What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Short answer: there isn’t one global “AI law.” Today’s guardrails are a stack of binding laws and agency rules, plus standards and voluntary codes. Here’s the snapshot as of October 13, 2026.

United States (federal)

•Executive branch rules for government AI: Executive Order 14110 (Oct 30, 2023) kicked off an all‑of‑government program; OMB M‑24‑10 (Mar 28, 2024) now requires federal agencies to inventory “safety‑impacting” AI uses, test/red‑team them, and put governance in place before deployment.[1]

•NIST guidance and the AI Safety Institute: the voluntary AI Risk Management Framework (AI RMF 1.0, Jan 2023) and a Generative AI profile (July 26, 2024) are the main technical baselines; the Commerce Department stood up the U.S. AI Safety Institute and an international network to coordinate testing and safety science.[2]

•Consumer protection, civil rights, and telecom enforcement (applies to private sector): the FTC, DOJ Civil Rights Division, CFPB, and EEOC issued a joint statement (Apr 25, 2023) reminding firms that existing laws on unfair/deceptive practices, fair lending, and anti‑discrimination fully apply to automated systems; the EEOC also published technical help on Title VII and AI in hiring. Separately, the FCC ruled (Feb 8, 2024) that AI‑generated voices in robocalls are “artificial or prerecorded voices” under the TCPA, so they require consent or fall under narrow exemptions.[3]

United States (state and local)

•Colorado AI Act (SB24‑205): signed May 17, 2024, with duties for “developers” and “deployers” of high‑risk AI to use reasonable care, document and disclose risks of algorithmic discrimination, and provide notices; key obligations phase in beginning February 1, 2026. Rulemaking is underway at the AG’s office.[4]

•NYC Local Law 144 (hiring tools): since July 5, 2023, employers using Automated Employment Decision Tools in NYC must obtain annual independent bias audits, post results, and give notices to candidates/employees.[5]

•Tennessee ELVIS Act: protects individuals’ voice/likeness against unauthorized AI cloning; signed Mar 21, 2024 (effective July 1, 2024).[6]

•Utah AI Policy framework: 2024–2025 laws require disclosure in certain AI interactions (narrowed in 2025), create a learning lab/sandbox, and add special rules for “mental health chatbots” (disclosure and safeguards) from May 7, 2025.[7]

•Deepfake election ad rules: multiple states now require disclosures or platform actions around AI‑generated political content; California’s AB 2655 applies to large platforms starting Jan 1, 2025; AB 2355 requires disclosures on AI‑altered political ads.[8]

European Union

•AI Act: entered into force Aug 1, 2024; bans eight “unacceptable‑risk” practices from Feb 2, 2025 and added a ninth (non‑consensual sexual/CSAM synthetic content) effective Dec 2026; obligations for general‑purpose AI (GPAI) models apply since Aug 2, 2025; transparency duties from Aug 2, 2026; high‑risk rules start Dec 2, 2027 (Annex III uses) and Aug 2, 2028 (AI embedded in regulated products). The EU AI Office enforces GPAI‑model rules.[9]

•Product liability update: Directive (EU) 2024/2853 extends strict liability to software and AI systems; Member States must transpose by Dec 9, 2026. Failure to ship needed safety/security updates can create liability exposure.[10]

United Kingdom

•No comprehensive AI statute yet. The UK is pursuing a “pro‑innovation” approach using existing regulators; the government’s Feb 2024 response to its AI White Paper set expectations for sector regulators and created central coordination. Online Safety Act implementation (Ofcom) adds content‑safety, transparency and reporting duties that cover AI‑generated material on platforms.[11]

China

•Binding rules on algorithms and generative/synthetic content: algorithmic recommendation provisions (effective Mar 1, 2022), deep synthesis provisions (effective Jan 10, 2023), and Interim Measures for Generative AI services (effective Aug 15, 2023) require record‑filings, identity checks, labeling of AI‑generated content, security assessments, and content controls.[12]

International treaties, principles, and standards

•Council of Europe Framework Convention on AI (first binding international treaty focused on AI and human rights, democracy and rule of law): adopted May 17, 2024 and opened for signature Sept 5, 2024; applies to parties that sign/ratify.[13]

•OECD AI Principles (2019; updated 2024): widely used non‑binding benchmark; underpin the G7 Hiroshima Process voluntary Code of Conduct for advanced AI developers (Oct 30, 2023).[14]

•ISO/IEC standards: ISO/IEC 42001:2023 (AI management systems—certifiable), and ISO/IEC 23894:2023 (AI risk management guidance) are increasingly referenced in corporate governance, procurement, and conformity assessments.[15]

How accountability typically works in practice

•Pre‑deployment: risk assessments, red‑teaming/testing, technical documentation, transparency, and bias checks (mandated in the EU for certain systems; required in NYC hiring; expected for U.S. federal systems per OMB; recommended by NIST globally).[9]

•Post‑deployment: incident reporting, monitoring, and human‑oversight obligations (EU AI Act), plus enforcement under existing privacy, consumer‑protection, telemarketing/communications, and anti‑discrimination laws (U.S.).[9]

If you tell me your sector and where you operate, I can translate this into a concrete “what applies to us now vs. what’s coming next” checklist.

