties apply even with complex/ML models; firms must give specific, accurate reasons.[8]

•Employment discrimination: EEOC guidance warns employers that algorithmic selection tools can trigger Title VII liability if they cause disparate impact.[9]

•Consumer protection: the FTC has pursued cases (e.g., Rite Aid facial recognition) and warned against deceptive “AI‑washing” claims.[10]

•Federal AI safety institutions: the U.S. AI Safety Institute (at NIST) and its multi‑stakeholder consortium coordinate evaluations, red‑teaming guidance, and synthetic‑content risk work; the U.S. and UK safety institutes have an MoU to align testing approaches.[11]

United States – state and local rules

•California – CCPA/CPRA regulations on automated decisionmaking technology (ADMT), risk assessments, and cybersecurity audits were approved Sept 23, 2025 and took effect Jan 1, 2026; they add consumer access/opt‑out rights around certain ADMT and require programmatic risk assessments for high‑risk processing.[12]

•New York City – Local Law 144 (in force, enforced since July 5, 2023) requires bias audits and candidate notice for automated employment decision tools used in hiring/promotion. Penalties apply for non‑compliance.[13]

•Utah – Artificial Intelligence Policy Act (SB 149; in force since May 1, 2024, amended 2025) requires disclosures in specified interactions and establishes an AI policy office and safe‑harbor pathways.[14]

•Colorado – 2024 AI law (SB24‑205) created duties for “high‑risk” AI and algorithmic discrimination; the legislature later pushed back initial compliance to June 30, 2026 while rulemaking proceeded (and related “Chatbot Safety Act” work began). Check the AG’s AI rulemaking hub for current requirements and timelines.[15]

•Connecticut – 2026 package (Public Act 26‑15 and related measures) establishes AI governance programs and new guardrails for automated employment‑related decision processes, phased from Oct 1, 2026.[16]

Other national approaches

•United Kingdom – No single “AI Act”; instead a regulator‑led, principles‑based regime. The government’s pro‑innovation AI regulation program tasks sector regulators to apply common principles; the UK AI Safety Institute publishes evaluation methods and conducts pre‑deployment testing in partnership with peers (including the U.S.). Online Safety Act 2023 separately regulates recommender‑driven online harms, with Ofcom enforcement milestones.[17]

International soft law and cooperation

•OECD AI Principles (2019; updated 2024) guide many countries’ policy baselines; G7’s Hiroshima Process issued an international (voluntary) Code of Conduct for advanced‑AI developers. The UN General Assembly adopted a 2024 resolution urging “safe, secure, trustworthy” AI aligned with human rights and sustainable development.[18]

Cross‑cutting standards you’ll see referenced in law and procurement

•ISO/IEC 42001:2023 (AI management systems) – a certifiable governance standard now used in tenders and by regulators as evidence of process discipline; often paired with ISO/IEC 23894:2023 (AI risk management).[19]

•NIST AI RMF 1.0 + Generative AI Profile – nonbinding in the U.S. private sector but widely adopted and cited by OMB for federal agencies and by state AGs/regulators as a benchmark for “reasonable” AI risk practices.[6]

•U.S. Copyright Office policy (Mar 16, 2023) clarifies that only human‑authored elements are copyrightable; applicants must disclose and disclaim AI‑generated portions. The Office’s ongoing AI study (2024–2025) addresses AI‑generated outputs and training on copyrighted works.[20]

What this usually means if you build or deploy AI now

•Map your system to the right regime(s): EU AI Act risk category; U.S. sector rules (credit, employment, health); state ADMT/profiling rules (e.g., California), and any local laws (e.g., NYC hiring tools).[1]

•Stand up a governance system: document model/data lineage, testing, red‑teaming, and human‑oversight plans aligned to NIST AI RMF/GenAI Profile or ISO/IEC 42001; expect audits/impact assessments for high‑risk or consequential uses.[21]

•Provide transparency and user rights where required: notices, opt‑outs, human review/appeal mechanisms, and synthetic‑content disclosure/watermarking where laws require it (e.g., EU AI Act transparency and certain state ADMT rules).[22]

•Keep an eye on liability and enforcement: EU product liability is expanding to software/AI; in the U.S., CFPB/EEOC/FTC already enforce existing laws against AI‑driven practices.[2]

If you want, tell me your industry and where you operate; I can highlight the exact obligations and dates that apply to your use cases.

Citations (22)

