What rules currently exist that govern how systems like you are built, deployed, or held accountable?
Short answer: there isn’t one single “AI law.” Today’s rules are a patchwork of general laws being applied to AI, sector‑specific regulations, new state and city statutes, and a few comprehensive frameworks abroad.
United States — federal (cross‑sector)
United States — state and local
European Union (comprehensive baseline)
United Kingdom
China
Voluntary standards and “soft law” that many organizations use to show accountability
What this means in practice
If you share your sector, users/locations, and whether your system makes “consequential decisions” about people, I can pinpoint which specific obligations and timelines apply to you and suggest a right‑sized compliance checklist.
Citations (21)
- EXECUTIVE OFFICE OF THE PRESIDENT
Backs: “HHS later referenced 2025 OMB follow‑ons for implementation and acquisition.”
evidence, official document. Claim: OMB M-24-10 requires federal agencies to inventory AI use, set up governance, assess safety/rights-impacting systems, and publish limited public reporting.
- Rite Aid Banned from Using AI Facial Recognition After FTC Says Retailer Deployed Technology without Reasonable Safeguards | Federal Trade Commission
Backs: “FTC enforcement: the Commission banned Rite Aid from using facial recognition for five years and imposed strict safeguards; it has a 2023 biometric policy statement and a 2026 proposed policy statement clarifying how Section 5 applies to AI marketing and “suppression of accuracy.””
evidence, article. Claim: FTC banned Rite Aid from using facial recognition for five years and imposed safeguards; FTC enforcement applies consumer protection law to AI.
- Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms | Consumer Financial Protection Bureau
Backs: “CFPB: creditors using AI/ML still must give specific reasons when taking adverse action under ECOA/Reg B; generic “the algorithm decided” isn’t enough.”
evidence, official document. Claim: Creditors using AI/ML must give specific adverse action reasons under ECOA/Reg B; generic algorithm explanations are insufficient.
- Civil Rights Division | Artificial Intelligence and Civil Rights
Backs: “DOJ/HUD filed a Statement of Interest on tenant‑screening algorithms under the Fair Housing Act.”
evidence, official document. Claim: EEOC/DOJ/HUD guidance and actions address algorithmic discrimination, including a DOJ/HUD statement of interest on tenant-screening algorithms.
- Final Guidance: PCCPs for AI-Enabled Devices
Backs: “ONC’s HTI‑1 rule added transparency for certified health IT with algorithmic decision support.”
evidence, official document. Claim: FDA finalized Dec. 2024 guidance on Predetermined Change Control Plans for AI-enabled medical devices.
- NTIA calls for audits and investments in trustworthy AI systems | National Telecommunications and Information Administration
Backs: “NTIA’s 2024 AI Accountability Policy Report urges independent audits and risk management for high‑risk systems (nonbinding but influential).”
evidence, article. Claim: NTIA's 2024 AI Accountability Policy Report urges independent audits and risk management for high-risk systems; nonbinding but influential.
- 88 FR 16190 - Copyright Registration Guidance: Works Containing Material Generated by Artificial Intelligence - Content Details - 2023-05321
Backs: “Applicants must disclose AI‑generated material in registrations.”
evidence, official document. Claim: Copyright Office says only human-authored expression is copyrightable and applicants must disclose AI-generated material in registrations.
- SB24-205 Consumer Protections for Artificial Intelligence | Colorado General Assembly
Backs: “Additional 2026 “Chatbot Safety Act” provisions add safeguards for conversational AI used by minors. Core duties begin in 2026.”
evidence, official document. Claim: Colorado's 2024 AI law requires developers and deployers of high-risk AI to assess risks, avoid discrimination, give notices, with AG enforcement.
- California Finalizes Regulations to Strengthen Consumers' Privacy
Backs: “CPPA regulations effective Jan 1, 2026 add consumer rights to access and opt out of Automated Decision‑Making Technology (ADMT), require pre‑use notices, and mandate risk assessments/cybersecurity audits; businesses using ADMT for “significant decisions” must be fully compliant by Jan 1, 2027.”
evidence, article. Claim: California CPPA regulations add ADMT opt-out and access rights, pre-use notices, risk assessments and audits, with compliance dates through 2027.
