What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Short answer: It depends where you are and what you’re doing with AI. Today’s rules are a mix of binding laws, regulator guidance, procurement policies, export controls, and voluntary standards. Here’s the practical, current landscape (as of October 12, 2026), with the items most likely to affect builders and deployers of systems like me.

United States (federal)

•Executive branch policy for agencies: In 2025 the administration rescinded EO 14110 (Oct 30, 2023) and replaced it with a deregulatory framework and updated OMB policy. OMB Memorandum M‑25‑21 (Feb 2025) now governs how federal agencies acquire and use AI, superseding OMB M‑24‑10 (Mar 2024). Expect fewer centralized restrictions, more agency discretion, and emphasis on accelerating government use and procurement.[1]

•NIST guidance and testing: The NIST AI Risk Management Framework (AI RMF 1.0) and its Generative AI Profile are the government’s main, voluntary benchmarks for trustworthy AI; NIST hosts the U.S. AI Safety Institute and an evaluations ecosystem used by industry and agencies. These are not laws but are frequently referenced in contracts and safe‑harbor schemes.[2]

•Consumer protection and civil-rights enforcement: Sectoral laws still apply to AI use. Key examples: the EEOC’s Title VII guidance makes clear that employers are responsible if their hiring tools cause unlawful disparate impact; CFPB rules still require specific reasons in adverse‑action notices when AI is used for credit decisions. Note: in 2026 the CFPB amended Regulation B to state ECOA does not recognize disparate‑impact liability, a notable shift in federal fair‑lending risk. The FTC continues to use Section 5 (UDAP) and its new impersonation rule against deceptive AI uses (e.g., voice cloning).[3]

•Export controls that affect AI model training and chips: BIS maintains and updates restrictions on exporting advanced computing chips, tools, and certain AI‑related technology to China and some other destinations. These rules affect where and how frontier models can be trained and deployed.[4]

United States (state and local)

•Colorado AI Act (SB 24‑205, amended): A comprehensive, risk‑based law for “high‑risk” AI used in consequential decisions (e.g., employment, credit, housing). Duties for developers and deployers include risk management, impact assessments, notices, and incident reporting; enforcement by the AG. Initial effective date was delayed; key obligations begin June 30, 2026, with rulemaking continuing into 2027 (and additional 2026 session revisions).[5]

•New York City Local Law 144 (AEDTs): Since July 5, 2023, employers using automated employment decision tools in NYC must complete an annual independent bias audit, publish a summary, and give notices to candidates and employees. This is actively enforced citywide.[6]

•California transparency and “frontier” model rules:

•SB 53 (Transparency in Frontier AI Act): effective January 1, 2026; large frontier developers must publish a “frontier AI framework” and transparency reports, with whistleblower reporting to the AG.[7]

•AB 2013 (Training Data Transparency Act): chaptered Sept 28, 2024; requires developers of generative‑AI systems or services offered in CA to post documentation about data used for training.[8]

•The CA Department of Technology also imposes procurement/risk‑assessment requirements on state agencies for GenAI (based on NIST AI RMF). These are binding on state procurement and often shape vendor obligations.[9]

•Many state privacy laws (e.g., Virginia, Colorado, California) already regulate “profiling” and automated decision‑making through data‑protection assessments, opt‑outs, or disclosures. These are not AI‑only, but they bite whenever AI processes personal data for consequential outcomes.[10]

European Union

•The EU AI Act (Regulation (EU) 2024/1689): the world’s first comprehensive AI statute. It bans certain practices; imposes strict requirements on “high‑risk” systems (risk management, data governance, documentation, human oversight, robustness); and creates obligations for general‑purpose AI (GPAI), including transparency and, for models with “systemic risk,” additional governance. Timeline highlights: some provisions have applied since 2025; GPAI enforcement and AI Office powers from August 2, 2026; Annex III high‑risk rules from December 2, 2027 (stand‑alone) and August 2, 2028 (embedded).[11]

•Product liability modernization: The revised Product Liability Directive expressly covers software and AI systems, easing the path for victims to claim for damage caused by defective AI products; Member States are implementing it into national law. This sits alongside the AI Act’s ex‑ante obligations.[12]

United Kingdom

•No single AI act; the UK relies on a “pro‑innovation” principles‑based framework applied by existing regulators (ICO, CMA, MHRA, etc.). The UK AI Safety (now Security) Institute runs capability and safeguards testing of advanced models and publishes evaluation methodologies used by government and industry.[13]

