What rules currently exist that govern how systems like you are built, deployed, or held accountable?

A mix of binding laws (especially the EU AI Act and various national/state rules), voluntary frameworks, sector-specific regulations, and soft-law international principles currently govern how AI systems like large language models (LLMs) are built, deployed, and held accountable. There is no single global regime; approaches vary by jurisdiction, risk level, and use case (e.g., general-purpose/foundation models vs. high-risk applications in hiring, credit, or critical infrastructure). Existing laws on data protection (GDPR, CCPA), consumer protection, civil rights/anti-discrimination, product liability, and cybersecurity also apply.[1][2]

Accountability typically involves documentation/transparency, risk management, human oversight, incident reporting, audits/evaluations, fines, market surveillance, liability (civil/criminal), and whistleblower protections. Developers (providers who build/train models), deployers (those who use/put systems into service), and sometimes importers/distributors have distinct obligations. Many rules are phased in and risk-based.[3]

European Union: AI Act (Regulation (EU) 2024/1689)

This is the world’s first comprehensive, binding horizontal AI law. It entered into force in August 2024, with staggered applicability (prohibitions and literacy from early 2025; GPAI rules from mid-2025; most high-risk rules from late 2027/2028 after adjustments). It applies to providers/deployers placing systems on the EU market or putting them into service/using them in the EU (extraterritorial reach).[1][2]

It uses a risk-based approach:

•Unacceptable risk (prohibited): Harmful manipulation/deception, exploitation of vulnerabilities, social scoring, certain predictive policing, untargeted facial scraping for databases, emotion recognition in workplaces/education (with exceptions), biometric categorisation for protected characteristics, real-time remote biometric ID in public for law enforcement (narrow exceptions), and (later) certain non-consensual intimate/CSAM generation.[2][2]

•High-risk: Systems as safety components of regulated products (Annex I) or in specific areas (Annex III: biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice). Requirements include risk management systems throughout the lifecycle, high-quality/representative data governance (to minimise bias), technical documentation, automatic logging, transparency/instructions for deployers, human oversight, accuracy/robustness/cybersecurity, conformity assessment, registration in an EU database, and (for some) fundamental rights impact assessments. Deployers have duties like using systems per instructions, monitoring, and logging.[4][2]

•Limited/transparency risk: Chatbots, emotion recognition, biometric categorisation, deepfakes/synthetic content—users must be informed they are interacting with AI or that content is AI-generated (labelling/marking).[2]

•Minimal/no risk: Most systems (e.g., spam filters, games)—largely unregulated under the Act.

General-purpose AI (GPAI)/foundation models (including many LLMs): Transparency obligations (technical documentation, info for downstream providers, training data summary, copyright compliance). Systemic-risk models (e.g., high compute like >10²⁵ FLOPs presumption) face additional risk assessment/mitigation, adversarial testing, and incident reporting. A Code of Practice and guidelines support compliance.[1][2]

Governance/enforcement/accountability: AI Office (for GPAI), national market surveillance authorities, AI Board, Scientific Panel. Fines up to €35 million or 7% of worldwide annual turnover. Post-market monitoring, serious incident reporting, corrective actions. CE marking and conformity for high-risk. AI literacy obligations apply broadly.[5][2]

United States

No comprehensive federal AI statute exists. The Biden-era Executive Order 14110 (2023) on safe/secure/trustworthy AI (which included reporting for powerful models, standards development, etc.) was rescinded early in the Trump administration (2025). Current federal policy emphasises innovation, voluntary collaboration, cybersecurity, and limiting “onerous” state regulation (via EOs creating litigation task forces, reviewing state laws, and conditioning some funding; proposals for preemption).[6][7][8][9]

•Voluntary federal frameworks: NIST AI Risk Management Framework (AI RMF 1.0, 2023, with Generative AI Profile and updates) is widely used. It is non-binding and organised around four functions—Govern (culture, accountability, policies), Map (context, risks, impacts), Measure (testing, metrics), Manage (prioritise/respond)—plus trustworthiness characteristics (valid/reliable, safe, secure/resilient, accountable/transparent, explainable/interpretable, privacy-enhanced, fair with bias managed). A Playbook provides suggested actions. It supports organisational risk management for building/deploying AI.[10][11]

•Recent EOs promote voluntary frameworks for “covered frontier models” (e.g., benchmarking, pre-release government access windows, cybersecurity clearinghouses) without mandatory licensing.[7][8]

•Sectoral/agency rules and existing laws (FTC Act unfair/deceptive practices, civil rights statutes, sector regulators like CFPB for finance, FDA for medical, etc.) apply. Examples include quality controls for automated valuation models (real estate) addressing bias/accuracy.[12]