Citations (15)

1govinfo.govGovernment
Federal Register
Backs: “OMB M‑24‑10 (Mar 28, 2024) now requires federal agencies to inventory “safety‑impacting” AI uses, test/red‑team them, and put governance in place before deployment.”
2nist.govGovernment
Artificial Intelligence Risk Management Framework (AI RMF 1.0) | NIST
Backs: “AI Safety Institute and an international network to coordinate testing and safety science.”
3ftc.govGovernment
Joint Statement on Enforcement Efforts Against Discrimination and Bias in Automated Systems | Federal Trade Commission
Backs: “Separately, the FCC ruled (Feb 8, 2024) that AI‑generated voices in robocalls are “artificial or prerecorded voices” under the TCPA, so they require consent or fall under narrow exemptions.”
4colorado.govGovernment
SB24-205 Consumer Protections for Artificial Intelligence | Colorado General Assembly
Backs: “Colorado AI Act (SB24‑205): signed May 17, 2024, with duties for “developers” and “deployers” of high‑risk AI to use reasonable care, document and disclose risks of algorithmic discrimination, and provide notices; key obligations phase in beginning February 1, 2026. Rulemaking is underway at the AG’s office.”
5nyc.govGovernment
Automated Employment Decision Tools (AEDT) - DCWP
Backs: “NYC Local Law 144 (hiring tools): since July 5, 2023, employers using Automated Employment Decision Tools in NYC must obtain annual independent bias audits, post results, and give notices to candidates/employees.”
6tn.govGovernment
Bill Information - Tennessee General Assembly
Backs: “Tennessee ELVIS Act: protects individuals’ voice/likeness against unauthorized AI cloning; signed Mar 21, 2024 (effective July 1, 2024).”
7utah.govGovernment
AI FAQ - commerce.utah.gov
Backs: “2024–2025 laws require disclosure in certain AI interactions (narrowed in 2025), create a learning lab/sandbox, and add special rules for “mental health chatbots” (disclosure and safeguards) from May 7, 2025.”
8ncsl.orgNonprofits and think tanks
2024 Election Enactments
Backs: “California’s AB 2655 applies to large platforms starting Jan 1, 2025; AB 2355 requires disclosures on AI‑altered political ads.”
9europa.euGovernment
AI Act | Shaping Europe’s digital future
Backs: “AI Act: entered into force Aug 1, 2024; bans eight “unacceptable‑risk” practices from Feb 2, 2025 and added a ninth (non‑consensual sexual/CSAM synthetic content) effective Dec 2026; obligations for general‑purpose AI (GPAI) models apply since Aug 2, 2025; transparency duties from Aug 2, 2026; high‑risk rules start…”
10europa.euGovernment
Directive - 2024/2853 - ET - Product Liability Directive - EUR-Lex
Backs: “Failure to ship needed safety/security updates can create liability exposure.”
11gov.ukGovernment
A pro-innovation approach to AI regulation: government response - GOV.UK
Backs: “Online Safety Act implementation (Ofcom) adds content‑safety, transparency and reporting duties that cover AI‑generated material on platforms.”
12cac.gov.cnGovernment
互联网信息服务算法推荐管理规定_中央网络安全和信息化委员会办公室
Backs: “Binding rules on algorithms and generative/synthetic content: algorithmic recommendation provisions (effective Mar 1, 2022), deep synthesis provisions (effective Jan 10, 2023), and Interim Measures for Generative AI services (effective Aug 15, 2023) require record‑filings, identity checks, labeling of AI‑generated…”
13coe.intGovernment
Committee on Artificial Intelligence (CAI) - Artificial Intelligence
Backs: “Council of Europe Framework Convention on AI (first binding international treaty focused on AI and human rights, democracy and rule of law): adopted May 17, 2024 and opened for signature Sept 5, 2024; applies to parties that sign/ratify.”
14oecd.orgGovernment
AI principles | OECD
Backs: “OECD AI Principles (2019; updated 2024): widely used non‑binding benchmark; underpin the G7 Hiroshima Process voluntary Code of Conduct for advanced AI developers (Oct 30, 2023).”
15iso.orgNonprofits and think tanks
ISO/IEC 42001:2023 - AI management systems
Backs: “ISO/IEC 42001:2023 (AI management systems—certifiable), and ISO/IEC 23894:2023 (AI risk management guidance) are increasingly referenced in corporate governance, procurement, and conformity assessments.”