What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Short answer: There isn’t one single global “AI law.” Today, AI builders and deployers operate under a patchwork of binding laws, regulator guidance, export controls, sector rules, and voluntary standards. Here are the pieces that matter most right now, with who they apply to and what they require.

United States (federal)

•Executive branch policy and agency rules

•Executive Order 14110 (Oct 30, 2023) directs the Commerce Department and NIST to set safety testing, reporting, and security expectations for “dual‑use” foundation models; it launched ongoing red‑team, watermarking, and safety‑reporting workstreams.[1]

•OMB Memorandum M‑24‑10 (Mar 2024) binds federal agencies: designate Chief AI Officers, inventory AI uses, do impact assessments, test/red‑team “safety‑impacting” AI before deployment, and publish certain use cases. While aimed at government use, it influences vendors that sell to government.[2]

•NIST AI Risk Management Framework 1.0 (Jan 2023) and the Generative AI Profile (Jul 2024) are voluntary but widely used by companies to structure governance, testing, and documentation.[3]

•Trade/export and model‑weights controls

•BIS interim rules (Jan 2025) added export controls on certain “advanced” closed‑weight AI model weights and related items; BIS also proposed (Sep 2024) reporting for training runs above a compute threshold and for large compute clusters under EO 14110. Some elements are being refined, but they show the direction of travel for frontier‑model oversight.[4]

•Civil rights and consumer protection (enforced under existing laws)

•FTC, CFPB, DOJ, and EEOC jointly stated in Apr 2023 that AI is fully subject to existing consumer protection and anti‑discrimination laws; there is “no AI exemption.” This covers unfair/deceptive practices, credit, housing, employment, and competition.[5]

•Sector regulators

•FDA has issued multiple guidances for AI/ML medical devices (e.g., marketing submissions and “predetermined change control plans”), and participates in GMLP principles through IMDRF—meaning lifecycle risk management, monitoring, and change control are expected for AI medical devices.[6]

United States (state and local)

•Colorado AI Act (SB24‑205): from Feb 1, 2026, “developers” and “deployers” of high‑risk AI that makes “consequential decisions” must run a risk‑management program, impact assessments, notices, bias monitoring, and incident reporting; enforced by the Attorney General.[7]

•California CPPA regulations (effective Jan 1, 2026): new rules under the CCPA require privacy risk assessments, certain cybersecurity audits, and give consumers rights to access/opt out of “automated decision‑making technology” (ADMT) in significant decisions; ADMT compliance deadlines extend into 2027.[8]

•New York City Local Law 144 (in force since 2023): employers using “automated employment decision tools” must obtain an annual independent bias audit and give notices to candidates/employees.[9]

•Voice/image rights: Tennessee’s ELVIS Act (Mar 2024) expanded protection for voice likeness against AI cloning, a model some other states are now following.[10]

European Union

•EU AI Act (entered into force Aug 1, 2024; most rules apply Aug 2, 2026, with staged deadlines):

•Bans certain practices; transparency duties (e.g., deepfake labeling) apply earlier; “high‑risk” system duties apply later on a staggered schedule (e.g., Dec 2, 2027 for many stand‑alone high‑risk systems, Aug 2, 2028 for high‑risk systems embedded in regulated products). Providers of general‑purpose AI (GPAI) have baseline obligations, with extra duties for “systemic‑risk” models. Expect conformity assessment, logging, data‑governance, testing, incident reporting, and human‑oversight controls.[11]

•Digital Services Act (DSA): very large platforms/search engines must assess and mitigate systemic risks linked to recommender systems, provide non‑profiling recommender options, and publish transparency reports (including error rates of automated moderation).[12]

•Product liability: the updated Product Liability Directive (2024/2853) clarifies that software (including AI systems) is a “product” for strict‑liability purposes; software developers can be “manufacturers.” This affects how injured users can claim compensation.[13]

•Data and copyright overlays:

•GDPR limits profiling/solely automated decisions with significant effects and requires transparency, legal basis, and safeguards; it also governs training data that include personal data.[14]

•Copyright: the 2019 DSM Directive’s text‑and‑data‑mining regime lets rightsholders opt out of mining (affecting AI training); the Commission is evaluating a unified opt‑out registry. The AI Act also points GPAI providers to respect TDM opt‑outs and publish sufficiently detailed training‑data summaries.[15]

