Provider rules, national law, EU law and human rights: who sets the rules for AI

One test for every rule

Every text that governs AI can be placed with three questions: Who sets it? Whom does it bind? Who enforces it? The answers sort the texts into layers. The order below describes how the layers relate in the EU, the USA, Canada and China as of October 12, 2026. It does not say which rules should apply, and it ranks no provider above another.

Human rights bind states

The Universal Declaration of Human Rights of 1948 is a resolution, not a treaty [1]. The International Covenant on Civil and Political Rights binds its states parties — among them the USA, Canada and every EU member state; China signed in 1998 and has not ratified [2]. The Council of Europe Framework Convention on AI (CETS No. 225), opened for signature on September 5, 2024, is the first treaty on AI and human rights [3]. The EU, the USA and Canada have signed it; the EU ratified it on May 15, 2026 [4] [5]. It enters into force after five ratifications, including three Council of Europe member states. All of these texts oblige states. A provider is bound by them only through the law a state makes to give them effect.

Constitutions bind public power

A constitution sets up and limits the power of a state. The EU has no constitution: it has the treaties and the Charter of Fundamental Rights, which binds the EU bodies and the member states when they implement Union law [6] [7]. Each member state keeps its constitution; Germany's Basic Law binds legislature, executive and courts to the basic rights and protects human dignity from amendment [10]. The US Constitution binds government, and private providers only where they act as the state [13] [14]. Whether chatbot output is speech protected by the First Amendment is open; in May 2025 a federal court declined to treat it as such at the pleading stage, and the case was settled [15]. The Canadian Charter of Rights and Freedoms applies to Parliament, the legislatures and governments [19]. The Constitution of the People's Republic of China states that the state respects and preserves human rights; its interpretation lies with the Standing Committee of the National People's Congress [22]. None of the four contains a provision on AI.

EU law applies in every member state

The AI Act — Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744 — is a regulation: it applies directly in all 27 member states, without transposition, and assigns its obligations to providers, deployers and other operators [11]. By the primacy of EU law, it prevails over conflicting national law [8]. National constitutional courts accept this on the basis of their own constitutions and reserve a review of constitutional identity; the German Federal Constitutional Court did so in its Lisbon judgment [9]. The AI Act serves the protection of the Charter's rights, for example through the fundamental rights impact assessment of certain deployers. It does not replace a constitution and creates no constitutional order of its own.

Laws and regulations in the USA, Canada and China

• USA: There is no federal AI statute. Federal policy is set by executive order; Executive Order 14365 calls for a national framework that preempts conflicting state laws [16]. State laws such as California SB 53 bind within their state [17]. A bill is not a law.
• Canada: No federal AI statute is in force. The Artificial Intelligence and Data Act died on the order paper in January 2025; Bill C-36 on privacy and consumer data is at second reading [20]. Federal institutions follow the Directive on Automated Decision-Making.
• China: AI is governed by regulations of the Cyberspace Administration of China and other agencies, such as the interim measures for generative AI services and the labeling measures [23] [24]. They bind providers offering services in China.

Co-regulation: recognized, not enacted

Co-regulation sits between law and company rules. Its instruments are voluntary, but the law defines their effect. Under the AI Act, the GPAI Code of Practice lets providers of general-purpose AI models demonstrate compliance, and cited harmonized standards give a presumption of conformity [12]. The NIST AI RMF in the USA and the Canadian voluntary code take effect only where a law, a contract or a procurement rule refers to them [18] [21].

Provider rules: model specifications and usage policies

Providers place two kinds of rules between the law and the people using their models:

• A model specification describes how the provider intends its models to behave — Anthropic's constitution for Claude, OpenAI's Model Spec, Microsoft AI's draft code of conduct for its models [25] [27] [30]. It addresses the model and the provider's teams and takes effect through training, evaluation and product decisions. Anthropic explains that it does not mean “constitution” as a rigid legal document [25].
• A usage policy says what users may do — Anthropic, OpenAI, Google, Mistral AI and DeepSeek publish them, as policies or as part of their terms [26] [28] [29] [31] [32]. It binds users by contract, within consumer, unfair-terms and platform law, and is enforced by the provider, for example by closing an account. Which law governs it differs; DeepSeek's terms, for instance, are governed by the law of the People's Republic of China [32].

Provider rules can be stricter than the law. They cannot set aside a statutory right or duty, and following them shows nothing about whether the law is met.

Ethics frameworks and soft law

Ethics frameworks of international organizations, public bodies and institutions form a layer of their own. They bind no one; they act through interpretation, self-commitment and later legislation. Cite them as the position of the body that issued them, with its date, not as a legal source.

Which layer answers which question

The context card four questions about AI consciousness separates the empirical, design, safety and moral-legal questions. The layers answer them differently:

Question	Where it is answered today
Empirical: could a system have experiences?	On no legal layer. Research works on it; a statute that declares a status presupposes an answer.
Design: should a system express feelings or motives?	Mainly in provider rules, limited by laws on disclosure, marking and the protection of children.
Safety: oversight, goals, interruption	In laws and regulations, co-regulation and provider rules.
Moral-legal: welfare, rights, legal standing	In constitutions and human rights (dignity and rights of human beings) and in ordinary law (legal personhood). Claims in provider rules and ethics frameworks have no legal force.

What does not change

• Naming a law, a treaty or a provider rule never shows conformity. Each obligation has to be checked against its source, its scope and its date.
• Bills, drafts and consultations are not law, and a signed treaty binds only once it is ratified and in force.
• The order describes rank and addressees. It does not decide political questions, and it is no legal advice.