What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Here’s a concise snapshot of the main, currently operative rules and guardrails for AI systems as of September 28, 2026, grouped by where they apply and what they cover.

United States – federal

•Federal agencies’ use of AI: OMB’s M‑24‑10 requires every executive agency to stand up AI governance, inventory and manage “safety- or rights‑impacting” uses, implement minimum risk controls, and publish compliance plans. It operationalizes NIST’s AI Risk Management Framework across government.[1]

•Consumer protection and fraud:

•FCC declared AI‑generated voices in robocalls illegal under the TCPA, enabling fines and enforcement (Declaratory Ruling adopted February 8, 2024).[2]

•FTC finalized an impersonation rule and proposed expansions to cover AI‑enabled impersonation of individuals; it also finalized a rule banning fake reviews (including AI‑generated).[3]

•Four agencies (FTC, DOJ Civil Rights, CFPB, EEOC) jointly reaffirmed there’s “no AI exemption” from existing anti‑discrimination and consumer‑protection laws.[4]

•Finance, employment:

•CFPB guidance makes clear lenders must give specific, accurate adverse‑action reasons even when using “black‑box” AI models. EEOC technical assistance clarifies Title VII applies to AI‑assisted hiring/selection.[5]

•Health/medical devices:

•FDA finalized guidance on Predetermined Change Control Plans (PCCPs) so AI‑enabled devices can update models safely without re‑filing each time; subsequent materials explain implementation.[6]

•Executive Orders:

•EO 14110 (Oct 30, 2023) was rescinded on Jan 20, 2025; the current administration issued EO 14409 (June 2, 2026) emphasizing cybersecurity collaboration and voluntary coordination around “frontier models.”[7]

•Voluntary but widely used standards:

•NIST AI Risk Management Framework 1.0 and its 2024 Generative AI Profile guide risk controls, measurements, and governance; AIRC supports implementation.[8]

United States – state and local

•Colorado Artificial Intelligence Act (SB 24‑205): imposes duties on “developers” and “deployers” of high‑risk AI to prevent algorithmic discrimination; phased obligations start in 2025–2026, with AG rulemaking through 2026–2027.[9]

•California CPPA regulations (effective Jan 1, 2026): require risk assessments, annual cybersecurity audits for certain businesses, and give consumers access and opt‑out rights for Automated Decisionmaking Technology (ADMT).[10]

•NYC Local Law 144 (in force): employers using automated employment decision tools must obtain an annual independent bias audit, post results, and give candidate/employee notice.[11]

•Utah Artificial Intelligence Policy Act (SB 149, 2024, amended): disclosure duties when people interact with generative AI in regulated/consumer contexts; establishes an AI Policy Office and sandbox.[12]

•Tennessee ELVIS Act (2024): expands right‑of‑publicity to protect voice and likeness against AI cloning/deepfakes.[13]

•Plus targeted hiring/biometrics rules, e.g., Illinois’ Artificial Intelligence Video Interview Act (notice/consent/deletion when AI analyzes interview videos) and Maryland’s consent for facial recognition in interviews.[14]

European Union

•EU AI Act: entered into force Aug 1, 2024; most rules began applying Aug 2, 2026, with staged deadlines. Banned practices apply earlier; high‑risk obligations phase in through Dec 2, 2027 (stand‑alone) and Aug 2, 2028 (embedded). GPAI/transparency duties and governance ramp up before full high‑risk application.[15]

•Digital Services Act (already in effect): imposes platform accountability, transparency over recommender systems/ads, and extra duties for VLOPs/VLOSEs.[16]

•GDPR Article 22: limits solely automated decisions with legal/similar effects and provides data‑subject safeguards.[17]

•Updated Product Liability Directive (2024/2853): clarifies software/AI are “products” for strict‑liability purposes and addresses failure to provide security updates.[18]

United Kingdom

•No horizontal AI statute yet; the government’s “pro‑innovation” approach uses existing regulators (e.g., ICO, CMA, MHRA) with coordination guidance; the UK has stood up an AI Safety Institute.[19]

China

•Binding rules on GenAI providers to the public (effective Aug 15, 2023) plus earlier “deep synthesis” and algorithmic‑recommendation regulations; obligations include content controls, security assessments, and filings for certain services.[20]

Canada

•No federal AI act in force; federal efforts to pass AIDA ended with earlier parliamentary resets. AI use is largely governed via privacy law (PIPEDA and provincial regimes) and regulator guidance (OPC’s principles on generative AI), plus sectoral rules.[21]

International instruments (non‑domestic but influential)

•Council of Europe Framework Convention on AI (adopted May 17, 2024; opened for signature Sept 5, 2024): a binding treaty framework on human rights, democracy, and rule of law in AI.[22]