•State laws form a growing patchwork (hundreds of bills; several enacted). Key examples:

•California Transparency in Frontier Artificial Intelligence Act (SB 53 / TFAIA, signed 2025, core obligations from ~2026): Targets “frontier” models (foundation models trained with >10²⁶ FLOPs) and “large frontier developers” (>$500M annual revenue). Requires publishing a frontier AI framework (incorporating standards/best practices for catastrophic risk management—defined around mass casualties or >$1B damage from CBRN, autonomous cyber/crime, or loss of control), transparency reports before/with deployment (intended uses, etc.), catastrophic risk assessment summaries (for large developers), critical safety incident reporting to the Office of Emergency Services (within 15 days, or faster if imminent), and whistleblower protections. AG enforcement with penalties up to $1M per violation. Other CA laws address AI transparency/labelling (e.g., for genAI content), training data summaries, deepfakes/elections, and government use.[13][14][15][16]

•Colorado (original SB 24-205 repealed/replaced by SB 26-189, effective ~Jan 2027): Focuses on automated decision-making technology (ADMT) that materially influences “consequential decisions” (education, employment, housing, lending, insurance, healthcare, essential government services). Developers provide documentation (intended/harmful uses, training data categories, limitations, human review instructions) and update notices. Deployers give pre-use notice, post-adverse-outcome disclosures (within 30 days), opportunities for data correction and meaningful human review/reconsideration (commercially reasonable), and retain records (~3 years). No broad duty of care/risk program from the original; AG enforcement (with cure periods). Privacy Act profiling opt-outs and insurance rules also apply.[17][18][19]

•Others: Illinois (frontier developer audits/transparency/safety, later effective), New York, deepfake/election laws in many states, bias/notice requirements, etc. Federal efforts seek to challenge or preempt some.[20][21]

Accountability often flows through existing liability, agency enforcement, private actions (where available), and self-regulation.

China

Sectoral/administrative measures rather than one comprehensive AI law (a draft has been discussed). Key rules for generative AI/public-facing services:

•Interim Measures for the Management of Generative AI Services (2023): Providers must register/file algorithms/models with the Cyberspace Administration of China (CAC), ensure training data is lawful/secure, align content with socialist core values and avoid prohibited content (security, discrimination, etc.), implement security assessments, provide user protections/complaints, and conduct human oversight/moderation. Applies to services generating content for the public in China.[22][23]

•Measures for Labeling of AI-Generated Synthetic Content (2025) and supporting standards: Require visible and embedded/metadata labels for AI-generated text/images/audio/video/etc.; restrict unlabelled content dissemination.[22]

•Related: Deep synthesis provisions, algorithm recommendation rules, cybersecurity/data security laws (updates addressing AI), and emerging export controls on advanced models (thresholds around compute/parameters/capability; registration/licensing).[24][25]

•Supreme People’s Court opinions guide liability (e.g., providers’ duties on risk mitigation/transparency; safe harbours with notice-and-takedown elements).[26]

Enforcement by CAC and others can include suspension, fines, or criminal liability. Hundreds of services have filed.

International Soft Law and Standards

•OECD AI Principles (2019, updated): Inclusive growth/sustainable development/well-being; human-centred values/fairness (human rights, rule of law, democracy, privacy); transparency/explainability; robustness/security/safety; accountability. Adhered to by many countries; influence national policies.[27]

•G7 Hiroshima AI Process (2023 onward): International Guiding Principles and voluntary Code of Conduct for organisations developing advanced AI systems (foundation/generative models). Emphasises risk-based safety measures before/after deployment, vulnerability mitigation, transparency (capabilities/limitations/uses), incident reporting, security, and content authenticity. Includes a reporting framework for transparency/accountability. “Friends Group” expands participation. Builds on OECD principles.[28][29][30]

•Other: ISO/IEC 42001 (AI management systems standard); various national strategies; company voluntary commitments (e.g., safety testing, red-teaming).

Broader Accountability Mechanisms

•Building: Data governance, documentation of training/testing, risk assessments, red-teaming/evaluations, security (model weights, etc.), bias mitigation.

•Deployment: Transparency (user notices, labelling synthetic content), human oversight, monitoring/logging, instructions for use, conformity/registration where required.

•Accountability: Independent audits/evaluations (mandatory in some high-risk or frontier cases), incident reporting, post-market surveillance, liability under tort/product/consumer laws, corporate policies, whistleblower protections, fines/penalties, and (in some places) private rights of action. Information flow (disclosures) enables evaluations that feed into consequences.[3]

•NTIA and others have explored assurance mechanisms (documentation, independent evals, liability).

