What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Short answer: there isn’t a single global “AI law.” Today’s guardrails are a patchwork of general laws (consumer protection, privacy, anti‑discrimination, product safety), sector rules (health, finance, employment), plus several new AI‑specific regimes. Here are the most relevant ones as of October 26, 2026.

United States

•Federal policy and procurement

•Executive Order 14110 (Oct 30, 2023) was rescinded on Jan 20, 2025; it was replaced by Executive Order 14179 (Jan 23, 2025), which shifted emphasis to “removing barriers” and directed a new federal AI action plan. OMB followed with Memo M‑25‑21, updating how agencies govern and buy AI.[1]

•Cross‑cutting enforcement under existing laws

•FTC: policing deceptive AI marketing and unfair practices (e.g., “Operation AI Comply”). EEOC: Title VII applies to AI in hiring. CFPB: creditors using AI must give specific, accurate adverse‑action reasons (ECOA/Reg B). FCC: AI‑generated voice robocalls count as “artificial/prerecorded” voices under the TCPA and generally require prior consent.[2]

•States and cities (biggest current obligations)

•Colorado SB 24‑205 (the “ADMT Act”): for “high‑risk” AI used in consequential decisions, developers and deployers must run risk management programs, do impact assessments by Feb 1, 2026, give notices, and offer human review/appeals; AG enforcement. A 2026 “Chatbot Safety Act” added teen‑safety and disclosure duties for conversational AI. Rulemaking is underway.[3]

•California: the CPPA finalized Automated Decisionmaking Technology (ADMT) regulations—effective Jan 1, 2026 (with some phased compliance to Jan 1, 2027 for significant decisions)—adding pre‑use notices, access/opt‑out rights, and risk assessments. Separately, SB 53 (Transparency in Frontier AI Act) was signed Sept 29, 2025; frontier‑model developers must publish safety frameworks and report certain serious incidents.[4]

•New York City Local Law 144 (in force since July 2023): employers using Automated Employment Decision Tools must obtain an annual bias audit and provide candidate/employee notices.[5]

European Union

•EU AI Act (Regulation 2024/1689)

•In force since Aug 1, 2024; most rules started Aug 2, 2026. Bans on certain “unacceptable‑risk” practices applied from Feb 2, 2025. Transparency duties (Article 50) now require labeling of AI interactions and “deepfakes” (with a limited grace period for pre‑Aug 2, 2026 models until Dec 2, 2026). High‑risk system rules phase in later: standalone Annex III systems on Dec 2, 2027; high‑risk AI embedded in regulated products on Aug 2, 2028. Significant fines apply (up to €35m or 7% of global turnover for prohibited practices).[6]

•General‑purpose AI (foundation models): from Aug 2, 2026, providers must adopt a copyright‑compliance policy and publish a summary of training content, using an EU template; additional duties apply to “systemic‑risk” models.[7]

•Related EU laws you’ll feel

•Digital Services Act: very large platforms/search engines must assess and mitigate systemic risks, including those linked to recommender systems and AI‑generated content.[8]

•Revised Product Liability Directive (Directive 2024/2853): extends strict‑liability rules to software/AI, enabling claims for damage (including data loss) caused by defective AI products.[9]

United Kingdom

•No single “AI Act.” The government’s “pro‑innovation” framework asks existing regulators to apply five cross‑cutting principles (safety, transparency, fairness, accountability, contestability). The UK AI Safety Institute and ICO guidance (including Article 22 rights on solely automated decisions) are key reference points.[10]

Canada

•No federal AI statute in force; Bill C‑27’s AIDA did not pass. Organizations rely on general privacy/consumer laws (e.g., PIPEDA) and provincial regimes—most notably Québec’s Law 25, which since Sept 22, 2023 requires notice and the right to human review when decisions are made “exclusively” by automated processing. Federal agencies must follow the Directive on Automated Decision‑Making for administrative decisions.[11]

China

•Binding national rules already cover algorithmic recommendation (Mar 1, 2022), “deep synthesis”/synthetic media (Jan 10, 2023), and public‑facing generative AI (Interim Measures, Aug 15, 2023)—imposing disclosure, data‑management, safety, and content‑governance duties on providers.[12]

Standards and voluntary frameworks you’ll see in contracts, audits, and safe‑harbors

•NIST AI Risk Management Framework 1.0 (plus a Generative AI Profile) and the US AI Safety Institute/International Network of AI Safety Institutes drive testing and evaluation practices.[13]

•ISO/IEC 42001:2023 (certifiable AI management systems) and ISO/IEC 23894:2023 (AI risk management) are increasingly referenced in procurement and as compliance “ladders.”[14]

•IEEE 7000/7003 (ethics‑by‑design and algorithmic‑bias considerations).[15]

•G7 “Hiroshima Process” voluntary Code of Conduct for developers of advanced AI, with an OECD reporting framework. OECD’s AI Principles were updated in 2024.[16]

How accountability typically shows up

•Ex ante: risk assessments, impact assessments, testing/red‑teaming, transparency/disclosure (e.g., AI Act Article 50; CPPA ADMT; CO ADMT), human oversight, and governance systems (e.g., ISO/IEC 42001; NIST AI RMF).[17]

•Ex post: regulatory enforcement (FTC/CFPB/EEOC/FCC; EU AI Office/national authorities), product‑liability and unfair‑practice suits, audits and orders, and significant administrative fines under the EU AI Act.[2]

If you tell me your sector (e.g., hiring, lending, healthcare, consumer apps) and where you operate, I can map the exact obligations and key dates you need to meet.

