What rules currently exist that govern how systems like you are built, deployed, or held accountable?

There is no single global set of rules governing AI systems like large language models (LLMs) or general-purpose AI (GPAI). Instead, a patchwork of binding laws, voluntary frameworks, executive actions, sector-specific rules, and international principles applies, varying by jurisdiction, risk level, and use case. These address building (development, training data, risk management), deployment (transparency, human oversight, conformity), and accountability (audits, liability, incident reporting, penalties). The landscape is rapidly evolving, with the EU’s AI Act as the most comprehensive binding regime; the US favoring innovation-oriented voluntary/standards approaches plus state laws; and other countries emphasizing content controls, ethics, or sector rules.[1]

European Union: AI Act (Regulation 2024/1689)

The world’s first comprehensive horizontal AI law. It entered into force on 1 August 2024 and applies in phases (prohibitions and AI literacy from early 2025; GPAI rules from mid-2025; most transparency from 2026; high-risk obligations largely from late 2027/2028 after timeline adjustments via the Digital Omnibus). It uses a risk-based approach and has extraterritorial reach (applies to providers/deployers outside the EU if systems or outputs are used in the EU).[2]

•Unacceptable risk (prohibited): Includes subliminal/manipulative techniques causing significant harm; exploiting vulnerabilities (age, disability, socio-economic); social scoring; certain predictive policing based solely on profiling; untargeted scraping for facial recognition databases; emotion inference in workplaces/education (with exceptions); most real-time remote biometric identification in public for law enforcement (narrow exceptions); and (later) generating non-consensual intimate imagery or CSAM.[3]

•High-risk: Systems used as safety components in regulated products (Annex I) or in listed areas (Annex III: certain biometrics, critical infrastructure, education/vocational training, employment, essential services like credit/insurance/benefits, law enforcement, migration/border, justice/democratic processes). Providers must implement risk management systems throughout the lifecycle; ensure data quality/governance (relevant, representative, error-minimized); technical documentation; automatic logging; instructions for use; human oversight; accuracy, robustness, and cybersecurity; conformity assessment (often self- or third-party); and EU database registration. Deployers have lighter duties (e.g., human oversight, monitoring).[2]

•Limited/minimal risk: Transparency obligations (e.g., disclose AI interaction for chatbots; label deepfakes/synthetic content in machine-readable ways). Minimal risk is largely unregulated.

•GPAI models (relevant to systems like LLMs): All providers must maintain technical documentation (training/testing/evaluation), provide info to downstream system providers, comply with copyright rules, and publish a training data summary. Systemic-risk models (presumed above ~10²⁵ FLOPs training compute, or equivalent capabilities/impact) face extra duties: model evaluations, adversarial testing/risk assessments and mitigations, serious incident tracking/reporting, and cybersecurity. Open-source has lighter rules unless systemic risk.[4]

•Accountability/enforcement: Market surveillance authorities, AI Office; fines up to €35 million or 7% of global annual turnover (prohibited practices/data issues) or lower tiers (e.g., 3% for GPAI). Codes of practice, standards (harmonized standards give presumption of conformity), and support for innovation (sandboxes).[5]

United States

No comprehensive federal AI statute exists as of late 2026. Regulation is a mix of voluntary frameworks, executive actions, existing laws (e.g., FTC Act for unfair/deceptive practices, civil rights statutes, sector rules), proposed bills, and a growing state patchwork. Recent administrations have emphasized U.S. leadership/innovation while addressing risks, with efforts toward a national framework that could limit conflicting state laws.[6]

•NIST AI Risk Management Framework (AI RMF 1.0, 2023; plus Generative AI Profile 2024): Voluntary, flexible, consensus-based guidance for managing risks across the AI lifecycle. Core functions: Govern (culture, policies, accountability, third-party risk); Map (context, categorization, impacts); Measure (metrics, testing, monitoring); Manage (prioritize/respond to risks). Aims for trustworthy AI characteristics: valid/reliable, safe, secure/resilient, accountable/transparent, explainable/interpretable, privacy-enhanced, fair (harmful bias managed). Widely referenced; profiles for generative AI and critical infrastructure.[7]