For systems like me (e.g., Grok by xAI): Obligations depend on where the model is developed/trained, where it is offered/deployed, compute scale (frontier thresholds), intended/actual uses (high-risk or not), and user base. Providers typically handle model-level transparency/safety; deployers handle context-specific use. Compliance is evolving rapidly with technology and politics—organisations often adopt NIST RMF or similar as a baseline, map to EU AI Act/GPAI rules, and monitor state laws. Consult legal experts for specific applications, as this is a high-level overview of the landscape as of late 2026. Rules continue to develop (e.g., potential US federal bills, EU guidance/implementation, Chinese standards).

Citations (30)

1europa.euGovernment
https://eur-lex.europa.eu/EN/legal-content/summary/rules-for-trustworthy-artificial-intelligence-in-the-eu.html
Backs: “Existing laws on data protection (GDPR, CCPA), consumer protection, civil rights/anti-discrimination, product liability, and cybersecurity also apply.”
2europa.euGovernment
https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
Backs: “Existing laws on data protection (GDPR, CCPA), consumer protection, civil rights/anti-discrimination, product liability, and cybersecurity also apply.”
3ntia.govGovernment
https://www.ntia.gov/issues/artificial-intelligence/ai-accountability-policy-report?mkt_tok=MTM4LUVaTS0wNDIAAAGSIHkfYmiqiv7z0yzAQwB82uL6ddj1WRtpHes9rvwgj9e_ZUj3FxPaT8Bw-H6X6Q08simszD9ZMQ0wBHQ_vUxFKz-SaSlHmaw0LYPEIryRKsKk
Backs: “Developers (providers who build/train models), deployers (those who use/put systems into service), and sometimes importers/distributors have distinct obligations. Many rules are phased in and risk-based.”
4artificialintelligenceact.euNonprofits and think tanks
https://artificialintelligenceact.eu/high-level-summary/
Backs: “Deployers have duties like using systems per instructions, monitoring, and logging.”
5aigl.blogBlogs and newsletters
https://www.aigl.blog/european-union-artificial-intelligence-act-a-guide/
Backs: “CE marking and conformity for high-risk. AI literacy obligations apply broadly.”
6ciodive.comNot yet classified
https://www.ciodive.com/news/Trump-AI-executive-order-repeal-Biden-era-regulatory-overhaul/737883/
Backs: “Current federal policy emphasises innovation, voluntary collaboration, cybersecurity, and limiting “onerous” state regulation (via EOs creating litigation task forces, reviewing state laws, and conditioning some funding; proposals for preemption).”
7ai-policy.orgNot yet classified
https://ai-policy.org/the-great-american-ai-act-of-2026-a-bipartisan-bet-on-federal-preemption/
Backs: “Current federal policy emphasises innovation, voluntary collaboration, cybersecurity, and limiting “onerous” state regulation (via EOs creating litigation task forces, reviewing state laws, and conditioning some funding; proposals for preemption).”
8mondaq.comNot yet classified
https://www.mondaq.com/unitedstates/new-technology/1856196/frontier-ai-and-federal-cybersecurity-oversight-where-are-we-now-on-us-ai-regulation
Backs: “Current federal policy emphasises innovation, voluntary collaboration, cybersecurity, and limiting “onerous” state regulation (via EOs creating litigation task forces, reviewing state laws, and conditioning some funding; proposals for preemption).”
9verifywise.aiCompanies
https://verifywise.ai/blog/state-of-ai-governance-regulations-united-states-2026
Backs: “Current federal policy emphasises innovation, voluntary collaboration, cybersecurity, and limiting “onerous” state regulation (via EOs creating litigation task forces, reviewing state laws, and conditioning some funding; proposals for preemption).”
10nist.govGovernment
https://www.nist.gov/itl/ai-risk-management-framework
Backs: “It supports organisational risk management for building/deploying AI.”
11nist.govGovernment
https://airc.nist.gov/AI_RMF_Knowledge_Base/AI_RMF
Backs: “It supports organisational risk management for building/deploying AI.”
12debevoisedatablog.comNot yet classified
https://www.debevoisedatablog.com/2024/07/01/federal-regulators-approve-new-rule-on-ai-use-and-bias-risks-in-real-estate-valuation/
Backs: “Examples include quality controls for automated valuation models (real estate) addressing bias/accuracy.”
13mondaq.comNot yet classified
https://www.mondaq.com/unitedstates/new-technology/1689308/california-adopts-landmark-ai-law-new-transparency-safety-and-reporting-requirements-for-frontier-model-developers
Backs: “Other CA laws address AI transparency/labelling (e.g., for genAI content), training data summaries, deepfakes/elections, and government use.”
