What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Short answer

•There isn’t one global “AI law.” As of October 29, 2026, AI systems are governed by a patchwork of binding laws and regulations, sector rules, and voluntary standards. Below are the most widely applied and concrete ones in force now (plus a few that kick in soon).

United States (federal)

•Consumer protection and civil-rights enforcement already apply to AI:

•CFPB says lenders using AI/ML must still give specific, accurate reasons in adverse‑action notices under ECOA/Reg B—black‑box models are no excuse.[1]

•EEOC and DOJ have issued technical assistance: using algorithms in hiring can violate Title VII and the ADA; employers should assess adverse impact and provide reasonable accommodations.[2]

•FTC polices unfair/deceptive AI claims and practices under Section 5 and has issued business guidance on AI use.[3]

•Telecom/voice-cloning: FCC declared AI‑generated voices in robocalls “artificial” under the TCPA, making such calls illegal without consent; enforcement is active.[4]

•Federal agencies’ own use of AI: OMB memos M‑24‑10 (2024) and M‑25‑21/22 (2025) require agency AI governance, risk management, inventories, and acquisition guardrails. Executive Orders 14110 (Oct 30, 2023) and 14179 (Jan 23, 2025) set direction but do not themselves regulate private firms.[5]

United States (state/local)

•Hiring tools in NYC: Local Law 144 requires a yearly independent bias audit, public posting of results, and notices before using AEDTs for hiring or promotion. In force since July 2023.[6]

•California privacy rules for automated decisionmaking (ADMT): CPPA regulations (effective Jan 1, 2026; ADMT compliance by Jan 1, 2027) add pre‑use notice, access/opt‑out rights, and risk‑assessment duties when ADMT makes “significant decisions” (employment, housing, credit, education, health).[7]

•Colorado: 2026 legislation repealed and re‑enacted the 2024 AI law; a new ADMT law and a “Chatbot Safety Act” were signed July 1, 2026 for effect Jan 1, 2027 (age cues, AI disclosure, teen safeguards, suicide/self‑harm response protocols, annual reporting). Rulemaking is underway.[8]

•Biometrics: Illinois BIPA remains the strictest U.S. law on private biometric data; an Aug 2, 2024 amendment capped damages to one recovery per person per method, curbing “per‑scan” stacking.[9]

•Voice/likeness cloning: Tennessee’s ELVIS Act (effective July 1, 2024) adds a property right in one’s voice (including AI simulations) and creates civil liability for unauthorized replicas.[10]

•Political deepfakes: Multiple states now require disclosures or provide remedies; for example, Washington’s 2023 SB 5152 and PDC rules require disclosure of “synthetic media” in election ads and enable suits by candidates.[11]

European Union

•The EU AI Act: entered into force Aug 1, 2024; most rules apply from Aug 2, 2026. Bans on certain practices started Feb 2, 2025 (with some additional prohibitions effective Dec 2, 2026). High‑risk system obligations phase in through 2027–2028; enforcement involves the EU AI Office and national authorities with significant fines.[12]

•Product liability: the 2024 Product Liability Directive expressly covers software and AI systems as “products” and must be transposed by Member States by late 2026, strengthening no‑fault liability for defective AI.[13]

•Platform transparency: the Digital Services Act imposes risk‑assessment and recommender‑system transparency duties on large platforms.[14]

United Kingdom

•No horizontal AI statute; the government directs sector regulators (ICO, CMA, FCA, Ofcom) to apply five cross‑sector AI principles. The Online Safety Act 2023 imposes “safety‑by‑design” duties (with Ofcom codes) that reach recommender and automated detection systems.[15]

China

•Binding rules already target algorithms, deep synthesis, and generative AI:

•Algorithmic Recommendation Provisions (effective Mar 1, 2022).[16]

•Deep Synthesis Provisions (effective Jan 10, 2023).[17]

•Interim Measures on Generative AI Services (effective Aug 15, 2023), with security and transparency obligations and penalties for violations.[18]

International instruments

•Council of Europe’s Framework Convention on AI (opened for signature Sept 5, 2024) is the first binding treaty centered on human rights, democracy, and rule of law in AI; the EU is a Party and other signatories are ratifying. It requires risk/impact assessment, transparency/notice, accountability, and remedies.[19]

•OECD AI Principles (2019, updated 2024) and UNESCO’s 2021 Recommendation on AI Ethics guide many national policies but are non‑binding.[20]

Widely used voluntary standards and evaluation frameworks

•NIST AI Risk Management Framework (AI RMF 1.0) is the de‑facto U.S. playbook for AI risk governance; federal policy cross‑references it.[21]

•ISO/IEC 42001:2023 (AI management systems) and ISO/IEC 23894:2023 (AI risk management) support certifiable governance and risk processes for developers and deployers.[22]

•IEEE standards (for example, IEEE 7003‑2024 on algorithmic bias) provide technical and process guidance for fairness, transparency, and governance.[23]

What this means in practice

•Today, accountability for systems like this is enforced mainly through:

•General laws (consumer protection, civil rights, telecom, product liability) applied to AI;

•New, AI‑specific rules in certain jurisdictions (EU AI Act; California ADMT rules; Colorado ADMT/chatbot law starting 2027; NYC AEDT audits);

•Sector regulators and platform rules (e.g., DSA in the EU, Ofcom codes in the UK);

•Contractual, standards‑based governance (NIST/ISO/IEEE) adopted by firms and sometimes required by customers or regulators.[6]

If helpful, tell me your industry and where you operate, and I can translate this into a short “what applies to me” checklist with dates and obligations.