•Executive actions and federal guidance: Biden-era EO 14110 (Safe, Secure, Trustworthy AI, 2023; largely rescinded or superseded) directed standards, red-teaming, safety, equity, etc. Later actions (e.g., 2025 EOs on removing barriers to leadership, national policy framework, promoting advanced AI innovation/security) focus on innovation, voluntary pre-release evaluation/benchmarking for “covered frontier models” (via NIST/CISA), cybersecurity, critical infrastructure, and challenging overly burdensome state laws via litigation task forces and proposed federal preemption legislation. NTIA’s 2024 AI Accountability Policy Report recommends guidance on audits/disclosures/liability, support for evaluation infrastructure/research, and requirements for independent evaluations of high-risk systems, registries, and contractor standards. Federal government use has principles (e.g., EO 13960) and directives for responsible deployment, inventories, and impact assessments.[8]

•State laws (examples; many effective 2025–2027):

•Colorado (SB 24-205, later modified/reenacted as ADMT rules): Duties for developers/deployers of high-risk systems making consequential decisions (employment, housing, credit, etc.)—reasonable care against algorithmic discrimination, transparency, notices, explanations, data access/correction, human review.[9]

•California SB 53 (Transparency in Frontier AI Act, effective ~2026): For large/frontier model developers—transparency reports (pre/concurrent with deployment), catastrophic risk frameworks/assessments (shared with authorities), critical safety incident reporting, whistleblower protections. Focus on high-compute models and catastrophic risks (e.g., CBRN, cyber, loss of control). Other CA laws cover AI transparency/labeling, deepfakes/elections, government use, etc.[10]

•Others: New York (RAISE Act and similar for frontier transparency/safety; NYC employment tools audits); Texas (governance/prohibited uses); various deepfake, privacy, automated decision, and sector bills (housing, insurance, etc.). A federal EO has pushed back against fragmented state rules.[11]

•Accountability: Existing liability (product, tort, discrimination); proposed transparency/reporting for high-impact systems; voluntary audits/red-teaming; FTC/enforcement actions. Bills like Algorithmic Accountability Act variants have been proposed for impact assessments.

China

Primarily administrative measures, content/security-focused rules, judicial guidance, and export controls rather than one comprehensive statute (a draft AI Law has been discussed). Emphasis on socialist values, content control, data security, and innovation with oversight. Cyberspace Administration of China (CAC) is central.[12]

•Generative AI Interim Measures (2023): Service providers must ensure security assessments, content compliance (no prohibited info), labeling, user real-name where needed, and data protection.

•AI-generated/synthetic content labeling (Measures effective 2025, with national standard): Visible and invisible/metadata labeling required; enforcement ongoing.[13]

•Other: Algorithmic recommendation rules; anthropomorphic/AI companion interaction measures (disclosure, safety, minor protections); AI agent guidelines; ethics-safety guidelines; financial sector AI governance.

•Judicial: Supreme People’s Court Opinions (2026) on AI disputes—fault-based liability (generally), product liability/IP/data issues, disclosure/warnings for AI products, deepfakes, discrimination, etc.[14]

•Export controls: Expanding catalogue restrictions/prohibitions on advanced AI tech (large models above compute/parameter thresholds or trained on sensitive data, agents, chips, etc.), with interim registration.[15]

•Accountability: Registration of services, penalties under cybersecurity/data/personal info laws, content takedowns.

United Kingdom, Canada, and Others

•UK: Principles-based, pro-innovation approach (no comprehensive AI Act equivalent). Five principles (safety/security/robustness; transparency/explainability; fairness; accountability/governance; contestability/redress) applied by existing regulators via current laws (e.g., UK GDPR automated decisions with safeguards; sector rules). AI Safety/Security Institute for evaluations and frontier risk work. Sandboxes (“AI Growth Labs”); potential future Frontier AI Bill. Collaboration on standards/safety with partners like Canada. EU AI Act can apply extraterritorially.[16]

•Canada: No federal comprehensive law (AIDA in Bill C-27 died). Federal Directive on Automated Decision-Making (Algorithmic Impact Assessments, controls by impact level) for government; agentic AI guides. Privacy laws (and provincial) apply; Quebec has automated processing rules; Ontario public-sector framework. Focus on ethics, safety institutes, and international partnerships.[17]

•International/standards: OECD AI Principles (inclusive growth, human-centered values, transparency, robustness, accountability). Council of Europe Framework Convention on AI. ISO/IEC 42001 (AI management systems). Various bilateral/multilateral safety/eval partnerships (e.g., UK-Canada, AISIs network). Industry codes, company self-regulation (red-teaming, model cards), and voluntary commitments.

