I'll map the current rules that govern how AI systems are built, deployed, and held accountable.
As of 2026, there is no single global law that governs how AI systems like me are built, deployed and held accountable. Instead there is a layered system of binding laws, sectoral rules, and voluntary governance frameworks:
1. European Union - The EU AI Act
The most comprehensive binding framework is the European Union's AI Act, which establishes a binding, risk-based regulatory framework
It is an EU Regulation that applies in phases:
•2 February 2025: Bans on "unacceptable-risk" AI practices applied
•2 August 2025: Obligations for providers of "general-purpose" AI systems — such as large language models — began to apply , requiring technical documentation, training data summaries and copyright compliance.
•2 August 2026: Transparency obligations now apply . Article 50 of the EU AI Act came into force on 2 August 2026, introducing transparency obligations for providers and deployers of certain AI systems - including that providers must disclose AI interactions and mark AI-generated or manipulated content, while deployers must disclose deepfakes
Other parts were deliberately phased:
> The prohibitions on unacceptable-risk AI practices have applied since February 2, 2025, and are untouched. General-purpose AI model obligations have applied since August 2, 2025, and are also untouched. And Article 50's transparency rules... were not part of the deferral
Governance rules and obligations for providers of general-purpose AI models began applying in August 2025 , and high-risk obligations for standalone systems were delayed to 2 December 2027 under the Digital Omnibus. The Act applies extraterritorially to any system whose output reaches the EU market, even if the provider is outside the EU, and is enforced by the European Commission's AI Office and national authorities with fines up to €35M or 7% of global turnover
2. United States - Federal Level
The US has no comprehensive federal AI statute comparable to the EU AI Act. Regulation is sectoral and via executive action:
•No enacted comprehensive law: Proposals like the Algorithmic Accountability Act would have directed the FTC to require companies to assess impacts of automated decision systems , but remain proposals as of 2026.
•Executive Orders and OMB Policy: The White House Office of Management and Budget (OMB) set policy demanding that federal agencies be transparent about AI use and to drive "federal accountability and oversight of AI" . In January 2025 the administration rolled back Biden-era safeguards for high-risk AI , and in July 2025 released Winning the Race: America's AI Action Plan which calls for removing federal regulations that hinder AI development and deployment .
•December 2025 Executive Order: On Dec. 11, 2025 President Trump signed an executive order titled "Ensuring a National Policy Framework for Artificial Intelligence" that seeks to establish federal supremacy over state AI regulation and directs the Department of Justice to challenge certain state AI laws .
•First narrow federal AI law: The TAKE IT DOWN Act signed in May 2025 represented Congress's first federal legislative response to AI-generated synthetic media — narrowly scoped to non-consensual intimate imagery rather than broader AI regulation .
Other applicable federal rules include privacy and civil rights laws (GDPR for EU users, CCPA in California, FTC Act, anti-discrimination laws) which emphasize the importance of data security and privacy and require handling personal data ethically
3. United States - State Level
Because federal action is limited, states have created binding requirements:
•Colorado AI Act (SB 24-205) - Enacted May 2024: Considered the first comprehensive state AI law, it creates duties for developers and for those that deploy AI and is described as establishing the first comprehensive state-level framework governing high-risk AI systems. By creating parallel obligations for developers and deployers, mandating risk management programs and impact assessments . Enforcement is by the Attorney General with penalties up to ~$20,000 per violation , with no private right of action. Effective date moved to June 30, 2026 / Jan 1, 2027 after amendments.
•California AI Transparency Act (SB 942): Enacted September 2024, effective Jan 1, 2026 (and Aug 2, 2026 for some provisions) - requires covered providers of generative AI systems to create AI detection tools and mandates "clear, conspicuous" disclosures for AI-generated images, videos, and audio , with $5,000 per violation . Related California laws effective Jan 1, 2026 include the Frontier AI Act (SB 53) requiring safety frameworks for frontier developers and Training Data Transparency (AB 2013) .
•Texas Responsible AI Governance Act (TRAIGA) - Effective Jan 1, 2026: Applies broadly to persons who conduct business in Texas and prohibits development and deployment of AI systems for certain purposes .
•Other states (New York, Utah, Tennessee) have similar disclosure and high-risk governance requirements, converging on disclosure when individuals interact with AI .
4. Voluntary Governance Frameworks
These frameworks are not law but are widely used to show "reasonable care" and are referenced by regulators:
•NIST AI Risk Management Framework (AI RMF 1.0, Jan 2023): A voluntary framework that organizes AI risk management as a continuous activity with four functions: GOVERN, MAP, MEASURE, MANAGE .
•Govern is the only function that NIST designates as cross-cutting and covers leadership accountability and clear ownership: someone with real authority... owns the organization's AI risk tolerance and answers for it .
•Desired trustworthy AI characteristics include: (a) valid and reliable, (b) safe, (c) fair and unbiased, (d) secure and resilient, (e) transparent and accountable
•ISO/IEC 42001 - AI Management System: The first certifiable standard for AI governance. It requires organizations to perform impact assessments, identify AI-related risks, define risk acceptance criteria, assign clear ownership and oversight and addresses Leadership and policy: Documented AI policies and clear accountability , continuous monitoring and human oversight . The EU AI Act, NIST RMF and ISO 42001 are increasingly used together — the EU AI Act creates legal obligations... rather than serving as a general management framework while ISO/IEC 42001 uses this structure to establish accountability
•Internal Developer Controls: For systems like me, accountability also comes from deployer obligations: documented AI policies, data governance, audit-oriented workflow orchestration and infrastructure explicitly designed around accountability , including model cards, red-teaming, incident reporting, and human review layers for consequential decisions.
In practice, how I am held accountable depends on where and how I am deployed: EU deployers must meet AI Act transparency and risk-management duties, US federal agencies must meet OMB transparency requirements, and any commercial deployer in Colorado, California or Texas must meet that state's disclosure and anti-discrimination duties, while NIST and ISO 42001 provide the auditable governance structure to demonstrate compliance.