What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Rules governing the building, deployment, and accountability of AI systems (such as large language models and general-purpose AI) form a fragmented, evolving global landscape. Binding comprehensive laws are limited (most notably the EU AI Act), while the US relies on voluntary frameworks, executive actions, sector-specific rules, and a growing patchwork of state laws. China emphasizes content controls and labeling for generative AI. International soft-law principles provide widely referenced guidance. Existing laws on privacy, discrimination, product liability, and consumer protection often apply to AI as well.[1]

European Union: The EU AI Act (Regulation 2024/1689)

This is the world’s first comprehensive, binding horizontal AI law. It entered into force on 1 August 2024 and uses a risk-based approach with phased application (prohibitions from early 2025; general-purpose AI/GPAI rules from August 2025; transparency obligations from around August 2026; high-risk obligations largely from late 2026/2027, with some adjustments via later Omnibus amendments). It applies extraterritorially to providers/deployers placing systems on the EU market or whose outputs are used there.[1]

Risk categories and key rules:

•Unacceptable risk (prohibited): Includes harmful manipulation/deception, exploitation of vulnerabilities, social scoring, certain predictive policing, untargeted facial recognition scraping, emotion recognition in workplaces/education (in many cases), biometric categorisation for sensitive traits, most real-time remote biometric ID in public spaces for law enforcement, and (later) certain non-consensual intimate/CSAM generation.[1]

•High-risk: Systems in critical areas (e.g., biometrics, critical infrastructure safety components, education/employment decisions, essential services like credit scoring, law enforcement, migration, justice). Providers must implement risk management systems, ensure high-quality/representative training data (to minimize bias), maintain technical documentation and logs for traceability, provide transparency to deployers, enable human oversight, and meet accuracy/robustness/cybersecurity standards. Conformity assessments, CE marking, and EU database registration apply. Deployers must follow instructions, ensure competent human oversight, monitor performance, retain logs, and (in some cases) conduct fundamental rights impact assessments.[1]

•Transparency obligations: For systems interacting with people (e.g., chatbots—disclose AI interaction), generative AI (mark synthetic content, including deepfakes, in machine-readable ways where relevant), emotion recognition, and biometric categorisation.

•General-purpose AI (GPAI) models (relevant to systems like LLMs): Providers must prepare technical documentation, comply with copyright (including training data policies and summaries of training content), and meet transparency rules. Models with “systemic risk” (e.g., very large compute thresholds like >10^25 FLOPs) face additional risk evaluation/mitigation, incident reporting, and cybersecurity duties.[2]

Accountability and enforcement: Market surveillance by national authorities and the EU AI Office (especially for GPAI). Serious incident reporting, post-market monitoring, and fines up to €35 million or 7% of global annual turnover (higher tiers for prohibited practices). Codes of practice, standards, sandboxes, and guidance support compliance. Obligations distribute across the value chain (providers, deployers, importers, distributors).[3]

United States

There is no single comprehensive federal AI statute equivalent to the EU AI Act. Regulation is a mix of voluntary standards, executive actions (which can change with administrations), existing laws, proposed bills, and state laws creating a patchwork.[4])

•NIST AI Risk Management Framework (AI RMF 1.0, 2023, with Generative AI Profile): Voluntary, widely influential guidance for organizations designing, developing, deploying, or using AI. Core functions: Govern (culture, accountability, policies), Map (context, risks, impacts), Measure (testing, metrics), Manage (prioritize and respond to risks). It emphasizes trustworthiness characteristics (valid/reliable, safe, secure/resilient, accountable/transparent, explainable/interpretable, privacy-enhanced, fair with bias managed). Playbooks, profiles, and crosswalks support implementation. It aligns with other frameworks and is referenced in federal guidance.[5]

•Executive actions: Biden’s EO 14110 (2023) on safe/secure/trustworthy AI (reporting for dual-use foundation models, red-teaming, standards work, etc.) was rescinded in January 2025. Subsequent Trump administration orders emphasize removing barriers to innovation and US leadership, voluntary frameworks for frontier model cybersecurity/pre-release evaluation (e.g., with NIST/CISA/NSA involvement), national policy frameworks aiming to address conflicting state laws, critical infrastructure protection, and secure development—while stressing no mandatory licensing/pre-clearance for models. NIST continues related standards and evaluation work.[6]

