What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Short answer: A patchwork of binding laws, sector rules, and voluntary standards governs how AI systems are built, deployed, and held accountable. Here are the most important, up-to-date pieces, grouped by where they apply and what they require.

United States (federal)

•Federal agencies’ own AI use: OMB M‑24‑10 requires each agency to inventory AI use cases, name a Chief AI Officer, apply minimum risk controls for “rights‑impacting” AI, and publish certain uses; agencies have been implementing it across 2024–2026.[1]

•General consumer protection and deception: the FTC can police unfair or deceptive AI claims under Section 5 and, since April 2024, enforce a specific Impersonation Rule (with civil penalties) against government/business impersonation schemes; it is also moving to address AI deepfakes that impersonate individuals.[2]

•Credit and lending: the CFPB says lenders must give specific, accurate reasons for adverse actions even when decisions come from complex/ML models (ECOA/Reg B).[3]

•Banking models and AI: bank regulators updated interagency model‑risk guidance in 2026; banks must validate, monitor, and govern AI/ML models proportionate to risk.[4]

•Health/medical AI: FDA issued final guidance so AI‑enabled devices can include a “predetermined change control plan” (PCCP) that governs how models can be updated safely after approval.[5]

•Employment/civil rights: EEOC guidance explains how Title VII disparate‑impact rules apply to AI hiring/selection tools.[6]

•Securities/financial advice: the SEC’s 2023 “predictive data analytics” conflicts rule was not adopted and was withdrawn in 2025; firms still face existing fiduciary/Reg BI and supervision duties, and FINRA has reminded members how existing rules apply to GenAI.[7]

•Federal standards and testing: NIST’s AI Risk Management Framework (and its Generative AI Profile) guide risk controls; the U.S. AI Safety Institute at NIST coordinates evaluation/red‑teaming and international safety‑testing work.[8]

United States (state and local)

•New York City (Local Law 144): automated employment decision tools used for NYC jobs must undergo an annual, independent bias audit; results and candidate notices are required. Enforced since July 2023.[9]

•Colorado (2026 updates): Colorado overhauled its 2024 “AI Act.” From June 30, 2026, duties focus on “automated decision‑making technology” used for consequential decisions (employment, housing, lending, health care, etc.): developer documentation duties, deployer notices, record‑keeping, and AG enforcement under the state UDAP law; no new private right of action. Related conversational‑AI operator duties begin Jan 1, 2027.[10]

•California privacy/ADMT rules: the CPPA’s automated decisionmaking technology regulations (effective Jan 1, 2026) give consumers notice, access info, and an opt‑out for significant decisions; they also trigger privacy risk assessments and cybersecurity audits for certain processing.[11]

•Targeted hiring/biometric laws: Illinois’ AI Video Interview Act (notice, explanation, consent; reporting if AI is used to screen) and Maryland’s consent rule for facial recognition during interviews.[12]

•Political deepfakes: several states now require disclosures or restrict deceptive AI in election ads, but scope and enforcement vary.[13]

European Union

•EU AI Act (Regulation (EU) 2024/1689): a binding, risk‑based regime with bans, obligations for general‑purpose AI (GPAI) providers, and strict duties for high‑risk uses. Key dates: most transparency and GPAI model obligations enforceable Aug 2, 2026; Annex III “high‑risk” standalone system rules apply Dec 2, 2027; high‑risk AI embedded in regulated products applies Aug 2, 2028. The Commission’s AI Office leads enforcement for GPAI.[14]

•Digital Services Act (DSA): very large online platforms/search engines must assess and mitigate systemic risks, open recommender parameters to scrutiny, and submit to audits; the Commission can demand data/algorithm access and penalize non‑compliance.[15]

•Product liability: the revised Product Liability Directive explicitly covers software and AI systems and clarifies who can be liable when defects or missed security updates cause harm; Member States must transpose it by late 2026.[16]

•EU guidance and codes: the Commission has issued guidelines for Article 50 transparency and a voluntary GPAI Code of Practice to help model providers meet AI Act duties.[17]

United Kingdom

•No single AI act yet; the UK follows a regulator‑led, “pro‑innovation” approach. The CMA has set competition/consumer principles for foundation models and continues market scrutiny; regulators are issuing AI guidance under existing powers.[18]