- Bill Text: CA AB2013 | 2023-2024 | Regular Session | Chaptered | LegiScan
Backs: “AB 2013 (effective Jan 1, 2026) requires developers of publicly available generative AI systems to post training‑data documentation.”
evidence, official document. Claim: AB 2013 requires generative AI developers to post training-data documentation, effective Jan 1, 2026.
- Governor Newsom signs SB 53, advancing California’s world-leading artificial intelligence industry | Governor of California
Backs: “SB 53 (Transparency in Frontier Artificial Intelligence Act, signed Sep 29, 2025) establishes frontier‑model safety/transparency obligations and a whistleblower channel to the Attorney General.”
evidence, article. Claim: SB 53 signed Sep 29, 2025 establishes frontier-model safety/transparency obligations and a whistleblower channel to the Attorney General.
- California Gov. Gavin Newsom signs laws to protect workers from AI risks
Backs: “2026 worker‑protection bills further constrain certain AI workplace uses (e.g., “No Robo Bosses” human‑in‑the‑loop requirements, biometric emotion analysis bans).”
evidence, article. Claim: California worker-protection bills constrain AI workplace uses such as human-in-the-loop requirements and biometric emotion analysis bans.
- Automated Employment Decision Tools (AEDT) - DCWP
Backs: “New York City Local Law 144 (enforced since July 5, 2023) bars use of automated employment decision tools unless an annual independent bias audit is done, a summary is posted, and candidates get notice.”
evidence, official document. Claim: NYC Local Law 144 bars automated employment decision tools without annual independent bias audit, posted summary, and candidate notice.
- 820 ILCS 42/5
Backs: “Maryland restricts employers’ facial recognition in hiring without consent.”
evidence, official document. Claim: Illinois AI Video Interview Act requires notice/consent and limits use and sharing of AI-analyzed interview videos.
- Federal and State Approaches to AI in Elections: Define,...
Backs: “Many states now require disclosures or restrict deceptive AI‑generated political ads near elections; rules vary widely by state. NCSL keeps a current tracker.”
further reading, article. Claim: Many states require disclosures or restrict deceptive AI political ads; rules vary, and NCSL keeps a tracker.
- AI Act | Shaping Europe’s digital future
Backs: “It entered into force in 2024 with phased application: the general framework applies by August 2, 2026; prohibitions on certain “unacceptable‑risk” uses apply earlier; and, after 2026, most high‑risk obligations phase in on Dec 2, 2027 (stand‑alone high‑risk systems) and Aug 2, 2028 (high‑risk AI embedded in regulated…”
evidence, reference entry. Claim: EU AI Act is the first comprehensive AI law with phased application through 2026-2028.
- A pro-innovation approach to AI regulation: government response - GOV.UK
Backs: “Regulators apply cross‑cutting principles, and the UK AI Safety Institute runs capability/safety evaluations; separate Online Safety Act 2023 imposes platform safety and transparency duties (including around proactive technologies/algorithms).”
evidence, official document. Claim: UK uses a regulator-led pro-innovation approach with cross-cutting principles and no single AI act.
- Translation: Internet Information Service Algorithmic Recommendation Management Provisions – Effective March 1, 2022
Backs: “Binding rules include the 2022 Provisions on Algorithmic Recommendation in Internet Information Services and the 2023 Interim Measures for Generative AI Services (security filings/assessments, content controls, and transparency obligations for public‑facing generative AI).”
evidence, article. Claim: China has binding rules including the 2022 algorithmic recommendation provisions and 2023 generative AI measures.
- AI Risk Management Framework | NIST
Backs: “AI Safety Institute at NIST is building test methods and benchmarks to evaluate advanced models.”
evidence, official document. Claim: NIST AI Risk Management Framework and Generative AI Profile are voluntary standards organizations use to show accountability.
- ISO/IEC 42001:2023 - AI management systems
Backs: “ISO/IEC 42001:2023, the first certifiable AI management‑system standard (AIMS), used to stand up and audit an organization’s AI governance program.”
evidence, reference entry. Claim: ISO/IEC 42001:2023 is the first certifiable AI management-system standard.
- G7 Leaders' Statement on the Hiroshima AI Process
Backs: “G7 Hiroshima Process International Code of Conduct and Guiding Principles for organizations developing advanced AI systems (voluntary, widely referenced).”
evidence, official document. Claim: G7 Hiroshima Process code of conduct and guiding principles for advanced AI developers are voluntary.