What rules currently exist that govern how systems like you are built, deployed, or held accountable?

I'll map the current rules governing how AI systems are built, deployed, and held accountable.

There is no single global law governing how AI systems are built, deployed, or held accountable. Regulation is a patchwork of binding law, sector-specific rules, and voluntary frameworks that varies by jurisdiction and by risk level.

1. The Overall Landscape

AI regulation isn't one law - it's a patchwork of federal guidance, state statutes, and international regimes. In 2026, the United States is fighting over whether states can regulate AI at all, the EU AI Act has moved from theory to enforcement, and China continues to layer new rules

2. European Union - EU AI Act

The most comprehensive horizontal law, applying across all 27 member states. It is risk-based:

> In the EU AI Act, AI systems are classified into 4 categories according to the perceived risk they pose: Unacceptable risk systems are banned entirely... high-risk systems are subject to rules of traceability, transparency and robustness, low-risk systems require transparency on the part of the supplier, and minimal risk systems for which no requirements are set

In more detail:

Applicability is extraterritorial - similar to GDPR - covering providers and users outside the EU when the results generated by the system are used in the EU

Enforcement timeline as of 2026:

A July 2026 amendment, the Digital Omnibus, locked in those dates and gave small and mid-cap companies lighter compliance requirements

For providers in scope under GPAI rules, obligations that took effect on August 2, 2025 are already live. Automatic event logging, technical documentation, adversarial testing records and incident reporting to the AI Office are all current requirements. Providers must maintain technical documentation, give downstream developers information about capabilities, and GPAI models that pose systemic risk face additional requirements, including model evaluations and adversarial testing, ongoing risk management, incident reporting, and stronger cybersecurity protections

3. United States

The US still doesn't have a comprehensive federal AI law. What it has instead is a fast-moving mix of state statutes, agency enforcement, and an active, unresolved fight over who gets to regulate AI at all

Federal position:

Critically: the order doesn't preempt state law on its own. Preemption requires either a court ruling or an act of Congress, and Congress has twice declined to pass broad preemption language

> An executive order alone cannot override state law. President Trump's December 2025 EO 14365 attempts to preempt state AI regulation through litigation, conditional funding, and federal standards, but states retain their regulatory authority unless Congress passes preemptive legislation
> There is no broad federal AI law. The Trump administration repealed the Biden-era AI executive order in January 2025

Until that changes, state AI laws remain enforceable, and companies that pause compliance while waiting for federal clarity are taking on real exposure

The Senate voted 99-1 in July 2025 to reject a proposed 10-year federal moratorium on state AI regulation

Enforcement via existing law:

The FTC has kept up its scrutiny of AI-powered products, focusing on false or misleading claims and data practices... That enforcement authority under Section 5 of the FTC Act remains active. In September 2026 the FTC opened an investigation into OpenAI, Anthropic and other AI companies over possible consumer harm

State laws doing most of the regulatory work:

Most US state privacy laws also layer on their own automated decision-making and profiling requirements, typically a disclosure obligation and an opt-out right

4. China

China has a layered, sector-specific regulations, not a single statute: Generative AI Regulations (2023), AI Safety Governance Framework (2024), Network Data Security Management Regulations (January 2025), AI-content-labeling rules (September 2025)

5. International Principles and Soft Law

Three international instruments form a values baseline:

The OECD Recommendation on AI, adopted in 2019 and amended in 2024, and the UNESCO Recommendation on the Ethics of AI, adopted in 2021, provide widely endorsed soft law, emphasizing human-centred, trustworthy AI with transparency, robustness, accountability, and human oversight. UNESCO insists AI systems should not displace ultimate human responsibility and must remain auditable, transparent, and subject to oversight

OECD principles include: inclusive growth, human rights, transparency, robustness / security / safety, accountability

6. Technical Governance Frameworks Used for Accountability

Even where law is voluntary, two frameworks are widely referenced in regulation and contracts:

> The NIST AI Risk Management Framework organizes work into four functions: Govern (the culture and accountability that runs across everything), Map (understand context and risk), Measure (analyze and track risk), and Manage (act on prioritized risk)

Texas TRAIGA offers a safe harbor for organizations that substantially comply with the NIST AI Risk Management Framework

Put simply: law sets the duty, ISO/IEC 42001 builds the management system, and NIST turns that into daily controls

7. How Accountability is Allocated: Builder vs. Deployer

Modern rules distinguish roles:

Under the EU AI Act, the provider (developer) and deployer (user) have distinct obligations. A buyer deploying a high-risk system inherits deployer obligations (oversight, FRIA, monitoring) but depends on the provider for documentation and conformity

Articles 26–27 impose substantial obligations on 'deployers' of high-risk AI systems: they must implement human oversight measures appropriate to the system's risks, monitor system operation for anomalies, maintain logs, report serious incidents to authorities

Deployers who modify the intended purpose of a high-risk AI system, or who use it outside the provider’s instructions, absorb the provider’s obligations. The EU AI Liability Directive creates a presumption of causality when a provider or deployer fails to comply with the AI Act and harm occurs.

Essentially, day-to-day accountability for a deployed AI system rests with the agency that owns the approved use case, and contracts must allocate responsibility for obligations neither party can fulfill alone.

This summary reflects rules enforceable as of early 2026 and is for information only; specific obligations depend on jurisdiction, use case, and whether a system is classified as GPAI or high-risk. For application to a particular system, consult the official texts (EU AI Act, state statutes, CAC measures) and legal counsel.