What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Short answer: it depends where you are and what you do with AI. In the United States there’s still no single, cross‑sector federal statute that regulates private‑sector AI end‑to‑end. Instead, a patchwork of federal agency powers and state/local laws applies, and several countries/regions (notably the EU) now have comprehensive regimes with phased obligations.

Here’s the current snapshot as of October 16, 2026:

United States (federal)

•Executive branch policy shifted in 2025. President Biden’s 2023 AI executive order (EO 14110) was rescinded on January 20, 2025. It was replaced by new orders emphasizing a national, “minimally burdensome” framework and challenging conflicting state AI laws (EO 14179, Jan 23, 2025; EO 14365, Dec 11, 2025). OMB’s government‑use rules were also reset: OMB M‑25‑21 (Apr 3, 2025) rescinds and replaces M‑24‑10 and directs agencies to accelerate AI adoption while managing “high‑impact” uses. These bind federal agencies’ own use of AI and procurement; they are not a private‑sector AI law.[1]

•Enforcement uses existing laws:

•FTC Act Section 5 (unfair/deceptive practices) including biometrics guidance and recent AI policy statements; agencies continue case‑by‑case enforcement.[2]

•Financial services: CFPB circulars and guidance require specific, accurate adverse‑action reasons even when AI/ML or complex algorithms are used (ECOA/Reg B, FCRA).[3]

•Copyright: the U.S. Copyright Office’s AI guidance and reports (2023 policy; 2024–2025 reports) require disclosure and limit protection for non‑human authorship.[4]

•Voluntary standards widely referenced by regulators and courts:

•NIST AI Risk Management Framework 1.0 (Jan 26, 2023) and Playbook remain the core U.S. baseline for AI risk governance; NIST is publishing profiles (e.g., generative AI, critical infrastructure) and maintains the AI Resource Center.[5]

United States (state and local)

•Colorado’s Automated Decision‑Making Technology Act (SB 24‑205) targets “high‑risk” AI used for consequential decisions and aims to prevent algorithmic discrimination. Rulemaking is ongoing; the Attorney General must adopt rules before January 1, 2027.[6]

•Utah’s Artificial Intelligence Policy Act (effective May 1, 2024; amended 2025–2026) requires disclosure when generative AI is used in certain consumer and “regulated occupation” interactions; additional duties apply to mental‑health chatbots.[7]

•Tennessee’s ELVIS Act (Mar 21, 2024) adds voice to right‑of‑publicity protections, aimed at AI voice cloning.[8]

•New York City Local Law 144 (enforced since July 5, 2023) requires annual independent bias audits and notices for automated employment decision tools used in hiring/promotion.[9]

•Biometric privacy: Illinois BIPA (notice, consent, retention, private suits) and Texas CUBI (notice/consent, AG enforcement) frequently apply to AI that processes face/voice/other biometrics. Recent AG settlements in Texas highlight active enforcement.[10]

European Union

•The EU AI Act is in force and phasing in:

•General transparency duties (e.g., marking AI‑generated content; informing users about certain AI systems) are enforceable from August 2, 2026, with a narrow grace period for systems already on the market before that date. High‑risk Annex III obligations start December 2, 2027; for high‑risk AI embedded in regulated products, August 2, 2028.[11]

•The Commission has published Article 50 transparency guidance to help providers/deployers comply starting August 2, 2026.[12]

•Other EU digital laws that affect AI systems:

•Digital Services Act (applicable since Feb 17, 2024) imposes platform accountability and transparency (including access to data/algorithms for supervision and recommender‑system duties), with active enforcement against VLOPs/VLOSEs.[13]

•The new Product Liability Directive (Oct 23, 2024) modernizes strict liability and explicitly covers software and AI‑related updates/services, tightening duties around security updates and post‑market changes.[14]

Council of Europe and UN (global baselines)

•The Council of Europe’s Framework Convention on AI, Human Rights, Democracy and the Rule of Law (CETS 225) is the first binding international AI treaty; opened for signature on September 5, 2024, with EU and several states (including the U.S.) signing. It will enter into force after the required ratifications.[15]

•The UN General Assembly adopted its first AI resolution on “safe, secure and trustworthy” AI in March 2024 and followed up in 2025 by establishing a high‑level panel process. These are non‑binding but guide national policy.[16]

United Kingdom

•The UK still uses a “pro‑innovation,” regulator‑led approach (no horizontal AI statute). The government created the AI Safety Institute and publishes evaluation approaches and frontier‑model trend reports; regulators (e.g., Ofcom) are integrating AI oversight within sectoral mandates.[17]

China

•Binding national rules govern synthetic media and public‑facing generative AI:

•Deep Synthesis Provisions (effective Jan 10, 2023) require labeling, security, and content‑governance controls.[18]

•Interim Measures for Generative AI Services (effective Aug 15, 2023) require lawful data sources, IP and privacy compliance, risk controls, and incident reporting.[19]

