What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Short answer: There’s no single, global AI law. Instead, today’s “rules of the road” are a patchwork of binding laws and regulations, agency enforcement of existing statutes, sector rules, state/local laws, and voluntary-but-increasingly-expected standards. Highlights you should know:

United States (federal)

•Executive-branch policy and procurement: OMB issued government‑wide rules for agencies’ use and buying of AI (governance, risk tests for safety/rights‑impacting uses, Chief AI Officers, inventories). Subsequent OMB memoranda in 2025–26 continue this line.[1]

•Safety, testing, evaluations: NIST’s AI Risk Management Framework and its Generative AI Profile are the de facto baseline many organizations map to. NIST also stood up the U.S. AI Safety Institute to develop evaluation methods and coordinate with peer institutes.[2]

•Civil rights and consumer protection (enforced under existing laws):

•FTC: deceptive “AI” marketing and unfair practices remain unlawful.[3]

•CFPB: if AI/ML is used in credit or employment-related consumer reports, you still owe specific adverse‑action reasons under ECOA/Reg B and must meet FCRA duties.[4]

•DOJ/EEOC/FTC/CFPB jointly affirmed there’s “no AI exemption” for discrimination laws.[5]

•Healthcare devices: FDA finalized the “Predetermined Change Control Plan” pathway so AI-enabled device software can update safely without a new submission each time; broader lifecycle guidance is in flight.[6]

•Politics/content: the FEC declined to promulgate a federal AI‑ad rule in 2024; regulation here is largely state‑level (see below).[7]

United States (state and local)

•Hiring: NYC Local Law 144 requires a bias audit, notices, and public posting before using automated employment decision tools.[8]

•Broad AI governance: Colorado’s 2024 AI Act imposes “reasonable care” and risk‑management duties for high‑risk AI (effective 2026, with ongoing AG activity). Utah’s 2024 Artificial Intelligence Policy Act created disclosure rules in regulated professions and an AI sandbox office.[9]

•Deepfakes/elections and impersonation: Dozens of states now require labels or restrict deceptive AI in political ads; count and details vary by state (trackers from NCSL are current). Separate right‑of‑publicity and “digital replica” laws (e.g., Tennessee ELVIS Act; California AB 1836/AB 2602) regulate AI voice/likeness uses.[10]

European Union

•AI Act (Regulation (EU) 2024/1689): a risk‑based regime now in force with staged applicability. Prohibited practices and general‑purpose AI (GPAI) obligations arrive first; high‑risk system requirements phase in later (through 2027–2028). The Commission has issued GPAI guidance and timelines.[11]

•Platform accountability (Digital Services Act): very large platforms/search engines must assess and mitigate systemic risks (including from recommender systems), undergo independent audits, and publish reports.[12]

•Liability: the revised Product Liability Directive now explicitly covers software and AI systems, modernizing no‑fault product liability across the EU.[13]

United Kingdom

•No omnibus AI statute; regulators apply existing laws (data protection, consumer/competition) guided by the UK government’s “pro‑innovation” AI regulation framework. The CMA has issued competition/consumer principles for foundation‑model markets; the ICO enforces data‑protection duties for AI (fairness, transparency, explainability).[14]

International frameworks and soft law

•OECD AI Principles (2019, updated 2024), UNESCO’s Recommendation on AI Ethics (2021), and the Council of Europe’s Framework Convention on AI (opened for signature 2024) shape many countries’ rules and corporate programs.[15]

Voluntary standards often required by customers, insurers, or regulators

•NIST AI RMF (and GenAI Profile), ISO/IEC 42001 (AI management systems), ISO/IEC 23894 (AI risk management), and IEEE 7000‑series (ethics, transparency, well‑being) are widely referenced in compliance programs, audits, and procurement.[2]

If you tell me your industry and where you operate, I can turn this into a concrete compliance checklist and monitoring calendar.

Citations (15)

1whitehouse.govGovernment
EXECUTIVE OFFICE OF THE PRESIDENT
Backs: “OMB issued government‑wide rules for agencies’ use and buying of AI (governance, risk tests for safety/rights‑impacting uses, Chief AI Officers, inventories). Subsequent OMB memoranda in 2025–26 continue this line.”
2nist.govGovernment
AI Risk Management Framework | NIST
Backs: “AI Safety Institute to develop evaluation methods and coordinate with peer institutes.”
3ftc.govGovernment
Statement of Chair Lina M. Khan Regarding the Joint Interagency Statement on AI
Backs: “FTC: deceptive “AI” marketing and unfair practices remain unlawful.”
4consumerfinance.govGovernment
Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms | Consumer Financial Protection Bureau
Backs: “CFPB: if AI/ML is used in credit or employment-related consumer reports, you still owe specific adverse‑action reasons under ECOA/Reg B and must meet FCRA duties.”
5ftc.govGovernment
# JOINT STATEMENT ON ENFORCEMENT EFFORTS AGAINST DISCRIMINATION AND BIAS IN AUTOMATED SYSTEMS
Backs: “DOJ/EEOC/FTC/CFPB jointly affirmed there’s “no AI exemption” for discrimination laws.”
6fda.govGovernment
Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions | FDA
Backs: “FDA finalized the “Predetermined Change Control Plan” pathway so AI-enabled device software can update safely without a new submission each time; broader lifecycle guidance is in flight.”
7fec.govGovernment
FEC Record | Regulations | Commission approves Notification of Disposition, Interpretive Rule on artificial intelligence in campaign ads
Backs: “Politics/content: the FEC declined to promulgate a federal AI‑ad rule in 2024; regulation here is largely state‑level (see below).”
8nyc.govGovernment
Automated Employment Decision Tools (AEDT) - DCWP
Backs: “NYC Local Law 144 requires a bias audit, notices, and public posting before using automated employment decision tools.”
9colorado.govGovernment
SB24-205 Consumer Protections for Artificial Intelligence | Colorado General Assembly
Backs: “Utah’s 2024 Artificial Intelligence Policy Act created disclosure rules in regulated professions and an AI sandbox office.”
10ncsl.orgNonprofits and think tanks
Artificial Intelligence (AI) in Elections and Campaigns
Backs: “California AB 1836/AB 2602) regulate AI voice/likeness uses.”
11europa.euGovernment
AI Act | Shaping Europe’s digital future
Backs: “Prohibited practices and general‑purpose AI (GPAI) obligations arrive first; high‑risk system requirements phase in later (through 2027–2028). The Commission has issued GPAI guidance and timelines.”
12europa.euGovernment
Digital Services Act - Consilium
Backs: “Platform accountability (Digital Services Act): very large platforms/search engines must assess and mitigate systemic risks (including from recommender systems), undergo independent audits, and publish reports.”
13europa.euGovernment
Directive - 2024/2853 - EN - Product Liability Directive - EUR-Lex
Backs: “Liability: the revised Product Liability Directive now explicitly covers software and AI systems, modernizing no‑fault product liability across the EU.”
14gov.ukGovernment
A pro-innovation approach to AI regulation - GOV.UK
Backs: “The CMA has issued competition/consumer principles for foundation‑model markets; the ICO enforces data‑protection duties for AI (fairness, transparency, explainability).”
15oecd.aiGovernment
AI Principles Overview - OECD.AI
Backs: “OECD AI Principles (2019, updated 2024), UNESCO’s Recommendation on AI Ethics (2021), and the Council of Europe’s Framework Convention on AI (opened for signature 2024) shape many countries’ rules and corporate programs.”