What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Short answer: It depends where you are and what you’re doing with the AI. Today’s “rules” are a mix of binding laws, regulator enforcement using existing laws, public‑sector procurement/usage policies, and voluntary standards that many organizations now treat as de‑facto requirements.

Here’s a current snapshot (United States focus, with major international regimes)

United States (federal)

•Agency use and procurement

•OMB policy now governs how federal agencies adopt and buy AI. In 2025 OMB issued:

•M‑25‑21 (Accelerating Federal Use of AI), which rescinds M‑24‑10 and sets governance, inventories, risk controls, and public‑trust requirements for agency AI use.[1]

•M‑25‑22 (Driving Efficient Acquisition of AI), which updates acquisition practices and replaces M‑24‑18.[2]

•Note: the 2023 AI Executive Order (EO 14110) was rescinded on January 20, 2025; subsequent guidance now points to the newer OMB memos above.[3]

•Regulator enforcement using existing laws

•FTC uses Section 5 (unfair/deceptive acts) and privacy authority to police AI deployments (e.g., Rite Aid consent order banning certain facial recognition uses and imposing an algorithmic fairness program).[4]

•CFPB reminds lenders that “black‑box” models don’t excuse adverse‑action notice duties under ECOA/Reg B; lenders must give specific reasons.[5]

•EEOC enforces Title VII/ADA where AI in hiring causes discrimination; it has technical assistance on AI and adverse impact.[6]

•Sector/privacy guardrails via state law

•California CPPA regulations effective Jan 1, 2026 require risk assessments, cybersecurity audits, and give consumers access/opt‑out rights for Automated Decision‑Making Technology (ADMT).[7]

•NYC Local Law 144 (since 2023) requires bias audits and notices for automated employment decision tools.[8]

•Colorado’s 2024 AI law (SB 24‑205) establishes duties for “high‑risk” AI to prevent algorithmic discrimination; the AG is running rulemaking, and a 2026 “Chatbot Safety Act” added teen‑safety and disclosure duties for conversational AI.[9]

•Illinois BIPA (biometric privacy) continues to constrain facial recognition; 2024 amendments limited damages to one recovery per person per collection method, and the Clearview AI settlement illustrates injunctive limits.[10]

European Union

•AI Act (Regulation (EU) 2024/1689): global first comprehensive AI law, risk‑tiered obligations, an AI Office for supervision of general‑purpose models, and fines for non‑compliance.

•Key dates now in force: transparency obligations (Article 50) apply from August 2, 2026; GPAI (general‑purpose model) duties apply on an accelerated timeline; most high‑risk system requirements phase in through 2027–2028.[11]

•Harmonised standards will give “presumption of conformity” once published; providers must run QMS, data/tech documentation, human oversight, logging, post‑market monitoring, and incident reporting for high‑risk systems.[12]

•Digital Services Act (DSA): since 2024, very large platforms/search must assess and mitigate systemic risks tied to recommender and other algorithmic systems and undergo annual independent audits.[13]

•Product liability: the 2024 revision extends strict liability to software/AI; Member States must transpose by December 9, 2026.[14]

United Kingdom

•No single AI statute; the government’s “pro‑innovation” policy steers existing regulators (ICO, CMA, MHRA, etc.) and stood up the UK’s AI Safety/Security Institute to evaluate frontier models; Online Safety Act 2023 imposes duties of care (including on algorithmic recommender risks) for user‑to‑user and search services.[15]

Canada

•No federal AI act in force (AIDA in Bill C‑27 did not become law). The federal public service, however, must use the Directive on Automated Decision‑Making (2019; amended 2023), which requires an Algorithmic Impact Assessment and proportional safeguards before deploying automated decision systems.[16]

China

•Binding national rules already cover: algorithmic recommendations (effective March 1, 2022), deep synthesis/deepfakes (effective January 10, 2023), and public‑facing generative AI services (finalized July 2023). They require filings, transparency, security assessments, watermarking and other controls.[17]

Council of Europe, OECD, G7 (international)