International soft law and standards you’ll see referenced in contracts, audits, and enforcement

•OECD AI Principles (2019; updated May 3, 2024) remain the global reference for trustworthy AI and are echoed in many national instruments and the EU AI Act’s approach.[20]

•ISO/IEC 42001:2023 (AI management systems) is the first certifiable AI governance standard; some organizations now use it to demonstrate process accountability for AI.[21]

•NIST AI RMF 1.0 and profiles (U.S.) are frequently cited as a “reasonable practices” yardstick even outside government.[5]

What this means in practice

•If you build AI: expect to be held to general consumer‑protection, civil‑rights, data‑protection, IP, product‑safety, and cybersecurity laws already on the books, plus any sector rules (finance, health, employment). In the EU, map your systems against AI Act risk categories and calendar the phased deadlines; in the U.S., align to NIST AI RMF/ISO 42001 and the specific state/local laws where you operate.[11]

•If you deploy AI: disclosure, record‑keeping, impact/risk assessments, bias testing, and user notices increasingly matter (e.g., NYC hiring audits; Colorado’s high‑risk duties pending; EU transparency and high‑risk regimes).[9]

•Accountability levers that regulators and courts are already using: deceptive‑practice theories for overclaiming capabilities or hiding risks; disparate‑impact/discrimination claims in hiring/credit/insurance; biometric‑privacy violations for face/voice processing; and strict product liability (EU) for software‑driven defects.[2]

Want this tailored to your situation?
Tell me:

•Where you operate and ship (U.S. states, EU/UK, elsewhere)

•Whether you build models, fine‑tune, or just integrate third‑party AI

•Your use cases (hiring, lending, healthcare, content generation, safety‑critical, etc.)

I can generate a concise obligation map and a date‑driven compliance checklist for your stack.

Citations (21)

