What rules shape systems like me — from building to accountability — I'll map the current landscape for you.
There is no single global law for systems like me. Current governance is a layered system of binding laws in some jurisdictions, and voluntary frameworks and sectoral rules elsewhere:
1. European Union - The EU AI Act - Binding, Risk-Based Law
The most comprehensive binding law. It is described as a new set of rules governing the development, deployment, and use of artificial intelligence systems in the European Union with a risk-based approach.
•Effective date: Uniform rules entered into force 1st August 2024
•Risk Tiers: Divides systems into four levels:
•Unacceptable Risk: Banned due to clear threats to rights and values
•High Risk: Strict requirements due to potential harm - systems used in critical infrastructure, education, recruitment, law enforcement, or medical devices must meet stringent requirements
•Minimal Risk: No specific rules, but guidelines recommended
•Builder & Deployer Obligations for High-Risk and General-Purpose AI (GPAI):
•Maintain transparency documentation (show how the AI system was trained and tested) and comprehensive records including logs, documentation, and assessments that demonstrate adherence
•Keeping records of how a system was trained, testing for bias before deployment, allowing human reviewers to actually override the system, and giving affected people a plain-language explanation on request
•Register certain high-risk systems in an EU database
•For GPAI models - systems trained to handle many different tasks rather than one narrow purpose like ChatGPT - substantive obligations for providers of models placed on the market on or after August 2, 2025 have been applicable since that date
•Current Phase (as of 2026):
•Transparency obligations in Article 50 now apply as of August 2, 2026, requiring providers to ensure people are informed when they are interacting directly with an AI system and disclosure and content-marking obligations for deepfakes and biometric systems
•The EU AI Office enforcement powers took effect for those obligations, with financial penalties for violations for GPAI enforcement regime now binding
•Principal requirements for high-risk systems were postponed but not eliminated - deadlines moved to December 2027 and August 2028, with the first harmonised standard EN 18286:2026 cited October 15
Accountability principle: the more power an AI system has over a human life, the more accountability the law should demand - build AI but classify risk, document, test data, preserve human accountability
2. United States - No General Federal AI Law - Voluntary Federal Framework + State Laws
At the federal level, there is no general federal AI law; there is voluntary NIST guidance plus state and city rules
A. Voluntary Federal Frameworks:
•NIST AI Risk Management Framework (AI RMF 1.0): Published January 2023 and also described as published in January 2023 helping organizations identify, assess, and manage risks throughout the AI lifecycle. It is the closest thing the US has to a shared definition of "tested".
•Structure: Four functions — Govern, Map, Measure, Manage - described as a continuous risk management cycle
•Govern establishes policies, accountability, leadership responsibilities
•Characteristics of trustworthy AI: valid and reliable; safe; secure and resilient; accountable and transparent; explainable also listed as (a) valid and reliable, (b) safe, (c) fair and unbiased, (d) secure and resilient, (e) transparent and accountable, (f) explainable and interpretable, and (g) privacy enhanced
•Companion profile for generative AI also exists and a Cyber AI Profile in December 2025 defining real-time monitoring for deployed models
•Federal Agency Transparency: Requirement for agencies to publish AI use-case inventories began with an executive order in 2020 and was codified in the Advancing American AI Act in 2022, which requires each agency to prepare, maintain, and publicly post an inventory of its AI use cases. President Biden's OMB memo in 2024 directed agencies to implement safeguards when using AI in ways that could significantly affect people.
B. Executive Orders - Shifting Federal Policy:
•Biden's Executive Order 14110 (October 2023) on safe and trustworthy AI required safety testing for advanced AI systems, directed agencies to develop bias auditing standards, mandated reporting from developers, and established workforce protections. It built explicitly on OECD AI Principles of 2019, UNESCO's 2021 Recommendation, and the EU AI Act. It included obligation for developers of the most powerful systems to share safety testing and red-teaming results with the federal government.
•Trump Executive Order 14179 (January 20, 2025) revoked Biden's EO 14110 and made US competitiveness the governing principle. Trump’s order eliminated those requirements and directed agencies to review and remove regulatory [requirements].