•Other federal elements: NTIA AI Accountability Policy Report (2024) recommends transparency, independent audits/evaluations for high-risk systems, registries of high-risk deployments/incidents, and consequences (liability/regulation). Sectoral agencies apply existing authorities (e.g., FTC on unfair/deceptive practices, EEOC/DOJ on discrimination, FDA for medical AI). Proposed bills have addressed governance, transparency for high-impact systems, and federal agency use, but comprehensive legislation remains limited. Government contractors/grantees often face AI governance requirements.[7]

•State laws: Growing and varied. Examples include California measures on AI transparency (content disclosure for large providers), generative AI accountability in government, deepfakes/elections, and frontier model safety/transparency/incident reporting (e.g., SB 53 elements); Colorado’s AI Act (high-risk systems influencing consequential decisions like housing/employment/credit—impact assessments, notifications, anti-discrimination duties, effective ~2026); and laws in other states on deepfakes, biometric data, elections, and automated decision-making. This creates compliance complexity, with federal efforts sometimes seeking to promote national consistency.[8]

Accountability: Often via existing civil liability (torts, product liability), consumer protection, civil rights enforcement, contractual requirements, and voluntary audits/red-teaming. Transparency reports and human oversight appear in various proposals and state rules.

China

No single comprehensive AI law exists. Key binding measures for generative AI include:

•Interim Measures for the Management of Generative AI Services (2023): Apply to public-facing services. Requirements cover lawful training data, content security/alignment with socialist values/core ethics, prevention of discrimination, IP protection, user protections/consent for personal data, transparency, cybersecurity, and security assessments/filings (especially for services with public opinion or social mobilization attributes). Research/internal use is largely exempt.[9]

•Labeling measures and standards (2025): Explicit (visible) and implicit (metadata) labeling of AI-generated/synthetic content (text, images, audio, video); restrictions on unlabeled dissemination.[10]

Related rules cover deep synthesis, algorithmic recommendations, and sector guidelines. Emphasis is on safety, controllability, reliability, and preventing risks while promoting development (“AI Plus” initiatives). Accountability includes provider responsibility, assessments, and potential enforcement by the Cyberspace Administration of China (CAC) and others.[11]

International Soft Law and Principles

These are non-binding but highly influential in shaping national laws, corporate policies, and standards:

•OECD AI Principles (2019, updated 2024): Inclusive growth/sustainable development/well-being; human-centered values and fairness; transparency and explainability; robustness, security, and safety; accountability. Recommendations for national policies. The OECD AI system definition has influenced the EU AI Act and others.[12]

•UNESCO Recommendation on the Ethics of Artificial Intelligence (2021): Adopted by 193 member states. Core values (human rights/dignity, environment, diversity/inclusiveness, living in peace/justice) and principles (proportionality/do no harm, safety/security, fairness/non-discrimination, sustainability, privacy, human oversight, transparency/explainability, responsibility/accountability, awareness/literacy, multi-stakeholder approaches). Includes policy action areas (e.g., data governance, education, labor, health, impact assessments). Explicitly addresses issues like social scoring/mass surveillance.[13]

Other efforts include G7 Hiroshima AI Process, Council of Europe work, ISO/IEC standards (e.g., AI management systems), and various national strategies.

Broader Accountability, Building, and Deployment Considerations

•Building: Data quality/governance, risk assessment from design, documentation, testing/evaluation (including red-teaming for advanced models), bias mitigation, security-by-design, and (in regulated contexts) conformity or impact assessments.

•Deployment: Human oversight (especially high-risk), monitoring/logging, transparency/disclosures to users, adherence to intended use/instructions, and incident reporting.

•Accountability: Chain of documentation → independent evaluation/audits → consequences (fines, liability, corrective actions, market restrictions). Corporate governance, whistleblower protections (in some laws), and supply-chain responsibilities matter. For frontier/GPAI systems, additional systemic risk focus appears in the EU and voluntary US efforts.

•Cross-cutting: Privacy laws (GDPR, CCPA, etc.), intellectual property (training data copyright debates), content moderation/deepfake rules, election integrity, and critical infrastructure protections apply. Industry self-regulation, voluntary commitments, and insurance/liability markets also play roles.

