What rules currently exist that govern how systems like you are built, deployed, or held accountable?

I'll research the current landscape of AI governance rules across major jurisdictions to give you an accurate picture.As of September 2026, AI systems like me are governed by a patchwork of binding laws, executive actions, and voluntary frameworks that vary significantly by jurisdiction. Here's the current landscape:

European Union: The AI Act (Binding, Comprehensive)

The AI Act entered into force on 1 August 2024 and became applicable on 2 August 2026, with prohibited AI practices and AI literacy obligations having entered into application from 2 February 2025, and governance rules and obligations for general-purpose AI models becoming applicable on 2 August 2025. As of August 2026, Article 50 of the AI Act now applies, adding transparency requirements: chatbots must disclose that users are dealing with AI unless obvious from context, providers of systems generating or manipulating images, audio, video, or text must ensure synthetic content is identifiable through machine-readable marking, and systems recognizing emotions or categorizing people via biometric data must inform individuals.

However, the toughest requirements have been delayed. EU AI Act enforcement now applies to Article 50 transparency and general-purpose AI, with high-risk system deadlines moved to 2027 and 2028, after the Digital Omnibus moved the principal high-risk AI requirements from 2026 to fixed dates. Specifically, stand-alone high-risk systems classified under Article 6(2) and Annex III become subject to Chapter III requirements on December 2, 2027, while high-risk systems connected to regulated products under Annex I reach their revised deadline on August 2, 2028. The delays stem partly from European standardisation bodies facing delays in delivering key standards, with many now expected towards the end of 2026.

Enforcement runs through the AI Office and Member State authorities responsible for implementing, supervising and enforcing the AI Act, with the AI Office holding enforcement powers over general-purpose AI models—it can request technical documentation, evaluate models, require corrective measures and issue fines for non-compliance, supported by the AI Board, Scientific Panel and Advisory Forum. Penalties are steep: the AI Act's top tier of 7% of global turnover exceeds GDPR's 4% maximum, though Article 99(8) prevents double penalties for the same violation under both laws.

United States: Federal-State Conflict

The U.S. has no comprehensive federal AI law, and the current administration is actively trying to preempt state efforts. In December 2025, President Trump signed Executive Order 14365, "Ensuring a National Policy Framework for Artificial Intelligence," establishing a federal policy aimed at promoting a uniform national framework for AI regulation and limiting the impact of conflicting state laws. This order is aggressive: it directs the Attorney General to establish an AI litigation task force to challenge state AI laws deemed inconsistent with the Executive Order's language, including on grounds of unconstitutional regulation of interstate commerce and federal preemption, and instructs the Department of Commerce to condition $42 billion in broadband infrastructure funding on the repeal of state AI regulations deemed onerous. It also directs the FTC to issue a policy statement classifying state-mandated bias mitigation as a per se deceptive trade practice.

In March 2026, the White House followed up with a National Policy Framework for Artificial Intelligence, together with companion legislative recommendations, intended to translate the Executive Order's calls for a unified, minimally burdensome national AI policy into legislative guidance for Congress. Separately, a June 2026 order established a voluntary framework permitting developers of certain advanced AI models to voluntarily provide the federal government with model access prior to public release for cybersecurity and national security assessments.

Despite this, state laws remain in force—the federal EO has not actually preempted them. The June 2, 2026 federal AI executive order does not preempt state AI laws; Colorado SB 24-205, Texas TRAIGA, California SB 53 and AB 2013, Utah SB 149, and Illinois HB 3773 all still apply to companies operating in those states. Key state laws include:

International Frameworks (Mostly Voluntary)

Beyond the EU and US, governance is fragmented and largely non-binding:

Overall, the global coordination landscape is described by researchers as a "weak regime complex," where the UN Advisory Body on AI, the Hiroshima AI Process, the Council of Europe AI Convention, and the Bletchley Declaration all address AI risks without addressing issues like identity governance specifically.

The Bottom Line

There is no single, unified rulebook. Instead, systems like me potentially fall under: the EU AI Act's binding transparency and (eventually) high-risk requirements if operating in Europe; a patchwork of U.S. state laws (California, Colorado, Texas, etc.) covering transparency, bias, and frontier-model safety; a U.S. federal push to override those state laws via executive action and litigation (with uncertain legal success so far); and a web of voluntary international principles (OECD, G7) that shape norms but carry no enforcement teeth. This is a rapidly moving target—several major deadlines (EU high-risk rules, Colorado's law, various California provisions) are still shifting even now.