I'll map the current rules governing how AI systems are built, deployed, and held accountable.
There is no single global law governing AI systems like this one. As of 2026, governance is a layered patchwork of binding law, sectoral regulation, and voluntary frameworks that varies by jurisdiction and by where a system's output is used :
1. European Union - Comprehensive, risk-based statute
The European Union Artificial Intelligence Act ("EU AI Act") introduces the first comprehensive supranational regulatory framework governing artificial intelligence systems according to risk classification, lifecycle accountability, and operational governance obligations.
It entered into force 1 August 2024 and is phased in over 6 to 36 months:
•4 risk tiers: unacceptable (banned), high (strict), limited (transparency), minimal (none)
•Classifies AI by how much harm a system could cause. Banned uses sit at the top, heavy documentation and oversight apply to high risk, and minimal risk faces almost no mandatory rules
•Prohibited practices (e.g. social scoring, real-time biometric surveillance) are banned outright; prohibited practices became enforceable 2 Feb 2025
•High-risk systems (Annex III — employment, education, essential services, law enforcement, migration, justice) face strict conformity requirements before market placement - covering eight standalone use case categories: biometric identification, critical infrastructure, education, employment, essential services (credit, insurance), law enforcement, migration and border control, and administration of justice, including risk management, data governance, documentation, human oversight, transparency, logging
•General Purpose AI (GPAI) / foundation models (e.g. large language models): GPAI providers face transparency and documentation duties (and more for the largest models). Required: technical docs, training-data summary, copyright compliance; systemic-risk models add evaluations, adversarial testing, incident reporting, cybersecurity. GPAI providers in scope face obligations that took effect August 2, 2026: automatic event logging, technical documentation, adversarial testing records and incident reporting to the AI Office
•Transparency (Article 50): From 2 August 2026, mandatory transparency obligations requiring organisations to disclose AI interactions, mark AI-generated content, and inform users about emotion recognition and biometric categorisation systems. Every chatbot serving EU users must now tell the person it is talking with that the system is AI, deepfakes need machine-readable metadata. Providers must disclose AI interactions and mark AI-generated or manipulated content, while deployers must disclose deepfakes and emotion recognition use
Non-compliance fines: Prohibited AI practices: up to €35 million or 7% of global annual turnover. High-risk or GPAI noncompliance: up to €15 million or 3%.
Companies that breach major provisions could face fines of up to 3% of global turnover.
2. United States - No single federal AI law, sectoral patchwork
In the United States, there is no single nationwide AI law, so regulation comes from federal agencies, state laws, and voluntary standards.
•As of mid-2026, the United States has no comprehensive federal AI law. No comprehensive federal AI law exists in the US as of mid-2026
•Federal approach is a Sectoral Patchwork, State Legislation & AI LEAD Act with Executive Orders requiring safety testing, watermarking, and agency bias audits. Most significant federal initiative was Executive Order 14110 (October 2023), later January 2025 AI Executive Order emphasizes innovation and December 2025 EO 14365 establishing national AI policy framework.
•Agencies such as the FTC, SEC, and other regulators apply existing consumer protection, privacy, discrimination, and financial rules to AI uses.
•The FTC applies Section 5 of the FTC Act which makes unfair or deceptive business practices illegal to AI - if a company tells you its AI protects privacy but scrapes data for undisclosed purposes, the FTC can investigate. The FTC, CFPB, and state attorneys general have brought enforcement actions against AI-driven products that produced discriminatory outputs or violated privacy laws.
•FTC has warned that companies that fail to live up to privacy promises may violate laws and previous actions have required companies that improperly obtained consumer data to withdraw all products, including models and algorithms, developed with the improperly obtained data. FTC Chair has signaled developers who instruct AI agents could be held responsible for resulting harm and existing legal tools including FTC data-breach authority may apply.
•States are primary enforcers: regulation comes through state laws focused on high-risk AI, automated decision audits. Examples: California's AB 316 and AI Accountability Act mandating impact assessments, California and New York targeted AI transparency rules, Colorado AI Act. Several major state AI laws imposed new safety and accountability obligations beginning January 1, 2026.
•Preemption debate: Executive Order alone cannot override state law, Senate voted 99-1 in July 2025 to reject a proposed 10-year federal moratorium on state AI regulation, though a December 2025 federal blueprint attempts to ban state laws specifically regulating development of AI models for a three-year period while retaining authority over deployment.
