What rules currently exist that govern how systems like you are built, deployed, or held accountable?
Short answer: There isn’t one global “AI law.” Today, systems like this are governed by a patchwork of (a) general laws that already apply to software, data and discrimination, (b) AI‑specific statutes and rules in a few jurisdictions, and (c) standards and guidance used by regulators and customers to hold vendors to account. Here are the most relevant, with dates so you can see what is actually in force now.
United States – federal (what applies nationwide)
United States – state and local (what many companies feel most in practice)
European Union (binding and rapidly phasing in)
United Kingdom
Canada
China
Cross‑jurisdictional standards and frameworks (increasingly referenced in contracts and supervision)
What this means in practice if you build or deploy systems like this
If you want, tell me where you operate and your use case (e.g., hiring, customer service, healthcare), and I’ll map your specific obligations and likely audit artifacts.
Citations (24)
- EXECUTIVE OFFICE OF THE PRESIDENT
Backs: “Note this governs agencies and their vendors, not the general public.”
- DCPD-202500115 - Executive Order 14148—Initial Rescissions of Harmful Executive Orders and Actions - DCPD-202500115 | Content Details | GovInfo
Backs: “If you saw older references to EO 14110 obligations, they no longer control.”
- Statement of Chair Lina M. Khan Regarding the Joint Interagency Statement on AI
Backs: “FTC: can act against unfair or deceptive AI claims (e.g., “AI‑powered” marketing and training‑data claims).”
- Consumer Financial Protection Circular 2022-03: Adverse action notification requirements in connection with credit decisions based on complex algorithms | Consumer Financial Protection Bureau
Backs: “CFPB: lenders using complex/AI models must still give specific adverse‑action reasons under ECOA/Reg B; model opacity is not a defense.”
- EEOC Releases New Resource on Artificial Intelligence and Title VII
Backs: “Title VII/ADA apply to AI in hiring; the EEOC’s 2023 technical assistance explains how to audit for disparate impact.”
- Model Risk Management: Revised Guidance | OCC
Backs: “Financial regulators: banks must apply model‑risk‑management guidance (SR 11‑7/OCC MRM), updated and re‑affirmed in 2026.”
- 88 FR 16190 - Copyright Registration Guidance: Works Containing Material Generated by Artificial Intelligence - Content Details - 2023-05321
Backs: “The Office’s 2025 Part 2 report reiterates the “human authorship” focus. Courts are also beginning to rule on training‑data issues.”
- SENATE BILL 24-205
Backs: “Requires risk‑management programs, impact assessments, notice to individuals, and incident notification to the AG for algorithmic discrimination; developers also have disclosure duties to deployers and the AG.”
- Automated Employment Decision Tools (AEDT) - DCWP
Backs: “Since July 5, 2023, employers using AEDTs in NYC must conduct an independent annual bias audit, publish results, and give notices to candidates/employees.”
- California Finalizes Regulations to Strengthen Consumers' Privacy
Backs: “CPPA regulations finalized in 2025 took effect Jan 1, 2026, adding consumer rights and notices for Automated Decision‑Making Technology (ADMT), plus risk assessments and cyber‑audits; some ADMT duties phase in by Jan 1, 2027 for “significant decisions.””
- California Business and Professions Code § 17940 (2025) :: 2025 California Code :: U.S. Codes and Statutes :: U.S. Law :: Justia
Backs: “California’s “Bot” disclosure law (SB 1001) has required clear bot identification in certain commercial/election contexts since July 1, 2019.”
- California governor vetoes bill to create first-in-nation AI safety measures
Backs: “A proposed 2024 “frontier model” bill (SB 1047) was vetoed; it is not law.”
- 740 ILCS 14/20
Backs: “Illinois BIPA (740 ILCS 14) imposes strict notice/consent, retention and security duties for biometrics and allows private lawsuits; 2024 amendments clarified per‑person damages counting.”
- Protecting Washingtonians’ Personal Health Data and Privacy | Washington State
Backs: “Washington’s My Health My Data Act (effective Mar 31, 2024) restricts collection/sharing of consumer health data outside HIPAA; enforced under the state consumer protection act.”
- AI Act enters into force
Backs: “Bans certain “unacceptable‑risk” practices from Feb 2, 2025; transparency duties (e.g., deepfake labeling) tighten by Dec 2, 2026; high‑risk rules phase in later: standalone high‑risk systems by Dec 2, 2027, and high‑risk systems embedded in products by Aug 2, 2028. National authorities and the Commission will enforce.”
- The enforcement framework under the Digital Services Act | Shaping Europe’s digital future
Backs: “Very Large Online Platforms/Search Engines must assess and mitigate “systemic risks,” adapt recommender systems, and publish transparency/audit reports (applies to AI‑driven intermediaries).”
- Liability for defective products
Backs: “Member States must transpose it by Dec 9, 2026, after which claims can be brought under the new rules.”
- The Framework Convention on Artificial Intelligence - Artificial Intelligence
Backs: “A first‑ever binding international AI convention (opened for signature Sept 5, 2024) requiring signatories to align AI lifecycles with human rights, democracy and rule‑of‑law; it complements, not replaces, EU law.”
- AI regulation: a pro-innovation approach - GOV.UK
Backs: “Separately, the Online Safety Act 2023 is being phased in via Ofcom codes and imposes risk duties on platforms (including recommender/algorithmic risks).”
- Directive on Automated Decision-Making- Canada.ca
Backs: “However, the Treasury Board’s Directive on Automated Decision‑Making (effective 2019; updated 2023) governs federal agencies’ automated decisions and requires Algorithmic Impact Assessments, transparency, testing and human oversight scaled to risk.”
- Translation: Internet Information Service Algorithmic Recommendation Management Provisions – Effective March 1, 2022
Backs: “Binding national rules govern recommendation algorithms (Mar 1, 2022), deep‑synthesis/deepfake services (Jan 10, 2023), and generative‑AI services (Aug 15, 2023), covering filing, security/risk assessments, content labeling, and enforcement by the Cyberspace Administration of China and others.”
- AI Risk Management Framework | NIST
Backs: “NIST AI Risk Management Framework 1.0 (2023) with a Generative‑AI Profile (2024) is used widely for internal controls and vendor assessments in the U.S.”
- ISO/IEC 42001:2023 - AI management systems
Backs: “ISO/IEC 42001:2023 (AI management systems) and ISO/IEC 23894:2023 (AI risk management) let organizations certify or demonstrate governance and risk controls for AI lifecycles. Regulators and customers increasingly ask for alignment.”
- OECD Legal Instruments
Backs: “OECD AI Principles (2019; updated 2024) underpin many national policies and international cooperation on “trustworthy AI.””