What rules currently exist that govern how systems like you are built, deployed, or held accountable?
Short answer as of September 27, 2026: there isn’t one global “AI law.” Instead, a patchwork of binding laws, agency rules, enforcement actions, and voluntary standards governs how modern AI is built, deployed, and held to account. Here are the headline regimes and what they require.
Global reference points
European Union (binding)
United States (federal)
United States (state and local)
United Kingdom
China
Standards and assurance you’ll see in contracts and audits
What this means in practice
Want this tailored? Tell me where you operate and your AI use cases (e.g., hiring, underwriting, chatbots, health, education). I can map the exact obligations, effective dates, and the shortest path to compliance.
Citations (21)
- General Assembly Adopts Landmark Resolution on Steering Artificial Intelligence towards Global Good, Faster Realization of Sustainable Development | Meetings Coverage and Press Releases
Backs: “In March 2024 the UN General Assembly unanimously adopted a non‑binding resolution urging “safe, secure and trustworthy” AI and human‑rights safeguards; governments now cite it when shaping national rules.”
- G7 Leaders' Statement on the Hiroshima AI Process | Ministry of Foreign Affairs of Japan
Backs: “Voluntary guiding principles and a developer Code of Conduct for “advanced” AI (including foundation/gen‑AI) covering risk management, testing/red‑teaming, transparency, and incident reporting.”
- AI principles | OECD
Backs: “Intergovernmental principles (updated May 2024) on inclusive growth, human‑centered values, transparency, robustness, and accountability; widely used by regulators as a baseline.”
- Timeline - Artificial intelligence - Consilium
Backs: “Bans on “unacceptable‑risk” uses have applied since Feb 2, 2025; general‑purpose AI (GPAI) obligations since Aug 2, 2025; high‑risk use‑case rules apply Dec 2, 2027 (stand‑alone) and Aug 2, 2028 (embedded in regulated products).”
- Navigating the AI Act | Shaping Europe’s digital future
Backs: “Transparency: chatbots must disclose they’re AI; deepfakes and certain AI‑generated text/audio/video must be labeled; generative systems must mark outputs in machine‑readable form; specific notice duties for emotion recognition/biometric categorization. Guidance issued in 2026 to help comply.”
- Directive - 2024/2853 - EN - Product Liability Directive - EUR-Lex
Backs: “In force since Dec 8, 2024, with application via national transposition; affects AI providers whose products cause damage.”
- EXECUTIVE OFFICE OF THE PRESIDENT
Backs: “Even if you don’t sell to government, it’s a de‑facto baseline many organizations align to.”
- Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence | NIST
Backs: “President Biden’s EO 14110 (Oct 30, 2023) jump‑started federal AI policy but was rescinded on Jan 20, 2025 and superseded by later directives; some reporting/testing efforts continue under subsequent orders and agency actions.”
- Artificial Intelligence Risk Management Framework (AI RMF 1.0) | NIST
Backs: “NIST also leads the U.S. AI Safety Institute work on evaluations/red‑teaming.”
- Rite Aid Banned from Using AI Facial Recognition After FTC Says Retailer Deployed Technology without Reasonable Safeguards | Federal Trade Commission
Backs: “Rite Aid was banned for five years from using facial‑recognition for security after deploying it without adequate safeguards. Claims about what “AI” can do must be substantiated.”
- FTC Chair Khan and Officials from DOJ, CFPB and EEOC Release Joint Statement on AI | Federal Trade Commission
Backs: “EEOC guidance explains how Title VII applies to AI hiring/selection tools.”
- Federal Register / Vol. 89, No. 88 / Monday, May 6, 2024 / Rules and Regulations
Backs: “Courts have partially affected portions, but core protections remain in effect.”
- California Finalizes Regulations to Strengthen Consumers' Privacy
Backs: “Under the CCPA/CPRA, final rules require certain businesses to conduct privacy risk assessments and cybersecurity audits, and create access/opt‑out rights plus notices for “automated decision‑making technology (ADMT),” with full ADMT duties for “significant decisions” by Jan 1, 2027.”
- SB26-189 Automated Decision-Making Technology | Colorado General Assembly
Backs: “Chatbot law adds teen‑safety, disclosure, and crisis‑response requirements.”
- Automated Employment Decision Tools (AEDT) - DCWP
Backs: “Since July 5, 2023, employers using automated employment decision tools in NYC must complete an annual, independent bias audit, publish a summary, and give candidates notice.”
- 103-0769
Backs: “Powerful private right of action with statutory damages; amended Aug 2, 2024 to cap “per‑scan” stacking—now generally one recovery per person for repeated collections/disclosures by the same method/recipient; electronic consent expressly allowed. Still heavily litigated.”
- PHOTOS: Gov. Lee Signs ELVIS Act Into Law
Backs: “Effective July 1, 2024; expands right‑of‑publicity to prohibit unauthorized AI voice/likeness cloning and targets tools primarily designed for such misuse.”
- A pro-innovation approach to AI regulation - GOV.UK
Backs: “The UK AI Safety (now Security) Institute publishes evaluation approaches and works with regulators; sector laws (e.g., data protection, online safety, product safety) apply to AI uses.”
- 互联网信息服务算法推荐管理规定_中央网络安全和信息化委员会办公室
Backs: “These impose filing/labeling requirements, security assessments, content controls, and user rights such as opt‑out of algorithmic recommendation.”
- ISO/IEC 42001:2023 - AI management systems
Backs: “First certifiable international standard for governing AI across an organization (policy, risk, controls, continuous improvement). Often paired with NIST AI RMF in practice.”
- AI Act | Shaping Europe’s digital future
Backs: “If you develop or ship models/systems: expect documentation, data/copyright diligence, evaluation/red‑teaming, security/incident processes, and, in the EU, transparency and GPAI obligations on a fixed schedule (with high‑risk regimes to follow).”