More answers like this
GPT-5Oct 6, 2026openai/gpt-5-2025-08-07

What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Here’s a snapshot of the main, currently-in-force or imminent rules that shape how systems like me are built, deployed, and held accountable, as of October 6, 2026.

United States (federal)

•Government use of AI: Executive Order 14110 and OMB Memorandum M‑24‑10 require federal agencies to designate Chief AI Officers, inventory AI uses, and conduct risk/impact assessments and safeguards for “safety‑impacting” and “rights‑impacting” AI before deployment.[1]
•Risk management and evaluations: NIST’s AI Risk Management Framework (AI RMF 1.0) and its Generative AI Profile are the de‑facto playbooks for building and evaluating trustworthy AI; the U.S. AI Safety Institute (at NIST) is developing tests, benchmarks, and red‑teaming guidance, and has begun national evaluation pilots (ARIA, GenAI). These are voluntary but widely referenced by agencies and industry.[2]
•General enforcement: The FTC, CFPB, and EEOC apply existing laws to AI (deception, unfairness, discrimination, FCRA, etc.). Recent actions and guidance emphasize “no AI exemption” from consumer protection and civil rights laws and address algorithmic steering, adverse impact in hiring tools, and more.[3]
•Sector rules
•Healthcare/medical devices: FDA issued final guidance allowing Predetermined Change Control Plans (PCCPs) for AI‑enabled device software so safe model updates can occur without a new submission every time.[4]
•Transportation/AVs: NHTSA asserts recall/defect authority over automated driving systems and updated ADS guidance in 2026; development remains largely under guidance plus post‑market safety oversight.[5]
•National security/export controls: Commerce/BIS maintains and updates export controls restricting advanced AI chips and related items to certain destinations.[6]

United States (state/local highlights)

•New York City Local Law 144 (AEDTs): Since July 5, 2023, employers using automated hiring tools in NYC must complete an annual independent bias audit, publish results, and give candidate notices. Enforcement is active.[7]
•Colorado SB24‑205 (ADMT/“high‑risk” AI): Effective February 1, 2026, developers and deployers of high‑risk AI used for consequential decisions must use reasonable care to prevent algorithmic discrimination, disclose risks to the AG and customers, and meet documentation/notice duties; violations are enforceable under the Colorado Consumer Protection Act. Rulemaking continues into 2027.[8]
•California (package of AI laws): The Governor’s office reports multiple AI statutes in 2025–2026 (e.g., frontier AI transparency and independent verification frameworks; worker protections). Details vary by bill; see the state’s summary for what’s in force.[9]

European Union

•AI Act (Regulation (EU) 2024/1689): In force since August 1, 2024, with phased application:
•Prohibited uses and some literacy duties apply from February 2, 2025.
•Core transparency duties (including certain AI‑generated content marking) apply from August 2, 2026; content‑labeling/detection deadlines tighten by December 2, 2026.
•High‑risk system obligations phase in by December 2, 2027 (Annex III) and August 2, 2028 for product‑regulated areas (Annex I).[10]
•Digital Services Act (DSA): Very large platforms/search (VLOPs/VLOSEs) have been under enhanced risk‑management, auditing, and recommender‑transparency duties since August 25, 2023; all covered platforms have been under the DSA since February 2024.[11]
•Product liability: The revised Product Liability Directive explicitly covers software and AI systems; Member States must transpose by December 9, 2026, expanding avenues for redress when AI‑enabled products cause harm.[12]
•Standards: CEN‑CENELEC JTC 21 is producing harmonised standards for the AI Act (confer presumption of conformity); first key standards are slated during 2026–2027.[13]

United Kingdom

•Regulator‑led, “pro‑innovation” framework: Cross‑sector principles (safety, transparency, fairness, accountability, contestability) implemented by existing regulators rather than an AI‑specific statute; the UK established an AI Safety Institute to evaluate frontier models.[14]

