What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Short answer: There isn’t one single “AI law.” Today’s guardrails are a stack of binding laws, regulator rules and guidance, government procurement policies, export controls, and voluntary standards. Here’s the landscape as of October 17, 2026.

Global and regional baselines

•OECD AI Principles (2019, updated 2024) underpin many countries’ policies (human-centered, transparency, robustness, accountability). Not binding, but widely referenced.[1]

•Council of Europe Framework Convention on AI (opened 2024) is the first binding international treaty on AI and human rights; countries join by signature/ratification.[2]

European Union

•EU AI Act (Regulation 2024/1689): risk-based rules with staggered dates.

•Prohibited practices (Article 5) started applying in 2025 (with some specific bans applying by Dec 2, 2026).[3]

•Obligations for providers of general‑purpose AI (GPAI) models have applied since Aug 2, 2025 (transparency, copyright policy, training‑data summary; extra duties for “systemic‑risk” models).[4]

•Transparency duties for certain AI systems (e.g., labeling AI‑generated content) apply from Aug 2, 2026 (with a short grace period for some content marking).[5]

•High‑risk AI rules start Dec 2, 2027 (stand‑alone Annex III systems), and Aug 2, 2028 (high‑risk AI embedded in regulated products).[6]

•Other EU laws often apply in parallel:

•GDPR (data protection), and the Digital Services Act (DSA) requires transparency and risk management around recommender and ad systems, especially for very large platforms/search engines.[7]

•New Product Liability Directive (2024) makes software/AI a “product” for strict‑liability claims when defective.[8]

United States (no single federal “AI Act,” but many enforceable rules)

•Federal agency use of AI: OMB Memorandum M‑25‑21 (Apr 2025) governs how federal agencies inventory, govern, and procure AI; it replaced M‑24‑10. If you sell to the U.S. government, these requirements matter.[9]

•Executive branch policy: President Biden’s EO 14110 (Oct 2023) set a whole‑of‑government AI agenda, but it was rescinded in Jan 2025; subsequent White House policy emphasized agency AI adoption and procurement alongside M‑25‑21.[10]

•Consumer protection/competition (FTC):

•The FTC polices unfair/deceptive practices (Section 5) for AI claims and behaviors (e.g., inflated “AI” marketing, manipulative design, privacy misrepresentations). In 2026 the FTC proposed and sought comment on a policy statement addressing “suppression of accuracy” and truthful outputs; the FTC’s AI portal aggregates current actions/guidance.[11]

•Credit and finance (CFPB):

•Adverse‑action notice rules under ECOA/Reg B apply even when credit decisions come from complex algorithms—firms must give specific reasons for denials.[12]

•Employment and civil rights:

•EEOC warns that AI used in hiring must comply with Title VII (adverse‑impact analysis) and ADA obligations; DOJ/ADA guidance addresses algorithmic disability discrimination in hiring.[13]

•Health/medical AI (FDA):

•AI/ML‑based Software as a Medical Device is regulated under existing device pathways; the SaMD AI/ML Action Plan and related guidance (e.g., Predetermined Change Control Plans, Good ML Practice principles) shape submissions and post‑market change control.[14]

•Copyright (U.S. Copyright Office):

•Registration of works with AI‑generated content requires disclosure; only the human‑authored elements are copyrightable. Ongoing USCO reports address digital replicas, copyrightability of AI outputs, and training‑data issues.[15]

•Export controls (Commerce/BIS):

•Tighter controls since 2022–2023 restrict exports of advanced AI chips/supercomputing items and certain related tech to specified destinations/entities.[16]

U.S. state and local rules you’re likely to feel

•New York City Local Law 144 (AEDT): requires a yearly independent bias audit before using automated employment decision tools, public posting of audit results, and candidate/employee notices.[17]

•Colorado AI Act (SB 24‑205, 2024): imposes duties of “reasonable care” and risk management for “high‑risk” AI that makes consequential decisions (with specific controller/deployer obligations and AG enforcement).[18]

•Broad privacy laws (which affect AI data pipelines) now exist in many states; California’s CCPA/CPRA and Colorado’s CPA are notable for opt‑outs, sensitive‑data rules, and enforcement by state regulators.[19]

