Artificial-intelligence law, rules and accountability
AI Regulations and Oversight
Artificial-intelligence governance is developing through federal policy, existing agency authority, state legislation, international regulation, technical standards and company rules. This tracker separates binding law from proposed measures and voluntary frameworks, then identifies what each development changes about how AI may be built, offered and used.
Project, Research, Analysis, Editorial by Patrick Russell; assisted by ChatGPT (OpenAI).
Federal policy development · Updated September 29, 2026
A signed voluntary accord defines four layers of frontier-system oversight
President Donald Trump’s verified account posted the signed “White House Accord on Super Intelligence” after the September 29 luncheon. President Trump and leaders of Google, Anthropic, Meta, OpenAI, xAI and Nvidia committed to operational controls during model training and deployment, an empowered internal monitoring team, independent assessment by an outside auditor or evaluator, independent board-committee oversight and recurring meetings to establish standards and best practices. The accord expressly anticipates that later legal or regulatory codification may make sense, but the present document is voluntary.
President’s stated position
Presidential policy and communications position. President Trump called the accord morally binding, likened it to a constitution and emphasized company self-policing rather than broad restrictions. He continues to frame rapid American development as strategically necessary while saying the participating firms understand their obligation to police themselves.
Established authority and facts
The accord and its signatures are public, but it is not a statute, regulation or executive order. The separate America.gov order creates executive-branch service requirements. A second September 29 executive order directs federal use of “Super Intelligence” and “SI,” retains the current statutory AI definition for implementation and requires proposed legislative language within 60 days.
Claims and disputed matters
The signatories state that the four control layers are critical to safety and commit their companies to implementation. The document does not itself demonstrate that controls are operating or prescribe common tests, deadlines or disclosures. Whether company-selected evaluators and voluntary board oversight are sufficiently independent remains disputed, as does whether Congress should mandate testing, incident reporting or regulator access.
Inference and what remains unproved
The accord creates a clearer responsibility chain than the earlier meeting announcement, but its effectiveness depends on implementation evidence. No public text establishes sanctions, legal liability, government inspection rights, breach remedies, mandatory public reports or consequences for failed audits. A proposed oversight committee, SI Czar and SI Force remain unconfirmed as completed institutions.
Current determination: The accord is a material but nonbinding oversight framework. It is stronger evidence than a meeting announcement because it names controls, signatories and a continuing coordination process. It should now be evaluated through published implementation evidence: company policies, evaluator independence, audit scope and findings, board reporting, incident disclosure, corrective action and any later codification. America.gov remains the separate federal deployment test.
Signed White House Accord · Super Intelligence terminology order · White House terminology fact sheet · Reuters accord report · CBS News remarks and context · America.gov executive order
Election influence and protective action · October 4 evidence connection
Historical September 2024 enforcement record reviewed October 4, 2026.
Treasury’s coordinated sanctions response supplies an enforcement example for oversight. Evaluation should distinguish authority and sanctions from measured deterrence, durable disruption or voter protection.
Original federal record · September 4, 2024 · Full evidence record in Election Integrity.
Research implication: Compare sanctions, platform controls and provenance safeguards against documented recurrence and implementation.
Defense, space and AI: evidence update · October 4–6, 2026
Targeted public-record review · October 4–6, 2026. Earlier chapters retain their original evidence dates.
Defense AI security guidance is distinct from binding law
NSA and allied partners’ April 30 agentic-AI guidance connects oversight to permissions, configuration, human control and accountability. It does not itself create a statute or demonstrate compliance by TITAN, NGC2, Ship OS or another named system.
Oversight implication: distinguish generally published advice from a program’s enforceable contract requirements, approval conditions and documented evaluations. Require program-specific evidence before stating that a system meets the guidance. Original NSA publication.
A continuing tracker of artificial-intelligence legislation, regulation, enforcement, industry standards and rules governing use
What this page tracks
This page is about the governance of artificial intelligence itself. It tracks rules that affect how AI systems are developed, tested, marketed, deployed and used. Education appears only when an AI rule specifically applies to students, schools, assessment, children’s data or educational decisions. The broader subject is the legal and institutional control of AI across society.
The tracker distinguishes enacted law, rules already in force, enacted measures with future effective dates, active rulemaking, pending legislation, enforcement under existing law, voluntary government frameworks, international standards and private company policies. These categories are not interchangeable. A proposal is not law, a voluntary standard is not a regulation and a company policy can be changed by the company unless incorporated into a contract or legal obligation.