United Kingdom

•No horizontal “AI Act”; the government uses a regulator‑led, “pro‑innovation” approach and created the AI Safety Institute to evaluate frontier models. Sector regulators (ICO, FCA, CMA, etc.) apply existing law plus guidance.[16]

China

•Interim Measures for Generative AI Services (effective Aug 15, 2023) impose content controls, security assessments for services with public‑opinion or mobilization capacity, algorithm filing/record‑keeping, data quality and non‑discrimination measures, complaint handling, and transparency on providers of public‑facing genAI.[17]

International treaties and soft law

•Council of Europe Framework Convention on AI, Human Rights, Democracy and the Rule of Law (opened for signature Sep 5, 2024): a binding human‑rights‑anchored AI treaty for signatories, to be implemented through national measures.[18]

•OECD AI Principles (2019; updated 2024) and the G7 Hiroshima Process (2023 guiding principles and voluntary code of conduct for developers of advanced AI): non‑binding, but widely referenced in corporate governance and by regulators.[19]

Voluntary standards that organizations use to demonstrate “state of the art”

•NIST AI RMF 1.0 and Playbook (U.S.).[3]

•ISO/IEC 42001 (AI management system), ISO/IEC 23894 (AI risk management), and ISO/IEC 42005 (AI system impact assessments) help structure policies, controls, and documentation; they are often mapped to the EU AI Act and NIST RMF.[20]

What this means in practice (common obligations you’ll see across regimes)

•Risk management and testing: document risks, run pre‑deployment and ongoing evaluations/red‑teaming, and keep logs and technical documentation.[3]

•Transparency: notify users when AI meaningfully influences decisions; label synthetic content/deepfakes; publish summaries of training data sources for GPAI (EU).[11]

•Human oversight and impact assessments: ensure meaningful human review for significant decisions; conduct impact/bias assessments for high‑risk uses (hiring, credit, housing, health, education, essential services).[7]

•Data governance and rights: follow privacy law for training/inputs/outputs, handle sensitive data carefully, and honor copyright TDM opt‑outs where applicable.[14]

•Incident reporting and post‑market monitoring: detect, document, and report serious incidents or systemic risks, then iterate mitigations (especially in the EU AI Act and FDA settings).[11]

If you tell me:

•where you operate (e.g., U.S., EU, UK, etc.),

•what you’re building (foundation model vs. an application),

•and which use cases you’ll support (employment, credit, healthcare, education, kids, public sector, etc.),

I can map the specific obligations, deadlines, and the shortest path to compliance (e.g., which assessments, which notices, which controls, and which standards to adopt first).

Citations (20)

