I'll map the current rules that govern how AI systems are built, deployed, and held accountable.
Currently there is no single global law for systems like me. Instead rules are a layered mix of binding laws, voluntary frameworks, and sector/state regulations that govern building, deployment and accountability:
1. Binding, comprehensive law - EU AI Act
The most structurally significant binding law is the EU AI Act:
•It entered into force on August 1, 2024, with phased applicability
•Bans on unacceptable-risk AI systems, including social scoring and certain biometric identification tools, took effect in February 2025. Rules governing general-purpose AI models, including governance structures and penalty mechanisms, became applicable in August 2025
•From 2 August 2026, the EU AI Act introduces mandatory transparency obligations requiring organisations to disclose AI interactions, mark AI-generated content, and inform users about emotion recognition and biometric categorisation systems
•Subsequent timelines split for specific high-risk systems: rules for certain high-risk domains under Annex III (such as biometrics, critical infrastructure, education, employment, and migration/border control) apply from December 2, 2027; while rules for high-risk AI systems embedded into regulated products (such as elevators or toys) apply from August 2, 2028
Key features for building/deployment/accountability:
•Risk-based classification: certain applications are prohibited outright, while systems designated as high-risk are subject to strict regulatory obligations, including conformity assessments and transparency requirements
•It tells companies: build AI, but classify the risk. Use AI, but document the system. Deploy AI, but test the data. Automate decisions, but preserve human accountability
•It applies to providers that place AI systems on the EU market or put them into service in the EU, regardless of where the provider is established. It also applies to deployers located in the EU and to providers and deployers outside the EU when the outputs of the AI system are used in the EU
•Accountability sits with both providers and deployers - for high-risk systems it Assigns liability to deployers, ending the practice of pointing to the vendor as responsible
2. United States - Decentralized, soft-law + state patchwork
By contrast, the United States does not consolidate AI regulation into a single comprehensive statute. Instead, it favors a decentralized, soft-law approach primarily composed of Executive Order 14110 and the NIST Artificial Intelligence Risk Management Framework
•The United States lacks comprehensive federal AI legislation. Regulation comes from executive orders, agency enforcement actions, and a growing patchwork of state laws
•In the U.S., the 2023 AI Executive Order was rescinded in Jan 2025, but the NIST AI Risk Management Framework (voluntary) remains the de-facto playbook
The NIST AI Risk Management Framework is voluntary U.S. framework emphasizing governance, data quality, transparency and robustness
•It can be broken down into four core functions under the NIST AI RMF Core — Govern, Map, Measure, and Manage — running across the AI system lifecycle
•It emphasizes risk management and social responsibility to ensure that AI is developed properly and in a secure manner
•This framework operates primarily at the organizational and supply-chain levels and allows companies significant flexibility in tailoring risk management practices
State-level binding laws are now doing most regulatory work:
•Colorado AI Act - Enforceable June 30, 2026 - Governs algorithmic discrimination in consequential decisions
•Colorado: The Colorado AI Act (SB 24-205) requires deployers of high-risk AI systems, those making consequential decisions in employment, lending, housing, healthcare, insurance, education, government services, and legal services, to run impact assessments, maintain a risk management program, and report algorithmic discrimination to the attorney general
•Other states developing similar patchwork: Texas's TRAIGA, California's AI Transparency Act, and Colorado's AI Act, plus California, NY, Illinois varying rules on automated employment decisions, biometrics
3. Other jurisdictions
•China has targeted rules, including AI content labeling measures in force since September 2025. In the US context, China CAC "AI Anthropomorphic Interaction Services" measures take effect July 15, 2026
•The UK has no AI-specific legislation and relies on existing regulators
•The first binding international treaty is the Council of Europe Framework Convention on Artificial Intelligence, Human Rights, Democracy, and the Rule of Law in 2024
4. Voluntary international standards and what they require
AI compliance frameworks are structured guidelines that help companies develop, deploy and monitor AI systems in line with legal, ethical and risk management standards. These frameworks cover data governance, model fairness, transparency, accountability and cybersecurity
Leading frameworks cited globally:
•OECD AI Principles - Adopted on 22 May 2019, with the principles on 3 May 2024, the Recommendation sets five values-based principles: inclusive growth, ... privacy; transparency and explainability; robustness, security and safety; and accountability
•Updated in 2024, specifically call for responsible stewardship of trustworthy AI and systematic risk management throughout the AI lifecycle
•Promote transparency, robustness, and accountability in AI systems
•ISO/IEC 42001 is the first management system standard focused entirely on AI governance and compliance. Requirements for establishing, implementing, maintaining, and continually improving AI management systems can be referenced in ISO/IEC 42001
•NIST AI RMF + ISO/IEC 42001 + OECD are often implemented together
What frameworks typically require for building/deployment/accountability:
•Risk assessment involves classifying AI systems based on their potential to cause harm or discrimination. Transparency and explainability make sure that AI decisions can be interpreted and explained. Data and model governance manages how data is collected, used and secured. Human oversight keeps a human-in-the-loop. Accountability and documentation assigns responsibility and maintains records for audit
•Some frameworks are legally binding like the EU AI Act. Others like the NIST framework or OECD principles are voluntary but widely respected and can influence future regulation or procurement requirements. ISO/IEC 42001 is a certifiable standard