Rules for how AI systems like me are built and held accountable are evolving fast — I'll map the current landscape for you.
There is no single global law for systems like me. Instead, rules are layered across hard law, voluntary standards, and international principles, shifting from broad principles to granular risk-based obligations:
1. Legally Binding Hard Law - Risk-Based Tiered Models
European Union - EU AI Act (Regulation (EU) 2024/1689) - the most comprehensive:
The Act is the first comprehensive regulation governing AI systems, and it's already in force. It was published July 2024 and effective since August 2024.
It uses a tiered approach:
> reserves its main obligations to only a subset of AI systems in order to balance the promotion of investment and innovation with the mitigation of risks
Specifically, it provides for three sets of rules tailored to level of risk: (i) unacceptable risk, (ii) high-risk and (iii) limited risk, commonly described as four levels: unacceptable, high, limited, and minimal.
•Unacceptable risk: Defines four levels of AI risk and prohibits nine categories of AI practices, including certain uses of emotion recognition, biometric categorization and real-time remote biometric identification. Prohibitions took effect February 2025
•High-Risk systems (e.g. hiring, credit scoring, biometric identification, critical infrastructure): Must meet strict, mandatory requirements, including strict Data Governance rules for training data. High-risk requirements have compliance timelines staggered 24-36 months, with Annex III standalone systems restructured to December 2, 2027
•General-Purpose AI (GPAI) / Foundation models: Rules governing general-purpose AI models became applicable August 2025. Providers of GPAI models that exceed 10^25 FLOPs of training compute, or that reach more than 10,000 registered business users, face obligations including model evaluations, documented adversarial testing, and direct incident reporting to the AI Office
•Transparency / Limited Risk: Article 50 transparency obligations require providers and deployers to tell people when they're interacting with a machine, and to mark AI-generated content so it can be flagged as such. Article 50 became applicable 2 August 2026, with fines up to €15 million or 3% of global turnover. Enterprises running generative AI tools now have to comply with Article 50
China - Centralized, state-centric:
China has the most strict and centralized AI regulations, focusing on:
•Algorithmic recommendation services regulation effective March 1, 2022
•Generative AI Measures requiring providers to suspend or terminate services if users violate laws
•Unlike the U.S., which encourages voluntary transparency, China mandates that all AI-generated content carry visible labels and embedded metadata
•Accountability Mechanisms: China's model enforces platform responsibility for labeling, auditing, and removing unlabeled contentand requires transparency in recommendation algorithms and content moderation, focusing on state control and societal stability rather than liability for harms
United States - No Single Federal AI Law, Patchwork Approach:
> In the US there is no single federal AI law; a patchwork applies
> Rather than implementing a comprehensive binding statute comparable to the EU AI Act, the U.S. relies on a non-binding, innovation-supportive framework centered on Executive Order 14110 and the NIST AI Risk Management Framework
•Federal voluntary framework: This approach reflects a preference for sector-specific regulation, agency guidance, and voluntary compliance mechanisms. NIST also created the AI Risk Management Framework, released in January 2023, which is a voluntary system meant to reduce risks associated with AI
•Existing agency enforcement: FTC's authority over unfair and deceptive practices (Section 5), EEOC, CFPB, HIPAA, FDA, SEC are applied to AI
•Executive Orders: Executive Order 13960 (2020) mandated trustworthy and transparent government use, Executive Order 14110 (2023) shifted focus to AI safety and risk management, directing agencies to evaluate sector-specific risks and supporting technical standards through the new U.S. AI Safety Institute at NIST
•State Laws - increasingly granular (38 states adopted roughly 100 laws in 2025):
•Colorado AI Act (SB 205, effective Jan 1, 2027): Applies specifically to “high-risk” systems that make a consequential decision and establishes a duty of care for developers and deployers to prevent algorithmic discrimination, creating accountability through transparency, documentation, and risk management requirements
•California: Training-data transparency law (AB 2013) and AI-content disclosure law (SB 942); Transparency in Frontier Artificial Intelligence Act (SB 53) requiring large frontier AI developers to disclose risk management protocols, annual comprehensive risk assessments and safety frameworks
•Other examples: Illinois biometric privacy law (BIPA), Utah AI Policy Act, New York Algorithmic Pricing Disclosure Act effective November 2025
No federal statute has preempted state laws - State obligations remain fully in force
United Kingdom - Principles-based, Non-statutory:
> There is no UK AI Act in force. The UK currently follows a non-statutory, principles-based approach to AI regulation
> Unlike the EU, the UK did not introduce any new legislation and did not put the five principles on a statutory footing
The UK relies on a vertical approach, relying on expertise of existing regulators to tailor implementation. Guidelines are applied by existing regulators rather than a single AI law such as ICO, FCA, CMA, Ofcom through existing powers on data protection, fairness, and accountability.
The five cross-sector principles from the March 2023 White Paper are: safety and robustness; transparency; fairness; accountability; contestability and redress, also phrased as safety, transparency, fairness, accountability and contestability
2. Voluntary Standards and Soft-Law Frameworks
These frameworks guide how systems are built and managed before hard law applies:
•NIST AI Risk Management Framework (AI RMF 1.0): Voluntary U.S. framework for the governance, mapping, measurement, and management of AI risk, increasingly cited as foundation for proposed regulation, with a companion resource for generative AI (NIST AI 100-1)
•OECD AI Principles (2019, updated 2024): The most-cited principles, endorsed by ~50 countries. They Promote AI that is innovative, trustworthy, and human-centric with principles: transparency, accountability, robustness, and fairness. In detail they cover five values-based principles: inclusive growth/sustainable development/well-being; human rights and democratic values; transparency and explainability; robustness, security and safety; accountability
•UNESCO Recommendation on the Ethics of AI (2021): The first global normative instrument on the ethics of AI, adopted by 193 Member States, establishing internationally recognised principles including transparency, accountability, fairness, privacy, and human oversight
•Council of Europe Framework Convention on AI, Human Rights, Democracy and the Rule of Law: The first legally binding international treaty on AI, opened for signature September 2024
3. Common Accountability Model Emerging Globally
Jurisdictions are moving beyond broad principles towards more granular, risk-based obligations governing development, deployment and oversight. This increasingly means:
> identifying where AI is being used, assessing associated risks, establishing appropriate levels of human oversight, verifying AI-generated outputs and establishing clear lines of accountability for AI-driven decisions
In practice this means:
•Built: Data governance, documented adversarial testing, model evaluations, risk management frameworks, and secure development practices
•Deployed: Pre-deployment risk assessments, AI intake/approval processes where agencies must verify use cases meet requirements before deployment and day-to-day accountability rests with the owner agency, transparency disclosures, human oversight
•Held Accountable: Through provider/deployer distinction (EU, Colorado), platform liability (China), FTC deception authority, audit and incident reporting duties (72 hours under EU GPAI provisions), and rights to explanation for adverse decisions