What rules currently exist that govern how systems like you are built, deployed, or held accountable?
Short answer: It’s a patchwork. There’s no single, global AI law. Instead, a mix of hard laws, sector rules, agency enforcement, procurement policies, and voluntary standards govern how systems like me are built, deployed, and held to account.
The big buckets (with current examples)
What these rules usually require in practice
If you’re building or deploying a general‑purpose model today
If helpful, tell me where you operate and your model’s main uses (e.g., recruiting, lending, customer support, healthcare). I can turn this into a tailored compliance and accountability checklist with the exact obligations and dates that apply to you.
Citations (34)
- AI principles | OECD
Backs: “OECD AI Principles (2019, updated 2024) guide “trustworthy AI” policy across many countries.”
- Recommendation on the ethics of artificial intelligence
Backs: “UNESCO’s 2021 Recommendation on AI ethics (adopted by 190+ countries) sets human‑rights‑based guardrails and implementation actions.”
- ISO/IEC 42001:2023 | IEC
Backs: “ISO/IEC 42001:2023, a certifiable AI management system (AIMS) standard.”
- ISO/IEC 23894:2023 - AI — Guidance on risk management
Backs: “ISO/IEC 23894:2023, guidance for AI risk management.”
- Artificial Intelligence Risk Management Framework (AI RMF 1.0) | NIST
Backs: “NIST (U.S.) AI Risk Management Framework 1.0 (plus a Generative AI profile) is widely referenced by companies and governments.”
- Hiroshima Process International Guiding Principles for Organizations Developing Advanced AI System (30/10/2023) - G7/G20 Documents Database
Backs: “G7 Hiroshima Process (Oct 30, 2023) issued Guiding Principles and a voluntary Code of Conduct for developers of advanced/foundation‑model AI.”
- AI Act enters into force
Backs: “Aug 1, 2024: entered into force.”
- AI Act | Shaping Europe’s digital future
Backs: “Aug 2, 2025: obligations for general‑purpose AI (GPAI) models began. The AI Office can supervise/enforce against GPAI.”
- Guidelines on transparency obligations for providers and deployers of AI systems | Shaping Europe’s digital future
Backs: “Aug 2, 2026: transparency duties (e.g., labeling certain AI‑generated content; chatbot disclosure) started to apply; broader enforcement begins.”
- Timeline - Artificial intelligence - Consilium
Backs: “Dec 2, 2027 (Annex III) and Aug 2, 2028 (Annex I): phased application of “high‑risk” rules following the 2025–26 “AI Omnibus” adjustments.”
- Regulation - 2022/2065 - EN - DSA - EUR-Lex
Backs: “EU Digital Services Act (DSA): platform accountability (risk assessments, recommender transparency, ad repositories; non‑profiling options on VLOPs).”
- Automated decision-making and profiling | European Data Protection Board
Backs: “GDPR still governs training/usage data and automated decisions (Article 22), with EDPB guidance on interplay with DSA and AI models.”
- Directive (EU) 2024/2853 of the European Parliament and of the Council of 23 October 2024 on liability for defective products and repealing Council Directive 85/374/EEC (Text with EEA relevance)
Backs: “Revised Product Liability Directive (2024/2853): updated strict liability now explicitly includes software/AI; Member States must transpose by Dec 9, 2026.”
- Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence | NIST
Backs: “Executive Order 14110 (Oct 30, 2023) jump‑started federal AI safety/testing work; it was later rescinded on Jan 20, 2025, but many agency actions and guidance it catalyzed continue under separate authorities.”
- Federal Rules: Federal Rules: MEMORANDUM, ADVANCING GOVERNANCE, INNOVATION, AND RISK MANAGEMENT FOR AGENCY USE OF ARTIFICIAL INTELLIGENCE; MEMORANDUM FOR THE HEADS OF EXECUTIVE DEPARTMENTS AND AGENCIES; OMB MEMORANDUM M-24-10 | U.S. GAO | U.S. GAO
Backs: “OMB Memorandum M‑24‑10 (Mar 28, 2024) required every federal agency to inventory AI uses, stand up AI governance, and apply risk controls (especially for rights‑ or safety‑impacting AI); later memos address AI acquisition.”
