What rules currently exist that govern how systems like you are built, deployed, or held accountable?

I will look up the major existing laws, regulations, and frameworks that apply to the development, deployment, and accountability of AI systems like large language models.I am gathering more precise details on the major frameworks, starting with the EU AI Act and key U.S. and Chinese measures.Rules governing AI systems like large language models (LLMs) and generative AI focus on risk-based approaches covering development (building/training), deployment/use, transparency, safety, and accountability/liability. They form a fragmented global patchwork: comprehensive binding laws in the EU and China, a U.S. mix of executive actions + growing state laws (no broad federal statute), voluntary frameworks, and cross-cutting laws (privacy, IP, product liability, consumer protection). Rules evolve quickly; this reflects the landscape as of late 2026.[1][2]

European Union: AI Act (Most Comprehensive Binding Framework)

The EU AI Act (Regulation 2024/1689, in force August 2024, with phased application and some Digital Omnibus amendments) uses a risk-based system applying extraterritorially to providers/deployers placing systems or outputs on the EU market.[3][4]

•Prohibited practices (unacceptable risk; applied earlier, e.g., from Feb 2025): Social scoring; certain manipulative/subliminal techniques or exploitation of vulnerabilities causing harm; untargeted facial image scraping for databases; emotion recognition in workplaces/education (limited exceptions); real-time remote biometric ID in public for law enforcement (narrow exceptions); biometric categorization inferring sensitive attributes; generation of non-consensual intimate imagery/CSAM.[3]

•High-risk AI systems (e.g., in biometrics, critical infrastructure, education, employment/hiring, essential services/credit/insurance, law enforcement, migration; or safety components of regulated products): Conformity assessments, risk management systems, data governance/quality, transparency/logging, human oversight, accuracy/robustness/cybersecurity, registration in an EU database, and post-market monitoring. Providers bear primary duties; deployers have lighter ones (e.g., human oversight, monitoring). Timelines extended in places (e.g., many high-risk rules toward late 2026–2028 for standards readiness).[3][4]

•Limited/transparency risk (e.g., chatbots, deepfakes/emotion recognition/biometric categorization where not high-risk/prohibited): Disclose AI interaction or synthetic nature of content (Article 50 rules phasing in, e.g., from 2026).[1]

•Minimal risk: Mostly unregulated beyond existing law.

•General-purpose AI (GPAI) models (foundation models/LLMs showing significant generality; indicative ~10^23 FLOPs + generative capabilities): All providers must maintain technical documentation (training/testing/evaluation; Annex XI), provide info to downstream system providers (Annex XII), implement a copyright compliance policy (respecting text/data mining reservations), and publish a training content summary (Commission template). Open-source exemptions exist for some documentation (unless systemic risk). Providers outside the EU need an authorized representative.[4][5][6]

•Systemic risk GPAI (presumed if training compute >10^25 FLOPs, or Commission designation based on capabilities/impact): Additional duties—state-of-the-art evaluations (including adversarial/red-teaming), systemic risk assessment/mitigation, serious incident tracking/reporting, and cybersecurity for the model/infrastructure. Notify the AI Office. A Code of Practice supports compliance. Obligations largely applied from August 2025 (with transitions for earlier models).[4][3]

•Governance/enforcement: National market surveillance authorities + EU AI Office (for GPAI). Fines up to €35 million or 7% of global annual turnover (prohibited practices); lower tiers for others. Supports innovation via sandboxes.[1]

•Related: Updated Product Liability Directive (covers software/AI, facilitating claims); General Product Safety Regulation; GDPR (data for training/use).