1europa.euGovernment
AI Act enters into force - European Commission
Backs: “GPAI “systemic risk” models (e.g., very large compute) have extra security, documentation, and evaluation duties and must notify the EU AI Office.”
2europa.euGovernment
Liability for defective products - Internal Market, Industry, Entrepreneurship and SMEs
Backs: “Member States must transpose by December 9, 2026, modernizing no‑fault liability for defective AI-enabled products.”
3coe.intGovernment
The Framework Convention on Artificial Intelligence - Artificial Intelligence
Backs: “Council of Europe – Framework Convention on AI, Human Rights, Democracy and Rule of Law: first binding international treaty on AI, opened for signature Sept 5, 2024; enters into force after sufficient ratifications.”
4cac.gov.cnGovernment
互联网信息服务深度合成管理规定_中央网络安全和信息化委员会办公室
Backs: ““Interim Measures for Generative AI Services” (effective Aug 15, 2023) set additional provider obligations (e.g., security assessments, content controls).”
5govinfo.govGovernment
Federal Register / Vol. 90, No. 17 / Tuesday, January 28, 2025 / Presidential Documents
Backs: “OMB Memorandum M‑24‑10 (Mar 2024) still requires federal agencies to inventory AI use, apply minimum risk controls where rights/safety are affected, and report governance progress.”
6nist.govGovernment
AI Risk Management Framework | NIST
Backs: “NIST AI Risk Management Framework (AI RMF 1.0) and the Generative AI Profile (NIST AI 600‑1, July 2024) provide widely used, nonbinding risk controls that agencies and companies map to.”
7ntia.govGovernment
NTIA calls for audits and investments in trustworthy AI systems | National Telecommunications and Information Administration
Backs: “NTIA’s AI Accountability Policy Report (Mar 27, 2024) recommends independent evaluations/audits for high‑risk systems and outlines accountability inputs (documentation, red‑teaming, incident reporting, etc.).”
8consumerfinance.govGovernment
Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms | Consumer Financial Protection Bureau
Backs: “CFPB says ECOA/Reg B adverse‑action notice duties apply even with complex/ML models; firms must give specific, accurate reasons.”
9govdelivery.comCompanies
EEOC Releases New Resource on Artificial Intelligence and Title VII
Backs: “EEOC guidance warns employers that algorithmic selection tools can trigger Title VII liability if they cause disparate impact.”
10congress.govGovernment
AUTHENTICATED
Backs: “Consumer protection: the FTC has pursued cases (e.g., Rite Aid facial recognition) and warned against deceptive “AI‑washing” claims.”
11nist.govGovernment
Biden-Harris Administration Announces First-Ever Consortium Dedicated to AI Safety | NIST
Backs: “AI Safety Institute (at NIST) and its multi‑stakeholder consortium coordinate evaluations, red‑teaming guidance, and synthetic‑content risk work; the U.S. and UK safety institutes have an MoU to align testing approaches.”
12ca.govGovernment
California Finalizes Regulations to Strengthen Consumers' Privacy
Backs: “California – CCPA/CPRA regulations on automated decisionmaking technology (ADMT), risk assessments, and cybersecurity audits were approved Sept 23, 2025 and took effect Jan 1, 2026; they add consumer access/opt‑out rights around certain ADMT and require programmatic risk assessments for high‑risk processing.”
13nyc.govGovernment
Automated Employment Decision Tools (AEDT) - DCWP
Backs: “New York City – Local Law 144 (in force, enforced since July 5, 2023) requires bias audits and candidate notice for automated employment decision tools used in hiring/promotion. Penalties apply for non‑compliance.”
14utah.govGovernment
Utah Legislature SB0149
Backs: “Utah – Artificial Intelligence Policy Act (SB 149; in force since May 1, 2024, amended 2025) requires disclosures in specified interactions and establishes an AI policy office and safe‑harbor pathways.”
15colorado.govGovernment
SB25B-004 Increase Transparency for Algorithmic Systems | Colorado General Assembly
Backs: “Check the AG’s AI rulemaking hub for current requirements and timelines.”
16ct.govGovernment
Governor Lamont Signs Legislation Establishing Youth Online Safety Protections, Regulations Over Artificial Intelligence, and Initiatives to Upskill Connecticut’s Workforce
Backs: “Connecticut – 2026 package (Public Act 26‑15 and related measures) establishes AI governance programs and new guardrails for automated employment‑related decision processes, phased from Oct 1, 2026.”
17gov.ukGovernment
A pro-innovation approach to AI regulation: government response - GOV.UK
Backs: “Online Safety Act 2023 separately regulates recommender‑driven online harms, with Ofcom enforcement milestones.”
18oecd.orgGovernment
AI principles | OECD
Backs: “The UN General Assembly adopted a 2024 resolution urging “safe, secure, trustworthy” AI aligned with human rights and sustainable development.”
19iso.orgNonprofits and think tanks
ISO/IEC 42001:2023 - AI management systems
Backs: “ISO/IEC 42001:2023 (AI management systems) – a certifiable governance standard now used in tenders and by regulators as evidence of process discipline; often paired with ISO/IEC 23894:2023 (AI risk management).”
20govinfo.govGovernment
Federal Register / Vol. 88, No. 51 / Thursday, March 16, 2023 / Rules and Regulations 16193
Backs: “The Office’s ongoing AI study (2024–2025) addresses AI‑generated outputs and training on copyrighted works.”
21nist.govGovernment
Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile
Backs: “Stand up a governance system: document model/data lineage, testing, red‑teaming, and human‑oversight plans aligned to NIST AI RMF/GenAI Profile or ISO/IEC 42001; expect audits/impact assessments for high‑risk or consequential uses.”
22europa.euGovernment
AI Act | Shaping Europe’s digital future
Backs: “Provide transparency and user rights where required: notices, opt‑outs, human review/appeal mechanisms, and synthetic‑content disclosure/watermarking where laws require it (e.g., EU AI Act transparency and certain state ADMT rules).”