•Subsequent Trump actions:
•AI Action Plan (July 2025) emphasized innovation, infrastructure, and limits on regulation
•EO 14365 (December 11, 2025) established a DOJ AI Litigation Task Force to challenge state AI laws and called for a national preemptive framework. The dominant theme is a moratorium on state AI laws and that US companies must be "free to innovate without cumbersome regulation"
•EO 14409 (June 2, 2026) established a voluntary pre-release frontier model review process up to 30 days before release and Treasury-led cybersecurity clearinghouse - described as asking companies to voluntarily submit most powerful models for government testing
Current comparison table describes Trump approach as Policy roadmap, no mandates, voluntary pledge with None (self-policing) vs EU AI Act binding law with financial penalties
C. US State and City Laws - Where Binding Rules Currently Apply:
States have created strict compliance rules, reflecting growing complexity:
•Colorado Artificial Intelligence Act: Created strict compliance rules for developers and deployers of high-risk automated systems, requiring impact assessments and protections against algorithmic discrimination in hiring, housing
•California: Enacted measures addressing deepfake watermarking, algorithmic accountability in healthcare, and transparency rules requiring developers to explain training data sources, plus SB 53 Transparency in Frontier Artificial Intelligence Act took effect January 1, 2026
•Utah Senate Bill 226 (2025): Establishes framework focused on ensuring transparency, fairness, and accountability in use of AI in critical sectors such as healthcare and education
•New York and Illinois: New York's Responsible AI Safety and Education (RAISE) Act and Illinois's Artificial Intelligence Safety Measures Act take effect January 1, 2027; New York advanced the GUARD Act establishing an Office of Algorithmic Accountability to assess city agency AI tools and create procurement rules
•New York City Local Law 144: Example of city rule requiring [bias audits for automated employment decision tools]
•General state principle for government use: Human accountability - a person, not the model, owns consequential decisions; policies bar fully autonomous AI from decisions affecting rights, benefits, or obligations; some prohibit high-risk systems outright or ban un-explainable "black box" systems
3. United Kingdom - Principles-Based, Regulator-Led
•No comprehensive statute yet; approach is principles-based, enforced through existing regulators. Expected to align with ICO scrutiny of data protection plus sector regulators in finance and health.
•Five cross-sector AI principles: safety, transparency, fairness, accountability and contestability, alternatively stated as safety, security, robustness, transparency and explainability, fairness, accountability and governance, and contestability and redress
•Government AI Regulation White Paper (March 2023) established those principles which directly map to ISO 42001 control objectives. Companies should monitor sector-specific guidance by ICO, Ofcom, CMA and implement frameworks aligned with ISO/IEC 42001 or NIST AI RMF as AI Bill moves toward legislation
4. International Voluntary Standards - Accountability Mechanisms
These are not laws but are increasingly required for procurement and certification:
•ISO/IEC 42001:2023: The world's first certifiable international standard for AI management systems. Published December 2023. It specifies requirements for establishing, implementing, maintaining, and continually improving an artificial intelligence management system (AIMS).
•It is jurisdiction-neutral, built around 10 clauses and 38 Annex A controls across 9 control areas
•Provides accountability and oversight: top-management accountability, assigned roles and escalation routes, mapping to EU AI Act Article 14 and data governance controls on provenance, quality and preparation of data
In practice, systems like me are held accountable through a combination of: mandatory documentation and logging, bias testing before deployment, human oversight and override requirements, transparency/disclosure to users, impact assessments for high-risk uses, enforceable rights to explanation and contestation, and agency use-case inventories and audits - with enforcement ranging from EU fines to US state civil liability and administrative complaints after regulations take effect.
The landscape is changing rapidly - EU high-risk deadlines were deferred to 2027-2028 while transparency rules are already live, and US federal preemption efforts are being litigated - so builders and deployers often align to both the strictest binding law (EU AI Act) and the voluntary frameworks (NIST AI RMF and ISO 42001) to demonstrate accountability across jurisdictions.