China

•Binding, nationwide rules targeted at specific AI modalities and platforms:

•Algorithmic recommendation provisions (effective Mar 1, 2022) requiring algorithm filing, user controls, and content responsibilities.[14]

•Deep synthesis regulation (effective Jan 10, 2023) imposing provenance/labeling and security responsibilities on providers.[15]

•Interim Measures for Generative AI services (effective Aug 15, 2023) governing public‑facing gen‑AI providers, with further labeling rules effective Sept 1, 2025.[16]

International instruments and soft law

•OECD AI Principles (2019; updated 2024) are the most widely adopted government guidance for “trustworthy AI” and underpin many national policies and the G7’s work. UNESCO’s 2021 Recommendation on the Ethics of AI is a global normative reference for ethics and human‑rights safeguards. The UN General Assembly (Mar 21, 2024) adopted a consensus resolution urging “safe, secure and trustworthy” AI for sustainable development. These are soft‑law but increasingly shape hard‑law.[17]

•Council of Europe Framework Convention on AI (opened for signature Sept 5, 2024): the first binding international treaty focused on AI and human rights, democracy, and rule of law; open to non‑European signatories (including the U.S. signed at opening). It will bind parties once ratified domestically.[18]

Technical standards and industry practices that regulators reference

•ISO/IEC 42001 (AI management systems) and ISO/IEC 23894 (AI risk management) are becoming the default certifiable governance and risk‑management baselines companies use to demonstrate due care or to meet safe‑harbor language (e.g., Colorado recognizes “nationally or internationally recognized” AI risk frameworks).[19]

•Content authenticity and provenance: The C2PA specification (current versions 2.x) underpins “Content Credentials” adopted in cameras, creative tools, and platforms for provenance/watermark signaling; some laws and policies (EU AI Act transparency duties starting Aug 2, 2026) will push wider use.[20]

What this means in practice (United States focus)

•Building: There’s no single federal AI law. Use recognized frameworks (NIST AI RMF; ISO/IEC 42001/23894) and be mindful of export controls for compute and components. Frontier model developers operating in CA now face transparency duties (SB 53; AB 2013).[2]

•Deploying: If your system influences consequential decisions (hiring, lending, housing, healthcare), expect impact assessments, disclosures, and audit obligations under state/local rules (NYC LL 144 now; Colorado beginning June 30, 2026), plus existing civil‑rights, fair‑lending, disability, and consumer‑protection laws.[21]

•Accountability and redress: In the U.S. it’s largely after‑the‑fact enforcement (FTC, EEOC, CFPB, state AGs) and litigation under sectoral laws. In the EU it’s both ex‑ante (AI Act) and ex‑post (revised product liability). Global soft‑law (OECD/UNESCO/UNGA) sets expectations that regulators and courts may cite.[22]

If you tell me what jurisdiction(s), use case (e.g., hiring, healthcare, consumer chat, code generation), and whether you’re a model developer or an enterprise deployer, I can map the specific obligations and timelines you need to plan for.

Citations (22)

