Rules, Uncertainty and Responsible Decisions: Finding What Applies to You

Eventually every AI decision meets two hard facts. The first is that the rules differ from one country, sector and year to the next, and they are changing quickly. The second is that you must often decide before you know enough. This page does not hand you a verdict on either. It gives you a method: weigh the benefits of innovation against possible harm, find the rules that really apply to you from official sources, tell an ethical concern from a confirmed legal duty, know when to call an expert, decide in proportion to the risk, and explain your decision to someone who disagrees with it.

It builds on Frameworks, Standards and Competing Principles: Ethics, Law and Policy, where you first separated principles, standards, laws and policies, and on the eight-step pattern from Everyday AI Ethics: Who Benefits and Who Could Be Harmed. Nothing here is legal advice. Where a law is mentioned, it sits in a dated legal note taken from sources we checked on 2026-10-12.

What you will learn

• How to weigh the benefits of an innovation against its possible social harms, and what the two main arguments about oversight say.
• Why regulation differs by country, and a step-by-step method to find the current official rules for your country and sector.
• How to tell an ethical concern from a confirmed legal obligation, and when to ask for expert or legal advice.
• How to make a proportionate decision when evidence is incomplete, and how to explain it to someone who disagrees.
• How to write a personal and workplace AI-use commitment, and what to prepare for the Practice Lab.

Innovation benefits and possible social harms

Innovation can bring real gains: faster services, wider access, new tools for people who were left out. It can also bring harms that appear later or fall on people who never chose the tool. Neither side cancels the other. The useful question is how the gains and the harms are shared, and whether the harms can be undone.

A pilot, a limit on who or what the tool is used for, a human check, and a review date are common ways to keep benefits while limiting harm. You do not have to choose between "ban" and "launch".

Public oversight and self-regulation

Public oversight means rules and checks set by governments or other public bodies. Self-regulation means that industry, a profession or a company sets and enforces its own standards. Most real systems mix the two. The arguments below are the strongest on each side; reasonable people weigh them differently.

Most people agree that harmful uses need a response and that rules should be clear. They differ on who sets them, how detailed they are and how fast they change. The two are not exclusive: voluntary codes often sit beside binding law. This page takes no side. Your task is to state which argument you find more convincing for a given case, and why.

Regulatory approaches differ by jurisdiction

A jurisdiction is an area with its own legal authority: a country, a state or a city. There is no single global AI law. Approaches range from a binding, risk-based law to voluntary guidance combined with existing laws. Here is a sample, with the confidence we have in each.

Legal note (as of 2026-10-12; not legal advice): The European Union has a binding regulation on AI, Regulation (EU) 2024/1689 (the "AI Act"). The European Commission describes four risk levels: unacceptable (banned), high risk, transparency risk, and minimal or no risk. Its obligations start in stages. According to the Commission's AI Service Desk timeline, which takes into account the amendments of the "digital omnibus", prohibitions applied from 2025-02-02, most rules including the transparency rules apply from 2026-08-02, and rules for high-risk systems are scheduled for 2027-12-02 and 2028-08-02 depending on the kind of system. The Commission's own pages are not fully in step: one FAQ page still describes the amendments as a proposal. In the United States we found no single comprehensive federal AI statute; according to law-firm summaries, states have passed their own laws, and the balance between federal and state rules is contested. The Colorado General Assembly's website shows that SB26-189, on automated decision-making technology, became law in 2026, with some duties starting later; search and law-firm summaries report that it replaced Colorado's broad 2024 AI law, which did not take effect, and that it is narrower. New York City has a local law on automated employment decision tools that requires a bias audit, public audit information and notices. OECD, UNESCO and NIST publish voluntary principles and frameworks, not binding law. Check the current official text for your country and sector.

Other approaches are reported only in law-firm summaries that we could not verify against official texts. Treat the table as a pointer to where to look, not as a statement of law.

The lesson is not the list. It is that the same tool can face different duties in different places, that voluntary and binding are different, and that this landscape changes often, even within a year.

Finding the current official rules for your country and sector

You need a method that leads you to the right official source, and a record of what you found.

