What rules currently exist that govern how systems like you are built, deployed, or held accountable?
Great question, and one that's genuinely complex because the regulatory landscape is still taking shape and varies significantly by jurisdiction. Let me search for current information to give you an accurate picture.The regulatory landscape for AI systems like me is a genuine patchwork right now — nothing like the unified, long-settled frameworks that exist for industries like pharmaceuticals or aviation. Here's what actually exists as of late 2026:
1. The EU AI Act — the most comprehensive binding law
This is the first comprehensive regulation on AI by a major regulator anywhere, and it takes a risk-based approach: the stricter the potential harm an AI system could cause, the heavier its regulatory requirements. It sorts systems into tiers: applications that create an unacceptable risk, such as government-run social scoring, are banned; high-risk applications, such as a CV-scanning tool that ranks job applicants, are subject to specific legal requirements; and applications not explicitly banned or listed as high-risk are largely left unregulated.
For a system like me specifically, two parts matter most:
High-risk systems (not typically chatbots, but things like hiring or credit-scoring tools) face much heavier obligations: a documented risk management system, robust data governance measures, detailed technical documentation, automatic logging, appropriate human oversight, and safeguards for accuracy, robustness, and cybersecurity. Penalties for violations can reach €35 million or 7% of global annual turnover, whichever is higher.
The Act is also still being actively amended — in May 2026, the EU provisionally agreed material changes to it through the "Digital Omnibus on AI," involving a significant postponement of compliance deadlines.
2. United States — no federal law, a messy state/federal split
The United States has no comprehensive federal AI statute. Instead, federal AI governance has been shaped by a series of executive orders, alongside agency guidance, voluntary frameworks, and a growing wave of state-level laws.
Federal executive actions: The Trump administration has pushed to limit state-level regulation while adding narrower security-focused rules:
State laws (currently the real binding rules for most US-based AI activity):
3. Voluntary / soft-law frameworks
These aren't legally binding but function as de facto industry standards and are often referenced in actual laws:
The bottom line
There is no single, settled rulebook. Instead there's: one binding comprehensive law (EU AI Act, still being amended); a US federal vacuum filled by executive orders pulling in a deregulatory/national-security direction while actively trying to preempt state laws; a handful of binding state laws (mainly California's frontier-transparency requirements) that currently represent the most concrete accountability mechanism for companies building large models; and a layer of voluntary frameworks (NIST, G7, ISO) that many companies use as internal governance scaffolding even without legal compulsion. Given how quickly this is shifting — deadlines moving, laws being repealed and replaced within months — any snapshot like this one has a short shelf life.
Citations (26)
- EU Artificial Intelligence Act
Source excerpt: “The AI Act is a European regulation on artificial intelligence (AI) – the first comprehensive regulation on AI by a major regulator anywhere. ”
- EU AI Act Summary: Complete Guide 2026 & PDF Available
Source excerpt: “The Act takes a risk-based approach: the stricter the potential harm an AI system could cause, the heavier its regulatory requirements. ”
- EU Artificial Intelligence Act
Source excerpt: “First, applications and systems that create an **unacceptable risk**, such as government-run social scoring of the type used in China, are banned. Sec...”
- EU AI Act 2026 Updates: Compliance Requirements and Business Risks
Source excerpt: “Both providers and deployers are required that users are informed clearly when they interact with AI (Article 50(1)), when content is artificially gen...”
- The EU AI Act
Source excerpt: “### 2 August 2026 – most transparency obligations apply Providers of AI systems intended to interact directly with people, or which generate synthetic...”
- AI regulatory compliance in 2026: EU AI Act, US orders, and state laws, and how to operationalize them
Source excerpt: “Obligations on general-purpose AI models began in August 2025, with the Commission's enforcement powers over those providers arriving in August 2026 a...”
- EU AI Act 2026: New Rules for Training Data and Copyright
Source excerpt: “Public Disclosure of Training Data Every provider of a **general-purpose AI model** including large language models will be required to publish a **pu...”
