What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Short answer

•There isn’t a single global “AI law.” Today’s rules are a patchwork of binding laws (privacy, discrimination, consumer protection, product liability, export controls), new AI‑specific statutes and rules in some places, and nonbinding frameworks/standards that many buyers and regulators now expect you to follow.

Key frameworks in force now or coming soon

United States (federal)

•Executive Orders and federal agency policy for government use of AI: The current federal policy baseline is Executive Order 14179 (Jan 23, 2025) and Executive Order 14365 (Dec 11, 2025). EO 14179 set a national, pro‑innovation AI policy and directed an AI Action Plan; EO 14365 pushes a uniform national framework and directs agencies to address conflicts with state AI laws. OMB Memorandum M‑25‑21 (Apr 3, 2025) replaced the 2024 memo and now requires every federal agency to appoint a Chief AI Officer, publish AI use inventories, and apply minimum risk‑management practices for “high‑impact AI” in federal programs. These govern federal agency use, not the whole private sector, but they shape procurement and expectations.[1]

•Consumer protection and civil‑rights enforcement still apply to AI:

•FTC: uses Section 5 (unfair/deceptive acts) for AI claims and deepfake/impersonation scams; it finalized a rule against government/business impersonation and has proposed further AI‑related actions. In 2025 it also proposed a policy statement warning that “steering” outputs away from users’ stated objectives could be deceptive.[2]

•CFPB: lenders using complex/ML models must still give specific reasons for adverse credit actions under ECOA/Reg B; using a “black box” doesn’t excuse this.[3]

•EEOC/DOJ: remind employers that Title VII and disability laws apply when using AI in hiring; disparate impact rules still apply.[4]

•Export controls that affect building frontier systems: BIS rules (2023, updated 2024) restrict exporting certain advanced AI chips, related items, and some software/technology, and expand foreign‑direct‑product rules—important for model training/inference supply chains.[5]

•Federal technical guidance you’ll see in contracts, audits, and RFPs:

•NIST AI Risk Management Framework and its Generative AI Profile (2024), plus NIST guidance on content provenance/watermarking for synthetic media. These are voluntary but increasingly referenced.[6]

United States (state and city)

•California: the CPPA’s finalized CCPA regulations on Automated Decisionmaking Technology (ADMT) took effect Jan 1, 2026. They create rights to access information about, and to opt out of, certain ADMT uses; “significant decision” use cases must meet added requirements and, if used before Jan 1, 2027, must be compliant by that date. Annual cybersecurity audits and privacy risk assessments are required for specified businesses.[7]

•Colorado: the 2024 “AI Act” (SB 24‑205) was delayed, then replaced in 2026 by SB 26‑189 (effective Jan 1, 2027), which re‑enacts duties for developers/deployers of “automated decision‑making technology” (documentation to deployers, risk controls, AG enforcement) and shifts timelines. A 2026 “Chatbot Safety Act” adds disclosures and teen‑safety duties for conversational AI starting Jan 1, 2027; AG rulemaking is underway.[8]

•New York City: Local Law 144 (effective July 5, 2023) requires bias audits and notices for “automated employment decision tools” used in NYC hiring/promotion. Enforcement continues; DCWP has rules on audit content and public postings.[9]

•Other state privacy laws (e.g., Colorado Privacy Act rules) already regulate “profiling” and automated decisions in some contexts.[10]

European Union

•AI Act (Regulation (EU) 2024/1689): entered into force Aug 1, 2024 with phased obligations.

•General‑purpose AI (GPAI) model duties (e.g., copyright policy, training‑data summary; extra duties for “systemic‑risk” models) apply from Aug 2, 2025; the Commission’s AI Office oversees GPAI. Commission enforcement powers for GPAI begin Aug 2, 2026.[11]

•Transparency obligations (labeling AI‑generated content, deepfakes; disclosures for chatbots and emotion/biometric categorization) apply from Aug 2, 2026, with guidance and a voluntary code of practice to help compliance.[12]

•High‑risk AI system obligations begin later: Annex III high‑risk use cases apply from Dec 2, 2027; embedded high‑risk AI in regulated products apply from Aug 2, 2028.[13]

•GDPR still governs personal‑data uses, including rules on solely automated decisions with legal/similar effects (Article 22).[14]

•Revised Product Liability Directive (EU) 2024/2853: expands strict liability to software/AI and updates evidence rules; Member States must transpose by late 2026.[15]