Canada

•Federal government use: The Directive on Automated Decision‑Making requires Algorithmic Impact Assessments and transparency before deploying automated decision systems in federal services.[15]
•Federal private‑sector AI law: The proposed Artificial Intelligence and Data Act (AIDA, Bill C‑27) did not enter into force following the 2025 prorogation; no federal cross‑cutting AI statute is currently in effect.[16]
•Provinces: Québec’s Law 25 adds disclosure and rights when decisions are made solely by automated processing, among broader privacy obligations.[17]

China

•Deep synthesis (“deepfakes”) regulation: Effective January 10, 2023, providers must label synthetic content, implement security controls, and meet consent/notice duties in specified cases.[18]
•Generative AI “Interim Measures”: Effective August 15, 2023, impose obligations on providers of public‑facing generative AI services (data provenance, IP respect, complaint handling, safety controls, etc.).[19]

International soft law and treaties

•OECD AI Principles (2019) underpin many national frameworks and industry practices.[20]
•G7 Hiroshima Process (2023): Voluntary guiding principles and a code of conduct for organizations developing advanced AI systems.[21]
•Council of Europe AI Framework Convention (2024): First binding international AI treaty focused on human rights, democracy, and rule of law; opened for signature September 5, 2024 (U.S., EU and others signed). National ratifications will determine entry into force.[22]

Assurance and standards you’ll see in practice (often referenced in compliance programs)

•NIST AI RMF and GenAI Profile for governance, red‑teaming, evals; ISO/IEC 42001:2023 (certifiable AI management system) used to evidence organizational controls; EU harmonised standards will tie directly to AI Act conformity for high‑risk systems.[2]

If you share your sector and where you operate or ship products, I can map the specific duties (e.g., model documentation, bias testing, notices/labels, impact assessments, audit/certification options, and potential liability exposure) that apply to you and flag the next deadlines.

Citations (22)

  1. 1govinfo.govGovernment
    Executive Orders  EO 14110

    Backs: “Executive Order 14110 and OMB Memorandum M‑24‑10 require federal agencies to designate Chief AI Officers, inventory AI uses, and conduct risk/impact assessments and safeguards for “safety‑impacting” and “rights‑impacting” AI before deployment.”

  2. 2nist.govGovernment
    AI Risk Management Framework | NIST

    Backs: “These are voluntary but widely referenced by agencies and industry.”

  3. 3ftc.govGovernment
    FTC Chair Khan and Officials from DOJ, CFPB and EEOC Release Joint Statement on AI | Federal Trade Commission

    Backs: “Recent actions and guidance emphasize “no AI exemption” from consumer protection and civil rights laws and address algorithmic steering, adverse impact in hiring tools, and more.”

  4. 4govdelivery.comCompanies
    Final Guidance: PCCPs for AI-Enabled Devices

    Backs: “FDA issued final guidance allowing Predetermined Change Control Plans (PCCPs) for AI‑enabled device software so safe model updates can occur without a new submission every time.”

  5. 5nhtsa.govGovernment
    SAE Government/Industry Meeting | NHTSA

    Backs: “NHTSA asserts recall/defect authority over automated driving systems and updated ADS guidance in 2026; development remains largely under guidance plus post‑market safety oversight.”

  6. 6doc.govGovernment
    Advanced Computing and Semiconductor Manufacturing Items Controls to PRC

    Backs: “Commerce/BIS maintains and updates export controls restricting advanced AI chips and related items to certain destinations.”

  7. 7nyc.govGovernment
    Automated Employment Decision Tools (AEDT) - DCWP

    Backs: “Since July 5, 2023, employers using automated hiring tools in NYC must complete an annual independent bias audit, publish results, and give candidate notices. Enforcement is active.”

