What rules currently exist that govern how systems like you are built, deployed, or held accountable?
Short answer: there isn’t one single “AI law.” Today’s guardrails are a patchwork of binding laws, agency rules, and voluntary standards that vary by jurisdiction and sector. Here are the main ones in force now (as of October 2, 2026), plus near‑term dates that matter.
United States (federal)
United States (state and local)
European Union
United Kingdom
China
International and soft law (shape what “good” looks like)
Technical standards you’ll see in contracts and audits
Two practical implications for builders and deployers
If you tell me where you operate and what systems you’re building (e.g., hiring, lending, health, kids/teens, content platforms), I can map the concrete obligations, dates, and the specific tests, notices, and records you’ll need.
Citations (23)
- Executive Orders EO 14110
Backs: “OMB Memorandum M‑24‑10 (Mar 28, 2024) makes agencies stand up AI governance, do risk management for uses affecting rights/safety, appoint Chief AI Officers, and inventory/high‑risk uses.”
evidence, official document. Claim: Executive Order 14110 and OMB guidance direct federal agencies on AI safety, governance, risk management, and Chief AI Officers.
- Artificial Intelligence Risk Management Framework (AI RMF 1.0) | NIST
Backs: “AI Safety Institute at NIST to coordinate evaluations, red‑teaming and guidance.”
evidence, official document. Claim: NIST AI Risk Management Framework 1.0 is a voluntary but widely used standard for AI risk management.
- FTC Announces Crackdown on Deceptive AI Claims and Schemes | Federal Trade Commission
Backs: “FTC uses its unfair/deceptive and competition authorities against misleading AI claims and harmful uses; agencies jointly stated “there’s no AI exemption” (FTC/DOJ/CFPB/EEOC).”
evidence, article. Claim: FTC applies its authorities against deceptive AI claims and harmful uses.
- Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms | Consumer Financial Protection Bureau
Backs: “CFPB reminds lenders they must give specific reasons for credit denials even when using complex algorithms (ECOA/Reg B).”
evidence, official document. Claim: CFPB says lenders must give specific reasons for credit denials even when using complex algorithms.
- U.S. EEOC and U.S. Department of Justice Warn against Disability Discrimination | U.S. Equal Employment Opportunity Commission
Backs: “EEOC/DOJ guidance warns employers that AI tools can violate ADA/Title VII if they cause disability or other discrimination.”
evidence, article. Claim: EEOC/DOJ warn employers that AI tools can violate ADA/Title VII through discrimination.
- 88 FR 16190 - Copyright Registration Guidance: Works Containing Material Generated by Artificial Intelligence - Content Details - 2023-05321
Backs: “Copyright Office’s 2023 policy says purely AI‑generated material isn’t copyrightable; mixed human/AI works must disclose the AI portions. Ongoing multi‑part AI study continues in 2024–2025.”
evidence, official document. Claim: Copyright Office guidance: purely AI-generated material is not copyrightable and AI portions must be disclosed.
- SB24-205 Consumer Protections for Artificial Intelligence | Colorado General Assembly
Backs: “Colorado AI Act (SB 24‑205): from February 1, 2026, “developers” and “deployers” of high‑risk AI must use reasonable care to prevent algorithmic discrimination, with documentation, disclosures, and AG rulemaking; enforcement by the AG.”
evidence, official document. Claim: Colorado AI Act requires developers and deployers of high-risk AI to use reasonable care against algorithmic discrimination.
- California Finalizes Regulations to Strengthen Consumers' Privacy
Backs: “CPPA regulations effective January 1, 2026 add • cybersecurity audits • risk assessments • and consumer rights to access/opt out of Automated Decisionmaking Technology (ADMT) for significant decisions (employment, housing, credit, etc.).”
evidence, article. Claim: California CPPA regulations add cybersecurity audits, risk assessments, and ADMT consumer rights effective 2026.
- Code of Colorado Regulations, Part 9, Section 4 CCR 904-3-9.04 - OPTING OUT OF PROFILING IN FURTHERANCE OF DECISIONS THAT PRODUCE LEGAL OR SIMILARLY SIGNIFICANT EFFECTS CONCERNING A CONSUMER | Code of Colorado Regulations | Justia
Backs: “Privacy/profiling controls in multiple states: e.g., Colorado Privacy Act gives consumers a right to opt out of profiling with legal/similar effects and requires honoring recognized universal opt‑out signals (e.g., Global Privacy Control).”
evidence, official document. Claim: Colorado Privacy Act gives consumers a right to opt out of profiling with significant effects.
