There is no single global set of binding rules for AI systems like large language models (LLMs) or general-purpose AI (GPAI). Instead, a fragmented landscape of international principles (mostly soft law), regional/national regulations, voluntary frameworks, and existing laws (e.g., data protection, liability, consumer protection) applies. These govern aspects of building (development, training, risk assessment), deployment (use cases, transparency, oversight), and accountability (audits, reporting, liability, penalties). Rules are evolving rapidly, with a risk-based emphasis on high-impact or high-capability systems. Information is current as of late 2026 based on available sources.[1]
International Principles and Frameworks (Mostly Non-Binding or Soft Law)
These influence national laws and company practices but generally lack direct enforcement or sanctions:
•OECD AI Principles (adopted 2019, updated 2024): Widely endorsed (including by G20). Core principles for AI actors include: inclusive growth/sustainable development/well-being; respect for human rights, rule of law, democracy, fairness, and privacy; transparency and explainability; robustness, security, and safety; and accountability. Governments are recommended to invest in R&D, foster ecosystems, build capacity, and cooperate internationally. Not legally binding but foundational (e.g., influenced the EU AI Act’s AI definition).[2] •UNESCO Recommendation on the Ethics of Artificial Intelligence (2021): Adopted by all ~194 member states. Core values: human dignity/rights; just/peaceful societies; diversity/inclusiveness; environmental flourishing. Principles include proportionality/do no harm, safety/security, fairness/non-discrimination, sustainability, privacy, human oversight, transparency/explainability, responsibility/accountability, awareness/literacy, and multi-stakeholder approaches. Guides national policies and readiness assessments; emphasizes human rights and equity (including Global South perspectives). Non-binding.[3] •Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (opened for signature September 2024): The first international legally binding treaty on AI. Aims for consistency with human rights, democracy, and rule of law across the AI lifecycle (technology-neutral). Covers transparency, documentation, risk management, oversight, and a risk-based approach. Signed by many (including EU, US, UK, Canada, Japan, and others); EU has advanced toward ratification (~2026). Not yet fully in force (requires sufficient ratifications, including from Council of Europe members). Complements instruments like the EU AI Act.[4] •Others: G7 Hiroshima AI Process (voluntary codes/reporting for advanced AI); UN initiatives (e.g., Global Digital Compact, dialogues); ISO/IEC standards (e.g., AI management systems like ISO 42001); various declarations (Bletchley, etc.). China has promoted global initiatives and a World AI Cooperation Organization (WAICO).
These promote trustworthy AI but leave detailed implementation to jurisdictions or voluntary adoption.
European Union: The AI Act (Most Comprehensive Binding Framework)
The EU Artificial Intelligence Act (Regulation (EU) 2024/1689) is the world’s first comprehensive horizontal AI law. It entered into force on 1 August 2024 and applies progressively (with adjustments via a 2026 “AI Omnibus”/Digital Omnibus for simplification and timelines). It uses a risk-based approach and applies extraterritorially to systems placed on the EU market or affecting people in the EU. It distinguishes providers (builders/developers) and deployers (users).[5][5]
•Unacceptable risk (prohibited practices): Banned since ~February 2025 (e.g., social scoring by public authorities, harmful manipulation/exploitation of vulnerabilities, untargeted facial recognition scraping, certain real-time remote biometric ID in public spaces for law enforcement, emotion recognition in workplaces/education, biometric categorisation for protected characteristics, and certain AI-generated non-consensual intimate/CSAM content).
•High-risk AI: Strict obligations (risk management, high-quality data, logging/traceability, documentation, transparency to deployers, human oversight, accuracy/robustness/cybersecurity, conformity assessments, registration, post-market monitoring, incident reporting). Applies to uses like critical infrastructure safety components, education/employment decisions, essential services (e.g., credit), law enforcement, migration/border, justice, biometrics. Timeline deferred: standalone Annex III systems from ~2 December 2027; embedded in regulated products (Annex I) from ~2 August 2028.
•Limited/transparency risk: Disclose AI interactions (e.g., chatbots must inform users they are AI unless obvious); mark AI-generated content (machine-readable + visible labels for deepfakes/public interest text). Article 50 transparency duties active since ~2 August 2026 (with grace periods for some existing systems).
•Minimal/no risk: Most systems (e.g., spam filters, games); voluntary codes encouraged.
•General-Purpose AI (GPAI)/foundation models: Baseline obligations (transparency, copyright compliance, documentation) since ~August 2025; additional systemic risk assessments/mitigations for high-capability models. EU AI Office oversees/enforces (can request docs, evaluate, require corrections, fine).
•Accountability/penalties: Fines up to €35 million or 7% of global annual turnover (prohibited practices); lower tiers (e.g., ~3% or €15M) for other breaches. Governance via AI Office, national authorities, AI Board, scientific panel. Supports sandboxes for innovation. Complements GDPR, product liability, etc.
•Building: Risk assessments, data quality, testing, documentation. Deployment: Oversight, monitoring. Accountability: Reporting, audits, liability exposure.
Related: National laws (e.g., Italy overlays); proposed liability directives.