•Council of Europe Framework Convention on AI (CETS No. 225): first binding international AI treaty (human rights, democracy, rule of law), opened for signature Sept 5, 2024; the EU signed and has moved toward applying it alongside the AI Act.[18]

•OECD AI Principles (2019; updated 2024) underpin many national strategies and standards work.[19]

•G7 Hiroshima Process Code of Conduct gives voluntary guidance for developers of advanced/foundation models.[20]

Standards and “rules by contract” that shape how AI is built

•NIST AI Risk Management Framework 1.0 (2023) and its Generative AI Profile (2024) are widely adopted as the baseline for model/system risk controls, evaluations, and governance.[21]

•ISO/IEC 42001:2023 (AI Management System) is the first certifiable AI governance standard; many organizations use it with ISO/IEC 23894 (AI risk management) to operationalize controls and show due diligence (often required in RFPs, audits, and regulator dialogues).[22]

•Security guidance: the US CISA and UK NCSC’s joint “Guidelines for Secure AI System Development,” plus allied agency guidance on securely deploying AI systems, are becoming table‑stakes for build and red‑team processes.[23]

What these rules mean in practice (build, deploy, accountability)

•Before build: document intended use and risk; run data‑protection/impact or algorithmic‑impact assessments; implement governance (policy, roles, testing plans, incident response). Expect to align with NIST AI RMF/ISO 42001 whether or not it’s legally mandated.[21]

•During development: data and model documentation, bias/fairness evaluation, safety/security testing (including adversarial tests), human‑oversight and fallback design, traceability and logging for later audits. These are explicit in the EU AI Act for high‑risk systems and GPAI, and implicit via US regulator expectations (FTC/CFPB/EEOC).[12]

•At deployment: provide required notices/disclosures (e.g., NYC AEDT notices, California ADMT rights; EU Article 50 transparency), maintain monitoring and a channel to report/mitigate incidents, and keep your audit artifacts up to date.[8]

•Accountability if things go wrong: consumer‑protection and civil‑rights enforcement (FTC, EEOC, CFPB), biometric privacy suits (e.g., under Illinois BIPA), and—in the EU—regulatory fines under the AI Act/DSA and product‑liability exposure for software/AI.[4]

If you tell me your role and where you operate (e.g., US enterprise SaaS, EU medical device, NYC hiring tool), I can map the exact obligations, the dates in effect as of today (October 7, 2026), and a practical compliance checklist.

Citations (23)

