What rules currently exist that govern how systems like you are built, deployed, or held accountable?

I'll research the current regulatory landscape for AI systems, since this area is evolving rapidly.As of October 2026, the governance of AI systems like me comes from a patchwork of binding law, government policy, and voluntary industry commitments—no single comprehensive framework exists yet. Here's the current landscape:

1. The EU AI Act (binding, most comprehensive)

The EU AI Act is the most developed binding framework. It applies in phases: Article 5 prohibitions and the AI literacy requirement under Article 4 became applicable on 2 February 2025, and general-purpose AI obligations under Articles 50 to 55 became applicable on 2 August 2025.

As of August 2, 2026, the EU AI Act became broadly applicable, bringing Article 50 transparency requirements and stronger regulatory enforcement into effect. The European Commission's AI Office and national authorities can now enforce applicable provisions, while general-purpose AI model requirements that started in 2025 have entered their full Commission enforcement phase. For general-purpose AI models specifically, from 2 August 2026, the AI Office and authorities of the Member States are responsible for implementing, supervising and enforcing the AI Act. The AI Office holds enforcement powers over GPAI models, and can request technical documentation, evaluate models, require corrective measures and issue fines for non-compliance.

However, the toughest "high-risk" obligations were recently delayed. Following the "Digital Omnibus" amendment package, rules for systems used in certain high-risk areas—including biometrics, critical infrastructure, education, employment, migration, asylum and border control—will apply from 2 December 2027, and for systems integrated into products such as lifts or toys, the rules will apply from 2 August 2028.

Companies like Anthropic can also voluntarily sign the GPAI Code of Practice: current signatories include Amazon, Anthropic, Google, IBM, Microsoft, Mistral AI, OpenAI, ServiceNow, and other providers, though xAI has signed the Safety and Security chapter only.

2. US federal policy (light-touch, no comprehensive law)

The United States has no comprehensive federal AI statute. Instead, federal AI governance has been shaped by a series of executive orders—first under President Biden, then dramatically reversed by President Trump—alongside agency guidance, voluntary frameworks like the NIST AI Risk Management Framework.

Recent federal action has focused on two things:

Cybersecurity/national security oversight: In June 2026, the White House issued an executive order titled "Promoting Advanced Artificial Intelligence Innovation and Security," establishing a voluntary framework permitting developers of certain advanced AI models to voluntarily provide the federal government with model access prior to public release for cybersecurity and national security assessments. This order establishes two new federal AI oversight mechanisms, though it does not impose direct compliance obligations on businesses but formalizes the government's role in the AI development cycle.

Preempting state regulation: In December 2025, a separate executive order titled "Ensuring a National Policy Framework for Artificial Intelligence" proposed to establish a uniform Federal policy framework for AI that preempts state AI laws deemed by the administration to be inconsistent with that policy. It directs the Attorney General to establish an AI litigation task force to challenge state AI laws deemed inconsistent, including on grounds of unconstitutional regulation of interstate commerce and federal preemption, and uses federal funding as leverage by authorizing agencies to condition discretionary grants on states refraining from enacting AI laws deemed inconsistent with the policy.

3. US state laws (currently the main binding rules for most companies)

Since federal law is sparse, businesses operating AI systems in the United States face no directly enforceable comprehensive federal AI law. The most consequential compliance obligations come from state legislatures—Colorado, Texas, California, Illinois, Connecticut, and more than 35 other states have introduced or enacted AI-specific legislation.

Key enacted laws include:

Litigation is actively testing these laws—xAI filed suit in federal court seeking an injunction against the Colorado AI Act on First Amendment, Dormant Commerce Clause, due process, and equal protection grounds.

4. Company-level voluntary safety frameworks

Beyond law, frontier AI developers (including Anthropic) maintain self-imposed governance frameworks. Anthropic's is called the Responsible Scaling Policy (RSP): a voluntary framework for managing catastrophic risks from advanced AI systems. It establishes how we identify and evaluate risks, how we make decisions about AI development and deployment, and how we aim to make sure that the benefits of our models exceed their costs.

The RSP works through capability thresholds: a frontier AI developer's own published commitment to test its models against defined dangerous-capability thresholds, and to apply stronger safeguards before releasing or continuing to train a model that crosses one. Accountability mechanisms built into this include Risk Reports published every 3-6 months with each redaction disclosed, a Frontier Safety Roadmap of public goals, external review of Risk Reports in defined cases, an approximately annual third-party review of procedural compliance, a Responsible Scaling Officer, whistleblower channels and a ban on non-disparagement terms that would stop staff publicly raising safety concerns.

Similar frameworks exist industry-wide: the July 2023 White House voluntary commitments, the Seoul AI Safety Summit commitments, and individual lab safety policies: Anthropic's Responsible Scaling Policy, OpenAI's Preparedness Framework, and DeepMind's Frontier Safety Framework. Importantly, all three documents are voluntary, self-published policies, not regulation—commitments a lab makes to itself and to the public about how it will behave, with credibility resting on whether the lab actually follows them.

Anthropic explicitly distinguishes its voluntary commitments from legal compliance: its newer Frontier Compliance Framework (FCF) serves as its compliance framework for SB 53 and other regulatory requirements, while the RSP remains its voluntary safety policy, reflecting what it believes best practices should be, even when that goes beyond or differs from current regulatory requirements.

Bottom line

Right now, accountability for systems like me comes from a mix of: (1) binding EU law that's partially phased in with high-risk rules pushed to 2027–2028; (2) a US federal approach that's light on direct obligations but aggressive on preempting states; (3) a growing but contested patchwork of US state laws, several already facing litigation; and (4) voluntary, self-policed industry safety frameworks that go beyond what any law currently requires but aren't legally enforceable. This is a genuinely unsettled area—expect meaningful shifts in the next 1–2 years as the EU's high-risk rules approach, US courts rule on state-law preemption, and more states and countries legislate.