An Overview of Emerging Global AI Regulations

Australia

Legislation

Federal

Australia does not have a dedicated AI law. AI is regulated mainly through existing, largely technology-neutral laws (privacy, consumer protection, copyright, workplace, online safety and sector rules) and government policy.

In January 2024, the government issued its interim response to the 2023 Safe and Responsible AI consultation, followed in September 2024 by a proposals paper on mandatory guardrails for high-risk AI. However, the National AI Plan released on December 2, 2025 paused the mandatory guardrails and set aside a standalone AI Act for now, relying on existing laws. The government is establishing an AI Safety Institute (announced November 2025) to test and evaluate advanced AI systems and support regulators.

The Privacy and Other Legislation Amendment Act 2024 adds AI-relevant privacy duties: from December 10, 2026, privacy policies must disclose when personal information is used in substantially automated decisions that significantly affect individuals.

State

The New South Wales (NSW) Government came up with the first AI strategy, recognizing the challenges that come with the use of AI and charting a course for AI to be used safely across the government with the right safeguards in place.

For this purpose, the NSW Government published the AI Assurance Framework to assist agencies in designing, building, and using AI-enabled products and solutions. It is mandatory for all projects that incorporate an AI component or utilize AI-driven tools. This encompasses the utilization of large language models and generative AI, explicitly falling within the framework's application scope. The framework is intended to be used by:

• project teams who are using AI systems in their solutions,
• operational teams who are managing AI systems,
• Senior Officers who are accountable for the design and use of AI systems,
• internal assessors conducting agency self-assessments, and
• the AI review body (TBC).

However, a project is not expected to use the framework if it meets the following criteria:

• It uses an AI system that is a widely available commercial application.
• The solution is not customized or used in any way other than intended.

The AI Assurance Framework became effective in March 2022 and was updated in 2024. The State Government also established the NSW AI Review Committee to provide expert guidance and oversight of AI use within government.

Federal government use of AI

In June 2024, the Department of Finance issued the National Framework for the Assurance of AI in Government, which introduces 5 different mechanisms to ensure the effective application of AI ethics principles. Then, in September of the same year, the Policy for the Responsible Use of AI in Government entered into effect. Finally, in November of 2024, the Senate Select Committee on Adopting AI released its report on AI’s opportunities and risks in the countries, focusing on key challenges such as bias, discrimination, and data transparency.

In April 2025, the federal government released AI model clauses to ensure ethical and secure AI use in public sector procurement, covering topics ranging from AI services, customer system, and AI tools to buyer approval, ethical designe, and human oversight.

Additional Resources

In March 2022, the government issued a call for papers on the regulation of AI, calling on various stakeholders on how the government should approach AI regulation in a manner that enables the creation of a harmonic legislative framework without jeopardizing the use of AI to its maximum potential.

In the paper, the government referred to several of its own reports and guides as examples of what kind of ideas it hoped to receive. These include the following:

• The Artificial Intelligence Ethics Framework, published in 2019 as a guide for government and private bodies on how to responsibly design, develop, and implement AI in Australia;
• The Review of the Privacy Act, which contained several recommendations related to automated decision-making systems and mechanisms;
• The Australian Human Rights Commission Human Rights and Technology Final Report, published in 2021, recommended the establishment of an independent AI safety commissioner to oversee various aspects related to commercial AI use in Australia;
• The AI Action Plan, published in 2021, laid down Australia's strategic vision to become a global leader in developing reliable AI technologies and systems;
• The Blueprint for Critical Technologies, published in 2021 as "framework for capitalizing on critical technologies to drive a technologically-advanced, future-ready nation."

Other key resources include:

• The NSW Parliament released a report on AI highlighting the use, risks, and regulatory needs in critical sectors like healthcare and manufacturing with applications such as computer vision and autonomous operations.
•   The Guidance for AI Adoption (October 2025), which replaced the 2024 Voluntary AI Safety Standard and condenses its 10 guardrails into six practices: decide who is accountable; understand impacts and plan accordingly; measure and manage risks; share essential information; test and monitor; and maintain human control.
• The Digital Transformation Agency published the AI Technical Standard to ensure transparency, accountability, and safety in AI systems covering their entire lifecycle, from design to retirement.

Various other regulatory bodies in Australia have also undertaken steps on their own to promote the responsible use of AI under their jurisdiction. For example, since the Online Safety Act of 2021 has come into effect, the National eSafety Commissioner requires all organizations to appropriately inform their users of the use of automated recommendation systems.

Similarly, the Commonwealth Scientific and Industrial Research Organisation (CSIRO) launched its own independent Responsible AI Network to promote collaboration between various Australian firms and create ethically safe and viable AI technologies.

While the government has so far not revealed any of the submissions it received in response to its March 2022 call for papers apart from those sent in by KPMG and the Law Council of Australia, there is growing consensus that most paper submissions contain similar recommendations such as the creation of dedicated AI regulatory body and a federal guideline on the responsible use of AI, both commercially and individually.

Brazil

Legislation

Federal

There is no comprehensive federal law regulating AI in Brazil yet.

In May 2023, Bill of Law 2338/2023 on the use of AI was introduced in the Federal Senate, consolidating earlier bills (5.051/2019, 21/2020 and 872/2021). The Senate approved an amended version on December 10, 2024, following a report by its Temporary Commission on AI. The bill is now before a Special Committee of the Chamber of Deputies, which had not issued its opinion as of September 2026.

Along with imposing various obligations on businesses using AI systems, the law provides the following rights to the consumers:

• Right to prior information regarding their interactions with artificial intelligence systems.
• Right to an explanation of the decision, recommendation, or prediction made by artificial intelligence systems.
• Right to challenge decisions or predictions of artificial intelligence systems that produce legal effects or significantly impact the interests of the affected party.
• Right to human determination and human participation in decisions of artificial intelligence systems, taking into account the context and the state of the art of technological development.
• Right to non-discrimination and the correction of direct, indirect, illegal, or abusive discriminatory biases.
• Right to privacy and protection of personal data, under applicable law.

