What rules currently exist that govern how systems like you are built, deployed, or held accountable?
AI systems like large language models (LLMs), generative AI chatbots, and general-purpose AI (GPAI) are governed by a growing but fragmented set of binding laws, risk-based regulations, voluntary frameworks, and existing legal regimes (e.g., data protection, product liability, consumer protection, and anti-discrimination laws). There is no single global rulebook; approaches vary by jurisdiction, with the EU’s comprehensive risk-based model as the most advanced binding framework, a US patchwork of state laws plus federal executive actions and voluntary standards, and targeted rules in places like China and South Korea.[1][2]
Key themes across regimes include risk classification/assessment, transparency (disclosing AI interactions and labeling synthetic content), documentation and logging, human oversight, safety/testing for high-capability or high-impact systems, incident reporting, and accountability via fines, civil liability, or enforcement actions. Obligations typically distinguish providers/developers (who build/train models) from deployers/users (who put systems into service). Extraterritorial reach is common (e.g., EU rules apply to systems placed on the EU market or whose outputs are used there).
European Union: AI Act (Primary Comprehensive Framework)
The EU AI Act (Regulation (EU) 2024/1689, entered into force August 2024, amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744) is the world’s first major horizontal AI law. It uses a risk-based approach with phased application.[3][4]
Existing laws like the GDPR continue to apply to personal data processing in AI systems.
United States: Patchwork of Federal Actions, State Laws, and Voluntary Frameworks
No comprehensive federal AI statute exists as of late 2026. The Biden-era Executive Order 14110 (2023) on Safe, Secure, and Trustworthy AI directed agency actions on safety testing/reporting for dual-use foundation models (via Defense Production Act), standards, civil rights, etc., and led to the US AI Safety Institute and NIST work; elements have been rescinded, modified, or superseded under the Trump administration, which favors lighter-touch, innovation-focused approaches, voluntary commitments (e.g., White House Accord on Super Intelligence/frontier responsibilities with major labs), and potential preemption of some state laws, alongside national security/cyber focus.[9][10][11]
China
Targeted measures rather than one statute (a comprehensive AI law remains pending). Key rules for generative AI:[17]
South Korea: AI Basic Act
In force January 22, 2026 (with some provisions later). Covers generative AI, high-impact AI (domains affecting life/safety/rights, e.g., healthcare, hiring, credit, transport, biometrics for investigation), and high-performance AI (compute ≥10^26 FLOPs).[21][22]
Other Notable Elements
Common practical expectations for systems like me (GPAI chatbots/generative models): Disclose AI nature in interactions; label or enable provenance for outputs where required; maintain safety frameworks and report major incidents if frontier-scale; support human oversight and explanations for consequential uses; document training/use limitations; comply with data protection. Multijurisdictional operators often map to the strictest overlapping requirements (transparency + risk management + documentation).
Rules continue to evolve rapidly (timelines have already shifted via amendments like the EU Omnibus), with enforcement ramping up and more national laws expected. Organizations typically inventory systems, classify risks, implement controls aligned to frameworks like NIST AI RMF or ISO 42001, and monitor jurisdictional updates. This is a high-level overview based on publicly available information as of late 2026—not legal advice; consult qualified counsel for specific compliance.
Citations (24)
- https://iaim.ai/ai-regulatory-calendar/
Backs: “There is no single global rulebook; approaches vary by jurisdiction, with the EU’s comprehensive risk-based model as the most advanced binding framework, a US patchwork of state laws plus federal executive actions and voluntary standards, and targeted rules in places like China and South Korea.”
- https://iaim.ai/ai-regulation/
Backs: “There is no single global rulebook; approaches vary by jurisdiction, with the EU’s comprehensive risk-based model as the most advanced binding framework, a US patchwork of state laws plus federal executive actions and voluntary standards, and targeted rules in places like China and South Korea.”
- https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
Backs: “The EU AI Act (Regulation (EU) 2024/1689, entered into force August 2024, amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744) is the world’s first major horizontal AI law. It uses a risk-based approach with phased application.”
- https://www.anaconda.com/blog/state-ai-regulation-2027
Backs: “The EU AI Act (Regulation (EU) 2024/1689, entered into force August 2024, amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744) is the world’s first major horizontal AI law. It uses a risk-based approach with phased application.”
- https://digital-strategy.ec.europa.eu/en/faqs/navigating-ai-act
Backs: “Practices like social scoring, harmful manipulation/subliminal techniques, exploitation of vulnerabilities, untargeted facial recognition scraping for databases, certain predictive policing, and (from December 2026) systems generating non-consensual intimate imagery or child sexual abuse material. Prohibitions largely…”
- https://nhimg.org/ai-governance-guide
Backs: “High-risk obligations for Annex III systems were delayed to December 2, 2027; for Annex I (product-embedded) to August 2, 2028.”
