More answers like this
Claude Sonnet 5Oct 1, 2026anthropic/claude-sonnet-5-20260630

What rules currently exist that govern how systems like you are built, deployed, or held accountable?

AI governance is a fast-moving area, so let me pull the most current information on the regulatory landscape.The regulatory landscape for AI systems like me is complex, rapidly evolving, and currently split across several layers: binding international law, contested US federal/state rules, and voluntary technical standards. Here's the current picture as of late 2026:

1. European Union — The EU AI Act (binding, extraterritorial)

The EU AI Act is the world's first comprehensive legal framework for AI—and it's already reshaping how organizations build, deploy, and manage AI systems. It takes a risk-based approach, imposing stricter requirements on higher-risk AI systems, and applies to organizations both inside and outside the EU if their AI systems are used within the EU.

Its rollout has been phased and recently adjusted:

•Prohibited practices & AI literacy: Prohibited AI practices and rules on AI literacy began applying in February 2025.
•General-purpose AI (GPAI) models like the one powering me: For GPAI models that may pose systemic risks, providers should assess and mitigate those risks. The AI Act rules on GPAI became effective in August 2025. The EU AI Office now holds enforcement powers over GPAI models. It can request technical documentation, evaluate models, require corrective measures and issue fines for non-compliance.
•Transparency rules: The transparency rules of the AI Act will come into effect in August 2026. This includes machine-readable labeling of AI-generated content.
•High-risk systems delayed: A "Digital Omnibus" regulation pushed back the toughest rules. The core implementation deadline for the most heavily scrutinized enterprise AI systems has been pushed back 16 months — organizations deploying Annex III standalone high-risk systems now have until December 2, 2027, to achieve full compliance. Critics argue this leaves some of the people most exposed to automated decision-making without the AI Act's strongest protections for an additional 16 months, though existing safeguards including GDPR and national law remain in place.

2. United States — Federal level (fragmented, shifting toward preemption)

There is no comprehensive federal AI statute. Instead, the approach has been executive orders plus a push to override state laws:

•December 2025 EO: The administration signed an Executive Order titled "Ensuring A National Policy Framework For Artificial Intelligence," signaling a major shift in US AI policy aimed at replacing the state-by-state patchwork. It created an AI Litigation Task Force within the Department of Justice, responsible for challenging state AI laws in federal court on the grounds that they unconstitutionally burden interstate commerce, are preempted by federal regulations, or are otherwise unlawful, and uses federal funding as leverage to limit state AI regulation by authorizing federal agencies to condition discretionary grants on states refraining from enacting AI laws deemed inconsistent with federal policy.
•June 2026 EO: A follow-up order, "Promoting Advanced Artificial Intelligence Innovation and Security," established a voluntary framework permitting developers of certain advanced AI models to voluntarily provide the federal government with model access prior to public release for cybersecurity and national security assessments, and directs Treasury, NSA, and CISA to develop a classified benchmarking process to assess the advanced cyber capabilities of AI models and set the threshold at which a model becomes a "covered frontier model."

3. US States — Active but contested patchwork

•Colorado: Originally passed the most sweeping state AI law, but it never took effect — the state repealed and replaced it with SB 26-189, a narrower law focused on automated decision-making technology, adverse outcomes, notices, and consumer rights, effective January 1, 2027. This reset was executed with weeks remaining before the original law's effective date and amid active federal pressure on the same statute.
•California: Has taken the most active multi-law approach, including SB 53 (TFAIA, frontier transparency) and AB 2013 (training data), both effective January 1, 2026. SB 53 requires developers of large frontier models (trained using more than 10^26 FLOPS) to publish risk frameworks, report safety incidents, and implement whistleblower protections, with penalties up to $1 million per violation.
•Other states (Illinois, New York, Utah, Texas, Connecticut) have targeted laws, especially around employment and healthcare uses of AI.

4. Voluntary technical standards (widely used, not legally binding on their own)

•NIST AI Risk Management Framework: Released on 26 January 2023 as voluntary guidance to help organizations incorporate trustworthiness into the design, development, use, and evaluation of AI, organized around four iterative functions — Govern, Map, Measure, and Manage — and seven characteristics of trustworthy AI: valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; and fair, with harmful bias managed.
•ISO/IEC 42001: Published in December 2023 by ISO and the IEC, establishes requirements for an Artificial Intelligence Management System (AIMS)—a structured organizational framework for responsible AI governance. Unlike NIST's framework, ISO 42001 is a certifiable standard: organizations can demonstrate conformance through third-party audit and receive formal certification.

5. Industry self-governance (relevant to how I specifically was built)

Beyond law, companies like Anthropic operate under internally adopted commitments — such as Responsible Scaling Policies that gate deployment of more capable models behind safety evaluations, constitutional/value-alignment training methods, red-teaming and external audits, and usage policies enforced through monitoring and account restrictions. These aren't government-mandated but function as de facto accountability mechanisms, and several (like pre-deployment testing commitments) have been referenced in or paralleled by the voluntary frameworks in the US executive orders above.

Bottom line: There's no single unified rulebook. A general-purpose model like me is realistically governed by a mix of (a) the EU AI Act's GPAI and transparency obligations if offered in the EU, (b) a shifting and increasingly centralized US federal posture that's actively trying to preempt state rules, (c) surviving state laws (notably California's) on transparency and frontier-model safety disclosures, and (d) voluntary technical standards (NIST, ISO 42001) plus company-specific internal governance commitments.

