More answers like this
Muse Spark 1.2Oct 24, 2026meta/muse-spark-1.2-20260805
What rules currently exist that govern how systems like you are built, deployed, or held accountable?
I'll map the current rules that govern how AI systems like me are built, deployed, and held accountable.
There is no single global law for systems like me. Rules are layered by jurisdiction, plus voluntary standards:
1. European Union - The most comprehensive binding law
The EU has one binding law, the AI Act, in force since 1 August 2024.
It sorts AI by the risk a given use poses to people and is rolling out in stages:
•Passed in 2024, it sets the standard for how AI must be developed, deployed, and monitored across the European Union
•Prohibited practices (AI that manipulates behavior, exploits vulnerabilities, or enables social scoring, emotion-recognition in schools etc.) are banned from February 2025
•The penalties for non-compliance range from €7.5 million to €35 million or 1% to 7% of global annual turnover
Currently applicable provisions as of 2026:
•GPAI obligations since August 2025 and Article 50 transparency rules since August 2026 are now in force. These are unaffected by delay to high-risk rules.
•The rules governing providers of general-purpose AI (GPAI) models under Chapter V (Articles 51-56) became applicable on August 2, 2025. From this date, all new GPAI models placed on the EU market must comply with transparency obligations (Article 53), copyright policy requirements, and — for models above the 10²⁵ FLOP systemic risk threshold — safety and security assessment obligations (Article 55)
•Article 50 came into force on 2 August 2026, introducing transparency obligations for providers and deployers. Providers must disclose AI interactions and mark AI-generated or manipulated content, while deployers must disclose deepfakes, certain AI-generated public-interest content, and the use of emotion recognition or biometric categorisation systems
•They apply not only to EU organisations, but also to businesses outside the EU that place AI systems on the EU market or whose AI-generated outputs are used within the EU
Delayed high-risk obligations:
•The rules for high-risk systems in the Annex III areas now apply from 2 December 2027 and those for AI embedded in Annex I regulated products from 2 August 2028, while the obligations for general-purpose AI models have applied since 2 August 2025. This delay was via the AI Omnibus, which entered into force on 27 July 2026.
For high-risk AI systems, the Act mandates formal governance including: establishment of a risk management system governing the AI life cycle; implementation of data governance to ensure quality, accuracy, and completeness of training dataset; creation of technical documentation; transparency obligations; design for recordkeeping, human oversight, accuracy.
2. United States - No comprehensive federal AI law
•The United States has no comprehensive federal AI statute as of October 2026. The United States has no comprehensive federal AI law.
•Federal executive action sets the policy layer. The NIST AI Risk Management Framework, released in January 2023, provides voluntary guidance for organizations to incorporate trustworthiness considerations into AI development and deployment. It remains voluntary and remains the primary voluntary governance standard for U.S. companies. NIST says the framework is being revised and organizes risk management around Govern, Map, Measure, and Manage.
•According to Fortune's July 2026 reporting, the US relies largely on a voluntary pre-release review process created by a June 2026 executive order, rather than a binding AI licensing law.
•Executive Order 14365 (Ensuring a National Policy Framework for Artificial Intelligence) issued December 11, 2025 establishes a federal policy aimed at promoting a uniform national framework for AI regulation and limiting the impact of conflicting state laws. It directs federal agencies to identify and challenge state AI laws deemed inconsistent with federal policy, including via an AI Litigation Task Force to challenge state AI laws the administration considers inconsistent with federal policy. It aims to establish a uniform and "minimally burdensome" Federal standard, directing development of a federal legislative recommendation to preempt the current patchwork of varying state AI laws, except in a few discrete areas: child safety, AI compute and data center infrastructure, State government procurement and use of AI.
•Only a direct act of Congress containing an explicit federal preemption clause can formally block states from regulating. Because Congress has not passed a comprehensive federal AI statute, state governments remain free to pass mandatory disclosure laws, algorithmic bias bans, and deepfake restrictions. Under the Constitution, a presidential executive order does not possess the legal power to automatically wipe out state statutes, its effect is for the courts to determine.
