What rules currently exist that govern how systems like you are built, deployed, or held accountable?
Short answer: It depends where you operate, what kind of AI you build (general‑purpose vs. “high‑risk” or sector‑specific), and who your users are. Here’s the current, high‑level map as of October 28, 2026.
United States (federal)
United States (state/local)
European Union
United Kingdom
People’s Republic of China
Council of Europe (pan‑European treaty)
Cross‑cutting privacy and platform laws that shape AI deployment
Standards and assurance (voluntary but widely used, sometimes referenced by regulators and procurement)
If you tell me:
I can map the specific obligations, deadlines, and likely enforcers for your case and suggest a concrete compliance checklist.
Citations (13)
- EXECUTIVE OFFICE OF THE PRESIDENT
Backs: “These rules bind federal agencies and shape procurement from vendors.”
evidence, official document. Claim: OMB M-24-10 requires federal agencies to inventory AI, manage risks, give notice for rights-impacting uses, and shut down non-compliant systems.
- Executive Orders EO 14110
Backs: “NIST has since published the AI Risk Management Framework (AI RMF 1.0) and a Generative AI profile used widely in industry.”
evidence, official document. Claim: EO 14110 directs NIST and agencies to issue testing, safety, security guidance; influences but doesn't directly regulate private developers.
- Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms | Consumer Financial Protection Bureau
Backs: “Existing laws still apply to AI: e.g., the CFPB says creditors must give specific adverse‑action reasons even if decisions used complex models; the EEOC warns Title VII applies to AI in hiring; the FTC treats misleading AI claims or unfair uses as unlawful.”
evidence, official document. Claim: CFPB says creditors must give specific adverse-action reasons even when complex models are used; existing laws apply to AI.
- SB26-189 Automated Decision-Making Technology | Colorado General Assembly
Backs: “Separately, the 2026 “Conversational AI Service” law (HB26‑1263) adds disclosure and youth‑safety requirements for public chatbots, effective Jan 1, 2027. Rulemaking is underway.”
evidence, official document. Claim: Colorado's 2026 ADMT Act (SB26-189) takes effect Jan 1, 2027, setting duties for developers and deployers of covered ADMT.
- CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology (ADMT), and Insurance Regulations - California Privacy Protection Agency (CPPA)
Backs: “California also adopted SB 53 in 2025, the Transparency in Frontier AI Act, with safety‑reporting and disclosure duties for frontier‑model developers.”
evidence, official document. Claim: California CPPA regulations effective Jan 2026 require ADMT disclosures, user rights, risk assessments and cybersecurity audits.
- Automated Employment Decision Tools (AEDT) - DCWP
Backs: “Illinois’ AI Video Interview Act (since 2020) requires notice, explanation, and consent before using AI to analyze candidate videos.”
evidence, article. Claim: NYC Local Law 144 requires annual independent bias audits and notices for automated employment decision tools.
- AI Act | Shaping Europe’s digital future
Backs: “Key dates: bans on certain “unacceptable‑risk” uses apply from Feb 2, 2025; transparency duties (e.g., disclose that users are interacting with AI; label deepfakes/AI‑generated content) apply from Aug 2, 2026, with a short grace period for pre‑existing systems’ watermarking; general‑purpose AI (GPAI) model obligations…”
evidence, article. Claim: EU AI Act applies in phases: prohibitions, GPAI obligations, transparency duties, and high-risk rules, enforced by AI Office and national authorities.
- Directive - 2024/2853 - EN - Product Liability Directive - EUR-Lex
Backs: “From Dec 9, 2026, member states must have transposed rules that explicitly treat software and AI systems as “products,” expanding strict‑liability exposure (e.g., for failure to supply necessary security updates).”
evidence, official document. Claim: EU Directive 2024/2853 treats software and AI as products, expanding strict liability, with transposition due Dec 9, 2026.
- AI regulation in the UK - House of Commons Library
Backs: “The current government has signalled interest in binding rules for the most powerful models, while sectoral regulators publish their own AI guidance.”
evidence, article. Claim: UK uses a pro-innovation, regulator-led approach with no horizontal AI Act; interest in binding rules for powerful models.
- China: Generative AI Measures Finalized | Library of Congress
Backs: “The 2023 Interim Measures for Generative AI Services (CAC and other ministries) govern public‑facing gen‑AI: content standards, security assessments/filings in some cases, user disclosures, and mechanisms to address illegal content.”
evidence, article. Claim: China's 2023 Interim Measures govern public-facing generative AI: content standards, security assessments, disclosures.
- The Framework Convention on Artificial Intelligence - Artificial Intelligence
Backs: “The EU approved concluding the Convention in April 2026; it will bind parties as they ratify.”
evidence, article. Claim: Council of Europe Framework Convention is the first binding international AI treaty, setting human-rights-based obligations for states.
- Application of the GDPR - European Commission
Backs: “Similar constraints increasingly appear in US state privacy regimes (e.g., California CCPA/CPRA + 2026 CPPA ADMT rules).”
evidence, article. Claim: GDPR governs personal-data processing by AI: legal basis, transparency, data minimization, DPIAs.
- Artificial Intelligence Risk Management Framework (AI RMF 1.0)
Backs: “ISO/IEC 42001 (AI management systems), ISO/IEC 5338 (AI lifecycle processes), and related AI trustworthiness standards help demonstrate governance, risk, and quality controls.”
evidence, official document. Claim: NIST AI RMF 1.0 is a voluntary framework widely used for AI governance and risk management.