14.[EN

E-002826/2024
Answer given by Executive Vice-Pr](https://www.europarl.europa.eu/doceo/document/E-10-2024-002826-ASW_EN.pdf?utm_source=openai)

Citations (23)

1consumerfinance.govGovernment
CFPB Acts to Protect the Public from Black-Box Credit Models Using Complex Algorithms | Consumer Financial Protection Bureau
Backs: “CFPB says lenders using AI/ML must still give specific, accurate reasons in adverse‑action notices under ECOA/Reg B—black‑box models are no excuse.”
evidence, article. Claim: CFPB says lenders using AI/ML must give specific, accurate adverse-action reasons under ECOA/Reg B; black-box models are no excuse.
2aclum.orgNot yet classified
Select Issues: Assessing Adverse Impact in Software, Algorithms, and Artificial Intelligence Used in Employment Selection Procedures Under Title VII of the Civil Rights Act of 1964 | U.S. Equal Employment Opportunity Commission
Backs: “EEOC and DOJ have issued technical assistance: using algorithms in hiring can violate Title VII and the ADA; employers should assess adverse impact and provide reasonable accommodations.”
evidence, official document. Claim: EEOC/DOJ guidance: algorithmic hiring tools can violate Title VII and ADA; employers should assess adverse impact.
3ftc.govGovernment
The Federal Trade Commission 2023 Privacy and Data Security Update
Backs: “FTC polices unfair/deceptive AI claims and practices under Section 5 and has issued business guidance on AI use.”
evidence, official document. Claim: FTC polices unfair/deceptive AI claims and practices under Section 5 and has issued business guidance.
4govinfo.govGovernment
FCC NEWS from the Federal Communications Commission
Backs: “FCC declared AI‑generated voices in robocalls “artificial” under the TCPA, making such calls illegal without consent; enforcement is active.”
evidence, official document. Claim: FCC declared AI-generated voices in robocalls artificial under the TCPA, making them illegal without consent.
5whitehouse.govGovernment
EXECUTIVE OFFICE OF THE PRESIDENT
Backs: “Executive Orders 14110 (Oct 30, 2023) and 14179 (Jan 23, 2025) set direction but do not themselves regulate private firms.”
evidence, official document. Claim: OMB memos require federal agency AI governance, risk management, inventories; executive orders set direction without regulating private firms.
6nyc.govGovernment
Automated Employment Decision Tools (AEDT) - DCWP
Backs: “Local Law 144 requires a yearly independent bias audit, public posting of results, and notices before using AEDTs for hiring or promotion. In force since July 2023.”
evidence, official document. Claim: NYC Local Law 144 requires yearly independent bias audits, public results, and notices for automated employment decision tools.
7ca.govGovernment
California Finalizes Regulations to Strengthen Consumers' Privacy
Backs: “ADMT compliance by Jan 1, 2027) add pre‑use notice, access/opt‑out rights, and risk‑assessment duties when ADMT makes “significant decisions” (employment, housing, credit, education, health).”
evidence, article. Claim: California CPPA regulations add notice, access/opt-out rights, and risk assessments for automated decisionmaking technology in significant decisions.
8coag.govGovernment
Colorado Anti-Discrimination in AI Law (ADAI) Rulemaking | Colorado Attorney General
Backs: “2026 legislation repealed and re‑enacted the 2024 AI law; a new ADMT law and a “Chatbot Safety Act” were signed July 1, 2026 for effect Jan 1, 2027 (age cues, AI disclosure, teen safeguards, suicide/self‑harm response protocols, annual reporting). Rulemaking is underway.”
evidence, official document. Claim: Colorado re-enacted its AI law and signed ADMT and Chatbot Safety Act effective Jan 2027; rulemaking underway.
9alston.comCompanies
Labor & Employment Advisory: New Law Limits Damages Plaintiffs Can Seek Under Illinois Biometric Information Privacy Act | News & Insights | Alston & Bird
Backs: “Illinois BIPA remains the strictest U.S. law on private biometric data; an Aug 2, 2024 amendment capped damages to one recovery per person per method, curbing “per‑scan” stacking.”
evidence, article. Claim: Illinois BIPA amendment of Aug 2, 2024 capped damages to one recovery per person per method.
10tn.govGovernment
PHOTOS: Gov. Lee Signs ELVIS Act Into Law
Backs: “Tennessee’s ELVIS Act (effective July 1, 2024) adds a property right in one’s voice (including AI simulations) and creates civil liability for unauthorized replicas.”
evidence, article. Claim: Tennessee's ELVIS Act adds a property right in one's voice, including AI simulations, with civil liability for unauthorized replicas.
11wa.govGovernment
SB 5152 Washington State Legislature
