What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Short answer: it depends where you operate and what you’re doing with AI. As of October 22, 2026, the rules that most directly govern how systems like me are built, deployed, and held accountable fall into five buckets: AI‑specific laws, general privacy/consumer/civil‑rights laws applied to AI, sectoral or procurement rules, platform rules, and standards and codes.

United States (federal)

•Executive branch policy for federal agencies: OMB Memorandum M‑24‑10 requires every agency to inventory AI uses, stand up governance with a Chief AI Officer, and apply safeguards (testing/red‑teaming, impact assessments, human oversight, opt‑outs, etc.) for “safety‑ or rights‑impacting AI.” It governs government use and procurement, not the private sector. Note: Executive Order 14110 (Oct 30, 2023) that had directed much of this work was rescinded on January 20, 2025, but M‑24‑10 remains in force and agencies are implementing it.[1]

•Accountability through existing laws: the FTC polices unfair or deceptive AI claims (e.g., “AI‑powered” efficacy assertions) under Section 5; the EEOC and DOJ/ADA have issued guidance clarifying that algorithmic selection and hiring tools must comply with Title VII and ADA, including avoiding disparate impact and providing accommodations. Financial and credit uses also trigger existing duties (e.g., adverse‑action notices under ECOA/FCRA).[2]

United States (state and local)

•New York City Local Law 144 (hiring): employers and agencies may not use an automated employment decision tool unless it has undergone an independent annual bias audit, the results are published, and candidates receive required notices.[3]

•Colorado’s Automated Decision‑Making Technology Act (SB 24‑205): from February 1, 2026, “developers” and “deployers” of high‑risk AI tied to consequential decisions (e.g., employment, lending, housing, healthcare) must implement risk‑management programs, share documentation with customers, conduct/refresh impact assessments, notify consumers, and disclose material discrimination risks to the Attorney General. Rulemaking is underway; violations are enforced under the Colorado Consumer Protection Act.[4]

•California CPPA regulations on Automated Decision‑Making Technology (ADMT): effective January 1, 2026 (with some compliance dates into 2027), covered businesses must give pre‑use notices, provide access/meaningful information about logic and outcomes, and offer opt‑outs for certain ADMT uses; separate rules require privacy risk assessments and cyber audits.[5]

•Comprehensive state privacy laws (e.g., Colorado, Connecticut, Virginia) give consumers rights to opt out of profiling/automated decisions with legal or similarly significant effects and often require impact assessments for such uses.[6]

•Biometric laws: Illinois’ BIPA (and similar laws) impose consent, notice, retention, and security obligations for biometric data; major facial‑recognition settlements have reinforced its reach.[7]

European Union

•EU AI Act (Regulation (EU) 2024/1689): a risk‑based regime with:

•Prohibitions (applied since Feb 2, 2025) on certain practices;

•Transparency duties (incl. deepfake labeling and AI‑interaction disclosure) applying from Aug 2, 2026, with a Dec 2, 2026 grace for some legacy systems;

•General‑purpose AI (GPAI) obligations, including a public summary of training content and a copyright‑compliance policy, phasing in by 2026–2027;

•High‑risk system requirements (data governance, documentation, quality management, human oversight, post‑market monitoring) applying from Dec 2, 2027 (and Aug 2, 2028 for product‑related high‑risk systems). Substantial fines back enforcement.[8]

•Digital Services Act (DSA): for very large platforms/search engines, mandatory risk assessments, transparency of recommender systems, and mitigation of systemic risks, including those amplified by AI.[9]

•New EU Product Liability Directive (2024/2853): explicitly covers software and AI systems; Member States must transpose by December 9, 2026, expanding no‑fault liability for defective digital products.[10]

United Kingdom

•No horizontal AI statute yet; the government’s “pro‑innovation” approach relies on sector regulators and existing UK GDPR/DPA 2018. Article 22‑style safeguards restrict solely automated decisions with legal or similarly significant effects and require meaningful human review and routes to contest; the ICO has detailed guidance.[11]

China

•Binding rules for public‑facing generative AI (effective Aug 15, 2023) require lawful training data, content moderation, safety assessments for services with “public opinion or social mobilization” capacity, and other controls; “deep synthesis” and algorithmic‑recommendation regulations add labeling, filing, and security‑assessment duties.[12]