United States: Patchwork of Federal Guidance, State Laws, and Existing Statutes
No comprehensive federal AI statute exists as of late 2026. Policy emphasizes innovation and US leadership, with voluntary tools and sector-specific or state rules. Existing laws (FTC Act for unfair/deceptive practices, anti-discrimination, product liability, copyright, sector regulators like FDA/SEC) apply.[6][1]
•Federal: Executive Orders (e.g., 2025 EO 14179 “Removing Barriers to American Leadership in AI” and follow-ons prioritizing innovation, reviewing prior rules; AI Action Plan; later EOs on infrastructure, security evaluations for advanced models, voluntary accords). NIST AI Risk Management Framework (AI RMF: Govern-Map-Measure-Manage functions for trustworthy AI—voluntary but influential and sometimes referenced for defenses). OMB guidance for federal agency AI use/procurement. TAKE IT DOWN Act (effective ~2026) requires platforms to remove non-consensual intimate imagery (including AI deepfakes). Push for federal preemption of conflicting state laws via EOs/task forces and legislative proposals (minimally burdensome national standard). No new dedicated federal AI regulator preferred; use existing ones. Voluntary industry commitments (safety policies, audits, evaluations).
•State laws (growing patchwork; several effective 2026):
•California: SB 53 (Transparency in Frontier AI Act—safety frameworks, catastrophic risk assessments, incident reporting, transparency for large frontier models above compute/revenue thresholds, effective Jan 2026); AI Transparency Act/SB 942 (provenance/disclosure for GenAI systems, effective ~Aug 2026); AB 2013 (training data transparency); others on chatbots, automated decisions, employment.
•Texas TRAIGA (Responsible AI Governance Act, effective Jan 2026—focus on government + some private prohibitions/safeguards; NIST RMF as potential defense).
•Illinois (employment AI decisions); Colorado (automated decision-making technology/ADMT for consequential decisions—risk assessments, transparency; effective ~2027, with litigation); New York RAISE Act (frontier model safety/transparency/incident reporting, ~2027); others on deepfakes, bias audits, etc.
•Building/deployment: Safety protocols for frontier models, disclosures, bias mitigation in high-stakes uses (hiring, etc.). Accountability: State AG enforcement, private rights in some cases, civil/criminal liability for foreseeable harms, incident reporting, audits. Federal efforts aim to reduce fragmentation.
China: Sectoral and Content-Focused Binding Rules
China regulates via administrative measures (led by Cyberspace Administration of China/CAC and others) rather than one omnibus statute, emphasizing security, content control, ideology alignment, and orderly development. Applies to services offered in China.[7]
•Generative AI Interim Measures (2023, ongoing): Providers must ensure content aligns with laws/socialist values, conduct security assessments, protect data/privacy, label outputs, prevent discrimination/misinformation; filings for certain large models; human annotation standards.
•AI-Generated Synthetic Content Labeling Measures (effective ~1 September 2025): Mandatory explicit (user-perceivable: text/audio/visual markers) and implicit (machine-readable metadata/watermarks) labels for text, images, audio, video, virtual scenes. Technical standards (e.g., GB 45438-2025) specify details (placement, content, anti-tampering). Obligations across providers, platforms, users; enforcement via campaigns removing non-compliant content/accounts.
•Other: Algorithm recommendation provisions, deep synthesis rules (biometric consent, labeling), national AI ethics guidelines, industry promotion rules, cybersecurity laws.
•Building: Security assessments, data controls, filings. Deployment: Content filtering/labeling. Accountability: Administrative penalties, platform liability, campaigns.
Other Notable Jurisdictions
•South Korea: AI Basic Act (in force ~January 2026)—transparency, risk assessment, human oversight, documentation (extraterritorial elements for affecting Korean users); high-impact systems focus.
•UK: No horizontal statute; principles-based/regulator-led (existing sector regulators apply AI principles on safety, transparency, fairness, accountability, contestability). Innovation-friendly, with sandboxes and voluntary guidance.
•Japan: AI Promotion Act (in force, lighter-touch/no heavy penalties); guidelines for operators.
•Others (e.g., Canada, Brazil, Australia, India): Strategies, bills, or sectoral rules (privacy, automated decisions); many reference OECD/UNESCO.
Cross-Cutting Accountability Mechanisms
•Transparency/disclosure: User notices for AI interactions; content labeling/provenance (EU Art. 50, China measures, CA laws, voluntary C2PA).
•Risk management/testing: Assessments, audits (third-party for frontier), robustness/safety evaluations (NIST, EU high-risk/GPAI, CA SB 53).
•Human oversight and documentation: Required for high-risk; logging, technical docs.
•Incident reporting and monitoring: Post-market, serious incidents.
•Liability: Civil/criminal under existing laws (product, tort, consumer protection) for foreseeable harms; some specific (fines, private rights); developers often remain liable.
•Enforcement: Regulators (EU AI Office/national, US FTC/state AGs, China CAC), fines, bans, corrective actions. Whistleblower protections in some laws.
•Existing laws apply broadly: GDPR/CCPA-style privacy (data used in training/deployment), IP/copyright (training data debates/settlements ongoing), anti-discrimination, cybersecurity, export controls (for advanced tech).
For systems like me (GPAI/LLMs/chatbots): Key obligations often include disclosing AI nature, labeling generated content where required, safety evaluations for capable models, content safeguards, and compliance with data/privacy rules. Builders face documentation and risk duties for high-capability systems; deployers handle use-case oversight. Voluntary industry practices (red-teaming, evals, policies) and standards fill gaps.
This landscape is dynamic—timelines shift (e.g., EU high-risk delays), litigation occurs (e.g., US state challenges), and new bills emerge. Companies often adopt the strictest applicable rules (e.g., EU for global products) plus voluntary best practices. For specifics, consult primary texts, lawyers, or trackers (e.g., AI Policy Tracker), as this is a high-level overview, not legal advice. International cooperation continues via OECD, UN, G7, Council of Europe, and bilateral efforts, but binding global rules remain limited.