What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Here’s the short, practical map of the main rules in force today (as of October 25, 2026) that govern how systems like me are built, deployed, and held accountable.

International “baseline” frameworks (soft law, but widely used)

•OECD AI Principles (updated May 2024) set cross‑cutting expectations on safety, transparency, accountability and human rights; many regulators reference them.[1]

•UNESCO Recommendation on the Ethics of AI (adopted Nov 2021) guides Member States on safeguards, impact assessment, and governance.[2]

•Council of Europe Framework Convention on AI (opened for signature Sept 5, 2024). It’s a binding treaty once five states ratify; as of late 2026 it’s signed by many but not yet in force.[3]

European Union (binding, risk‑based)

•AI Act (Regulation (EU) 2024/1689): entered into force Aug 1, 2024 with staged application. Key dates: prohibitions apply from Feb 2, 2025; general‑purpose AI (foundation model) rules from Aug 2, 2025; transparency duties (e.g., AI interactions, deepfake labeling) and core enforcement from Aug 2, 2026; added prohibitions for non‑consensual sexual deepfakes/CSAM from Dec 2, 2026; Annex III high‑risk rules from Dec 2, 2027; and product‑embedded high‑risk rules by Aug 2, 2028.[4]

•Product liability: the revised Product Liability Directive (EU) 2024/2853 modernizes strict liability and expressly covers software/AI; Member States must transpose it, strengthening recourse for AI‑caused harm.[5]

•Platform and data rules that bite AI systems: the Digital Services Act (since Feb 17, 2024 for all platforms; earlier for VLOPs) imposes transparency and risk‑mitigation around recommender systems/algorithms and audits; GDPR (including Article 22) restricts solely automated, significant decisions and ensures data‑subject rights.[6]

United States (no single federal AI law; a web of agency rules, standards, and state laws)

•Federal executive/agency governance: President Biden’s EO 14110 (Oct 30, 2023) was rescinded on Jan 20, 2025; OMB subsequently replaced the 2024 AI memos with updated guidance (e.g., M‑25‑21/M‑25‑22) that governs how federal agencies use and buy AI. These bind U.S. agencies (not private firms).[7]

•Voluntary technical standard: NIST’s AI Risk Management Framework (AI RMF 1.0, Jan 26, 2023) is the de‑facto U.S. benchmark many companies and regulators look to for AI governance, risk controls, and documentation.[8]

•Consumer protection and civil‑rights enforcement (applies to AI uses):

•FTC uses Section 5 (unfair/deceptive acts): warns against overstating AI capabilities and deceptive AI uses.[9]

•CFPB: lenders using “black‑box” or complex models must give real reasons for credit denials under ECOA/Reg B; guidance emphasizes explainability in adverse‑action notices.[10]

•EEOC: enforces anti‑discrimination in hiring; has an AI and Algorithmic Fairness initiative and technical assistance.[11]

•State and local laws now imposing concrete duties:

•New York City Local Law 144 (effective Jan 1, 2023; enforced since July 5, 2023): independent bias audits and notices for Automated Employment Decision Tools used in NYC hiring/promotion.[12]

•California SB 53 (Transparency in Frontier AI Act) signed Sept 29, 2025: requires large “frontier” model developers to publish safety protocols and report critical incidents; effective from 2026.[13]

•New York State’s RAISE Act (signed Dec 19, 2025): imposes transparency, safety‑plan, and incident‑reporting duties on frontier model developers.[14]

•Colorado SB26‑189 (Automated Decision‑Making Technology Act, signed May 14, 2026; effective Jan 1, 2027): duties for developers and deployers when ADMT materially influences “consequential” decisions (e.g., jobs, credit, housing, health).[15]

•Colorado HB26‑1263 (Conversational AI Service Operator Requirements, signed May 29/June 1, 2026; effective Jan 1, 2027): age‑estimation and special safeguards for minors; AI disclosure; self‑harm response protocols; annual reporting.[16]

United Kingdom (principles‑led, regulator‑centric)

•No horizontal “UK AI Act” yet. The government applies a pro‑innovation approach: existing regulators (ICO, CMA, Ofcom, FCA, MHRA, etc.) interpret cross‑cutting AI principles; the UK AI Safety Institute publishes evaluations and safety research used by government. UK GDPR and sector laws govern data use and high‑risk applications.[17]

China (binding, service‑provider rules)

•Algorithmic Recommendation Provisions (effective Mar 1, 2022), Deep Synthesis Provisions (effective Jan 10, 2023), and Interim Measures for Generative AI Services (issued July 2023; effective Aug 15, 2023) set registration, labeling, safety, and content‑governance duties on providers.[18]

•The U.S. Copyright Office’s guidance (Mar 16, 2023; updated work program in 2025) clarifies that only the human‑authored portions of AI‑assisted works are protectable; applicants must disclose AI‑generated content in registrations.[19]

What this means in practice

•If you build or deploy AI in the EU, the AI Act’s timelines and your system’s risk tier now determine core obligations, with additional duties from DSA/GDPR and the updated Product Liability regime.[4]

•In the U.S., align to sectoral law and enforcement (FTC/CFPB/EEOC), follow NIST AI RMF for governance, and watch state laws (NYC, CA, NY, CO) that impose concrete audits, transparency, and incident‑reporting.[8]

•In the UK, expect regulator guidance and AISI evaluations to shape expectations alongside UK GDPR.[17]

•In China, public‑facing generative and deep‑synthesis services face registration, testing, and labeling obligations.[20]

Want a quick, tailored checklist? Tell me:

•Your primary market(s) (e.g., EU, U.S., UK, China),

•What your system does (e.g., hiring screening, lending, health, chat assistant),

•Whether it’s public‑facing or B2B, and

•Whether you train, fine‑tune, or only deploy third‑party models.