•U.S. Copyright Office guidance: works containing AI‑generated material are registrable only to the extent of human authorship; applicants must disclose AI‑generated content.[13]

•EU AI Act adds copyright‑focused duties for GPAI providers (copyright policy; training‑data summary) and aligns with the EU text‑and‑data‑mining opt‑out.[14]

•State and national privacy laws (GDPR/UK GDPR/CCPA‑CPRA/CPA, etc.) continue to apply to training, fine‑tuning, and deployment, including lawful basis, transparency, minimization, and data‑subject rights.[15]

Government and platform‑specific obligations

•If you sell to or are used by the U.S. federal government, expect M‑24‑10 controls in solicitations and contracts (e.g., risk assessments, T&E, inventories, waivers/governance).[16]

•Platforms under the DSA must provide algorithmic transparency and mitigate risks from AI‑driven recommender systems; EU guidance clarifies deepfake and interactive‑AI disclosures.[9]

Standards and “soft law” that regulators increasingly reference

•NIST AI Risk Management Framework (AI RMF 1.0) and its Generative AI Profile; widely adopted as a baseline for AI risk controls.[17]

•ISO/IEC 42001:2023 (AI management systems) and ISO/IEC 23894:2023 (AI risk management) provide certifiable governance and risk‑management scaffolding that map well to emerging laws.[18]

•OECD AI Principles (2019, updated 2024) and the Council of Europe Framework Convention on AI (opened for signature 2024; obligations on risk and rights protection once ratified by parties).[19]

What this means in practice

•If you build models or high‑risk applications in the EU, plan for AI Act classification, technical documentation, risk management, human oversight, post‑market monitoring, and—if you’re a GPAI provider—copyright policy and a public training‑data summary. Label deepfakes.[20]

•If you deploy AI for consequential decisions in Colorado (from Feb 1, 2026) or use ADMT in California (from Jan 1, 2026), stand up risk programs, do impact assessments, provide notices/access/opt‑outs, and prepare for AG/CPPA oversight.[4]

•If you hire in NYC, commission and publish an annual AEDT bias audit and notify candidates.[3]

•Everywhere, treat marketing claims about “AI” like any other advertising claim (substantiation required); ensure civil‑rights compliance in hiring, lending, housing, etc.; and expect privacy regulators to scrutinize training data, fine‑tuning, and profiling.[2]

If you tell me your industry, where you operate, and whether you’re a model developer, a deployer, or a platform, I can translate this into a concrete, jurisdiction‑specific compliance checklist and upcoming deadlines.

Citations (20)