In 2024, amendments were proposed to the Bill, with the Temporary Commission for AI in Brazil releasing a detailed report analyzing the proposed amendments.

State

To date, there are no comprehensive state legislations regulating the use of AI.

Additional Resources

Brazil's data protection authority, the ANPD, launched an AI Regulatory Sandbox to support experimentation with innovative AI models while promoting algorithmic transparency. Under the Senate-approved bill, the ANPD would coordinate the national AI regulation and governance system.

United States

Legislation

Federal

There is no comprehensive federal law regulating AI in the United States (US).

In October 2023, President Biden issued Executive Order 14110 on "Safe, Secure and Trustworthy Development and Use of Artificial Intelligence", which directed around 20 federal agencies to address AI risks to national security, the economy and public welfare. President Trump revoked EO 14110 on January 20, 2025, and issued Executive Order 14179, "Removing Barriers to American Leadership in Artificial Intelligence," on January 23, 2025.

Since then, federal policy has focused on accelerating AI adoption and innovation:

• In April 2025, the Office of Management and Budget issued memoranda M-25-21 and M-25-22 on federal use and acquisition of AI.
• On July 23, 2025, the White House released America's AI Action Plan, with more than 90 federal actions across three pillars: accelerating AI innovation, building AI infrastructure, and leading in international AI diplomacy and security.
• On December 11, 2025, President Trump signed an executive order, "Ensuring a National Policy Framework for Artificial Intelligence," directing the Attorney General to set up an AI Litigation Task Force to challenge state AI laws seen as conflicting with federal policy, and the Commerce Department to identify burdensome state laws. The order does not itself invalidate any state law.
• In May 2025, the House passed the One Big Beautiful Bill Act with a 10-year moratorium on enforcing state and local AI laws. The Senate removed the provision by a 99–1 vote, and the Act was signed without it in July 2025.

Bills in Congress include S.1638, which would prohibit federal contractors from using certain AI technologies from "countries of concern" (such as DeepSeek), and S.1633, which would require NIST to establish a pilot program for evaluating AI systems used by federal agencies.

See our guide to US federal AI governance.

State

States remain the main source of binding AI rules in the US. Key laws include:

• Connecticut's Public Act 23-16 regulates the state government's use of AI, establishes an Office of Artificial Intelligence and an AI Advisory Board, and created a task force to study AI and develop an AI bill of rights.
• Kentucky's Senate Bill 4 (2025) regulates the use of high-risk AI systems in state government and requires disclosure of AI use in decision-making.
• Montana's SB 212 (2025) made Montana the first state to enact a "Right to Compute" law, protecting citizens' right to own, access and use computational tools.
• Utah enacted several AI laws in 2025 covering AI impersonation, transparency, mental health chatbots, law enforcement AI policies, government data privacy and school data. Utah's Artificial Intelligence Policy Act is covered in detail below.
• Illinois' Artificial Intelligence Video Interview Act requires employers using AI to analyze video interviews to notify applicants and obtain their consent. Since January 1, 2026, an amendment to the Illinois Human Rights Act (HB 3773) also prohibits employers from using AI in ways that discriminate against protected classes, bans using zip codes as a proxy, and requires notice when AI is used in employment decisions.
• Texas' House Bill 149, the Texas Responsible AI Governance Act (TRAIGA), signed on June 22, 2025 and in force since January 1, 2026, focuses mainly on government use of AI and a set of prohibited practices, such as social scoring and AI designed to manipulate behavior to incite harm. It also updates rules on biometric identifiers and consent, and applies to anyone doing business in Texas or offering products or services used by Texas residents. It offers a safe harbor for substantial compliance with the NIST AI Risk Management Framework, with penalties of up to $40,000 per day for continuing violations.
• California's SB 53, the Transparency in Frontier AI Act, signed on September 29, 2025 and in force since January 1, 2026, requires developers of frontier models (trained with more than 10^26 operations) to publish safety frameworks and transparency reports and to report critical safety incidents. Large frontier developers (over $500 million in revenue) have additional duties, with civil penalties of up to $1 million per violation.
• New York's RAISE Act, signed in December 2025 and amended in March 2026, takes effect on January 1, 2027. It requires large frontier AI developers to publish safety frameworks, report safety incidents within 72 hours and file disclosures with a new oversight office.
• Colorado SB 26-189, signed on May 14, 2026 and effective January 1, 2027, repealed and replaced the Colorado AI Act (SB 24-205) with a narrower regime for developers and deployers of covered automated decision-making technology. See below and our SB 205 vs. SB 189 comparison.
• New York City's Local Law 144 prohibits employers from using an automated employment decision tool (AEDT) unless it has had an annual bias audit, a summary of the audit is published, and candidates receive notice. Enforcement began on July 5, 2023, under final rules adopted on April 5, 2023.

Not enacted: Virginia's HB 2094, the High-Risk AI Developer and Deployer Act, passed the legislature but was vetoed by Governor Youngkin on March 24, 2025. See our HB 2094 overview.

