Rules for building and deploying AI systems are evolving fast — I'll map the current landscape of laws and accountability frameworks for you.
There is no single global law for systems like me - there are overlapping binding laws, sector-specific rules, voluntary frameworks, and general laws that still apply. Current rules can be grouped into several layers:
1. Comprehensive binding law - EU AI Act
The most comprehensive example is the EU AI Act, formally Regulation (EU) 2024/1689, described as the world's first comprehensive, legally binding AI legislation.
It uses a risk-based classification:
•tiers AI applications from unacceptable risk — prohibited outright — to high risk, which faces strict compliance obligations, to minimal risk
•categorizes AI into unacceptable, high, limited, and minimal risk, imposing strict obligations to ensure safety, transparency, and compliance
Timeline is phased:
•It entered into force on 1 August 2024
•Bans on the highest-risk applications took effect February 2, 2025
•Rules for general-purpose AI models began applying August 2, 2025and obligations for general-purpose AI models began to apply on 2 August 2025
•Obligations that landed this August cover general-purpose AI, meaning the foundation models sold by the largest labs. Providers now have to publish summaries of the data used to train those systems, document how the models work, and label AI-generated content
•Transparency obligations from August 2, 2026
•The AI Act entered into force on 1 August 2024 and will be fully applicable two years later, on 2 August 2026, with obligations for high-risk systems embedded into regulated products extended until 2 August 2027
What it governs for building, deployment and accountability:
•Prohibited practices include manipulative or deceptive AI techniques, untargeted facial data scraping, exploitative systems targeting vulnerable groups and certain forms of biometric categorization and emotion recognition
•For high-risk systems (e.g. hiring, credit, medical, policing) it requires documentation, risk management, human oversight, and conformity assessment before deployment.
•Penalties are steep: infringements of the prohibited-practices rules carry fines of up to 6% of global annual turnover, with other summaries noting up to €35 million or 7% of global annual turnover.
Systems like general-purpose chat assistants fall under the General-Purpose AI (GPAI) provider duties.
2. United States - No unified federal AI law, but layered federal + state rules
The U.S. hasn’t passed a unified federal AI law yet — but states aren’t waiting.
Federal voluntary and policy layer:
•The National Institute of Standards and Technology (NIST) released the Artificial Intelligence Risk Management Framework (AI RMF) as NIST AI 100-1, published on January 26, 2023, as voluntary
•It provides structured guidance for building trustworthy, accountable AI systemsand organizes activities into four functions: Govern, Map, Measure, and Manage
•Govern establishes a culture, policies and accountability for AI riskand specifically establishes accountability, policies, risk appetite, decision rights, and oversight mechanisms
•A core principle of the framework is Accountability: Establishing clear roles, responsibilities and governance structures for managing AI risks
•Congress directed NIST to develop a voluntary framework that could balance innovation with accountability
•Existing general laws are used for enforcement: AI capability representations are subject to Section 5 of the Federal Trade Commission Act, and Model-as-a-service companies that fail to abide by their privacy commitments may be liable under the laws enforced by the FTC
Federal legislative proposals and executive actions:
•Proposals like the Artificial Intelligence Accountability Act would require study and report on accountability measures including audits, assessments, and certifications
•EO 14179 (January 20, 2025) revoked Biden's EO 14110 and made US competitiveness the governing principle. EO 14365 (December 11, 2025) established a DOJ AI Litigation Task Force to challenge state AI laws
State patchwork - as of 2026, 25 states have enacted AI-specific legislation, including:
•Colorado AI Act (SB 205): Establishes a duty of care for developers and deployers to prevent algorithmic discrimination, creating accountability through transparency, documentation, and risk management requirements. It applies specifically to “high-risk artificial intelligence systems,” which the law defines as any AI system that “when deployed, makes, or is a substantial factor in making, a consequential decision.”
•Texas Responsible AI Governance Act (June 2025): Bans unauthorized facial recognition and mandates that AI tools be clearly disclosed in any public-facing systems
•California laws: including Transparency in Frontier Artificial Intelligence Act and California AI Accountability Act (2025), with requirements for high-risk AI systems to be updated annuallyand civil penalties under California transparency laws
3. China - Layered, sector-specific binding rules
Rather than a single statute, China issues one rule per problem area (algorithms, deep synthesis, generative AI…). Current status is described as Layered, sector-specific regulations, not a single statute: Generative AI Regulations (2023), AI Safety Governance Framework (2024), Network Data Security Management Regulations (January 2025), AI-content-labeling rules (September 2025).