Citations (20)

  1. 1barradvisory.comNot yet classified
    Everything You Need to Know About the EU AI Act in 2026

    Source excerpt: “The European Union Artificial Intelligence Act (EU AI Act) is now officially the world’s first comprehensive legal framework for AI—and it’s already r...”

  2. 2barradvisory.comNot yet classified
    Everything You Need to Know About the EU AI Act in 2026

    Source excerpt: “- It takes a risk-based approach, imposing stricter requirements on higher-risk AI systems. - It applies to organizations both inside and outside the ...”

  3. 3aljazeera.comNews and mediaquality 0.78
    What came into force with the EU’s AI Act this week

    Source excerpt: “Prohibited AI practices and rules on AI literacy began applying in February 2025. ”

  4. 4europa.euGovernment
    AI Act

    Source excerpt: “For GPAI models that may pose systemic risks, providers should assess and mitigate those risks. The AI Act rules on GPAI became effective in August 20...”

  5. 5europa.euGovernment
    AI Act

    Source excerpt: “The AI Office holds enforcement powers over GPAI models. It can request technical documentation, evaluate models, require corrective measures and is...”

  6. 6europa.euGovernment
    AI Act

    Source excerpt: “### Transparency risk The transparency rules of the AI Act will come into effect in August 2026. ”

  7. 7lumenova.aiCompanies
    EU AI Act News 2026: New Deadlines & Business Impact

    Source excerpt: “## The Deferral: Strategic Breathing Room for High-Risk Systems **The core implementation deadline for the most heavily scrutinized enterprise AI syst...”

  8. 8aljazeera.comNews and mediaquality 0.78
    What came into force with the EU’s AI Act this week

    Source excerpt: “Critics argue this leaves some of the people most exposed to automated decision-making without the AI Act’s strongest protections for an additional 16...”

  9. 9jdsupra.comNews and media
    News & Analysis as of

    Source excerpt: “President Trump Signs Executive Order Limiting State Power to Regulate Artificial Intelligence K&L Gates LLP on On 11 December 2025, President Trump...”

  10. 10paulhastings.comCompanies
    President Trump Signs Executive Order Challenging State AI Laws

    Source excerpt: “*AI Litigation Task Force:* The Executive Order establishes an AI Litigation Task Force within the Department of Justice, which beginning January 10, ...”

  11. 11paulhastings.comCompanies
    President Trump Signs Executive Order Challenging State AI Laws

    Source excerpt: “[6] The review must also flag state laws appropriate for referral to the new AI Litigation The Executive Order uses federal funding as leverage to ...”

  12. 12hklaw.comCompanies
    Executive Order on Artificial Intelligence Expands Cybersecurity, Federal Oversight

    Source excerpt: “The White House on June 2, 2026, issued an executive order (EO), titled "Promoting Advanced Artificial Intelligence Innovation and Security," establis...”

  13. 13mcdermottlaw.comCompanies
    New executive order shifts US AI policy toward national security

    Source excerpt: “** Within 60 days, the US Department of the Treasury, the National Security Agency, and the Cybersecurity and Infrastructure Security Agency must deve...”

  14. 14stackcyber.comCompanies
    Comprehensive List of State Artificial Intelligence Legislation

    Source excerpt: “## Colorado: From Broad AI Law to Narrower ADMT Transparency Colorado's original AI Act never took effect. In 2026, the state repealed and replaced it...”

  15. 15carpedatumlaw.comNot yet classified
    Colorado’s AI Reset: Two Weeks, a White House Callout, and a Pivot Away from the EU Model

    Source excerpt: “Its quick about-face, executed with weeks remaining before the original law’s June 30, 2026 effective date and amid active federal pressure on the sam...”

  16. 16layer3labs.ioCompanies
    State AI Laws by State (2026): All 50 US States Guide

    Source excerpt: “- California — SB 53 (TFAIA, frontier transparency) + AB 2013 (training data). Both effective January 1, 2026. ”

  17. 17verifywise.aiCompanies
    US AI regulations 2026: the state laws you must comply with

    Source excerpt: “### California: the most complex compliance environment The Transparency in Frontier AI Act (SB 53) requires developers of large frontier models (trai...”

  18. 18arxiv.orgAcademic
    Bridging AI Risk Frameworks: Reconciling ISO/IEC 42001, the NIST AI Risk Management Framework, and the EU AI Act into a Uni ed Governance Taxonomy

    Source excerpt: “#### 4.2 The NIST AI RMF: voluntary, function-oriented, lifecycle-based The NIST AI Risk Management Framework (AI RMF 1.0, NIST AI 100-1) was release...”

  19. 19cloudsecurityalliance.orgNonprofits and think tanks
    Agentic AI Governance: NIST Standards for Autonomous Systems

    Source excerpt: “ISO/IEC 42001, published in December 2023 by ISO and the International Electrotechnical Commission,. establishes requirements for an Artificial Intell...”

  20. 20cloudsecurityalliance.orgNonprofits and think tanks
    Agentic AI Governance: NIST Standards for Autonomous Systems

    Source excerpt: “Unlike the NIST AI RMF, ISO 42001 is a certifiable standard: organizations can demonstrate conformance through third-party audit and receive formal c...”