I'll map the current rules governing how AI systems are built, deployed, and held accountable.
Current rules governing systems like this are a patchwork - no single global law - built from binding regulations, sectoral enforcement of existing laws, and voluntary frameworks:
1. European Union - Comprehensive Binding Law
The EU AI Act (Regulation (EU) 2024/1689) is the world's first comprehensive, legally binding AI legislation, also described as signed into law on August 1, 2024.
It uses a risk-tiered framework:
•AI systems are tiered by the harm they can cause — from unacceptable risk (social scoring, mass surveillance, real-time biometric identification in public spaces) to high risk (AI used in hiring, education, critical infrastructure, and law enforcement) to minimal risk (systems that face essentially no obligations)
•More generally tiers AI applications from unacceptable risk — prohibited outright — to high risk, which faces strict compliance obligations, to minimal risk
Phased application:
•Bans on the highest-risk applications took effect February 2, 2025. Prohibitions on unacceptable-risk AI took effect February 2, 2025
•Rules for general-purpose AI models began applying August 2, 2025
•Rules for general-purpose AI (GPAI) from August 2, 2025; Article 50 transparency obligations from August 2, 2026; and high-risk system obligations from December 2, 2027, and August 2, 2028
•High-risk obligations due August 2026 (timeline under review via the Digital Omnibus proposal)
What builders/deployers must do:
•Providers now have to publish summaries of the data used to train those systems, document how the models work, and label AI-generated content
•High-Risk AI Systems require mandatory conformity assessment, CE marking
•Companies that fail to mark synthetic outputs, omit required deepfake warnings, or operate deceptive conversational agents face administrative fines of up to 15 million euros, or up to 3 percent of their total worldwide annual turnover
Penalties: infringements of the prohibited-practices rules carry fines of up to 6% of global annual turnover and more generally penalties up to €35 million or 7% of global turnover.
Liability layer on top of the AI Act:
•Directive (EU) 2024/2853 on liability for defective products, transposition deadline December 9, 2026. Brings standalone software and AI systems inside strict product liability
•Framework treats software and AI systems more like physical products for strict-liability purposes
•The dedicated AI liability instrument is none — AI Liability Directive withdrawn 11 February 2025. The European Commission withdrew the AI Liability Directive proposal in 2025. Gap is filled by revised Product Liability Directive and national tort law.
Governance architecture includes notified bodies, a European AI Office, and national competent authorities.
2. United States - No Single Federal AI Law
The United States currently does not have a single comprehensive federal AI law. At federal level: No comprehensive federal AI law. Governed by executive orders.
Instead governance is built from:
a) Executive Orders:
•Biden Administration's Executive Order 14110, issued in October 2023, directed safety standards, civil rights protections. On January 20, 2025 — day one of the Trump Administration — it was revoked.
•Executive Order 14179, "Removing Barriers to American Leadership in Artificial Intelligence," replaced it
•Executive Order 14365 (December 2025) targeting the states. A DOJ AI Litigation Task Force, operational from January 2026, is authorized to challenge state AI laws in federal court — with the Dormant Commerce Clause as the primary legal theory
•EO 14409 (June 2, 2026), "Promoting Advanced Artificial Intelligence Innovation and Security," requests that AI companies voluntarily provide government access to covered frontier models for a cybersecurity review up to thirty days before release, and establishes a Treasury-led clearinghouse
Congressional bills (CREATE AI Act, AI Accountability Act, AI PLAN Act) remain unenacted.
b) Application of existing laws - FTC and sector regulators:
•This technology is already regulated in the U.S., in part by the FTC pursuant to its Section 5 authority on unfair and deceptive practices
•"If a company makes a deceptive claim using or about AI, that company can be held accountable," said Bedoya
•The FTC has brought 13 AI washing enforcement actions, treating deceptive AI capability claims as violations of Section 5 of the FTC Act
•In the United States, the FTC is applying Section 5 unfair and deceptive practices authority to AI agent failures
•The governance landscape is instead built from the NIST AI Risk Management Framework — voluntary, not law, but increasingly referenced by sector regulators (the FTC, CFPB, FDA, SEC, and EEOC have each cited NIST AI RMF principles when assessing whether an organisation's AI practices meet a reasonable standard of care)
The FTC's enforcement posture makes clear that companies deploying AI tools can be held liable under Section 5 for how those systems behave in production, not just the vendors who built them.
