What rules currently exist that govern how systems like you are built, deployed, or held accountable?

This is a fast-moving area, so let me look up the current state of AI governance and regulation.The rules governing AI systems like me come from several overlapping layers—international, regional, national/state, and company-level self-governance. Here's the current landscape as of October 2026:

1. EU AI Act (the most comprehensive binding framework)

The EU's Regulation 2024/1689 is being phased in over several years rather than all at once. Prohibited AI practices and rules on AI literacy began applying in February 2025, obligations for general-purpose AI models followed in August 2025, and transparency requirements took effect in August 2026.

As of August 2, 2026, providers and deployers of certain systems (like chatbots and content generators) must comply with transparency rules. Specifically:

Noncompliance with these rules can trigger significant penalties—fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher.

Notably, the Act's toughest provisions—the "high-risk" rules for AI used in employment, education, essential services, and similar sensitive domains—have been postponed. The high-risk obligations for AI systems used in areas such as biometrics, employment, education, essential services, and migration, asylum and border management were due to apply from August 2 alongside the transparency rules, but in May 2026 EU lawmakers agreed to postpone those obligations until December 2, 2027 as part of a "Digital Omnibus" package. Separately, new prohibitions on AI-generated non-consensual intimate content and CSAM take effect December 2, 2026.

2. United States — fragmented, shifting federal approach

There is no comprehensive U.S. federal AI statute. As of mid-2026, there is no comprehensive federal AI statute, and none appears imminent—federal AI regulation instead runs through executive action and agency posture, alongside a growing body of state law.

The federal executive-order landscape has swung significantly:

3. U.S. State Laws — the real regulatory action

With federal legislation stalled, states have become the primary source of binding AI rules:

California SB 53 (Transparency in Frontier AI Act) is the first law in the U.S. to directly regulate frontier model developers on catastrophic-risk grounds. It requires large AI developers to publish safety frameworks, report critical incidents within 15 days, and protects whistleblowers. It applies specifically to companies that develop AI models trained with more than 10^26 floating-point operations, with the strictest duties reserved for large frontier developers—those with annual gross revenues above $500 million. Penalties can reach up to $1 million per violation, depending on the severity of the offense.

Colorado AI Act takes a different, risk-based approach, regulating the development and downstream deployment of "high-risk artificial intelligence systems," though its enforcement has been contested and suspended amid litigation.

California also has companion laws like SB 942 (AI Transparency Act for large-scale generative systems) and AB 2013 (Training Data Transparency Act).

4. Company-level self-governance (voluntary, not law)

Frontier AI labs—including Anthropic—operate under self-published voluntary safety frameworks that predate and now intersect with these laws. Frontier AI developers may implement a responsible capability scaling policy—an internal policy intended to keep risks to an acceptable level, typically containing a description of specific model capabilities requiring additional safety measures ("capability thresholds"), a commitment to evaluate models for dangerous capabilities, and a commitment to pause development if safety measures can't be implemented.

For Anthropic specifically, this takes the form of the Responsible Scaling Policy (RSP), now in a more detailed version. The RSP is a framework for managing potential catastrophic risks from models, centered around implementing safeguards proportional to identified risks—as models become more powerful, they require stronger protections, and when models reach certain capability thresholds, additional safeguards around security and deployment are implemented. Anthropic has also published a Frontier Compliance Framework that describes how the company assesses and mitigates cyber offense, chemical, biological, radiological, and nuclear threats, as well as risks of AI sabotage and loss of control, and harmful manipulation—this framework serves as Anthropic's compliance mechanism for SB 53 and other regulatory requirements.

These commitments include mechanisms like Risk Reports published every 3-6 months with redactions disclosed, external review of Risk Reports in defined cases, a Responsible Scaling Officer, and whistleblower channels with a ban on non-disparagement terms that would stop staff from publicly raising safety concerns. Similar frameworks exist at other major labs, including OpenAI's Preparedness Framework and DeepMind's Frontier Safety Framework.

The overall picture

Right now, governance of systems like me is a patchwork: binding EU rules are phasing in (with high-risk provisions delayed to 2027–2028), the U.S. has no comprehensive federal law and is instead trying to preempt a growing set of state laws (California leading with SB 53), and much of the substantive safety work—capability evaluations, red-teaming, deployment safeguards—still happens through voluntary, company-published frameworks rather than legal mandate. This is a rapidly evolving area, so specifics are likely to keep shifting in the coming months.