Guidances

In 2020, the White House issued Guidance for Regulation of Artificial Intelligence Applications (M-21-06), establishing a framework for federal agencies regulating emerging AI technologies. It has since been superseded by later OMB memoranda. Agency guidance includes:

The aforementioned Guidance has helped various US agencies formulate, from time to time, different guidelines, recommendations, and plans of their own. These include:

• The US Department of Defence’s AI Principles: Recommendations on the Ethical Use of Artificial Intelligence;
• The US Food and Drug Administration’s Artificial Intelligence/Machine Learning (AI/ML)-Based Software as a Medical Device (SaMD) Action Plan;
• The Federal Trade Commission's:
  • Using Artificial Intelligence and Algorithms guidelines,
  • Aiming for truth, fairness, and equity in your company’s use of AI,
  • Keep your AI claims in check,
  • Chatbots, deepfakes, and voiceclones: AI deception for sale,
  • The Luring Test: AI and the engineering of consumer trust,

• The Department of Health & Human Services' Trustworthy AI Playbook,
• The Consumer Financial Protection Bureau's 2024 rule on quality control standards for automated valuation models used in mortgage lending;
• California's Civil Rights Council regulations on automated decision systems in employment, in force since October 1, 2025. The California Privacy Protection Agency's ADMT regulations also took effect on January 1, 2026, with ADMT obligations from January 1, 2027.
• Consumer Financial Protection Bureau's Rules to Implement the Dodd-Frank Act governing the use of "automated valuation models" in the housing market.
• California’s Civil Rights Council adopted final regulations on the use of automated decision systems (ADS).
• NIST has established its Software Supply Chain & DevOps Security Practices Consortium.

In October 2022, the White House issued a Blueprint for an AI Bill of Rights (since withdrawn from the White House website) setting out five protections: data privacy; notice and explanation; algorithmic discrimination protections; safe and effective systems; and human alternatives, consideration and fallback.

In January 2023, the National Institute of Standards and Technology (NIST) issued its AI Risk Management Framework (AI RMF), a voluntary, rights-preserving, non-sector-specific resource to help organizations manage AI risks. NIST added a Generative AI Profile in July 2024. Several state laws, including Texas TRAIGA, reference the AI RMF as a safe harbor.

In May 2023, the Congressional Research Service published Generative Artificial Intelligence and Data Privacy: A Primer, which suggested three mechanisms Congress might consider for governing AI developers' use of data:

• Notice and disclosure requirements: obtaining consent or notifying individuals before collecting or using their data.
• Opt-out requirements: letting individuals opt out of data collection.
• Deletion and minimization requirements: letting individuals delete their data from existing datasets.

"Arkansas – HB 1876 (Act 927, 2025): Ownership of AI-Generated Content"

Arkansas enacted a state law setting default ownership rules for content and models produced with generative AI. Signed on April 21, 2025, Act 927 provides that the person who supplies the input or directives to a generative AI tool owns the generated content, as long as it does not infringe existing intellectual property. For model training, ownership generally follows the person or entity that lawfully provided the training data, subject to contract. AI outputs or trained models created within the scope of employment and under employer direction belong to the employer (work made for hire). The Act does not confer ownership over infringing material. It took effect on August 5, 2025.

Additional Resources: Official bill page and status (HB 1876 → Act 927).

"California – AB 2013 (2024): Generative AI Training Data Transparency"

AB 2013 requires developers of generative AI systems or services released on or after January 1, 2022 and made available to Californians to publish documentation about their training data. It took effect on January 1, 2026.

Definitions: "Generative AI" is AI that can generate derived synthetic content, such as text, images, video or audio, emulating the structure and characteristics of its training data. A "developer" is any person, partnership, corporation or government agency that designs, codes, produces or substantially modifies a generative AI system or service for public use. "Substantially modifies" means creating a new version or release, including retraining or fine-tuning, that materially changes functionality or performance.

Exemptions: AI used solely for security and integrity; AI used to operate aircraft in national airspace; and AI developed exclusively for national security, military or defense purposes and available only to federal entities.

Documentation requirements: By January 1, 2026, or before a substantial modification, developers must post on their websites a high-level summary of the datasets used, including:

• the sources or owners of the datasets;
• how the datasets further the system's intended purpose;
• the number and types of data points;
• whether the datasets include copyrighted, trademarked or patented material, or are entirely in the public domain;
• whether the datasets were purchased or licensed;
• whether they include personal information or aggregate consumer information;
• any cleaning, processing or other modification, and its purpose;
• the time period during which data was collected, and whether collection is ongoing;
• whether synthetic data generation was used.

Enforcement: The Act does not specify a dedicated enforcement mechanism; enforcement would likely rely on California's general consumer protection law.

Effective Date: January 1, 2026

Additional Resources: California AB 2013 – official text.

"California – SB 942 (2024): The California AI Transparency Act"

SB 942 sets transparency obligations for large generative AI providers so that users can identify AI-generated or altered content. Originally due to take effect on January 1, 2026, its operative date was moved to August 2, 2026 by AB 853 (signed October 13, 2025). AB 853 also adds obligations for large online platforms from January 1, 2027 and for capture device manufacturers from January 1, 2028.

Scope: The law applies to "covered providers" – those that create or produce a generative AI system with more than 1,000,000 monthly users or visitors that is publicly accessible in California – and their licensees. It does not apply to products or services providing exclusively non-user-generated video game, television, streaming, movie or interactive experiences.

Key provisions:

• AI detection tool: covered providers must offer a free, publicly accessible tool (with an API) that lets users check whether content was created or altered by the provider's system and shows system provenance data, without collecting or retaining personal information longer than necessary.
• Manifest disclosures: users must have the option to include a clear, conspicuous, hard-to-remove label on AI-generated content.
• Latent disclosures: embedded metadata (provider name, system name and version, creation date and a unique identifier) that is detectable by the provider's tool and difficult to remove.
• Licensees: providers must contractually require licensees to keep the disclosure capability and must revoke a license within 96 hours if a licensee disables it; the licensee must then stop using the system.

Penalties and enforcement: civil penalties of $5,000 per violation, enforceable by the Attorney General, city attorneys or county counsel, with each day of noncompliance a separate violation; injunctive relief and attorney's fees against licensees that continue using a system after revocation.

