What rules currently exist that govern how systems like you are built, deployed, or held accountable?

Rules for AI systems are fast-moving — I'll pull together the current laws and accountability frameworks that govern how they are built and deployed.

Rules for AI build, deployment and accountability are a fast-moving patchwork, with no single global statute. The field called AI Governance is generally described as frameworks, laws, policies, and organizational practices that guide how AI systems are developed, deployed, monitored, and held accountable.

1. European Union - Binding, risk-based regulation

The European Union has the most comprehensive regulatory framework for AI anywhere in the world. The EU AI Act, formally adopted in 2024, is Regulation (EU) 2024/1689, which entered into force on 1 August 2024. It applies to EU organizations and also globally to non-EU organizations that address the European market.

It sits alongside the GDPR, NIS2 Directive and other digital strategy acts, and both GDPR and AI Act apply in parallel where AI processes personal data.

The Act pursues a risk-based approach, classifying AI systems into four categories with escalating obligations:

Tier	What falls into it	Consequence
Prohibited	Ten practices banned outright	€35m or 7% of turnover
High risk	Annex I product safety and eight Annex III use-case areas	Full Chapter III regime and conformity assessment
Transparency risk	Article 50: interaction notice, synthetic marking, deep fakes	Disclosure and marking duties
Minimal risk	Everything else: the large majority of AI systems	AI literacy duty only

More detail:

•Prohibited AI practices (Art.5) - systems posing unacceptable risk – for example, those involving subliminal manipulation, social scoring, and certain real-time biometric identification – are banned outright. Article 5 now prohibits ten practices, eight unlawful since 2 February 2025 including subliminal manipulation, exploitation of vulnerability, social scoring, predictive policing based on profiling alone, untargeted facial scraping, emotion inference at work and in education, biometric categorisation for sensitive traits, and real-time remote biometric identification, with two further bans covering non-consensual intimate imagery and child sexual abuse material applying from 2 December 2026.

•High-risk AI systems (Arts. 6-49) - Systems listed in Annexes II and III covering areas such as biometrics, critical infrastructure, education, employment, law enforcement, and migration must comply with extensive requirements, including risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy, robustness, and cybersecurity.

•Limited-risk AI systems (Art. 50) - Systems interacting directly with persons, generating synthetic content, or performing emotion recognition must meet specific transparency and labeling obligations.

•Low and minimal-risk AI systems - Subject only to voluntary codes of conduct.

General-Purpose AI (GPAI) models are separately regulated under Chapter V, with additional obligations for “systemic risk” models, including technical documentation, information for downstream providers, a copyright policy, a public training-content summary, and where the model presents systemic risk, model evaluation, adversarial testing, incident reporting and cybersecurity.

Obligations are assigned by role:

•Providers (developers) must establish a continuous risk management system (Art.9), ensure data governance quality criteria (Art.10), maintain technical documentation (Art.11), design logging for traceability (Art.12), provide transparency and instructions for use (Art.13), ensure human oversight by design (Art.14), ensure accuracy, robustness and cybersecurity (Art.15), undergo conformity assessment and CE marking (Art.43), implement quality management system (Art.17), register in EU database (Art.49), and maintain post-market monitoring (Art.72) and serious incident reporting within 15 days (Art.73).

•Deployers (users) must ensure no prohibited use, operate in line with provider instructions, assign competent human oversight, ensure input data quality, monitor and retain logs for at least six months, and conduct Fundamental Rights Impact Assessment (FRIA) before putting systems into operation in essential services (banks, schools, hospitals) (Art.27), as well as inform natural persons they are interacting with an AI system (Art.50) and ensure AI literacy among staff (Art.4).

Penalties: supervisory authorities can impose fines ranging from 3% of global annual turnover or €15 million (whichever is higher) to 7% of global turnover or €35 million. In three tiers the maximum is €35 million or 7% for prohibited practices.

