What rules currently exist that govern how systems like you are built, deployed, or held accountable?

The rules governing how systems like me (Large Language Models, Generative AI, and General-Purpose AI) are built, deployed, and held accountable have evolved into a complex, multi-tiered landscape. Today, these rules are shaped by a strict, comprehensive regulatory framework in Europe, a highly active patchwork of state-level laws in the United States, and a shifting federal landscape focused on balancing national security and innovation.

The primary regulatory frameworks, laws, and compliance standards governing generative AI are structured around several key pillars:

1. The European Union: The EU AI Act

The European Union’s AI Act is the most comprehensive and binding global legislation regulating AI systems. It uses a risk-based approach, and several of its milestones are already active or currently taking effect:

•Prohibited Practices (Active since Feb 2025): AI systems that engage in social scoring, manipulative behavioral subversion, or untargeted harvesting of facial images (like scraping CCTV footage) are completely banned in the EU.

•General Purpose AI (GPAI) Obligations (Full enforcement began Aug 2, 2026): Providers of the base foundation models (like the ones powering me) must comply with strict rules. They are required to maintain detailed technical documentation, provide necessary integration information to downstream developers, maintain a policy to respect EU copyright law, and publish a detailed summary of the data used to train the model.

•Transparency and Watermarking (Article 50): Generative AI providers must ensure their outputs are marked with machine-readable, robust watermarks so users know the content is AI-generated. Under the latest guidelines, systems released after August 2026 must have this built-in immediately, while older systems have a grace period until December 2, 2026, to comply.

•High-Risk Systems (Delayed to late 2027/2028): Under the EU’s Digital Omnibus on AI (passed in June 2026), the enforcement dates for "high-risk" standalone AI systems (such as those used in hiring, credit scoring, or law enforcement) were delayed to December 2, 2027, to allow more time for technical standards to be finalized.

2. United States: Federal De-regulation and Targeted Laws

In the U.S., there is no single comprehensive federal AI law. U.S. policy is characterized by a push-and-pull between federal agencies, executive orders, and state legislatures:

•Executive Orders & De-regulation: The Trump administration dismantled previous administration policies (such as the 2023 Executive Order’s mandatory safety reporting). Under Executive Order 14365 (December 2025) and subsequent directives, federal policy focuses on a pro-innovation, minimally burdensome approach, even threatening to challenge state-level laws that restrict AI development. However, Executive Order 14409 (June 2026) mandates federal agencies to prioritize secure deployment of frontier models and counter AI-enabled cyber threats.

•Federal Legislation (The TAKE IT DOWN Act): Enacted to target deepfakes, this federal law (fully in effect as of May 19, 2026) criminalizes the publication or threat of publishing non-consensual intimate imagery, including AI-generated deepfakes, and requires online platforms to remove such content within 48 hours of notification.

•National Security Export Controls: In June 2026, the U.S. Department of Commerce expanded hardware restrictions by introducing licensing requirements for exporting advanced frontier AI models (such as those built by major U.S. labs) to certain non-allied countries.

•Federal Agencies (FTC): Despite a lack of comprehensive legislation, the Federal Trade Commission (FTC) actively uses existing consumer protection and anti-discrimination laws to penalize companies for "AI washing" (making false claims about AI capabilities) and deploying biased models.

3. United States: State-Level Regulations

Because of the federal vacuum, states have become the primary battleground for legally binding rules in the U.S. California and Colorado represent the two most influential but divergent approaches:

•California’s Suite of Laws (Effective Jan 1, 2026):

•Transparency in Frontier AI Act (SB 53): Regulates developers of the largest "frontier" models (trained with immense compute power). Developers must establish, publish, and stick to strict safety and security protocols and report major safety incidents.

•AI Training Data Transparency Act (AB 2013): Generative AI developers must publish detailed summaries of their training datasets on their websites—including data sources and whether copyrighted or personal info was used.

•AI Transparency Act (SB 942): Mandates that generative AI providers include latent, machine-readable disclosures (watermarks) in AI-generated text, image, audio, and video.

•Colorado’s Reversal (SB 26-189): Colorado originally passed a sweeping consumer-protection AI Act (SB 24-205). However, following intense industry pushback and federal policy shifts, the state legislature repealed and replaced it in May 2026. The new law (SB 26-189, effective January 1, 2027) scales back strict risk management audits and instead focuses primarily on basic transparency, requiring businesses to disclose to consumers when AI is used to make "consequential decisions" like housing, hiring, or insurance.

•Workplace & Local Laws: New York City’s Local Law 144 continues to mandate independent bias audits for automated employment decision tools, while states like Illinois and Connecticut have active laws governing AI use in job candidate evaluations and video interview analysis.

