What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Rules governing AI systems like large language models (LLMs) and general-purpose AI (GPAI) chatbots are a mix of binding laws (especially risk-based regulations), voluntary frameworks/standards, existing general laws (privacy, consumer protection, anti-discrimination, product liability, IP), and emerging accountability mechanisms. These address the full lifecycle: development/building (data quality, testing, documentation, risk assessment), deployment (transparency, human oversight, restrictions on uses), and accountability (audits, incident reporting, liability, fines).[1]

The landscape is fragmented and evolving rapidly (as of late 2026). The EU has the most comprehensive binding horizontal regulation. The US emphasizes innovation with federal executive actions, voluntary tools, and growing state laws (with efforts toward federal preemption). China uses targeted administrative measures focused on content and security. International bodies provide influential soft-law principles. Many jurisdictions also apply sector-specific rules (e.g., finance, healthcare, employment) and general laws.[2]

Binding Regulations and Laws

European Union – AI Act (Regulation 2024/1689)
This is the world’s first comprehensive, horizontal AI law. It entered into force on 1 August 2024, with phased application (prohibitions from early 2025; GPAI rules from August 2025; many high-risk obligations later, with some timelines adjusted via 2026 amendments/“AI Omnibus” toward late 2027 for certain high-risk systems). It uses a risk-based approach and applies extraterritorially to providers/deployers placing systems on the EU market or whose outputs are used in the EU.[1][3]

Enforcement: Fines up to €35 million or 7% of global annual turnover (higher tiers for prohibited practices); market surveillance by national authorities + EU AI Office; codes of practice and standards for presumption of conformity. Related instruments include GDPR, DSA, and proposed liability rules.[5]

United States
No single comprehensive federal AI statute equivalent to the EU Act. Policy has shifted under different administrations. Biden’s 2023 EO 14110 (Safe, Secure, and Trustworthy AI) emphasized safety reporting, standards, and equity but was fully revoked in 2025 by Trump EO 14179 (“Removing Barriers to American Leadership in AI”), which prioritizes innovation, U.S. dominance, infrastructure, and reducing barriers. Subsequent actions include an AI Action Plan (dozens of recommendations on innovation, infrastructure, international leadership), efforts to evaluate/preempt “burdensome” state laws (EO 14365 and related task forces/litigation), voluntary frameworks for frontier model pre-release government review (up to ~30 days for national security/cyber aspects), and OMB guidance on federal agency AI use/procurement.[6][7][7]

Federal policy seeks a lighter national framework that avoids stifling innovation while addressing security and preempting conflicting state rules in some areas (preserving general consumer protection, child safety, etc.).

China
No single comprehensive AI law (though broader legislation has been discussed). Layered administrative measures and standards, often content- and security-focused, enforced by the Cyberspace Administration of China (CAC) and others. Key ones include:

Other jurisdictions (examples from trackers): Canada (proposed AI and Data Act elements), Brazil (AI bill with risk prohibitions and liability), UK (sector-led/pro-innovation approach), Australia (voluntary AI Safety Standard with guardrails), Singapore (Model AI Governance Frameworks + toolkits, largely voluntary), South Korea and others developing acts. Many start with national strategies/ethics guidelines before binding rules.[2]

Voluntary Frameworks, Standards, and Soft Law

These heavily influence building/deployment practices and are often referenced in contracts, procurement, or as baselines for compliance:

Accountability Mechanisms

Application to Systems Like Me (GPAI/LLMs/Chatbots)

Existing non-AI-specific laws remain foundational everywhere. Compliance often involves mapping systems to risk tiers, implementing governance, and monitoring evolving standards/guidance (e.g., EU codes of practice, NIST profiles). The field continues to develop quickly with amendments, new state laws, international coordination, and technical standards. For the most current details on a specific jurisdiction or use case, consult official sources or legal experts, as implementations and timelines shift.