Timeline as amended by the Digital Omnibus Regulation (EU) 2026/1744 in force 27 July 2026:

•1 Aug 2024 Regulation enters into force

•2 Feb 2025 Prohibited practices and AI literacy apply

•2 Aug 2025 General-purpose AI model obligations apply

•2 Aug 2026 Transparency obligations and general application date

•2 Dec 2027 Annex III high-risk obligations apply (deferred)

•2 Aug 2028 Annex I product-safety high-risk obligations apply

Enforcement is by national market surveillance authorities and the AI Office, but as of mid-2026 only approximately 33% of Member States have fully designated both authorities.

2. United States - No comprehensive federal law, patchwork of federal and state rules

The United States regulates AI through executive orders, targeted federal statutes, and state laws rather than a single federal framework. The United States still doesn't have a comprehensive federal AI law.

Federal level:

•Executive Order 14110 (Oct 30, 2023) titled "Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence" directed over 50 federal entities to take more than 100 actions and required companies training AI models above certain thresholds to report under Defense Production Act authority and directed NIST to develop safety guidelines.

•Revocation and replacement: On January 23, 2025, President Trump signed Executive Order 14179 "Removing Barriers to American Leadership in Artificial Intelligence," revoking Biden's EO 14110.

•EO 14365 (Dec 11, 2025) titled "Ensuring a National Policy Framework for Artificial Intelligence" directly targets state AI laws by establishing a DOJ AI Litigation Task Force to challenge state AI laws, directing Commerce to identify "problematic" state laws, threatening to withhold broadband funding, and directing FTC/FCC to consider federal preemption. Legal scholars note an executive order cannot override state law without congressional action or court ruling.

•TAKE IT DOWN Act (P.L. 119-12), signed May 19, 2025, is the first federal law directly regulating AI-generated content, criminalizing nonconsensual publication of intimate images including AI-generated deepfakes, with penalties up to 2 years (adults) and 3 years (minors) and requiring platforms to remove reported content within 48 hours.

NIST AI Risk Management Framework:

The NIST AI Risk Management Framework is a voluntary, widely recognized guide to help organizations manage risks throughout the AI lifecycle. AI RMF 1.0 was published January 26, 2023, with Generative AI Profile AI 600-1 final July 26, 2024. It lacks enforcement mechanisms but is increasingly referenced in state statutes - for example Texas HB 149 gives a defendant shield from liability if it discovered violation through internal review while substantially complying with the NIST Generative AI Profile.

State laws - 50-state patchwork:

In 2025 all 50 states introduced AI legislation and 38 states enacted roughly 100 AI-related measures. Key examples:

•Colorado: SB 24-205, the Consumer Protections for Artificial Intelligence Act, signed May 17, 2024, was the first state law to broadly regulate AI systems that make "consequential decisions", defining high-risk AI as any system that makes or substantially factors into decisions about employment, education, financial services, healthcare, housing, insurance, or legal services, requiring developers to use reasonable care to prevent algorithmic discrimination, deployers to conduct annual impact assessments, and disclosure to the Attorney General within 90 days. The original was repealed before taking effect and replaced by SB 26-189 with a narrower Automated Decision-Making Technology (ADMT) Act effective January 1, 2027.

•California: Multiple statutes: SB 53 (Frontier AI Safety) signed Sept 29, 2025 requires large frontier AI developers to publish safety frameworks and report critical safety incidents within 15 days; SB 942 (AI Transparency Act) operative August 2, 2026 requires providers with over 1M monthly users to offer free AI detection tools and embed disclosure metadata; AB 2013 effective Jan 1, 2026 requires documentation of training datasets; FEHA AI Employment Rules effective Oct 1, 2025 require bias audits and 4-year record retention.

•Texas: HB 149, the Texas Responsible AI Governance Act, took effect January 1, 2026, prohibiting AI systems designed to manipulate human behavior, discriminate, produce child exploitation material, or infringe constitutional rights, with penalties $10k-$12k per curable violation and $80k-$200k per uncurable violation.

