What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Rules and frameworks governing the building, deployment, and accountability of AI systems (such as large language models) form a rapidly evolving, multi-layered landscape. They include binding laws (notably the EU AI Act), voluntary standards and frameworks, state/provincial rules, sector-specific regulations, and the application of pre-existing laws (e.g., data protection and liability). There is no single global regime; applicability depends on jurisdiction, risk level/use case, and whether the system processes personal data or is placed on certain markets. Extraterritorial effects are common (e.g., EU rules can apply to non-EU providers whose systems affect EU users).[1]

1. European Union: The AI Act (Most Comprehensive Binding Framework)

The EU AI Act (Regulation (EU) 2024/1689) is the world’s first comprehensive horizontal AI law. It entered into force on 1 August 2024 and applies in phases with a risk-based approach.[1]

Risk categories and key rules:

•Unacceptable risk (prohibited): Banned practices include harmful manipulative/deceptive techniques, exploitation of vulnerabilities, social scoring, certain predictive policing/profiling, untargeted facial image scraping for databases, emotion recognition in workplaces/education (in many cases), biometric categorisation for sensitive traits, most real-time remote biometric identification in public spaces by law enforcement, and (from late 2026) certain non-consensual intimate/sexually explicit content generation. Prohibitions largely applied from February 2025.[1]

•High-risk: Systems in areas like critical infrastructure safety components, education/employment decisions, access to essential services (e.g., credit), law enforcement, migration/border control, administration of justice, and certain biometrics. Providers must implement a continuous risk management system; ensure high-quality, representative training/validation/testing data with governance; maintain technical documentation and automatic logs; provide transparency/instructions; enable effective human oversight; and ensure accuracy, robustness, and cybersecurity. Conformity assessment (often self- or third-party), EU declaration of conformity, CE marking, and registration in an EU database are required before market placement. Post-market monitoring and incident reporting apply. Obligations for many high-risk systems were deferred (via 2026 amendments) to December 2027 (Annex III stand-alone) or August 2028 (product-embedded).[2]

•Limited/transparency risk: Chatbots, deepfakes, and certain generative systems require disclosure that users are interacting with AI and (for synthetic content) labeling/marking so it is identifiable. Rules largely apply from August 2026 (with some transitions).[1]

•Minimal risk: Most systems (e.g., spam filters, games) face few or no specific AI Act rules.

•General-purpose AI (GPAI) models (including many foundation/LLMs): Transparency (e.g., training data summaries), copyright compliance, and—for systemic-risk models—risk assessments, evaluations, mitigations, and incident reporting. GPAI rules largely applied from August 2025; codes of practice and guidelines support compliance.[1]

Who is accountable: Heavy obligations fall on providers (developers who place systems/models on the market or put them into service under their name). Deployers (users under their own responsibility) must follow instructions, ensure human oversight, monitor, and (in some cases) conduct fundamental rights impact assessments. Importers/distributors have supporting duties. The AI Office (for GPAI) and national market surveillance authorities enforce; fines can reach €35 million or 7% of global annual turnover for the most serious violations.[3]

The Act coexists with (and does not override) the GDPR and other laws. Where personal data is processed (training, inputs, outputs), GDPR principles (lawful basis, purpose limitation, data minimisation, DPIAs for high-risk processing, rights including against solely automated decisions with significant effects under Art. 22, security) fully apply alongside AI Act requirements.[4]

2. United States: Patchwork of Federal Guidance, State Laws, and Existing Rules

There is no comprehensive federal AI statute. The Biden-era Executive Order 14110 (Safe, Secure, and Trustworthy AI, 2023) directed agency actions on safety testing, reporting for powerful models, civil rights, etc., but was revoked in early 2025 by subsequent orders (e.g., EO 14179) emphasizing removal of barriers to U.S. leadership, innovation, and a national policy framework, with revisions to agency guidance.[5]