United Kingdom

•No comprehensive AI statute yet; the government uses a “pro‑innovation” approach, asking sector regulators to apply cross‑cutting principles. The UK AI Safety Institute publishes model‑evaluation methods; the (new) government has signaled interest in binding rules for the most powerful models.[16]

China

•Binding national rules already cover algorithmic recommendation services (since Mar 1, 2022), “deep synthesis”/deepfakes (since Jan 10, 2023), and public‑facing generative‑AI services (since Aug 15, 2023). They impose filing/recordal, labeling, security, and content‑management duties on providers.[17]

Multilateral and soft law

•Council of Europe Framework Convention on AI, Human Rights, Democracy and Rule of Law: first binding international AI treaty; opened for signature Sep 5, 2024 (enters into force for ratifying states).[18]

•OECD AI Principles (updated May 2024): nonbinding but widely adopted baseline for “trustworthy AI”; many governments/regulators reference them.[19]

•UN General Assembly AI resolutions: in Mar 2024 (A/RES/78/265) member states endorsed “safe, secure, and trustworthy AI” for sustainable development; a 2025 resolution created an expert panel process. These are not binding but guide national agendas.[20]

Common standards buyers and regulators expect

•ISO/IEC 42001:2023 (AI management systems—certifiable governance standard) and ISO/IEC 23894:2023 (AI risk management guidance) are increasingly used in procurement and conformity programs (and map cleanly to the NIST AI RMF).[21]

What this means in practice (as of October 11, 2026)

•If you build or deploy in the U.S.:

•Expect FTC/CFPB/EEOC enforcement using existing laws. Don’t make unsubstantiated AI claims; avoid deceptive “steering”; keep robust disclosures and adverse‑action reasons where required.[2]

•Check state/local triggers: NYC (bias audits before use in hiring), California ADMT rights (in force now; significant‑decision uses must be compliant by Jan 1, 2027), Colorado ADMT/Chatbot Safety Act duties from Jan 1, 2027.[9]

•If your training/inference stack depends on advanced chips, ensure BIS compliance.[5]

•If you place models/systems on the EU market:

•GPAI providers must meet transparency/copyright/training‑data‑summary duties now (since Aug 2, 2025), with enforcement powers from Aug 2, 2026; label AI‑generated content and deepfakes from Aug 2, 2026; prepare for high‑risk obligations starting Dec 2, 2027.[22]

•Software/AI is within EU strict product liability from Dec 2024 once Member States transpose (by late 2026).[15]

•Everywhere:

•Have an AI governance/risk‑management program (NIST AI RMF, ISO/IEC 42001/23894), track data provenance, document evaluations, and prepare plain‑language user disclosures where your system can meaningfully affect rights or access to services. These steps align with multiple regimes and reduce audit friction.[6]

If you want, tell me where you operate and the types of AI you use (e.g., hiring screening, lending, chatbots, medical, EU availability). I can translate this map into a short, system‑specific compliance checklist and deadline calendar.

Citations (22)