•Illinois: HB 3773 effective Jan 1, 2026 amends Human Rights Act to make it a civil rights violation to use AI that discriminates in employment.

•New York City: Local Law 144 enforced since July 5, 2023 requires employers using automated employment decision tools to obtain independent bias audits annually.

•Deepfakes: As of mid-2025, 47 states have enacted deepfake legislation, with 46 states addressing nonconsensual intimate deepfakes and 28 states regulating AI-generated content in political communications.

3. United Kingdom - Principles-based, sector-led

The United Kingdom adheres to a flexible, sector-specific approach, eschewing a single comprehensive statute. Its “A pro-innovation approach to AI regulation” published 29 March 2023 establishes five key principles: safety, security. Those principles are detailed as safety, security, robustness; appropriate transparency; fairness; accountability and governance; contestability and redress, but leaves implementation to existing sectoral regulators (FCA, ICO, CMA, MHRA). There is no standalone AI law yet.

4. China - State-control, layered sector-specific rules

China has pursued a centralized, state-controlled approach with layered, sector-specific regulations, not a single statute: Generative AI Regulations (2023), AI Safety Governance Framework (2024), Network Data Security Management Regulations (January 2025), AI-content-labeling rules (September 2025). Core rules cover Algorithmic Recommendation, Deep Synthesis and Generative AI rules; AI-content Labelling Measures (2025) and require content controls, training-data legality, security assessments and filing/registration before launch, mandatory filing and content labelling.

5. International soft-law and treaty frameworks

•OECD AI Principles: First intergovernmental standard adopted by 40+ countries, updated in 2024 emphasizing inclusive growth, transparency, and accountability, representing the closest thing to a global consensus, endorsed by 47 adherents including all G7 members.

•Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law: The first international, legally binding treaty to ensure human rights, rule of law and democratic standards in use of AI, opened for signature September 2024. It establishes seven core principles including accountability: clear responsibility for AI's impact on human rights, including legal mechanisms to hold actors accountable, and requires parties to adopt measures to ensure accountability and availability of legal remedies for victims.

•Other instruments increasingly cited: G20 references OECD principles, UNESCO Recommendation, and in the EU additional intersections with GDPR Article 22 (right not to be subject to solely automated decisions), Digital Services Act transparency for recommender systems, and Digital Markets Act gatekeeper rules.

In practice, most systems like conversational AI fall under transparency obligations (disclosure that user is interacting with AI, marking synthetic content) rather than high-risk conformity assessments, while accountability mechanisms differ sharply by jurisdiction: EU fines and market surveillance, US voluntary NIST RMF plus enforceable state AG actions and FTC unfair-practice authority, UK regulator guidance, and China filing and security assessment regimes.

Citations (3)

1reedsmith.comNot yet classified
Regulation of AI in the EU
Backs: “The field called AI Governance is generally described as frameworks, laws, policies, and organizational practices that guide how AI systems are developed, deployed, monitored, and held accountable. 1.”
background, article. Claim: AI governance is described as frameworks, laws, policies, and organizational practices guiding how AI systems are developed, deployed, monitored, and held accountable.
2euaiact.comNot yet classified
EU AI Act - EU Artificial Intelligence Act
Backs: “European Union - Binding, risk-based regulation. The European Union has the most comprehensive regulatory framework for AI anywhere in the world.”
evidence, home page. Claim: The EU has the most comprehensive AI regulatory framework, with the risk-based EU AI Act binding providers and deployers.
3recordinglaw.comNot yet classified
AI Laws and Regulation in the United States (2026)
Backs: “Enforcement is by national market surveillance authorities and the AI Office, but as of mid-2026 only approximately 33% of Member States have fully designated both authorities. 2. United States - No comprehensive federal law, patchwork of federal and state rules”
evidence, article. Claim: The US lacks a comprehensive federal AI law and relies on executive orders, targeted federal statutes, and a patchwork of state laws.