More answers like this
GPT-5Oct 1, 2026openai/gpt-5-2025-08-07

What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Short answer: There isn’t one single “AI law.” Today’s guardrails are a patchwork of binding laws, agency rules and guidance, sector‑specific obligations, and voluntary standards that together shape how systems like me are built, deployed, and held accountable.

Here’s the current landscape (as of October 1, 2026):

Global and multilateral baselines

•OECD AI Principles (values + recommendations first adopted 2019; updated May 2024) now inform many national frameworks.[1]
•Council of Europe Framework Convention on AI (adopted May 17, 2024; opened for signature Sept 5, 2024) is the first binding international treaty on AI and fundamental rights; it’s open beyond Europe as states ratify.[2]
•UN General Assembly AI resolution (Mar 21, 2024) urges “safe, secure, trustworthy” AI and human‑rights grounding (nonbinding, but influential).[3]
•G7 “Hiroshima Process” (2023→) issued voluntary Guiding Principles and a Code of Conduct for developers of advanced AI; a reporting framework is being piloted across G7 members.[4]

European Union (binding)

•EU AI Act (Regulation (EU) 2024/1689): risk‑based obligations for providers and deployers; bans certain practices; adds transparency duties (e.g., label AI‑generated content in defined cases); creates special rules for general‑purpose AI (GPAI). Key dates:
•In force: Aug 1, 2024.
•Prohibitions and AI literacy: from Feb 2, 2025.
•Transparency duties (Article 50): from Aug 2, 2026; grace to Dec 2, 2026 for some pre‑existing systems.
•High‑risk rules: Dec 2, 2027 (Annex III stand‑alone); Aug 2, 2028 (embedded in regulated products).[5]
•GPAI/copyright and systemic‑risk duties (incl. notification; codes of practice until harmonized standards land).[6]
•Digital Services Act (DSA): very large platforms/search engines must assess systemic risks, give more transparency about recommender systems, ads, and let users adjust recommendations.[7]

United States (federal)

•Executive branch policy and standards:
•OMB M‑24‑10 (Mar 2024) requires US agencies to inventory, govern, and mitigate risks for AI used in programs affecting rights/safety; complementary AI acquisition guidance followed.[8]
•NIST AI Risk Management Framework 1.0 (Jan 2023) + Generative AI Profile (July 2024) guide risk practices across the AI lifecycle (widely adopted, voluntary). NIST also runs the U.S. AI Safety Institute and an international network for testing/evaluation.[9]
•Enforcement under existing laws (no “AI exemption”):
•FTC, DOJ, CFPB, EEOC joint statements (2023–2024): civil‑rights, consumer‑protection, fair‑competition, and employment laws apply to automated systems. Example: in credit, ECOA/Reg B adverse‑action notices still must give specific reasons—even for complex models.[10]
•FTC uses its deception/unfairness authority against misleading AI claims or harmful deployments (e.g., Everalbum facial‑recognition case required deletion of models built on improperly obtained data).[11]

United States (state/local, selected highlights)

•Colorado SB 24‑205 (Automated Decision‑Making/AI consumer protections): high‑risk AI used for “consequential decisions” must implement risk management, disclose use, and avoid algorithmic discrimination; AG rulemaking is underway.[12]
•New York City Local Law 144 (effective July 5, 2023): hiring/promotion “AEDTs” require an annual independent bias audit, public posting of audit results, and candidate notice.[13]
•Illinois AI Video Interview Act: notice/consent, data‑handling rules when AI analyzes recorded interviews.[14]
•California privacy enforcement (CCPA/CPRA): the CPPA has adopted regulations on risk assessments, cybersecurity audits, and automated decision‑making technology (ADMT) and continues rulemaking/enforcement.[15]

Canada (federal)

•Public‑sector AI is governed today by the Treasury Board Directive on Automated Decision‑Making (in force since 2019; updated 2023): mandates an Algorithmic Impact Assessment, testing for bias, transparency, and ongoing oversight for federal automated systems.[16]
•AIDA (the proposed Artificial Intelligence and Data Act within Bill C‑27) did not enter into force in its 2022–2025 form; the government has relied on interim voluntary instruments like the 2023 generative‑AI Code of Conduct while considering next steps.[17]

Data protection and platform rules that bite on AI

•GDPR (EU) limits solely automated decisions with legal/similar significant effects and adds profiling safeguards; EDPB guidance clarifies scope and human‑review standards. US‑style state privacy laws (e.g., CPRA) add rights and, via CPPA regs, governance for ADMT.[18]

Voluntary and consensus standards used for compliance

•ISO/IEC 42001:2023 (AI management systems) is a certifiable governance standard many organizations map to the EU AI Act/NIST RMF. ISO/IEC 23894:2023 gives AI risk‑management guidance.[19]

What this means in practice if you build or deploy AI

•Expect to implement risk management, testing, logging, security, data governance, and transparency processes (NIST AI RMF; ISO 42001/23894).[9]
•If you touch the EU: classify use cases, meet AI Act timelines (transparency by Aug 2, 2026; high‑risk by 2027/2028), and follow GPAI/copyright duties. If you operate on large platforms serving the EU, DSA transparency and recommender‑system obligations apply now.[5]
•In the US: your AI uses are already covered by existing laws (consumer protection, civil rights, credit, employment, housing, privacy). Agencies have said clearly there’s no “AI carve‑out,” and they are enforcing.[10]
•Watch local rules: hiring tools in NYC; high‑risk AI in Colorado; California CPPA’s ADMT and risk‑assessment regulations.[13]
•Keep claims about AI capabilities truthful and substantiated; the FTC has warned and acted on “AI‑washing.”[11]

If you want, tell me your industry and where you operate. I can translate this patchwork into a short, concrete compliance checklist for your situation.