Principal finding
There is no single United States rulebook governing all artificial-intelligence use. Oversight is forming through a layered system: existing consumer-protection and civil-rights law, federal policy, sector regulators, rapidly changing state statutes, contractual controls, technical standards and international laws that can affect American companies. The practical obligation depends on the system, use, location, affected person, data, decision and risk level.
Current AI governance tracker
This table tracks the principal laws, policies, standards and governing authorities affecting artificial intelligence, distinguishing their current status from their practical effect.
Evidence tableView 9 recordsHide 9 records
Jurisdiction or authority | Rule or framework | Status and effect on AI use |
|---|---|---|
United States — Federal Trade Commission | Federal Trade Commission Act and AI enforcement | Existing law applies now. Deceptive claims, unfair practices, false performance representations, misuse of consumer data and unsafe marketing do not become lawful because AI is involved. In 2026 the commission also proposed an AI-accuracy policy statement; a proposal must be tracked separately from binding law. |
United States — civil-rights and sector regulators | Existing employment, disability, credit, health, privacy, safety and discrimination law | Binding law applies according to sector and use. An AI hiring tool, credit model, medical system or government decision process remains subject to the laws governing the underlying decision. AI does not create an exemption. |
California | Transparency in Frontier Artificial Intelligence Act — Senate Bill 53 | Enacted in 2025. Covered frontier developers must disclose safety frameworks, report specified critical safety incidents and comply with whistleblower protections. The law focuses on developers of powerful models rather than ordinary end users. |
California | Senate Bill 813 and Assembly Bill 1405 | Signed September 9, 2026. Senate Bill 813 creates a framework for independent verification organizations assessing AI systems for compliance with state law. Assembly Bill 1405 creates a registry for AI auditors and standards for their independence, transparency and integrity. |
California | Companion chatbots and child safety | California has enacted and strengthened AI companion-chatbot protections, including warnings, crisis protocols, parental controls, child-safety audits and risk assessments. Applicability depends on the product, user age and statutory definition. |
Colorado | Automated Decision-Making Technology Act and Chatbot Safety Act | New requirements take effect January 1, 2027. Developers and deployers face duties involving automated systems that materially influence consequential decisions; consumers receive rights involving inaccurate personal data. Proposed implementing rules remained in active rulemaking as of September 14, 2026. |
European Union | Artificial Intelligence Act | Binding risk-based regulation. Prohibited-practice and AI-literacy duties began in 2025; general-purpose AI duties began in 2025; enforcement and transparency obligations expanded in 2026. High-risk system requirements have later staged dates. The Act can affect non-European providers and deployers when its territorial rules are met. |
National Institute of Standards and Technology | AI Risk Management Framework and Generative AI Profile | Voluntary United States frameworks organized around governing, mapping, measuring and managing AI risk. They can guide procurement, testing and internal controls but do not become law merely through adoption. |
International Organization for Standardization | ISO/IEC 42001, 42005 and 42006 | Voluntary standards covering AI management systems, AI impact assessments and competence requirements for organizations that audit and certify AI management systems. Certification can support governance and contracting but is not proof that a particular AI output is accurate, safe or lawful. |
United States federal direction
Federal AI policy currently combines presidential direction, agency use requirements, procurement policy, research and standards programs, national-security controls and enforcement of existing laws. Proposed national AI legislation should be tracked by bill number, sponsor, chamber, committee status, latest action and operative text. White House priorities and agency guidance can direct the executive branch, but they should not be labeled enacted legislation unless Congress passes and the President signs a bill.
What federal oversight changes in practice
- Marketing claims: companies must be able to substantiate claims about accuracy, safety, detection, earnings, capability and human equivalence.
- Consequential decisions: employers, lenders, health providers, schools and government agencies retain responsibility when AI materially influences a decision.
- Data and privacy: legal duties depend on the data, person, sector, relationship and jurisdiction; a vendor’s privacy statement does not replace the user organization’s obligations.
- Government use: agencies must follow applicable authorization, procurement, civil-rights, records, security and human-review requirements when deploying AI.
States as the active legislative laboratory
State law is currently producing many of the most concrete controls on AI use. The major categories include automated consequential decisions, frontier-model safety, independent audits, training-data transparency, synthetic-content labeling, election deepfakes, digital replicas and likeness, companion chatbots, child safety, employment tools, health decisions, government procurement and disclosure when a person is interacting with AI.
A useful state tracker must preserve effective dates and amendments. Colorado’s original 2024 AI law was later revised and its requirements now take effect in 2027. California added major frontier-model, auditor and child-chatbot provisions across successive legislative sessions. A static list of bill titles will quickly become misleading unless later enactments, delays, repeals, regulations and court decisions are attached to the original record.
