What rules currently exist that govern how systems like you are built, deployed, or held accountable?
Short answer: it’s a patchwork. Depending on where you build and what you deploy, different binding laws, sector rules, and voluntary standards apply. Here’s the “what’s in force now” snapshot as of October 19, 2026.
AI‑specific laws and duties
Cross‑cutting privacy, consumer protection, and anti‑discrimination rules that constrain AI use
Platform and content rules touching AI systems
High‑risk sectors with dedicated guidance or approval pathways
Government use of AI (US)
Widely used standards and frameworks (often referenced in contracts and audits)
If you tell me your jurisdiction(s), sector (e.g., hiring, healthcare, finance, education), and whether you develop foundation models or deploy third‑party tools, I can turn this into a concrete, jurisdiction‑specific compliance checklist.
Citations (18)
- AI Act enters into force
Backs: “The revised Product Liability Directive now expressly covers software and AI and will apply to products placed on the market from Dec 9, 2026.”
- SB24-205 Consumer Protections for Artificial Intelligence | Colorado General Assembly
Backs: “California finalized CCPA regulations that add Automated Decisionmaking Technology (ADMT) rights, audits, and risk assessments effective Jan 1, 2026 (with some ADMT compliance deadlines into 2027).”
- Translation: Internet Information Service Algorithmic Recommendation Management Provisions – Effective March 1, 2022
Backs: “Algorithm Recommendation Provisions (effective Mar 1, 2022), Deep Synthesis Provisions (effective Jan 10, 2023), and the Interim Measures for Generative AI (effective Aug 15, 2023).”
- Information for individuals - European Commission
Backs: “22) and grants explanation/contestation rights; regulators have reiterated how this interacts with platform and moderation duties.”
- Joint Statement on Enforcement Efforts Against Discrimination and Bias in Automated Systems | Federal Trade Commission
Backs: “The EEOC and DOJ have warned that AI in hiring must comply with federal civil‑rights laws; the EEOC issued technical assistance on adverse impact.”
- Federal Register, Volume 90 Issue 76 (Tuesday, April 22, 2025)
Backs: “FERPA governs access/use/disclosure of student education records in the US.”
- Illinois General Assembly - Illinois Compiled Statutes - Full Text
Backs: “Illinois’ Biometric Information Privacy Act (BIPA) requires consent, policies, and provides a private right of action; major facial‑recognition settlements (e.g., Clearview) have been enforced under BIPA.”
- Prorogation puts Parliament on hold
Backs: “Organizations rely on PIPEDA and provincial laws (e.g., Québec’s Law 25, which adds automated‑decision notice and review rights).”
- How the Digital Services Act enhances transparency online | Shaping Europe’s digital future
Backs: “Very large platforms/search engines must assess and mitigate systemic risks tied to recommender systems, undergo annual independent audits, offer a non‑profiling option, and provide recommender transparency.”
- AI in Elections: A Look at the Federal and State Legislative Landscape
Backs: “California’s regime requires a standardized “Ad generated or substantially altered using artificial intelligence” disclosure on covered political ads.”
- Guidelines on transparency obligations for providers and deployers of certain AI systems | Shaping Europe’s digital future
Backs: “Adds disclosure requirements for certain generative/interactive AI and for synthetic/deepfake content starting Aug 2, 2026, with Commission guidance for implementation.”
- Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions | FDA
Backs: “FDA finalized guidance on Predetermined Change Control Plans (PCCPs) for AI‑enabled device software functions, enabling regulated updates while maintaining safety/effectiveness.”
- Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms | Consumer Financial Protection Bureau
Backs: “Beyond ECOA/Reg B notices, financial regulators continue supervision around model risk, transparency, and fair lending when AI is used.”
- Automated Employment Decision Tools (AEDT) - DCWP
Backs: “Bias audits/notices in NYC; federal EEO laws apply to AI‑assisted screening/selection nationwide.”
- iii. sharing technical resources for implementation of this memorandum’s risk management practices, such as for testing, continuous monitoring, and evaluation; and
Backs: “The memo remains the operative federal management policy even as broader executive policy has changed.”
- AI Risk Management Framework | NIST
Backs: “NIST also published secure‑development practices for gen‑AI/foundation models aligned to SSDF.”
- ISO/IEC 23894:2023 - AI — Guidance on risk management
Backs: “ISO/IEC 42001 (AI management systems) and ISO/IEC 23894 (AI risk management) are the leading international standards organizations certify or map against.”
- What are the OECD Principles on AI? | OECD
Backs: “OECD AI Principles (2019, updated materials published since) and the G7 Hiroshima Process (2023) provide widely cited, voluntary guardrails (including a voluntary Code of Conduct for advanced AI developers).”