What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Rules governing AI systems (like large language models and generative AI) cover development/building, deployment/use, and accountability, but form a patchwork of binding laws, voluntary frameworks, standards, and existing general laws rather than a single global regime. They emphasize risk-based approaches, with stricter rules for high-risk or frontier systems. Coverage is strongest in the EU; the US relies more on voluntary measures, executive actions, state laws, and sector-specific rules; international efforts provide principles. Many apply extraterritorially (e.g., to non-EU providers whose systems affect the EU market).[1][2]

European Union: The AI Act (Regulation (EU) 2024/1689)

This is the world’s first comprehensive, binding horizontal AI law. It entered into force in August 2024, with phased application (prohibitions and some GPAI rules earlier; transparency from ~August 2026; high-risk obligations deferred via 2026 amendments/Digital Omnibus to December 2027 for standalone Annex III systems and August 2028 for those in regulated products). It uses a risk-based approach and applies to providers (developers/placers on market), deployers (users in professional capacity), importers, and distributors—regardless of location if the system or its output is used in the EU.[1][3]

Risk categories and rules:

•Unacceptable risk (prohibited): Bans practices like harmful manipulation/deception, exploitation of vulnerabilities, social scoring, untargeted facial scraping for databases, most real-time remote biometric ID in public for law enforcement (narrow exceptions), emotion recognition in workplaces/education (limited exceptions), biometric categorization for sensitive traits, predictive policing based solely on profiling, and (from late 2026) certain non-consensual intimate/CSAM generative content.[1][1]

•High-risk: Systems as safety components in regulated products (Annex I, e.g., machinery, medical) or listed use cases (Annex III: biometrics, critical infrastructure, education/employment decisions, access to essential services/credit, law enforcement, migration/border, justice/democracy). Requirements for providers include: risk management systems (iterative lifecycle process); high-quality data governance (to minimize bias); technical documentation; automatic logging/traceability; transparency/instructions for use; human oversight design; accuracy, robustness, and cybersecurity. Quality management systems, conformity assessments (self or third-party), CE marking, EU database registration, post-market monitoring, and serious incident reporting. Deployers must follow instructions, ensure competent human oversight, and keep logs.[4][3]

•Limited/transparency risk: Chatbots, deepfakes/synthetic content—disclose AI interaction; mark AI-generated content (especially public-interest or deepfakes).

•Minimal/no risk: Most systems (e.g., spam filters, games)—largely unregulated under the Act.

•General-purpose AI (GPAI)/foundation models: Transparency (technical docs, training data summary, copyright compliance); systemic-risk models (high capability/compute) face evaluations, risk assessments/mitigations, incident reporting, and cybersecurity. Codes of practice support compliance.[1]

Accountability/enforcement: Market surveillance by national authorities and the EU AI Office (stronger for GPAI); fines up to €35M or 7% global turnover (prohibited) or lower tiers for other breaches; documentation enables audits/traceability. Existing laws (e.g., GDPR for data/privacy) layer on top.[5]

United States

No comprehensive federal AI statute exists. Approach prioritizes innovation, with voluntary frameworks, executive actions, existing laws (civil rights, consumer protection, sector rules in finance/health/etc.), and growing state activity. Federal policy has shifted with administrations.[6]

•Federal executive/policy: Biden’s EO 14110 (2023, Safe/Secure/Trustworthy AI) imposed reporting for dual-use foundation models, safety testing, standards development, etc., but was revoked by Trump. Trump-era actions emphasize “minimally burdensome” regulation, American AI leadership/dominance, voluntary industry commitments (e.g., safety guidelines, self-policing), potential preemption of burdensome state laws, national security reviews (e.g., voluntary pre-release windows for advanced models in some EOs), cybersecurity focus, and reducing barriers. OMB guidance and other memos address federal agency AI use/procurement (risk management, inventories). An NTIA AI Accountability Policy Report (2024) recommended guidance, support, audits/independent evaluations for high-risk systems, documentation/disclosures, and consequences/liability.[7][8][9]