Backs: “Multiple states now require disclosures or provide remedies; for example, Washington’s 2023 SB 5152 and PDC rules require disclosure of “synthetic media” in election ads and enable suits by candidates.”
evidence, official document. Claim: Washington's SB 5152 requires synthetic media disclosure in election ads and enables candidate lawsuits.
12europa.euGovernment
AI Act enters into force
Backs: “High‑risk system obligations phase in through 2027–2028; enforcement involves the EU AI Office and national authorities with significant fines.”
evidence, article. Claim: EU AI Act entered into force Aug 1, 2024, with phased application, bans, high-risk obligations and enforcement by the AI Office.
13europa.euGovernment
Directive - 2024/2853 - EN - Product Liability Directive - EUR-Lex
Backs: “Product liability: the 2024 Product Liability Directive expressly covers software and AI systems as “products” and must be transposed by Member States by late 2026, strengthening no‑fault liability for defective AI.”
evidence, official document. Claim: 2024 Product Liability Directive covers software and AI as products, strengthening no-fault liability for defective AI.
14europa.euGovernment
EN E-002826/2024 Answer given by Executive Vice-Pr
Backs: “Platform transparency: the Digital Services Act imposes risk‑assessment and recommender‑system transparency duties on large platforms.”
evidence, official document. Claim: Digital Services Act imposes risk-assessment and recommender-system transparency duties on large platforms.
15gov.ukGovernment
Implementing the UK’s AI regulatory principles: initial guidance for regulators - GOV.UK
Backs: “The Online Safety Act 2023 imposes “safety‑by‑design” duties (with Ofcom codes) that reach recommender and automated detection systems.”
evidence, official document. Claim: UK has no horizontal AI statute; regulators apply five cross-sector AI principles; Online Safety Act imposes safety-by-design duties.
16stanford.eduAcademic
Translation: Internet Information Service Algorithmic Recommendation Management Provisions – Effective March 1, 2022
Backs: “Algorithmic Recommendation Provisions (effective Mar 1, 2022).”
evidence, official document. Claim: China's Algorithmic Recommendation Provisions took effect Mar 1, 2022.
17cac.gov.cnGovernment
互联网信息服务深度合成管理规定_中央网络安全和信息化委员会办公室
Backs: “Deep Synthesis Provisions (effective Jan 10, 2023).”
evidence, official document. Claim: China's Deep Synthesis Provisions took effect Jan 10, 2023.
18loc.govGovernment
China: Generative AI Measures Finalized | Library of Congress
Backs: “Interim Measures on Generative AI Services (effective Aug 15, 2023), with security and transparency obligations and penalties for violations.”
evidence, article. Claim: China's Interim Measures on Generative AI Services took effect Aug 15, 2023, with security and transparency obligations and penalties.
19coe.intGovernment
The Framework Convention on Artificial Intelligence - Artificial Intelligence
Backs: “It requires risk/impact assessment, transparency/notice, accountability, and remedies.”
evidence, official document. Claim: Council of Europe Framework Convention on AI is the first binding AI treaty, requiring risk assessment, transparency, accountability, and remedies.
20oecd.aiGovernment
AI Principles Overview - OECD.AI
Backs: “OECD AI Principles (2019, updated 2024) and UNESCO’s 2021 Recommendation on AI Ethics guide many national policies but are non‑binding.”
evidence, reference entry. Claim: OECD AI Principles (2019, updated 2024) and UNESCO recommendation guide national policies but are non-binding.
21nist.govGovernment
AI Risks and Trustworthiness - AIRC
Backs: “NIST AI Risk Management Framework (AI RMF 1.0) is the de‑facto U.S. playbook for AI risk governance; federal policy cross‑references it.”
evidence, article. Claim: NIST AI RMF 1.0 is the de-facto U.S. playbook for AI risk governance.
22iso.orgNonprofits and think tanks
ISO/IEC 42001:2023 - AI management systems
Backs: “ISO/IEC 42001:2023 (AI management systems) and ISO/IEC 23894:2023 (AI risk management) support certifiable governance and risk processes for developers and deployers.”
evidence, reference entry. Claim: ISO/IEC 42001 and 23894 support certifiable AI governance and risk processes for developers and deployers.
23ieee.orgNot yet classified
IEEE SA - IEEE 7003-2024
Backs: “IEEE standards (for example, IEEE 7003‑2024 on algorithmic bias) provide technical and process guidance for fairness, transparency, and governance.”
evidence, reference entry. Claim: IEEE 7003-2024 on algorithmic bias provides technical and process guidance for fairness, transparency and governance.