Effective Date: August 2, 2026

Additional Resources: California SB 942 – official text.

"California – SB 1001 (2018): Bolstering Online Transparency (BOT) Act"

Enacted in 2018 and in effect since July 1, 2019, SB 1001 was one of the first US laws to regulate automated online accounts ("bots"). It defines a bot as an automated online account where all or substantially all actions or posts are not the result of a person.

Key provisions: it is unlawful to use a bot to communicate with a person in California with the intent to mislead them about its artificial identity in order to influence a commercial transaction or a vote in an election. The requirement does not apply if the person clearly and conspicuously discloses that it is a bot. The law does not apply to online platform service providers, and its duties are cumulative with other laws.

Enforcement: through California's Unfair Competition Law, by the Attorney General or local prosecutors.

Effective Date: July 1, 2019

Additional Resources: California SB 1001 – official text.

"California – AB 3030 (2024): Health Care Services and Artificial Intelligence"

In effect since January 1, 2025, AB 3030 requires licensed health facilities, clinics and physicians' offices that use generative AI to create communications about a patient's clinical information to include a disclaimer that the content was AI-generated, and instructions for contacting a human health care provider.

Disclaimer format: at the beginning of written communications; throughout continuous online interactions (e.g., chat-based telehealth); at the start and end of audio communications; and throughout video communications.

Exclusions: administrative uses (such as scheduling or billing) and AI-generated communications that are read and reviewed by a licensed provider before being sent.

Enforcement: violations by health facilities and clinics are enforced under the California Health and Safety Code; physicians are subject to the Medical Board of California or the Osteopathic Medical Board of California.

Effective Date: January 1, 2025

Additional Resources: California AB 3030 – official text.

"Colorado – SB 26-189 (2026), replacing the Colorado AI Act (SB 24-205)"

Colorado's Consumer Protections for Artificial Intelligence Act (SB 24-205), enacted in May 2024, was the first comprehensive US state law on high-risk AI systems. Its effective date was first moved from February 1, 2026 to June 30, 2026 (August 2025 special session). On May 14, 2026, Governor Polis signed SB 26-189, which repeals and re-enacts the framework with a narrower regime focused on developers and deployers of covered automated decision-making technology, effective January 1, 2027.

Under SB 24-205, developers and deployers of high-risk AI systems used in consequential decisions (education, employment, housing, health care, insurance, financial and legal services, and government benefits) had to use reasonable care to prevent algorithmic discrimination, provide documentation and impact assessments, give consumers notice, explanation, correction and appeal rights, and report discrimination risks to the Attorney General within 90 days. SB 26-189 scales these requirements back.

Effective Date: January 1, 2027 (SB 26-189)

Additional Resources: Colorado SB 24-205 – official text; Colorado AI Act overview; SB 205 vs. SB 189.

"Utah – SB 149 (2024): Artificial Intelligence Policy Act (as amended in 2025)"

In effect since May 1, 2024, Utah's Artificial Intelligence Policy Act sets disclosure obligations for the use of generative AI in consumer interactions and in regulated occupations. Amendments effective May 7, 2025 narrowed the law (SB 226) and extended it until July 1, 2027 (SB 332). A separate 2025 law (HB 452) regulates mental health chatbots.

Definitions: As amended, "generative AI" covers AI technology designed to simulate human conversation with consumers through text, audio or visual communication, generating unscripted outputs with limited or no human oversight.

Key provisions:

• Consumer transactions: a business using generative AI must disclose that the person is interacting with AI if the person makes a clear and unambiguous request.
• Regulated occupations: professionals such as physicians, lawyers and accountants must proactively disclose the use of generative AI in "high-risk" interactions – for example, where the AI collects sensitive personal information or is involved in significant financial, legal, medical or mental health decisions. Disclosure must be given verbally at the start of a conversation or electronically before a written exchange.
• Safe harbor: no enforcement action applies if the AI clearly and conspicuously discloses that it is non-human at the outset of and throughout the interaction.
• No AI defense: a person cannot argue that the AI, rather than the human operator, made the violating statement or committed the violating act.

Penalties and enforcement: up to $2,500 per violation, and up to $5,000 per violation of an administrative or court order, enforced by the Utah Division of Consumer Protection and the Attorney General.

Effective Date: May 1, 2024 (amended May 7, 2025)

Additional Resources: Utah SB 149 – official text.

"New York City – Local Law 144 (2021): Automated Employment Decision Tools"

In effect since January 1, 2023, with enforcement from July 5, 2023, New York City's AEDT Law regulates employers' and employment agencies' use of AI or algorithmic tools in hiring and promotion decisions for New York City jobs.

Definition: an AEDT is a computational process derived from machine learning, statistical modeling, data analytics or AI that issues a simplified output (such as a score, classification or recommendation) used to substantially assist or replace discretionary decision-making for employment decisions.

Key provisions:

• Bias audit: an AEDT may not be used unless an independent bias audit has been conducted within the previous 12 months, assessing disparate impact by sex, race and ethnicity.
• Public disclosure: employers must publish the date of the most recent audit, a summary of results (including selection or scoring rates and impact ratios by category) and the tool's distribution date, and keep the information available for at least six months after last use.
• Notice: candidates and employees must receive at least 10 business days' notice that an AEDT will be used, the job qualifications and characteristics it assesses, and how to request an alternative process or accommodation. On written request, employers must disclose the type and source of data collected and their data retention policy within 30 days.

Penalties and enforcement: up to $500 for a first violation and each additional violation on the same day, and 500–1,500 for each subsequent violation, enforced by the NYC Department of Consumer and Worker Protection (DCWP).

