What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Here’s a concise, “what applies where” snapshot of the main, current rules that govern how AI systems are built, deployed, and held accountable (as of October 10, 2026). If you want a deeper dive for a specific sector or jurisdiction, say the word.

United States (federal)

•Executive branch policy and federal-agency guardrails

•Executive Order 14110 (Oct 30, 2023) directs NIST to develop AI safety/testing guidance and Commerce/other agencies to set content-authentication guidance, and triggers reporting and safety-testing expectations for powerful models.[1]

•OMB Memorandum M-24-10 (Mar 28, 2024) requires all federal agencies to inventory AI uses, stand up governance, and apply minimum risk-management practices for “rights-” and “safety-” impacting AI, with public reporting. Agencies (e.g., the Fed, EEOC) have since published compliance plans.[2]

•NIST AI Risk Management Framework (AI RMF 1.0) and the NIST Generative AI Profile (AI 600‑1) are the de facto technical baselines many programs and vendors map to. The U.S. AI Safety Institute at NIST coordinates testing/evaluation work. These are voluntary but heavily referenced in EO 14110/OMB policy and procurement.[3]

•Enforcement under existing federal laws (“no AI exemption”)

•The DOJ, FTC, CFPB, and EEOC jointly affirmed that civil-rights, consumer‑protection, fair‑lending, and competition laws apply to automated systems; each has brought or guided enforcement accordingly (e.g., adverse‑action explainability in credit).[4]

United States (state and local)

•Colorado AI Act (SB 24‑205)

•Effective Feb 1, 2026 for deployers: duties to use reasonable care to prevent algorithmic discrimination in “high‑risk” AI (consequential decisions), plus notices, risk management, and impact assessments; developer transparency duties as well. Enforced by the Attorney General.[5]

•California privacy regulations (CPPA)

•Final regulations (effective Jan 1, 2026) add rights around “Automated Decisionmaking Technology” (ADMT) used for significant decisions: pre‑use notice, access, opt‑out, plus risk assessments and annual cybersecurity audits; phased compliance (ADMT obligations by Jan 1, 2027).[6]

•New York City Local Law 144 (hiring tools)

•Since July 5, 2023, automated employment decision tools used in NYC require an annual independent bias audit, public posting of results, and candidate notices.[7]

•Illinois AI Video Interview Act

•Requires notice, consent, limited use/sharing, and, upon request, deletion of interview videos analyzed by AI; added demographic reporting if employers rely solely on AI to screen for interviews.[8]

•Political deepfakes and election ads (fast‑moving, state‑by‑state)

•Dozens of states now require disclosures (or impose time‑limited bans) for AI‑generated political ads; the FEC issued 2024 guidance but declined broader rulemaking. Check your state’s specific requirements.[9]

European Union

•EU AI Act (Regulation (EU) 2024/1689)

•In force since Aug 1, 2024. Key dates: most transparency rules apply from Aug 2, 2026; prohibitions 1–8 (e.g., social scoring, manipulative/deceptive systems) have applied since Feb 2, 2025; the new prohibition on non‑consensual intimate/CSAM generation applies Dec 2, 2026. GPAI (general‑purpose AI) obligations took effect Aug 2, 2025, enforced by the EU AI Office from Aug 2, 2026. High‑risk use‑case rules start Dec 2, 2027 (and Aug 2, 2028 when embedded in regulated products). Significant fines: up to €35M/7% turnover for prohibited practices; €15M/3% and €7.5M/1% for other breaches/misleading info.[10]

•Digital Services Act (DSA)

•Very large platforms/search engines must assess/mitigate systemic risks (including those tied to recommender systems), provide non‑profiling recommender options, and publish audits/risk reports. These duties complement AI Act obligations when platforms deploy AI.[11]

•Product liability update

•The 2024 Product Liability Directive clarifies that software/AI are “products” under EU no‑fault liability, easing injured users’ ability to claim compensation; Member States must transpose by Dec 9, 2026.[12]

•GDPR Article 22 and EDPB guidance

•Gives individuals protections against solely automated decisions with legal/similarly significant effects; controllers must provide meaningful information about logic and allow human review in many cases.[13]

United Kingdom

•“Pro‑innovation” regulatory approach (no single AI statute)

•The UK directs existing regulators to apply cross‑cutting AI principles; it launched the UK AI Safety Institute to evaluate frontier risks and publish testing methods, but has not enacted an AI‑Act‑style comprehensive law.[14]

Council of Europe (multinational treaty)