•NIST AI Risk Management Framework (AI RMF 1.0, 2023; Generative AI Profile 2024): Voluntary, widely influential. Core functions: Govern (culture, accountability, policies); Map (context, risks, impacts); Measure (metrics, testing, evaluation); Manage (prioritize/respond to risks). Emphasizes trustworthiness characteristics (valid/reliable, safe, secure/resilient, accountable/transparent, explainable/interpretable, privacy-enhanced, fair/bias-managed). Playbook and profiles aid implementation; used by industry/government.[10][11]

•State laws (dozens enacted or proposed; patchwork growing): Focus often on frontier/high-risk systems, bias/discrimination in automated decisions, deepfakes, transparency. Key examples:

•California SB 53 (Transparency in Frontier AI Act, effective ~Jan 2026): Targets frontier developers (models trained with >10²⁶ FLOPs) and especially “large” ones (>$500M annual revenue). Requires public frontier AI safety frameworks (risk assessment/mitigation for catastrophic risks like CBRN weapons, autonomous cyber/crime, loss of control causing mass harm/>$1B damage; standards incorporation; governance); pre-deployment transparency reports; critical safety incident reporting (to state emergency services, tight timelines); whistleblower protections. Later measures add independent audits/oversight elements. Other CA laws cover training data disclosure, AI content marking/detection.[12][13]

•Similar frontier-focused laws in New York (RAISE Act) and Illinois (with mandatory audits). Colorado’s AI Act (and others) require risk management, impact assessments, disclosures/notices, and consumer rights (opt-out, appeal) for high-risk automated decision-making (e.g., employment, credit, housing, insurance). Texas and others restrict specific harmful uses (e.g., deepfakes, CSAM). Many states address election deepfakes, biometric/privacy issues.[14][9]

•Accountability: Existing product liability/tort, discrimination (e.g., Title VII, ECOA), FTC unfair/deceptive practices, sector regulators. Recommendations for audits, red-teaming, documentation. No broad federal pre-deployment licensing yet (voluntary elements in some EOs).

International and Voluntary Frameworks/Standards

These influence national laws and corporate practice (non-binding or certifiable):

•OECD AI Principles (2019, updated 2024): Widely adopted (dozens of countries + G20 influence). Values-based: (1) inclusive growth/sustainable development/well-being; (2) human rights/democratic values including fairness/privacy (addresses mis/disinfo); (3) transparency/explainability; (4) robustness/security/safety; (5) accountability. Policy recommendations: invest in R&D, inclusive ecosystems, agile interoperable governance, human capacity/labor transitions, international cooperation. Updated for generative/GPAI.[15][16]

•UNESCO Recommendation on the Ethics of AI (2021): Broad consensus (193 states) on human rights, do-no-harm, safety, fairness, privacy, sustainability, transparency, human oversight, accountability. Supports national policy development.[17]

•ISO/IEC 42001: Certifiable AI management system standard (policy, roles, risk treatment, lifecycle controls, continual improvement)—maps well to EU AI Act/NIST.[18]

•Others: G7 Hiroshima Process (guiding principles/code of conduct for advanced AI); UN Global Dialogue/resolutions and Advisory Body recommendations; IEEE ethical design standards; Council of Europe efforts. Many countries developing national strategies inspired by these.[19]

Building, Deployment, and Accountability Cross-Cutting Themes

•Building/development: Risk management systems, data quality/governance (bias mitigation), technical documentation, robustness/cybersecurity/safety testing (including red-teaming/evals for frontier), human oversight by design, quality management. Frontier-specific: catastrophic risk assessments, safety frameworks, compute thresholds. GPAI: training data summaries, copyright.

•Deployment/use: Intended-purpose restrictions, instructions/transparency to users (AI disclosure, content labeling), human oversight by competent persons, logging/monitoring, conformity to risk class, post-market surveillance/incident reporting. Deployers share some duties.

•Accountability/holding responsible: Documentation for audits/traceability; independent evaluations/audits (mandatory in some high-risk/frontier cases); registration/databases; incident reporting; whistleblower protections; fines/penalties; liability under AI-specific + general laws (tort, product, privacy, discrimination); named owners/roles/governance structures; CE marking/conformity for market access. Voluntary commitments and self-regulation fill gaps. Enforcement via market surveillance, agencies (e.g., EU AI Office, state AGs, FTC), civil suits.[7][20]