- Automated Employment Decision Tools (AEDT) - DCWP
Backs: “New York City Local Law 144 (AEDT): since July 5, 2023, bias audits and notices are required before using automated employment decision tools in NYC.”
evidence, article. Claim: NYC Local Law 144 requires bias audits and notices for automated employment decision tools.
- Regulation - EU - 2024/1689 - EN - EUR-Lex
Backs: “Prohibitions and GPAI governance phase in earlier; core “high‑risk” obligations start Dec 2, 2027 (stand‑alone uses) and Aug 2, 2028 (embedded in regulated products).”
evidence, official document. Claim: EU AI Act (Regulation 2024/1689) is in force with phased applicability dates.
- Article 53: Obligations for providers of general-purpose AI models | AI Act Service Desk
Backs: “General‑purpose AI (GPAI) providers must publish a sufficiently detailed summary of training content and have a policy to respect EU copyright (Article 53).”
evidence, official document. Claim: GPAI providers must publish training content summaries and have a copyright compliance policy (Article 53).
- The enforcement framework under the Digital Services Act | Shaping Europe’s digital future
Backs: “Digital Services Act (DSA): already applies to all platforms since Feb 17, 2024; imposes transparency around recommender systems, ads, systemic‑risk assessments (tighter for Very Large Online Platforms/Search).”
evidence, article. Claim: Digital Services Act imposes transparency and systemic-risk obligations on platforms.
- Directive - 2024/2853 - EN - Product Liability Directive - EUR-Lex
Backs: “EU countries must transpose by Dec 9, 2026 (then applies to products placed on the market after that).”
evidence, official document. Claim: Revised Product Liability Directive extends strict liability to software/AI, with transposition due Dec 9, 2026.
- AI regulation: a pro-innovation approach - GOV.UK
Backs: ““Pro‑innovation” approach: no horizontal AI act yet; the government directs existing regulators to apply five principles, with active oversight by the CMA (competition/consumer protection) and guidance from the ICO on AI and data protection.”
evidence, official document. Claim: UK has a pro-innovation approach with no horizontal AI act, directing existing regulators to apply five principles.
- Translation: Internet Information Service Algorithmic Recommendation Management Provisions – Effective March 1, 2022
Backs: “Algorithmic Recommendation Provisions (effective Mar 1, 2022).”
evidence, article. Claim: China's Algorithmic Recommendation Provisions took effect March 1, 2022.
- 互聯網信息服務深度合成管理規定_國務院部門文件_中國政府網
Backs: “Deep Synthesis Provisions (effective Jan 10, 2023).”
evidence, official document. Claim: China's Deep Synthesis Provisions took effect January 10, 2023.
- Interim Measures for the Management of Generative AI Services | Comparative AI
Backs: “Interim Measures for Generative AI Services (effective Aug 15, 2023).”
evidence, article. Claim: China's Interim Measures for Generative AI Services took effect August 15, 2023.
- Committee on Artificial Intelligence (CAI) - Artificial Intelligence
Backs: “Council of Europe Framework Convention on AI (adopted May 17, 2024; opened for signature Sept 5, 2024): first binding international AI treaty focused on human rights, democracy and rule of law (enters into force after ratifications).”
evidence, home page. Claim: Council of Europe Framework Convention on AI is the first binding international AI treaty on human rights and democracy.
- OECD Legal Instruments
Backs: “OECD AI Principles (2019; updated 2024) and UNESCO’s 2021 Recommendation on AI Ethics guide many national frameworks.”
attribution, official document. Claim: OECD AI Principles and UNESCO recommendation guide many national frameworks.
- Hiroshima Process International
Backs: “G7 “Hiroshima Process” voluntary Code of Conduct for developers of advanced AI systems (2023).”
evidence, official document. Claim: G7 Hiroshima Process voluntary Code of Conduct for developers of advanced AI systems.
- ISO/IEC 42001:2023 - AI management systems
Backs: “ISO/IEC 42005:2025 (AI system impact assessment). These align well with NIST’s AI RMF.”
evidence, reference entry. Claim: ISO/IEC 42001 and related ISO standards cover AI management, risk, lifecycle, and impact assessment.
- FTC Chair Khan and Officials from DOJ, CFPB and EEOC Release Joint Statement on AI | Federal Trade Commission
Backs: “Even where there’s no single AI statute, existing laws still apply: consumer protection, civil rights/anti‑discrimination, sectoral privacy/financial rules, and product liability. Agencies have said explicitly there’s “no AI exemption.””
attribution, article. Claim: Agencies jointly stated there is 'no AI exemption' from existing laws.