  8. 8colorado.govGovernment
    SB24-205 Consumer Protections for Artificial Intelligence | Colorado General Assembly

    Backs: “Effective February 1, 2026, developers and deployers of high‑risk AI used for consequential decisions must use reasonable care to prevent algorithmic discrimination, disclose risks to the AG and customers, and meet documentation/notice duties; violations are enforceable under the Colorado Consumer Protection Act.…”

  9. 9ca.govGovernment
    California’s nation-leading AI framework just got stronger, Governor Newsom signs more first-in-the-nation worker protections and more | Governor of California

    Backs: “Details vary by bill; see the state’s summary for what’s in force.”

  10. 10europa.euGovernment
    AI Act | Shaping Europe’s digital future

    Backs: “High‑risk system obligations phase in by December 2, 2027 (Annex III) and August 2, 2028 for product‑regulated areas (Annex I).”

  11. 11europa.euGovernment
    Digital Services Act: ensuring a safe and accountable online environment

    Backs: “Very large platforms/search (VLOPs/VLOSEs) have been under enhanced risk‑management, auditing, and recommender‑transparency duties since August 25, 2023; all covered platforms have been under the DSA since February 2024.”

  12. 12europa.euGovernment
    Directive - 2024/2853 - EN - Product Liability Directive - EUR-Lex

    Backs: “Member States must transpose by December 9, 2026, expanding avenues for redress when AI‑enabled products cause harm.”

  13. 13europa.euGovernment
    Understanding the standardisation of the AI Act | Shaping Europe’s digital future

    Backs: “CEN‑CENELEC JTC 21 is producing harmonised standards for the AI Act (confer presumption of conformity); first key standards are slated during 2026–2027.”

  14. 14gov.ukGovernment
    A pro-innovation approach to AI regulation: government response - GOV.UK

    Backs: “Cross‑sector principles (safety, transparency, fairness, accountability, contestability) implemented by existing regulators rather than an AI‑specific statute; the UK established an AI Safety Institute to evaluate frontier models.”

  15. 15canada.caGovernment
    Directive on Automated Decision-Making- Canada.ca

    Backs: “The Directive on Automated Decision‑Making requires Algorithmic Impact Assessments and transparency before deploying automated decision systems in federal services.”

  16. 16parl.caNot yet classified
    C-27 (44-1) - LEGISinfo - Parliament of Canada

    Backs: “The proposed Artificial Intelligence and Data Act (AIDA, Bill C‑27) did not enter into force following the 2025 prorogation; no federal cross‑cutting AI statute is currently in effect.”

  17. 17qc.caNot yet classified
    Légis Québec

    Backs: “Québec’s Law 25 adds disclosure and rights when decisions are made solely by automated processing, among broader privacy obligations.”

  18. 18cac.gov.cnGovernment
    互联网信息服务深度合成管理规定_中央网络安全和信息化委员会办公室

    Backs: “Effective January 10, 2023, providers must label synthetic content, implement security controls, and meet consent/notice duties in specified cases.”

  19. 19cac.gov.cnGovernment
    生成式人工智能服务管理暂行办法_中央网络安全和信息化委员会办公室

    Backs: “Effective August 15, 2023, impose obligations on providers of public‑facing generative AI services (data provenance, IP respect, complaint handling, safety controls, etc.).”

  20. 20oecd.orgGovernment
    What are the OECD Principles on AI? (EN)

    Backs: “OECD AI Principles (2019) underpin many national frameworks and industry practices.”

  21. 21g7g20-documents.orgNot yet classified
    Hiroshima Process International Guiding Principles for Organizations Developing Advanced AI System (30/10/2023) - G7/G20 Documents Database

    Backs: “Voluntary guiding principles and a code of conduct for organizations developing advanced AI systems.”

  22. 22coe.intGovernment
    The Framework Convention on Artificial Intelligence - Artificial Intelligence

    Backs: “First binding international AI treaty focused on human rights, democracy, and rule of law; opened for signature September 5, 2024 (U.S., EU and others signed). National ratifications will determine entry into force.”