Effective Date: January 1, 2023 (enforced from July 5, 2023)

Additional Resources: NYC Local Law 144 – official text.

China

Legislation

National

China does not have a comprehensive AI law, although new AI legislation is on the State Council's 2026 legislative agenda. Instead, it regulates AI through a series of targeted rules:

• Algorithmic recommendations: The Internet Information Service Algorithmic Recommendation Management Provisions, in effect since March 1, 2022, require providers of algorithmic recommendation services to let users view and delete the tags used to profile them and to turn off personalized recommendations.
• Deep synthesis: The Provisions on the Administration of Deep Synthesis Internet Information Services, issued in November 2022 by the Cyberspace Administration of China (CAC), the Ministry of Industry and Information Technology (MIIT) and the Ministry of Public Security and in effect since January 10, 2023, regulate deepfakes and other AI-generated media. They require providers to establish user registration, algorithm review, data security and personal information protection systems, to evaluate algorithms regularly and to label generated content.
• Generative AI: The Interim Measures for the Management of Generative AI Services, finalized in July 2023 and in effect since August 15, 2023, apply to generative AI services offered to the public in China. Key requirements include:
  • taking effective measures during algorithm design, training data selection, model generation and optimization, and service provision to prevent bias and discrimination;
  • increasing the transparency, accuracy and reliability of generative AI services;
  • using data and foundation models from lawful sources;
  • obtaining consent to use personal information;
  • conducting security assessments and filing algorithms for services with public opinion attributes or social mobilization capabilities;
  • having clear service agreements and measures to prevent minors' overreliance on the services;
  • labeling AI-generated content.
• Labeling: The Measures for Labeling AI-Generated Synthetic Content, issued by the CAC and three other agencies in March 2025, took effect on September 1, 2025, together with mandatory national standard GB 45438-2025. They require explicit labels on AI-generated text, images, audio, video and virtual scenes and implicit labels in metadata, and require platforms to check for and flag AI-generated content.
• Cybersecurity Law: Amendments in force since January 1, 2026 add the law's first AI article, supporting AI research and infrastructure while strengthening AI ethics, risk monitoring and safety oversight.

In July 2024, the CAC and other agencies published the Guidelines for the Construction of a National AI Industry Comprehensive Standardization System (2024 Edition), covering AI standard architecture, technical standards and key directions for areas such as natural language processing, computer vision, robotics and security. In 2025, MIIT and other agencies released the Administrative Measures for the Ethical Management of AI Science and Technology to balance innovation and security and align with international AI governance efforts.

State/Provincial

Provincial rules have been similarly proactive, with the Shanghai Regulations on Promoting the Development of the AI Industry and the Shenzhen Special Economic Zone Artificial Intelligence Industry Promotion Regulations (both 2022) placing obligations on organizations.

Shanghai Regulations: apply to AI science and technology innovation, industrial development, application and governance within Shanghai, under the oversight of the municipal economic and information departments. They aim to promote high-quality development of the AI industry, integrate AI with the economy, daily life and urban governance, and build a world-class AI industrial cluster. They introduce graded management and "sandbox" supervision so companies can test technologies in a regulated environment.

Shenzhen Regulations: promote high-quality development of the AI industry in the Shenzhen Special Economic Zone under the municipal industry and information technology department. They categorize AI applications by risk: high-risk applications require pre-assessment and risk early warning, while medium- and low-risk applications require pre-disclosure and post-tracking. Low-risk AI products and services can undergo testing and trials even without local or national standards, provided they meet international standards.

Guidances & Additional Resources

China has been one of the most proactive countries in regulating AI and engaging stakeholders on ethical standards.

In 2017, the State Council published A Next Generation Artificial Intelligence Development Plan, a roadmap for how state and private institutions can develop, deploy and oversee AI responsibly.

In 2021, the National New Generation AI Governance Professional Committee issued the Ethical Norms for New Generation Artificial Intelligence, setting six ethical standards: improving human well-being; promoting fairness and justice; protecting privacy and security; ensuring controllability and credibility; strengthening responsibility; and improving ethical literacy.

United Kingdom

Legislation

The UK does not have a dedicated AI law. The Data Protection and Digital Information (No. 2) Bill, introduced in March 2023, fell when Parliament was dissolved in 2024. Its successor, the Data (Use and Access) Act 2025 (Royal Assent June 19, 2025), reformed the rules on automated decision-making under Article 22 of the UK GDPR: since February 2026, solely automated decisions with legal or similarly significant effects are generally permitted for non-special category data, provided safeguards are in place – information, the ability to make representations, human intervention and the right to contest the decision.

A long-expected AI bill for frontier AI developers has been repeatedly delayed and had not been introduced as of October 2026.

Guidances

In March 2023, the UK government issued a white paper, "A pro-innovation approach to AI regulation," which relies on existing regulators and laws rather than a new AI regulator. It set out five principles for regulators to apply within their remits:

• safety, security and robustness;
• transparency and explainability;
• fairness;
• accountability and governance;
• contestability and redress.

Under this approach, existing regulators such as the Health & Safety Executive, the Equality & Human Rights Commission and the Competition & Markets Authority oversee AI within their sectors. The government confirmed the approach in its February 2024 response. It builds on the 2021 National AI Strategy.

In January 2025, the government published the AI Opportunities Action Plan (50 recommendations to drive AI adoption and growth), and in February 2025 the AI Safety Institute was renamed the AI Security Institute, with a sharper focus on national security risks.

The Department for Education has published guidance on Generative Artificial Intelligence in Education.

Singapore

Legislation

Singapore does not have a dedicated AI law and favors voluntary frameworks and sector guidance. The Advisory Council on the Ethical Use of AI and Data was established in 2018 to advise the government on ethical, policy and governance issues arising from AI.