•Voice/likeness deepfakes: Tennessee’s ELVIS Act (2024) expanded right‑of‑publicity protections to voice against AI misuse. Other states have adopted targeted deepfake or election‑ad rules.[20]

United Kingdom and Canada

•UK: No omnibus AI statute yet; the government’s “pro‑innovation” approach directs sector regulators to apply cross‑cutting AI principles. The UK AI Safety Institute (AISI) leads model evaluations and safety research; the 2023 Bletchley Declaration launched international coordination on “frontier AI.”[21]

•Canada: The proposed Artificial Intelligence and Data Act (AIDA) is the federal framework under Bill C‑27; the government has published companion materials while it advances. Until in force, existing laws (privacy, consumer protection, sectoral rules) govern.[22]

China (PRC)

•National measures regulate generative AI services (security assessments, content moderation, provenance obligations) alongside earlier rules for recommendation algorithms and “deep synthesis.”[23]

Voluntary but influential technical standards and frameworks

•NIST AI Risk Management Framework (AI RMF 1.0) and NIST AI Resource Center: widely used for governance, testing, incident response, and post‑deployment monitoring; U.S. federal buyers increasingly reference these.[24]

•ISO/IEC 42001:2023 (AI management systems) and ISO/IEC 23894:2023 (AI risk management) are becoming common asks in procurement and third‑party risk programs.[25]

What “accountability” looks like in practice

•Depending on sector/jurisdiction, expect requirements such as: documented risk and impact assessments; data‑provenance and copyright compliance; pre‑deployment testing/red‑teaming; bias and performance evaluations; transparency and user notices; human‑in‑the‑loop and appeal paths; incident reporting; post‑market monitoring; secure development and change control; and records you can show regulators, auditors, or courts. Many of these are explicit under the EU AI Act timelines above and are already enforced indirectly in the U.S. via FTC, CFPB, EEOC/DOJ, FDA, and state privacy laws.[5]

If you tell me the jurisdictions you operate in and your use case (e.g., hiring, credit, health, consumer chatbots, foundation models), I can translate this into a short, prioritized compliance to‑do list and timelines specific to you.

Citations (25)

