What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Short answer: There isn’t one single global “AI law.” Instead, a patchwork of binding laws, sector rules, executive actions, and voluntary standards govern how AI is built, deployed, and held accountable. Here are the main ones in force today and what they require.

United States (federal)

•No comprehensive federal AI statute yet. The 2023 Biden AI order (EO 14110) was rescinded on January 20, 2025. In its place, EO 14365 (Dec 11, 2025) directs a “national AI policy framework,” instructs agencies to challenge conflicting state AI laws, consider conditioning certain federal funds on state compliance, and pursue federal preemption via legislation; it doesn’t itself impose broad obligations on private AI builders.[1]

•Federal agency enforcement under existing laws:

•FTC: continues to police deceptive/unfair AI claims; in July 2026 it sought comment on a policy statement clarifying when undisclosed manipulation of outputs (“suppression of accuracy”) could be deceptive under Section 5.[2]

•CFPB: lenders using AI must give specific, accurate adverse‑action reasons under ECOA/FCRA (can’t hide behind “black box” models).[3]

•FDA: final guidance lets AI/ML medical‑device makers pre‑agree “Predetermined Change Control Plans” so the agency can authorize safe, iterative model updates.[4]

•Banking regulators: model‑risk management expectations apply to AI models (updated supervisory guidance in 2026).[5]

•Federal government’s own use of AI: OMB Memorandum M‑24‑10 (Mar 2024) requires agencies to inventory, govern, and risk‑manage AI, with extra safeguards for uses affecting the public’s rights and safety.[6]

•Federal technical baselines (voluntary but widely referenced): NIST AI Risk Management Framework (AI RMF 1.0) and its Generative AI Profile.[7]

United States (state and local highlights)

•Colorado AI Act (SB 24‑205): first broad state law on “high‑risk” AI used in consequential decisions (credit, employment, etc.). It imposes a duty of care to prevent algorithmic discrimination, documentation and notice duties, and AG enforcement (no private right of action). Effective date was extended; enforcement begins no later than June 30, 2026.[8]

•New York City Local Law 144 (AEDT): employers can’t use automated employment decision tools unless they complete an independent annual bias audit, publish a summary, and give candidate/employee notices; enforced since July 5, 2023.[9]

•California:

•SB 53 (Transparency in Frontier AI Act): since Jan 1, 2026, large “frontier” developers must publish an AI safety framework, risk information, and related transparency measures.[10]

•SB 813 (2026): creates a framework for independent verification organizations to assess AI systems and models for safety and risk.[11]

European Union

•EU AI Act (Regulation 2024/1689): the world’s first comprehensive AI law. It bans certain practices; sets obligations for “high‑risk” AI (quality management, data governance, human oversight, post‑market monitoring, incident reporting, CE‑marking); adds transparency duties (including certain synthetic‑content marking); and creates the European AI Office. Key application dates now phase in as follows:

•Many transparency duties (incl. certain synthetic‑content obligations) apply from August 2, 2026 (with a short grace period for some pre‑existing systems).[12]

•High‑risk rules for Annex III use‑cases apply from December 2, 2027; for high‑risk AI embedded in regulated products from August 2, 2028.[13]

•Penalties can reach the higher of €35M or 7% of global turnover for prohibited practices.[14]

•Digital Services Act (DSA): already in force for platforms and search engines since Feb 17, 2024, requiring recommender‑system transparency, ad transparency, data access for regulators/researchers, and systemic risk management for “very large” services.[15]

•Governance: the European AI Office coordinates supervision (especially for general‑purpose AI) alongside national market‑surveillance authorities.[16]

United Kingdom

•No single AI Act; the government uses a sector‑regulator model under its “pro‑innovation” approach, backed by the UK AI Safety/Security Institute’s model evaluations that inform policy. Sector bodies (e.g., Ofcom, MHRA) set and enforce domain rules; Online Safety Act covers certain content risks.[17]

Canada

•No federal, cross‑cutting AI statute in force. The proposed Artificial Intelligence and Data Act (AIDA) did not become law; the government continues consultations and has launched a new “AI for All” strategy. The binding rules that do exist mainly govern federal agencies’ own automation via the Treasury Board’s Directive on Automated Decision‑Making and its mandatory Algorithmic Impact Assessment.[18]

China

•Departmental regulations govern algorithms and generative AI nationwide:

•Algorithmic Recommendation Provisions (effective 2022) require filing for certain algorithms, disclosures, and user controls (e.g., non‑profiling options).[19]

•Deep Synthesis Provisions (effective Jan 10, 2023) require labeling of synthetic media and other controls.[20]

•Interim Measures for Generative AI (effective Aug 15, 2023) impose obligations on public‑facing GenAI services (content moderation, data governance, filings/security assessments for services with public‑opinion or mobilization attributes).[21]

International instruments and standards you’ll see referenced in contracts, audits, and enforcement

•Council of Europe Framework Convention on AI (opened for signature Sept 5, 2024): the first binding international treaty on AI and human rights, democracy and rule of law; the EU concluded it in 2026. It will bind only ratifying parties but is shaping national laws.[22]

•OECD AI Principles (2019; updated guidance 2024): widely adopted, human‑centric principles that inform many national frameworks (including definitions).[23]

•UNESCO Recommendation on the Ethics of AI (2021): a global (non‑binding) standard many governments use to frame policy and public‑sector AI use.[24]

•ISO/IEC 42001:2023 (AI Management System) and ISO/IEC 23894:2023 (AI risk management): voluntary standards organizations can certify against or align to; often used to demonstrate due diligence and map to EU/US expectations.[25]

•NIST AI RMF 1.0 + Generative AI Profile: common US baseline for AI risk management that regulators, procurement, and auditors increasingly reference.[7]

What this means in practice

•If you build AI: expect to show documented risk management (data governance, testing/red‑teaming, human oversight), transparency for users, incident and post‑market monitoring, plus sector‑specific obligations (medical devices, finance, consumer protection). EU‑bound products must plan toward AI Act conformity; Colorado/NYC/California add US obligations depending on your use case and footprint.[14]

•If you deploy AI: know when your use is “high‑risk” (EU Annex III; Colorado categories; NYC hiring tools) and stand up governance: impact/bias assessments, audits, notices, human review, and appeal processes.[13]

•If you make claims about AI: substantiation is critical; deceptive marketing or undisclosed output manipulation can trigger FTC action.[2]

If you share where you operate (US/EU/elsewhere) and what your system does (e.g., hiring, lending, health, consumer apps), I can map the concrete obligations, dates, and proof-of-compliance you’ll need.

Citations (25)