1. Define your case. Write the country (and state or city), the sector (education, hiring, health, finance, media, retail), the task, the people affected, and the data used.
2. List the kinds of rule that might apply. AI-specific rules, data protection, consumer protection, equality and anti-discrimination, copyright, sector rules from a professional or sector regulator, contracts, and your workplace policy.
3. Go to official home pages. Start from your government's legislation portal and the website of your data-protection authority, consumer regulator, sector regulator and copyright office. These are for you to find in your own country. For examples of official starting points elsewhere, see the table below.
4. Check status and date. Is it in force, adopted but not yet applying, or only proposed? What is the version or date? Has it been amended? Official pages can lag or disagree.
5. Read the primary text or the regulator's own guidance. Use news and law-firm summaries to find the source, then read the source.
6. Check scope. Who must comply (a developer, a user, an employer), what size, which uses, and any exceptions?
7. Record it. Keep a short log: what you found, where, on what date, and what you could not confirm.
8. Ask for help when stakes are high or the text is unclear. See the section on expert advice below.

For a worked example of what to record, here is one entry, taken from a page we checked on 2026-10-12.

Legal note (as of 2026-10-12; not legal advice): According to the New York City Department of Consumer and Worker Protection, employers and employment agencies may not use an automated employment decision tool in the city unless it had a bias audit within one year, information about the audit is public, and the required notices were given; the department enforces the rule and takes complaints, and enforcement began on 2023-07-05. This is a narrow, local rule about hiring tools. It does not describe other places or other uses. Check the current official text for your country and sector.

Template:

RULES LOG                                          Case: [task, sector, country]  Date: [date]
Rule or guidance : name, and whether binding / voluntary / proposed
Source           : official home page and section you read (not a summary)
Applies to       : who must comply; does it cover us? (yes / no / unsure)
What it asks     : two or three plain-language lines
Status checked   : in force / adopted, starts [date] / proposed; version; date checked
Not confirmed    : what I could not verify
Next step        : ask [adviser / regulator]; recheck on [date]

An ethical concern and a confirmed legal obligation

An ethical concern is a reason to worry about harm or unfairness, whether or not a law mentions it. A confirmed legal obligation is a duty you have checked in an official source and found applies to your case. A workplace policy is your organisation's own rule. They overlap, but they are not the same. Use four labels in your notes.

Legal note (as of 2026-10-12; not legal advice): The European Commission's page on the AI Act says that users must be told when they interact with an AI system such as a chatbot, and that generative output must be identifiable. The transparency rules are scheduled to apply from 2026-08-02 according to the AI Service Desk timeline. Whether and how they apply to a given organisation depends on the legal text and its scope. In a place with no such rule, telling people may still be an ethical choice or a workplace policy. Check the current official text for your country and sector.

Neither direction is automatically safe. Treating every ethical concern as a legal duty can create false certainty and cost. Treating a legal duty as only an ethical preference can create real exposure. Do not assume "legal" means "fine" either: lawful conduct can still harm people, and you can still be held to your workplace policy.

When expert or legal advice is needed

A responsible beginner knows the edge of their knowledge. Ask for expert help when the risk is high, the rule is unclear, or being wrong would be costly or hard to undo.

When you ask, bring your case description and your rules log. You will get better advice and probably spend less. A chat assistant can help you prepare questions, but it can state rules wrongly and with confidence. Check anything it says against the official source, as you learned to do with outputs on Trust, Verification and Automation Bias: When to Rely on AI Output.

A proportionate decision under uncertainty

You will rarely have complete evidence. A proportionate decision matches the care you take to the size of the risk: more care for severe, widespread or irreversible harm and for people who cannot protect themselves; less for small, reversible and visible risks. Uncertainty is not a reason to freeze, nor to proceed as if you knew.

Invented scenario:

Hannah runs a training company in Berlin with 120 trainees. She is considering a tool that flags
possible copied text in trainee reports. The vendor says it is accurate but gives no test
results. A trainee's flagged report could lead to a failed course. Hannah is unsure which
rules apply to scoring or flagging trainees, and the vendor has not said where data is kept.