•Framework Convention on AI and Human Rights, Democracy and Rule of Law

•First binding international AI treaty, adopted May 17, 2024; opened for signature Sept 5, 2024 (signatories include the EU, U.S., U.K.). It sets baseline obligations to protect human rights and democratic values across the AI lifecycle; it will bind parties as they ratify.[15]

China (selected national rules affecting build/deploy)

•Algorithmic recommendation rules (effective Mar 1, 2022) regulate recommender systems (e.g., feed ranking).[16]

•“Deep synthesis” rules (effective Jan 10, 2023) impose labeling, security, and takedown duties for synthetic media.[17]

•Interim Measures for Generative AI Services (effective Aug 15, 2023) set content, filing, and security‑assessment duties for public‑facing generative AI.[18]

Cross‑cutting standards and frameworks (often used to demonstrate “reasonable care” or as audit baselines)

•NIST AI RMF 1.0 and Generative AI Profile (U.S.) for risk management across the AI lifecycle; widely referenced by agencies and industry.[3]

•ISO/IEC 42001:2023 (AI management systems) — a certifiable management‑system standard for organizational AI governance; ISO/IEC 23894:2023 (AI risk management) — guidance on managing AI risk.[19]

•IEEE 7000‑2021 (ethics in system design) — process standard for addressing ethical concerns during engineering.[20]

•C2PA “Content Credentials” — a technical standard used to label/provide provenance for AI‑generated/edited media; increasingly referenced in watermarking/labeling programs.[21]

•Soft‑law principles: OECD AI Principles (2019, updated 2024) and UNESCO’s 2021 Recommendation on AI Ethics underpin many national frameworks.[22]

What this typically means in practice for builders and deployers

•Risk management and documentation: AI risk registers, data protection/AI impact assessments, red‑teaming and pre‑deployment testing, post‑market monitoring. (Required for EU high‑risk AI; expected/encouraged by OMB M‑24‑10 and NIST RMF.)[10]

•Transparency to users: notices when AI is used, explanations or adverse‑action reasons for consequential decisions, and labeling of synthetic media in many jurisdictions. (EU AI Act transparency; U.S. CPPA ADMT; state deepfake‑ad disclosures.)[10]

•Human oversight and contestability: human‑in‑the‑loop or effective escalation paths and appeals for significant decisions (EU AI Act; GDPR Art. 22; OMB policy for “rights/safety impacting” AI).[10]

•Fairness and nondiscrimination safeguards: bias testing/audits and anti‑discrimination duties (EU high‑risk obligations; NYC bias audit; Colorado AI Act’s duty to avoid algorithmic discrimination; U.S. civil‑rights enforcement).[10]

•Accountability and penalties: EU AI Act features tiered fines up to 7% of global turnover for prohibited practices; U.S. enforcement leverages existing laws (FTC Act, ECOA, Title VII, etc.), with additional state penalties depending on the statute.[23]

If you tell me your industry and where you operate (e.g., “we’re a U.S. fintech that hires in NYC and serves EU users”), I can map the exact obligations, audits/assessments you’ll need, and the fastest way to show compliance using the frameworks above.

Citations (23)