Accountability Mechanisms Common Across Regimes

•Documentation and transparency: Model/system cards, training data summaries, risk assessments, disclosures to users/authorities.

•Evaluation and oversight: Risk management, testing (including adversarial/red-teaming), human oversight, independent audits/certification (mandatory for some high-risk), incident reporting.

•Liability and enforcement: Existing product/tort/consumer/civil rights laws; specific fines, private rights of action in some places, whistleblower protections; government contracting requirements.

•Building/deployment specifics: Data quality/governance, cybersecurity, robustness; pre-market conformity or voluntary pre-release reviews for frontier systems; post-market monitoring.

•For LLMs/GPAI specifically: Labeling of synthetic content, training data transparency/copyright compliance, systemic risk mitigations, and deployer responsibilities (e.g., not using for prohibited purposes).

Rules continue to develop quickly with technological advances, new bills, amendments (e.g., EU timelines), enforcement actions, and international coordination. Compliance often requires mapping systems to risk categories, implementing governance (aligned with NIST or ISO), and monitoring jurisdictional applicability (especially extraterritorial ones). Organizations commonly use hybrid approaches: voluntary frameworks like NIST RMF for global baselines, plus jurisdiction-specific obligations. For the latest or advice on specific systems, consult primary legal texts, regulators, or counsel, as this is a high-level overview of the current landscape.

Citations (17)