Worksheet, filled in:

1. SITUATION     Flag possibly copied text in trainee reports.
2. AFFECTED      Trainees (a failed course matters), trainers, the company.
3. BENEFITS/HARMS Saves checking time. Harm: a false flag could unfairly fail someone.
4. OPTIONS       A. Use the tool's flag as a result.  B. Use it only to point a trainer to
                 passages, a trainer decides, trainee may respond.  C. No tool; trainers read.
                 D. Pilot B on 20 old reports first.
5. EVIDENCE      Unknown: accuracy on our reports; where data goes; which rules apply.
                 Next: ask the vendor for test method and data location; log the rules;
                 ask an adviser about trainee data and automated scoring.
6. DECISION      Option D now. Go to B only if the pilot flags no more than 2 reports that
                 trainers judge unfair, and the vendor answers in writing. Never option A.
7. ACCOUNTABLE   Hannah; head trainer reviews every flag.
8. REVIEW DATE   2027-01-31 or sooner if a trainee complains.

Notice how uncertainty shaped the decision: it did not stop it, it made it smaller, reversible and watched. Other reasonable choices exist. A more cautious owner might pick option C. Both should say which step of the pattern they would change.

Explaining a decision to someone who disagrees

You will sometimes have to explain a decision to a trainee, client, colleague or neighbour who thinks you are wrong. The aim is not to win. It is to be understood, to show the reasoning is honest, and to leave a way to be corrected.

1. Listen first. Ask what they are worried about and say it back in your own words.
2. State the decision and the reasons. Use the pattern: who is affected, what you weighed, what you decided and why.
3. Say what you do not know. Uncertainty stated plainly builds more trust than false confidence.
4. Say what would change your mind. For example a test result, a rule, or new evidence.
5. Offer a route. A review, an appeal, a human contact, and a date to look again.

Invented dialogue:

Samira: I do not want an automated tool judging my report. It might be wrong about me.
Hannah  : That is a fair worry, and I share part of it. A false flag could cost you the course.
        So the tool will not decide anything. It only points a trainer to passages, and a
        trainer reads them and you can respond before any result. I do not yet know how
        accurate it is on our reports, so we are testing it on old ones first. If it
        flags work that trainers think is fair, we will stop. Does that answer your concern,
        or is there something else you would want in place? We will review in January.

Compare with a weak reply: "The tool is accurate and the decision is final." It gives no reasons, no uncertainty, no route and no way to be corrected.

A personal and workplace AI-use commitment

A commitment is a short statement of how you will use AI, in your own words. It is not a legal document. A personal commitment is yours. A workplace one is agreed with colleagues and sits beside the policy from Policies, Vendors, Records and Incidents: Responsible AI in a Small Team. Keep it to a page.

Template:

MY AI-USE COMMITMENT                       Name: [name]   Context: [student / teacher / ...]
1. I use AI for     [low-risk uses I allow myself]
2. I ask first      [uses where I check a rule, a person or a policy before I begin]
3. I do not use AI  [uses I rule out]
4. I protect        [data I never paste; people whose privacy I respect]
5. I check          [what I verify before I use any output]
6. I am open        [when and how I say that AI helped]
7. If it goes wrong [whom I tell, how fast; I correct and learn instead of hiding]
8. I look again     [review date; one thing I will re-check]

Example:

MY AI-USE COMMITMENT              Name: Nadia   Context: freelance translator in Dhaka
1. I use AI for     First drafts of my own emails; checking spelling in my translations.
2. I ask first      Any client file marked confidential; I read the client's contract first.
3. I do not use AI  To invent quotes, references or statistics; for legal or medical advice.
4. I protect        Client names and contact details; I remove them before pasting.
5. I check          Every fact, number and name against the source before I send.
6. I am open        I tell clients when AI helped with a draft, and I follow their rules.
7. If it goes wrong I tell the client the same day, fix it, and write down what I will change.
8. I look again     2027-04-12: re-read this and ask if anything changed.

Getting ready for the Practice Lab and the capstone

The capstone asks you to write a practical AI-use policy for your own situation. Prepare now, and the work will be quick. Decide on three things. First, the context: student, teacher, freelancer, employee or small-business owner. Second, the scope: which tools, tasks and people the policy covers and which it does not. Third, a review date and the person who will update it. Keep your commitment and your rules log; you will use them. The next page is a set of scenario cards that let you practise every step of this tutorial.