1govinfo.govGovernment
90 FR 8741 - Removing Barriers to American Leadership in Artificial Intelligence - Content Details - 2025-02172
Backs: “These govern federal agency use, not the whole private sector, but they shape procurement and expectations.”
2ftc.govGovernment
New Impersonator Rule gives FTC a powerful tool for protecting consumers and businesses | Federal Trade Commission
Backs: “In 2025 it also proposed a policy statement warning that “steering” outputs away from users’ stated objectives could be deceptive.”
3consumerfinance.govGovernment
Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms | Consumer Financial Protection Bureau
Backs: “CFPB: lenders using complex/ML models must still give specific reasons for adverse credit actions under ECOA/Reg B; using a “black box” doesn’t excuse this.”
4eeoc.govGovernment
EEOC History: 2020 - 2024 | U.S. Equal Employment Opportunity Commission
Backs: “EEOC/DOJ: remind employers that Title VII and disability laws apply when using AI in hiring; disparate impact rules still apply.”
5govinfo.govGovernment
88 FR 73424 - Export Controls on Semiconductor Manufacturing Items - Content Details - 2023-23049
Backs: “BIS rules (2023, updated 2024) restrict exporting certain advanced AI chips, related items, and some software/technology, and expand foreign‑direct‑product rules—important for model training/inference supply chains.”
6nist.govGovernment
AI Risk Management Framework | NIST
Backs: “NIST AI Risk Management Framework and its Generative AI Profile (2024), plus NIST guidance on content provenance/watermarking for synthetic media. These are voluntary but increasingly referenced.”
7ca.govGovernment
CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology (ADMT), and Insurance Regulations - California Privacy Protection Agency (CPPA)
Backs: “Annual cybersecurity audits and privacy risk assessments are required for specified businesses.”
8colorado.govGovernment
SB26-189 Automated Decision-Making Technology | Colorado General Assembly
Backs: “A 2026 “Chatbot Safety Act” adds disclosures and teen‑safety duties for conversational AI starting Jan 1, 2027; AG rulemaking is underway.”
9nyc.govGovernment
Automated Employment Decision Tools (AEDT) - DCWP
Backs: “Enforcement continues; DCWP has rules on audit content and public postings.”
10coag.govGovernment
Attorney General’s Office files finalized Colorado Privacy Act rules - Colorado Attorney General | Colorado Attorney General
Backs: “Other state privacy laws (e.g., Colorado Privacy Act rules) already regulate “profiling” and automated decisions in some contexts.”
11europa.euGovernment
Regulation - EU - 2024/1689 - EN - EUR-Lex
Backs: “General‑purpose AI (GPAI) model duties (e.g., copyright policy, training‑data summary; extra duties for “systemic‑risk” models) apply from Aug 2, 2025; the Commission’s AI Office oversees GPAI. Commission enforcement powers for GPAI begin Aug 2, 2026.”
12europa.euGovernment
AI Act | Shaping Europe’s digital future
Backs: “Transparency obligations (labeling AI‑generated content, deepfakes; disclosures for chatbots and emotion/biometric categorization) apply from Aug 2, 2026, with guidance and a voluntary code of practice to help compliance.”
13europa.euGovernment
Frequently Asked Questions | AI Act Service Desk
Backs: “Annex III high‑risk use cases apply from Dec 2, 2027; embedded high‑risk AI in regulated products apply from Aug 2, 2028.”
14europa.euGovernment
Regulation - 2016/679 - DE - gdpr - EUR-Lex
Backs: “GDPR still governs personal‑data uses, including rules on solely automated decisions with legal/similar effects (Article 22).”
15europa.euGovernment
Directive - 2024/2853 - EN - Product Liability Directive - EUR-Lex
Backs: “Revised Product Liability Directive (EU) 2024/2853: expands strict liability to software/AI and updates evidence rules; Member States must transpose by late 2026.”
16gov.ukGovernment
A pro-innovation approach to AI regulation: government response - GOV.UK
Backs: “The UK AI Safety Institute publishes model‑evaluation methods; the (new) government has signaled interest in binding rules for the most powerful models.”
17stanford.eduAcademic
Translation: Internet Information Service Algorithmic Recommendation Management Provisions – Effective March 1, 2022
Backs: “They impose filing/recordal, labeling, security, and content‑management duties on providers.”
18coe.intGovernment
The Framework Convention on Artificial Intelligence - Artificial Intelligence
Backs: “Council of Europe Framework Convention on AI, Human Rights, Democracy and Rule of Law: first binding international AI treaty; opened for signature Sep 5, 2024 (enters into force for ratifying states).”
19oecd.orgGovernment
OECD updates AI Principles to stay abreast of rapid technological developments | OECD
Backs: “OECD AI Principles (updated May 2024): nonbinding but widely adopted baseline for “trustworthy AI”; many governments/regulators reference them.”
20un.orgGovernment
Seizing the opportunities of safe, secure and trustworthy artificial intelligence systems for sustainable development :
Backs: “UN General Assembly AI resolutions: in Mar 2024 (A/RES/78/265) member states endorsed “safe, secure, and trustworthy AI” for sustainable development; a 2025 resolution created an expert panel process. These are not binding but guide national agendas.”
21iso.orgNonprofits and think tanks
ISO/IEC 42001:2023 - AI management systems
Backs: “ISO/IEC 42001:2023 (AI management systems—certifiable governance standard) and ISO/IEC 23894:2023 (AI risk management guidance) are increasingly used in procurement and conformity programs (and map cleanly to the NIST AI RMF).”
22europa.euGovernment
General-purpose AI obligations under the AI Act | Shaping Europe’s digital future
Backs: “GPAI providers must meet transparency/copyright/training‑data‑summary duties now (since Aug 2, 2025), with enforcement powers from Aug 2, 2026; label AI‑generated content and deepfakes from Aug 2, 2026; prepare for high‑risk obligations starting Dec 2, 2027.”