- Reducing Risks Posed by Synthetic Content An Overview of Technical Approaches to Digital Content Transparency | NIST
Backs: “NIST continues to publish AI safety/testing and synthetic‑content transparency work (e.g., provenance/watermarking guidance).”
- Policy Statements | Federal Trade Commission
Backs: “Section 5 (unfair/deceptive practices) applies to AI claims, data use, bias, and transparency; the FTC is moving toward a policy statement on AI accuracy.”
- Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms | Consumer Financial Protection Bureau
Backs: “CFPB: lenders using complex models must give specific, accurate adverse‑action reasons under ECOA/Reg B—no “black box” excuses.”
- EEOC Releases New Resource on Artificial Intelligence and Title VII
Backs: “EEOC has published technical assistance on algorithmic bias and adverse impact.”
- Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions; Guidance for Industry and Food and Drug Administration Staff; Availability | 89 FR 96259
Backs: “FDA finalized guidance allowing “predetermined change control plans” (PCCPs) so AI/ML medical software can update safely without a new clearance each time; CDS guidance clarifies what’s regulated.”
- FRB: Supervisory Letter SR 26-2 on Revised Guidance on Model Risk Management -- April 17, 2026
Backs: “Banking: updated interagency Model Risk Management guidance (SR 26‑2/OCC 2026‑13) expects robust validation/governance for AI models.”
- SB24-205 Consumer Protections for Artificial Intelligence | Colorado General Assembly
Backs: “The law requires developers and deployers of “high‑risk” AI to run risk‑management programs, do impact assessments, notify the AG of discovered algorithmic discrimination, and give notices.”
- Automated Employment Decision Tools (AEDT) - DCWP
Backs: “New York City Local Law 144 (in force since July 2023): requires annual independent bias audits for automated employment decision tools used in the city, plus notices and public posting.”
- California Finalizes Regulations to Strengthen Consumers' Privacy
Backs: “California Privacy Protection Agency’s ADMT regulations (effective Jan 1, 2026): establish consumer opt‑out and information rights for certain automated decision‑making; some obligations phase in by Jan 1, 2027.”
- Commission meeting highlights: May 2024 | Washington State Public Disclosure Commission (PDC)
Backs: “Election deepfake/synthetic‑media laws: multiple states now require disclosures or restrict deceptive deepfakes near elections (e.g., WA, CA; others vary on prohibition vs. labeling).”
- PHOTOS: Gov. Lee Signs ELVIS Act Into Law
Backs: “Tennessee’s 2024 ELVIS Act protects name/image/voice misuse, aimed at generative cloning.”
- A pro-innovation approach to AI regulation: government response - GOV.UK
Backs: “The UK chose a “pro‑innovation,” regulator‑led model (no comprehensive AI statute yet). Regulators have published AI strategies and guidance.”
- Online Safety Act 2023
Backs: “Online Safety Act 2023 imposes duties of care on in‑scope services, including duties tied to algorithms/recommenders; Ofcom issues detailed codes and guidance.”
- Artificial Intelligence and Data Act (AIDA, Bill C-27) — LAPSED
Backs: “Canada has no federal horizontal AI law in force as of Oct 2026; the proposed Artificial Intelligence and Data Act (AIDA) did not pass in prior form.”
- Légis Québec
Backs: “Ontario has a binding Responsible Use of AI Directive for provincial public‑sector use.”
- 互联网信息服务算法推荐管理规定_中央网络安全和信息化委员会办公室
Backs: “Algorithmic Recommendation Provisions (effective Mar 1, 2022) require filing, transparency, controls on recommender systems.”
- 互联网信息服务深度合成管理规定_中央网络安全和信息化委员会办公室
Backs: “Deep Synthesis rules (Jan 10, 2023) and Generative AI “Interim Measures” (effective Aug 15, 2023) add content‑labeling/watermarking, security assessment, and provider responsibilities.”
- Regulation - EU - 2024/1689 - EN - EUR-Lex
Backs: “Documentation and disclosures: technical documentation for regulators and deployers (EU AI Act; banking SR 26‑2).”
- The Federal Trade Commission 2023 Privacy and Data Security Update
Backs: “EU product liability now clearly covers AI/software; state AG enforcement (e.g., Colorado).”