What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Short answer: It’s a patchwork. There isn’t one global “AI law.” Today (October 23, 2026), AI systems like me are governed by a mix of binding laws and regulations, agency enforcement under existing laws, procurement rules for government use, and voluntary standards that many organizations adopt.

United States (federal)

•Executive direction and federal procurement/use

•June 2, 2026: A White House Executive Order emphasized a voluntary federal framework for “frontier” models, early access for government testing, and explicitly rejected mandatory federal licensing/preclearance for AI model development.[1]

•OMB’s Memorandum M‑24‑10 (Mar 28, 2024) requires every federal agency to inventory AI, stand up governance, and apply minimum risk‑management practices, with extra safeguards for “safety‑impacting AI” used by government.[2]

•NIST guidance and infrastructure: the AI Risk Management Framework (AI RMF 1.0, 2023; GenAI Profile, 2024) and the U.S. AI Safety Institute/Consortium (2024, expanded in 2026) support evaluations, red‑teaming, and measurement science for trustworthy AI. These are influential but voluntary.[3]

•Enforcement using existing federal laws (no “AI exemption”)

•Agencies (FTC, DOJ, CFPB, EEOC) jointly warned in April 2023 they will enforce civil‑rights, consumer‑protection and fair‑competition laws against AI‑enabled harms (e.g., discrimination, deception). The FTC has since brought AI‑related cases and warned firms to avoid deceptive AI claims.[4]

•In lending, the CFPB requires specific adverse‑action reasons even when complex/AI models are used (ECOA/Reg B).[5]

United States (state and local)

•Comprehensive privacy laws now exist in many states and often reach AI via automated decision‑making/profiling rights or data‑protection duties. Trackers maintained by IAPP show the active (and growing) state law landscape as of 2026.[6]

•New York City Local Law 144 (effective July 5, 2023) requires independent bias audits, notices, and public posting for “automated employment decision tools” used in hiring/promotions.[7]

•Colorado’s SB24‑205 (effective Feb 1, 2026) imposes “reasonable care” duties to prevent algorithmic discrimination in “high‑risk” AI used for consequential decisions, plus documentation, notices, and an enforcement hook under the state consumer‑protection law. The Attorney General is developing rules.[8]

•Sectoral/state laws that often bite AI uses:

•Illinois Biometric Information Privacy Act (BIPA) requires consent, limits disclosure/sale, and enables a private right of action for biometric data (e.g., face/voice prints).[9]

•Washington’s My Health My Data Act restricts “consumer health data,” including certain inferences and precise‑location uses tied to health, with opt‑in consent and geofencing limits.[10]

European Union

•The EU AI Act (Regulation (EU) 2024/1689) is in force with phased application:

•General‑purpose AI (GPAI) model obligations have applied since Aug 2, 2025; the Commission’s enforcement powers for GPAI began Aug 2, 2026. High‑risk AI rules now apply on a delayed schedule: Dec 2, 2027 (stand‑alone high‑risk systems) and Aug 2, 2028 (high‑risk systems embedded in regulated products). Transparency duties for certain AI content apply in 2026.[11]

•Liability: the revised Product Liability Directive (EU) 2024/2853 explicitly covers software and AI systems; it entered into force Dec 8, 2024 and must be transposed by Member States by Dec 9, 2026, modernizing strict‑liability rules for defective digital products. The separate AI Liability Directive proposal was withdrawn in 2025.[12]

United Kingdom

•The UK uses a “pro‑innovation,” sector‑led approach (no horizontal AI Act). Regulators (e.g., CMA, FCA) have issued guidance and are watching competition/consumer risks in foundation‑model markets.[13]

China

•Binding national rules govern algorithmic recommender systems (in force Mar 1, 2022), “deep synthesis” (e.g., deepfakes; in force Jan 10, 2023), and public‑facing generative‑AI services (Interim Measures effective Aug 15, 2023). These require content controls, labeling, data governance, and (in some cases) filings/security assessments.[14]

International frameworks and voluntary standards

•Council of Europe Framework Convention on AI, Human Rights, Democracy and the Rule of Law (opened for signature Sept 5, 2024) is the first binding international treaty framework on AI for signatories.[15]

•OECD AI Principles (2019) underpin many national approaches and were echoed by G20; they’re nonbinding but widely referenced.[16]

•Widely used standards and guidance:

•NIST AI Risk Management Framework (USA), including the 2024 Generative AI Profile.[17]

•ISO/IEC 42001:2023 (AI Management Systems)—a certifiable governance standard organizations can adopt—and ISO/IEC 23894:2023 (AI risk management guidance).[18]

What this means in practice

•If you build/deploy AI in the U.S., you’re primarily accountable under sectoral and general laws (consumer protection, civil rights, privacy, lending, health, etc.), plus any applicable state AI/privacy statutes; if you sell to the U.S. government, OMB M‑24‑10 and NIST guidance apply to how agencies buy and use your system. In the EU, the AI Act sets role‑specific obligations (e.g., provider vs. deployer), with near‑term duties for GPAI and later‑phase duties for high‑risk systems, and the updated Product Liability regime strengthens recourse for harms from defective AI software. China imposes service‑provider obligations around content control, labeling, and filing. Many organizations adopt NIST/ISO frameworks to operationalize risk management and audits even where not legally required.[2]

If you tell me your industry and where you operate, I can map the specific rules, dates, and duties you’re likely on the hook for.

