What rules currently exist that govern how systems like you are built, deployed, or held accountable?
There is no single global set of binding rules for AI systems. Instead, a patchwork of international principles, voluntary standards, national/regional laws, sector-specific rules, and liability frameworks governs how AI (including large language models and general-purpose AI like me) is built, deployed, and held accountable. These emphasize risk management, transparency, human oversight, safety, fairness, and documentation, with heavier obligations for higher-risk uses. Rules are evolving rapidly as of late 2026, with phased implementation.[1]
International Principles and Soft Law
These are non-binding but highly influential, shaping national strategies and often referenced in hard law:
These promote trustworthy AI but lack direct enforcement.
Voluntary Standards and Frameworks
Widely used for practical governance (and often to demonstrate compliance with laws):
Other standards (e.g., IEEE ethical design) and company self-regulation also play roles.
European Union: Comprehensive Risk-Based Regulation
The EU AI Act (Regulation 2024/1689, entered into force August 2024, with amendments via the 2026 Digital Omnibus/AI Omnibus) is the world’s first major horizontal AI law. It has extraterritorial reach (applies to providers/deployers placing systems on the EU market or whose outputs are used there). It uses a risk-based approach:[4]
Governance/enforcement: EU AI Office (especially for GPAI), national authorities, market surveillance. Fines up to €35M or 7% of global turnover. AI literacy duties apply. Providers (developers) and deployers both have roles.[4]
Liability/accountability: Updated Product Liability Directive (2024/2853, transposition by Dec 2026, applies to products from then) treats software/AI (including SaaS) as products. Strict (no-fault) liability for manufacturers (including brand sellers) for defects causing personal injury, psychological harm, or certain property/data damage. Presumptions of defect/causation possible in complex cases; disclosure of technical info; continuous learning/updates can create ongoing liability. Complements the AI Act (which is more preventive). No separate AI Liability Directive advanced. Existing tort/contract law also applies.[6]
United States: Fragmented, Pro-Innovation Federal Approach + State Laws
No comprehensive federal AI statute. Policy relies on executive actions, existing laws (FTC Act for unfair/deceptive practices, civil rights/employment/anti-discrimination laws, sectoral rules in finance/health/etc., computer fraud statutes), procurement rules, and voluntary frameworks. Focus has shifted toward innovation and reducing barriers.[7]
Accountability: Primarily through existing tort/product liability (state common law; open questions for AI), consumer protection, contract, and sectoral enforcement. No broad federal AI-specific liability regime. Incident reporting and documentation increasingly expected for large models.
China
Technology- and service-specific binding measures rather than one comprehensive statute:
Other rules cover deep synthesis, algorithms, and cybersecurity. Strong content controls and provider responsibilities.
Other Notable Jurisdictions
Cross-Cutting Themes for Building, Deployment, and Accountability
Common requirements across regimes (especially for systems like LLMs/GPAI or high-impact uses):
For systems like me (conversational LLMs/GPAI): Heavy emphasis on output labeling/transparency, documentation for downstream users, systemic risk mitigations if thresholds met, content safety, and (in regulated uses) human oversight. Providers often bear primary build/docs duties; deployers handle use-context compliance.
Rules interact with privacy (GDPR/CCPA equivalents), intellectual property, consumer protection, and sector laws (health, finance, employment). Compliance often involves AI inventories, impact assessments, and mapping to the strictest applicable rules. Developments continue (e.g., further Omnibus tweaks, U.S. preemption debates, enforcement actions). For the latest or jurisdiction-specific advice, consult official sources or legal experts, as this is a high-level overview based on publicly available information as of late 2026.
Citations (15)
- https://www.openlayer.com/blog/ai-regulations-compliance-guide
Backs: “Rules are evolving rapidly as of late 2026, with phased implementation.”
evidence, article. Claim: High-risk AI obligations and deadlines deferred by the Omnibus to Dec 2027 and Aug 2028.
- https://nhimg.org/oecd-ai-principles-guide
Backs: “Governments receive recommendations on policy. Endorsed by dozens of countries and the G20.”
evidence, article. Claim: OECD AI Principles: five core values, updated 2024, endorsed by dozens of countries and the G20.
