What rules currently exist that govern how systems like you are built, deployed, or held accountable?
Rules governing AI systems like large language models (LLMs) and general-purpose AI (GPAI) are evolving rapidly, fragmented by jurisdiction, and mix binding laws, voluntary frameworks, standards, and soft law. They address the full lifecycle—design/build (data, training, risk assessment), deployment/use (transparency, oversight, prohibited uses), and accountability (liability, audits, remedies)—with a strong emphasis on risk-based approaches, human rights, safety, fairness, transparency, and innovation. No single global regime exists; most advanced systems face overlapping obligations depending on where they are developed, offered, or used.[1][2]
International and Soft-Law Frameworks
European Union (Most Comprehensive Binding Regime)
The EU AI Act (Regulation (EU) 2024/1689, entered into force August 2024, with phased application) is the world’s first comprehensive horizontal AI law. It uses a risk-based approach and applies extraterritorially to providers/deployers placing systems on the EU market or whose outputs are used there (with exemptions for military/research in some cases).[7][8][8]
Risk categories and key rules:
Governance/enforcement: AI Office, national authorities, AI Board; fines up to €35 million or 7% global turnover (prohibited practices/data issues) or lower percentages for others. AI literacy obligations, sandboxes for innovation. Supporting measures include the AI Pact (voluntary early compliance).[11]
Related EU rules:
United States
No comprehensive federal AI statute establishing broad development/deployment rules or prohibitions. Approach emphasizes innovation, voluntary frameworks, sector-specific regulation, existing laws (e.g., civil rights, FTC unfair/deceptive practices, product liability under state tort law), and executive actions. States have been more active.[15]
China
Layered, sector- and technology-specific rules (no single comprehensive AI law as of mid-2020s, though drafts and ethics guidelines exist), led by Cyberspace Administration of China (CAC) and others, underpinned by Cybersecurity Law, Data Security Law, and Personal Information Protection Law (PIPL). Emphasis on content control, security, “safe, reliable, controllable” AI, social stability, and national security.[23][24]
Key measures: Algorithmic Recommendation Provisions (filing, opt-outs, anti-discrimination); Deep Synthesis Provisions (labeling/watermarking synthetic media, real-name, consent); Interim Generative AI Measures (2023: training data legality/quality, content moderation, security assessments, user protection for public services); AI-generated content labeling measures (explicit/implicit marks, 2025); rules on anthropomorphic/interactive AI, facial recognition, ethics reviews. Providers face filing, security assessments, real-name requirements, and content responsibilities. Local rules (e.g., Shanghai, Shenzhen, Beijing) promote industry while adding governance. Judicial guidance (e.g., Supreme People’s Court opinions) addresses liability, IP, data in AI disputes. Export controls and “AI Plus” initiatives also apply.[23][25]
Standards and Industry/Self-Regulation
Accountability and Liability
Application to Systems Like Me (GPAI/LLMs/Chatbots)
Transparency rules (disclose AI nature; label synthetic content) are common and increasingly mandatory (EU, China, some US states). High-risk obligations trigger mainly if deployed in covered use cases (e.g., hiring, credit, justice). GPAI-specific rules (EU) and voluntary frameworks (NIST) emphasize safety testing, risk mitigation for systemic capabilities, data provenance/copyright, and robustness. Training data practices face privacy (GDPR/PIPL), IP, and quality rules. Deployment accountability often falls on the user/deployer for specific applications, with providers responsible for base model safety/docs. National security/export rules can restrict advanced capabilities.
Overall trends and caveats: Regulation is risk- and use-case-based rather than technology-banning in most places (except prohibited practices). Focus is growing on frontier/systemic risks, generative content authenticity, automated decisions, and accountability chains. Implementation is phased, with guidance, sandboxes, and standards easing compliance. Rules change quickly—check official sources (e.g., EUR-Lex, NIST, CAC, Congress.gov) for the latest, as amendments (e.g., EU Omnibus delays) and new state/federal actions occur frequently. Companies often adopt “highest common denominator” compliance or voluntary best practices. Sectoral rules (finance, health, transport) and general laws always layer on top.
Citations (27)
- https://www.techtarget.com/ai/tip/Global-AI-legislation-and-regulation-tracker
Backs: “No single global regime exists; most advanced systems face overlapping obligations depending on where they are developed, offered, or used.”
- https://law.washu.edu/ai-policy-and-regulation-resources/all-ai-regulations-by-jurisdiction/
Backs: “No single global regime exists; most advanced systems face overlapping obligations depending on where they are developed, offered, or used.”
- https://www.oecd.org/en/topics/ai-principles.html
Backs: “Widely influential (e.g., definitions adopted in EU AI Act and elsewhere); adherents include OECD members, the EU, and others.”
- https://verityai.co/blog/oecd-ai-principles-guide
Backs: “Widely influential (e.g., definitions adopted in EU AI Act and elsewhere); adherents include OECD members, the EU, and others.”
- https://www.coe.int/en/web/artificial-intelligence/the-framework-convention-on-artificial-intelligence
Backs: “Signatories include the EU, US, UK, Canada, Japan, and others; excludes pure national defense/research in some cases. Monitored via Conference of the Parties.”