Binding duties therefore sit mostly in state law:
•In 2024 Colorado became the first state to pass a comprehensive AI law. The Colorado AI Act places clear legal duties on both developers and deployers of "high-risk AI systems", tools that make or meaningfully influence important decisions. It requires deployers to adopt a risk management policy and program reasonable when measured against NIST AI RMF and ISO/IEC 42001.
•NCSL reported that 227 state AI bills were enacted or adopted in 2025.
•Other frontier-model laws: On December 19, 2025, New York Governor signed Assembly Bill A6453-A, the Responsible AI Safety and Education Act (RAISE Act), establishing a targeted framework governing development and deployment of the most advanced "frontier" models, with focus on AI safety, transparency, and prevention and reporting of incidents involving catastrophic harm. Protocols, along with records of updates, must be maintained for as long as the model is deployed plus five years.
•California, New York and Illinois laws rejected mandatory licensing and preapproval frameworks, instead they rely primarily on AI companies developing risk frameworks and then being subjected to transparency obligations, incident reporting, and in Illinois, independent compliance audits.
Sectoral regulators (FDA, SEC, FTC, EEOC) also tighten rules for specific applications while NIST remains voluntary.
3. United Kingdom - Principles-based, not statute
•The UK continues to take a lighter, more flexible approach based on the five principles of safety, transparency, fairness, accountability, and contestability. While a statutory AI framework continues to be debated, regulators currently rely on guidance rather than enforceable legislation.
•The approach is set out through the AI Regulation White Paper (2023): a flexible, principles-based approach, willing to legislate if required but establishing the AI Safety Institute to offer insights into advanced capabilities by conducting safety testing. The five principles are: safety/security/robustness, transparency/explainability, fairness, accountability/governance, contestability/redress; AI Safety Institute evaluations are voluntary.
•The AI Safety Institute runs technical evaluations of advanced models but does not currently mandate them, and assigns responsibility to existing regulators (FCA, ICO, MHRA, Ofcom, CMA, etc.) to apply cross-cutting AI principles within their domains. The AI Safety Institute was renamed the AI Security Institute in 2025.
4. China - State-controlled algorithmic governance
•China regulates through targeted rules, embedding AI governance into its 15th Five-Year Plan approved on 12 March 2026, reinforcing algorithm filing, safety assessments and socialist-values compliance.
•Algorithm filing requirements since March 2022, with over 1,400 AI algorithms from more than 450 companies filed as of June 2024.
•China's approach includes: Algorithmic Recommendation Guidelines: AI-driven platforms must disclose algorithms and allow user opt-outs; Deepfake Regulations: AI-generated media must be labeled; AI Security Law: AI models must align with national security interests. It takes a different approach: mandatory AI content labeling, national security standards, and sector-specific rules.
5. International voluntary standards & accountability framework
•NIST AI RMF 1.0 and EU AI Act Article 10 and ISO/IEC 42001 are commonly used benchmarks for governance gaps.
•ISO/IEC 42001:2023 is the international standard for AI management systems. ISO 42001 emphasizes accountability throughout the lifecycle: Organizations are held responsible for actions and outcomes produced by their models. The standard requires companies to implement mechanisms for monitoring and auditing AI systems to ensure they operate as intended. Every action is attributable. Every system is observable.
•General accountability principle: The AI itself cannot be sued; liability exists outside the negligent actor, but product liability laws will still apply and the developer who built the system and the deployer who put it into production may be sued. There is no single federal "AI agent liability" law in the U.S.; liability typically turns on existing standards and who designed, deployed, or instructed the system. Developers have responsibilities for systems they create or provide, while deployers have responsibilities for how they use them. The three-word scope — "developed, modified, or used" — captures the entire AI supply chain.
•Jurisdictions seem to be moving beyond broad principles towards more granular, risk-based obligations governing development, deployment and oversight, requiring demonstrable governance: identifying where AI is being used, assessing risks, establishing appropriate human oversight, verifying outputs and establishing clear lines of accountability.