More answers like this
Muse Spark 1.2Oct 6, 2026meta/muse-spark-1.2-20260805
What rules currently exist that govern how systems like you are built, deployed, or held accountable?
What governs how AI systems like me are built and held accountable is shifting fast — I'll map the current rules for you.
There is no single global law for systems like me. Rules are layered: binding laws in some jurisdictions, sectoral and voluntary frameworks in others, and international soft-law principles. As of 2026, the landscape includes:
1. International Treaties and Principles
•Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225) - the first legally binding international treaty on AI. Adopted 17 May 2024 and opened for signature in Vilnius on 5 September 2024, it aims to ensure AI development and use align with human rights, democracy and rule of law throughout the lifecycle. It entered into force on November 1, 2025 following ratification by the UK, France and Norway, covers the entire AI lifecycle and applies to both public and private actors.
•OECD AI Principles - intergovernmental principles for trustworthy AI endorsed by 42+ countries. Most frameworks converge on principles including accountability (a human owns the outcome), transparency, non-maleficence, and respect for human-centered values. The OECD has an explicit Accountability principle and ties accountability to role-appropriate responsibility, traceability and ongoing risk management.
•OECD Due Diligence Guidance for Responsible AI - published 19 February 2026, a voluntary framework backed by all member countries, described as soft law but a precursor to law.
2. European Union - Most Comprehensive Binding Regime
The EU AI Act was published 12 July 2024 and entered into force in August 2024, specifically on 1 August 2024, but provisions apply in stages.
•Risk-based approach: Imposing different requirements on (i) prohibited or "unacceptable risk" systems; (ii) high-risk systems; (iii) systems that trigger specific transparency obligations. At its heart it follows a risk management approach; it aims to regulate transparency and accountability for AI systems and their developers.
•Phased enforcement:
•2 February 2025: Prohibitions on unacceptable-risk AI systems take effect, alongside AI literacy obligation
•2 August 2025: Rules governing general-purpose AI (GPAI) models, including foundation models, become applicable. Providers of GPAI models like ChatGPT, Claude and Gemini have been legally required to maintain technical documentation, publish training data summaries, and respect copyright rules since August 2nd, 2025
•2 August 2026: Transparency obligations and supervisory powers - Article 50 requires providers and deployers of certain AI systems to tell people when they're interacting with a machine, and to mark AI-generated content so it can be flagged. Any AI-powered chatbot, voice agent or interactive system deployed to EU users must clearly disclose at the start of the interaction that the user is dealing with AI, and AI-generated or manipulated content including deepfakes must carry machine-readable labels identifying it as synthetic
•High-risk obligations deferred: Originally full applicability was set for August 2026, but the complexity of governing high-risk AI has led to a strategic enforcement deferral to December 2027 for Annex III systems and 2 August 2028 for AI embedded in regulated products, with providers of generative AI outputs given until December 2, 2026 to comply for systems placed on market before August 2, 2026 under the AI Omnibus Regulation
•High-risk requirements: Developers must perform evaluations, assess and mitigate systemic risks, conduct adversarial testing, report serious incidents to the European Commission, ensure cybersecurity and report on energy efficiency. European citizens have a right to launch complaints and receive explanations about decisions made by high-risk AI systems that impact their rights. Article 17 requires an accountability framework setting out management and staff responsibilities within the quality management system.
•Other EU laws intersecting with AI: GDPR (data privacy), which intersects with AI liability by protecting individuals from harmful automated decisions, and sector laws. Existing landscape also includes GDPR, CCPA, HIPAA (healthcare), SOX (finance).
•Liability: Europe has updated its EU Product Liability Directive, which Member States must transpose by December 9, 2026, to bring AI/ML systems within the definition of "product," and which authorizes courts to presume defectiveness where a manufacturer fails to disclose AI/ML training and validation data. With the withdrawal of the separate AI Liability Directive proposal, the revised Product Liability Directive and national tort law remain the principal private-law background.
3. United States - Fragmented, Voluntary and Sectoral Federal Model + State Laws
•No unified federal AI law: The United States has focused on innovation, with no unified federal AI law; instead governance relies on sector regulators such as the FTC, HIPAA, the SEC, and the voluntary NIST AI Risk Management Framework. Rather than a single comprehensive statute comparable to the EU AI Act, the US relies on a fragmented, voluntary, sectoral governance model. The primary federal instruments are Executive Order 14110 and the NIST AI Risk Management Framework, neither of which is legally binding on the private sector.
•Executive Orders:
•Executive Order 14110 (October 2023, Biden administration) required developers of dual-use foundation models to report training parameters, model weights and red-team results.
•December 2025 Executive Order directed federal agencies to establish a "minimally burdensome national policy framework" for AI, preempting state-level rules targeting the patchwork in states like California, Colorado and Illinois. That order directed the Department of Justice to challenge state laws that "stifle innovation" and threatened to withhold federal broadband funding from states that enforce what it deems "onerous" guardrails, and in December 2025 directed agencies to review state AI laws including by directing the FCC to begin a process to determine whether to adopt a federal reporting standard that would purport to preempt state laws.
