What governs systems like me is a fast-moving mix of law and policy — I'll map the current rules for building, deploying, and holding AI accountable.
There is no single global law for systems like me - there is a layered architecture of binding laws, mandatory regulations in some jurisdictions, and voluntary frameworks and standards that govern how AI is built, deployed and held accountable:
1. European Union - The EU AI Act - most comprehensive binding law
The EU AI Act is described as the world's first comprehensive AI regulatory framework, categorizing AI systems by risk level and requiring transparency for generative AI outputs.
•Status and timeline: Became law on August 1, 2024 and entered into force on August 1, 2024, with phased applicability. It classifies AI into unacceptable, high, limited and minimal risk, imposing strict obligations to ensure safety, transparency and compliance. Banned uses sit at the top, heavy documentation and oversight apply to high risk, and minimal risk faces almost no mandatory rules.
•Phased application:
•Bans on unacceptable-risk AI systems, including social scoring and certain biometric identification tools, took effect in February 2025. Prohibitions on unacceptable-risk AI starting February 2, 2025
•Rules governing general-purpose AI models, including governance structures and penalty mechanisms, became applicable in August 2025
•General-purpose AI model rules and governance arrangements applied from August 2, 2025
•Rules directly relevant to conversational/generative systems like me - Transparency:
•From 2 August 2026, the EU AI Act introduces mandatory transparency obligations requiring organisations to disclose AI interactions, mark AI-generated content, and inform users about emotion recognition and biometric categorisation systems. These rules apply not only to EU organisations but also to international businesses whose AI systems or outputs reach the EU market
•Article 50 of the EU AI Act came into force on 2 August 2026, introducing transparency obligations for providers and deployers of certain AI systems. Providers must disclose AI interactions and mark AI-generated or manipulated content
•Since 2 August 2026, any AI that talks to people in the EU must clearly tell them it's an AI — not a human. It's called Article 50. It requires that people be told they are interacting with an AI system at the point of interaction, and that synthetic audio or video that appears authentic be labeled
•With fines up to €15 million or 3% of global turnover. Chatbots have to identify themselves. Deepfakes need labels. Watermarks are mandatory
•High-risk obligations: High-risk systems face strict obligations for data quality, transparency, human oversight, and conformity assessment. Tools that screen, filter, or rank job applicants are classified as high-risk, meaning companies must document exactly how the software works.
2. United States - Decentralized, principles and framework-based approach
By contrast, the United States does not consolidate AI regulation into a single comprehensive statute. Instead, it favors a decentralized, soft-law approach primarily composed of Executive Order 14110 and the NIST Artificial Intelligence Risk Management Framework.
•Executive Orders: The Biden AI Executive Order, signed in October 2023, set off a broad government effort to manage AI risks. It tasked agencies that are responsible for regulating different critical infrastructure sectors using the NIST Risk Management Framework. It also invoked the Defense Production Act, requiring companies to provide the Department of Commerce with information on development of certain AI, defined as a dual-use foundational model, posing a serious risk. The framework has been developed in response to White House directives following President Biden's Executive Order on the Safe, Secure and Trustworthy Development of AI
•NIST AI Risk Management Framework (AI RMF):
•NIST has continued to develop its AI Risk Management Framework, which gives developers and deployers voluntary guidance for identifying and mitigating AI risks
•On July 26, 2024, NIST released their NIST-AI-600-1, Artificial Intelligence Risk Management Framework: Generative Artificial ... This framework was born out of an October 2023 Executive Order, tasking NIST with developing a new generative AI framework
•The NIST AI RMF has been designed to encourage responsible development of AI. At its core, it emphasizes risk management and social responsibility
•The governance frameworks themselves provide structure. The NIST AI Risk Management Framework organizes oversight into four functions — Govern, Map, Measure, and
•State laws referencing the framework: The growing importance of the AI RMF is evidenced by numerous American laws and executive orders that incorporate or reference it, including the White House's October 2023 executive order and the State of California's September 2023 order, which developed state guidelines based on the NIST framework. Colorado's new law, Consumer Protections for Artificial Intelligence, protects organisations that comply with the AI RMF.
•Accountability in practice: Organizations making progress share common practices: they maintain inventories of AI systems; they conduct risk classifications distinguishing high-stakes applications; they establish clear accountability for each deployed model; and they implement continuous monitoring rather than one-time assessments. Agencies must complete the AI intake process before deployment to verify that proposed use cases meet those requirements. But once an AI system is approved, ownership moves back to the individual agency. Essentially, day-to-day accountability for a deployed AI system rests with the agency that owns the approved use case.
