What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Here’s the short version of “what’s on the books” today (as of October 8, 2026), organized by where you operate and what phase of the AI lifecycle you’re in.

United States (federal)

•No single, comprehensive AI statute. Federal agencies govern AI through existing laws (consumer protection, civil rights, credit, health/privacy) and policy memoranda. The 2023 AI executive order (EO 14110) was rescinded on January 20, 2025 and superseded by new directives including EO 14179 (Jan 23, 2025) focused on “Removing Barriers to American Leadership in AI.” These orders reoriented policy but did not eliminate agencies’ ability to police deceptive or discriminatory AI uses under current law.[1]

•Oversight via regulators using existing authority:

•FTC: enforces against deceptive/unfair AI claims; updated impersonation rulemaking to address AI-enabled voice cloning; has signaled scrutiny of generative‑AI marketing and biometric practices.[2]

•EEOC/DOJ: remind employers that Title VII and ADA apply to algorithmic hiring and assessment tools; issued technical assistance on adverse impact.[3]

•Federal procurement and use:

•OMB M‑24‑10 (Mar 2024) requires each agency to stand up AI governance, inventory and manage “rights‑impacting” and “safety‑impacting” AI, and meet minimum risk‑management practices; subsequent memos address acquisition. These bind federal agencies (and often shape vendor requirements).[4]

•Voluntary but influential federal standards:

•NIST AI Risk Management Framework (AI RMF 1.0) and its Generative AI profile; the NIST AI Safety Institute coordinates evaluations and guidance with industry and allies. These aren’t laws, but they’re fast becoming the common language for audits and assurances.[5]

United States (state and local)

•Colorado’s AI law (SB 24‑205) imposes “reasonable care” duties on developers and deployers of high‑risk AI to prevent algorithmic discrimination, with notice, recordkeeping and incident duties. Core obligations begin in 2026 (Colorado has adjusted some dates; track Attorney General rulemaking).[6]

•New York City Local Law 144: employers using automated employment decision tools must complete an annual independent bias audit and give candidate notices; enforced since July 5, 2023.[7]

•California privacy rules now include Automated Decision‑Making Technology (ADMT) regulations under the CCPA/CPRA (effective Jan 1, 2026; some ADMT compliance dates run to Jan 1, 2027). They create access/opt‑out rights and risk‑assessment/audit duties for certain AI uses.[8]

•Long‑standing sectoral laws (e.g., Illinois BIPA for biometrics) continue to drive litigation and design constraints for face, voice and other biometric features.[9]

European Union

•EU AI Act (Regulation 2024/1689): risk‑based, horizontal framework.

•In force since Aug 1, 2024; most rules apply from Aug 2, 2026. Prohibited AI practices and AI‑literacy obligations have applied since Feb 2, 2025. High‑risk Annex III uses apply from Dec 2, 2027; high‑risk AI embedded in regulated products from Aug 2, 2028. GPAI (foundation‑model) obligations and code‑of‑practice milestones sit on an earlier track. Plan compliance to these dates.[10]

•Expect duties around risk management, data/technical documentation, logging, transparency, human oversight, post‑market monitoring, incident reporting—and, for GPAI providers, training‑data summaries and copyright‑TDM compliance.[11]

•Digital Services Act (DSA): platform accountability and recommender‑system transparency, with extra duties for VLOPs/VLOSEs (risk assessments/mitigation, data access for researchers, non‑profiling recommender option). Applies since Feb 17, 2024 (VLOPs/VLOSEs earlier).[12]

•GDPR: Article 22 and related guidance limit solely automated decisions with legal/similarly significant effects and require meaningful information about logic and safeguards.[13]

United Kingdom

•No single “AI Act” yet. The UK runs a regulator‑led, “pro‑innovation” approach anchored in cross‑cutting principles, with central coordination and the government’s AI Safety/Security Institute to test frontier systems and develop evaluation methods. Platform duties also come via the Online Safety Act 2023.[14]

Canada

•No federal AI‑specific statute in force; earlier AIDA (as part of Bill C‑27) did not become law. Public‑sector use is governed by the binding Treasury Board Directive on Automated Decision‑Making, which mandates Algorithmic Impact Assessments, testing, transparency and oversight for automated decisions.[15]

China

•Binding national rules govern algorithms and generative AI, including:

•Algorithmic Recommendation Provisions (effective Mar 1, 2022).