China: Sectoral and Generative AI-Focused Rules

China has binding rules emphasizing content control, security, and data legality, primarily for public-facing services in mainland China (R&D/internal use often exempt). A comprehensive AI law remains in draft stages.[7]

•Interim Measures for the Management of Generative AI Services (effective August 2023): Providers must use lawfully sourced training data/foundation models (respect IP; consent or other lawful basis for personal info under PIPL; improve data quality/diversity/authenticity); prevent discrimination; moderate prohibited content (national security, disinformation, violence, porn, etc.—align with socialist core values); label AI-generated content; real-name user registration; retain input/output logs (≥6 months); sign clear user agreements disclosing limitations; establish complaint channels; protect user rights/privacy. Services with “public opinion attributes or social mobilization capacity” require security assessments and algorithm filings with the CAC.[8][9]

•AI-Generated/Synthetic Content Labelling Measures (effective September 2025) + national standard: Explicit (visible/audible) labels retained on export/download + implicit metadata/watermarks. Platforms must detect/preserve/add labels. Active enforcement ongoing.[10]

•Other: Cybersecurity Law amendments (AI provisions); data security/PIPL; draft export controls on advanced models (e.g., high compute/parameters/capability thresholds requiring licenses or prohibitions); sector rules (e.g., finance). Courts have guidance on AI disputes (IP, torts).[10][7]

United States: Fragmented Federal + State Approach

No comprehensive federal AI statute. Existing laws (civil rights, FTC unfair/deceptive practices, sector rules) apply. Federal policy relies on executive orders (which can shift with administrations), agency guidance, and procurement. States lead on binding private-sector rules; federal efforts include challenging “onerous” state laws via litigation task forces and funding levers (preemption requires Congress or courts).[2][11][12]

•Federal: Biden EO 14110 (2023; safety testing/reporting for powerful models, standards development—largely revoked/replaced). Later EOs emphasize innovation, U.S. competitiveness, removing barriers, federal AI use/governance, and addressing state laws (e.g., EO 14365 creating a DOJ AI Litigation Task Force). NIST AI Risk Management Framework (AI RMF, 2023 + Generative AI Profile): Voluntary; core functions Govern/Map/Measure/Manage; trustworthiness characteristics (valid/reliable, safe, secure/resilient, accountable/transparent, explainable, privacy-enhanced, fair). Influences practice and sometimes serves as a defense or reference. Agency-specific rules, export controls on chips/tech, and proposed (unenacted comprehensive) bills on transparency/high-impact systems. Federal AI use has inventories, risk management, and procurement conditions.[13][14][15]

•Key state laws (examples; many more on deepfakes, elections, CSAM, disclosures):

•Colorado AI Act (and reenactments): Duties for developers/deployers of high-risk automated decision systems (consequential decisions on employment, housing, credit, etc.)—reasonable care against algorithmic discrimination, impact assessments, transparency/notices, explanations, human review options.[2]

•California: SB 53 (Transparency in Frontier AI Act, effective 2026)—large frontier developers (high revenue/compute thresholds) must publish safety frameworks (catastrophic risk, standards alignment, assessments), report critical safety incidents, protect whistleblowers. SB 942 (AI Transparency)—detection tools/watermarks/metadata for generative AI (large providers). AB 2013—training data disclosures. Others on deepfakes/elections, healthcare, government use, voice/likeness.[16][17]

•New York RAISE Act and Illinois similar frontier safety/transparency/incident reporting/audits (effective ~2027). NYC Local Law 144: Bias audits for automated employment decision tools. Texas TRAIGA: Prohibited uses, disclosures for government/health. Utah and others: Consumer disclosures for AI interactions.[16][18]

•Many states regulate deepfakes (elections, intimate images), AI in hiring/insurance, and child protections.

Other Jurisdictions and International Efforts

•UK: Pro-innovation, principles-based (safety, transparency, fairness, accountability, contestability) applied by existing sector regulators; AI Safety Institute for testing. No comprehensive statute expected soon.[1]

•South Korea: AI Basic Act with high-performance thresholds and duties.

•G7 Hiroshima AI Process (2023 Guiding Principles + Code of Conduct): Voluntary for advanced/foundation/generative AI organizations—lifecycle risk ID/evaluation/mitigation (pre- and post-deployment testing, traceability); vulnerability/incident/misuse monitoring; public transparency reports on capabilities/limitations/use; information sharing; governance/risk policies (privacy); robust security (cyber/physical/insider); content authentication/provenance (e.g., watermarking); research on mitigations; prioritize beneficial applications; advance standards. Applies risk-proportionately across actors.[19][20]

•OECD AI Principles, Council of Europe efforts, ISO/IEC 42001 (AI management systems), and bilateral/multilateral cooperation.