Singapore's first National Artificial Intelligence Strategy was published in 2019, and National AI Strategy 2.0 followed in December 2023.

Targeted legislation includes:

• The Road Traffic (Autonomous Motor Vehicles) Rules 2017, which regulate trials of autonomous vehicles;
• the Elections (Integrity of Online Advertising) (Amendment) Act 2024, which bans digitally manipulated content (including deepfakes) that falsely depicts election candidates;
• the Online Safety (Relief and Accountability) Act 2025, which gives victims of online harms, including intimate image abuse and deepfakes, avenues for relief.

Guidances

The Infocomm Media Development Authority (IMDA) has identified four "pillar" technologies for Singapore's digitalization: cybersecurity, immersive media, the Internet of Things and AI. The AI pillar is driven by AI Singapore, which builds Singapore's AI ecosystem.

Key guidance includes:

• The Monetary Authority of Singapore's FEAT Principles for the use of AI and data analytics in the financial sector, and the Veritas Initiative;
• The Personal Data Protection Commission's (PDPC) Model AI Governance Framework, Implementation and Self-Assessment Guide for Organisations and Compendium of Use Cases (Volume 1 and Volume 2);
• The Model AI Governance Framework for Generative AI (May 2024) and the PDPC's Advisory Guidelines on the Use of Personal Data in AI Recommendation and Decision Systems (March 2024);
• IMDA's A Guide to Job Redesign in the Age of AI;
• IMDA and PDPC's AI Verify testing framework and toolkit, now supported by the AI Verify Foundation;
• a Model AI Governance Framework for Agentic AI, launched in January 2026.

Japan

Legislation

In May 2025, Japan enacted its first AI law, the Act on the Promotion of Research, Development and Utilization of AI-Related Technologies (AI Promotion Act). Most provisions took effect on June 4, 2025, and the chapters establishing the AI Strategy Headquarters (chaired by the Prime Minister) and the AI Basic Plan took effect on September 1, 2025. The Act sets basic principles and asks businesses to cooperate with government measures, but imposes no penalties. The Cabinet adopted Japan's first AI Basic Plan, centered on "trustworthy AI", on December 23, 2025.

Japan also adopted the Hiroshima AI Process, launched at the 2023 G7 Hiroshima Summit, to establish international guiding principles and a code of conduct for organizations developing advanced AI systems.

In February 2024, the Japan AI Safety Institute was launched to examine AI safety evaluation methods, develop standards, and collaborate with similar institutes in the US and UK. It has released a Guide to Evaluation Perspectives on AI Safety and a Guide to Red Teaming Methodology on AI Safety.

Japan has also amended existing laws to address AI, for example:

• the Road Traffic Act, to regulate automated driving;
• the Financial Instruments and Exchange Act, to require registration of firms using algorithmic high-speed trading;
• the Act on Improving Transparency and Fairness of Digital Platforms, which requires platforms to disclose key factors that determine search rankings.

Guidance

• In 2019, the government published the Social Principles of Human-Centric AI, setting out seven principles: human-centricity; education and literacy; privacy protection; security; fair competition; fairness, accountability and transparency; and innovation.

  These principles have led to further guidance, including:

  • the AI Guidelines for Business (METI and MIC, April 2024), which consolidate and replace earlier guidelines such as the Governance Guidelines for Implementation of AI Principles;
  • the Guidebook on Corporate Governance for Privacy in Digital Transformation;
  • the Guidebook for Utilization of Camera Images;
  • the Contract Guidelines on Utilization of AI and Data;
  • the Machine Learning Quality Management Guideline.

Canada

Legislation

Federal

There is no comprehensive federal law regulating AI in Canada.

In June 2022, the government tabled the Artificial Intelligence and Data Act (AIDA) as part of Bill C-27, the Digital Charter Implementation Act, 2022. AIDA would have regulated high-impact AI systems in international and interprovincial trade, but it died on the Order Paper when Parliament was prorogued in January 2025. The March 2023 AIDA Companion document noted that existing laws already apply to AI, including the Canada Consumer Product Safety Act, Food and Drugs Act, Motor Vehicle Safety Act, Bank Act, Canadian Human Rights Act and provincial human rights laws, and the Criminal Code.

In September 2023, the federal government published a Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems. In November 2024, it launched the Canadian AI Safety Institute (CAISI) to support the safe development and deployment of AI.

In May 2025, Canada appointed its first Minister of Artificial Intelligence and Digital Innovation, and on June 4, 2026 it launched a National AI Strategy, "AI for All," which commits to modernizing privacy and online safety laws and strengthening national AI safety capabilities. No AI-specific bill had been introduced as of October 2026.

Provincial

No province has enacted comprehensive AI legislation, although provincial human rights and privacy laws apply to AI. Quebec's Law 25 requires notice when decisions are based exclusively on automated processing, and Ontario's Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024 sets rules for AI use by public sector entities.

Guidances

In November 2020, the Office of the Privacy Commissioner of Canada (OPC) issued A Regulatory Framework for AI: Recommendations for PIPEDA Reform, recommending recognition of privacy as a human right, specific provisions on automated decision-making, and demonstrable accountability.

In May 2021, Ontario published a report on its Trustworthy AI Framework consultation.

The Government of Canada's guidance on the Responsible use of AI commits federal departments to:

• understand and measure the impact of AI by developing and sharing tools and approaches;
• be transparent about how and when AI is used, starting with a clear user need and public benefit;
• provide meaningful explanations of AI decisions and opportunities to review and challenge them;
• share source code, training data and other information where possible, while protecting personal information, system integrity and national security;
• provide training so that employees have the skills to design and implement AI responsibly.

The Directive on Automated Decision-Making sets binding rules for federal institutions using automated decision systems, including algorithmic impact assessments; it was updated in 2025.

