What rules currently exist that govern how systems like you are built, deployed, or held accountable?

What governs how AI systems are built and deployed? I'll survey the current rules on accountability.

Rules governing systems like AI assistants are evolving rapidly and vary by jurisdiction. There is no single global law - instead a layered set of binding laws, voluntary frameworks, and sectoral/state rules:

1. European Union - AI Act - Most Comprehensive, Risk-Based Law

The EU AI Act is described as the first comprehensive regulation governing AI systems, published July 2024 and effective since August 2024, and as the primary legislative framework that regulates the development and use of artificial intelligence in the European Union. It applies to providers and developers inside and outside the EU if systems are intended to be used in the EU.

It uses a risk-based classification system:

Despite a broad scope and definition of AI systems, the Act reserves its main obligations to only a subset to balance innovation with mitigation of risks, specifically (i) unacceptable risk, (ii) high-risk and (iii) limited risk.

Implementation is phased:

What high-risk and deployer obligations entail:

High-risk systems are subject to regulatory requirements, including:

This framework considers both providers who make high-risk systems available and deployers who use AI systems inside their organization - deployers must monitor operation and keep logs. Deployers must also ensure input data is relevant and sufficiently representative, monitor operation and report risks and incidents to the provider, with record keeping and transparency obligations vis-à-vis workers.

General Purpose AI (GPAI) / Foundation models - e.g. large language models like GPT-4o, Gemini, Claude:

GPAI models capable of a broad range of tasks must provide technical documentation, comply with copyright, and publish training data summaries. All GPAI providers must prepare technical documentation, comply with EU copyright law, and make certain information available to deployers.

Providers of GPAI models that exceed 10^25 FLOPs of training compute, or that reach more than 10,000 registered business users, face obligations including model evaluations, documented adversarial testing, and direct incident reporting to the AI Office. Systemic-risk models face additional obligations including model evaluation, adversarial testing, incident reporting.

Accountability and penalties:

Other EU laws also affect AI: General Data Protection Regulations (GDPR) regulate data processing relevant to many AI systems, the updated Product Liability Directive classifies AI systems as products, making developers liable if defective AI products cause harm, plus a proposed AI Liability Directive.

2. United States - No Single Federal Law, Patchwork of Voluntary Frameworks and State Laws

In the US there is no single federal AI law; a patchwork applies:

The NIST AI Risk Management Framework is a voluntary framework, published in January 2023. Its core has four functions: Govern sets policies and accountability, Map establishes context and risks, Measure analyzes and tracks those risks, and Manage prioritizes and acts. The Govern function establishes accountability, policies, risk appetite, decision rights, and oversight mechanisms.

The 2022 Blueprint for an AI Bill of Rights is not an enforceable law but outlines five principles: safe and effective systems, algorithmic discrimination protection, data privacy, notice and explanation, and human alternatives and fallback.

State laws - where most binding US rules currently exist:

As of July 2026, at least 5 states have comprehensive AI laws either in force or effective January 1, 2027 — California, Colorado, Texas, New York, and Illinois — alongside a patchwork of 40+ narrower laws on deepfakes, hiring, and chatbots. 145 AI bills became law across all 50 states in 2025.

Federal direction shifting:

The Trump administration released a federal AI legislative framework outlining seven innovation-focused objectives that would preempt state-level AI regulations across the US. It proposes non-binding platform accountability expectations and avoids enforceable requirements for misinformation or election interference. On December 11, 2025, President Trump signed an executive order directing the Attorney General to establish within 30 days an AI Litigation Task Force whose sole responsibility shall be to challenge State AI laws inconsistent with minimally burdensome regulation.

Pending federal bills include the AI Accountability Act (H.R.1694) which would require NTIA to study accountability measures including audits, assessments, and certifications, and the bipartisan AI Agent Accountability Act which would hold AI agent operators and developers criminally and civilly liable for hacking damage.

3. China - Layered, Binding Rules for Specific AI Types

China has built a layered set of AI regulations targeting specific categories:

Organizations deploying AI in China face mandatory registration, security reviews, content filtering, data localization, and regular reporting, with enforcement including service suspension, fines up to 10% of annual revenue, and criminal liability. DST must fulfill permitting requirements including securing a license from Ministry of Industry and Information Technology.

4. Other Frameworks and Common Principles

Across jurisdictions, common accountability mechanisms are emerging:

If you are building or deploying a system like an AI assistant, the relevant obligations depend on where users are, what risks the system poses (e.g., employment, healthcare, biometric identification = high-risk in EU; consequential decisions = high-risk in Colorado), and whether you are a provider vs. deployer.