- EU AI Act 2026 Updates: Compliance Requirements and Business Risks
Source excerpt: “# EU AI Act 2026 Updates: Compliance Requirements and Business Risks ## Obligations for providers and deployers of High-risk AI systems Providers of H...”
- EU AI Act Summary: Complete Guide 2026 & PDF Available
Source excerpt: “The maximum fine for violations is **€35 million or 7% of global annual turnover**, whichever is higher. ”
- The EU AI Act
Source excerpt: “Within the space of a few weeks, in May 2026, the EU provisionally agreed material changes to it through the Digital Omnibus on AI (see our previous b...”
- Federal AI Policy & Executive Orders Tracker 2026 (US Updates)
Source excerpt: “Updated Daily No Comprehensive Federal AI Law (Yet) AI Executive Order Tracker Meanwhile at the state level: **—** AI bills published **—** states wi...”
- New State AI Laws are Effective on January 1, 2026, But a New Executive Order Signals Disruption
Source excerpt: “The executive order, titled “Ensuring a National Policy Framework for Artificial Intelligence” (the “**Executive Order**”), proposes to establish a un...”
- Executive Order Issued to Restrict State Regulation of AI
Source excerpt: “Client Alerts - Telecommunications *January 23, 2026* # Executive Order Issued to Restrict State Regulation of Artificial Intelligence # Executive ...”
- 2026 AI Compliance: Upcoming Laws Every Organization Needs to Know
Source excerpt: “### Key Provisions - Developers of “covered frontier models” (a threshold to be set through a classified benchmarking process) may provide the federal...”
- New executive order shifts US AI policy toward national security
Source excerpt: “The US attorney general is directed to prioritize enforcement of federal criminal statutes against anyone who uses AI to illegally access or damage co...”
- AI legislation in the US: A 2026 overview - SIG
Source excerpt: “## The federal vs. state battle: preemption On March 20, 2026, the White House released a National Policy Framework for Artificial Intelligence, urgin...”
- IP & Technology Law Trends
Source excerpt: “Finally, the Transparency in Frontier Artificial Intelligence Act (TFAIA) requires large AI companies in **California** that build and train AI models...”
- IP & Technology Law Trends
Source excerpt: “It also gives the state the power to obtain civil penalties up to $1 million per violation and requires periodic reporting and oversight. ”
- IP & Technology Law Trends
Source excerpt: “Its stated purposes are to advance the responsible development and use of AI systems, provide transparency around and protect individuals from risk, a...”
- US AI regulations 2026: the state laws you must comply with
Source excerpt: “The final version was narrowed significantly during the legislative process. It eliminates most private sector obligations and limits compliance requi...”
- US AI regulations 2026: the state laws you must comply with
Source excerpt: “In May 2026 Colorado repealed and replaced the law with SB 26-189, a narrower statute regulating automated decision-making technology (ADMT) that mate...”
- 5 Key AI Risk Management Frameworks for Enterprises
Source excerpt: “The NIST AI Risk Management Framework (AI RMF) is a voluntary resource developed by the U.S. National Institute of Standards and Technology. ”
- 5 Key AI Risk Management Frameworks for Enterprises
Source excerpt: “The NIST AI RMF The NIST AI Risk Management Framework (AI RMF) is a voluntary resource developed by the U.S. National Institute of Standards and Tec...”
- Top 5 AI Risk Management Frameworks You Should Know Before the AIGP Exam
Source excerpt: “NIST AI Risk Management Framework (AI RMF)** The NIST AI RMF Core outlines four functions: Govern, Map, Measure, and Monitor/Manage, to address AI ri...”
- G7 AI Regulation Overview
Source excerpt: “## Regulatory Approach The G7 framework adopts a soft-law, voluntary regulatory approach structured around 11 International Guiding Principles and an ...”
- G7 AI Regulation Overview
Source excerpt: “The framework prioritizes high-impact risk areas, including chemical, biological, radiological, and nuclear (CBRN) weapon risks, cyberattack enhanceme...”