Israel

Legislation

There is no comprehensive AI law in Israel.

In December 2023, the Ministry of Innovation, Science and Technology published Israel's first AI policy, which favors sector-specific regulation, soft law and voluntary standards over a horizontal AI law, and encourages alignment with international frameworks. Rather than a single statute, Israel relies on amendments to existing laws and on policy guidance that supports self-regulation and standardization.

Key government resources include:

• Israeli AI Regulation and Policy White Paper: A First Glance (draft, 2022);
• Israel's Policy on Artificial Intelligence Regulation and Ethics (2023);
• Harnessing Innovation: Israeli Perspectives on AI Ethics and Governance.

Additional Resources

Existing laws continue to apply to AI. Amendment 13 to the Protection of Privacy Law (in force since August 14, 2025) strengthens the Privacy Protection Authority's enforcement powers, which also apply to AI systems processing personal data, and the Authority has published guidance on applying privacy law to AI.

The Copyright Act protects literary, artistic and musical works and is relevant to questions about AI-generated content and ownership. Israel's Basic Law: Human Dignity and Liberty protects constitutional rights, and AI practices or policies that conflict with these rights can be challenged.

United Arab Emirates

Legislation

The UAE does not have a dedicated AI law.

It is, however, at the forefront of AI adoption. In 2017, it became the first country to appoint a Minister of State for Artificial Intelligence. In June 2026, the Cabinet approved a new Artificial Intelligence and Data Authority, consolidating federal oversight of AI, digital government and data.

The UAE Council for AI and Blockchain oversees policy on the use of AI within government and has issued toolkits and guidance to help public and private bodies use AI responsibly, especially when involving residents' data.

In July 2024, the Ministry of Cabinet Affairs launched the UAE Charter for the Development and Use of AI, issued by the UAE Artificial Intelligence, Digital Economy and Remote Work Applications Office. In the DIFC financial free zone, Data Protection Regulation 10 sets specific rules for processing personal data through autonomous and semi-autonomous systems.

Additional Resources

Key UAE guides, tools and incentives include:

• The National Artificial Intelligence Strategy 2031: a framework for adopting AI across economic sectors and government services such as healthcare, education and transportation;
• AI Ethics Principles and Guidelines: standards for fairness, transparency, accountability, privacy and security in developing and deploying AI;
• AI Coding Licence: a special licence launched by the DIFC with the UAE AI Office for coders developing AI tools for UAE-based organizations;
• AI Systems Ethics Self-Assessment Tool: lets organizations assess whether their AI systems follow the official ethics guidelines.

South Korea

Legislation

South Korea's Framework Act on the Development of Artificial Intelligence and Establishment of Trust (AI Basic Act) was passed by the National Assembly in December 2024, signed in January 2025, and took effect on January 22, 2026. It is the second comprehensive AI law after the EU AI Act.

The Act applies to AI activities that affect the Korean market or users, including those of foreign companies, and is overseen by the Ministry of Science and ICT (MSIT). Key obligations include risk management and user protection measures for "high-impact AI" (for example, in healthcare, hiring, credit and critical infrastructure), notifying users when they interact with generative or high-impact AI, labeling AI-generated content, and appointing a domestic representative for foreign businesses above thresholds. Administrative fines are up to KRW 30 million, and MSIT has said it will not impose fines for at least the first year.

The Personal Information Protection Commission (PIPC) has published guidance on using personal data to train and develop AI models, and has set up an AI Privacy Task Force to coordinate with the private sector on AI matters.

In September 2025, the Ministry of Science and ICT launched the Presidential Committee on National AI Strategy, which brings together experts across subcommittees to implement the national AI action plan. In the same month, the PIPC announced regulatory reforms to support innovation in AI, autonomous mobility and robotics.

Additional Resources

• R&D and Standardization Roadmap: the PIPC's roadmap for personal information lifecycle protection and utilization technology (2026–2030), so data can be used for innovation without compromising individual rights;
• AI Innovation Hub: the Ministry of Science and ICT's initiative providing AI development infrastructure, equipment, software and data for SMEs;
• AI R&D Strategy: aims to build an innovative AI ecosystem through analysis of technology, human resources and infrastructure;
• AI Privacy Risk Assessment and Management Model: addresses privacy risks in AI systems;
• AI Regulatory Harmonization Roadmap: developed with 25 ministries, AI companies, research institutions and experts, with 67 tasks to harmonize AI regulation and give early guidance on compliance, data handling and safety.

Saudi Arabia

Legislation

Saudi Arabia does not have a comprehensive AI law.

Like several other countries leading in AI, it takes a flexible approach to regulating the industry to promote investment and collaboration. In April 2025, the Communications, Space and Technology Commission published a draft Global AI Hub Law to let foreign governments and companies host data and AI infrastructure in the Kingdom; it had not been enacted as of October 2026. 2026 has been designated the Year of AI.

The National Strategy for Data & AI sets out the Kingdom's ambition to transition from traditional economic sectors toward data and AI. With projects like NEOM, Saudi Arabia's flexible framework and incentive schemes are designed to attract AI companies and investors.

Saudi Vision 2030 aims to use AI across sectors, from infrastructure and facility management to environmental monitoring, traffic control and cybersecurity.

Additional Resources

• Open Data Policy: states that open data must not be used for political purposes, illegal or criminal activity, or discriminatory expressions, which also applies to data used to train AI systems;
• Personal Data Protection Law (PDPL): Saudi Arabia's primary privacy law, fully enforceable since September 14, 2024. It applies to personal data used to train or operate AI systems, and requires explicit consent for decisions based solely on automated processing.
• Generative AI Guidelines (SDAIA, 2024): guidance for government and the public on adopting generative AI, with examples of challenges and solutions;
• AI Ethics Principles 2.0: apply to all stakeholders designing, developing, deploying, using or affected by AI systems in the Kingdom;
• SDAIA's AI Adoption Framework (2025) and Deepfakes Guidelines.

