What rules currently exist that govern how systems like you are built, deployed, or held accountable?
Rules governing AI systems like large language models (LLMs) or general-purpose AI (GPAI) focus on risk-based approaches covering development (building), deployment/use, and accountability/enforcement. There is no single global regime; instead, a mix of binding laws (especially the EU AI Act), national/sectoral rules, voluntary frameworks, and international principles. These emphasize safety, transparency, human oversight, risk management, non-discrimination, and fundamental rights, with varying levels of obligation based on risk and capability.[1][2]
The landscape evolves quickly (as of late 2026), with phased implementations, amendments, and efforts toward harmonization or preemption. Existing laws (e.g., data protection like GDPR, consumer protection, product liability, anti-discrimination, cybersecurity) also apply.
European Union: The AI Act (Primary Comprehensive Binding Framework)
The EU AI Act (Regulation (EU) 2024/1689, as amended by the Digital Omnibus on AI) is the world’s first broad horizontal AI law. It entered into force in August 2024, with staggered application (prohibitions/AI literacy from Feb 2025; GPAI from Aug 2025; most rules from Aug 2026; high-risk Annex III from Dec 2027; some product-linked later). It has extraterritorial reach for systems placed on the EU market or affecting people there.[2][2]
It uses a risk-based approach:
GPAI/general-purpose models (like many LLMs): Transparency obligations (technical documentation, info for downstream users, training data summary). Systemic-risk models (presumed above ~10^25 FLOPs or equivalent capability) face additional risk assessment/mitigation, evaluation, cybersecurity, and incident reporting. A Code of Practice and AI Office support compliance/enforcement.[3][2]
Accountability/enforcement: National market surveillance authorities + EU AI Office (especially for GPAI). Fines up to €35M or 7% global turnover (prohibited practices) or €15M/3% (other). Post-market monitoring, serious incident reporting, and corrective actions required. Providers (developers placing on market) and deployers (users) share duties; supply chain roles (importers/distributors) have obligations. AI literacy duties apply broadly. Product liability updates treat AI/software as products.[5][1]
Exemptions exist for pure research, military/national security (narrowly), and some open-source.
United States: Patchwork of State Laws, Federal Guidance, and Voluntary Frameworks
No comprehensive federal AI statute exists. Policy emphasizes innovation and leadership, with executive orders (e.g., revoking prior safety-focused EO 14110; promoting dominance via EO 14179 and others; voluntary frontier model frameworks; efforts via EO 14365 to challenge/preempt “onerous” state laws through litigation and funding). Existing agencies (FTC for unfair/deceptive practices, sector regulators) and laws apply. Federal agencies follow OMB memos on governance, inventories, and procurement.[6][7][8]
Key state laws (examples; many focus on specific uses or large models):
NIST AI Risk Management Framework (AI RMF 1.0, 2023 + Generative AI Profile): Voluntary but highly influential. Core functions—Govern (culture, accountability, policies), Map (context, risks, impacts), Measure (testing/metrics), Manage (prioritize/respond)—promote trustworthy AI characteristics: valid/reliable, safe, secure/resilient, accountable/transparent, explainable/interpretable, privacy-enhanced, fair (bias managed). Used for building, deploying, and evaluating systems; profiles address generative AI risks (e.g., confabulation, provenance).[12][13]
Accountability often via civil liability, AG enforcement, private actions, or sector rules. Frontier voluntary processes may involve government access/evaluation.
China
Sectoral/administrative measures rather than one comprehensive law (a national AI law remains in discussion/draft stages). Key for generative AI:
Enforcement by Cyberspace Administration of China (CAC) and others; filings/registrations common.