International rules that affect AI use
The European Union Artificial Intelligence Act is the most developed cross-sector legal regime in the reviewed record. It classifies uses by risk, prohibits specified practices, regulates general-purpose models, imposes transparency duties and creates stronger obligations for high-risk systems. Providers and organizations outside Europe may still be affected when they place systems in the European market or otherwise meet the Act’s territorial rules.
From August 2, 2026, European authorities began enforcing additional provisions, including transparency requirements involving generated or manipulated content. Requirements for specified high-risk systems are staged later, including December 2, 2027 for listed sensitive uses and August 2, 2028 for AI embedded in certain regulated products. Each date should be verified against the operative law and later amendments before a compliance conclusion is made.
Industry rules and voluntary standards
Industry governance has three distinct layers. Technical and management standards define repeatable practices. Trade or multi-company commitments state shared expectations. Individual providers impose acceptable-use, safety, privacy and account rules through their own services. These mechanisms can influence conduct faster than legislation, but their authority and durability are different from law.
Evidence tableView 4 recordsHide 4 records
Control type | What it can do | What it cannot prove |
|---|---|---|
NIST framework | Organize governance, risk mapping, measurement and management | Voluntary use does not establish legal compliance or successful implementation |
ISO management and impact standards | Create auditable organizational processes, impact assessment and certification structures | Certification does not validate every model, output, deployment or legal conclusion |
Provider policies | Restrict prohibited uses, define account permissions, disclose data practices and enable enforcement within a service | A private policy may change and does not displace the customer’s independent legal duties |
Contracts and procurement rules | Convert selected controls into enforceable duties between identified parties | Contract compliance does not necessarily establish public benefit, safety or independent human capability |
Rules by type of AI use
- General-purpose models: training transparency, copyright, systemic-risk assessment, incident reporting, security and downstream information duties.
- Automated decisions: notice, impact assessment, discrimination testing, data correction, explanation, appeal and human review.
- Generated content: disclosure, provenance, watermarking, impersonation, digital likeness, election communications and nonconsensual intimate imagery.
- Companion and conversational systems: disclosure that the user is interacting with AI, crisis response, minors, parental controls, safety testing and restrictions on manipulative conduct.
- Education: student-data protection, age and consent, approved tools, academic integrity, protected human assessment and human responsibility for consequential decisions.
- Employment, credit, health and government: existing sector law plus emerging AI-specific requirements for testing, documentation, notice, review and accountability.
Oversight test
- Identify the system, model, provider, deployer, user and affected person.
- Classify the use: assistance, generation, recommendation, prediction, surveillance or consequential decision.
- Determine jurisdiction, sector, affected population, data category and effective date.
- Separate binding legal duties from proposals, guidance, standards, certifications, contracts and provider rules.
- Record who tests the system, who receives reports, who can investigate and what remedy or penalty exists.
- Document the intended use and stated limits of the complete application, including the promises and limits of any underlying model or component.
- Compare testing before use with monitoring and incident review after deployment; record who owns each task and how an affected person can seek correction.
- Track amendments, litigation, delayed dates, implementing rules and evidence of actual enforcement.
Research proposal, not binding law
Daniel Huttenlocher, Asu Ozdaglar and David Goldston propose applying existing sector rules first and clarifying responsibilities across AI components, providers and deployers. This 2023 policy brief supplies questions for the oversight test; current legal obligations must be established from the operative law, contracts and enforcement record.
MIT — A Framework for U.S. AI Governance (2023 policy proposal).
Connection to the well-formed mind investigation
The legal tracker does not assume that regulation is automatically wise or sufficient. It asks what conduct is controlled, what human authority remains, whether people know when AI is acting, whether a consequential decision can be challenged and whether responsibility can be traced to an accountable person or institution. These are the points at which AI regulation intersects with judgment, authorship, autonomy and the formation of a human mind.
Official sources
Federal Trade Commission artificial-intelligence enforcement and policy record.
National Institute of Standards and Technology — Artificial Intelligence Risk Management Framework.
California Governor — Senate Bill 53, Senate Bill 813, Assembly Bill 1405 and related AI safeguards.
California Governor — companion chatbot, child-safety and student-data legislation.
Colorado Attorney General — Automated Decision-Making Technology and Chatbot Safety rulemaking.
European Commission — Artificial Intelligence Act regulatory framework and application timeline.
European Commission — General-Purpose Artificial Intelligence Code of Practice.
Tracker status
Current through September 14, 2026. This is a public-source policy tracker, not legal advice. Each entry remains subject to amendments, implementing rules, litigation, preemption, delayed effective dates and jurisdiction-specific interpretation.