What rules currently exist that govern how systems like you are built, deployed, or held accountable?

A patchwork of binding regulations, voluntary frameworks, executive actions, and international principles currently governs the building, deployment, and accountability of AI systems like large language models (LLMs) and general-purpose AI (GPAI). These vary significantly by jurisdiction, risk level of the system/use case, and whether the focus is on frontier/high-capability models versus narrower applications. There is no single global regime; instead, major frameworks emphasize risk-based approaches, transparency, safety/security, bias mitigation, human oversight, and liability. Existing laws (e.g., data protection, consumer protection, anti-discrimination, product liability, and intellectual property) also apply.[1]

The landscape has evolved rapidly since ~2023–2024, with the EU leading comprehensive binding rules, the US remaining more fragmented and (under recent administrations) innovation-focused with state-level activity and voluntary tools, China using targeted measures for generative AI, and international bodies providing principles. Many rules phase in over time and have extraterritorial reach if systems are placed on a market or affect users there.[2]

European Union: The AI Act (Primary Comprehensive Framework)

The EU AI Act (Regulation (EU) 2024/1689) is the world’s first comprehensive horizontal legal framework for AI. It entered into force on 1 August 2024 and applies in phases (full applicability largely from August 2026 onward, with earlier dates for prohibitions and GPAI rules; some high-risk obligations later, e.g., into 2027–2028). It uses a risk-based approach and applies extraterritorially to providers placing systems/models on the EU market (or putting them into service) regardless of location.[3]

Risk categories and rules:

General-purpose AI (GPAI) models (relevant to systems like me): Providers must maintain technical documentation (available to the AI Office/authorities), publish a sufficiently detailed summary of training content, and (if outside the EU) appoint an authorised representative. Free/open-source models have some exemptions (not for systemic risk). Models with systemic risk (presumed for high compute, e.g., training >10^25 FLOPs, or other criteria; capability-based) face additional duties: model evaluations (including adversarial testing), risk assessment/mitigation for systemic risks, cybersecurity, incident reporting, and more. Codes of Practice support compliance. GPAI rules largely applied from August 2025.[6]

Accountability and enforcement: Market surveillance authorities, the EU AI Office (especially for GPAI), AI Board, and others. Providers/deployers must report serious incidents. Fines up to €35 million or 7% of worldwide annual turnover (higher tiers for prohibited practices). Corrective actions, withdrawal, etc., possible. Post-market monitoring required.[1]

Supporting elements include the AI Pact (voluntary early compliance), standards, sandboxes, and guidance documents.

United States: Fragmented, Innovation-Oriented with State Activity and Voluntary Tools

There is no comprehensive federal AI law as of mid-to-late 2026. Federal approach has shifted toward reducing barriers to leadership/innovation (e.g., Executive Order 14179 of January 2025 rescinding prior Biden-era EO 14110 on safe/secure/trustworthy AI; later orders on national policy frameworks, challenging burdensome state laws via litigation task forces, voluntary pre-release engagement for certain frontier models on cybersecurity/national security, and AI Action Plans). Focus includes agency use/procurement guidance (OMB memos), critical infrastructure, and R&D.[7]

Key federal/voluntary elements:

State laws (dozens enacted or pending; many effective 2025–2027; federal efforts seek to limit conflicts with national policy):

Accountability: Evolving liability (some clarification that developers/deployers remain responsible); audits/assessments; AG enforcement; private rights of action in places; whistleblower protections. Federal pushback against overly restrictive state rules.

China: Targeted Measures for Generative AI and Content

No single comprehensive AI law equivalent to the EU Act. Layered approach under Cybersecurity Law, Personal Information Protection Law (PIPL), Data Security Law, plus specific measures. Cyberspace Administration of China (CAC) is central.[11]

Accountability: CAC filing/security assessments, content monitoring/responsibility of providers, penalties under broader cyber/data laws.

International Principles and Other Frameworks

Building, Deployment, and Accountability Themes

Building (development/training): Data governance/quality/provenance/legality (privacy, IP, bias minimisation); documentation of processes; risk/safety evaluations (especially frontier/systemic); compute/security thresholds triggering extra rules; ethics reviews in some places. Export controls and hardware security can apply.

Deployment: Risk classification and mitigation; transparency/labelling (AI interaction, synthetic content); human oversight; monitoring/incident reporting; conformity/registration where required; consumer rights (disclosures, opt-outs, explanations in high-stakes cases).

Accountability:

Voluntary best practices (NIST RMF, company safety frameworks, red-teaming) fill gaps and often align with or satisfy legal duties. Rules continue to evolve quickly with technology, court cases, and new legislation/guidance. For systems like LLMs, GPAI/frontier-specific rules (EU systemic risk, US/CA/NY safety frameworks, China GenAI measures) are most directly relevant, layered on general risk-based or sectoral requirements. Compliance often involves mapping use cases to risks, maintaining documentation, and monitoring for material changes. Consult legal experts for specific applications, as details (thresholds, timelines, exemptions) are nuanced and jurisdiction-specific.