Citations (17)

1whitehouse.govGovernment
Initial Rescissions Of Harmful Executive Orders And Actions – The White House
Backs: “OMB followed with Memo M‑25‑21, updating how agencies govern and buy AI.”
2ftc.govGovernment
FTC Announces Crackdown on Deceptive AI Claims and Schemes | Federal Trade Commission
Backs: “AI‑generated voice robocalls count as “artificial/prerecorded” voices under the TCPA and generally require prior consent.”
3colorado.govGovernment
SENATE BILL 24-205
Backs: “A 2026 “Chatbot Safety Act” added teen‑safety and disclosure duties for conversational AI. Rulemaking is underway.”
4ca.govGovernment
California Finalizes Regulations to Strengthen Consumers' Privacy
Backs: “Separately, SB 53 (Transparency in Frontier AI Act) was signed Sept 29, 2025; frontier‑model developers must publish safety frameworks and report certain serious incidents.”
5nyc.govGovernment
Automated Employment Decision Tools (AEDT) - DCWP
Backs: “New York City Local Law 144 (in force since July 2023): employers using Automated Employment Decision Tools must obtain an annual bias audit and provide candidate/employee notices.”
6europa.euGovernment
AI Act | Shaping Europe’s digital future
Backs: “Significant fines apply (up to €35m or 7% of global turnover for prohibited practices).”
7europa.euGovernment
Article 53: Obligations for providers of general-purpose AI models | AI Act Service Desk
Backs: “General‑purpose AI (foundation models): from Aug 2, 2026, providers must adopt a copyright‑compliance policy and publish a summary of training content, using an EU template; additional duties apply to “systemic‑risk” models.”
8europa.euGovernment
The Digital Services Act | Shaping Europe’s digital future
Backs: “Digital Services Act: very large platforms/search engines must assess and mitigate systemic risks, including those linked to recommender systems and AI‑generated content.”
9europa.euGovernment
Directive (EU) 2024/2853 of the European Parliament and of the Council of 23 October 2024 on liability for defective products and repealing Council Directive 85/374/EEC (Text with EEA relevance)
Backs: “Revised Product Liability Directive (Directive 2024/2853): extends strict‑liability rules to software/AI, enabling claims for damage (including data loss) caused by defective AI products.”
10gov.ukGovernment
A pro-innovation approach to AI regulation: government response - GOV.UK
Backs: “The UK AI Safety Institute and ICO guidance (including Article 22 rights on solely automated decisions) are key reference points.”
11dentons.comNot yet classified
Dentons - Doing business in Canada: Artificial intelligence and data
Backs: “Federal agencies must follow the Directive on Automated Decision‑Making for administrative decisions.”
12stanford.eduAcademic
Translation: Internet Information Service Algorithmic Recommendation Management Provisions – Effective March 1, 2022
Backs: “Binding national rules already cover algorithmic recommendation (Mar 1, 2022), “deep synthesis”/synthetic media (Jan 10, 2023), and public‑facing generative AI (Interim Measures, Aug 15, 2023)—imposing disclosure, data‑management, safety, and content‑governance duties on providers.”
13nist.govGovernment
AI Risk Management Framework | NIST
Backs: “NIST AI Risk Management Framework 1.0 (plus a Generative AI Profile) and the US AI Safety Institute/International Network of AI Safety Institutes drive testing and evaluation practices.”
14iso.orgNonprofits and think tanks
ISO/IEC 42001:2023 - AI management systems
Backs: “ISO/IEC 42001:2023 (certifiable AI management systems) and ISO/IEC 23894:2023 (AI risk management) are increasingly referenced in procurement and as compliance “ladders.””
15ieee.orgNot yet classified
7000-2021 - IEEE Standard Model Process for Addressing Ethical Concerns during System Design | IEEE Standard | IEEE Xplore
Backs: “IEEE 7000/7003 (ethics‑by‑design and algorithmic‑bias considerations).”
16g7g20-documents.orgNot yet classified
Hiroshima Process International Code of Conduct for Organizations Developing Advanced AI Systems (30/10/2023) - G7/G20 Documents Database
Backs: “G7 “Hiroshima Process” voluntary Code of Conduct for developers of advanced AI, with an OECD reporting framework. OECD’s AI Principles were updated in 2024.”
17europa.euGovernment
Guidelines on transparency obligations for providers and deployers of certain AI systems | Shaping Europe’s digital future
Backs: “CO ADMT), human oversight, and governance systems (e.g., ISO/IEC 42001; NIST AI RMF).”