•Deep Synthesis Provisions (deepfakes; effective Jan 10, 2023).

•Interim Measures for Generative AI Services (effective Aug 15, 2023). These focus on service providers’ safety, labeling, data and security assessments.[16]

International/soft law and treaties

•Council of Europe Framework Convention on AI (opened for signature Sept 5, 2024): first binding international treaty focused on human rights, democracy and rule of law in AI; entering into force depends on ratifications.[17]

•OECD AI Principles (2019, updated 2024): widely adopted soft‑law foundation used by many regulators and standards bodies.[18]

•G7 Hiroshima AI Process: voluntary guiding principles and a code of conduct for developers of advanced AI systems; informs assurance and reporting practices.[19]

•Copyright and training data (global context): in the U.S., the Copyright Office’s policy requires human authorship for protection and has ongoing AI studies; in the EU, the DSM Copyright Directive’s text‑and‑data‑mining exceptions (and opt‑outs) interact with the AI Act’s GPAI obligations.[20]

Technical standards and audits you’ll see in contracts and due diligence

•ISO/IEC 42001:2023 (AI management systems) and ISO/IEC 23894:2023 (AI risk management) are emerging baselines for audits/certification; often mapped to NIST AI RMF.[21]

•NIST AI RMF 1.0 with a Generative AI Profile is the de facto reference in U.S. markets (public and private).[5]

What this means in practice

•Build phase: expect risk assessments, data governance, testing/evaluation (including bias and safety), technical documentation, and management‑system controls (ISO 42001/NIST AI RMF) to be requested by customers or required by law in certain jurisdictions.[21]

•Deploy phase: disclosures to users, recordkeeping/logging, human‑oversight contours, model/feature‑level transparency (e.g., NYC audits; EU AI Act transparency; CA ADMT rights), content labeling/watermarking in some regimes, and incident reporting.[7]

•Accountability: regulators can and do act under existing laws (consumer protection, anti‑discrimination, privacy/biometrics), and new horizontal AI laws (EU AI Act; CO law) create explicit duties and penalties. Platform rules (DSA/Online Safety Act) add algorithmic transparency and systemic‑risk obligations.[2]

If you tell me your sector, model type (e.g., foundation vs. application‑specific), and target markets, I can turn this into a concrete, jurisdiction‑by‑jurisdiction compliance checklist with the exact obligations and dates that apply to you.

Citations (21)

