What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Short answer: It’s a patchwork. There’s no single, global “AI law.” What governs systems like me today is a mix of (a) binding laws and regulations, (b) sector rules that already applied before AI, and (c) voluntary but influential standards. Here are the pieces that matter most as of October 27, 2026:

European Union (binding)

•EU Artificial Intelligence Act (risk-based). Key dates now in force: bans and AI‑literacy duties since Feb 2, 2025; general‑purpose AI (GPAI) model obligations since Aug 2, 2025; general transparency duties (including AI‑generated content) since Aug 2, 2026; additional deepfake‑related prohibitions from Dec 2, 2026; high‑risk Annex III system rules from Dec 2, 2027. Enforcement is shared by national authorities and the EU’s AI Office (for GPAI).[1]

•Product liability. The updated EU Product Liability Directive makes software (including AI) a “product” under strict liability. Member States must transpose by Dec 9, 2026; it applies to products placed on the market after that date.[2]

United States – federal (no omnibus AI statute)

•Federal procurement/use of AI. OMB Memorandum M‑24‑10 binds federal agencies: appoint Chief AI Officers, inventory AI uses, assess and manage rights/safety risks for “safety‑impacting” and “rights‑impacting” AI, and publish use cases. This governs how the U.S. government builds/buys/uses AI.[3]

•General consumer/civil‑rights enforcement using existing law:

•FTC: enforces unfair/deceptive practices applied to AI (e.g., 2023 Rite Aid facial‑recognition case that restricted use and imposed safeguards); it is also pursuing rules addressing AI‑enabled impersonation/deepfakes.[4]

•CFPB: lenders using AI must still give specific, accurate reasons for adverse actions under ECOA/Reg B (you can’t hide behind a “black box”).[5]

•Sector regulators:

•FDA: finalized guidance (Aug 2025) on “predetermined change control plans” for AI‑enabled medical devices so models can be updated safely post‑market.[6]

•Banking regulators: long‑standing model‑risk‑management expectations (SR 11‑7) updated on Apr 17, 2026 (SR 26‑2) emphasize risk‑based governance, validation, and monitoring for models (including many AI models).[7]

United States – state/local (binding, but varies by location)

•Hiring AI audits (NYC). Since July 5, 2023, NYC Local Law 144 requires a bias audit and candidate/employee notice before using automated employment decision tools.[8]

•Broad AI duties (Colorado). Colorado’s 2024 Automated Decision‑Making Technology Act now applies (from Feb 1, 2026): developers and deployers of “high‑risk” AI must use reasonable care, keep documentation, perform impact assessments, notify consumers, and report discovered algorithmic discrimination to the AG.[9]

•Election deepfakes. Dozens of states now require disclosures on AI‑generated political ads and/or restrict deceptive deepfakes near elections; details and timing vary by state.[10]

•AI transparency in conversations. California’s bot‑disclosure law (in force since 2019) requires bots that try to sell or influence votes to clearly disclose they’re bots.[11]

•Voice/likeness protection. Tennessee’s ELVIS Act (effective July 1, 2024) adds voice to right‑of‑publicity protections, directly targeting AI voice cloning.[12]

United Kingdom (mostly principles + sector law)

•“Pro‑innovation” AI regulation policy: non‑statutory principles (transparency, fairness, accountability, contestability) implemented by existing regulators, with a plan to add a statutory “duty to have regard” when Parliamentary time allows. Online Safety Act obligations for platforms also apply to harmful content, including AI‑generated material.[13]

•UK AI Safety Institute: publishes evaluation tooling and guidance; government also issued a voluntary AI Cyber Security Code of Practice (Jan 31, 2025).[14]

China (binding)

•Algorithmic recommendation (effective Mar 1, 2022) and deep‑synthesis (effective Jan 10, 2023) rules impose filing, labeling, real‑name verification, content controls, and security‑assessment duties for AI services, including generators and recommendation systems. Interim measures for generative AI were issued in 2023.[15]

International frameworks (binding or widely used)

•Council of Europe Framework Convention on AI (human rights, democracy, rule of law): adopted May 17, 2024; opened for signature Sep 5, 2024; the EU ratified on May 15, 2026. It obliges parties to ensure transparency, oversight, accountability, remedies, and risk/impact assessment across the AI lifecycle.[16]

•OECD AI Principles (updated May 2024) shape many national approaches: transparency, robustness/safety, and accountability throughout the AI lifecycle.[17]

Voluntary but influential standards and guidance (often required by customers, regulators, or contracts)

