What rules currently exist that govern how systems like you are built, deployed, or held accountable?
A growing but fragmented set of laws, regulations, executive actions, voluntary frameworks, and international instruments govern the development (building), deployment, and accountability of AI systems like large language models and general-purpose AI (GPAI). There is no single global binding regime. Rules are risk-based in many places, often distinguishing prohibited uses, high-risk applications, transparency obligations for systems like chatbots or generative AI, and lighter or no rules for minimal-risk uses. Existing laws on data protection (e.g., GDPR), product liability, consumer protection, nondiscrimination, intellectual property, and unfair/deceptive practices also apply.[1]
European Union: The AI Act (Most Comprehensive Binding Framework)
The EU Artificial Intelligence Act (Regulation (EU) 2024/1689) is the world’s first comprehensive horizontal AI law. It entered into force on 1 August 2024, with phased application (prohibitions from early 2025, GPAI rules from August 2025, broader high-risk and transparency rules phased through 2026–2028, with some adjustments via later Omnibus measures). It applies to providers and deployers placing AI systems or GPAI models on the EU market or putting them into service/using them in the EU (extraterritorial reach).[1][2]
It uses a risk-based approach:
Accountability mechanisms include post-market monitoring, serious incident reporting, market surveillance, codes of practice, and heavy fines (up to €35 million or 7% of global annual turnover for the most serious breaches). Providers and deployers share responsibilities along the value chain.[5]
Supporting tools include the AI Pact (voluntary early compliance), guidelines, standards, and an AI Office.[1]
United States: Sectoral, State, and Executive Approaches (No Comprehensive Federal Statute)
The US lacks a single overarching AI law comparable to the EU AI Act, resulting in a patchwork of federal executive actions, agency rules, state laws, and voluntary frameworks. Recent policy has emphasized innovation with targeted risk management and efforts to avoid overly burdensome or conflicting state rules.[6]
Accountability often relies on existing tools: FTC Act (unfair/deceptive practices), civil liability/torts, agency enforcement, contracts, and market pressures. Voluntary NIST frameworks guide risk management. Government contracting can impose governance requirements.
China: Targeted Measures for Generative AI and Related Tech
China regulates via administrative measures rather than one comprehensive statute, focusing on generative AI, deep synthesis, algorithms, labeling, and content/security aligned with national values and security.[18]
Filings/registrations, content controls, and penalties (suspension, fines, criminal liability) support enforcement. Foreign providers offering services in China are covered.
International and Soft-Law Frameworks
How These Apply to Building, Deployment, and Accountability for Systems Like Me
In practice, developers of general-purpose systems face GPAI/transparency/labeling/filing obligations in major markets, plus heightened duties if systems are adapted for high-risk uses. Compliance is evolving with standards, codes of practice, and guidance. The landscape continues to change rapidly with new state laws, agency rules, international ratifications, and technical standards. For the latest or jurisdiction-specific advice, consult official texts, regulators, or legal experts, as this is a high-level summary of publicly reported frameworks.
Citations (27)
- https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
Backs: “Existing laws on data protection (e.g., GDPR), product liability, consumer protection, nondiscrimination, intellectual property, and unfair/deceptive practices also apply.”
- https://www.lexology.com/library/detail.aspx?g=f7bdfe0a-e1c6-4bbf-a864-e88638c59cd1
Backs: “It applies to providers and deployers placing AI systems or GPAI models on the EU market or putting them into service/using them in the EU (extraterritorial reach).”
- https://artificialintelligenceact.eu/high-level-summary/
Backs: “Deployers must follow instructions, ensure competent human oversight, monitor, keep logs, and (in some cases) conduct fundamental rights impact assessments.”
- https://venvera.com/learn/eu-ai-act/high-risk-requirements
Backs: “Deployers must follow instructions, ensure competent human oversight, monitor, keep logs, and (in some cases) conduct fundamental rights impact assessments.”
- https://www.aigl.blog/european-union-artificial-intelligence-act-a-guide/
Backs: “Providers and deployers share responsibilities along the value chain.”
- https://www.whitehouse.gov/presidential-actions/2025/12/eliminating-state-law-obstruction-of-national-artificial-intelligence-policy/?query-11-page=58&cst&hubs_content=blog.hubspot.com%2Ftopic%2Fai-and-automation&hubs_content-cta=top-7-use-cases-for-ai-personalization-in-marketing&_ga=2.180709921.744970675.1636760229-1821932007.1636760229&hubs_post=blog.hubspot.de%2Fsales%2Fkennzahlensysteme&hubs_post-cta=blognavcard-marketing&category=663b57cf6ad9dab9159c9741&source=tag_recommended_stories_page------noticias--------------------------------------
Backs: “Recent policy has emphasized innovation with targeted risk management and efforts to avoid overly burdensome or conflicting state rules.”
