What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Says it is contested

AI governance is a fast-moving area, so let me pull current information on the major regulatory frameworks.As of late 2026, the rules governing AI systems like me come from several distinct, overlapping layers — binding law, executive policy, and industry self-regulation. Here's the current landscape:

1. EU AI Act (the most comprehensive binding framework)

The EU AI Act is now substantially in force. Its core structure classifies AI by risk level and attaches obligations accordingly — it classifies AI by risk and attaches duties such as risk classification, documentation and record-keeping, human oversight, data quality and transparency. Key milestones:

•Prohibitions and AI literacy: Prohibitions (Art. 5) and AI literacy requirements (Art. 4) have been in force since 2 February 2025.

•General-purpose AI (GPAI) obligations: GPAI obligations under Articles 51-55 have applied since 2 August 2025, with GPAI fines under Article 101 applying since 2 August 2026. Enforcement has already begun — the Commission confirmed that the AI Office had sent its first requests for information to more than 30 AI companies as of September 2026.

•Transparency rules: Transparency obligations under Article 50 have applied since 2 August 2026, and generative systems already on the market before then must add machine-readable labeling by 2 December 2026.

•High-risk systems: A "Digital Omnibus" amendment pushed back some deadlines — provider obligations in Chapter III and deployer obligations under Article 26, as they apply to systems listed in Annex III, were deferred by the Digital Omnibus to 2 December 2027.

•Enforcement structure: Each Member State must designate at minimum one notifying authority responsible for overseeing conformity assessment bodies, and one market surveillance authority responsible for enforcing the Act against providers and deployers.

2. United States — a fragmented, contested landscape

Federal level: There is no comprehensive federal AI statute. Instead, the approach is executive-order-driven and security-focused rather than consumer-protection-focused:

•In June 2026, President Trump signed Executive Order 14409, "Promoting Advanced Artificial Intelligence Innovation and Security," establishing new cybersecurity mandates and a voluntary framework for the secure deployment of frontier AI models.

•This order is largely non-binding on industry: it is voluntary, not mandatory, asking frontier AI developers to give the government a 30-day look at their most powerful models before public release.

•A separate, earlier executive order sought to limit state-level regulation by requiring the DOJ to establish an "AI Litigation Task Force" to challenge state AI laws deemed inconsistent with federal policy, and directing federal agencies to withhold discretionary grant funding from states with laws deemed "onerous". However, as of October 2026, no state AI law has actually been preempted by the federal government, and no federal AI statute of general application exists.

State level: In the absence of comprehensive federal law, states have become the primary binding regulators, especially for frontier models:

•California SB 53 (TFAIA), effective January 1, 2026, is the first U.S. law regulating frontier AI models directly. It covers developers of foundation models trained above 10^26 FLOPs, with the heaviest duties reserved for developers above $500 million in annual revenue. Covered developers must publish a frontier AI framework describing how they assess and mitigate catastrophic risk, publish transparency reports at deployment, report critical safety incidents, and honor whistleblower protections. Penalties can reach $1 million per violation.

•California AB 2013 requires generative AI developers to post a summary of their training data on their website.

•California SB 942 requires large AI platforms to provide free AI-content detection tools and include manifest and latent watermarks.

•Colorado repealed its original broad AI Act and replaced it with a narrower one — a new Colorado Automated Decision-Making Technology in Consequential Decisions Act, signed May 2026, takes effect January 1, 2027 and repeals the state's broad 2024 Colorado AI Act before it ever took effect.

•Illinois followed suit: SB 315, signed July 2026, requires large frontier developers to implement and publish a frontier AI framework, publish transparency reports, and report safety incidents — and, notably, imposes a third-party independent audit requirement not found in California's or New York's laws.

•Companion-chatbot and minor-safety laws have also emerged, such as Colorado's Chatbot Safety Act and Connecticut's AI Responsibility and Transparency Act, both taking effect January 1, 2027.

3. Industry self-governance (voluntary, not legally binding — except where law adopts it)

Major labs maintain their own internal safety frameworks, which predate most binding law:

•Only a handful of companies have published formal AI safety frameworks: Anthropic published its Responsible Scaling Policy in September 2023, OpenAI published its Preparedness Framework in December 2023, and Google DeepMind published its Frontier Safety Framework in May 2024.

•These remain explicitly voluntary. Anthropic's current version states it is "our voluntary framework for managing catastrophic risks from advanced AI systems", establishing how the company identifies and evaluates risks and makes decisions about AI development and deployment.

•Interestingly, California's SB 53 took the novel step of making such frameworks legally binding: the law takes these voluntary frameworks and makes them legally binding, though it allows AI companies to change the framework's contents over time. However, in practice this has produced some tension — Anthropic released a separate, vaguer "Frontier Compliance Framework" as its official legal compliance document under SB 53, distinct from its public Responsible Scaling Policy, effectively decoupling its legally binding commitments from its more ambitious voluntary ones.

•International coordination has also occurred via summits: 13 companies signed the Frontier AI Safety Commitments at the 2024 AI Seoul Summit, committing to produce safety frameworks ahead of the 2025 Paris AI Action Summit.