Citations (18)

1whitehouse.govGovernment
Fact Sheet: President Donald J. Trump Promotes Advanced Artificial Intelligence Innovation and Security – The White House
Backs: “A White House Executive Order emphasized a voluntary federal framework for “frontier” models, early access for government testing, and explicitly rejected mandatory federal licensing/preclearance for AI model development.”
2whitehouse.govGovernment
EXECUTIVE OFFICE OF THE PRESIDENT
Backs: “OMB’s Memorandum M‑24‑10 (Mar 28, 2024) requires every federal agency to inventory AI, stand up governance, and apply minimum risk‑management practices, with extra safeguards for “safety‑impacting AI” used by government.”
3nist.govGovernment
AI Risk Management Framework | NIST
Backs: “AI Safety Institute/Consortium (2024, expanded in 2026) support evaluations, red‑teaming, and measurement science for trustworthy AI. These are influential but voluntary.”
4ftc.govGovernment
Joint Statement on Enforcement Efforts Against Discrimination and Bias in Automated Systems | Federal Trade Commission
Backs: “The FTC has since brought AI‑related cases and warned firms to avoid deceptive AI claims.”
5consumerfinance.govGovernment
Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms | Consumer Financial Protection Bureau
Backs: “In lending, the CFPB requires specific adverse‑action reasons even when complex/AI models are used (ECOA/Reg B).”
6iapp.orgNonprofits and think tanks
US State Privacy Legislation Tracker | IAPP
Backs: “Trackers maintained by IAPP show the active (and growing) state law landscape as of 2026.”
7nyc.govGovernment
Automated Employment Decision Tools (AEDT) - DCWP
Backs: “New York City Local Law 144 (effective July 5, 2023) requires independent bias audits, notices, and public posting for “automated employment decision tools” used in hiring/promotions.”
8colorado.govGovernment
SB24-205 Consumer Protections for Artificial Intelligence | Colorado General Assembly
Backs: “Colorado’s SB24‑205 (effective Feb 1, 2026) imposes “reasonable care” duties to prevent algorithmic discrimination in “high‑risk” AI used for consequential decisions, plus documentation, notices, and an enforcement hook under the state consumer‑protection law. The Attorney General is developing rules.”
9ilga.govGovernment
https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004+
Backs: “Illinois Biometric Information Privacy Act (BIPA) requires consent, limits disclosure/sale, and enables a private right of action for biometric data (e.g., face/voice prints).”
10wa.govGovernment
REVISED CODE OF WASHINGTON
Backs: “Washington’s My Health My Data Act restricts “consumer health data,” including certain inferences and precise‑location uses tied to health, with opt‑in consent and geofencing limits.”
11europa.euGovernment
Regulation - EU - 2024/1689 - EN - EUR-Lex
Backs: “Dec 2, 2027 (stand‑alone high‑risk systems) and Aug 2, 2028 (high‑risk systems embedded in regulated products). Transparency duties for certain AI content apply in 2026.”
12europa.euGovernment
Liability for defective products
Backs: “The separate AI Liability Directive proposal was withdrawn in 2025.”
13gov.ukGovernment
A pro-innovation approach to AI regulation: government response - GOV.UK
Backs: “Regulators (e.g., CMA, FCA) have issued guidance and are watching competition/consumer risks in foundation‑model markets.”
14cac.gov.cnGovernment
互联网信息服务算法推荐管理规定_中央网络安全和信息化委员会办公室
Backs: “These require content controls, labeling, data governance, and (in some cases) filings/security assessments.”
15coe.intGovernment
The Framework Convention on Artificial Intelligence - Artificial Intelligence
Backs: “Council of Europe Framework Convention on AI, Human Rights, Democracy and the Rule of Law (opened for signature Sept 5, 2024) is the first binding international treaty framework on AI for signatories.”
16oecd.orgGovernment
What are the OECD Principles on AI? (EN)
Backs: “OECD AI Principles (2019) underpin many national approaches and were echoed by G20; they’re nonbinding but widely referenced.”
17nist.govGovernment
AI Risk Management Framework - Resources | NIST
Backs: “NIST AI Risk Management Framework (USA), including the 2024 Generative AI Profile.”
18iso.orgNonprofits and think tanks
ISO/IEC 42001:2023 - AI management systems
Backs: “ISO/IEC 42001:2023 (AI Management Systems)—a certifiable governance standard organizations can adopt—and ISO/IEC 23894:2023 (AI risk management guidance).”