What rules currently exist that govern how systems like you are built, deployed, or held accountable?
Short answer: There isn’t a single global “AI law.” Today’s guardrails are a patchwork of binding laws and rules, sector-by-sector regulators, government procurement/use policies, and voluntary standards. Here are the ones that most concretely govern how foundation models and generative AI are built, deployed, and held to account as of October 21, 2026.
United States (federal use and sector regulators)
United States (state and local)
European Union
United Kingdom
Canada
China
Cross‑cutting standards and benchmarks used by regulators and buyers
What this means in practice
If you want, tell me your role and where you operate (e.g., U.S. private sector, selling into the EU), and I’ll map the must‑dos and dates you actually need to hit.
Citations (17)
- EXECUTIVE OFFICE OF THE PRESIDENT
Backs: “These replaced the Biden‑era M‑24‑10 and M‑24‑18 after EO 14110 was revoked on Jan 20, 2025 (EO 14148).”
- New Impersonator Rule gives FTC a powerful tool for protecting consumers and businesses | Federal Trade Commission
Backs: “FTC: applies its deception/unfairness authority to AI marketing claims and synthetic‑media harms; a 2024 impersonation rule lets FTC seek redress/civil penalties against government/business impersonation scams (aimed at deepfakes, voice clones) and a proposal extends it to impersonation of individuals.”
- Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms | Consumer Financial Protection Bureau
Backs: “CFPB has reiterated this in 2022 and 2023 circulars (applies to black‑box models).”
- Fiscal Year 2023 Agency Performance Report
Backs: “EEOC/DOJ: guidance confirms Title VII and ADA apply to algorithmic hiring/HR tools; employers can face liability for disparate impact or disability discrimination from automated screening.”
- HTI-1 Final Rule - ONC - Office of the National Coordinator for Health Information Technology
Backs: “FDA finalized guidance on “predetermined change control plans” for AI‑enabled devices to manage post‑market model updates.”
- SB24-205 Consumer Protections for Artificial Intelligence | Colorado General Assembly
Backs: “Colorado also enacted HB26‑1263 (“Conversational AI Service Operator Requirements”) with disclosure, youth‑safety and reporting obligations effective Jan 1, 2027.”
- California Finalizes Regulations to Strengthen Consumers' Privacy
Backs: “CPPA regulations effective Jan 1, 2026 add requirements for risk assessments, cybersecurity audits, and consumer rights to access/opt‑out for “automated decisionmaking technology (ADMT)”; compliance for “significant decisions” is required by Jan 1, 2027.”
- Automated Employment Decision Tools (AEDT) - DCWP
Backs: “Local Law 144 (effective July 5, 2023) requires annual independent bias audits and notices for automated employment decision tools.”
- The enforcement framework of the AI Act | Shaping Europe’s digital future
Backs: “The EU AI Office and national authorities begin enforcement in 2026.”
- Directive - 2024/2853 - EN - Product Liability Directive - EUR-Lex
Backs: “Member States must transpose by Dec 9, 2026, extending strict‑liability routes for AI‑caused harm.”
- A pro-innovation approach to AI regulation: government response - GOV.UK
Backs: “Ofcom can fine up to 10% of global revenue for serious breaches. ICO maintains detailed AI/data‑protection guidance.”
- C-27 (44-1) - LEGISinfo - Parliament of Canada
Backs: “However, the federal Directive on Automated Decision‑Making (Treasury Board) binds federal departments; updated compliance for existing systems is required by June 24, 2026 (impact assessments, testing, notice/recourse by risk level).”
- Translation: Internet Information Service Algorithmic Recommendation Management Provisions – Effective March 1, 2022
Backs: “Providers offering gen‑AI to the public must use lawful training data, label synthetic content, perform security assessments/filings, and control prohibited outputs.”
- Artificial Intelligence Risk Management Framework (AI RMF 1.0)
Backs: “AI Risk Management Framework 1.0 (with a Generative AI Profile) and ongoing profiles (e.g., critical infrastructure) are widely referenced in U.S. policy and procurement.”
- ISO/IEC 42001:2023 - AI management systems
Backs: “42001:2023 (AI management systems) is the first certifiable AI governance standard; organizations increasingly use it to demonstrate controls for risk, data, transparency, and oversight.”
- 7000-2021 - IEEE Standard Model Process for Addressing Ethical Concerns during System Design | IEEE Standard | IEEE Xplore
Backs: “7000/7010 and related standards provide processes for embedding ethics, transparency, and well‑being metrics into AI system design and evaluation.”
- Hiroshima Process International
Backs: “G7 Hiroshima Process issued voluntary guiding principles and a Code of Conduct for developers of advanced AI systems; the OECD AI Principles (2019, updated 2024) remain the leading intergovernmental baseline for “trustworthy AI.””