•Voluntary federal frameworks: The NIST AI Risk Management Framework (AI RMF 1.0, 2023) and companions (e.g., Generative AI Profile) provide a widely used, voluntary structure with four core functions—Govern (culture, accountability, policies), Map (context, risks, impacts), Measure (metrics, testing), and Manage (prioritize/respond)—to achieve trustworthy AI characteristics (valid/reliable, safe, secure/resilient, accountable/transparent, explainable/interpretable, privacy-enhanced, fair with bias managed). It is sector-agnostic and supports lifecycle risk management.[6]

•State laws: Growing patchwork. California’s SB 53 (Transparency in Frontier Artificial Intelligence Act, 2025; effective ~January 2026) targets large frontier developers (high compute thresholds, e.g., >10²⁶ FLOPs, plus revenue >$500M for heightened duties). It requires publishing a frontier AI safety/risk framework (covering catastrophic risks like CBRN weapons, cyber attacks without oversight, or loss of control; incorporating standards/best practices; governance), transparency reports on deployments, reporting critical safety incidents (e.g., within 15 days to state authorities), and whistleblower protections. Other states address algorithmic discrimination (e.g., Colorado), deepfakes, employment, etc.[7]

•Other: Sectoral rules, export controls on advanced chips/compute, federal use policies (e.g., OMB memos on agency AI), NTIA accountability work (documentation, audits, liability recommendations), and GAO frameworks. Existing laws on civil rights, consumer protection, product liability, and torts apply to harms.[8]

Accountability often rests with the developing/deploying organization via internal governance, documentation, and potential civil liability; named individual roles are not always mandated by statute.

3. International Principles and Standards

•OECD AI Principles (Recommendation, 2019; updated 2024): Non-binding but highly influential (47+ adherents, including OECD members, EU, and others; informed G20 and many national frameworks). Five values-based principles for AI actors: (1) inclusive growth, sustainable development, and well-being (now including environmental sustainability); (2) human-centred values, fairness, human rights, and democratic values (including addressing mis/disinformation); (3) transparency and explainability; (4) robustness, security, and safety; (5) accountability. Plus recommendations to governments on policy, investment, and international cooperation. Updated definition of AI systems covers general-purpose/generative AI.[9]

•ISO/IEC 42001:2023: First international certifiable standard for an Artificial Intelligence Management System (AIMS). Organizations establish, implement, maintain, and improve policies/processes for responsible AI development, provision, or use (covering context, leadership/accountability, risk/impact assessment, lifecycle controls, data, transparency, human oversight, third parties, performance evaluation, and continual improvement via Plan-Do-Check-Act). Voluntary but increasingly used for procurement, evidence of good governance, and alignment with regulations like the EU AI Act.[10]

•Other: Council of Europe frameworks, UNESCO recommendations, G7 Hiroshima Process, national strategies, and emerging laws (e.g., South Korea’s AI Basic Act in force from early 2026 with high-impact/high-performance obligations; China’s layered rules on generative AI services, deep synthesis/synthetic content, recommendation algorithms, security assessments, and labeling, enforced via cybersecurity/data laws).[11]

4. Cross-Cutting Accountability Mechanisms and Existing Laws

•Building: Data governance/quality, risk/impact assessments (including fundamental rights or DPIAs), documentation/technical files, testing/evaluation (robustness, bias, safety), secure development, and (for high-risk/GPAI) conformity or systemic risk processes.

•Deployment: Human oversight (meaningful ability to intervene/override), transparency/disclosures (AI interaction, synthetic content labeling), monitoring/logging, post-market surveillance, and incident reporting.

•Held accountable: Organizational responsibility (providers often primary under EU rules; internal roles/governance under frameworks like NIST or CA SB 53); regulatory enforcement (fines, corrective actions, market bans); civil/criminal liability under product liability (defective AI), tort/negligence, consumer protection, anti-discrimination, and employment laws; private rights of action; audits/independent evaluations (emerging, e.g., CA auditor frameworks); whistleblower protections in some laws. Documentation, audit trails, and named accountability structures support this.[12]

•Pre-existing laws: GDPR/CCPA-equivalents (personal data in training/use), product safety, intellectual property/copyright (training data and outputs), cybersecurity (e.g., NIS2), and sector rules (finance, health, autos, critical infrastructure) apply regardless of AI-specific statutes.