1whitehouse.govGovernment
EXECUTIVE OFFICE OF THE PRESIDENT
Backs: “Executive Order 14110 (Oct 30, 2023) that had directed much of this work was rescinded on January 20, 2025, but M‑24‑10 remains in force and agencies are implementing it.”
2context.centerNot yet classified
Keep your AI claims in check
Backs: “Financial and credit uses also trigger existing duties (e.g., adverse‑action notices under ECOA/FCRA).”
3nyc.govGovernment
Automated Employment Decision Tools (AEDT) - DCWP
Backs: “New York City Local Law 144 (hiring): employers and agencies may not use an automated employment decision tool unless it has undergone an independent annual bias audit, the results are published, and candidates receive required notices.”
4colorado.govGovernment
https://leg.colorado.gov/sites/default/files/2024a_205_signed.pdf
Backs: “Rulemaking is underway; violations are enforced under the Colorado Consumer Protection Act.”
5ca.govGovernment
CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology (ADMT), and Insurance Regulations - California Privacy Protection Agency (CPPA)
Backs: “California CPPA regulations on Automated Decision‑Making Technology (ADMT): effective January 1, 2026 (with some compliance dates into 2027), covered businesses must give pre‑use notices, provide access/meaningful information about logic and outcomes, and offer opt‑outs for certain ADMT uses; separate rules require…”
6coag.govGovernment
Colorado Privacy Act (CPA) - Colorado Attorney General | Colorado Attorney General
Backs: “Comprehensive state privacy laws (e.g., Colorado, Connecticut, Virginia) give consumers rights to opt out of profiling/automated decisions with legal or similarly significant effects and often require impact assessments for such uses.”
7elaws.usNot yet classified
740 ILCS 14. Biometric Information Privacy Act., CHAPTER 740. CIVIL LIABILITIES, RIGHTS AND REMEDIES, Illinois Compiled Statutes
Backs: “Illinois’ BIPA (and similar laws) impose consent, notice, retention, and security obligations for biometric data; major facial‑recognition settlements have reinforced its reach.”
8europa.euGovernment
AI Act | Shaping Europe’s digital future
Backs: “High‑risk system requirements (data governance, documentation, quality management, human oversight, post‑market monitoring) applying from Dec 2, 2027 (and Aug 2, 2028 for product‑related high‑risk systems). Substantial fines back enforcement.”
9europa.euGovernment
Regulation - 2022/2065 - EN - DSA - EUR-Lex
Backs: “Digital Services Act (DSA): for very large platforms/search engines, mandatory risk assessments, transparency of recommender systems, and mitigation of systemic risks, including those amplified by AI.”
10europa.euGovernment
Liability for defective products - Internal Market, Industry, Entrepreneurship and SMEs
Backs: “Member States must transpose by December 9, 2026, expanding no‑fault liability for defective digital products.”
11gov.ukGovernment
A pro-innovation approach to AI regulation - GOV.UK
Backs: “Article 22‑style safeguards restrict solely automated decisions with legal or similarly significant effects and require meaningful human review and routes to contest; the ICO has detailed guidance.”
12loc.govGovernment
China: Generative AI Measures Finalized | Library of Congress
Backs: ““deep synthesis” and algorithmic‑recommendation regulations add labeling, filing, and security‑assessment duties.”
13govinfo.govGovernment
88 FR 16190 - Copyright Registration Guidance: Works Containing Material Generated by Artificial Intelligence - Content Details - 2023-05321
Backs: “Copyright Office guidance: works containing AI‑generated material are registrable only to the extent of human authorship; applicants must disclose AI‑generated content.”
14europa.euGovernment
Article 53: Obligations for providers of general-purpose AI models | AI Act Service Desk
Backs: “EU AI Act adds copyright‑focused duties for GPAI providers (copyright policy; training‑data summary) and aligns with the EU text‑and‑data‑mining opt‑out.”
15europa.euGovernment
Transparency obligations under Article 50 of the AI Act | Shaping Europe’s digital future
Backs: “State and national privacy laws (GDPR/UK GDPR/CCPA‑CPRA/CPA, etc.) continue to apply to training, fine‑tuning, and deployment, including lawful basis, transparency, minimization, and data‑subject rights.”
16whitehouse.govGovernment
implement OMB Memorandum M-24-10’s requirements regarding rights-impacting and safety-impacting AI:
Backs: “If you sell to or are used by the U.S. federal government, expect M‑24‑10 controls in solicitations and contracts (e.g., risk assessments, T&E, inventories, waivers/governance).”
17nist.govGovernment
AI Risk Management Framework | NIST
Backs: “NIST AI Risk Management Framework (AI RMF 1.0) and its Generative AI Profile; widely adopted as a baseline for AI risk controls.”
18iso.orgNonprofits and think tanks
ISO/IEC 42001:2023 - AI management systems
Backs: “ISO/IEC 42001:2023 (AI management systems) and ISO/IEC 23894:2023 (AI risk management) provide certifiable governance and risk‑management scaffolding that map well to emerging laws.”
19oecd.aiGovernment
AI Principles Overview - OECD.AI
Backs: “OECD AI Principles (2019, updated 2024) and the Council of Europe Framework Convention on AI (opened for signature 2024; obligations on risk and rights protection once ratified by parties).”
20europa.euGovernment
EUR-Lex - 02024R1689-20260727 - EN - EUR-Lex
Backs: “If you build models or high‑risk applications in the EU, plan for AI Act classification, technical documentation, risk management, human oversight, post‑market monitoring, and—if you’re a GPAI provider—copyright policy and a public training‑data summary. Label deepfakes.”