1whitehouse.govGovernment
Initial Rescissions Of Harmful Executive Orders And Actions – The White House
Backs: “Expect fewer centralized restrictions, more agency discretion, and emphasis on accelerating government use and procurement.”
2nist.govGovernment
Artificial Intelligence Risk Management Framework (AI RMF 1.0) | NIST
Backs: “These are not laws but are frequently referenced in contracts and safe‑harbor schemes.”
3eeoc.govGovernment
EEOC History: 2020 - 2024 | U.S. Equal Employment Opportunity Commission
Backs: “The FTC continues to use Section 5 (UDAP) and its new impersonation rule against deceptive AI uses (e.g., voice cloning).”
4doc.govGovernment
Advanced Computing and Semiconductor Manufacturing Items Controls to PRC
Backs: “These rules affect where and how frontier models can be trained and deployed.”
5colorado.govGovernment
SB24-205 Consumer Protections for Artificial Intelligence | Colorado General Assembly
Backs: “Initial effective date was delayed; key obligations begin June 30, 2026, with rulemaking continuing into 2027 (and additional 2026 session revisions).”
6nyc.govGovernment
Automated Employment Decision Tools: Frequently Asked Questions
Backs: “Since July 5, 2023, employers using automated employment decision tools in NYC must complete an annual independent bias audit, publish a summary, and give notices to candidates and employees. This is actively enforced citywide.”
7ca.govGovernment
Governor Newsom signs SB 53, advancing California’s world-leading artificial intelligence industry | Governor of California
Backs: “SB 53 (Transparency in Frontier AI Act): effective January 1, 2026; large frontier developers must publish a “frontier AI framework” and transparency reports, with whistleblower reporting to the AG.”
8legiscan.comData and tools
Bill Text: CA AB2013 | 2023-2024 | Regular Session | Amended | LegiScan
Backs: “AB 2013 (Training Data Transparency Act): chaptered Sept 28, 2024; requires developers of generative‑AI systems or services offered in CA to post documentation about data used for training.”
9ca.govGovernment
Technology Letter 25-01 - CDT
Backs: “These are binding on state procurement and often shape vendor obligations.”
10virginia.govGovernment
Code of Virginia (2025 Updates)
Backs: “These are not AI‑only, but they bite whenever AI processes personal data for consequential outcomes.”
11europa.euGovernment
AI Act | Shaping Europe’s digital future
Backs: “Annex III high‑risk rules from December 2, 2027 (stand‑alone) and August 2, 2028 (embedded).”
12europa.euGovernment
Directive (EU) 2024/2853 of the European Parliament and of the Council of 23 October 2024 on liability for defective products and repealing Council Directive 85/374/EEC (Text with EEA relevance)
Backs: “Member States are implementing it into national law. This sits alongside the AI Act’s ex‑ante obligations.”
13gov.ukGovernment
A pro-innovation approach to AI regulation - GOV.UK
Backs: “The UK AI Safety (now Security) Institute runs capability and safeguards testing of advanced models and publishes evaluation methodologies used by government and industry.”
14stanford.eduAcademic
Translation: Internet Information Service Algorithmic Recommendation Management Provisions – Effective March 1, 2022
Backs: “Algorithmic recommendation provisions (effective Mar 1, 2022) requiring algorithm filing, user controls, and content responsibilities.”
15cac.gov.cnGovernment
互联网信息服务深度合成管理规定_中央网络安全和信息化委员会办公室
Backs: “Deep synthesis regulation (effective Jan 10, 2023) imposing provenance/labeling and security responsibilities on providers.”
16dig.watchNot yet classified
Interim Measures for the Administration of Generative Artificial Intelligence Services | Digital Watch Observatory
Backs: “Interim Measures for Generative AI services (effective Aug 15, 2023) governing public‑facing gen‑AI providers, with further labeling rules effective Sept 1, 2025.”
17oecd.orgGovernment
OECD Legal Instruments
Backs: “The UN General Assembly (Mar 21, 2024) adopted a consensus resolution urging “safe, secure and trustworthy” AI for sustainable development. These are soft‑law but increasingly shape hard‑law.”
18coe.intGovernment
The Framework Convention on Artificial Intelligence - Artificial Intelligence
Backs: “Council of Europe Framework Convention on AI (opened for signature Sept 5, 2024): the first binding international treaty focused on AI and human rights, democracy, and rule of law; open to non‑European signatories (including the U.S. signed at opening). It will bind parties once ratified domestically.”
19iec.chNot yet classified
ISO/IEC 42001:2023 | IEC
Backs: “ISO/IEC 42001 (AI management systems) and ISO/IEC 23894 (AI risk management) are becoming the default certifiable governance and risk‑management baselines companies use to demonstrate due care or to meet safe‑harbor language (e.g., Colorado recognizes “nationally or internationally recognized” AI risk frameworks).”
20c2pa.orgNot yet classified
Content Credentials : C2PA Technical Specification :: C2PA Specifications
Backs: “The C2PA specification (current versions 2.x) underpins “Content Credentials” adopted in cameras, creative tools, and platforms for provenance/watermark signaling; some laws and policies (EU AI Act transparency duties starting Aug 2, 2026) will push wider use.”
21amlegal.comNot yet classified
Subchapter 25: Automated Employment Decision Tools
Backs: “Colorado beginning June 30, 2026), plus existing civil‑rights, fair‑lending, disability, and consumer‑protection laws.”
22ftc.govGovernment
Approaches to Address AI-enabled Voice Cloning | Federal Trade Commission
Backs: “Global soft‑law (OECD/UNESCO/UNGA) sets expectations that regulators and courts may cite.”