- https://govcompass.ai/ai-governance/ai-frameworks-comparison
Backs: “Used globally and by U.S. federal agencies; revisions ongoing.”
evidence, article. Claim: ISO/IEC 42001:2023 is the first certifiable international AI management system standard.
- https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
Backs: “It has extraterritorial reach (applies to providers/deployers placing systems on the EU market or whose outputs are used there). It uses a risk-based approach:”
statistic, official document. Claim: Enforcement via AI Office and national authorities; fines up to €35M or 7% of global turnover.
- https://docs.modulos.ai/frameworks/eu-ai-act/general-purpose-ai-models
Backs: “Obligations largely from Aug 2025; codes of practice support compliance.”
evidence, reference entry. Claim: General-purpose AI model obligations: documentation, training data summaries, systemic-risk assessment, largely from Aug 2025.
- https://www.actuia.com/en/news/eu-ai-liability-directive-what-it-will-cost-companies-selling-ai-agents/
Backs: “No separate AI Liability Directive advanced. Existing tort/contract law also applies.”
evidence, article. Claim: Updated Product Liability Directive treats software/AI as products with strict liability.
- https://nhimg.org/us-federal-ai-policy-guide
Backs: “Policy relies on executive actions, existing laws (FTC Act for unfair/deceptive practices, civil rights/employment/anti-discrimination laws, sectoral rules in finance/health/etc., computer fraud statutes), procurement rules, and voluntary frameworks. Focus has shifted toward innovation and reducing barriers.”
evidence, article. Claim: US has no comprehensive federal AI statute; relies on executive actions and existing laws.
- https://www.whitehouse.gov/presidential-actions/2025/12/eliminating-state-law-obstruction-of-national-artificial-intelligence-policy/?query-11-page=4&ssrid=ssr
Backs: “Frontier model voluntary processes and cyber-focused orders exist.”
evidence, official document. Claim: EO 14365 created a task force to challenge conflicting state AI laws and push a national framework.
- https://www.aei.org/research-products/report/regulating-the-frontier-how-california-new-york-and-illinois-are-governing-the-most-powerful-ai-models/
Backs: “Other CA rules on content transparency, training data, employment AI, CCPA automated decision-making (phasing in).”
evidence, article. Claim: California SB 53 requires frontier developers to publish safety frameworks and report critical incidents.
- https://nhimg.org/us-state-ai-laws-tracker-guide
Backs: “Narrower automated decision-making technology (ADMT) rules for consequential decisions (employment, housing, etc.)—notices, explanations for adverse outcomes, human review options, data access/correction.”
evidence, article. Claim: Federal efforts seek to limit state fragmentation but states remain active.
- https://actaicompliance.com/guides/us-state-ai-laws/
Backs: “Many focus on transparency, prohibited uses, employment, or frontier safety.”
evidence, article. Claim: Texas TRAIGA, New York RAISE Act, Illinois, Utah and NYC rules form a state patchwork.
- https://www.china-briefing.com/news/china-ai-regulations-2026-enforcement-guidance-compliance/
Backs: “Explicit (visible/audible) labels and implicit (metadata) labels for text/images/audio/video/virtual scenes; platform checks and user declarations; logs retention. Actively enforced.”
evidence, article. Claim: China's labeling measures for AI-generated content effective Sep 2025 require explicit and implicit labels.
- https://casrai.org/guides/korea-ai-basic-act
Backs: “Foreign providers may need a domestic representative. Extraterritorial; fines possible (grace periods noted).”
evidence, article. Claim: South Korea AI Basic Act effective Jan 2026 imposes obligations on generative and high-impact AI.
- https://www.osborneclarke.com/insights/regulatory-outlook-october-2026-artificial-intelligence
Backs: “Agentic AI and foundation model guidance emerging. Sandboxes and voluntary measures promoted.”
evidence, article. Claim: UK uses a pro-innovation, sector-led approach relying on existing regulators.
- https://nhimg.org/global-ai-regulation-map
Backs: “Clear roles (providers vs. deployers); logging/audit trails; incident reporting (critical safety events); post-market monitoring; conformity/risk management systems; liability for harm (strict product liability expanding to AI/software in EU; tort elsewhere); fines, market withdrawal, or private rights of action;…”
background, article. Claim: Cross-cutting accountability themes: clear roles, logging, incident reporting, liability, fines, local representatives.