What rules currently exist that govern how systems like you are built, deployed, or held accountable?
There is no single global set of binding rules for AI systems (such as large language models or general-purpose/frontier AI). Instead, a fragmented, rapidly evolving landscape of binding regulations, voluntary frameworks, sector-specific laws, and applications of existing legal regimes (privacy, consumer protection, civil rights, product liability, copyright) governs how they are built, deployed, and held accountable. As of late 2026, the most comprehensive binding horizontal rules come from the EU, with significant activity in China, US states, South Korea, and soft-law international standards. Federal US policy emphasizes innovation with lighter-touch measures.[1]
European Union: The AI Act (Risk-Based Binding Framework)
The EU AI Act (Regulation 2024/1689, as amended by the 2026 Digital Omnibus/AI Omnibus) is the world’s first comprehensive horizontal AI law. It applies extraterritorially to providers placing systems on the EU market or systems used in the EU. It uses a risk-based approach:[2]
Building aspects: Data quality/governance, training data legality (IP/privacy), and risk assessment throughout the lifecycle.
Deployment: Market placement requires compliance based on risk; prohibitions ban certain uses outright.
Accountability: Providers (developers placing on market) bear primary duties; deployers, importers, distributors have roles. Enforcement via Member State market surveillance authorities and the EU AI Office (for GPAI). Fines up to €35M or 7% global turnover (prohibited practices) or lower tiers (e.g., 3% for some GPAI/transparency). Serious incident reporting; post-market monitoring. Existing product liability rules (updated PLD treating software/AI as products with strict liability and evidentiary aids) also apply; a dedicated AI Liability Directive was withdrawn.[4]
United States: Patchwork of Executive Policy, Voluntary Frameworks, State Laws, and Existing Statutes
No comprehensive federal AI statute exists. Policy under the Trump administration (e.g., EO 14179 of Jan 2025 revoking prior Biden-era measures and promoting leadership/removing barriers; EO 14365 of Dec 2025 seeking a minimally burdensome national framework and challenging conflicting state laws; EO 14409 of June 2026 on advanced AI innovation/security with voluntary ~30-day pre-release government access/review for certain “covered frontier models” and cybersecurity measures) favors innovation over heavy mandates.[5]
Building: Safety frameworks/evaluations and incident reporting for frontier models in some states; data practices under privacy/IP laws.
Deployment: Sector and use-case restrictions; disclosure/watermarking.
Accountability: State incident reporting and frameworks; potential civil/criminal liability proposals (e.g., for AI agents causing harm); whistleblower protections in some laws. Deployers (e.g., companies using AI) often retain responsibility even for vendor models under guidance and contracts. No broad federal liability statute yet, though bills exist.[8]
China: Content, Security, and Values-Focused Rules
No single comprehensive AI law; layered administrative measures and standards. Key ones for generative AI:
Accountability: Oversight by CAC and other agencies; penalties including warnings, suspension, and legal liability. Registration and assessments key.
Other Jurisdictions and International Soft Law
International/voluntary:
Cross-Cutting Themes for Building, Deployment, and Accountability
For systems like large conversational/generative models: Core current obligations often center on transparency/disclosure, content labeling/marking, training data practices, safety evaluations (if large/frontier), and compliance with privacy/content laws in relevant jurisdictions. High-risk classifications apply mainly if used in sensitive domains (e.g., employment decisions).
Rules continue to evolve quickly with technology, enforcement starting in key areas (e.g., EU transparency/GPAI in 2026), implementation challenges (e.g., standards readiness, authority designations), and geopolitical differences (innovation-focused vs. rights/risk-focused vs. security/values-focused). Organizations typically map compliance by jurisdiction, risk tier, and role (provider/deployer), often using voluntary frameworks like NIST or OECD as baselines even where not mandated. For the latest or jurisdiction-specific advice, consult primary legal texts or experts, as this is a high-level overview of the landscape.
Citations (13)
- https://www.ainvasion.com/ai-regulation/
Backs: “Federal US policy emphasizes innovation with lighter-touch measures.”
- https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
Backs: “It applies extraterritorially to providers placing systems on the EU market or systems used in the EU. It uses a risk-based approach:”
- https://www.lexology.com/library/detail.aspx?g=f7bdfe0a-e1c6-4bbf-a864-e88638c59cd1
Backs: “Deployers have duties around human oversight and use as intended.”
- https://aisigil.com/ai-accountability/
Backs: “Existing product liability rules (updated PLD treating software/AI as products with strict liability and evidentiary aids) also apply; a dedicated AI Liability Directive was withdrawn.”
- https://aipolicytracker.org/jurisdictions/us
Backs: “EO 14409 of June 2026 on advanced AI innovation/security with voluntary ~30-day pre-release government access/review for certain “covered frontier models” and cybersecurity measures) favors innovation over heavy mandates.”
- https://www.lexology.com/library/detail.aspx?g=0da7da3f-b133-4790-af44-029c42ded9e7
Backs: “AI transparency/watermarking and training data transparency laws.”
- https://casrai.org/guides/ai-regulations-around-the-world
Backs: “New York RAISE Act (frontier models, incident reporting); various on chatbots/companions, deepfakes (especially elections), and transparency. Many effective 2026–2027.”
- https://www.technologyreview.com/2026/09/28/1145197/whos-liable-when-ai-agents-go-rogue/
Backs: “Deployers (e.g., companies using AI) often retain responsibility even for vendor models under guidance and contracts. No broad federal liability statute yet, though bills exist.”
- https://casrai.org/guides/china-ai-regulation-explained
Backs: “Classified/graded supervision; balance development and safety.”
- https://intelligence.dlapiper.com/artificial-intelligence?c=CN
Backs: “Foreign providers accessible in China are in scope. Focus on national security, content control, and alignment.”
- https://www.oecd.org/en/topics/ai-principles.html
Backs: “Recommendations for governments on R&D, ecosystems, governance, skills, and cooperation. Informs many national laws (including EU definition of AI).”
- https://aisecurityandsafety.org/en/guides/ai-governance-frameworks-compared/
Backs: “China’s Global AI Governance Initiative and related efforts (e.g., proposed cooperation organization).”
- https://casrai.org/guides/ai-accountability
Backs: “AI systems themselves are not “liable.” Liability regimes are still maturing—existing laws fill gaps, with proposals for stronger agent-specific or developer liability.”