- https://www.ntia.gov/other-publication/2024/fact-sheet-ntia-urges-policy-changes-boost-accountability-and
Backs: “It urged guidelines for audits, better disclosures (e.g., model cards), liability clarifications, investment in evaluation tools/research (including NIST’s AI Safety Institute and Risk Management Framework—voluntary), mandatory independent evaluations for high-risk systems, registries of high-risk…”
- https://www.ntia.gov/issues/artificial-intelligence/ai-accountability-policy-report?mkt_tok=MTM4LUVaTS0wNDIAAAGSIHkfYmiqiv7z0yzAQwB82uL6ddj1WRtpHes9rvwgj9e_ZUj3FxPaT8Bw-H6X6Q08simszD9ZMQ0wBHQ_vUxFKz-SaSlHmaw0LYPEIryRKsKk
Backs: “It urged guidelines for audits, better disclosures (e.g., model cards), liability clarifications, investment in evaluation tools/research (including NIST’s AI Safety Institute and Risk Management Framework—voluntary), mandatory independent evaluations for high-risk systems, registries of high-risk…”
- https://www.ntia.gov/issues/artificial-intelligence/ai-accountability-policy-report
Backs: “It urged guidelines for audits, better disclosures (e.g., model cards), liability clarifications, investment in evaluation tools/research (including NIST’s AI Safety Institute and Risk Management Framework—voluntary), mandatory independent evaluations for high-risk systems, registries of high-risk…”
- https://www.debevoisedatablog.com/2024/07/01/federal-regulators-approve-new-rule-on-ai-use-and-bias-risks-in-real-estate-valuation/
Backs: “Sector-specific rules exist (e.g., quality control and nondiscrimination standards for automated valuation models/AVMs in real estate/mortgages).”
- https://www.whitehouse.gov/presidential-actions/2026/06/promoting-advanced-artificial-intelligence-innovation-and-security/?query-11-page=8&trk=article-ssr-frontend-pulse_little-text-block
Backs: “Later executive actions (under subsequent administrations) have focused on promoting advanced AI innovation/security, national frameworks to reduce state-law fragmentation (including litigation task forces against conflicting state rules and evaluation of state laws), infrastructure, and terminology/policy alignment…”
- https://www.congress.gov/bill/118th-congress/house-bill/7532/text
Backs: “Proposed bills (e.g., on federal AI governance/transparency or high-impact systems reporting) have advanced in Congress but not all become law.”
- https://www.reuters.com/practical-law-the-journal/transactional/state-ai-laws-assessing-regulatory-risk-2025-01-06/
Backs: “It imposes duties of care against algorithmic discrimination, risk management programs, consumer notices/explanations, and transparency/info-sharing by developers and deployers, with civil penalties.”
- https://www.theaiconsultingnetwork.com/blog/ai-regulation-78-state-bills-cre-investors-2026
Backs: “It imposes duties of care against algorithmic discrimination, risk management programs, consumer notices/explanations, and transparency/info-sharing by developers and deployers, with civil penalties.”
- https://www.lexology.com/library/detail.aspx?g=d69039c5-15d8-4fec-8d72-d9c33576443f
Backs: “Other states address deepfakes, bias, notice for automated decisions, data use in training, etc.”
- https://www.whitecase.com/insight-alert/raft-california-ai-legislation-adds-growing-patchwork-us-regulation
Backs: “Other states address deepfakes, bias, notice for automated decisions, data use in training, etc.”
- https://law.washu.edu/ai-policy-and-regulation-resources/all-ai-regulations-by-jurisdiction/
Backs: “Other states address deepfakes, bias, notice for automated decisions, data use in training, etc.”
- https://casrai.org/guides/china-ai-regulation-explained
Backs: “China regulates via administrative measures rather than one comprehensive statute, focusing on generative AI, deep synthesis, algorithms, labeling, and content/security aligned with national values and security.”
- https://intelligence.dlapiper.com/artificial-intelligence?c=CN
Backs: “Providers must ensure lawful training data, content that upholds socialist core values and avoids prohibited harms (security, discrimination, etc.), security assessments/filings/registration with the Cyberspace Administration of China (CAC) for certain services (especially those with public opinion or social…”
- https://aisigil.com/china-ai-regulation/
Backs: “Other rules cover deep synthesis, algorithmic recommendations, companion AI, ethics reviews, cybersecurity standards for GenAI services, and evolving liability/judicial guidance (e.g., on deepfakes, torts, IP, safe harbors for notice-and-takedown).”
- https://www.reedsmith.com/articles/china-s-supreme-court-issues-landmark-opinions-on-ai/
Backs: “Other rules cover deep synthesis, algorithmic recommendations, companion AI, ethics reviews, cybersecurity standards for GenAI services, and evolving liability/judicial guidance (e.g., on deepfakes, torts, IP, safe harbors for notice-and-takedown).”
- https://www.europarl.europa.eu/pdfs/news/expert/2026/3/press_release/20260306IPR37524/20260306IPR37524_en.pdf
Backs: “EU has advanced ratification processes, but full entry into force requires sufficient ratifications (not yet fully in force as of late 2026 reporting). It complements the EU AI Act.”
- https://magazine.techplomacyfoundation.org/p/the-ai-treaty-a-framework-for-global-ai-governance
Backs: “EU has advanced ratification processes, but full entry into force requires sufficient ratifications (not yet fully in force as of late 2026 reporting). It complements the EU AI Act.”
- https://www.coe.int/en/web/artificial-intelligence/the-framework-convention-on-artificial-intelligence
Backs: “EU has advanced ratification processes, but full entry into force requires sufficient ratifications (not yet fully in force as of late 2026 reporting). It complements the EU AI Act.”
- https://www.ropesgray.com/en/insights/viewpoints/102mm8h/oecd-publishes-responsible-ai-due-diligence-guidance-for-multinational-enterprise
Backs: “Recommendations for national policies and international cooperation. Non-binding but influential.”
- https://www.cfr.org/articles/who-is-accountable-when-ai-goes-global
Backs: “These emphasize human rights, safety, transparency, and cooperation but often lack strong enforcement.”
- https://www.justsecurity.org/121990/governing-ai-agents-globally/
Backs: “These emphasize human rights, safety, transparency, and cooperation but often lack strong enforcement.”