•June 2, 2026 Executive Order "Promoting Advanced Artificial Intelligence Innovation and Security" established a voluntary framework permitting developers of certain advanced AI models to voluntarily provide the federal government with model access prior to public release for up to 30 days for cybersecurity and national security assessments and . The 2 June 2026 order draws a clear line: the US will not require a federal licence to build or ship an AI model, and it prefers a voluntary, cooperation-based frontier framework over a statutory one. A separate order at a White House summit secured a voluntary "White House Accord" committing firms to multiple layers of internal controls, independent external audits, and board oversight of frontier systems.
•Voluntary Frameworks:
•NIST AI Risk Management Framework (AI RMF): Helps organizations understand and manage AI-related risks across the lifecycle and build transparency, accountability, fairness and security into AI systems. Organized around four functions: Govern, Map, Measure, and Manage. It emphasizes human oversight, accountability and organizational responsibility throughout the AI lifecycle. It is voluntary but widely adopted, sector-agnostic and technology-neutral.
•ISO/IEC 42001 AI Management System: International standard offering a path to formal certification for an AI management system. It supplies the auditable management wrapper around NIST risk practices.
•The OECD principles set the ethical direction, the NIST RMF provides the practical roadmap, the EU AI Act imposes legally mandated requirements, and ISO 42001 offers certification - mature governance weaves them together.
•The UK framework is described as between the US and EU, governing AI through existing sector regulators, with frontier-safety guidance calling for named individual accountability, board sign-off, internal checks and balances, and separation of roles.
•State Laws (active as of 2026):
•Colorado AI Act (SB 24-205) - algorithmic-discrimination duties for developers and deployers of high-risk AI; effective 30 June 2026 (delayed from February), the only state law named in the federal EO. Requires organizations deploying high-risk AI systems to conduct documented risk assessments, implement algorithmic discrimination safeguards, and maintain ongoing monitoring and controls. The first US state law to introduce "High-Risk AI System".
•California - Transparency in Frontier AI Act (SB 53, effective 1 January 2026) imposes safety/transparency duties on frontier developers; SB 942 mandates AI-content disclosure/labeling from 2026, with frontier AI training data transparency (AB 2013) and AI Transparency Act (SB 942) both effective Jan 1 2026.
•Texas Responsible AI Governance Act, Illinois HB 3773 on AI discrimination in employment, and others taking effect Jan 1, 2026 also form part of the 2026 landscape.
•Proposed accountability legislation: On July 21, 2025 Senators Josh Hawley and Richard Blumenthal introduced the AI Accountability and Data Protection Act, which would create a new federal cause of action for individuals against companies training AI models using individuals' personal or copyrighted data without affirmative consent, reflecting ongoing debates about liability where causation, opacity, shared responsibility and evidence gaps make existing liability systems ill-equipped.
4. China - Directive, Pre-Release Approval Model
•Interim Measures for the Management of Generative AI Services, effective August 2023, specifically target generative AI technologies like large language models, requiring companies to register generative AI services with authorities before public release and conduct security assessments.
•Layered rules on algorithmic recommendation, deep synthesis and generative AI impose algorithm filing, real-name verification, pre-deployment security assessments and lifecycle logging. These regulations enforce mandatory filing procedures, real-name user authentication, pre-service security assessments, and continuous logging across the lifecycle.
•Measures for Labeling AI-Generated Synthetic Content, issued jointly by the Cyberspace Administration of China and three other agencies, took effect September 1, 2025. All AI-generated content must carry explicit, non-removable digital watermarks and visual indicators informing viewers that video is synthetic, and cloud providers must authenticate user identities creating accountability trails. The measures split the duty into Explicit Labels (visible text/audio/graphics at start, end or appropriate position) and Implicit Labels. The CAC has penalized platforms like CapCut for violating identification requirements under Cybersecurity Law and Generative AI measures.
5. How Accountability is Operationalized Across Regimes
•Build: Documentation, risk management, data governance protocols, technical documentation and energy reporting (EU), security assessments and algorithm filing (China), ethical impact assessments before deployment for federal AI (US GSA).
•Deploy: Transparency/disclosure duties (EU Article 50, US state labeling laws, China labeling), human oversight requirements (EU human oversight, NIST human judgment at key decision points), bias testing and compliance audits before deployment in the EU.
•Accountability: Risk-based classification, conformity evaluations and post-market monitoring mandatory before deployment in the EU, organizational accountability structures (NIST Govern 1.1-1.3, ISO Clause 5 leadership, OECD accountability), board oversight and independent audits under US voluntary accords, and strict/product liability and tort law for harms where negligence or defectiveness can be shown.
In summary, if a system like me operates in the EU it must comply with the AI Act's binding, phased requirements; in China it must pass registration and labeling controls before public release; in the US it is currently governed primarily by voluntary frameworks (NIST RMF, ISO 42001, OECD principles) and sectoral regulators, plus increasingly binding state-level laws, while federal action has moved to preserve a voluntary national model and challenge broader state restrictions.