I'll map the current rules governing how AI systems are built, deployed, and held accountable.
There are not yet one set of global rules for how systems like me are built, deployed and held accountable, but a fast growing patchwork of binding law, sectoral regulation, and voluntary frameworks. The main layers as of 2025-2026 are:
1. International baselines - not binding law, but the definition of "trustworthy AI"
•OECD AI Principles (2019, updated 2024) - Endorsed by ~47-50 countries and the basis for G20 principles. Five values-based principles: (1) Inclusive growth, sustainable development and well-being, (2) Respect for rule of law, human rights and democratic values, (3) Transparency and explainability, (4) Robustness, security and safety, (5) Accountability, plus five recommendations for governments to invest in R&D, foster ecosystems, shape policy, build human capacity and cooperate.
•UNESCO Recommendation on the Ethics of AI (Nov 2021) - Adopted by all 193 UNESCO member states, the broadest international consensus text on AI ethics.
•Council of Europe Framework Convention on AI, Human Rights, Democracy and the Rule of Law - Opened for signature September 2024, the first legally binding international treaty on AI.
These do not prescribe technical thresholds but emphasize human rights, transparency, accountability, risk management, provenance/labeling, and international cooperation.
2. European Union - the first comprehensive horizontal law
The EU AI Act (Regulation 2024/1689) entered into force in August 2024 with obligations phased in between 2025 and 2027.
It uses a risk-based categorization model:
•Unacceptable Risk - Prohibited: Systems that manipulate human behavior, deploy social scoring, or use untargeted biometric profiling are banned. Other prohibited practices include subliminal manipulation, exploitation of vulnerabilities, social scoring, biometric categorisation, remote biometric ID. Prohibitions under Article 5 have been in force since February 2, 2025.
•High Risk - Strict compliance: Allowed only with extensive requirements. Includes biometric ID, critical infrastructure, education, employment, access to essential services, law enforcement, migration, justice and also employment, education, essential services. Requirements include risk management, data governance, documentation, human oversight, transparency, logging, traceability and authority provenance, plus conformity assessments and fundamental rights impact assessments. Most high-risk rules apply from August 2, 2026 with some sources noting December 2027 for full high-risk regime. Fines reach €35 million or 7% of global turnover at the top tier.
•Limited Risk - Transparency only: e.g. chatbots, deepfakes, emotion recognition.
•Minimal Risk - No specific obligations.
•General-Purpose AI (GPAI) / Foundation models: Separate obligations under Articles 51-55 for transparency and documentation (more for the largest models) in force from August 2, 2025, with the AI Office now having active enforcement powers over providers.
•Transparency obligations - Article 50: Effective August 2, 2026, requiring: a chatbot serving anyone in the EU has to make clear it is a machine, a deepfake has to be disclosed, AI-generated text on matters of public interest has to say so unless human reviewed with editorial responsibility. Providers must disclose AI interactions and mark AI-generated or manipulated content with machine-readable metadata, while deployers must disclose deepfakes and emotion recognition/biometric categorisation use.
Building and accountability is also covered by the revised EU Product Liability Directive (EU) 2024/2853: it rewrote 1985 rules that only covered tangible goods and now names "operating systems, firmware, computer programs, applications or AI systems" as products, must be transposed by December 9, 2026, applies strict liability with no fault required, extends compensable harm to medically recognized psychological injury and destroyed personal data, and bars companies from limiting that liability by contract.
3. United States - no unified federal AI law, federal framework + state laws
> The U.S. hasn’t passed a unified federal AI law yet — but states aren’t waiting.
Federal:
•NIST AI Risk Management Framework (AI RMF 1.0, Jan 2023) is the primary voluntary governance framework for trustworthy AI. It organizes AI risk management across four core functions — GOVERN, MAP, MEASURE, MANAGE. It is referenced in Executive Order 14110 and state laws and enterprise procurement.
•Companion NIST AI 600-1 Generative AI Profile extends AI RMF to generative AI, focusing on governance, content provenance, pre-deployment testing, and incident disclosure.
