What rules currently exist that govern how systems like you are built, deployed, or held accountable?
Short answer: it’s a patchwork. “Rules for AI” today combine (a) general laws that apply to any software or data processing, (b) AI‑specific statutes and regulations in some jurisdictions, (c) sector regulators using existing powers, and (d) voluntary standards that many organizations adopt.
Here are the main buckets, with what’s in force now and what’s coming next.
United States (federal)
United States (state and local)
European Union
United Kingdom
China
Cross‑cutting standards and “soft law” that many organizations follow
What this means in practice for systems like me
If you tell me the sectors and geographies you care about (e.g., hiring in New York, lending in Colorado, or consumer apps in the EU), I can map the exact obligations, effective dates, and action checklist.
Citations (21)
- Removing Barriers to American Leadership in Artificial Intelligence – The White House
Backs: “These orders mostly bind federal agencies, not private companies, but they steer procurement and federal use.”
- FTC Seeks Public Comment on Policy Statement Addressing AI Accuracy | Federal Trade Commission
Backs: “FTC: enforces Section 5 (unfair/deceptive acts), has warned about deceptive AI claims and sought comment on an AI accuracy policy statement in 2026.”
- Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms | Consumer Financial Protection Bureau
Backs: “CFPB: says lenders using “black‑box” models still must give specific adverse‑action reasons under ECOA/Reg B. It’s reiterated this across circulars and guidance.”
- 2023 Annual Performance Report | U.S. Equal Employment Opportunity Commission
Backs: “EEOC/DOJ: remind employers that Title VII and the ADA apply when using automated hiring/screening tools.”
- Federal Communications Commission FCC 24-84
Backs: “FCC: declared in Feb 2024 that AI‑generated (cloned) voices fall under the TCPA’s “artificial or prerecorded voice,” tightening robocall rules.”
- SB24-205 Consumer Protections for Artificial Intelligence | Colorado General Assembly
Backs: “Imposes duties on developers and deployers of “high‑risk” AI used for consequential decisions (risk management, notices, incident reporting), with AG rulemaking and enforcement; core obligations phase in, with rulemaking underway.”
- California Finalizes Regulations to Strengthen Consumers' Privacy
Backs: “Provide consumer access and opt‑out rights, plus risk‑assessment and audit duties for covered businesses.”
- Subchapter 25: Automated Employment Decision Tools
Backs: “Requires an independent bias audit within the prior year and candidate/employee notices before using AEDTs for hiring/promotion. Accompanied by detailed DCWP rules and FAQs.”
- Attorney General’s Office files finalized Colorado Privacy Act rules - Colorado Attorney General | Colorado Attorney General
Backs: “General state privacy laws (e.g., Colorado, Connecticut, Virginia) give consumers rights to opt out of profiling/automated decisions with “legal or similarly significant effects,” and require impact assessments in some cases.”
- AI Act enters into force
Backs: “Expect conformity assessments, risk management, data governance, transparency, and incident reporting for “high‑risk” systems.”
- The enforcement framework under the Digital Services Act | Shaping Europe’s digital future
Backs: “Since February 17, 2024 (and earlier for designated VLOPs/VLOSEs), large platforms must assess and mitigate systemic risks, provide recommender‑system transparency, and enable non‑profiling feeds—rules that bite when AI drives curation/ads.”
- EUR-Lex - 02016R0679-20160504 - EN - EUR-Lex
Backs: “Gives people a right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects, plus “meaningful information about the logic involved.” Recent CJEU rulings clarified explanation rights.”
- Liability for defective products - Internal Market, Industry, Entrepreneurship and SMEs
Backs: “The revised EU Product Liability Directive (Directive (EU) 2024/2853) entered into force December 8, 2024 and must be transposed by December 9, 2026; it explicitly covers software and AI systems and strengthens no‑fault remedies for harm from defective products.”
- AI regulation: a pro-innovation approach - GOV.UK
Backs: “No single AI statute; the UK pursues a “pro‑innovation” framework via existing regulators guided by cross‑cutting principles, and has stood up an AI Safety Institute to develop and share evaluation methods.”
- 互联网信息服务算法推荐管理规定_中央网络安全和信息化委员会办公室
Backs: “Binding national rules govern algorithms and generative AI: the 2022 Provisions on Algorithmic Recommendation, and 2023 Interim Measures for Generative AI Services require, among other things, filings/recordals, security and data‑source requirements, transparency, and tagging of synthetic content per deep‑synthesis…”
- AI Risk Management Framework | NIST
Backs: “NIST AI Risk Management Framework (AI RMF 1.0, Jan 2023) with a Generative AI Profile (July 26, 2024) is widely used in risk programs and vendor assessments (especially in the U.S.).”
- ISO/IEC 42001:2023 - AI management systems
Backs: “ISO/IEC 42001:2023 is the first certifiable AI Management System standard; organizations can be audited and certified against it, similar to ISO 27001 for security.”
- What are the OECD Principles on AI? | OECD
Backs: “OECD AI Principles (2019, with 2024 refresh materials) and G7 Hiroshima Process International Code of Conduct (Oct 30, 2023) underpin many corporate AI governance commitments and reporting frameworks.”
- C2PA Specifications :: C2PA Specifications
Backs: “Content provenance/watermarking: the C2PA technical specification is becoming a common way to attach content credentials to AI‑generated media.”
- Subchapter T: Automated Employment Decision Tools
Backs: “Fairness and non‑discrimination: anti‑bias duties and audits in employment contexts (NYC LL 144) and enforcement under existing civil‑rights and consumer‑finance laws (EEOC, CFPB, FTC).”
- Artificial Intelligence | Federal Trade Commission
Backs: “Accountability/liability: regulators can sanction unfair/deceptive practices or discriminatory outcomes, and in the EU, product‑liability reforms explicitly include software/AI for no‑fault claims.”