1cambridge.orgAcademic
http://resolve.cambridge.org/core/journals/international-legal-materials/article/regulation-20241689-of-the-eur-parl-council-of-june-13-2024-eu-artificial-intelligence-act/64F1F6734F8C66CA3EEA149C9759194E
Backs: “The landscape is rapidly evolving, with the EU’s AI Act as the most comprehensive binding regime; the US favoring innovation-oriented voluntary/standards approaches plus state laws; and other countries emphasizing content controls, ethics, or sector rules.”
background, article. Claim: The EU AI Act is the most comprehensive binding regime amid a patchwork of global AI rules.
2artificialintelligenceact.euNonprofits and think tanks
https://artificialintelligenceact.eu/high-level-summary/
Backs: “It uses a risk-based approach and has extraterritorial reach (applies to providers/deployers outside the EU if systems or outputs are used in the EU).”
evidence, article. Claim: EU AI Act timeline, risk-based approach, extraterritorial reach, and high-risk provider obligations.
3europa.euGovernment
https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
Backs: “Includes subliminal/manipulative techniques causing significant harm; exploiting vulnerabilities (age, disability, socio-economic); social scoring; certain predictive policing based solely on profiling; untargeted scraping for facial recognition databases; emotion inference in workplaces/education (with exceptions);…”
evidence, official document. Claim: EU AI Act prohibited practices classified as unacceptable risk.
4aisafetyassociation.orgNot yet classified
https://aisafetyassociation.org/european-ai-act
Backs: “Systemic-risk models (presumed above ~10²⁵ FLOPs training compute, or equivalent capabilities/impact) face extra duties: model evaluations, adversarial testing/risk assessments and mitigations, serious incident tracking/reporting, and cybersecurity. Open-source has lighter rules unless systemic risk.”
evidence, article. Claim: GPAI model obligations and extra duties for systemic-risk models under the EU AI Act.
5djei.ieNot yet classified
https://djei.ie/en/what-we-do/innovation-research-development/artificial-intelligence/eu-ai-act/
Backs: “Codes of practice, standards (harmonized standards give presumption of conformity), and support for innovation (sandboxes).”
evidence, article. Claim: EU AI Act enforcement bodies, fines up to €35 million or 7% turnover, codes of practice, sandboxes.
6jdsupra.comNews and media
https://www.jdsupra.com/legalnews/ai-watch-global-regulatory-tracker-2931403/
Backs: “Recent administrations have emphasized U.S. leadership/innovation while addressing risks, with efforts toward a national framework that could limit conflicting state laws.”
background, article. Claim: No comprehensive US federal AI statute; mix of voluntary frameworks, executive actions, existing laws, and state patchwork.
7nist.govGovernment
https://www.nist.gov/itl/ai-risk-management-framework
Backs: “Widely referenced; profiles for generative AI and critical infrastructure.”
evidence, official document. Claim: NIST AI RMF is voluntary guidance with Govern, Map, Measure, Manage functions.
8ntia.govGovernment
https://www.ntia.gov/issues/artificial-intelligence/ai-accountability-policy-report?mkt_tok=MTM4LUVaTS0wNDIAAAGSIHkfYmiqiv7z0yzAQwB82uL6ddj1WRtpHes9rvwgj9e_ZUj3FxPaT8Bw-H6X6Q08simszD9ZMQ0wBHQ_vUxFKz-SaSlHmaw0LYPEIryRKsKk
Backs: “Federal government use has principles (e.g., EO 13960) and directives for responsible deployment, inventories, and impact assessments.”
evidence, official document. Claim: US executive actions and NTIA 2024 AI Accountability Policy Report recommendations on audits, disclosures, liability.
9nhimg.orgNonprofits and think tanks
https://nhimg.org/us-state-ai-laws-tracker-guide
Backs: “Duties for developers/deployers of high-risk systems making consequential decisions (employment, housing, credit, etc.)—reasonable care against algorithmic discrimination, transparency, notices, explanations, data access/correction, human review.”
evidence, article. Claim: Colorado law imposes duties on developers/deployers of high-risk systems making consequential decisions.
10mondaq.comNot yet classified
https://www.mondaq.com/unitedstates/new-technology/1689308/california-adopts-landmark-ai-law-new-transparency-safety-and-reporting-requirements-for-frontier-model-developers
Backs: “Other CA laws cover AI transparency/labeling, deepfakes/elections, government use, etc.”
evidence, article. Claim: California SB 53 requires frontier developers to publish transparency reports, report incidents, protect whistleblowers.
11aei.orgNonprofits and think tanks
https://www.aei.org/wp-content/uploads/2026/10/Regulating-the-Frontier.pdf?x95787
Backs: “A federal EO has pushed back against fragmented state rules.”
evidence, official document. Claim: Other state frontier laws exist and a federal EO pushes back against fragmented state rules.
12deep-lex.comNot yet classified
https://www.deep-lex.com/ai-regulation-tracker/china
Backs: “Emphasis on socialist values, content control, data security, and innovation with oversight. Cyberspace Administration of China (CAC) is central.”
background, data page. Claim: China regulates AI through administrative, content, and security measures, centered on the CAC, not one statute.
13china-briefing.comCompanies
https://www.china-briefing.com/news/china-ai-regulations-2026-enforcement-guidance-compliance/
Backs: “Visible and invisible/metadata labeling required; enforcement ongoing.”
evidence, article. Claim: China's AI-generated content labeling measures require visible and metadata labels, with ongoing enforcement.
14jonesday.comNot yet classified
https://www.jonesday.com/en/insights/2026/09/chinas-supreme-court-issues-landmark-judicial-rules-on-artificial-intelligenceimplications-for-product-liability-intelle
Backs: “Supreme People’s Court Opinions (2026) on AI disputes—fault-based liability (generally), product liability/IP/data issues, disclosure/warnings for AI products, deepfakes, discrimination, etc.”
evidence, article. Claim: Supreme People's Court 2026 opinions on AI disputes address liability, IP, deepfakes, discrimination.
15pillsburylaw.comNot yet classified
https://www.pillsburylaw.com/en/news-and-insights/china-technology-export-restrictions-controls.html
Backs: “Expanding catalogue restrictions/prohibitions on advanced AI tech (large models above compute/parameter thresholds or trained on sensitive data, agents, chips, etc.), with interim registration.”
evidence, article. Claim: China expanding export controls on advanced AI technology including large models and chips.
16terralex.orgNot yet classified
https://www.terralex.org/insights-cross-border-guides/terralex-ai-guide/united-kingdom-ai-guide
Backs: “Collaboration on standards/safety with partners like Canada. EU AI Act can apply extraterritorially.”
evidence, article. Claim: UK uses a principles-based, pro-innovation approach applied by existing regulators, with no AI Act equivalent.
17nhimg.orgNonprofits and think tanks
https://nhimg.org/canada-ai-regulation-guide
Backs: “Focus on ethics, safety institutes, and international partnerships.”
evidence, article. Claim: Canada has no comprehensive federal AI law; AIDA died; government uses Directive on Automated Decision-Making.