Practical Notes for Systems Like Large Language Models/Chatbots

Many fall under GPAI/transparency rules (disclosure that content is AI-generated; training data summaries where required) rather than high-risk unless deployed in regulated high-risk use cases (e.g., employment screening, credit). Providers face data/copyright/safety duties; deployers handle user-facing transparency and oversight. Compliance often involves inventorying systems, classifying risk, implementing governance (aligned to NIST/ISO/OECD), and preparing documentation.

The landscape continues to evolve quickly (e.g., EU simplifications/deferrals, U.S. state activity, new national laws, standards updates). Organizations typically map obligations by jurisdiction and use case, often adopting voluntary frameworks as a baseline for global interoperability and risk management. For the latest or jurisdiction-specific advice, consult official sources or legal experts, as this is a high-level overview based on publicly available information as of late 2026.

Citations (12)

1europa.euGovernment
https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
Backs: “Extraterritorial effects are common (e.g., EU rules can apply to non-EU providers whose systems affect EU users).”
2venvera.comLow provenance
https://venvera.com/learn/eu-ai-act/high-risk-requirements
Backs: “Obligations for many high-risk systems were deferred (via 2026 amendments) to December 2027 (Annex III stand-alone) or August 2028 (product-embedded).”
3lexology.comCommercial content
https://www.lexology.com/library/detail.aspx?g=f7bdfe0a-e1c6-4bbf-a864-e88638c59cd1
Backs: “The AI Office (for GPAI) and national market surveillance authorities enforce; fines can reach €35 million or 7% of global annual turnover for the most serious violations.”
4cnil.frNot yet classified
https://www.cnil.fr/en/ai-system-development-cnils-recommendations-to-comply-gdpr
Backs: “Where personal data is processed (training, inputs, outputs), GDPR principles (lawful basis, purpose limitation, data minimisation, DPIAs for high-risk processing, rights including against solely automated decisions with significant effects under Art. 22, security) fully apply alongside AI Act requirements.”
5casrai.orgNonprofits and think tanks
https://casrai.org/guides/trump-ai-executive-orders-eo-14179-eo-14365
Backs: “The Biden-era Executive Order 14110 (Safe, Secure, and Trustworthy AI, 2023) directed agency actions on safety testing, reporting for powerful models, civil rights, etc., but was revoked in early 2025 by subsequent orders (e.g., EO 14179) emphasizing removal of barriers to U.S. leadership, innovation, and a national…”
6nist.govGovernment
https://www.nist.gov/itl/ai-risk-management-framework
Backs: “It is sector-agnostic and supports lifecycle risk management.”
7carnegieendowment.orgNonprofits and think tanks
https://carnegieendowment.org/emissary/2025/10/california-sb-53-frontier-ai-law-what-it-does?lang=en
Backs: “Other states address algorithmic discrimination (e.g., Colorado), deepfakes, employment, etc.”
8ntia.govGovernment
https://www.ntia.gov/issues/artificial-intelligence/ai-accountability-policy-report
Backs: “Existing laws on civil rights, consumer protection, product liability, and torts apply to harms.”
9aipolicytracker.orgNot yet classified
https://aipolicytracker.org/policies/oecd-recommendation-on-artificial-intelligence
Backs: “Updated definition of AI systems covers general-purpose/generative AI.”
10iso.orgNonprofits and think tanks
https://www.iso.org/standard/81230.html
Backs: “Voluntary but increasingly used for procurement, evidence of good governance, and alignment with regulations like the EU AI Act.”
11getregula.comNot yet classified
https://getregula.com/regions/regulations.html
Backs: “China’s layered rules on generative AI services, deep synthesis/synthetic content, recommendation algorithms, security assessments, and labeling, enforced via cybersecurity/data laws).”
12casrai.orgNonprofits and think tanks
https://casrai.org/guides/ai-accountability
Backs: “Documentation, audit trails, and named accountability structures support this.”