Canada

•AIDA (the proposed federal Artificial Intelligence and Data Act within Bill C‑27) did not become law; Canada currently relies on existing privacy/civil‑rights laws and sector regulators, with further federal proposals under discussion.[19]

International soft law and standards

•OECD AI Principles (2019; updated 2024): widely adopted baseline on trustworthy AI, with an updated definition of “AI system” used across jurisdictions.[20]

•G7 Hiroshima Process: non‑binding international guiding principles and a developer Code of Conduct for advanced AI systems.[21]

•Council of Europe AI Convention (CETS No. 225): a binding human‑rights‑focused treaty opened for signature Sept 5, 2024; parties commit to safeguards across the AI lifecycle.[22]

•Technical standards used for assurance: ISO/IEC 42001 (AI management systems) and ISO/IEC 23894 (AI risk management) are being adopted and mapped to legal regimes (e.g., EU AI Act) as evidence of due diligence.[23]

What this means in practice for builders and deployers

•Governance and documentation: have an AI risk/governance program (NIST AI RMF, ISO/IEC 42001/23894), keep technical documentation, and publish specific system‑level notices where required.[8]

•Pre‑deployment testing and audits: conduct bias/fairness testing and independent audits where mandated (e.g., NYC hiring), and robust model validation in regulated sectors (banking, medical devices).[9]

•Transparency and user rights: give people clear notices, access information, opt‑outs (California ADMT rules), and, in the EU, label AI‑generated content and meet GPAI disclosure duties on data/copyright.[11]

•Incident and safety reporting: be prepared to notify regulators/users of certain harms or incidents (varies by regime; e.g., AI‑generated impersonation under FTC rules; product safety/medical device vigilance in the U.S./EU).[2]

•Liability exposure: in the EU, software/AI can trigger strict product liability; in the U.S., UDAP, civil‑rights, credit, or sector rules can drive enforcement or private litigation even without an AI‑specific statute.[16]

If you tell me your industry and where you operate, I can translate this into a concise compliance checklist with the exact obligations and dates that apply to you.

7.[Withdrawal of Proposed Regulatory Actions, 25531-25533 [2025-11110] :: Securities And Exchange Commission :: Agencies And Commissions :: Regulation Tracker :: Justia](https://regulations.justia.com/regulations/fedreg/2025/06/17/2025-11110.html?utm_source=openai)

Citations (23)