Citations (19)

  1. 1oecd.orgGovernment
    AI principles | OECD

    Backs: “OECD AI Principles (values + recommendations first adopted 2019; updated May 2024) now inform many national frameworks.”

  2. 2coe.intGovernment
    Committee on Artificial Intelligence (CAI) - Artificial Intelligence

    Backs: “Council of Europe Framework Convention on AI (adopted May 17, 2024; opened for signature Sept 5, 2024) is the first binding international treaty on AI and fundamental rights; it’s open beyond Europe as states ratify.”

  3. 3un.orgGovernment
    General Assembly Adopts Landmark Resolution on Steering Artificial Intelligence towards Global Good, Faster Realization of Sustainable Development | Meetings Coverage and Press Releases

    Backs: “UN General Assembly AI resolution (Mar 21, 2024) urges “safe, secure, trustworthy” AI and human‑rights grounding (nonbinding, but influential).”

  4. 4bundesregierung.deNot yet classified
    Hiroshima Process International

    Backs: “G7 “Hiroshima Process” (2023→) issued voluntary Guiding Principles and a Code of Conduct for developers of advanced AI; a reporting framework is being piloted across G7 members.”

  5. 5europa.euGovernment
    AI Act | Shaping Europe’s digital future

    Backs: “Dec 2, 2027 (Annex III stand‑alone); Aug 2, 2028 (embedded in regulated products).”

  6. 6europa.euGovernment
    Regulation - EU - 2024/1689 - DE - EUR-Lex

    Backs: “GPAI/copyright and systemic‑risk duties (incl. notification; codes of practice until harmonized standards land).”

  7. 7europa.euGovernment
    DSA: Very large online platforms and search engines | Shaping Europe’s digital future

    Backs: “Digital Services Act (DSA): very large platforms/search engines must assess systemic risks, give more transparency about recommender systems, ads, and let users adjust recommendations.”

  8. 8whitehouse.govGovernment
    EXECUTIVE OFFICE OF THE PRESIDENT

    Backs: “OMB M‑24‑10 (Mar 2024) requires US agencies to inventory, govern, and mitigate risks for AI used in programs affecting rights/safety; complementary AI acquisition guidance followed.”

  9. 9nist.govGovernment
    AI Risk Management Framework | NIST

    Backs: “AI Safety Institute and an international network for testing/evaluation.”

  10. 10ftc.govGovernment
    FTC Chair Khan and Officials from DOJ, CFPB and EEOC Release Joint Statement on AI | Federal Trade Commission

    Backs: “Example: in credit, ECOA/Reg B adverse‑action notices still must give specific reasons—even for complex models.”

  11. 11context.centerNot yet classified
    Keep your AI claims in check

    Backs: “FTC uses its deception/unfairness authority against misleading AI claims or harmful deployments (e.g., Everalbum facial‑recognition case required deletion of models built on improperly obtained data).”

  12. 12coag.govGovernment
    Colorado Anti-Discrimination in AI Law (ADAI) Rulemaking | Colorado Attorney General

    Backs: “Colorado SB 24‑205 (Automated Decision‑Making/AI consumer protections): high‑risk AI used for “consequential decisions” must implement risk management, disclose use, and avoid algorithmic discrimination; AG rulemaking is underway.”

  13. 13nyc.govGovernment
    Automated Employment Decision Tools (AEDT) - DCWP

    Backs: “New York City Local Law 144 (effective July 5, 2023): hiring/promotion “AEDTs” require an annual independent bias audit, public posting of audit results, and candidate notice.”

  14. 14ilga.govGovernment
    Illinois General Assembly - -

    Backs: “Illinois AI Video Interview Act: notice/consent, data‑handling rules when AI analyzes recorded interviews.”

  15. 15ca.govGovernment
    Law & Regulations - California Privacy Protection Agency (CPPA)

    Backs: “California privacy enforcement (CCPA/CPRA): the CPPA has adopted regulations on risk assessments, cybersecurity audits, and automated decision‑making technology (ADMT) and continues rulemaking/enforcement.”

  16. 16canada.caGovernment
    Directive on Automated Decision-Making- Canada.ca

    Backs: “Public‑sector AI is governed today by the Treasury Board Directive on Automated Decision‑Making (in force since 2019; updated 2023): mandates an Algorithmic Impact Assessment, testing for bias, transparency, and ongoing oversight for federal automated systems.”

  17. 17canada.caGovernment
    The Artificial Intelligence and Data Act (AIDA) – Companion document

    Backs: “AIDA (the proposed Artificial Intelligence and Data Act within Bill C‑27) did not enter into force in its 2022–2025 form; the government has relied on interim voluntary instruments like the 2023 generative‑AI Code of Conduct while considering next steps.”

  18. 18europa.euGovernment
    Automated decision-making and profiling | European Data Protection Board

    Backs: “US‑style state privacy laws (e.g., CPRA) add rights and, via CPPA regs, governance for ADMT.”

  19. 19modelgovernanceindex.comNot yet classified
    ISO/IEC 42001:2023 - Information technology - Artificial intelligence - Management system (ISO 42001) | Model Governance Index

    Backs: “ISO/IEC 42001:2023 (AI management systems) is a certifiable governance standard many organizations map to the EU AI Act/NIST RMF. ISO/IEC 23894:2023 gives AI risk‑management guidance.”