Auto Secure Login
AI Safeguards in Place Today: Laws, Standards and Labels
AI rules are no longer just principles. Some are binding law, some voluntary standards and some labels built into the images you see. Here is what exists now and what it means for your business.
Updated October 20, 2026
Five kinds of safeguard
- Risk-based laws that classify AI by potential harm, led by the EU AI Act.
- Transparency rules for chatbots, deepfakes and AI-generated media.
- Fraud and impersonation enforcement, including AI voice cloning.
- Voluntary standards such as the NIST AI Risk Management Framework and ISO/IEC 42001.
- Provenance labels such as C2PA Content Credentials.
The direction everywhere is from principles to proof: inventories, human review, records and disclosures you can show.
The EU AI Act and the 2026 Omnibus
The European Commission's AI Act page sets out the phases: bans on unacceptable practices and AI literacy duties from 2 February 2025, rules for general-purpose AI models from August 2025, and general application from 2 August 2026. The 2026 Digital Omnibus moved the high-risk obligations: systems used in areas such as employment, education and essential services now apply from 2 December 2027, and AI built into regulated products such as toys and lifts from 2 August 2028.
The delay is not a pause on everything. Transparency rules for chatbots and synthetic content still apply. A US business is affected if it offers AI-enabled services to people in the EU, or if its software vendors build EU features into tools sold everywhere.
United States: a patchwork that still bites
There is no single federal AI law. Existing law still applies to AI: consumer protection, civil rights, employment, privacy and communications rules.
- FCC: in 2024 it ruled that AI-generated voices in robocalls count as artificial voices under the Telephone Consumer Protection Act, so the same consent rules apply.
- FTC: deceptive AI claims, fake reviews and impersonation scams are enforced under existing law; its consumer reviews rule bans fake reviews, including AI-written ones.
- California: SB 53, signed September 29, 2025, requires the largest frontier AI developers to publish safety frameworks and report critical safety incidents.
- Colorado: two laws effective January 1, 2027 cover automated decisions about people and public-facing chatbots; see our Colorado AI laws guide.
Standards turn rules into daily practice
The NIST AI Risk Management Framework is free and voluntary, organized around four functions: govern, map, measure and manage. ISO/IEC 42001 is a certifiable AI management system standard. Most small businesses do not need certification, but the structure helps answer enterprise and government questionnaires: who owns AI risk, which uses exist, how outputs are tested and what happens when someone challenges a result.
Labels on AI content
C2PA Content Credentials attach signed records of how an image or video was made or edited, and some AI image tools add them automatically. Labels help, but metadata can be stripped and a missing label does not prove a picture is real. Our guide Is this image AI-made? explains how to check.
Safety testing by AI developers
Major AI developers now publish safety frameworks, run red-team tests before releases and, under laws like California's SB 53, must report certain critical incidents. That reduces some risks inside the model. It does not cover how your business uses the tool: what data you feed it, what it is allowed to do and who checks its output stays your responsibility.
What a small business should do now
- List every AI tool in use, including AI features inside existing software.
- Sort uses into low risk (brainstorming), moderate (customer-facing chat, marketing) and high (hiring, lending, housing, health, eligibility).
- Add human review and a way to challenge results for moderate and high-risk uses.
- Disclose chatbots, AI voices and synthetic media where people could be misled.
- Keep consent records for any voice or likeness you clone.
- Check vendor terms for data use, retention and incident notice.
- Name one owner and review the list every quarter.
Our AI acceptable use policy guide turns this into a staff policy.
Where ASL fits
Our products are built to show uncertainty, evidence and provenance, and to keep high-impact decisions with people; see our security and responsible automation page. Our AI consulting work starts with the inventory above, and our custom software development team builds disclosures, reviews and records into your tools. Contact us to talk it through.
Frequently asked questions
When do the EU AI Act high-risk rules apply?
After the 2026 Digital Omnibus, from 2 December 2027 for high-risk uses such as employment and education, and from 2 August 2028 for AI built into regulated products.
Is there a federal AI law in the United States?
No single one. Existing consumer protection, civil rights, privacy and communications laws apply to AI, plus state laws such as California's SB 53 and Colorado's 2027 laws.
Are AI voice robocalls legal?
The FCC ruled in 2024 that AI-generated voices are artificial voices under the TCPA, so the same consent requirements apply.
Do small businesses need ISO/IEC 42001 certification?
Usually not. The standard and the NIST AI RMF are useful structures for managing AI risk and answering customer questionnaires.
Do AI content labels prove an image is real or fake?
No. Content Credentials show recorded history when present, but metadata can be stripped and a missing label proves nothing on its own.
Related guides
- Colorado's New AI Laws: What Businesses Must Do by 2027
- AI Acceptable Use Policy for a Small Business: What to Include
- Is This Image AI-Made? Content Credentials and Watermarks
- Should You Tell Customers You Used AI?