First, an A.I. system must be subject to the full gamut of laws that apply to its human operator.
My second rule is that an A.I. system must clearly disclose that it is not human.
My third rule is that an A.I. system cannot retain or disclose confidential information without explicit approval from the source of that information.