What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Short answer: there’s no single global rulebook. Today’s guardrails are a patchwork of binding laws and agency enforcement, plus non‑binding frameworks and technical standards that many builders follow. Here’s the “what exists now” picture as of September 26, 2026.

Binding laws and government enforcement

•European Union (EU AI Act). In force since August 1, 2024, with phased applicability: bans on certain “unacceptable‑risk” AI apply first; general transparency and rules for general‑purpose AI (GPAI) apply next; most high‑risk obligations apply later (Dec 2, 2027 for Annex III uses; Aug 2, 2028 for AI embedded in regulated products). Penalties can reach the greater of €35M or 7% of worldwide turnover for prohibited practices. High‑risk systems must meet requirements on risk management, data governance, logging, technical documentation, human oversight, robustness/cybersecurity, and deployers in specified contexts must perform a Fundamental Rights Impact Assessment (FRIA).[1]

•United States (federal). There’s no omnibus AI statute yet. Federal agencies use existing laws:

•Executive Order 14110 (Oct 30, 2023) set a government‑wide agenda on safe, secure, trustworthy AI. OMB’s M‑24‑10 (Mar 2024) requires federal agencies to inventory, govern, and minimize risks for “rights‑impacting” and “safety‑impacting” AI. NIST publishes the voluntary AI Risk Management Framework (AI RMF) and houses the U.S. AI Safety Institute to develop evaluation and safety methods.[2]

•Enforcement under existing statutes: the FTC, DOJ, CFPB, and EEOC jointly affirmed in April 2023 that their consumer protection, fair competition, fair lending, and anti‑discrimination authorities apply to AI. CFPB guidance under ECOA/Reg B makes clear that creditors must provide specific adverse‑action reasons even when AI models are used.[3]

•United States (state/local). States and some cities have moved first:

•Colorado AI laws. SB24‑205 (the “Colorado AI Act”) imposes reasonable‑care duties, risk programs, impact assessments, notices, and appeal rights for “high‑risk” AI; enforcement begins in 2026. In 2026, Colorado also enacted the “Conversational AI Service Operator Requirements” (HB26‑1263, the “Chatbot Safety Act”) adding disclosures, youth protections and reporting for chatbot operators.[4]

•New York City Local Law 144 requires annual independent bias audits and notices for automated employment decision tools used in hiring/promotion.[5]

•Voice/deepfake and content rules. Tennessee’s ELVIS Act (2024) updated right‑of‑publicity protections to cover AI voice/image cloning; California (2024–2026) adopted laws targeting sexually explicit deepfakes, watermarking/labeling, and disclosure in AI‑generated advertising.[6]

•United Kingdom. No comprehensive AI act yet; the Government’s “pro‑innovation” approach empowers existing regulators to apply cross‑cutting principles, while the UK AI Safety Institute (AISI) leads model evaluations and safety research.[7]

•China. Binding national rules already cover algorithmic recommendation (in force Mar 1, 2022), “deep synthesis” (effective Jan 10, 2023), and public‑facing generative‑AI services (effective Aug 15, 2023), including filing, security assessments, labeling, and content controls for providers.[8]

•Council of Europe. The Framework Convention on AI, Human Rights, Democracy and the Rule of Law (a binding treaty) was adopted May 17, 2024 and opened for signature Sept 5, 2024; it obligates parties to align AI lifecycles with human‑rights and rule‑of‑law safeguards.[9]

•Canada. A federal AI bill (C‑27, including the Artificial Intelligence and Data Act) has not entered into force; meanwhile, the government issued a voluntary Code of Conduct for advanced generative AI which many firms reference.[10]

Soft‑law and multilateral principles

•OECD AI Principles (2019, updated 2024) and UNESCO’s Recommendation on the Ethics of AI (2021) guide many national policies and procurement rules. The G7’s Hiroshima Process produced voluntary guiding principles and a code of conduct for developers of advanced AI. The UN General Assembly adopted a non‑binding resolution in March 2024 calling for safe, secure and trustworthy AI for sustainable development, and the 2024 Global Digital Compact set out high‑level commitments on digital and AI governance.[11]

Technical standards and de facto accountability baselines

•NIST AI RMF 1.0 (USA) is widely used by companies and governments for risk management; NIST’s AI Safety Institute coordinates model evaluations and measurement science. ISO/IEC 42001:2023 (AI management systems) and ISO/IEC 23894:2023 (AI risk management) give auditable structures similar to ISO 27001 for information security. For content provenance/labeling, the C2PA technical specification is emerging as the cross‑industry standard used by many media and AI providers.[12]

What these rules expect from AI builders and deployers (common threads)

•Do structured risk management and impact assessment (including FRIAs in the EU for certain deployers/uses).

