Rules for systems like me are evolving — I'll gather the current frameworks governing how they're built, deployed, and held accountable.
As of October 2026, there is no single global law for systems like me. Rules are a patchwork of binding laws, executive orders, voluntary frameworks and state/regional regulations covering how AI is built, deployed, and held accountable:
1. European Union - The EU AI Act
The world's first comprehensive, legally binding AI legislation:
•Entered into force August 1, 2024 and phases in over several years. It tiers AI applications from unacceptable risk — prohibited outright — to high risk, which faces strict compliance obligations.
•February 2, 2025: Bans on unacceptable-risk practices took effect including manipulative or deceptive AI techniques, untargeted facial data scraping, exploitative systems targeting vulnerable groups and certain forms of biometric categorization and emotion recognition , plus an AI literacy obligation.
•August 2, 2025: Rules governing general-purpose AI models, including foundation models, became applicable. Providers must publish summaries of data used to train those systems, document how models work, and label AI-generated content.
•August 2, 2026 onward: Transparency obligations (Article 50) and most remaining high-risk system obligations apply from August 2, 2026, with high-risk obligations fully from December 2, 2027 and August 2, 2028 in amended timeline.
It classifies AI tools that screen, filter or rank job applicants as high-risk, meaning companies must document exactly how the software works, its limitations, and its decision-making before use.
Accountability: AI systems posing limited risk because of lack of transparency will be subject to information and transparency requirements while infringements of prohibited-practices carry fines up to €35 million or 7% of global annual turnover.
2. United States - No Comprehensive Federal Law, Evolving Executive Policy
Currently, there is no centralized federal law governing AI systems in the United States.
Federal Executive Orders:
•Executive Order 14110 (Oct 30, 2023) - Safe, Secure, and Trustworthy AI: Directed rigorous safety and security testing for high-risk AI systems, required safety testing for powerful models, red-teaming, watermarking, and agency guidance. It was grounded in and referenced the NIST AI Risk Management Framework and directed NIST to refine it, particularly for generative AI.
•Revoked Jan 20, 2025 by President Trump on his first day in office and superseded by EO 14179.
•Executive Order 14179 (Jan 23, 2025) - Removing Barriers to American Leadership in AI: Revoked existing AI policies seen as barriers to U.S. AI innovation and directed agencies to remove barriers to US AI leadership, with a three-pillar strategy to accelerate innovation, build infrastructure and lead in international diplomacy.
•Executive Order 14365 (Dec 11, 2025) - Ensuring a National Policy Framework for AI: Establishes a federal policy aimed at promoting a uniform national framework and limiting conflicting state laws, identifies "excessive state regulation" as an obstacle to sustaining U.S. global AI dominance through a minimally burdensome national framework and directs preparation of legislative recommendation that preempts State AI laws.
Voluntary Framework that functions as de facto standard:
•NIST AI Risk Management Framework (AI RMF 1.0, introduced January 2023) is technically voluntary but increasingly expected by federal agencies, business partners and customers. EO 14110 directed federal agencies to use it and many state regulations and industry standards reference NIST.
•The framework survived the revocation and continues to be refined, including NIST AI 600-1: Generative AI Profile, a companion resource for AI RMF focused on Generative AI developed in response to EO 14110 that provides guidance across the AI lifecycle.
Proposed federal accountability bills like the Artificial Intelligence Accountability Act requiring NTIA to study accountability measures including audits, assessments, and certifications and the Algorithmic Accountability Act have been introduced but not enacted as comprehensive law.
3. US States - Active Regulation in the Federal Vacuum
States have enacted laws as of 2026:
•Colorado AI Act (SB 24-205): First US law to impose anti-discrimination duties on developers of high-risk AI. Mandates that high-risk AI systems avoid discrimination and ensure transparency in consequential decisions, requires reasonable care against algorithmic discrimination, plus consumer notice and impact assessments for high-risk AI in employment, lending, housing, health etc effective 2026 - listed as June 30, 2026 in some trackers and February 2026 in others.
•California: Multiple laws effective Jan 1, 2026:
•Transparency in Frontier AI Act (SB 53) imposes safety/transparency duties on frontier developers
•AI Transparency Act (SB 942) mandates AI-content disclosure/labeling from 2026, requires large generative AI providers (over 1 million monthly users) to disclose AI-generated content, embed visible and hidden disclosures, offer free detection tools, and impose $5,000 per-violation penalties with penalties up to $5,000 per violation per day
•AB 2013 Training Data Transparency requires training data disclosure
•Texas Responsible AI Governance Act (TRAIGA), effective Jan 1, 2026 bans unauthorized facial recognition and mandates AI tools be clearly disclosed in public-facing systems.
•Utah AI Policy Act: Requires disclosure that a consumer is interacting with generative AI and creates liability for deceptive AI usage.
4. China - Binding Generative AI and Content Rules
•Interim Measures for Generative AI Services (August 2023) added rules for public-facing generative AI, particularly that can influence public opinion. They apply to legality and quality of training data, personal information, intellectual property and discrimination and cover transparency, accuracy and reliability.
•Deep Synthesis and Labeling Measures: Providers offering biometric editing must obtain explicit prior consent, establish feature libraries to detect illegal content, and apply mandatory explicit labels and machine-readable metadata headers under the AI Content Identification Measures and GB 45438-2025. The 2025 labeling Measures are scoped to public-facing generative content services offered within China regardless of provider location. Service providers must label AI-generated material either explicitly or via metadata.
•Accountability mechanisms: Providers must preserve records and respond when they discover illegal output, with assessment and labeling requirements, keep specified records and review content, and companies must submit AI systems for evaluation before public release, a process that can last months. Enforcement is assigned to cyberspace, telecom, public-security and broadcast regulators according to duties.
5. United Kingdom - Principles-Based, Regulator-Led
The UK does not currently have a single cross-sector AI Act equivalent to the EU AI Act.
Instead it empowers existing regulators (like the ICO for data protection, Ofcom for communications, and FCA for financial services) to apply five core principles:
1.safety, security, and robustness; 2. appropriate transparency and explainability; 3. fairness; 4. accountability and governance; and 5. contestability and redress.
These principles are not set out in a standalone AI Act but guide regulators rather than operate as one universal statutory set. The framework promotes a context-specific model where regulators respond to real-world usage rather than classifying all AI into preset risk bands and is described as principles-based governance.
6. International Principles
•OECD AI Principles (2019, first intergovernmental standard): Five pillars to promote responsible AI that many national policies adapt, covering inclusive growth, human-centered values, transparency, robustness and accountability. The US and EU both reference the OECD definition of AI.
•Bletchley Declaration (2023) and subsequent AI Safety Summits are non-binding commitments to cooperation on frontier model safety testing.
In practice, what this means for built, deployed, accountable:
•Built: Requirements for training-data summaries, technical documentation, risk management (NIST RMF), safety testing/red-teaming for powerful models, and bias mitigation.
•Deployed: Risk classification (EU high-risk vs minimal), human oversight, transparency/labeling of AI-generated content, and consumer notification of consequential decisions (employment, housing, credit, health).
•Held Accountable: Through fines (EU up to 7% turnover, California $5k per violation), mandated impact assessments/audits, rights to contest and redress (UK principle), documentation duties, and emerging litigation/task forces over state vs federal jurisdiction (EO 14365).
Rules are still phasing in through 2026-2028, so specific obligations depend on where you and the deployer are located and the use case.