1nist.govGovernment
Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence | NIST
Backs: “The 2023 AI executive order (EO 14110) was rescinded on January 20, 2025 and superseded by new directives including EO 14179 (Jan 23, 2025) focused on “Removing Barriers to American Leadership in AI.” These orders reoriented policy but did not eliminate agencies’ ability to police deceptive or discriminatory AI uses…”
2ftc.govGovernment
FTC Announces Crackdown on Deceptive AI Claims and Schemes | Federal Trade Commission
Backs: “FTC: enforces against deceptive/unfair AI claims; updated impersonation rulemaking to address AI-enabled voice cloning; has signaled scrutiny of generative‑AI marketing and biometric practices.”
3eeoc.govGovernment
EEOC History: 2020 - 2024 | U.S. Equal Employment Opportunity Commission
Backs: “EEOC/DOJ: remind employers that Title VII and ADA apply to algorithmic hiring and assessment tools; issued technical assistance on adverse impact.”
4whitehouse.govGovernment
EXECUTIVE OFFICE OF THE PRESIDENT
Backs: “These bind federal agencies (and often shape vendor requirements).”
5nist.govGovernment
Artificial Intelligence Risk Management Framework (AI RMF 1.0) | NIST
Backs: “These aren’t laws, but they’re fast becoming the common language for audits and assurances.”
6colorado.govGovernment
SB24-205 Consumer Protections for Artificial Intelligence | Colorado General Assembly
Backs: “Core obligations begin in 2026 (Colorado has adjusted some dates; track Attorney General rulemaking).”
7nyc.govGovernment
Automated Employment Decision Tools (AEDT) - DCWP
Backs: “New York City Local Law 144: employers using automated employment decision tools must complete an annual independent bias audit and give candidate notices; enforced since July 5, 2023.”
8ca.govGovernment
California Finalizes Regulations to Strengthen Consumers' Privacy
Backs: “They create access/opt‑out rights and risk‑assessment/audit duties for certain AI uses.”
9wikipedia.orgEncyclopedias and referencequality 0.83
Biometric Information Privacy Act
Backs: “Long‑standing sectoral laws (e.g., Illinois BIPA for biometrics) continue to drive litigation and design constraints for face, voice and other biometric features.”
10europa.euGovernment
AI Act | Shaping Europe’s digital future
Backs: “GPAI (foundation‑model) obligations and code‑of‑practice milestones sit on an earlier track. Plan compliance to these dates.”
11europa.euGovernment
EUR-Lex - 02024R1689-20260727 - EN - EUR-Lex
Backs: “Expect duties around risk management, data/technical documentation, logging, transparency, human oversight, post‑market monitoring, incident reporting—and, for GPAI providers, training‑data summaries and copyright‑TDM compliance.”
12europa.euGovernment
Digital Services Act: Questions and Answers | Shaping Europe’s digital future
Backs: “Digital Services Act (DSA): platform accountability and recommender‑system transparency, with extra duties for VLOPs/VLOSEs (risk assessments/mitigation, data access for researchers, non‑profiling recommender option). Applies since Feb 17, 2024 (VLOPs/VLOSEs earlier).”
13europa.euGovernment
Information for individuals - European Commission
Backs: “Article 22 and related guidance limit solely automated decisions with legal/similarly significant effects and require meaningful information about logic and safeguards.”
14gov.ukGovernment
A pro-innovation approach to AI regulation: government response - GOV.UK
Backs: “The UK runs a regulator‑led, “pro‑innovation” approach anchored in cross‑cutting principles, with central coordination and the government’s AI Safety/Security Institute to test frontier systems and develop evaluation methods. Platform duties also come via the Online Safety Act 2023.”
15cyberchaintec.comNot yet classified
AIDA and After: Where Federal AI Legislation Stands | Cyber Chain Technologies | Nexus by CyberChain Technologies
Backs: “Public‑sector use is governed by the binding Treasury Board Directive on Automated Decision‑Making, which mandates Algorithmic Impact Assessments, testing, transparency and oversight for automated decisions.”
16stanford.eduAcademic
Translation: Internet Information Service Algorithmic Recommendation Management Provisions – Effective March 1, 2022
Backs: “These focus on service providers’ safety, labeling, data and security assessments.”
17coe.intGovernment
The Framework Convention on Artificial Intelligence - Artificial Intelligence
Backs: “Council of Europe Framework Convention on AI (opened for signature Sept 5, 2024): first binding international treaty focused on human rights, democracy and rule of law in AI; entering into force depends on ratifications.”
18oecd.orgGovernment
AI principles | OECD
Backs: “OECD AI Principles (2019, updated 2024): widely adopted soft‑law foundation used by many regulators and standards bodies.”
19g7g20-documents.orgNot yet classified
Hiroshima Process International Code of Conduct for Organizations Developing Advanced AI Systems (30/10/2023) - G7/G20 Documents Database
Backs: “G7 Hiroshima AI Process: voluntary guiding principles and a code of conduct for developers of advanced AI systems; informs assurance and reporting practices.”
20govinfo.govGovernment
88 FR 16190 - Copyright Registration Guidance: Works Containing Material Generated by Artificial Intelligence - Content Details - 2023-05321
Backs: “Copyright and training data (global context): in the U.S., the Copyright Office’s policy requires human authorship for protection and has ongoing AI studies; in the EU, the DSM Copyright Directive’s text‑and‑data‑mining exceptions (and opt‑outs) interact with the AI Act’s GPAI obligations.”
21iso.orgNonprofits and think tanks
ISO/IEC 42001:2023 - AI management systems
Backs: “ISO/IEC 42001:2023 (AI management systems) and ISO/IEC 23894:2023 (AI risk management) are emerging baselines for audits/certification; often mapped to NIST AI RMF.”