•Use high‑quality, governed datasets; document models and design choices; maintain logs for traceability.

•Build in human oversight; evaluate and red‑team safety/security before and after release; monitor and correct post‑market issues.

•Be transparent: disclosures/labeling when people interact with AI or see AI‑generated content; user notices, appeals and explanations in consequential decisions (e.g., credit, employment).

•Protect rights (nondiscrimination, privacy) and security; maintain incident reporting and cooperate with regulators.

These elements are codified most comprehensively in the EU AI Act and, in the U.S., enforced piecemeal under existing laws and federal guidance.[13]

If you tell me your sector and where you operate (e.g., “we’re a U.S. fintech using LLMs for support triage” or “we deploy models in the EU healthcare market”), I can translate this into a concrete compliance checklist and timeline.

Citations (13)

1europa.euGovernment
Commission starts enforcing AI Act rules and new transparency requirements on 2 August | Shaping Europe’s digital future
Backs: “High‑risk systems must meet requirements on risk management, data governance, logging, technical documentation, human oversight, robustness/cybersecurity, and deployers in specified contexts must perform a Fundamental Rights Impact Assessment (FRIA).”
2govinfo.govGovernment
Executive Orders EO 14110
Backs: “AI Safety Institute to develop evaluation and safety methods.”
3ftc.govGovernment
FTC Chair Khan and Officials from DOJ, CFPB and EEOC Release Joint Statement on AI | Federal Trade Commission
Backs: “CFPB guidance under ECOA/Reg B makes clear that creditors must provide specific adverse‑action reasons even when AI models are used.”
4colorado.govGovernment
SB24-205 Consumer Protections for Artificial Intelligence | Colorado General Assembly
Backs: “In 2026, Colorado also enacted the “Conversational AI Service Operator Requirements” (HB26‑1263, the “Chatbot Safety Act”) adding disclosures, youth protections and reporting for chatbot operators.”
5nyc.govGovernment
Automated Employment Decision Tools (AEDT) - DCWP
Backs: “New York City Local Law 144 requires annual independent bias audits and notices for automated employment decision tools used in hiring/promotion.”
6tn.govGovernment
PHOTOS: Gov. Lee Signs ELVIS Act Into Law
Backs: “California (2024–2026) adopted laws targeting sexually explicit deepfakes, watermarking/labeling, and disclosure in AI‑generated advertising.”
7gov.ukGovernment
A pro-innovation approach to AI regulation: government response - GOV.UK
Backs: “No comprehensive AI act yet; the Government’s “pro‑innovation” approach empowers existing regulators to apply cross‑cutting principles, while the UK AI Safety Institute (AISI) leads model evaluations and safety research.”
8stanford.eduAcademic
Translation: Internet Information Service Algorithmic Recommendation Management Provisions – Effective March 1, 2022
Backs: “Binding national rules already cover algorithmic recommendation (in force Mar 1, 2022), “deep synthesis” (effective Jan 10, 2023), and public‑facing generative‑AI services (effective Aug 15, 2023), including filing, security assessments, labeling, and content controls for providers.”
9coe.intGovernment
Committee on Artificial Intelligence (CAI) - Artificial Intelligence
Backs: “The Framework Convention on AI, Human Rights, Democracy and the Rule of Law (a binding treaty) was adopted May 17, 2024 and opened for signature Sept 5, 2024; it obligates parties to align AI lifecycles with human‑rights and rule‑of‑law safeguards.”
10parl.caNot yet classified
Legislation at a glance - LEGISinfo - Parliament of Canada
Backs: “A federal AI bill (C‑27, including the Artificial Intelligence and Data Act) has not entered into force; meanwhile, the government issued a voluntary Code of Conduct for advanced generative AI which many firms reference.”
11oecd.orgGovernment
AI principles | OECD
Backs: “The UN General Assembly adopted a non‑binding resolution in March 2024 calling for safe, secure and trustworthy AI for sustainable development, and the 2024 Global Digital Compact set out high‑level commitments on digital and AI governance.”
12nist.govGovernment
AI Risk Management Framework | NIST
Backs: “For content provenance/labeling, the C2PA technical specification is emerging as the cross‑industry standard used by many media and AI providers.”
13europa.euGovernment
AI Act | Shaping Europe’s digital future
Backs: “These elements are codified most comprehensively in the EU AI Act and, in the U.S., enforced piecemeal under existing laws and federal guidance.”