•Executive Order 14110 "Safe, Secure, and Trustworthy Development and Use of AI" (Oct 30, 2023) - the longest executive order at 110 pages, required AI safety testing and reporting under Defense Production Act authority, mandated Chief AI Officer positions, and directed NIST to develop generative AI guidelines. It required federal agencies to align with AI RMF. Status is now noted as partially revoked/modified in 2025 - verify current status, and in a January 2025 assessment listed as rescinded.
•Sector regulators apply existing law to AI: FTC Act §5 unfair or deceptive practices, EEOC guidance on AI in employment, OCC/Federal Reserve for financial AI, etc..
State - the primary source of binding rules today:
As of 2026, AI-related legislation was already in effect in many states.
•Colorado AI Act (SB 24-205, enacted May 2024) - first-of-its-kind comprehensive state law governing development and use of AI, described as the most significant state-level legislation to date, establishing requirements for developers and deployers of high-risk AI systems.
•Texas Responsible AI Governance Act enacted June 2025 - bans unauthorized facial recognition and mandates AI tools be clearly disclosed in any public-facing systems.
•California: Transparency in Frontier AI Act and AB 2013 (2024)
•In 2023 fewer than 200 AI bills were introduced across all 50 states. In 2024 that exceeded 635, with 99 enacted.
•A proposed 10-year moratorium on state AI law in the "One Big Beautiful Bill Act" (signed July 4, 2025) was abandoned, so companies must comply with a variety of evolving state and local laws.
4. China - layered, vertical rules not one AI Act
China has built a layered set of AI regulations targeting specific categories of system or risk:
•Algorithmic recommendation regulation (March 2022), deepfake synthesis regulation (January 2023)
•Interim Measures for Generative AI Services (in force Aug 2023) govern GPAI services, covering content moderation, training data sourcing, and registration, with CAC security assessment mandatory before launch - 796 services filed as of February 2026.
•AI-Generated Content Labeling Measures + mandatory standard GB 45438-2025, effective 1 Sept 2025 — explicit labels visible to users plus implicit metadata labels, duties across providers, app-distribution platforms, and users. Formally titled "Measures for the Identification of AI-Generated Synthetic Content" adopted March 14, 2025, requiring service providers to label AI-generated material either explicitly or via metadata encoded in each file, effective September. Enforcement started Oct 1 with platforms like WeChat and Weibo adding AI-generated tags, and in April 2026 CAC took action against three prominent generative AI platforms for failing to implement mandatory content labelling.
•Network Data Security Management Regulations effective Jan 2025 and Cybersecurity Law revised in 2025.
•Interim measures on anthropomorphic interactive services effective July 15, 2026 address emotional dependency and minor protection.
5. United Kingdom - principles-based, sectoral
The UK maintains a sectoral, principles-based approach rather than a single cross-economy AI statute. Guidance tells regulators five principles to operationalize: safety/security/robustness; transparency/explainability; fairness; accountability/governance; contestability/redress. It is explicitly voluntary and non-prescriptive for regulators, intended to guide sector-specific implementation by existing regulators (ICO, FCA, Ofcom, CMA), complemented by the AI Safety/Security Institute.
6. Other jurisdictions
•South Korea - Passed AI Basic Act promulgated 21 Jan 2025; effective 22 Jan 2026, establishes national governance and trustworthiness requirements and applies to overseas conduct affecting the Korean market
•Singapore - Model AI Governance Framework (PDPC/IMDA) + AI Verify testing framework, voluntary (PDPA is binding)
7. How accountability works in practice
Across all these regimes, the pattern is consistent:
•Deploying an AI agent does not transfer liability to the agent — it concentrates accountability on the deploying organisation, under an emerging "reasonable oversight" standard.
•Final liability rests with the human principal; AI can acquire increasing agency without acquiring legal responsibility.
•California's 2026 Agent Accountability Statute explicitly forecloses defendants from arguing AI autonomously caused harm - accountability runs directly to the humans and corporations behind the software.
In short: building is governed by risk management (NIST RMF), data governance, documentation, safety testing and registration (EU, China); deployment is governed by transparency/labeling (EU Art 50, China Sept 2025 rules) and disclosure and human oversight duties; and accountability is enforced through product strict liability (EU), FTC and civil rights law (US), and direct organizational liability with fines up to 7% of global turnover in the EU and state enforcement in the US.