1oecd.orgGovernment
What are the OECD Principles on AI? | OECD
Backs: “OECD AI Principles (2019, updated 2024) underpin many countries’ policies (human-centered, transparency, robustness, accountability). Not binding, but widely referenced.”
2coe.intGovernment
The Framework Convention on Artificial Intelligence - Artificial Intelligence
Backs: “Council of Europe Framework Convention on AI (opened 2024) is the first binding international treaty on AI and human rights; countries join by signature/ratification.”
3europa.euGovernment
Rules for trustworthy artificial intelligence in the EU
Backs: “Prohibited practices (Article 5) started applying in 2025 (with some specific bans applying by Dec 2, 2026).”
4europa.euGovernment
EU rules on general-purpose AI models start to apply, bringing more transparency, safety and accountability | Shaping Europe’s digital future
Backs: “Obligations for providers of general‑purpose AI (GPAI) models have applied since Aug 2, 2025 (transparency, copyright policy, training‑data summary; extra duties for “systemic‑risk” models).”
5europa.euGovernment
When does enforcement start? | AI Act Service Desk
Backs: “Transparency duties for certain AI systems (e.g., labeling AI‑generated content) apply from Aug 2, 2026 (with a short grace period for some content marking).”
6europa.euGovernment
Frequently Asked Questions | AI Act Service Desk
Backs: “High‑risk AI rules start Dec 2, 2027 (stand‑alone Annex III systems), and Aug 2, 2028 (high‑risk AI embedded in regulated products).”
7europa.euGovernment
Legal framework of EU data protection
Backs: “GDPR (data protection), and the Digital Services Act (DSA) requires transparency and risk management around recommender and ad systems, especially for very large platforms/search engines.”
8europa.euGovernment
Directive - 2024/2853 - EN - Product Liability Directive - EUR-Lex
Backs: “New Product Liability Directive (2024) makes software/AI a “product” for strict‑liability claims when defective.”
9whitehouse.govGovernment
EXECUTIVE OFFICE OF THE PRESIDENT
Backs: “If you sell to the U.S. government, these requirements matter.”
10govinfo.govGovernment
Executive Orders EO 14110
Backs: “President Biden’s EO 14110 (Oct 2023) set a whole‑of‑government AI agenda, but it was rescinded in Jan 2025; subsequent White House policy emphasized agency AI adoption and procurement alongside M‑25‑21.”
11ftc.govGovernment
Artificial Intelligence | Federal Trade Commission
Backs: “In 2026 the FTC proposed and sought comment on a policy statement addressing “suppression of accuracy” and truthful outputs; the FTC’s AI portal aggregates current actions/guidance.”
12consumerfinance.govGovernment
Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms | Consumer Financial Protection Bureau
Backs: “Adverse‑action notice rules under ECOA/Reg B apply even when credit decisions come from complex algorithms—firms must give specific reasons for denials.”
13govdelivery.comCompanies
EEOC Releases New Resource on Artificial Intelligence and Title VII
Backs: “DOJ/ADA guidance addresses algorithmic disability discrimination in hiring.”
14fda.govGovernment
Artificial Intelligence in Software as a Medical Device | FDA
Backs: “AI/ML‑based Software as a Medical Device is regulated under existing device pathways; the SaMD AI/ML Action Plan and related guidance (e.g., Predetermined Change Control Plans, Good ML Practice principles) shape submissions and post‑market change control.”
15govinfo.govGovernment
88 FR 16190 - Copyright Registration Guidance: Works Containing Material Generated by Artificial Intelligence - Content Details - 2023-05321
Backs: “Ongoing USCO reports address digital replicas, copyrightability of AI outputs, and training‑data issues.”
16doc.govGovernment
Advanced Computing and Semiconductor Manufacturing Items Controls to PRC
Backs: “Tighter controls since 2022–2023 restrict exports of advanced AI chips/supercomputing items and certain related tech to specified destinations/entities.”
17nyc.govGovernment
Automated Employment Decision Tools (AEDT) - DCWP
Backs: “New York City Local Law 144 (AEDT): requires a yearly independent bias audit before using automated employment decision tools, public posting of audit results, and candidate/employee notices.”
18colorado.govGovernment
SB24-205 Consumer Protections for Artificial Intelligence | Colorado General Assembly
Backs: “Colorado AI Act (SB 24‑205, 2024): imposes duties of “reasonable care” and risk management for “high‑risk” AI that makes consequential decisions (with specific controller/deployer obligations and AG enforcement).”
19ca.govGovernment
California Consumer Privacy Act (CCPA) | State of California - Department of Justice - Office of the Attorney General
Backs: “California’s CCPA/CPRA and Colorado’s CPA are notable for opt‑outs, sensitive‑data rules, and enforcement by state regulators.”
20tn.govGovernment
PHOTOS: Gov. Lee Signs ELVIS Act Into Law
Backs: “Other states have adopted targeted deepfake or election‑ad rules.”
21gov.ukGovernment
A pro-innovation approach to AI regulation: government response - GOV.UK
Backs: “The UK AI Safety Institute (AISI) leads model evaluations and safety research; the 2023 Bletchley Declaration launched international coordination on “frontier AI.””
22canada.caGovernment
The Artificial Intelligence and Data Act (AIDA) – Companion document
Backs: “Until in force, existing laws (privacy, consumer protection, sectoral rules) govern.”
23cac.gov.cnGovernment
生成式人工智能服务管理暂行办法_中央网络安全和信息化委员会办公室
Backs: “National measures regulate generative AI services (security assessments, content moderation, provenance obligations) alongside earlier rules for recommendation algorithms and “deep synthesis.””
24nist.govGovernment
Artificial Intelligence Risk Management Framework (AI RMF 1.0) | NIST
Backs: “NIST AI Risk Management Framework (AI RMF 1.0) and NIST AI Resource Center: widely used for governance, testing, incident response, and post‑deployment monitoring; U.S. federal buyers increasingly reference these.”
25iso.orgNonprofits and think tanks
1. Background
Backs: “ISO/IEC 42001:2023 (AI management systems) and ISO/IEC 23894:2023 (AI risk management) are becoming common asks in procurement and third‑party risk programs.”