- https://www.whitecase.com/insight-our-thinking/ai-watch-global-regulatory-tracker-g7
Backs: “UNESCO Recommendation on the Ethics of AI; various UN efforts. These promote interoperability but lack direct enforcement.”
- https://eur-lex.europa.eu/EN/legal-content/summary/rules-for-trustworthy-artificial-intelligence-in-the-eu.html
Backs: “It uses a risk-based approach and applies extraterritorially to providers/deployers placing systems on the EU market or whose outputs are used there (with exemptions for military/research in some cases).”
- https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
Backs: “It uses a risk-based approach and applies extraterritorially to providers/deployers placing systems on the EU market or whose outputs are used there (with exemptions for military/research in some cases).”
- https://artificialintelligenceact.eu/high-level-summary/
Backs: “High-risk rules for stand-alone systems largely from December 2027 (after delays via Omnibus amendments); product-embedded later.”
- https://www.actuia.com/en/news/ai-act-obligations-in-force-and-delays-under-omnibus-2026-1744/
Backs: “High-risk rules for stand-alone systems largely from December 2027 (after delays via Omnibus amendments); product-embedded later.”
- https://djei.ie/en/what-we-do/innovation-research-development/artificial-intelligence/eu-ai-act/
Backs: “Supporting measures include the AI Pact (voluntary early compliance).”
- https://aisigil.com/ai-liability/
Backs: “Applies to products placed on market from ~9 December 2026; eases claimant burdens via disclosure. The separate AI Liability Directive proposal was withdrawn.”
- https://eur-lex.europa.eu/EN/legal-content/summary/defective-products-liability.html
Backs: “Applies to products placed on market from ~9 December 2026; eases claimant burdens via disclosure. The separate AI Liability Directive proposal was withdrawn.”
- https://digital.nemko.com/insights/a-pivotal-year
Backs: “Applies to products placed on market from ~9 December 2026; eases claimant burdens via disclosure. The separate AI Liability Directive proposal was withdrawn.”
- https://www.congress.gov/crs-product/R48555
Backs: “Approach emphasizes innovation, voluntary frameworks, sector-specific regulation, existing laws (e.g., civil rights, FTC unfair/deceptive practices, product liability under state tort law), and executive actions. States have been more active.”
- https://www.whitehouse.gov/fact-sheets/2025/01/fact-sheet-president-donald-j-trump-takes-action-to-enhance-americas-ai-leadership/?query-11-page=121&trk=article-ssr-frontend-pulse_little-text-block
Backs: “Focus shifted toward innovation, research investment, and reducing perceived over-regulation.”
- https://airc.nist.gov/airmf-resources/airmf/
Backs: “Emphasizes trustworthy characteristics (valid/reliable, safe, secure/resilient, accountable/transparent, explainable/interpretable, privacy-enhanced, fair with bias managed). Widely used; updates ongoing.”
- https://www.nist.gov/itl/ai-risk-management-framework
Backs: “Emphasizes trustworthy characteristics (valid/reliable, safe, secure/resilient, accountable/transparent, explainable/interpretable, privacy-enhanced, fair with bias managed). Widely used; updates ongoing.”
- https://ailawsusa.com/compliance/colorado-ai-act/
Backs: “Colorado’s original broad “high-risk” AI Act (duty of care against algorithmic discrimination, assessments) was repealed/replaced in 2026 by a narrower Automated Decision-Making Technology (ADMT) law (effective ~2027) focused on notices, disclosures for consequential decisions, documentation, and consumer rights…”
- https://legalclarity.org/ai-accountability-regulations-enforcement-and-governance/
Backs: “Colorado’s original broad “high-risk” AI Act (duty of care against algorithmic discrimination, assessments) was repealed/replaced in 2026 by a narrower Automated Decision-Making Technology (ADMT) law (effective ~2027) focused on notices, disclosures for consequential decisions, documentation, and consumer rights…”
- https://www.congress.gov/bill/118th-congress/senate-bill/3312/text
Backs: “Existing laws apply for discrimination, consumer protection, and liability.”
- https://www.commerce.senate.gov/press/dem/release/cantwell-outlines-comprehensive-governance-framework-for-safe-and-secure-frontier-ai/
Backs: “Existing laws apply for discrimination, consumer protection, and liability.”
- https://reg-intel.com/china-ai-regulation-2026-every-law-rule-and-draft-in-one-place/
Backs: “Emphasis on content control, security, “safe, reliable, controllable” AI, social stability, and national security.”
- https://intelligence.dlapiper.com/artificial-intelligence?c=CN
Backs: “Emphasis on content control, security, “safe, reliable, controllable” AI, social stability, and national security.”
- https://legalclarity.org/what-is-chinas-ai-law-regulations-and-requirements/
Backs: “Judicial guidance (e.g., Supreme People’s Court opinions) addresses liability, IP, data in AI disputes. Export controls and “AI Plus” initiatives also apply.”
- https://iso-library.com/standard/42001/
Backs: “Applicable to developers, providers, and users of any size/sector; often used to demonstrate governance aligning with laws like the EU AI Act. Related standards cover terminology, risk, etc.”
- https://www.iso.org/standard/81230.html
Backs: “Applicable to developers, providers, and users of any size/sector; often used to demonstrate governance aligning with laws like the EU AI Act. Related standards cover terminology, risk, etc.”