I'll map the current rules governing how AI systems are built, deployed and held accountable — starting with a sweep of global frameworks.
There is no single global law for how AI systems like me are built, deployed, or held accountable. As of 2026, governance is a patchwork of binding regulations, voluntary frameworks, and emerging state/country-level laws:
1. International & Voluntary Frameworks
These are not legally binding in most jurisdictions but are widely used as the baseline for accountability:
•NIST AI Risk Management Framework (AI RMF 1.0, Jan 2023) - The closest thing the United States has to a shared definition of tested AI. It is voluntary but the de-facto US baseline, built on four functions: Govern (org-level policy and accountability, cross-cutting), Map (establish context), Measure (benchmark and track risks), and Manage (prioritize, treat, monitor).
•Desired characteristics of a trustworthy AI system under the framework include being valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; and fair.
•Requires documented governance structures, transparent risk tolerances, and clear accountability for AI system design, deployment, and decommissioning.
•ISO/IEC 42001 - AI Management System - A certifiable AI management system with continual improvement, listed alongside NIST AI RMF and the EU AI Act as a key standard. The common 2026 pattern for AI vendors selling into regulated buyers is SOC 2 plus ISO/IEC 42001, with controls harmonized.
•OECD AI Principles are also frequently referenced as foundational principles, implemented through national policies.
2. European Union - EU AI Act (Regulation 2024/1689)
The most comprehensive binding law to date. It establishes a risk-based structure with prohibited uses, obligations for high-risk systems, transparency requirements for certain AI-generated content, and governance.
Approved in March 2024 and effective from August, the Act entered into force on 1 August 2024. Its obligations are being phased in between 2025 and 2027:
•February 2, 2025: Prohibited AI practices banned; AI literacy obligations apply. The rules on prohibited practices (Article 5) went into effect, prohibiting manipulative or deceptive AI techniques, untargeted facial data scraping, exploitative systems targeting vulnerable groups and certain forms of biometric categorization and emotion recognition.
•August 2, 2025: General-purpose AI (GPAI) rules apply; governance structure established. Stricter obligations will apply to general-purpose models from August 2025, including mandatory documentation of training data. GPAI model obligations (Art. 51-55) take effect.
•August 2, 2026: Main deadline: All other provisions apply, including high-risk AI system requirements. High-risk AI system requirements take effect.
For providers and deployers of high-risk systems the Act imposes enforceable requirements including traceability: the ability to trace what an AI system did and why, and authority provenance: demonstrating who authorized an AI action, plus automatic recording of high-risk AI events (Art. 12) and transparency obligations for limited-risk systems.
A later amendment, the "Digital Omnibus on AI" (Regulation (EU) 2026/1744, in force 27 July 2026) deferred the high-risk regime to 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
Non-compliance faces enforcement action from national AI authorities, which are now fully operational.
3. United States - Federal Level
There is no comprehensive federal AI statute as of June 2026, and the federal posture is deregulatory.
•Biden EO 14110 (October 2023) was the most comprehensive federal directive but was Revoked January 20, 2025.
•Trump EO 14179 (January 2025): Revoked Biden EO. Policy goal: "sustain and enhance America's global AI dominance". It directs policy favoring AI innovation over regulation, removes safety reporting requirements for foundation model developers, and tasks agencies with removing barriers. Immediately upon returning to office, President Trump eliminated the Biden Administration's overreaching AI policies, and in July 2025 released an AI Action Plan which called for examining and removing onerous regulations.
•Executive Order 14365 (December 11, 2025): "Ensuring a National Policy Framework for Artificial Intelligence". It frames state AI regulation as an obstacle to U.S. competitiveness and directs the executive branch to challenge it, including directing a DOJ task force to challenge state AI laws on preemption grounds, and establishing an AI Litigation Task Force inside the Department of Justice, active since January 2026. A proposed federal moratorium on state laws did not pass.
NIST AI RMF remains the voluntary federal touchstone.
4. United States - State Level
That leaves a state patchwork:
•Colorado AI Act (SB 24-205) — algorithmic-discrimination duties for developers and deployers of high-risk AI. It establishes a shared responsibility model where developers bear responsibility for how systems are designed, trained, and documented, while deployers are accountable for how they implement, monitor, and use these systems. Originally effective in 2026, it was amended and delayed to June 30, 2026, and then repealed and replaced by SB 26-189 (signed 14 May 2026) with a new framework taking effect 1 January 2027. It was the first US state law to introduce "High-Risk AI System" and is the only state law named in the federal EO.
•California - The most active state:
•Transparency in Frontier AI Act (SB 53, effective 1 January 2026) imposes safety/transparency duties on frontier developers, requiring frontier-model transparency and incident reporting
•AI Training Data Transparency (AB 2013) effective Jan 1, 2026 - publish a high-level summary of generative-AI training data
•AI Transparency Act (SB 942) effective Jan 1, 2026 - AI content disclosure/labeling
•Also CCPA ADM Regulations effective Jan 1, 2027
•Texas - Responsible AI Governance Act (TRAIGA), effective 1 January 2026, enforced since January 2026.
Other active laws include New York RAISE Act (December 2025), Connecticut SB 5 (October 1, 2026), and healthcare AI laws in Indiana, Utah, and Washington.
5. Other Jurisdictions
•United Kingdom: No single AI statute. It deliberately avoids a single AI statute and instead existing regulators (FCA, ICO, Ofcom, CMA) apply five cross-cutting AI principles within their existing mandates. The approach is voluntary, pro-innovation, principle-based, with sector regulators applying principles within existing mandates. The five core principles finalized in March 2025 are: safety, transparency, fairness, accountability, and contestability.
•China: Multiple binding regulations already in force governing algorithmic recommendations, deepfakes, and generative AI, with mandatory government filing requirements. The three key regulations govern content generation, deepfakes, recommendation algorithms, and security review, including the Generative AI Measures, Deep Synthesis Rules, and Recommendation Algorithm Rules.
In general, accountability mechanisms across these regimes include: risk classification, pre-deployment impact assessments and conformity assessments, data governance and documentation of training data, logging/traceability, human oversight, transparency/labeling of AI-generated content, and post-deployment monitoring and incident reporting.