Bottom line

There is currently no single, unified regime governing systems like me. Instead, accountability comes from a patchwork:

•Binding law: the EU AI Act (risk-tiered, with real penalties and an enforcing AI Office) and a growing set of U.S. state laws (especially California's SB 53, with similar laws now in Illinois and elsewhere) that specifically target "frontier" models like large language models.

•Executive policy: U.S. federal action is currently oriented around voluntary security cooperation and cyber-defense rather than mandatory consumer-facing rules, and is in active tension with state-level regulation.

•Self-regulation: Company-authored safety frameworks (Responsible Scaling Policy, Preparedness Framework, Frontier Safety Framework) that are voluntary by design, though some are now being referenced or incorporated by binding state law.

This is a genuinely unsettled and fast-moving area — deadlines, lawsuits (e.g., over Colorado's law), and new state bills are shifting monthly, so any specific compliance question should be checked against the most current primary sources.

Citations (25)

1collibra.comCompanies
AI regulatory compliance in 2026: EU AI Act, US orders, and state laws, and how to operationalize them
Source excerpt: “** It classifies AI by risk and attaches duties such as risk classification, documentation and record-keeping, human oversight, data quality and trans...”
evidence, article. Claim: EU AI Act classifies AI by risk and attaches duties like documentation, human oversight, data quality and transparency.
2blckalpaca.atCompanies
EU AI Act Tracker 2026/27: Implementation Status
Source excerpt: “4 (AI literacy, watered down by the Omnibus) since 2 February 2025, GPAI obligations (Art. ”
evidence, data page. Claim: Prohibitions and AI literacy requirements have been in force since 2 February 2025.
3blckalpaca.atCompanies
EU AI Act Tracker 2026/27: Implementation Status
Source excerpt: “51-55) since 2 August 2025; GPAI fines (Art. 101) since 2 August 2026. ”
evidence, data page. Claim: GPAI obligations apply since 2 August 2025, with GPAI fines under Article 101 since 2 August 2026.
4imiel.devBlogs and newsletters
EU AI Act 2026: How All 27 Member States Are Implementing It
Source excerpt: “digital-strategy.ec.europa.eu (opens in new tab) ## The General-Purpose AI Code of Practice Enforcement of GPAI obligations became possible on 2 Aug ...”
evidence, article. Claim: Enforcement has begun, with AI Office sending first information requests to over 30 AI companies.
5blckalpaca.atCompanies
EU AI Act Tracker 2026/27: Implementation Status
Source excerpt: “The central anchors: The transparency obligations under Article 50 have applied since 2 August 2026. Generative systems that were already on the mar...”
evidence, data page. Claim: Article 50 transparency obligations apply since 2 August 2026; generative systems already on market must add machine-readable labeling by December 2026.
6agentliability.euLow provenance
EU AI Act implementation status 2026: all 27 states
Source excerpt: “The provider obligations in Chapter III (Articles 9 through 17) and the deployer obligations in Article 26, as they apply to the systems listed in Ann...”
evidence, data page. Claim: Digital Omnibus deferred high-risk provider and deployer obligations for Annex III systems to 2 December 2027.
7agentliability.euLow provenance
EU AI Act implementation status 2026: all 27 states
Source excerpt: “At minimum, each Member State must designate one notifying authority (responsible for overseeing conformity assessment bodies) and one market surveill...”
evidence, data page. Claim: Each Member State must designate a notifying authority and a market surveillance authority.
8lathropgpm.comCompanies
New Executive Order Signals Evolving Federal Approach to AI - Lathrop GPM
Source excerpt: “On June 2, 2026, in a rapidly evolving federal AI policy landscape, President Trump signed a new Executive Order (EO) titled Promoting Advanced Artifi...”
evidence, article. Claim: President Trump signed Executive Order 14409 in June 2026 on advanced AI innovation and security.
9lathropgpm.comCompanies
New Executive Order Signals Evolving Federal Approach to AI - Lathrop GPM
Source excerpt: “This EO establishes new cybersecurity mandates and a voluntary framework for the secure deployment of frontier AI models. ”
evidence, article. Claim: The order establishes cybersecurity mandates and a voluntary framework for secure deployment of frontier AI models.
10layer3labs.ioCompanies
AI Executive Order Explained (June 2026): What It Means
Source excerpt: “The new order is voluntary, not mandatory. It asks frontier AI developers to give the government a 30-day look at their most powerful models before pu...”
evidence, article. Claim: The order is voluntary, asking frontier developers to give government a 30-day look before release.
11phillipslytle.comCompanies
Executive Order Issued to Restrict State Regulation of AI
Source excerpt: “Section 3 of the Executive Order requires that, by January 10, 2026, the DOJ establish an “AI Litigation Task Force” to challenge state AI laws deemed...”
evidence, article. Claim: Earlier executive order requires DOJ to establish an AI Litigation Task Force to challenge state AI laws.
12phillipslytle.comCompanies
Executive Order Issued to Restrict State Regulation of AI