4. Voluntary Frameworks and Standards

Because laws are still consolidating, developers rely heavily on voluntary frameworks that carry immense industry weight:

•NIST AI Risk Management Framework (RMF): Developed by the U.S. National Institute of Standards and Technology, this framework is widely used to map, measure, and manage AI risks. Increasingly, state laws and federal procurement policies treat adherence to the NIST AI RMF as a "safe harbor" or a gold standard for demonstrating safety compliance.

Summary of What This Means for Me

If a developer builds a system like me and deploys it globally today:

1.They must prove what I was trained on (under California AB 2013 and the EU AI Act).

2.They must watermark my outputs so people know I wrote them (under California SB 942 and EU Article 50).

3.They must respect copyright opt-outs in my data collection (under EU GPAI rules).

4.They cannot use me for prohibited activities like deceptive social profiling.

5.They face legal liability if I am used to make biased or discriminatory hiring/lending decisions without transparency disclosures (under various state laws).

Citations (14)

1drata.comCompanies
drata.com
Backs: “The rules governing how systems like me (Large Language Models, Generative AI, and General-Purpose AI) are built, deployed, and held accountable have evolved into a complex, multi-tiered landscape.”
2verifywise.aiCompanies
verifywise.ai
Backs: “The rules governing how systems like me (Large Language Models, Generative AI, and General-Purpose AI) are built, deployed, and held accountable have evolved into a complex, multi-tiered landscape.”
3brightdefense.comCompanies
brightdefense.com
Backs: “Today, these rules are shaped by a strict, comprehensive regulatory framework in Europe, a highly active patchwork of state-level laws in the United States, and a shifting federal landscape focused on balancing national security and innovation.”
4airia.comCompanies
airia.com
Backs: “Today, these rules are shaped by a strict, comprehensive regulatory framework in Europe, a highly active patchwork of state-level laws in the United States, and a shifting federal landscape focused on balancing national security and innovation.”
5ebglaw.comCompanies
ebglaw.com
Backs: “Today, these rules are shaped by a strict, comprehensive regulatory framework in Europe, a highly active patchwork of state-level laws in the United States, and a shifting federal landscape focused on balancing national security and innovation.”
6wikipedia.orgEncyclopedias and referencequality 0.83
wikipedia.org
Backs: “Today, these rules are shaped by a strict, comprehensive regulatory framework in Europe, a highly active patchwork of state-level laws in the United States, and a shifting federal landscape focused on balancing national security and innovation.”
7trustarc.comNot yet classified
trustarc.com
Backs: “The European Union: The EU AI Act. The European Union’s AI Act is the most comprehensive and binding global legislation regulating AI systems. It uses a risk-based approach, and several of its milestones are already active or currently taking effect:”
8alicelabs.aiCompanies
alicelabs.ai
Backs: “It uses a risk-based approach, and several of its milestones are already active or currently taking effect:”
9jamf.comCompanies
jamf.com
Backs: “Transparency and Watermarking (Article 50): Generative AI providers must ensure their outputs are marked with machine-readable, robust watermarks so users know the content is AI-generated. Under the latest guidelines, systems released after August 2026 must have this built-in immediately, while older systems have a…”
10techpolicy.pressNews and media
techpolicy.press
Backs: “Under Executive Order 14365 (December 2025) and subsequent directives, federal policy focuses on a pro-innovation, minimally burdensome approach, even threatening to challenge state-level laws that restrict AI development. However, Executive Order 14409 (June 2026) mandates federal agencies to prioritize secure…”
11whitecase.comCompanies
whitecase.com
Backs: “Under Executive Order 14365 (December 2025) and subsequent directives, federal policy focuses on a pro-innovation, minimally burdensome approach, even threatening to challenge state-level laws that restrict AI development. However, Executive Order 14409 (June 2026) mandates federal agencies to prioritize secure…”
12wsgr.comCompanies
wsgr.com
Backs: “Federal Legislation (The TAKE IT DOWN Act): Enacted to target deepfakes, this federal law (fully in effect as of May 19, 2026) criminalizes the publication or threat of publishing non-consensual intimate imagery, including AI-generated deepfakes, and requires online platforms to remove such content within 48 hours of…”
13dglaw.comNot yet classified
dglaw.com
Backs: “Colorado’s Reversal (SB 26-189): Colorado originally passed a sweeping consumer-protection AI Act (SB 24-205). However, following intense industry pushback and federal policy shifts, the state legislature repealed and replaced it in May 2026.”
14seyfarth.comNot yet classified
seyfarth.com
Backs: “However, following intense industry pushback and federal policy shifts, the state legislature repealed and replaced it in May 2026. The new law (SB 26-189, effective January 1, 2027) scales back strict risk management audits and instead focuses primarily on basic transparency, requiring businesses to disclose to…”