1whitehouse.govGovernment
EXECUTIVE OFFICE OF THE PRESIDENT
Backs: “OMB M‑24‑10 requires each agency to inventory AI use cases, name a Chief AI Officer, apply minimum risk controls for “rights‑impacting” AI, and publish certain uses; agencies have been implementing it across 2024–2026.”
2ftc.govGovernment
FTC Announces Impersonation Rule Goes into Effect Today | Federal Trade Commission
Backs: “General consumer protection and deception: the FTC can police unfair or deceptive AI claims under Section 5 and, since April 2024, enforce a specific Impersonation Rule (with civil penalties) against government/business impersonation schemes; it is also moving to address AI deepfakes that impersonate individuals.”
3consumerfinance.govGovernment
Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms | Consumer Financial Protection Bureau
Backs: “Credit and lending: the CFPB says lenders must give specific, accurate reasons for adverse actions even when decisions come from complex/ML models (ECOA/Reg B).”
4occ.govGovernment
Model Risk Management: Revised Guidance | OCC
Backs: “Banking models and AI: bank regulators updated interagency model‑risk guidance in 2026; banks must validate, monitor, and govern AI/ML models proportionate to risk.”
5fda.govGovernment
Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions | FDA
Backs: “FDA issued final guidance so AI‑enabled devices can include a “predetermined change control plan” (PCCP) that governs how models can be updated safely after approval.”
6govdelivery.comCompanies
EEOC Releases New Resource on Artificial Intelligence and Title VII
Backs: “EEOC guidance explains how Title VII disparate‑impact rules apply to AI hiring/selection tools.”
7justia.comEncyclopedias and reference
Withdrawal of Proposed Regulatory Actions, 25531-25533 [2025-11110] :: Securities And Exchange Commission :: Agencies And Commissions :: Regulation Tracker :: Justia
Backs: “Securities/financial advice: the SEC’s 2023 “predictive data analytics” conflicts rule was not adopted and was withdrawn in 2025; firms still face existing fiduciary/Reg BI and supervision duties, and FINRA has reminded members how existing rules apply to GenAI.”
8nist.govGovernment
AI Risk Management Framework | NIST
Backs: “AI Safety Institute at NIST coordinates evaluation/red‑teaming and international safety‑testing work.”
9nyc.govGovernment
Automated Employment Decision Tools (AEDT) - DCWP
Backs: “New York City (Local Law 144): automated employment decision tools used for NYC jobs must undergo an annual, independent bias audit; results and candidate notices are required. Enforced since July 2023.”
10colorado.govGovernment
SB26-189 Automated Decision-Making Technology | Colorado General Assembly
Backs: “Related conversational‑AI operator duties begin Jan 1, 2027.”
11ca.govGovernment
California Finalizes Regulations to Strengthen Consumers' Privacy
Backs: “California privacy/ADMT rules: the CPPA’s automated decisionmaking technology regulations (effective Jan 1, 2026) give consumers notice, access info, and an opt‑out for significant decisions; they also trigger privacy risk assessments and cybersecurity audits for certain processing.”
12ilga.govGovernment
-
Backs: “Illinois’ AI Video Interview Act (notice, explanation, consent; reporting if AI is used to screen) and Maryland’s consent rule for facial recognition during interviews.”
13apnews.comNews and mediaquality 1.00
AI ads are popular in the 2026 midterms, but state laws haven't stopped a lack of disclosure
Backs: “Political deepfakes: several states now require disclosures or restrict deceptive AI in election ads, but scope and enforcement vary.”
14europa.euGovernment
Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)Text with EEA relevance.
Backs: “Annex III “high‑risk” standalone system rules apply Dec 2, 2027; high‑risk AI embedded in regulated products applies Aug 2, 2028. The Commission’s AI Office leads enforcement for GPAI.”
15europa.euGovernment
The enforcement framework under the Digital Services Act | Shaping Europe’s digital future
Backs: “Digital Services Act (DSA): very large online platforms/search engines must assess and mitigate systemic risks, open recommender parameters to scrutiny, and submit to audits; the Commission can demand data/algorithm access and penalize non‑compliance.”
16europa.euGovernment
Directive (EU) 2024/2853 of the European Parliament and of the Council of 23 October 2024 on liability for defective products and repealing Council Directive 85/374/EEC (Text with EEA relevance)
Backs: “Product liability: the revised Product Liability Directive explicitly covers software and AI systems and clarifies who can be liable when defects or missed security updates cause harm; Member States must transpose it by late 2026.”
17europa.euGovernment
Guidelines on transparency obligations for providers and deployers of AI systems | Shaping Europe’s digital future
Backs: “EU guidance and codes: the Commission has issued guidelines for Article 50 transparency and a voluntary GPAI Code of Practice to help model providers meet AI Act duties.”
18gov.ukGovernment
AI Foundation Models: Update paper - GOV.UK
Backs: “The CMA has set competition/consumer principles for foundation models and continues market scrutiny; regulators are issuing AI guidance under existing powers.”
19cyberchaintec.comNot yet classified
AIDA and After: Where Federal AI Legislation Stands | Cyber Chain Technologies | Nexus by CyberChain Technologies
Backs: “Canada currently relies on existing privacy/civil‑rights laws and sector regulators, with further federal proposals under discussion.”
20oecd.orgGovernment
AI principles | OECD
Backs: “OECD AI Principles (2019; updated 2024): widely adopted baseline on trustworthy AI, with an updated definition of “AI system” used across jurisdictions.”
21utoronto.caAcademic
G7 Leaders' Statement on the Hiroshima AI Process
Backs: “G7 Hiroshima Process: non‑binding international guiding principles and a developer Code of Conduct for advanced AI systems.”
22coe.intGovernment
The Framework Convention on Artificial Intelligence - Artificial Intelligence
Backs: “225): a binding human‑rights‑focused treaty opened for signature Sept 5, 2024; parties commit to safeguards across the AI lifecycle.”
23iso.orgNonprofits and think tanks
ISO/IEC 42001:2023 - AI management systems
Backs: “ISO/IEC 42001 (AI management systems) and ISO/IEC 23894 (AI risk management) are being adopted and mapped to legal regimes (e.g., EU AI Act) as evidence of due diligence.”