Source excerpt: “(b) of the Executive Order requires federal agencies, in consultation with the Special Advisor for AI and Crypto, to withhold discretionary grant prog...”
evidence, article. Claim: Federal agencies directed to withhold discretionary grant funding from states with onerous AI laws.
13astraea.lawNot yet classified
California AI Laws 2026: The AI Regulation Tracker for California and U.S. AI Laws, Enacted and Pending
Source excerpt: ““As of October 2026, no state AI law has been preempted by the federal government, no federal AI statute of general application exists, and the one .....”
evidence, article. Claim: As of October 2026, no state AI law has been preempted and no general federal AI statute exists.
14gc.aiCompanies
State AI Laws in 2026: SB 53, SB 942, and Preemption · GC AI
Source excerpt: “It is the first US law regulating frontier AI models, and it is deliberately narrow: it covers developers of foundation models trained above 10^26 FLO...”
evidence, article. Claim: California SB 53 is the first US law regulating frontier models, covering developers above 10^26 FLOPs.
15layer3labs.ioCompanies
State AI Laws by State (2026): All 50 US States Guide
Source excerpt: “- AB 2013 — Generative AI developers must post a summary of their training data on their website. ”
evidence, article. Claim: California AB 2013 requires generative AI developers to post training data summaries.
16kslaw.comCompanies
New State AI Laws are Effective on January 1, 2026, But a New Executive Order Signals Disruption
Source excerpt: “- **California’s SB 942 (the California AI Transparency Act)**, which requires large AI platforms to provide free AI‑content detection tools and inclu...”
evidence, article. Claim: California SB 942 requires large AI platforms to provide free detection tools and watermarks.
17dlapiper.comCompanies
Law / proposed law in the United States - AI Laws of the World
Source excerpt: “- On 14 May 2026, Governor Jared Polis signed a new, narrower Colorado Automated Decision-Making Technology in Consequential Decisions Act (enacted as...”
evidence, data page. Claim: Colorado signed a narrower automated decision-making act in May 2026, replacing its 2024 AI Act.
18dlapiper.comCompanies
Law / proposed law in the United States - AI Laws of the World
Source excerpt: “More recently, on 6 July 2026, Governor JB Pritzker signed SB 315, a frontier model safety law that closely resembles California’s TFAIA and New York’...”
evidence, data page. Claim: Illinois SB 315 signed July 2026 is a frontier model safety law resembling California's.
19arxiv.orgAcademic
A Grading Rubric for AI Safety Frameworks
Source excerpt: “** To date, only four companies have published AI safety frameworks as defined above. Anthropic published their Responsible Scaling Policy (RSP) in Se...”
evidence, official document. Claim: Only a handful of companies have published formal AI safety frameworks, starting with Anthropic's RSP in September 2023.
20arxiv.orgAcademic
A Grading Rubric for AI Safety Frameworks
Source excerpt: “OpenAI published their Preparedness Framework (Beta) in December 2023 [39], Google DeepMind their Frontier Safety Framework in May 2024 [14], and Magi...”
evidence, official document. Claim: OpenAI published its Preparedness Framework in December 2023 and Google DeepMind its Frontier Safety Framework in May 2024.
21anthropic.comCompanies
Responsible Scaling Policy Version 3.0 Effective February 24, 2026
Source excerpt: “Frontier Safety Roadmap February 24, 2026 (RSP v3.0) Responsible Scaling Policy, Anthropic 2 Our Responsible Scaling Policy (RSP) is our voluntary ...”
attribution, official document. Claim: Anthropic describes its RSP as a voluntary framework for managing catastrophic risks from advanced AI.
22anthropic.comCompanies
Responsible Scaling Policy Version 3.0 Effective February 24, 2026
Source excerpt: “It establishes how we identify and evaluate risks, how we make decisions about AI development and deployment, and, from the perspective of the world ...”
attribution, official document. Claim: RSP establishes how Anthropic identifies and evaluates risks and makes development and deployment decisions.
23themidasproject.comNot yet classified
OpenAI wrote a safety framework for California. Its system cards are ignoring it.
Source excerpt: “The law takes these voluntary frameworks and makes them legally binding, though it allows AI companies to change the framework’s contents. ”
evidence, article. Claim: SB 53 makes voluntary frameworks legally binding while allowing companies to change their contents.
24themidasproject.comNot yet classified
OpenAI wrote a safety framework for California. Its system cards are ignoring it.
Source excerpt: “* But just before SB 53 went into effect, Anthropic released a new safety policy, the Frontier Compliance Framework, and designated it — not the Resp...”
evidence, article. Claim: Anthropic released a separate Frontier Compliance Framework as its SB 53 legal compliance document.
25arxiv.orgAcademic
A Grading Rubric for AI Safety Frameworks
Source excerpt: “Another 13 companies signed the Frontier AI Safety Commitments [16] at the AI Seoul Summit in May 2024, committing to producing safety frameworks ahea...”
evidence, official document. Claim: 13 companies signed the Frontier AI Safety Commitments at the 2024 Seoul Summit.