•NIST AI Risk Management Framework 1.0 (U.S.): a widely adopted governance playbook (govern, map, measure, manage) for trustworthy AI. The U.S. AI Safety Institute at NIST also publishes draft model‑evaluation practices.[18]

•ISO/IEC 42001:2023 (AI management systems) and ISO/IEC 23894:2023 (AI risk management): certifiable governance requirements (42001) and risk‑management guidance (23894) that many organizations map to or certify against.[19]

What this means in practice

•If you build or deploy LLMs/GPAI for the EU market, you already have GPAI‑specific obligations (since Aug 2, 2025) and content‑transparency duties (since Aug 2, 2026), with more to come for high‑risk uses in 2027. Plan for documenting training data governance, model/system documentation, and content labeling, plus incident reporting where applicable.[1]

•In the U.S., expect enforcement through existing laws (unfair/deceptive practices, credit/civil‑rights, health‑device safety), plus state‑specific rules (hiring audits, deepfake disclaimers, voice/likeness) and federal‑agency requirements if you sell to or build for government.[4]

•Independently of law, many buyers/regulators expect conformance with NIST AI RMF and ISO/IEC 42001/23894 for governance, risk, transparency, and monitoring.[18]

If you want, tell me your sector and where you operate/sell, and I’ll translate this into a concrete compliance checklist with the specific articles/sections that apply.

Citations (19)