Other National Approaches
International Principles and Treaties
Common Themes for Building, Deployment, and Accountability
Building/Development: Risk/impact assessments; data quality/governance (provenance, bias mitigation, legality/copyright); documentation/technical specs; testing/evaluation (including red-teaming for high-risk/frontier); security/cyber; safety frameworks for large models; quality management systems.[4]
Deployment/Use: Transparency/disclosure (AI interaction, generated content labeling/provenance); human oversight/review (especially consequential decisions); monitoring/logging; intended-use compliance; notices to affected people; fundamental rights considerations.[22]
Accountability: Clear roles (providers vs. deployers); incident/critical safety reporting; audits (independent in some cases); whistleblower protections; liability (civil, sometimes no-fault product); enforcement by regulators/AGs with fines/penalties; registration/databases for high-risk; post-market obligations. Organizations often map to the strictest applicable rules (e.g., EU for global ops). Voluntary standards (ISO/IEC 42001 AI management, NIST) support compliance.[13][10]
For systems like Grok (xAI-built LLMs), relevant rules typically include GPAI/transparency obligations (if serving EU users), frontier safety reporting (if meeting compute/revenue thresholds in CA/NY/etc.), content labeling where required (China/EU), and general risk management. Sectoral overlays (healthcare, finance, employment) add requirements. Companies often adopt internal governance aligned with NIST/OECD/EU to manage multi-jurisdictional exposure.
This is a high-level overview—specific obligations depend on system capabilities, use cases, location of providers/users/data, and exact thresholds. Laws continue to develop (e.g., US preemption debates, China export rules, EU guidance/Codes of Practice). Consult legal experts and official texts for compliance, as this is not advice. Official sources include the EU AI Act text, NIST publications, national gazettes, and OECD/UNESCO sites.
Citations (22)
- https://nhimg.org/global-ai-regulation-map
Backs: “These emphasize safety, transparency, human oversight, risk management, non-discrimination, and fundamental rights, with varying levels of obligation based on risk and capability.”
background, data page. Claim: No single global AI regime exists; a mix of binding laws, national rules, voluntary frameworks and international principles applies.
- https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
Backs: “These emphasize safety, transparency, human oversight, risk management, non-discrimination, and fundamental rights, with varying levels of obligation based on risk and capability.”
evidence, official document. Claim: EU AI Act uses a risk-based approach with staggered application, prohibited practices, transparency duties for chatbots and generative AI content.
- https://eur-lex.europa.eu/EN/legal-content/summary/rules-for-trustworthy-artificial-intelligence-in-the-eu.html
Backs: “Deployers must follow instructions, ensure oversight/monitoring, maintain logs, inform affected people, and report serious incidents. Fundamental rights impact assessments apply in some cases.”
evidence, official document. Claim: High-risk system obligations and GPAI transparency and systemic-risk duties under the EU AI Act.
- https://artificialintelligenceact.eu/high-level-summary/
Backs: “Deployers must follow instructions, ensure oversight/monitoring, maintain logs, inform affected people, and report serious incidents. Fundamental rights impact assessments apply in some cases.”
evidence, article. Claim: High-risk providers must implement risk management, data governance, documentation, oversight; common development themes.
- https://www.shiftquality.com/post/ai-regulation-tracker
Backs: “AI literacy duties apply broadly. Product liability updates treat AI/software as products.”
evidence, article. Claim: EU AI Act enforcement, fines, post-market monitoring and provider/deployer duties.
- https://www.whitehouse.gov/presidential-actions/2025/12/eliminating-state-law-obstruction-of-national-artificial-intelligence-policy/?query-11-page=5&trk=article-ssr-frontend-pulse_little-text-block
Backs: “Federal agencies follow OMB memos on governance, inventories, and procurement.”
evidence, official document. Claim: US executive action to challenge or preempt state AI laws; federal policy emphasizes innovation.
- https://legalclarity.org/ai-governance-oversight-laws-requirements-and-penalties/
Backs: “Federal agencies follow OMB memos on governance, inventories, and procurement.”
background, article. Claim: US federal approach relies on existing agencies and laws such as FTC authority.
- https://nhimg.org/us-federal-ai-policy-guide
Backs: “Federal agencies follow OMB memos on governance, inventories, and procurement.”
background, article. Claim: US federal AI policy: no comprehensive statute, executive orders, OMB memos on governance and procurement.
- https://actaicompliance.com/guides/us-state-ai-laws/
Backs: “Requires published safety frameworks, transparency reports, critical incident reporting (tight timelines), whistleblower protections.”
evidence, article. Claim: California SB 53 and Colorado AI Act requirements for frontier developers and automated decision-making.