Cross-Cutting Rules Affecting Building, Deployment, and Accountability

•Building/training: Data legality/provenance (privacy laws like GDPR/PIPL/CCPA; IP/copyright—fair use litigation ongoing, EU AI Act mandates compliance policies); bias/fairness testing; safety/red-teaming (especially frontier/systemic); documentation and quality controls.

•Deployment: Content labeling/disclosures (AI-generated or chatbot interactions—common hard rule); prohibited or restricted uses; human oversight for high-risk; age-gating/minors protections; terms of service.

•Accountability: Incident reporting; audits/evaluations (independent in some cases); transparency reports; governance structures/policies; whistleblower protections; liability (tort, product liability expanding to AI defects/outputs; strict liability elements in EU); fines/enforcement by regulators; market surveillance. Existing consumer protection, discrimination, and defamation laws apply to harms.

•Industry practices (self-regulation, safety institutes, red-teaming) and company policies often go beyond minimums. Export controls affect chips, advanced models, and tools.

In practice, providers of systems like Grok must navigate jurisdiction of users/markets (extraterritorial reach is common), classify systems by risk/use, maintain documentation/evaluations, ensure data compliance, label where required, and monitor for incidents. Accountability often flows through providers (developers) more than pure users, with deployers sharing duties for high-risk applications. Rules prioritize safety, fundamental rights, transparency, and innovation while addressing catastrophic/systemic risks for the most powerful models. For the latest or jurisdiction-specific advice, consult primary texts or legal experts, as implementation guidance, standards, and court interpretations continue to develop.

Citations (20)