1govinfo.govGovernment
Executive Orders EO 14110
Backs: “Executive Order 14110 (Oct 30, 2023) directs NIST to develop AI safety/testing guidance and Commerce/other agencies to set content-authentication guidance, and triggers reporting and safety-testing expectations for powerful models.”
2whitehouse.govGovernment
EXECUTIVE OFFICE OF THE PRESIDENT
Backs: “Agencies (e.g., the Fed, EEOC) have since published compliance plans.”
3nist.govGovernment
AI Risk Management Framework | NIST
Backs: “These are voluntary but heavily referenced in EO 14110/OMB policy and procurement.”
4ftc.govGovernment
FTC Chair Khan and Officials from DOJ, CFPB and EEOC Release Joint Statement on AI | Federal Trade Commission
Backs: “The DOJ, FTC, CFPB, and EEOC jointly affirmed that civil-rights, consumer‑protection, fair‑lending, and competition laws apply to automated systems; each has brought or guided enforcement accordingly (e.g., adverse‑action explainability in credit).”
5colorado.govGovernment
SB24-205 Consumer Protections for Artificial Intelligence | Colorado General Assembly
Backs: “Effective Feb 1, 2026 for deployers: duties to use reasonable care to prevent algorithmic discrimination in “high‑risk” AI (consequential decisions), plus notices, risk management, and impact assessments; developer transparency duties as well. Enforced by the Attorney General.”
6ca.govGovernment
CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology (ADMT), and Insurance Regulations - California Privacy Protection Agency (CPPA)
Backs: “Final regulations (effective Jan 1, 2026) add rights around “Automated Decisionmaking Technology” (ADMT) used for significant decisions: pre‑use notice, access, opt‑out, plus risk assessments and annual cybersecurity audits; phased compliance (ADMT obligations by Jan 1, 2027).”
7nyc.govGovernment
Automated Employment Decision Tools (AEDT) - DCWP
Backs: “Since July 5, 2023, automated employment decision tools used in NYC require an annual independent bias audit, public posting of results, and candidate notices.”
8ilga.govGovernment
-
Backs: “Requires notice, consent, limited use/sharing, and, upon request, deletion of interview videos analyzed by AI; added demographic reporting if employers rely solely on AI to screen for interviews.”
9ncsl.orgNonprofits and think tanks
Artificial Intelligence (AI) in Elections and Campaigns
Backs: “Dozens of states now require disclosures (or impose time‑limited bans) for AI‑generated political ads; the FEC issued 2024 guidance but declined broader rulemaking. Check your state’s specific requirements.”
10europa.euGovernment
AI Act | Shaping Europe’s digital future
Backs: “Significant fines: up to €35M/7% turnover for prohibited practices; €15M/3% and €7.5M/1% for other breaches/misleading info.”
11europa.euGovernment
Regulation - 2022/2065 - EN - DSA - EUR-Lex
Backs: “These duties complement AI Act obligations when platforms deploy AI.”
12europa.euGovernment
Directive (EU) 2024/2853 of the European Parliament and of the Council of 23 October 2024 on liability for defective products and repealing Council Directive 85/374/EEC (Text with EEA relevance)
Backs: “The 2024 Product Liability Directive clarifies that software/AI are “products” under EU no‑fault liability, easing injured users’ ability to claim compensation; Member States must transpose by Dec 9, 2026.”
13europa.euGovernment
Information for individuals - European Commission
Backs: “Gives individuals protections against solely automated decisions with legal/similarly significant effects; controllers must provide meaningful information about logic and allow human review in many cases.”
14gov.ukGovernment
AI regulation: a pro-innovation approach - GOV.UK
Backs: “The UK directs existing regulators to apply cross‑cutting AI principles; it launched the UK AI Safety Institute to evaluate frontier risks and publish testing methods, but has not enacted an AI‑Act‑style comprehensive law.”
15coe.intGovernment
Committee on Artificial Intelligence (CAI) - Artificial Intelligence
Backs: “It sets baseline obligations to protect human rights and democratic values across the AI lifecycle; it will bind parties as they ratify.”
16stanford.eduAcademic
Translation: Internet Information Service Algorithmic Recommendation Management Provisions – Effective March 1, 2022
Backs: “Algorithmic recommendation rules (effective Mar 1, 2022) regulate recommender systems (e.g., feed ranking).”
17chinalawtranslate.comNot yet classified
Provisions on the Administration of Deep Synthesis Internet Information Services
Backs: ““Deep synthesis” rules (effective Jan 10, 2023) impose labeling, security, and takedown duties for synthetic media.”
18comparativeai.orgLow provenance
Interim Measures for the Management of Generative AI Services | Comparative AI
Backs: “Interim Measures for Generative AI Services (effective Aug 15, 2023) set content, filing, and security‑assessment duties for public‑facing generative AI.”
19iso.orgNonprofits and think tanks
ISO/IEC 42001:2023 - AI management systems
Backs: “ISO/IEC 23894:2023 (AI risk management) — guidance on managing AI risk.”
20ieee.orgNot yet classified
7000-2021 - IEEE Standard Model Process for Addressing Ethical Concerns during System Design | IEEE Standard | IEEE Xplore
Backs: “IEEE 7000‑2021 (ethics in system design) — process standard for addressing ethical concerns during engineering.”
21c2pa.orgNot yet classified
Content Credentials : C2PA Technical Specification :: C2PA Specifications
Backs: “C2PA “Content Credentials” — a technical standard used to label/provide provenance for AI‑generated/edited media; increasingly referenced in watermarking/labeling programs.”
22oecd.orgGovernment
AI principles | OECD
Backs: “OECD AI Principles (2019, updated 2024) and UNESCO’s 2021 Recommendation on AI Ethics underpin many national frameworks.”
23europa.euGovernment
Article 99: Penalties | AI Act Service Desk
Backs: “U.S. enforcement leverages existing laws (FTC Act, ECOA, Title VII, etc.), with additional state penalties depending on the statute.”