1whitehouse.govGovernment
EXECUTIVE OFFICE OF THE PRESIDENT
Backs: “M‑25‑21 (Accelerating Federal Use of AI), which rescinds M‑24‑10 and sets governance, inventories, risk controls, and public‑trust requirements for agency AI use.”
2whitehouse.govGovernment
EXECUTIVE OFFICE OF THE PRESIDENT
Backs: “M‑25‑22 (Driving Efficient Acquisition of AI), which updates acquisition practices and replaces M‑24‑18.”
3nist.govGovernment
Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence | NIST
Backs: “Note: the 2023 AI Executive Order (EO 14110) was rescinded on January 20, 2025; subsequent guidance now points to the newer OMB memos above.”
4ftc.govGovernment
Rite Aid Corporation, FTC v. | Federal Trade Commission
Backs: “FTC uses Section 5 (unfair/deceptive acts) and privacy authority to police AI deployments (e.g., Rite Aid consent order banning certain facial recognition uses and imposing an algorithmic fairness program).”
5consumerfinance.govGovernment
Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms | Consumer Financial Protection Bureau
Backs: “CFPB reminds lenders that “black‑box” models don’t excuse adverse‑action notice duties under ECOA/Reg B; lenders must give specific reasons.”
6govdelivery.comCompanies
EEOC Releases New Resource on Artificial Intelligence and Title VII
Backs: “EEOC enforces Title VII/ADA where AI in hiring causes discrimination; it has technical assistance on AI and adverse impact.”
7ca.govGovernment
California Finalizes Regulations to Strengthen Consumers' Privacy
Backs: “California CPPA regulations effective Jan 1, 2026 require risk assessments, cybersecurity audits, and give consumers access/opt‑out rights for Automated Decision‑Making Technology (ADMT).”
8nyc.govGovernment
Automated Employment Decision Tools (AEDT) - DCWP
Backs: “NYC Local Law 144 (since 2023) requires bias audits and notices for automated employment decision tools.”
9colorado.govGovernment
SENATE BILL 24-205
Backs: “Colorado’s 2024 AI law (SB 24‑205) establishes duties for “high‑risk” AI to prevent algorithmic discrimination; the AG is running rulemaking, and a 2026 “Chatbot Safety Act” added teen‑safety and disclosure duties for conversational AI.”
10ilga.govGovernment
Illinois General Assembly - Public Act 103-0769
Backs: “2024 amendments limited damages to one recovery per person per collection method, and the Clearview AI settlement illustrates injunctive limits.”
11europa.euGovernment
When does enforcement start? | AI Act Service Desk
Backs: “GPAI (general‑purpose model) duties apply on an accelerated timeline; most high‑risk system requirements phase in through 2027–2028.”
12europa.euGovernment
EUR-Lex - 02024R1689-20260727 - EN - EUR-Lex
Backs: “Harmonised standards will give “presumption of conformity” once published; providers must run QMS, data/tech documentation, human oversight, logging, post‑market monitoring, and incident reporting for high‑risk systems.”
13europa.euGovernment
How the Digital Services Act enhances transparency online | Shaping Europe’s digital future
Backs: “Digital Services Act (DSA): since 2024, very large platforms/search must assess and mitigate systemic risks tied to recommender and other algorithmic systems and undergo annual independent audits.”
14europa.euGovernment
New liability rules for victims to seek compensation for damages caused by defective products online and offline
Backs: “Product liability: the 2024 revision extends strict liability to software/AI; Member States must transpose by December 9, 2026.”
15gov.ukGovernment
A pro-innovation approach to AI regulation: government response - GOV.UK
Backs: “Online Safety Act 2023 imposes duties of care (including on algorithmic recommender risks) for user‑to‑user and search services.”
16parl.caNot yet classified
C-27 (44-1) - LEGISinfo - Parliament of Canada
Backs: “The federal public service, however, must use the Directive on Automated Decision‑Making (2019; amended 2023), which requires an Algorithmic Impact Assessment and proportional safeguards before deploying automated decision systems.”
17stanford.eduAcademic
Translation: Internet Information Service Algorithmic Recommendation Management Provisions – Effective March 1, 2022
Backs: “They require filings, transparency, security assessments, watermarking and other controls.”
18coe.intGovernment
The Framework Convention on Artificial Intelligence - Artificial Intelligence
Backs: “225): first binding international AI treaty (human rights, democracy, rule of law), opened for signature Sept 5, 2024; the EU signed and has moved toward applying it alongside the AI Act.”
19oecd.orgGovernment
AI principles | OECD
Backs: “OECD AI Principles (2019; updated 2024) underpin many national strategies and standards work.”
20bundesregierung.deNot yet classified
Hiroshima Process International
Backs: “G7 Hiroshima Process Code of Conduct gives voluntary guidance for developers of advanced/foundation models.”
21nist.govGovernment
Artificial Intelligence Risk Management Framework (AI RMF 1.0) | NIST
Backs: “NIST AI Risk Management Framework 1.0 (2023) and its Generative AI Profile (2024) are widely adopted as the baseline for model/system risk controls, evaluations, and governance.”
22iso.orgNonprofits and think tanks
ISO/IEC 42001:2023 - AI management systems
Backs: “ISO/IEC 42001:2023 (AI Management System) is the first certifiable AI governance standard; many organizations use it with ISO/IEC 23894 (AI risk management) to operationalize controls and show due diligence (often required in RFPs, audits, and regulator dialogues).”
23cisa.govGovernment
CISA and UK NCSC Unveil Joint Guidelines for Secure AI System Development | CISA
Backs: “Security guidance: the US CISA and UK NCSC’s joint “Guidelines for Secure AI System Development,” plus allied agency guidance on securely deploying AI systems, are becoming table‑stakes for build and red‑team processes.”