1nhimg.orgNonprofits and think tanks
https://nhimg.org/global-ai-regulation-map
Backs: “They form a fragmented global patchwork: comprehensive binding laws in the EU and China, a U.S.”
2jdsupra.comNews and media
https://www.jdsupra.com/legalnews/ai-watch-global-regulatory-tracker-2931403/
Backs: “They form a fragmented global patchwork: comprehensive binding laws in the EU and China, a U.S. mix of executive actions + growing state laws (no broad federal statute), voluntary frameworks, and cross-cutting laws (privacy, IP, product liability, consumer protection).”
3artificialintelligenceact.euNonprofits and think tanks
https://artificialintelligenceact.eu/high-level-summary/
Backs: “European Union: AI Act (Most Comprehensive Binding Framework). The EU AI Act”
4europa.euGovernment
https://digital-strategy.ec.europa.eu/en/faqs/navigating-ai-act
Backs: “The EU AI Act (Regulation 2024/1689, in force August 2024, with phased application and some Digital Omnibus amendments) uses a risk-based system applying extraterritorially to providers/deployers placing systems or outputs on the EU market.”
5modulos.aiCompanies
https://docs.modulos.ai/frameworks/eu-ai-act/general-purpose-ai-models
Backs: “text/data mining reservations), and publish a training content summary (Commission template).”
6sysart.consultingNot yet classified
https://sysart.consulting/eu-ai-act/gpai-obligations/
Backs: “(Commission template). Open-source exemptions exist for some documentation (unless systemic risk).”
7deep-lex.comLow provenance
https://www.deep-lex.com/ai-regulation-tracker/china
Backs: “Related: Updated Product Liability Directive (covers software/AI, facilitating claims); General Product Safety Regulation; GDPR (data for training/use). China: Sectoral and Generative AI-Focused Rules”
8aigovernance.comLow provenance
https://aigovernance.com/entry/china-generative-ai-regulations-interim-measures
Backs: “registration; retain input/output logs (≥6 months); sign clear user agreements disclosing limitations; establish complaint channels; protect user rights/privacy.”
9lawinfochina.comData and tools
https://www.lawinfochina.com/display.aspx?id=41563&lib=law
Backs: “limitations; establish complaint channels; protect user rights/privacy.”
10china-briefing.comCompanies
https://www.china-briefing.com/news/china-ai-regulations-2026-enforcement-guidance-compliance/
Backs: “Services with “public opinion attributes or social mobilization capacity” require security assessments and algorithm filings with the CAC. AI-Generated/Synthetic Content Labelling Measures (effective September 2025) + national standard: Explicit (visible/audible) labels retained on export/download + implicit…”
11noblerworks.comNot yet classified
https://ai.noblerworks.com/explainers/policy/us-ai-policy/
Backs: “Federal policy relies on executive orders (which can shift with administrations), agency guidance, and procurement. States lead on binding private-sector rules; federal”
12reuters.comNews and mediaquality 1.00
https://www.reuters.com/legal/legalindustry/who-governs-ai-federal-governments-challenge-state-regulation-what-organizations--pracin-2026-08-12/
Backs: “States lead on binding private-sector rules; federal efforts include challenging “onerous” state laws via litigation task forces and funding levers (preemption requires Congress or courts).”
13convergenceanalysis.orgNonprofits and think tanks
https://www.convergenceanalysis.org/ai-regulatory-landscape-bluedot/the-2024-us-regulatory-landscape
Backs: “NIST AI Risk Management Framework (AI RMF, 2023 + Generative AI Profile): Voluntary; core functions Govern/Map/Measure/Manage; trustworthiness characteristics (valid/reliable, safe, secure/resilient, accountable/transparent, explainable, privacy-enhanced, fair). Influences practice and sometimes serves as a defense or…”
14nist.govGovernment
https://www.nist.gov/itl/ai-risk-management-framework
Backs: “Agency-specific rules, export controls on chips/tech, and proposed (unenacted comprehensive) bills on transparency/high-impact systems.”
15verifywise.aiCompanies
https://verifywise.ai/blog/state-of-ai-governance-regulations-united-states-2026
Backs: “Agency-specific rules, export controls on chips/tech, and proposed (unenacted comprehensive) bills on transparency/high-impact systems. Federal AI use has inventories, risk management, and procurement conditions.”
16aei.orgNonprofits and think tanks
https://www.aei.org/research-products/report/regulating-the-frontier-how-california-new-york-and-illinois-are-governing-the-most-powerful-ai-models/
Backs: “California: SB 53 (Transparency in Frontier AI Act, effective 2026)—large frontier developers (high revenue/compute thresholds) must publish safety frameworks (catastrophic risk, standards alignment, assessments), report critical safety incidents, protect whistleblowers. SB 942 (AI Transparency)—detection…”
17globalpolicywatch.comCompanies
https://www.globalpolicywatch.com/2024/11/u-s-tech-legislative-regulatory-litigation-update-third-quarter-2024/
Backs: “SB 942 (AI Transparency)—detection tools/watermarks/metadata for generative AI (large providers). AB 2013—training data disclosures. Others on deepfakes/elections, healthcare, government use, voice/likeness.”
18legal500.comCommercial content
https://www.legal500.com/intelligence/united-states/corporate-commercial-law/the-big-long-list-of-us-ai-laws
Backs: “NYC Local Law 144: Bias audits for automated employment decision tools. Texas TRAIGA: Prohibited uses, disclosures for government/health. Utah and others: Consumer disclosures for AI interactions.”
19whitecase.comCompanies
https://www.whitecase.com/insight-our-thinking/ai-watch-global-regulatory-tracker-g7
Backs: “G7 Hiroshima AI Process (2023 Guiding Principles + Code of Conduct): Voluntary for advanced/foundation/generative AI organizations—lifecycle risk ID/evaluation/mitigation (pre- and post-deployment testing, traceability); vulnerability/incident/misuse monitoring; public transparency reports on…”
20g7g20-documents.orgAcademic
https://g7g20-documents.org/database/document/2023-g7-japan-leaders-leaders-annex-hiroshima-process-international-guiding-principles-for-organizations-developing-advanced-ai-system
Backs: “(cyber/physical/insider); content authentication/provenance (e.g., watermarking); research on mitigations; prioritize beneficial applications; advance standards. Applies risk-proportionately across actors.”