•UN General Assembly resolution (Mar 2024): urges safe, secure, trustworthy AI to advance sustainable development; non‑binding but sets global expectations.[23]

•OECD AI Principles (2019, updated 2024) and G7 Hiroshima Process Guiding Principles and voluntary Code of Conduct for developers of advanced AI (Oct 2023).[24]

Technical standards and assurance (used by regulators and buyers)

•NIST AI RMF 1.0 (+ 2024 GAI Profile) widely referenced in U.S. policy and procurement.[8]

•ISO/IEC 42001:2023 (AI management systems) and ISO/IEC 23894:2023 (AI risk management) are the leading global standards organizations certify against or align to; ISO/IEC 5338:2023 covers AI life‑cycle processes.[25]

What accountability looks like in practice

•Regulatory enforcement under existing laws (e.g., FTC deceptive practices, SEC “AI‑washing,” CFPB/EEOC anti‑discrimination, FCC robocalls) is already active.[26]

•Safety, transparency, and documentation duties are becoming concrete in sectoral regimes (e.g., FDA PCCPs for AI‑enabled devices) and in comprehensive frameworks (EU AI Act) with audits, risk management, and conformity assessment.[6]

•Civil liability is evolving: in the EU, strict‑liability rules now expressly cover software/AI products; in U.S. states, right‑of‑publicity and targeted AI statutes (e.g., Tennessee, Illinois, Colorado) create new private and public remedies.[18]

If you tell me your role (e.g., model developer, deployer in hiring/health/finance, or public‑sector user) and where you operate, I can map your specific obligations and the timelines you need to hit.

3.[Trade Regulation Rule on Impersonation of Government and Businesses, 15017-15031 [2024-04335] :: Federal Trade Commission :: Agencies And Commissions :: Regulation Tracker :: Justia](https://regulations.justia.com/regulations/fedreg/2024/03/01/2024-04335.html?utm_source=openai)

9.[SB 24-205

Legislative Council Staff
Nonpartisan](https://content.leg.colorado.gov/sites/default/files/documents/2024A/bills/fn/2024a_sb205_00.pdf?utm_source=openai)

21.[AI Laws

of the World](https://intelligence.dlapiper.com/artificial-intelligence/guide.pdf?utm_source=openai)

Citations (26)