- https://artificialintelligenceact.eu/high-level-summary/
Backs: “High-risk obligations for Annex III systems were delayed to December 2, 2027; for Annex I (product-embedded) to August 2, 2028.”
- https://www.complyjet.com/blog/ai-regulations-by-country
Backs: “Applies extraterritorially. Minimal-risk systems face few new rules.”
- https://www.lawfaremedia.org/article/what-s-in-biden-s-executive-order-on-artificial-intelligence
Backs: “The Biden-era Executive Order 14110 (2023) on Safe, Secure, and Trustworthy AI directed agency actions on safety testing/reporting for dual-use foundation models (via Defense Production Act), standards, civil rights, etc., and led to the US AI Safety Institute and NIST work; elements have been rescinded, modified, or…”
- https://www.ciodive.com/news/Trump-AI-executive-order-repeal-Biden-era-regulatory-overhaul/737883/
Backs: “The Biden-era Executive Order 14110 (2023) on Safe, Secure, and Trustworthy AI directed agency actions on safety testing/reporting for dual-use foundation models (via Defense Production Act), standards, civil rights, etc., and led to the US AI Safety Institute and NIST work; elements have been rescinded, modified, or…”
- https://www.jenner.com/en/news-insights/client-alerts/new-ai-executive-order-key-takeaways-for-companies-developing-advanced-ai-models
Backs: “The Biden-era Executive Order 14110 (2023) on Safe, Secure, and Trustworthy AI directed agency actions on safety testing/reporting for dual-use foundation models (via Defense Production Act), standards, civil rights, etc., and led to the US AI Safety Institute and NIST work; elements have been rescinded, modified, or…”
- https://www.nist.gov/itl/ai-risk-management-framework
Backs: “Used for building trustworthy systems across the lifecycle; crosswalks exist to other frameworks (e.g., EU AI Act, ISO).”
- https://quality.arc42.org/standards/nist-ai-rmf
Backs: “Used for building trustworthy systems across the lifecycle; crosswalks exist to other frameworks (e.g., EU AI Act, ISO).”
- https://actaicompliance.com/guides/us-state-ai-laws/
Backs: “Training data transparency (AB 2013) and CCPA automated decision-making rules (from 2027).”
- https://verifywise.ai/blog/state-of-ai-governance-regulations-united-states-2026
Backs: “Training data transparency (AB 2013) and CCPA automated decision-making rules (from 2027).”
- https://superintelligencecompliance.ai/guides/us-state-ai-laws
Backs: “Developers provide documentation; deployers give notice, adverse-outcome explanations (within 30 days), correction/human review options. AG enforcement with cure periods.”
- https://www.deep-lex.com/ai-regulation-tracker/china
Backs: “Targeted measures rather than one statute (a comprehensive AI law remains pending). Key rules for generative AI:”
- https://fincul.com/ai-labelling-laws-us-europe/
Backs: “Platforms must check/add labels. Applies to providers and distributors.”
- https://casrai.org/guides/china-ai-regulation-explained
Backs: “Platforms must check/add labels. Applies to providers and distributors.”
- https://www.jonesday.com/en/insights/2026/09/chinas-supreme-court-issues-landmark-judicial-rules-on-artificial-intelligenceimplications-for-product-liability-intelle
Backs: “Filing, risk monitoring, and ethical norms emphasized. Export controls emerging on certain AI tech.”
- https://www.cooley.com/news/insight/2026/2026-01-27-south-koreas-ai-basic-act-overview-and-key-takeaways
Backs: “Covers generative AI, high-impact AI (domains affecting life/safety/rights, e.g., healthcare, hiring, credit, transport, biometrics for investigation), and high-performance AI (compute ≥10^26 FLOPs).”
- https://everyailaw.com/regulation/kr-ai-basic-act/
Backs: “Covers generative AI, high-impact AI (domains affecting life/safety/rights, e.g., healthcare, hiring, credit, transport, biometrics for investigation), and high-performance AI (compute ≥10^26 FLOPs).”
- https://airiskaware.com/insights/ai-governance-south-korea-2026
Backs: “Fines relatively modest (e.g., up to ~KRW 30 million); emphasis on promotion alongside trust.”
- https://nhimg.org/global-ai-regulation-map
Backs: “Whistleblower protections appear in some laws (e.g., CA). Corporate governance and insurance are evolving.”