c) Voluntary framework:
•The NIST AI Risk Management Framework (AI RMF) provides voluntary guidance on responsible AI
•Type Voluntary, Focus Risk lifecycle (Govern, Map, Measure, Manage)
•The US Favors “Soft Law” & Standards: Instead of a single federal “AI Law,” the US relies on the NIST AI Risk Management Framework and agency-level enforcement
3. U.S. States - Patchwork of Binding Laws
States moved because Congress did not.
•California enacted a package including the Defending Democracy from Deepfake Deception Act and the AI Transparency Act. Texas passed the Responsible AI Governance Act.
•Colorado became the first state to pass a comprehensive AI accountability law. It defines “high-risk” AI systems and requires Impact assessments for systems influencing employment, education, finance, or healthcare
•California SB 53 (Transparency in Frontier AI Act) Chaptered 2025-09-29; in force 2026-01-01 ; Frontier developers (models trained above 10^26 operations). Signed in September 2025 and in force since 1 January 2026, it requires published safety frameworks and transparency reports, and prompt reporting of critical safety incidents
•More detail: California SB 53 requires Published frontier AI framework; transparency report before deploying a new or substantially modified frontier model; critical safety incidents reported within 15 days, 24 hours if death or serious injury is imminent; whistleblower channel
•Texas TRAIGA (Jan 1, 2026) — focused on prohibited uses
•Utah narrowed its AI law's scope and extended safe harbor protections
Common regulatory themes include transparency/disclosure: most common; telling people when AI is used
Accountability requirements: Companies will be held accountable for the AI systems they deploy, regardless of whether the systems were intended or reckless
4. International and Voluntary Standards
•OECD AI Principles set the international baseline. Reference: OECD AI Principles (2019, updated 2024). OECD AI Policy Observatory, coordinating 44 countries
•NIST AI Risk Management Framework (AI RMF 1.0 plus the 2024 Generative AI profile) is the US reference for govern, map, measure, manage
•International organizations like the OECD and UNESCO have issued ethical frameworks emphasizing transparency, accountability, and human rights
•Council of Europe Enacted treaty (2024) — Framework Convention on Artificial Intelligence; first legally binding international AI treaty
•No multilateral body has produced an enforceable global standard. Enforcement remains the missing element
Other jurisdictions:
•United Kingdom No comprehensive AI statute. Regulator-by-regulator approach, relying instead on existing frameworks such as the Consumer Duty and the Senior Managers and Certification Regime
•China Layered, sector-specific regulations, not a single statute: Generative AI Regulations (2023), AI Safety Governance Framework (2024). Functions as a state-control mechanism rather than a rights-based framework
•South Korea Enacted (December 2024) — Framework Act on the Development of AI, Singapore Voluntary — Model AI Governance Framework (2nd edition)
5. What This Means for Building, Deploying, and Accountability
Building: Documentation and risk management (NIST Govern, Map, Measure, Manage; ISO/IEC 42001 AI Management System), data governance, model risk management, and under EU AI Act conformity assessments and training-data summaries.
Deploying: Transparency obligations (label AI-generated content, watermarking, provenance disclosures), human oversight, and impact assessments before high-risk uses (hiring, credit, housing, education, healthcare). Example Colorado requires impact assessments for consequential decisions.
Held accountable: Through:
•Consumer protection law (FTC Section 5 unfair/deceptive), product liability strict liability in EU, and fault-based tort.
•Civil penalties (EU up to 7%, California SB53 civil penalty up to USD 1M per violation).
•Requirement for accountability mechanisms and clear definitions of AI actors- developers, deployers, and users and call for shared liability, transparency, and accountability
•Proposals including liability for harm caused by AI in sectors like healthcare or transportation, obligations to conduct risk assessments before deploying AI, mechanisms for redress