1whitehouse.govGovernment
EXECUTIVE OFFICE OF THE PRESIDENT
Backs: “It operationalizes NIST’s AI Risk Management Framework across government.”
2fcc.govGovernment
FCC NEWS from the Federal Communications Commission
Backs: “FCC declared AI‑generated voices in robocalls illegal under the TCPA, enabling fines and enforcement (Declaratory Ruling adopted February 8, 2024).”
3justia.comEncyclopedias and reference
Trade Regulation Rule on Impersonation of Government and Businesses, 15017-15031 [2024-04335] :: Federal Trade Commission :: Agencies And Commissions :: Regulation Tracker :: Justia
Backs: “FTC finalized an impersonation rule and proposed expansions to cover AI‑enabled impersonation of individuals; it also finalized a rule banning fake reviews (including AI‑generated).”
4ftc.govGovernment
FTC Chair Khan and Officials from DOJ, CFPB and EEOC Release Joint Statement on AI | Federal Trade Commission
Backs: “Four agencies (FTC, DOJ Civil Rights, CFPB, EEOC) jointly reaffirmed there’s “no AI exemption” from existing anti‑discrimination and consumer‑protection laws.”
5consumerfinance.govGovernment
Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms | Consumer Financial Protection Bureau
Backs: “EEOC technical assistance clarifies Title VII applies to AI‑assisted hiring/selection.”
6fda.govGovernment
Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions | FDA
Backs: “FDA finalized guidance on Predetermined Change Control Plans (PCCPs) so AI‑enabled devices can update models safely without re‑filing each time; subsequent materials explain implementation.”
7nist.govGovernment
Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence | NIST
Backs: “EO 14110 (Oct 30, 2023) was rescinded on Jan 20, 2025; the current administration issued EO 14409 (June 2, 2026) emphasizing cybersecurity collaboration and voluntary coordination around “frontier models.””
8nist.govGovernment
Artificial Intelligence Risk Management Framework (AI RMF 1.0) | NIST
Backs: “NIST AI Risk Management Framework 1.0 and its 2024 Generative AI Profile guide risk controls, measurements, and governance; AIRC supports implementation.”
9colorado.govGovernment
SB 24-205 Legislative Council Staff Nonpartisan
Backs: “Colorado Artificial Intelligence Act (SB 24‑205): imposes duties on “developers” and “deployers” of high‑risk AI to prevent algorithmic discrimination; phased obligations start in 2025–2026, with AG rulemaking through 2026–2027.”
10ca.govGovernment
California Finalizes Regulations to Strengthen Consumers' Privacy
Backs: “California CPPA regulations (effective Jan 1, 2026): require risk assessments, annual cybersecurity audits for certain businesses, and give consumers access and opt‑out rights for Automated Decisionmaking Technology (ADMT).”
11nyc.govGovernment
Automated Employment Decision Tools (AEDT) - DCWP
Backs: “NYC Local Law 144 (in force): employers using automated employment decision tools must obtain an annual independent bias audit, post results, and give candidate/employee notice.”
12utah.govGovernment
Enrolled Copy S.B. 149
Backs: “Utah Artificial Intelligence Policy Act (SB 149, 2024, amended): disclosure duties when people interact with generative AI in regulated/consumer contexts; establishes an AI Policy Office and sandbox.”
13tn.govGovernment
PHOTOS: Gov. Lee Signs ELVIS Act Into Law
Backs: “Tennessee ELVIS Act (2024): expands right‑of‑publicity to protect voice and likeness against AI cloning/deepfakes.”
14ilga.govGovernment
Illinois General Assembly - -
Backs: “Plus targeted hiring/biometrics rules, e.g., Illinois’ Artificial Intelligence Video Interview Act (notice/consent/deletion when AI analyzes interview videos) and Maryland’s consent for facial recognition in interviews.”
15europa.euGovernment
AI Act | Shaping Europe’s digital future
Backs: “GPAI/transparency duties and governance ramp up before full high‑risk application.”
16europa.euGovernment
Regulation - 2022/2065 - IT - DSA - EUR-Lex
Backs: “Digital Services Act (already in effect): imposes platform accountability, transparency over recommender systems/ads, and extra duties for VLOPs/VLOSEs.”
17europa.euGovernment
Regulation - 2016/679 - EN - gdpr - EUR-Lex
Backs: “GDPR Article 22: limits solely automated decisions with legal/similar effects and provides data‑subject safeguards.”
18europa.euGovernment
Directive (EU) 2024/2853 of the European Parliament and of the Council of 23 October 2024 on liability for defective products and repealing Council Directive 85/374/EEC (Text with EEA relevance)
Backs: “Updated Product Liability Directive (2024/2853): clarifies software/AI are “products” for strict‑liability purposes and addresses failure to provide security updates.”
19gov.ukGovernment
A pro-innovation approach to AI regulation: government response - GOV.UK
Backs: “No horizontal AI statute yet; the government’s “pro‑innovation” approach uses existing regulators (e.g., ICO, CMA, MHRA) with coordination guidance; the UK has stood up an AI Safety Institute.”
20loc.govGovernment
China: Generative AI Measures Finalized | Library of Congress
Backs: “Binding rules on GenAI providers to the public (effective Aug 15, 2023) plus earlier “deep synthesis” and algorithmic‑recommendation regulations; obligations include content controls, security assessments, and filings for certain services.”
21dlapiper.comCompanies
AI Laws of the World
Backs: “AI use is largely governed via privacy law (PIPEDA and provincial regimes) and regulator guidance (OPC’s principles on generative AI), plus sectoral rules.”
22coe.intGovernment
Committee on Artificial Intelligence (CAI) - Artificial Intelligence
Backs: “Council of Europe Framework Convention on AI (adopted May 17, 2024; opened for signature Sept 5, 2024): a binding treaty framework on human rights, democracy, and rule of law in AI.”
23un.orgGovernment
General Assembly Adopts Landmark Resolution on Steering Artificial Intelligence towards Global Good, Faster Realization of Sustainable Development | Meetings Coverage and Press Releases
Backs: “UN General Assembly resolution (Mar 2024): urges safe, secure, trustworthy AI to advance sustainable development; non‑binding but sets global expectations.”
24oecd.orgGovernment
AI principles | OECD
Backs: “OECD AI Principles (2019, updated 2024) and G7 Hiroshima Process Guiding Principles and voluntary Code of Conduct for developers of advanced AI (Oct 2023).”
25iso.orgNonprofits and think tanks
ISO - Artificial intelligence
Backs: “ISO/IEC 42001:2023 (AI management systems) and ISO/IEC 23894:2023 (AI risk management) are the leading global standards organizations certify against or align to; ISO/IEC 5338:2023 covers AI life‑cycle processes.”
26sec.govGovernment
SEC.gov | SEC Charges Two Investment Advisers with Making False and Misleading Statements About Their Use of Artificial Intelligence
Backs: “Regulatory enforcement under existing laws (e.g., FTC deceptive practices, SEC “AI‑washing,” CFPB/EEOC anti‑discrimination, FCC robocalls) is already active.”