I’ll map the exact obligations, docs, and tests you need to implement now versus by specific future dates.

Citations (20)

1oecd.aiGovernment
AI Principles Overview - OECD.AI
Backs: “OECD AI Principles (updated May 2024) set cross‑cutting expectations on safety, transparency, accountability and human rights; many regulators reference them.”
2unesco.orgGovernment
Recommendation on the Ethics of Artificial Intelligence - Legal Affairs
Backs: “UNESCO Recommendation on the Ethics of AI (adopted Nov 2021) guides Member States on safeguards, impact assessment, and governance.”
3coe.intGovernment
The Framework Convention on Artificial Intelligence - Artificial Intelligence
Backs: “It’s a binding treaty once five states ratify; as of late 2026 it’s signed by many but not yet in force.”
4europa.euGovernment
Timeline for the Implementation of the EU AI Act | AI Act Service Desk
Backs: “Annex III high‑risk rules from Dec 2, 2027; and product‑embedded high‑risk rules by Aug 2, 2028.”
5europa.euGovernment
Directive - 2024/2853 - EN - Product Liability Directive - EUR-Lex
Backs: “Member States must transpose it, strengthening recourse for AI‑caused harm.”
6europa.euGovernment
Regulation - 2022/2065 - EN - DSA - EUR-Lex
Backs: “GDPR (including Article 22) restricts solely automated, significant decisions and ensures data‑subject rights.”
7nist.govGovernment
Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence | NIST
Backs: “OMB subsequently replaced the 2024 AI memos with updated guidance (e.g., M‑25‑21/M‑25‑22) that governs how federal agencies use and buy AI. These bind U.S. agencies (not private firms).”
8nist.govGovernment
Artificial Intelligence Risk Management Framework (AI RMF 1.0) | NIST
Backs: “NIST’s AI Risk Management Framework (AI RMF 1.0, Jan 26, 2023) is the de‑facto U.S. benchmark many companies and regulators look to for AI governance, risk controls, and documentation.”
9context.centerNot yet classified
Keep your AI claims in check
Backs: “FTC uses Section 5 (unfair/deceptive acts): warns against overstating AI capabilities and deceptive AI uses.”
10consumerfinance.govGovernment
Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms | Consumer Financial Protection Bureau
Backs: “CFPB: lenders using “black‑box” or complex models must give real reasons for credit denials under ECOA/Reg B; guidance emphasizes explainability in adverse‑action notices.”
11eeoc.govGovernment
EEOC Launches Initiative on Artificial Intelligence and Algorithmic Fairness | U.S. Equal Employment Opportunity Commission
Backs: “EEOC: enforces anti‑discrimination in hiring; has an AI and Algorithmic Fairness initiative and technical assistance.”
12nyc.govGovernment
Automated Employment Decision Tools (AEDT) - DCWP
Backs: “New York City Local Law 144 (effective Jan 1, 2023; enforced since July 5, 2023): independent bias audits and notices for Automated Employment Decision Tools used in NYC hiring/promotion.”
13ca.govGovernment
Governor Newsom signs SB 53, advancing California’s world-leading artificial intelligence industry | Governor of California
Backs: “California SB 53 (Transparency in Frontier AI Act) signed Sept 29, 2025: requires large “frontier” model developers to publish safety protocols and report critical incidents; effective from 2026.”
14ny.govGovernment
Governor Hochul Signs Nation-Leading Legislation to Require AI Frameworks for AI Frontier Models | Governor Kathy Hochul | New York State
Backs: “New York State’s RAISE Act (signed Dec 19, 2025): imposes transparency, safety‑plan, and incident‑reporting duties on frontier model developers.”
15colorado.govGovernment
SB26-189 Automated Decision-Making Technology | Colorado General Assembly
Backs: “Colorado SB26‑189 (Automated Decision‑Making Technology Act, signed May 14, 2026; effective Jan 1, 2027): duties for developers and deployers when ADMT materially influences “consequential” decisions (e.g., jobs, credit, housing, health).”
16colorado.govGovernment
HB26-1263 Conversational AI Service Operator Requirements | Colorado General Assembly
Backs: “AI disclosure; self‑harm response protocols; annual reporting.”
17parliament.ukGovernment
AI regulation in the UK - House of Commons Library
Backs: “UK GDPR and sector laws govern data use and high‑risk applications.”
18cac.gov.cnGovernment
互联网信息服务算法推荐管理规定_中央网络安全和信息化委员会办公室
Backs: “Algorithmic Recommendation Provisions (effective Mar 1, 2022), Deep Synthesis Provisions (effective Jan 10, 2023), and Interim Measures for Generative AI Services (issued July 2023; effective Aug 15, 2023) set registration, labeling, safety, and content‑governance duties on providers.”
19govinfo.govGovernment
88 FR 16190 - Copyright Registration Guidance: Works Containing Material Generated by Artificial Intelligence - Content Details - 2023-05321
Backs: “Copyright Office’s guidance (Mar 16, 2023; updated work program in 2025) clarifies that only the human‑authored portions of AI‑assisted works are protectable; applicants must disclose AI‑generated content in registrations.”
20cac.gov.cnGovernment
生成式人工智能服务管理暂行办法_中央网络安全和信息化委员会办公室
Backs: “In China, public‑facing generative and deep‑synthesis services face registration, testing, and labeling obligations.”