For systems like Grok (general-purpose conversational AI by xAI): Typically limited/transparency risk or GPAI under EU (disclose AI nature; content marking if generative/synthetic; potential systemic-risk rules if highly capable). Not automatically high-risk unless deployed in Annex III contexts (e.g., hiring, credit). US: voluntary NIST alignment, state frontier rules if thresholds met, general laws. Companies often publish safety frameworks, conduct evals, and follow OECD/NIST principles voluntarily. Rules evolve rapidly with technology and politics (e.g., Omnibus delays, new state bills, federal frameworks).[21]

Existing non-AI laws (privacy like GDPR/CCPA, IP/copyright, consumer protection, criminal, export controls, critical infrastructure) always apply. Compliance often involves mapping to multiple frameworks (e.g., EU Act + NIST + ISO 42001). For the latest, check official sources as timelines and details shift.

Citations (21)

1europa.euGovernment
https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
Backs: “Many apply extraterritorially (e.g., to non-EU providers whose systems affect the EU market).”
evidence, official document. Claim: EU AI Act is a risk-based binding framework with prohibited practices, high-risk rules, transparency duties and GPAI obligations, applying extraterritorially.
2rand.orgNonprofits and think tanks
https://www.rand.org/pubs/research_reports/RRA3243-3.html
Backs: “Many apply extraterritorially (e.g., to non-EU providers whose systems affect the EU market).”
background, official document. Claim: AI rules form a patchwork with strict rules for high-risk systems, applying extraterritorially to non-EU providers.
3artificialintelligenceact.euNonprofits and think tanks
https://artificialintelligenceact.eu/high-level-summary/
Backs: “It uses a risk-based approach and applies to providers (developers/placers on market), deployers (users in professional capacity), importers, and distributors—regardless of location if the system or its output is used in the EU.”
evidence, reference entry. Claim: AI Act timing and scope: applies to providers, deployers, importers and distributors; high-risk requirements for providers and deployers.
4venvera.comLow provenance
https://venvera.com/learn/eu-ai-act/high-risk-requirements
Backs: “Deployers must follow instructions, ensure competent human oversight, and keep logs.”
evidence, article. Claim: High-risk AI providers must implement risk management, data governance, documentation, logging, human oversight, conformity assessment and incident reporting.
5cyberhaven.comCompanies
https://www.cyberhaven.com/infosec-essentials/eu-ai-act
Backs: “Market surveillance by national authorities and the EU AI Office (stronger for GPAI); fines up to €35M or 7% global turnover (prohibited) or lower tiers for other breaches; documentation enables audits/traceability. Existing laws (e.g., GDPR for data/privacy) layer on top.”
statistic, article. Claim: EU AI Act enforcement via market surveillance with fines up to €35M or 7% of global turnover; GDPR layers on top.
6congress.govGovernment
https://www.congress.gov/crs-product/R48555
Backs: “Approach prioritizes innovation, with voluntary frameworks, executive actions, existing laws (civil rights, consumer protection, sector rules in finance/health/etc.), and growing state activity. Federal policy has shifted with administrations.”
background, official document. Claim: No comprehensive US federal AI statute exists; approach relies on voluntary frameworks, existing laws and state activity.
7ntia.govGovernment
https://www.ntia.gov/issues/artificial-intelligence/ai-accountability-policy-report
Backs: “An NTIA AI Accountability Policy Report (2024) recommended guidance, support, audits/independent evaluations for high-risk systems, documentation/disclosures, and consequences/liability.”
evidence, official document. Claim: NTIA 2024 AI Accountability Policy Report recommended audits, evaluations, disclosures and consequences/liability for high-risk systems.
8whitehouse.govGovernment
https://www.whitehouse.gov/fact-sheets/2025/01/fact-sheet-president-donald-j-trump-takes-action-to-enhance-americas-ai-leadership/?query-11-page=121&trk=article-ssr-frontend-pulse_little-text-block
Backs: “An NTIA AI Accountability Policy Report (2024) recommended guidance, support, audits/independent evaluations for high-risk systems, documentation/disclosures, and consequences/liability.”
evidence, official document. Claim: Trump-era actions emphasize minimally burdensome regulation and American AI leadership after revoking Biden's EO 14110.