1nist.govGovernment
Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence | NIST
Backs: “In its place, EO 14365 (Dec 11, 2025) directs a “national AI policy framework,” instructs agencies to challenge conflicting state AI laws, consider conditioning certain federal funds on state compliance, and pursue federal preemption via legislation; it doesn’t itself impose broad obligations on private AI builders.”
2ftc.govGovernment
FTC Seeks Public Comment on Policy Statement Addressing AI Accuracy | Federal Trade Commission
Backs: “FTC: continues to police deceptive/unfair AI claims; in July 2026 it sought comment on a policy statement clarifying when undisclosed manipulation of outputs (“suppression of accuracy”) could be deceptive under Section 5.”
3consumerfinance.govGovernment
Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms | Consumer Financial Protection Bureau
Backs: “CFPB: lenders using AI must give specific, accurate adverse‑action reasons under ECOA/FCRA (can’t hide behind “black box” models).”
4fda.govGovernment
Artificial Intelligence in Software as a Medical Device | FDA
Backs: “FDA: final guidance lets AI/ML medical‑device makers pre‑agree “Predetermined Change Control Plans” so the agency can authorize safe, iterative model updates.”
5fdic.govGovernment
Adoption of Supervisory Guidance on Model Risk Management (Revised March 2026) | FDIC.gov
Backs: “Banking regulators: model‑risk management expectations apply to AI models (updated supervisory guidance in 2026).”
6whitehouse.govGovernment
EXECUTIVE OFFICE OF THE PRESIDENT
Backs: “OMB Memorandum M‑24‑10 (Mar 2024) requires agencies to inventory, govern, and risk‑manage AI, with extra safeguards for uses affecting the public’s rights and safety.”
7nist.govGovernment
Artificial Intelligence Risk Management Framework (AI RMF 1.0) | NIST
Backs: “NIST AI Risk Management Framework (AI RMF 1.0) and its Generative AI Profile.”
8colorado.govGovernment
SB24-205 Consumer Protections for Artificial Intelligence | Colorado General Assembly
Backs: “Effective date was extended; enforcement begins no later than June 30, 2026.”
9nyc.govGovernment
Automated Employment Decision Tools (AEDT) - DCWP
Backs: “New York City Local Law 144 (AEDT): employers can’t use automated employment decision tools unless they complete an independent annual bias audit, publish a summary, and give candidate/employee notices; enforced since July 5, 2023.”
10ca.govGovernment
Governor Newsom signs SB 53, advancing California’s world-leading artificial intelligence industry | Governor of California
Backs: “SB 53 (Transparency in Frontier AI Act): since Jan 1, 2026, large “frontier” developers must publish an AI safety framework, risk information, and related transparency measures.”
11ca.govGovernment
California’s nation-leading AI framework just got stronger, Governor Newsom signs more first-in-the-nation worker protections and more | Governor of California
Backs: “SB 813 (2026): creates a framework for independent verification organizations to assess AI systems and models for safety and risk.”
12europa.euGovernment
When does enforcement start? | AI Act Service Desk
Backs: “Many transparency duties (incl. certain synthetic‑content obligations) apply from August 2, 2026 (with a short grace period for some pre‑existing systems).”
13europa.euGovernment
Timeline - Artificial intelligence - Consilium
Backs: “High‑risk rules for Annex III use‑cases apply from December 2, 2027; for high‑risk AI embedded in regulated products from August 2, 2028.”
14europa.euGovernment
Article 99: Penalties | AI Act Service Desk
Backs: “Penalties can reach the higher of €35M or 7% of global turnover for prohibited practices.”
15europa.euGovernment
The enforcement framework under the Digital Services Act | Shaping Europe’s digital future
Backs: “Digital Services Act (DSA): already in force for platforms and search engines since Feb 17, 2024, requiring recommender‑system transparency, ad transparency, data access for regulators/researchers, and systemic risk management for “very large” services.”
16europa.euGovernment
Governance and enforcement of the AI Act | Shaping Europe’s digital future
Backs: “Governance: the European AI Office coordinates supervision (especially for general‑purpose AI) alongside national market‑surveillance authorities.”
17gov.ukGovernment
A pro-innovation approach to AI regulation: government response - GOV.UK
Backs: “Sector bodies (e.g., Ofcom, MHRA) set and enforce domain rules; Online Safety Act covers certain content risks.”
18dataprotectionreport.comNot yet classified
AI regulation: Global guide
Backs: “The binding rules that do exist mainly govern federal agencies’ own automation via the Treasury Board’s Directive on Automated Decision‑Making and its mandatory Algorithmic Impact Assessment.”
19cac.gov.cnGovernment
互联网信息服务算法推荐管理规定_中央网络安全和信息化委员会办公室
Backs: “Algorithmic Recommendation Provisions (effective 2022) require filing for certain algorithms, disclosures, and user controls (e.g., non‑profiling options).”
20loc.govGovernment
China: Provisions on Deep Synthesis Technology Enter into Effect | Library of Congress
Backs: “Deep Synthesis Provisions (effective Jan 10, 2023) require labeling of synthetic media and other controls.”
21loc.govGovernment
China: Generative AI Measures Finalized | Library of Congress
Backs: “Interim Measures for Generative AI (effective Aug 15, 2023) impose obligations on public‑facing GenAI services (content moderation, data governance, filings/security assessments for services with public‑opinion or mobilization attributes).”
22coe.intGovernment
The Framework Convention on Artificial Intelligence - Artificial Intelligence
Backs: “It will bind only ratifying parties but is shaping national laws.”
23oecd.orgGovernment
OECD Legal Instruments
Backs: “OECD AI Principles (2019; updated guidance 2024): widely adopted, human‑centric principles that inform many national frameworks (including definitions).”
24unesco.orgGovernment
Ethics of Artificial Intelligence - AI | UNESCO
Backs: “UNESCO Recommendation on the Ethics of AI (2021): a global (non‑binding) standard many governments use to frame policy and public‑sector AI use.”
25iso.orgNonprofits and think tanks
ISO - ISO/IEC 42001 explained
Backs: “ISO/IEC 42001:2023 (AI Management System) and ISO/IEC 23894:2023 (AI risk management): voluntary standards organizations can certify against or align to; often used to demonstrate due diligence and map to EU/US expectations.”