This landscape is dynamic—timelines phase in, amendments occur (e.g., EU Omnibus), new state laws emerge, executive priorities shift, and international coordination continues. Systems like advanced LLMs face particular scrutiny under GPAI/systemic risk and transparency rules where applicable. Organizations typically map obligations by jurisdiction, risk level, and role (provider vs. deployer), often using frameworks like NIST AI RMF as a baseline even where not mandated. For the absolute latest details on any specific rule, consult official legal texts or counsel, as implementation guidance and enforcement evolve.

4.https://ca.practicallaw.thomsonreuters.com/w-042-1089?transitionType=Default&contextData=(sc.Default) — https://ca.practicallaw.thomsonreuters.com/w-042-1089?transitionType=Default&contextData=(sc.Default)

Citations (13)

1europa.euGovernment
https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
Backs: “Existing laws on privacy, discrimination, product liability, and consumer protection often apply to AI as well.”
2lexology.comCommercial content
https://www.lexology.com/library/detail.aspx?g=f7bdfe0a-e1c6-4bbf-a864-e88638c59cd1
Backs: “Models with “systemic risk” (e.g., very large compute thresholds like >10^25 FLOPs) face additional risk evaluation/mitigation, incident reporting, and cybersecurity duties.”
3aigl.blogBlogs and newsletters
https://www.aigl.blog/european-union-artificial-intelligence-act-a-guide/
Backs: “Obligations distribute across the value chain (providers, deployers, importers, distributors).”
4thomsonreuters.comNot yet classified
https://ca.practicallaw.thomsonreuters.com/w-042-1089?transitionType=Default&contextData=(sc.Default)
Backs: “Regulation is a mix of voluntary standards, executive actions (which can change with administrations), existing laws, proposed bills, and state laws creating a patchwork.”
5nist.govGovernment
https://www.nist.gov/itl/ai-risk-management-framework
Backs: “It aligns with other frameworks and is referenced in federal guidance.”
6whitehouse.govGovernment
https://www.whitehouse.gov/presidential-actions/2025/01/removing-barriers-to-american-leadership-in-artificial-intelligence/?query-11-page=21
Backs: “Subsequent Trump administration orders emphasize removing barriers to innovation and US leadership, voluntary frameworks for frontier model cybersecurity/pre-release evaluation (e.g., with NIST/CISA/NSA involvement), national policy frameworks aiming to address conflicting state laws, critical infrastructure…”
7ntia.govGovernment
https://www.ntia.gov/other-publication/2024/fact-sheet-ntia-urges-policy-changes-boost-accountability-and
Backs: “Government contractors/grantees often face AI governance requirements.”
8whitecase.comCompanies
https://www.whitecase.com/insight-alert/raft-california-ai-legislation-adds-growing-patchwork-us-regulation
Backs: “This creates compliance complexity, with federal efforts sometimes seeking to promote national consistency.”
9casrai.orgNonprofits and think tanks
https://casrai.org/guides/china-ai-regulation-explained
Backs: “Requirements cover lawful training data, content security/alignment with socialist values/core ethics, prevention of discrimination, IP protection, user protections/consent for personal data, transparency, cybersecurity, and security assessments/filings (especially for services with public opinion or social…”
10dlapiper.comCompanies
https://intelligence.dlapiper.com/artificial-intelligence?c=CN
Backs: “Explicit (visible) and implicit (metadata) labeling of AI-generated/synthetic content (text, images, audio, video); restrictions on unlabeled dissemination.”
11reuters.comNews and mediaquality 1.00
https://www.reuters.com/world/asia-pacific/china-issues-guidelines-new-productive-forces-including-ai-2026-10-09/
Backs: “Accountability includes provider responsibility, assessments, and potential enforcement by the Cyberspace Administration of China (CAC) and others.”
12oecd.aiGovernment
https://oecd.ai/en/dashboards/policy-initiatives/oecd-ai-principles-9705
Backs: “The OECD AI system definition has influenced the EU AI Act and others.”
13aigovernance.comLow provenance
https://aigovernance.com/policy/unesco-recommendation-ai-ethics
Backs: “Explicitly addresses issues like social scoring/mass surveillance.”