AI Laws, Regulation and Frameworks for Responsible Governance
Distinguish binding from voluntary
Questions frequently test whether an instrument is hard law, a standard, or a framework. Binding: EU AI Act, GDPR, China's Interim Measures for Generative AI Services (2023), algorithm recommendation and deep synthesis rules, Colorado's AI Act (reasonable care and impact assessments for high-risk systems, with a delayed effective date), and sectoral US laws such as ECOA, FCRA, Fair Housing Act and HIPAA. Voluntary or standards-based: OECD AI Principles, UNESCO Recommendation on the Ethics of AI (2021), the Council of Europe Framework Convention on AI (2024), NIST AI RMF (Govern, Map, Measure, Manage) with its Generative AI Profile, ISO/IEC 42001 (certifiable AI management system) and ISO/IEC 23894 (AI risk guidance).
The EU AI Act's risk pyramid
Prohibited practices (e.g., social scoring, certain manipulation and biometric categorisation) sit at the top; then high-risk systems (conformity assessment, risk management, data governance, logging, human oversight, accuracy and cybersecurity duties); then limited-risk systems subject to transparency obligations (chatbots, deepfake disclosure); then minimal risk. General-purpose AI models carry separate transparency and, for systemic-risk models, evaluation and incident-reporting duties. Application is staged, and the Act has extraterritorial reach where outputs are used in the EU.
Traps to avoid
Assuming GDPR Article 22 bans automated decisions - it does not; it conditions solely automated decisions with legal or similarly significant effects on exceptions and safeguards. Conflating the AI Act's 'high-risk' with GDPR 'high-risk processing'. Assuming NIST AI RMF is mandatory. Believing frameworks and laws are interchangeable.
Rule of thumb
Ask three questions in order: Is it binding here? What risk tier or legal basis applies? What documentation and oversight does the instrument demand?