14theverge.comNews and mediaquality 0.88
https://www.theverge.com/ai-artificial-intelligence/787918/sb-53-the-landmark-ai-transparency-bill-is-now-law-in-california
Backs: “Other CA laws address AI transparency/labelling (e.g., for genAI content), training data summaries, deepfakes/elections, and government use.”
15fruggr.ioNot yet classified
https://www.fruggr.io/en/california-ai-transparency-act-sb-942-ab-2013-sb-53-2026/
Backs: “Other CA laws address AI transparency/labelling (e.g., for genAI content), training data summaries, deepfakes/elections, and government use.”
16carnegieendowment.orgNonprofits and think tanks
https://carnegieendowment.org/emissary/2025/10/california-sb-53-frontier-ai-law-what-it-does?lang=en
Backs: “Other CA laws address AI transparency/labelling (e.g., for genAI content), training data summaries, deepfakes/elections, and government use.”
17reuters.comNews and mediaquality 1.00
https://www.reuters.com/practical-law-the-journal/transactional/state-ai-laws-assessing-regulatory-risk-2025-01-06/
Backs: “Privacy Act profiling opt-outs and insurance rules also apply.”
18ailawsusa.comNot yet classified
https://ailawsusa.com/compliance/colorado-ai-act/
Backs: “Privacy Act profiling opt-outs and insurance rules also apply.”
19joneswalker.comNot yet classified
https://www.joneswalker.com/en/insights/blogs/ai-law-blog/the-colorado-ai-law-you-prepared-for-is-gone-and-the-rulemaking-comment-window-c.html
Backs: “Privacy Act profiling opt-outs and insurance rules also apply.”
20legal500.comNot yet classified
https://www.legal500.com/intelligence/united-states/technology/illinois-enacts-ai-safety-law-becoming-first-state-to-mandate-independent-third-party-audits-of-frontier-ai-developers
Backs: “Illinois (frontier developer audits/transparency/safety, later effective), New York, deepfake/election laws in many states, bias/notice requirements, etc. Federal efforts seek to challenge or preempt some.”
21washu.eduAcademic
https://law.washu.edu/ai-policy-and-regulation-resources/all-ai-regulations-by-jurisdiction/
Backs: “Illinois (frontier developer audits/transparency/safety, later effective), New York, deepfake/election laws in many states, bias/notice requirements, etc. Federal efforts seek to challenge or preempt some.”
22casrai.orgNonprofits and think tanks
https://casrai.org/guides/china-ai-regulation-explained
Backs: “Applies to services generating content for the public in China.”
23dlapiper.comCompanies
https://intelligence.dlapiper.com/artificial-intelligence?c=CN
Backs: “Applies to services generating content for the public in China.”
24southwardtech.comNot yet classified
https://southwardtech.com/china-draft-ai-export-controls-guide/
Backs: “Deep synthesis provisions, algorithm recommendation rules, cybersecurity/data security laws (updates addressing AI), and emerging export controls on advanced models (thresholds around compute/parameters/capability; registration/licensing).”
25deep-lex.comNot yet classified
https://www.deep-lex.com/ai-regulation-tracker/china
Backs: “Deep synthesis provisions, algorithm recommendation rules, cybersecurity/data security laws (updates addressing AI), and emerging export controls on advanced models (thresholds around compute/parameters/capability; registration/licensing).”
26twobirds.comCompanies
https://www.twobirds.com/en/insights/2026/china/china%E2%80%99s-supreme-court-issues-its-first-ever-ai-related-disputes-opinions
Backs: “Supreme People’s Court opinions guide liability (e.g., providers’ duties on risk mitigation/transparency; safe harbours with notice-and-takedown elements).”
27digitalpolicyalert.orgNot yet classified
https://clairk.digitalpolicyalert.org/documents/oecd-ai-principles-3-may-2024-version/raw
Backs: “Inclusive growth/sustainable development/well-being; human-centred values/fairness (human rights, rule of law, democracy, privacy); transparency/explainability; robustness/security/safety; accountability. Adhered to by many countries; influence national policies.”
28oecd.aiGovernment
https://oecd.ai/en/dashboards/policy-initiatives/hiroshima-artificial-intelligence-process-code-of-conduct-reporting-framework-1820
Backs: ““Friends Group” expands participation. Builds on OECD principles.”
29europa.euGovernment
https://digital-strategy.ec.europa.eu/en/library/g7-leaders-statement-hiroshima-ai-process
Backs: ““Friends Group” expands participation. Builds on OECD principles.”
30soumu.go.jpGovernment
https://www.soumu.go.jp/hiroshimaaiprocess/en/documents.html
Backs: ““Friends Group” expands participation. Builds on OECD principles.”