1nist.govGovernment
Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence | NIST
Backs: “These bind federal agencies’ own use of AI and procurement; they are not a private‑sector AI law.”
evidence, article. Claim: Biden's 2023 AI executive order was rescinded and replaced by new orders and OMB memos governing federal agency AI use.
2ftc.govGovernment
Policy Statements | Federal Trade Commission
Backs: “FTC Act Section 5 (unfair/deceptive practices) including biometrics guidance and recent AI policy statements; agencies continue case‑by‑case enforcement.”
evidence, data page. Claim: FTC Act Section 5 and AI policy statements underpin case-by-case enforcement against unfair or deceptive AI practices.
3consumerfinance.govGovernment
Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms | Consumer Financial Protection Bureau
Backs: “CFPB circulars and guidance require specific, accurate adverse‑action reasons even when AI/ML or complex algorithms are used (ECOA/Reg B, FCRA).”
evidence, official document. Claim: CFPB circulars require specific, accurate adverse-action reasons even when AI/ML or complex algorithms are used in credit decisions.
4govinfo.govGovernment
88 FR 16190 - Copyright Registration Guidance: Works Containing Material Generated by Artificial Intelligence - Content Details - 2023-05321
Backs: “2024–2025 reports) require disclosure and limit protection for non‑human authorship.”
evidence, official document. Claim: Copyright Office AI guidance requires disclosure and limits protection for non-human authorship.
5nist.govGovernment
Artificial Intelligence Risk Management Framework (AI RMF 1.0) | NIST
Backs: “NIST is publishing profiles (e.g., generative AI, critical infrastructure) and maintains the AI Resource Center.”
evidence, official document. Claim: NIST AI RMF 1.0 is the core voluntary U.S. baseline for AI risk governance.
6coag.govGovernment
Colorado Anti-Discrimination in AI Law (ADAI) Rulemaking | Colorado Attorney General
Backs: “Rulemaking is ongoing; the Attorney General must adopt rules before January 1, 2027.”
evidence, official document. Claim: Colorado's high-risk AI law targets algorithmic discrimination; AG rulemaking is ongoing before January 1, 2027.
7utah.govGovernment
Utah Legislature SB0149
Backs: “Utah’s Artificial Intelligence Policy Act (effective May 1, 2024; amended 2025–2026) requires disclosure when generative AI is used in certain consumer and “regulated occupation” interactions; additional duties apply to mental‑health chatbots.”
evidence, official document. Claim: Utah's AI Policy Act requires disclosure of generative AI use in certain consumer and regulated-occupation interactions.
8tn.govGovernment
PHOTOS: Gov. Lee Signs ELVIS Act Into Law
Backs: “Tennessee’s ELVIS Act (Mar 21, 2024) adds voice to right‑of‑publicity protections, aimed at AI voice cloning.”
evidence, article. Claim: Tennessee's ELVIS Act extends right-of-publicity protections to voice, aimed at AI voice cloning.
9nyc.govGovernment
Automated Employment Decision Tools (AEDT) - DCWP
Backs: “New York City Local Law 144 (enforced since July 5, 2023) requires annual independent bias audits and notices for automated employment decision tools used in hiring/promotion.”
evidence, official document. Claim: NYC Local Law 144 requires annual bias audits and notices for automated employment decision tools.
10ilga.govGovernment
Illinois General Assembly - Illinois Compiled Statutes - Full Text
Backs: “Recent AG settlements in Texas highlight active enforcement.”
evidence, official document. Claim: Illinois BIPA imposes notice, consent, retention rules and private suits, often applicable to AI processing biometrics.
11europa.euGovernment
Timeline for the Implementation of the EU AI Act | AI Act Service Desk
Backs: “High‑risk Annex III obligations start December 2, 2027; for high‑risk AI embedded in regulated products, August 2, 2028.”
evidence, article. Claim: EU AI Act phases in obligations: transparency from August 2026, high-risk Annex III from December 2027, embedded products August 2028.
12europa.euGovernment
Guidelines on transparency obligations for providers and deployers of AI systems | Shaping Europe’s digital future
Backs: “The Commission has published Article 50 transparency guidance to help providers/deployers comply starting August 2, 2026.”
evidence, official document. Claim: The Commission published Article 50 transparency guidance for providers and deployers.
13europa.euGovernment
The enforcement framework under the Digital Services Act | Shaping Europe’s digital future
Backs: “Digital Services Act (applicable since Feb 17, 2024) imposes platform accountability and transparency (including access to data/algorithms for supervision and recommender‑system duties), with active enforcement against VLOPs/VLOSEs.”
evidence, article. Claim: The Digital Services Act imposes platform accountability and transparency duties with active enforcement against very large platforms.
14europa.euGovernment
Directive - 2024/2853 - IT - Product Liability Directive - EUR-Lex
Backs: “The new Product Liability Directive (Oct 23, 2024) modernizes strict liability and explicitly covers software and AI‑related updates/services, tightening duties around security updates and post‑market changes.”
evidence, official document. Claim: The new EU Product Liability Directive covers software and AI-related updates under strict liability.
15coe.intGovernment
Committee on Artificial Intelligence (CAI) - Artificial Intelligence
Backs: “The Council of Europe’s Framework Convention on AI, Human Rights, Democracy and the Rule of Law (CETS 225) is the first binding international AI treaty; opened for signature on September 5, 2024, with EU and several states (including the U.S.) signing. It will enter into force after the required ratifications.”
evidence, article. Claim: The Council of Europe Framework Convention on AI is the first binding international AI treaty, opened for signature in 2024.
16un.orgGovernment
United Nations
Backs: “The UN General Assembly adopted its first AI resolution on “safe, secure and trustworthy” AI in March 2024 and followed up in 2025 by establishing a high‑level panel process. These are non‑binding but guide national policy.”
evidence, official document. Claim: The UN General Assembly adopted non-binding AI resolutions and later established a high-level panel process.
17gov.ukGovernment
A pro-innovation approach to AI regulation: government response - GOV.UK
Backs: “The government created the AI Safety Institute and publishes evaluation approaches and frontier‑model trend reports; regulators (e.g., Ofcom) are integrating AI oversight within sectoral mandates.”
evidence, official document. Claim: The UK uses a pro-innovation, regulator-led approach with no horizontal AI statute.
18cac.gov.cnGovernment
互联网信息服务深度合成管理规定_中央网络安全和信息化委员会办公室
Backs: “Deep Synthesis Provisions (effective Jan 10, 2023) require labeling, security, and content‑governance controls.”
evidence, official document. Claim: China's Deep Synthesis Provisions require labeling, security, and content-governance controls.
19cyrilla.orgData and tools
Interim Measures for the Management of Generative Artificial Intelligence Services (EN).docx
Backs: “Interim Measures for Generative AI Services (effective Aug 15, 2023) require lawful data sources, IP and privacy compliance, risk controls, and incident reporting.”
evidence, official document. Claim: China's Interim Measures for Generative AI Services require lawful data, IP and privacy compliance, risk controls, and incident reporting.
20oecd.orgGovernment
OECD updates AI Principles to stay abreast of rapid technological developments | OECD
Backs: “OECD AI Principles (2019; updated May 3, 2024) remain the global reference for trustworthy AI and are echoed in many national instruments and the EU AI Act’s approach.”
evidence, article. Claim: OECD AI Principles were updated in May 2024 and remain a global reference for trustworthy AI.
21iso.orgNonprofits and think tanks
ISO/IEC 42001:2023 - AI management systems
Backs: “ISO/IEC 42001:2023 (AI management systems) is the first certifiable AI governance standard; some organizations now use it to demonstrate process accountability for AI.”
evidence, reference entry. Claim: ISO/IEC 42001:2023 is the first certifiable AI management system standard.