Where this shows up at work

A manager adds a rules log to a project and writes "unsure; ask adviser" instead of guessing. A freelancer tells a client what is known and unknown before starting. A team agrees on a small pilot instead of arguing "AI yes or no".

Common mistakes

• Relying on a summary or a headline for the rule. Fix: find the official page, check status and date, and note what you could not confirm.
• Treating "not illegal" as "fine", or every ethical concern as a legal duty. Fix: label each item as confirmed, probable, ethical only or unknown.
• Waiting for certainty, or acting as if certain. Fix: make the decision smaller, reversible and watched.
• Skipping advice when stakes are high. Fix: use the signals table, and bring your case and log.
• Defending a decision instead of explaining it. Fix: listen, give reasons, state unknowns, name what would change your mind and offer a route.

Try it yourself

1. Easy. Label each as confirmed obligation, probable obligation, ethical concern only or unknown, and say what you would do next: (a) you read the official text of a rule, and it clearly covers your use; (b) a news article says a new law may affect your tool; (c) you worry that a hiring chatbot may confuse applicants who write in a regional dialect, and you have found no rule on it.
2. Medium. Invented scenario: Radhika wants to use an AI tool to draft replies to parents' messages at her tutoring centre in Pune. She does not know whether any rule applies to the parents' data. Write the first three lines of her rules log and name one point where she should ask for advice.
3. Hard. Using the eight steps, make a proportionate decision for this case: a small clinic's front desk wants an AI tool to sort appointment requests by urgency. Evidence is thin and rules are unclear. Then write the reply you would give to a patient who objects.

Answers

Easy. (a) Confirmed obligation: next, follow it, record the source and date, recheck on a schedule. (b) Unknown or probable: next, find the official text, check status and scope, note that a news article is only a pointer. (c) Ethical concern only, for now: next, test the chatbot with real dialect examples, add a human route, and keep looking for any rule. Pass: three correct labels each with a sensible next step. Weak: calling (b) a confirmed duty, or ignoring (c) because no rule was found.

Medium. A strong log: (1) Case: tutoring centre, education, India (Pune); drafting parent replies; personal data of parents and pupils. (2) Kinds of rule to check: data protection law and its regulator, rules for education providers, consumer rules, the centre's own policy. (3) Sources: government legislation portal and the data-protection authority's official page; status: not yet checked. Ask for advice on how the data law applies to children's information and whether the vendor may keep chats. Pass: kinds of rule listed, official sources named, status marked unknown, and a clear advice point. Weak: stating a specific law as if it certainly applies without any source.

Hard. A strong answer treats this as high stakes (health): options such as no AI (staff sort), AI as a suggestion with a staff check of every request, or AI only for non-clinical admin; names patients as affected and notes some may not be able to object easily; says evidence is thin and plans a pilot; requires a human route for any patient who feels the sorting is wrong; names an owner; sets a review date; and says to ask a qualified health professional and a lawyer or the regulator before using it for urgency. The reply: listens, restates the concern, explains the safeguard, says what is unknown, offers a human contact and a date. Pass: proportion shown, advice sought, explanation honest. Weak: adopting the tool as the decision-maker, or refusing to engage with the patient's concern.

Summary

• Weigh innovation and harm by asking who gains, who is at risk, how bad and how reversible; pilots and reviews keep options open.
• Public oversight and self-regulation both have strong arguments; many systems mix them. State your reasons rather than a slogan.
• Rules differ by jurisdiction and change. Find them from official home pages, check status, date and scope, and keep a rules log.
• Keep ethical concern, legal obligation and workplace policy apart. Label items confirmed, probable, ethical only or unknown.
• Ask for expert or legal advice when stakes are high, rules are unclear or the cost of error is large.
• Decide in proportion, explain with reasons and unknowns, offer a route, and write a short commitment with a review date.

Next: Practice Lab: Everyday Responsible-AI Decisions with Scenario Cards puts every step of this tutorial to work on printed scenario cards, and prepares you for your capstone policy.