9legalclarity.orgCommercial content
https://legalclarity.org/ai-accountability-regulations-enforcement-and-governance/
Backs: “An NTIA AI Accountability Policy Report (2024) recommended guidance, support, audits/independent evaluations for high-risk systems, documentation/disclosures, and consequences/liability.”
evidence, article. Claim: US accountability via existing laws and state AI laws such as Colorado's requiring risk management and impact assessments.
10nist.govGovernment
https://www.nist.gov/itl/ai-risk-management-framework
Backs: “Playbook and profiles aid implementation; used by industry/government.”
evidence, official document. Claim: NIST AI RMF is voluntary with Govern, Map, Measure, Manage functions.
11nist.govGovernment
https://airc.nist.gov/AI_RMF_Knowledge_Base/AI_RMF
Backs: “Playbook and profiles aid implementation; used by industry/government.”
evidence, official document. Claim: NIST AI RMF trustworthiness characteristics and implementation resources.
12carnegieendowment.orgNonprofits and think tanks
https://carnegieendowment.org/emissary/2025/10/california-sb-53-frontier-ai-law-what-it-does?lang=en
Backs: “Other CA laws cover training data disclosure, AI content marking/detection.”
evidence, article. Claim: California SB 53 requires frontier developers to publish safety frameworks, transparency reports, report incidents and protect whistleblowers.
13metr.orgNonprofits and think tanks
https://metr.org/notes/2026-01-29-frontier-ai-safety-regulations
Backs: “Other CA laws cover training data disclosure, AI content marking/detection.”
evidence, article. Claim: Frontier AI safety regulations including California SB 53 and later measures adding audit elements.
14bigid.comCompanies
https://bigid.com/blog/ai-regulation-guide/
Backs: “Many states address election deepfakes, biometric/privacy issues.”
evidence, article. Claim: State laws in New York, Illinois, Colorado and elsewhere address frontier AI, automated decisions and deepfakes.
15oecd.aiGovernment
https://oecd.ai/en/ai-principles
Backs: “Policy recommendations: invest in R&D, inclusive ecosystems, agile interoperable governance, human capacity/labor transitions, international cooperation. Updated for generative/GPAI.”
evidence, official document. Claim: OECD AI Principles (2019, updated 2024) set values-based principles and policy recommendations.
16verityai.coCompanies
https://verityai.co/blog/oecd-ai-principles-guide
Backs: “Policy recommendations: invest in R&D, inclusive ecosystems, agile interoperable governance, human capacity/labor transitions, international cooperation. Updated for generative/GPAI.”
background, article. Claim: OECD AI Principles widely adopted and updated for generative AI.
17unesco.orgGovernment
https://www.unesco.org/en/artificial-intelligence
Backs: “Broad consensus (193 states) on human rights, do-no-harm, safety, fairness, privacy, sustainability, transparency, human oversight, accountability. Supports national policy development.”
evidence, official document. Claim: UNESCO Recommendation on the Ethics of AI (2021) adopted by 193 states.
18naaia.aiNonprofits and think tanks
https://naaia.ai/en/ai-governance-framework-how-to-build-one-that-meets-the-ai-act-iso-42001-and-nist-ai-rmf/
Backs: “Certifiable AI management system standard (policy, roles, risk treatment, lifecycle controls, continual improvement)—maps well to EU AI Act/NIST.”
evidence, article. Claim: ISO/IEC 42001 is a certifiable AI management system standard that maps to EU AI Act and NIST.
19aisecurityandsafety.orgNonprofits and think tanks
https://aisecurityandsafety.org/en/guides/ai-governance-frameworks-compared/
Backs: “Many countries developing national strategies inspired by these.”
further reading, article. Claim: Other frameworks: G7 Hiroshima Process, UN resolutions, IEEE standards, Council of Europe efforts.
20casrai.orgNonprofits and think tanks
https://casrai.org/guides/what-is-ai-governance
Backs: “Enforcement via market surveillance, agencies (e.g., EU AI Office, state AGs, FTC), civil suits.”
background, article. Claim: Accountability mechanisms include audits, incident reporting, documented governance roles and enforcement.
21nhimg.orgNonprofits and think tanks
https://nhimg.org/agentic-ai-compliance-guide
Backs: “Rules evolve rapidly with technology and politics (e.g., Omnibus delays, new state bills, federal frameworks).”
background, article. Claim: How rules apply to general-purpose conversational AI such as Grok and evolving compliance expectations.