Key rules:
•Interim Measures for Generative AI Services: Effective Date August 15, 2023, Regulator Cyberspace Administration of China (CAC), Scope All generative AI services offered to the public in China
•Includes requirements to Register their algorithms, Undergo security assessments, Comply with competition rules, Adhere to the training data rules
•De facto mandatory technical standard TC260-003-2024 "Basic Security Requirements for Generative AI Services" published 2024-02-29 for algorithmic filing and security assessment under the 2023 measures
•Labeling rules: The Cyberspace Administration of China together with three other agencies announced rules that will require service providers to label AI-generated material as such, either explicitly or via metadata encoded in each file, mandates both explicit and hidden labeling, coming into effect Sept 2025.
4. United Kingdom - Principles-based, regulator-led
The UK does not currently have a single cross-sector AI Act equivalent to the EU AI Act and has avoided a standalone AI law, instead empowering regulators to apply five high-level principles.
The five principles established through its AI regulatory framework are: (1) safety, security, and robustness; (2) appropriate transparency and explainability; (3) fairness; (4) accountability and governance; and (5) contestability and redress, also listed as Safety, security and robustness; Appropriate transparency and explainability; Fairness; Accountability and governance; and Contestability and redress.
Instead of a central AI watchdog, existing regulatory bodies—such as the Financial Conduct Authority (FCA) or the Information Commissioner’s Office (ICO)—apply these principles to AI. Existing laws on data protection, consumer, equality, employment, intellectual-property, and product safety can apply to an AI-assisted process now.
The UK published its White Paper “A pro-innovation approach to AI regulation” in March 2023 and finalized its AI Regulation: A Pro-Innovation Approach in March 2025.
5. International soft-law and principles
•OECD AI Principles: The OECD adopted AI Principles in 2019 aimed at sustaining trust by ensuring “explainability, transparency, accountability and robust data management.” They were agreed in May 2019 and amended in May 2024, and form the ethical foundation underlying all three frameworks discussed here.
They contain two groups:
•Five values-based principles for trustworthy, human-centric AI: inclusive growth, respect for human rights and the rule of law, transparency and explainability, robustness and safety, and accountability
•The five principles: inclusive growth; human rights & democratic values (fairness/privacy); transparency & explainability; robustness/security/safety; accountabilityalong with five policy recommendations directed at government
The Accountability principle is defined as: AI actors should be accountable for the proper functioning of AI systems and for respect of the OECD values-based principles, based on their roles, the context, and the state of the art. Every AI-impacting task should identify accountable owners, intended purpose, risk assumptions, data lineage, testing responsibilities, and post-deployment monitoring obligations.
Relatedly, the Council of Europe Framework Convention on AI, Human Rights, Democracy and the Rule of Law is binding on states that sign and ratify it.
6. International technical standards and management systems
•ISO/IEC 42001:2023: The world’s first international management-system standard for artificial intelligence, published in December 2023. It is described as an audit of your AI management system, not a badge from ISO.
•It helps support organizations in demonstrating that their AI is managed through a structured system of accountability, oversight, risk management, monitoring, and continual improvement.
•ISO 42001 recognizes that many AI failures stem not from algorithms alone, but from organizational weaknesses—such as unclear accountability, insufficient oversight, data governance gaps, or lack of ongoing monitoring
•Requirements include accountability, transparency, risk management and oversight and to demonstrate transparency in AI deployment, establish clear lines of accountability, and commit to continuous improvement.
7. General laws that already govern AI harms
Even without AI-specific statutes, existing law is applied. Experts note: Before inventing any new AI legislation, we should make sure we apply existing law properly. Consumer protection, product liability, negligence, intellectual property, privacy, and contract law already cover many harms that AI can cause or amplify.
In practice this means:
•Privacy/data protection: GDPR in EU (2016/679; applicable 2018-05-25), Personal Information Protection Law in China (effective 2021-11-01), CCPA/CPRA in California, etc.
•Intellectual property: Copyright and vicarious infringement doctrines can apply to AI companies that have “the right and ability to supervise the infringing activity”
•Liability/accountability gaps being addressed: Challenges remain including Causation: Proving that AI directly caused harm, Opacity: Understanding how AI reached a decision, Shared responsibility: Multiple actors in the AI supply chain
In summary, if you build or deploy a system like me today you may need to: document training data and model capabilities, conduct risk assessments (NIST Govern/Map/Measure/Manage or ISO 42001), ensure transparency/labeling of AI-generated content, provide human oversight and redress mechanisms, and assign a named human accountable for outcomes, while being subject to enforcement via regulators (FTC, EU market surveillance authorities, CAC) and civil liability under consumer, privacy, and IP law.