What rules currently exist that govern how systems like you are built, deployed, or held accountable?
What rules govern how AI like me is built and held accountable? I'll map the current landscape for you.
Current rules are not a single law but a layered system - binding laws in some jurisdictions, sector-specific rules, and voluntary frameworks that are widely used as an accountability baseline. Key regimes as of 2026:
1. European Union - EU AI Act - Binding, risk-based
The EU AI Act is the first comprehensive horizontal AI law. It entered into force in August 2024 and obligations are being phased in between 2025 and 2027.
How it governs building, deployment and accountability:
unacceptable, high, limited, minimal) and regulates the lifecycle covering how it's developed, trained, validated, placed on the market, integrated, deployed, monitored, and changedProhibited AI practices (Art. 5) and AI literacy (Art. 4) take effect plus The Act's general provisions and definitions began to apply, along with the first eight bans on prohibited AI practicesGeneral-purpose AI rules, including governance and transparency requirements, will go into effect and Stricter obligations will apply to general-purpose models from August 2025, including mandatory documentation of training dataMost immediately, the transparency obligations in Article 50 now apply and enforcement powers expanded on August 2, 2026. Also enforcement machinery is operational for obligations that are already in forcedeferred high-risk obligations to December 2027. More precisely, Following the 2026 AI Omnibus, high-risk rules apply from December 2, 2027 for Annex III systems and August 2, 2028 for Annex I product-embedded systems and High-risk AI obligations now phase in later, with Annex III rules applying from December 2, 2027 and Annex I product-embedded rules from August 2, 2028specified cross-border circumstances involving providers, deployers, and AI-system outputs connected to the EUTraceability: the ability to trace what an AI system did and why and Authority provenance: demonstrating who authorized an AI actionArticle 50 distinguishes between providers and deployers with technical marking obligations on providers and labelling of deepfakes on deployershighest penalty tier reaches €35 million or 7% of worldwide annual turnover for prohibited practicesOverview at European Commission: Regulatory framework on AI.
2. United States - No single federal AI law; fragmented framework
The United States has not enacted a horizontal federal AI statute. Instead:
> The US does not have a single comprehensive AI law. ... Instead, regulation is fragmented
a) Federal executive layer:
Executive Order 14179 of January 23, 2025 — "Removing Barriers to American Leadership in Artificial Intelligence". Revoked Executive Order 14110 (October 2023) and reframed toward pro-innovation orientation.OMB Memorandum M-25-21 (April 2025) — "Accelerating Federal Use of AI through Innovation, Governance, and Public Trust". Replaced M-24-10. Applies to federal agencies' use of AIOMB Memorandum M-25-22 (April 2025) — "Driving Efficient Acquisition of Artificial Intelligence in Government" M-25-21 requires agencies to designate Chief AI Officers, maintain AI use case inventories, and adopt minimum risk management practices for safety-impacting and rights-impacting AI
b) Voluntary federal baseline - NIST AI Risk Management Framework:
NIST AI Risk Management Framework (AI RMF 1.0) — January 2023 is Voluntary, but referenced by federal and state authorities as the de facto baselineVoluntary risk management | Active, widely adoptedGOVERN, MAP, MEASURE, MANAGE where GOVERN is the culture and accountability layer that runs throughoutNIST AI RMF Generative AI Profile (AI 600-1) — July 2024 extends it to generative AIvalid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; and fairc) Sector regulators apply existing law to AI:
FTC (Federal Trade Commission) — Section 5 of the FTC Act applies to unfair or deceptive AI practicesEEOC — Guidance on AI in employment decisions; technical assistance documents on disparate impact in AI hiring toolsCFPB Circular 2023-03 on adverse action notices and AIHHS / FDA — AI/ML-based Software as a Medical Device (SaMD) guidance, DOT/NHTSA for autonomous vehicles, SEC for predictive analytics disclosures3. U.S. State Laws - Patchwork that creates binding accountability
With no federal statute, State laws fill the gap. As of July 2026, at least 5 states have comprehensive AI laws either in force or effective January 1, 2027 — California, Colorado, Texas, New York, and Illinois and 145 AI bills became law across all 50 states in 2025.
Selected examples:
comprehensive AI consumer-protection statute, in force February 2026. Covers high-risk AI systems with developer and deployer duties. Establishes parallel obligations for both developers and deployers, recognizing that preventing algorithmic discrimination requires accountability at multiple points in the AI lifecycle - developers document and deployers implement risk management and impact assessments.AB 2013 (AI training data transparency), SB 942 (AI Transparency Act covering content provenance), SB 1001 (bot disclosure), SB 53 (frontier AI safety, Transparency in Frontier AI Act). AB 2013 In force January 2026. Requires developers of generative AI systems made available to Californians to publish high-level documentation about data used to train the system. SB 53 Requires large frontier-AI developers to publish frontier AI safety frameworks and to report critical safety incidentsArtificial Intelligence Video Interview Act plus HB 3773 (2024) amending the Illinois Human Rights Act for AI in employment. HB 3773 In force January 2026. Prohibits use of AI that has the effect of subjecting employees to discriminationAI consumer-protection statute with enforcement by Texas Attorney General. Imposes duties on developers and deployers of high-risk AI systemsrequires AI disclosure in regulated occupations; creates Office of AI Policyautomated employment decision tools (AEDT) audit requirement, in force July 2023Transparency and explainability, Accountability: Clear ownership of outcomes with defined RACI matrices, Fairness and non-discrimination, Privacy and data protection, Security and robustness, Human oversight4. China - Sectoral mandatory rules
China has not passed one comprehensive AI law but over 30 enforceable standards targeting specific technologies.
Interim Administrative Measures for Generative Artificial Intelligence Services ("Interim Measures") in July 2023, recognised as the first binding regulation on generative AI, which apply to any individual that uses generative AI technology to provide services to the public in Mainland China and took effect 15 August 2023. Requires security assessments before public launch and filing with authoritiesDeep Synthesis Provisions released 10 January 2023 to strengthen its supervision over deep synthesis technologies — Mandates watermarking and disclosure for AI-generated images, video, and audioAI Safety Governance Framework 1.0 published in 2024AI Content Labeling Measures (Sep 2025): All AI-generated content must carry explicit and implicit labels5. International Voluntary Standards
The first international AI management system standard designed for certifiable management systemsHow accountability is typically enforced
Across all regimes, accountability converges on similar mechanisms:
performance drift, emergent bias, and unexpected failure modes, with a documented planBecause state and international timelines are overlapping and changing quickly, organizations deploying AI generally track the union of requirements that apply to where their models were trained, where they are deployed, and where outputs are received.
This is general information, not legal advice. For a specific system you are building or deploying, check the current official texts (EU AI Act, NIST AI RMF, and your state statutes) and consult counsel.
Citations (2)
- What is AI governance? Principles, frameworks & tooling (2026) | MintMCP Blog
Backs: “2 August 2025: General-purpose AI rules, including governance and transparency requirements, will go into effect and Stricter obligations will apply to general-purpose models from August 2025, including mandatory documentation of training data. 2 August 2026: Most immediately, the transparency obligations in Article…”
- TrueAI/regulatory-alignment/v1/USA-FEDERAL-AND-STATES.md at 96415716b06e9fbc056af902472cbafce654f4d8 · bryanunitek/TrueAI
Backs: “Overview at European Commission:. 2. United States - No single federal AI law; fragmented framework”