This approach is often contrasted with the EU: US soft-law guidance to federal agencies and private-sector actors vs EU binding legislation.
3. United Kingdom - Pro-innovation, principles-based, regulator-led
To date the UK's approach has been to adopt a principles-based approach and require existing regulators to develop their own sector-specific guidelines for AI development and deployment. There is no AI licence or approval, only continuing duties on how AI is used.
The 2023 pro-innovation white paper "A pro-innovation approach to AI regulation" set five principles applied by all regulators:
Rather than adopting blanket rules that apply to all AI technologies, the white paper proposed five broad cross-sectoral principles ... Accountability and governance; and ... Contestability and redress.
The five principles set out in the AI White Paper are: (1) Safety, security and robustness; (2) Appropriate transparency and explainability; (3) Fairness; (4) Accountability and governance; and (5) Contestability and redress.
These are not a statute but shape how every UK regulator interprets AI conduct. These are not a statute but shape how every UK regulator interprets AI conduct. The principles are safety, security, and robustness; adequate transparency and explainability; fairness; accountability and governance; and contestability and redress.
4. China - Centralized, content and security-focused
China presents a different institutional boundary - centralized algorithmic and generative directives.
•Interim Measures for Generative AI: China's Interim Measures for the Management of Generative Artificial Intelligence Services, effective from August 2023, specifically target generative AI technologies like large language models. The regulation requires companies to register their generative AI services with authorities before public release and conduct security assessments. China was the first country to introduce rules specific to generative AI.
•Enforcement focus: Enforces mandatory security assessments prior to public release, real-time content filtering, user identity verification, and compulsory labeling/registration of synthetic media.
•Labeling rules: Content-labeling regulations, effective from September 2025, require AI-generated text, images, audio and video to carry visible or embedded identifiers. In collaboration with government ministries, the Cyberspace Administration of China (CAC) has announced that all AI-generated content on the internet will have to be labeled. A September 2026 campaign removed over 5.61 million unlawful AI-generated items.
•Ongoing obligations: Generative AI providers operating in China now face compliance obligations spanning content moderation, data governance, labeling, and, for emotionally interactive AI products, user protection mechanisms.
5. International Principles and Standards - voluntary but widely referenced
These frameworks are not legally binding in most countries but shape laws and corporate governance:
•OECD AI Principles (2019, revised 2024): The OECD AI Principles, adopted in 2019 and updated in 2024, remain the first intergovernmental standard on AI, now endorsed by 47 governments, built around five value-based principles: inclusive growth, human-centered values, transparency, robustness, and accountability. Accountability of AI actors (principle 1.5), including traceability of datasets, processes and decisions and systematic risk management at each lifecycle phase. While not legally binding, these principles influence national policies and corporate governance practices globally.
•ISO Standards:
•ISO/IEC 38507:2022 - The governance implications of an organisation's use of AI, written for governing bodies, executives
•ISO/IEC 42001:2023 standard, published in December 2023, is the first certifiable AI management system standard. Most credible frameworks agree on eight core principles: accountability, transparency, fairness, safety, privacy, human oversight, inclusivity and robustness. These originate in the OECD AI Principles and are reflected throughout ISO 42001, the NIST AI Risk Management Framework and the EU AI Act.
•Other operational standards like ISO/IEC 22989 (AI concepts) and ISO/IEC 23894 (AI risk management) provide operational guidance for technical robustness, testing, and auditability.
Several global frameworks guide responsible AI governance, including: The OECD AI Principles, The EU AI Act, The NIST AI Risk Management Framework (AI RMF), The ISO AI governance standards - frameworks define best practices for transparency, accountability, fairness, and risk management.
How this affects building, deploying and accountability in summary
•Building: Requirements for risk management, data governance, technical documentation, traceability of datasets, processes and decisions and systematic risk management at each lifecycle phase, safety/security/robustness testing.
•Deploying: Pre-deployment intake and risk classification, conformity assessments for high-risk systems, registration/security assessment in China before public release, and transparency/disclosure at point of interaction in EU from Aug 2026.
•Accountability: Govern, Map, Measure and Manage functions, clear accountability for each deployed model and continuous monitoring, and in the EU and internationally accountability assigned to human actors in the value chain with human oversight.
Rules are evolving quickly, vary by where the system is developed and where its outputs are accessed, and extraterritorial laws like the EU AI Act and China's labeling rules can apply even to non-EU/non-China providers if their users are in those jurisdictions.