- https://metr.org/notes/2026-01-29-frontier-ai-safety-regulations/
Backs: “Requires published safety frameworks, transparency reports, critical incident reporting (tight timelines), whistleblower protections.”
evidence, article. Claim: Frontier AI safety regulations: safety frameworks, incident reporting, whistleblower protections; accountability mechanisms.
- https://www.legal500.com/intelligence/united-states/corporate-commercial-law/the-big-long-list-of-us-ai-laws
Backs: “New York RAISE Act (frontier developers, incident reporting); transparency/disclosure for generative AI/chatbots (CA SB 942 and others); bias audits (e.g., NYC employment tools); deepfake/election rules; various on content labeling or high-risk uses.”
further reading, article. Claim: Other US state AI laws such as chatbot disclosure, deepfake and bias audit rules.
- https://www.nist.gov/itl/ai-risk-management-framework
Backs: “Used for building, deploying, and evaluating systems; profiles address generative AI risks (e.g., confabulation, provenance).”
evidence, official document. Claim: NIST AI RMF is voluntary with Govern, Map, Measure, Manage functions.
- https://www.sai360.com/resources/blog/a-guide-to-ai-model-governance-and-risk-management-frameworks
Backs: “Used for building, deploying, and evaluating systems; profiles address generative AI risks (e.g., confabulation, provenance).”
background, article. Claim: NIST framework and AI governance standards support compliance and accountability.
- https://casrai.org/guides/china-ai-regulation-explained
Backs: “Providers of public-facing services must ensure lawful training data, content safety/compliance with socialist values, security assessments/algorithm filing (especially for public-opinion attributes), user protections/complaint channels.”
evidence, article. Claim: China's generative AI interim measures and AI content labeling rules.
- https://www.deep-lex.com/ai-regulation-tracker/china
Backs: “Supreme Court opinions guide liability (e.g., safe harbor for providers taking measures on notice).”
evidence, data page. Claim: China's related rules, draft export controls and Supreme Court liability guidance.
- https://oecd.ai/en/dashboards/policy-initiatives/oecd-ai-principles-9705
Backs: “Inclusive growth/sustainable development; human rights/rule of law/fairness/privacy; transparency/explainability; robustness/security/safety; accountability. Guide policy and company practices.”
evidence, data page. Claim: OECD AI Principles (2019, updated 2024) cover transparency, safety, accountability.
- https://tinyurl.com/dkkjef5j
Backs: “Inclusive growth/sustainable development; human rights/rule of law/fairness/privacy; transparency/explainability; robustness/security/safety; accountability. Guide policy and company practices.”
further reading, other. Claim: OECD AI Principles guide policy and company practices (shortened link).
- https://oecd.ai/en/dashboards/policy-initiatives/recommendation-on-the-ethics-of-artificial-intelligence
Backs: “Policy actions on impact assessments, governance, data, education, etc.; readiness tools for states.”
evidence, data page. Claim: UNESCO Recommendation on the Ethics of AI (2021) sets global values and principles.
- https://aigovernance.com/entry/unesco-recommendation-ai-ethics
Backs: “Policy actions on impact assessments, governance, data, education, etc.; readiness tools for states.”
evidence, reference entry. Claim: UNESCO recommendation policy actions and readiness tools for states.
- https://eur-lex.europa.eu/EN/legal-content/summary/artificial-intelligence-and-human-rights-democracy-and-the-rule-of-law.html
Backs: “Implemented in EU via the AI Act. Excludes pure national defense/research (with caveats).”
evidence, official document. Claim: Council of Europe Framework Convention is the first binding international AI treaty on human rights, democracy and rule of law.
- https://www.europarl.europa.eu/pdfs/news/expert/2026/3/press_release/20260306IPR37524/20260306IPR37524_en.pdf
Backs: “Implemented in EU via the AI Act. Excludes pure national defense/research (with caveats).”
evidence, official document. Claim: EU ratification status of the Council of Europe AI convention.
- https://iaim.ai/ai-regulation/
Backs: “Transparency/disclosure (AI interaction, generated content labeling/provenance); human oversight/review (especially consequential decisions); monitoring/logging; intended-use compliance; notices to affected people; fundamental rights considerations.”
background, article. Claim: Deployment themes: transparency, human oversight, monitoring, and notices to affected people.