1europa.euGovernment
Timeline for the Implementation of the EU AI Act | AI Act Service Desk
Backs: “Enforcement is shared by national authorities and the EU’s AI Office (for GPAI).”
evidence, article. Claim: EU AI Act phased implementation dates: bans, GPAI obligations, transparency duties, and high-risk rules, with enforcement by national authorities and the AI Office.
2europa.euGovernment
Directive (EU) 2024/2853 of the European Parliament and of the Council of 23 October 2024 on liability for defective products and repealing Council Directive 85/374/EEC (Text with EEA relevance)
Backs: “Member States must transpose by Dec 9, 2026; it applies to products placed on the market after that date.”
evidence, official document. Claim: Updated EU Product Liability Directive treats software including AI as a product under strict liability; transposition due Dec 9, 2026.
3whitehouse.govGovernment
EXECUTIVE OFFICE OF THE PRESIDENT
Backs: “OMB Memorandum M‑24‑10 binds federal agencies: appoint Chief AI Officers, inventory AI uses, assess and manage rights/safety risks for “safety‑impacting” and “rights‑impacting” AI, and publish use cases. This governs how the U.S. government builds/buys/uses AI.”
evidence, official document. Claim: OMB M-24-10 requires federal agencies to appoint Chief AI Officers, inventory AI uses, and manage risks of safety- and rights-impacting AI.
4ftc.govGovernment
Rite Aid Banned from Using AI Facial Recognition After FTC Says Retailer Deployed Technology without Reasonable Safeguards | Federal Trade Commission
Backs: “FTC: enforces unfair/deceptive practices applied to AI (e.g., 2023 Rite Aid facial‑recognition case that restricted use and imposed safeguards); it is also pursuing rules addressing AI‑enabled impersonation/deepfakes.”
evidence, article. Claim: FTC's 2023 Rite Aid case restricted AI facial recognition use and imposed safeguards under unfair/deceptive practices authority.
5consumerfinance.govGovernment
Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms | Consumer Financial Protection Bureau
Backs: “CFPB: lenders using AI must still give specific, accurate reasons for adverse actions under ECOA/Reg B (you can’t hide behind a “black box”).”
evidence, official document. Claim: CFPB: lenders using AI must give specific, accurate adverse action reasons under ECOA/Reg B.
6fda.govGovernment
Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions | FDA
Backs: “FDA: finalized guidance (Aug 2025) on “predetermined change control plans” for AI‑enabled medical devices so models can be updated safely post‑market.”
evidence, official document. Claim: FDA finalized guidance on predetermined change control plans for AI-enabled medical devices.
7federalreserve.govGovernment
SR 11-7 attachment: Supervisory Guidance on Model Risk Management
Backs: “Banking regulators: long‑standing model‑risk‑management expectations (SR 11‑7) updated on Apr 17, 2026 (SR 26‑2) emphasize risk‑based governance, validation, and monitoring for models (including many AI models).”
evidence, official document. Claim: Banking model-risk-management expectations (SR 11-7) emphasize governance, validation, and monitoring of models including AI.
8nyc.govGovernment
Automated Employment Decision Tools (AEDT) - DCWP
Backs: “Since July 5, 2023, NYC Local Law 144 requires a bias audit and candidate/employee notice before using automated employment decision tools.”
evidence, article. Claim: NYC Local Law 144 requires bias audits and notice before using automated employment decision tools.
9colorado.govGovernment
https://leg.colorado.gov/sites/default/files/2024a_205_signed.pdf
Backs: “Colorado’s 2024 Automated Decision‑Making Technology Act now applies (from Feb 1, 2026): developers and deployers of “high‑risk” AI must use reasonable care, keep documentation, perform impact assessments, notify consumers, and report discovered algorithmic discrimination to the AG.”
evidence, official document. Claim: Colorado's 2024 act imposes reasonable care, documentation, impact assessments, and discrimination reporting duties on high-risk AI developers and deployers.
10ncsl.orgNonprofits and think tanks
Artificial Intelligence (AI) in Elections and Campaigns
Backs: “Dozens of states now require disclosures on AI‑generated political ads and/or restrict deceptive deepfakes near elections; details and timing vary by state.”
evidence, data page. Claim: Many states require disclosures on AI-generated political ads or restrict deceptive deepfakes near elections.
11justia.comEncyclopedias and reference
California Business and Professions Code § 17940 (2025) :: 2025 California Code :: U.S. Codes and Statutes :: U.S. Law :: Justia
Backs: “California’s bot‑disclosure law (in force since 2019) requires bots that try to sell or influence votes to clearly disclose they’re bots.”
evidence, official document. Claim: California's bot-disclosure law requires bots that sell or influence votes to disclose they are bots.
12tn.govGovernment
PHOTOS: Gov. Lee Signs ELVIS Act Into Law
Backs: “Tennessee’s ELVIS Act (effective July 1, 2024) adds voice to right‑of‑publicity protections, directly targeting AI voice cloning.”
evidence, article. Claim: Tennessee's ELVIS Act adds voice to right-of-publicity protections, targeting AI voice cloning.
13gov.ukGovernment
A pro-innovation approach to AI regulation - GOV.UK
Backs: “Online Safety Act obligations for platforms also apply to harmful content, including AI‑generated material.”
evidence, official document. Claim: UK uses non-statutory AI principles implemented by existing regulators, with a possible statutory duty to have regard later.
14aisi.gov.ukGovernment
Releasing AISI’s Engineering Playbook | AISI Work
Backs: “UK AI Safety Institute: publishes evaluation tooling and guidance; government also issued a voluntary AI Cyber Security Code of Practice (Jan 31, 2025).”
evidence, article. Claim: UK AI Safety Institute publishes evaluation tooling and guidance.
15stanford.eduAcademic
Translation: Internet Information Service Algorithmic Recommendation Management Provisions – Effective March 1, 2022
Backs: “Algorithmic recommendation (effective Mar 1, 2022) and deep‑synthesis (effective Jan 10, 2023) rules impose filing, labeling, real‑name verification, content controls, and security‑assessment duties for AI services, including generators and recommendation systems. Interim measures for generative AI were issued in 2023.”
evidence, article. Claim: China's algorithmic recommendation rules impose filing, labeling, real-name verification, content control, and security assessment duties.
16coe.intGovernment
Council of Europe's Work in progress - Artificial Intelligence
Backs: “It obliges parties to ensure transparency, oversight, accountability, remedies, and risk/impact assessment across the AI lifecycle.”
evidence, article. Claim: Council of Europe AI Framework Convention obliges parties to ensure transparency, oversight, accountability, remedies, and risk assessment.
17oecd.aiGovernment
AI Principles Overview - OECD.AI
Backs: “OECD AI Principles (updated May 2024) shape many national approaches: transparency, robustness/safety, and accountability throughout the AI lifecycle.”
evidence, article. Claim: OECD AI Principles (updated 2024) shape national approaches on transparency, safety, and accountability.
18nist.govGovernment
Artificial Intelligence Risk Management Framework (AI RMF 1.0) | NIST
Backs: “AI Safety Institute at NIST also publishes draft model‑evaluation practices.”
evidence, official document. Claim: NIST AI RMF 1.0 is a widely adopted voluntary governance framework (govern, map, measure, manage).
19iec.chNot yet classified
ISO/IEC 42001:2023 | IEC
Backs: “ISO/IEC 42001:2023 (AI management systems) and ISO/IEC 23894:2023 (AI risk management): certifiable governance requirements (42001) and risk‑management guidance (23894) that many organizations map to or certify against.”
evidence, reference entry. Claim: ISO/IEC 42001:2023 provides certifiable AI management system requirements that many organizations adopt.