Voluntary framework: The NIST AI Risk Management Framework (AI RMF 1.0) is voluntary and there is no certification. It is organized around four functions — Govern (cross-cutting accountability, policies, culture), Map (context, risks, impact), Measure (assessment), Manage (prioritization, response, monitoring). Govern establishes accountability, policies, risk appetite, decision rights, and oversight mechanisms. Organizations adopt it because it operationalizes risk-management obligations in the EU AI Act and ISO/IEC 42001, and increasingly appears as contractual requirement.
Other proposals under discussion: Algorithmic Accountability Act (mandate transparency in generative AI in critical decision-making) and NO FAKES Act of 2024 to protect against AI-enabled IP infringements.
3. United Kingdom - Principles-based, regulator-led
The UK does not currently have a single cross-sector AI Act equivalent to the EU AI Act. The UK's current approach is built around five broad principles: (1) safety, security, and robustness; (2) appropriate transparency and explainability; (3) fairness; (4) accountability and governance; and (5) contestability and redress. These principles are not set out in a standalone AI Act.
Instead of creating a new AI regulator, the UK empowers existing regulators (like the ICO for data protection, Ofcom for communications, and the FCA for financial services) to apply five core principles: safety, transparency, fairness, accountability, and contestability. The principles are explicitly voluntary and non-prescriptive for regulators, intended to guide sector-specific implementation.
The Online Safety Act 2023, while not designed specifically for AI, directly affects recommender systems and generative AI. Industry-specific laws such as Data Protection Act, Equality Act, and product liability also apply.
4. China - Layered, targeted binding rules
China has built a layered set of AI regulations targeting specific categories of system or risk rather than a single statute. Key measures:
•Generative AI Regulations (2023) govern GPAI services, covering content moderation, training data sourcing, and registration
•China's "Interim Measures for the Management of Generative Artificial Intelligence Services" (effective August 15, 2023) requires providers to register, label AI-generated content, ensure content aligns with "socialist core values," and conduct security assessments before commercial deployment
•Deep Synthesis Provisions (2022) specifically regulate deepfakes — requiring mandatory watermarking
•Algorithm Recommendation Regulations (March 2022)
•AI-content-labeling rules take effect September 1, 2025 - labelling measures since 2025-09-01 with explicit and implicit content labels required, plus lawful training data, security assessment and filing for opinion-shaping services.
Obligations include: Mandatory Labeling - all AI-generated content must carry explicit, non-removable digital watermarks, Real-Name Verification for providers, algorithm filing, pre-deployment security assessments and lifecycle logging, data localization, enforced by Cyberspace Administration of China (CAC) with fines up to 10% of annual revenue and criminal liability.
5. International principles and standards that shape accountability
•OECD AI Principles (2019, revised 2024): Intergovernmental recommendation including accountability of AI actors, including traceability of datasets, processes and decisions and systematic risk management at each lifecycle phase. Five values-based principles: inclusive growth, privacy, transparency and explainability, robustness/security/safety, and accountability.
•ISO/IEC 38507:2022: International standard (guidance) on governance implications of an organisation's use of AI for governing bodies and executives and ISO/IEC 42001 and ISO/IEC 23894 organize governance around lifecycle activities for identifying, assessing, monitoring, communicating, and treating AI risks.
•For how systems are held accountable in practice: accountability is derived from a combination of existing laws such as Information Technology Act, Digital Personal Data Protection Act, and general principles of criminal and tort law in many jurisdictions, but they do not explicitly define liability where AI acts autonomously, so liability is increasingly mapped to human actors: developers, deployers, and operators.
In summary, a system like this is currently governed as:
•Built: EU requires technical documentation, data governance, copyright compliance, training-data summaries, adversarial testing and cybersecurity for GPAI/systemic-risk models; China requires lawful training data and security filing; US/UK/NIST require documented risk management, bias testing and data protection via voluntary frameworks that become contractual/regulatory expectations.
•Deployed: EU requires human oversight, logging, post-market monitoring, incident reporting, and Article 50 disclosure that a user is talking to AI; China requires filing before public release and real-name verification; US states require impact assessments and automated decision audits; UK requires sector regulators to enforce safety/fairness/contestability within their domains.
•Held accountable: Through the AI-specific laws above (EU fines up to 7% turnover, China fines up to 10% revenue), plus existing product liability, consumer protection (FTC Section 5), anti-discrimination, data-privacy (GDPR, DPDP Act), copyright/IP, and contract law where deployers/owners retain day-to-day accountability for deployed systems.