1thefederalregister.orgLow provenance
Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence | 88 FR 75191
Backs: “Executive Order 14110 (Oct 30, 2023) directs the Commerce Department and NIST to set safety testing, reporting, and security expectations for “dual‑use” foundation models; it launched ongoing red‑team, watermarking, and safety‑reporting workstreams.”
2whitehouse.govGovernment
EXECUTIVE OFFICE OF THE PRESIDENT
Backs: “While aimed at government use, it influences vendors that sell to government.”
3nist.govGovernment
AI Risk Management Framework | NIST
Backs: “NIST AI Risk Management Framework 1.0 (Jan 2023) and the Generative AI Profile (Jul 2024) are voluntary but widely used by companies to structure governance, testing, and documentation.”
4govinfo.govGovernment
Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Rules and Regulations
Backs: “Some elements are being refined, but they show the direction of travel for frontier‑model oversight.”
5ftc.govGovernment
FTC Chair Khan and Officials from DOJ, CFPB and EEOC Release Joint Statement on AI | Federal Trade Commission
Backs: “FTC, CFPB, DOJ, and EEOC jointly stated in Apr 2023 that AI is fully subject to existing consumer protection and anti‑discrimination laws; there is “no AI exemption.” This covers unfair/deceptive practices, credit, housing, employment, and competition.”
6fda.govGovernment
Guidances with Digital Health Content | FDA
Backs: “FDA has issued multiple guidances for AI/ML medical devices (e.g., marketing submissions and “predetermined change control plans”), and participates in GMLP principles through IMDRF—meaning lifecycle risk management, monitoring, and change control are expected for AI medical devices.”
7colorado.govGovernment
SB24-205 Consumer Protections for Artificial Intelligence | Colorado General Assembly
Backs: “Colorado AI Act (SB24‑205): from Feb 1, 2026, “developers” and “deployers” of high‑risk AI that makes “consequential decisions” must run a risk‑management program, impact assessments, notices, bias monitoring, and incident reporting; enforced by the Attorney General.”
8ca.govGovernment
CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology (ADMT), and Insurance Regulations - California Privacy Protection Agency (CPPA)
Backs: “California CPPA regulations (effective Jan 1, 2026): new rules under the CCPA require privacy risk assessments, certain cybersecurity audits, and give consumers rights to access/opt out of “automated decision‑making technology” (ADMT) in significant decisions; ADMT compliance deadlines extend into 2027.”
9nyc.govGovernment
Automated Employment Decision Tools (AEDT) - DCWP
Backs: “New York City Local Law 144 (in force since 2023): employers using “automated employment decision tools” must obtain an annual independent bias audit and give notices to candidates/employees.”
10tn.govGovernment
PHOTOS: Gov. Lee Signs ELVIS Act Into Law
Backs: “Tennessee’s ELVIS Act (Mar 2024) expanded protection for voice likeness against AI cloning, a model some other states are now following.”
11europa.euGovernment
AI Act | Shaping Europe’s digital future
Backs: “Expect conformity assessment, logging, data‑governance, testing, incident reporting, and human‑oversight controls.”
12europa.euGovernment
Regulation - 2022/2065 - EN - DSA - EUR-Lex
Backs: “Digital Services Act (DSA): very large platforms/search engines must assess and mitigate systemic risks linked to recommender systems, provide non‑profiling recommender options, and publish transparency reports (including error rates of automated moderation).”
13europa.euGovernment
Directive (EU) 2024/2853 of the European Parliament and of the Council of 23 October 2024 on liability for defective products and repealing Council Directive 85/374/EEC (Text with EEA relevance)
Backs: “Product liability: the updated Product Liability Directive (2024/2853) clarifies that software (including AI systems) is a “product” for strict‑liability purposes; software developers can be “manufacturers.” This affects how injured users can claim compensation.”
14europa.euGovernment
Regulation - 2016/679 - DE - gdpr - EUR-Lex
Backs: “GDPR limits profiling/solely automated decisions with significant effects and requires transparency, legal basis, and safeguards; it also governs training data that include personal data.”
15europa.euGovernment
New feasibility study for introducing an EU-level registry of Text and Data Mining opt-out | Shaping Europe’s digital future
Backs: “The AI Act also points GPAI providers to respect TDM opt‑outs and publish sufficiently detailed training‑data summaries.”
16gov.ukGovernment
A pro-innovation approach to AI regulation: government response - GOV.UK
Backs: “Sector regulators (ICO, FCA, CMA, etc.) apply existing law plus guidance.”
17cac.gov.cnGovernment
生成式人工智能服务管理暂行办法_中央网络安全和信息化委员会办公室
Backs: “Interim Measures for Generative AI Services (effective Aug 15, 2023) impose content controls, security assessments for services with public‑opinion or mobilization capacity, algorithm filing/record‑keeping, data quality and non‑discrimination measures, complaint handling, and transparency on providers of public‑facing…”
18coe.intGovernment
The Framework Convention on Artificial Intelligence - Artificial Intelligence
Backs: “Council of Europe Framework Convention on AI, Human Rights, Democracy and the Rule of Law (opened for signature Sep 5, 2024): a binding human‑rights‑anchored AI treaty for signatories, to be implemented through national measures.”
19oecd.orgGovernment
AI principles | OECD
Backs: “OECD AI Principles (2019; updated 2024) and the G7 Hiroshima Process (2023 guiding principles and voluntary code of conduct for developers of advanced AI): non‑binding, but widely referenced in corporate governance and by regulators.”
20iec.chNot yet classified
ISO/IEC 42001:2023 | IEC
Backs: “ISO/IEC 42001 (AI management system), ISO/IEC 23894 (AI risk management), and ISO/IEC 42005 (AI system impact assessments) help structure policies, controls, and documentation; they are often mapped to the EU AI Act and NIST RMF.”