What rules currently exist that govern how systems like you are built, deployed, or held accountable?
A fragmented but growing set of binding laws, voluntary frameworks, standards, and applications of existing legal regimes (e.g., tort/product liability, data protection, consumer protection) govern the building (development/training), deployment (placing on the market/use), and accountability of AI systems like large language models and general-purpose AI.[1]
There is no single global regime. The EU has the most comprehensive binding horizontal regulation. The US relies primarily on executive actions, voluntary federal frameworks (with growing state laws and existing liability rules), while China uses sector-specific measures. International soft law and standards provide shared principles. Accountability generally falls on developers/providers and deployers/users (AI itself has no legal personhood), via fines, civil liability, incident reporting, audits, and transparency requirements. Rules emphasize risk-based approaches, with stricter duties for high-risk or frontier systems.[2]
European Union: AI Act (Regulation (EU) 2024/1689, as amended)
This is the world’s first comprehensive binding AI law (in force since August 2024, with phased application). It takes a risk-based approach applying extraterritorially to systems placed on the EU market or used there.[3][3]
Related: Updated Product Liability Directive (from late 2026) extends no-fault liability to software/AI as products.[7]
United States
No comprehensive federal AI statute. Policy emphasizes innovation with voluntary measures and existing laws; recent executive actions seek to limit “onerous” state laws and promote leadership.[8]
China
Sectoral/administrative measures rather than one comprehensive law (draft AI Law status unclear). Focus on generative AI, content, security, and exports.[14]
Other Notable Jurisdictions
International Soft Law, Standards, and Principles
These are non-binding but influential and often referenced in procurement/compliance:
Cross-Cutting Themes for Building, Deployment, and Accountability
Landscape evolves rapidly (phased deadlines, amendments like EU Omnibus, new state bills, export controls). Organizations often map to the strictest applicable rules (e.g., EU + CA frontier + ISO/NIST for global ops) and maintain inventories, named owners, risk assessments, and evidence. This is not legal advice—consult counsel for specifics, as applicability depends on system type, location of users/effects, compute/scale, and use case.
Citations (19)
- https://nhimg.org/global-ai-regulation-map
Backs: “A fragmented but growing set of binding laws, voluntary frameworks, standards, and applications of existing legal regimes (e.g., tort/product liability, data protection, consumer protection) govern the building (development/training), deployment (placing on the market/use), and accountability of AI systems like large…”
- https://montague.law/ai-agent-law/
Backs: “Rules emphasize risk-based approaches, with stricter duties for high-risk or frontier systems.”
- https://eur-lex.europa.eu/EN/legal-content/summary/rules-for-trustworthy-artificial-intelligence-in-the-eu.html
Backs: “It takes a risk-based approach applying extraterritorially to systems placed on the EU market or used there.”
- https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
Backs: “Practices like social scoring, subliminal/manipulative techniques causing harm, exploitation of vulnerabilities, untargeted facial recognition scraping, most real-time remote biometric ID in public by law enforcement, emotion recognition in workplaces/schools (with limited exceptions), and (from Dec 2026) generating…”
- https://nhimg.org/eu-ai-act-compliance-guide
Backs: “Deadlines: most high-risk from Dec 2027 (Annex III) or Aug 2028 (product-embedded).”
- https://www.actuia.com/en/news/ai-act-obligations-in-force-and-delays-under-omnibus-2026-1744/
Backs: “Chatbots must disclose AI interaction; generative AI outputs need machine-readable marking (and visible labels for deepfakes/public-interest text). Applies from Aug 2026.”
- https://aisigil.com/ai-liability/
Backs: “Updated Product Liability Directive (from late 2026) extends no-fault liability to software/AI as products.”
- https://www.whitehouse.gov/presidential-actions/2025/12/eliminating-state-law-obstruction-of-national-artificial-intelligence-policy/?query-11-page=9&_hsenc=p2ANqtz-8ESPfq2zGpSIkPYV9D6Cnc4EMWVEM0zNhcQDHHC5JNegZopGIl3wH2tJx3UfNcFBkSFfgz
Backs: “Policy emphasizes innovation with voluntary measures and existing laws; recent executive actions seek to limit “onerous” state laws and promote leadership.”
- https://www.theverge.com/policy/941775/trump-ai-executive-order
Backs: “Focus on standards, evaluations, critical infrastructure security, without a new regulator.”
- https://verifywise.ai/blog/state-of-ai-governance-regulations-united-states-2026
Backs: “Used by federal contractors and as best practice. GAO accountability frameworks exist for agencies.”
- https://www.ntia.gov/issues/artificial-intelligence/ai-accountability-policy-report?mkt_tok=MTM4LUVaTS0wNDIAAAGSIHkfYmiqiv7z0yzAQwB82uL6ddj1WRtpHes9rvwgj9e_ZUj3FxPaT8Bw-H6X6Q08simszD9ZMQ0wBHQ_vUxFKz-SaSlHmaw0LYPEIryRKsKk
Backs: “NTIA and others have recommended audits, disclosures, liability clarifications.”
- https://gc.ai/blog/state-ai-laws
Backs: “AB 2013 (training data transparency), SB 942 (AI content disclosure/labeling for large generative systems). Bars “AI did it” defense in some liability contexts.”
- https://www.rand.org/pubs/research_reports/RRA3084-1.html
Backs: “Professional rules (e.g., ABA for lawyers) require competence/supervision.”
- https://www.deep-lex.com/ai-regulation-tracker/china
Backs: “Sectoral/administrative measures rather than one comprehensive law (draft AI Law status unclear). Focus on generative AI, content, security, and exports.”
- https://southwardtech.com/china-draft-ai-export-controls-guide/
Backs: “Restrictions on advanced models (e.g., high compute/parameters/capabilities), data, etc.”
- https://www.lesswrong.com/posts/TKcjrvcMuY7Ca7Ya9/china-ai-safety-regulation-monthly-monitor-issue-1-september
Backs: “CAC and others enforce; penalties, incident reporting; courts apply reasonable care/disclosure standards. Officials accountable for investment risks.”
- https://everyailaw.com/regulation/kr-ai-basic-act/
Backs: “Risk assessments and safety/transparency for high-impact (life/safety/rights-affecting domains like employment, healthcare, biometrics) and generative AI; high-performance (e.g., ~10^26 FLOPs) safety duties; local representative for some foreign operators; national governance bodies. Grace periods for some enforcement.”
- https://aisigil.com/oecd-ai-principles/
Backs: “Inclusive growth, human rights/fairness/privacy, transparency/explainability, robustness/security/safety, accountability. Influences many national rules.”
- https://aipolicytracker.org/policies/iso-iec-42001-2023-ai-management-system
Backs: “Certifiable AI Management System standard (Plan-Do-Check-Act; risk/impact assessment, policy, controls for data/transparency/oversight/third parties). Maps well to EU Act/NIST/OECD.”