New Zealand

Legislation

New Zealand does not have a comprehensive AI law.

In July 2025, the government released New Zealand's first national AI strategy, "Investing with Confidence", together with Responsible AI Guidance for Businesses. It favors a light-touch approach that relies on existing laws, such as the Privacy Act 2020. In 2023, the government published interim generative AI guidance for the public service, followed by a Public Service AI Framework in January 2025.

Additional Resources

• Māori Data Sovereignty Principles: Māori data sovereignty refers to the inherent rights and interests of Māori in the collection, ownership and application of Māori data, which extend to AI models trained on such data;
• AI Cornerstones: proposed by the AI Forum of New Zealand in 2021 as a foundation for a human-centric national AI strategy built on trust, equity and accessibility.

India

Legislation

India does not have a dedicated AI law.

The Digital Personal Data Protection Act, 2023 (DPDPA) applies to personal data processed by AI applications and defines roles such as Data Fiduciaries and Consent Managers. The DPDP Rules, notified in November 2025, phase in most obligations by May 2027. See our DPDPA vs. GDPR comparison.

In February 2026, the government notified amendments to the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, in force since February 20, 2026. They require platforms to label "synthetically generated information" (AI-generated or altered content that appears authentic) with prominent labels and permanent provenance metadata, and to remove flagged unlawful content within three hours.

In November 2025, the Ministry of Electronics and Information Technology (MeitY) released the India AI Governance Guidelines, which rely mainly on existing laws and voluntary measures, organized around seven guiding principles and an action plan. The IndiaAI Mission, approved in March 2024, funds compute, datasets and AI safety work.

Additional Resources

• India AI Report by McKinsey: an assessment of India's AI landscape and the potential impact of generative AI, with recommendations for organizations adopting AI in India.
• NITI Aayog's National Strategy for AI: first published in 2018 by India's policy think tank, the strategy covers AI applications in sectors such as healthcare, agriculture and education and serves as a foundation for responsible AI adoption.
• INDIAai Portal: the national AI portal and hub for AI information, resources, policy updates and news.
• A Complex Adaptive System Framework to Regulate AI: a working paper by the Economic Advisory Council to the Prime Minister, based on five principles – guardrails, manual overrides, clear accountability, a specialist regulator, and transparency.
• Reimagining Security: An Era Powered by GenAI: a Data Security Council of India report on AI security challenges and opportunities.
• Framework for Responsible and Ethical Enablement of AI (FREE-AI): a Reserve Bank of India report with seven principles and 26 recommendations for financial institutions, regulators and the government.

Mexico

Legislation

Mexico does not have a federal AI law. Several AI bills have been introduced in Congress but none has been enacted. Organizations rely on general laws – including the new Federal Law on the Protection of Personal Data Held by Private Parties (in force since March 21, 2025), which adds rules on objecting to automated processing – and on initiatives and multi-stakeholder projects.

Additional Resources

• Mexican Society for Artificial Intelligence (SMIA): a scientific society specializing in AI research that publishes resources and organizes events connecting academia and industry.
• AI Mexico: a private initiative encouraging communication and collaboration among professionals, researchers and enthusiasts through workshops, courses and conferences.
• National Alliance for Artificial Intelligence (ANIA): a multi-stakeholder coalition promoting ethical and inclusive AI in Mexico.

Norway

Legislation

National

Norway does not yet have an AI statute in force. AI is currently governed by existing laws, such as the data protection rules enforced by the Norwegian Data Protection Authority, and by national strategies. As an EEA country, Norway is implementing the EU AI Act. On March 26, 2025, the government announced KI-Norge (AI Norway) within the Norwegian Digitalisation Agency (Digdir) as a national hub for innovative and responsible AI use, designated the Norwegian Communications Authority (Nkom) as the coordinating supervisory authority for AI, and named Norsk akkreditering as the national accreditation body.

A draft Norwegian AI Act was published for consultation on June 30, 2025. The original target of entry into force in late summer 2026 has been missed; the government now expects to present a bill to the Storting in spring 2027, subject to the EU AI Act's incorporation into the EEA Agreement.

Norway's approach builds on the National Strategy for Artificial Intelligence (2020), which emphasizes ethical principles, privacy, cybersecurity and AI infrastructure, and on the National Digitalisation Strategy 2024–2030, which prioritizes harnessing the opportunities of AI.

Regional

Norway is a unitary state with no separate regional AI legislation; national agencies and sector regulators lead on AI oversight.

Additional Resources

• National Strategy for Artificial Intelligence (2020).
• Datatilsynet's regulatory privacy sandbox, which offers guidance to selected AI projects, including generative AI.
• Framework for the Regulatory Sandbox: objectives and methodology for responsible AI development from a privacy perspective.
• The Digital Norway of the Future – National Digitalisation Strategy 2024–2030.

Italy

Legislation

National

Italy enacted a dedicated national AI law, Law No. 132 of September 23, 2025 ("Disposizioni e deleghe al Governo in materia di intelligenza artificiale"). It entered into force on October 10, 2025 and is aligned with the EU AI Act (Regulation (EU) 2024/1689). Key provisions include:

• National oversight: the Agency for Digital Italy (AgID) and the National Cybersecurity Agency (ACN) are Italy's national AI authorities. AgID is the notifying authority, responsible for conformity assessment bodies; ACN handles market surveillance, inspections and sanctions and is the single point of contact under the EU AI Act. The Bank of Italy, CONSOB and IVASS retain their supervisory roles in financial markets.
• Children: under-14s may access AI only with parental consent; 14–17-year-olds can consent themselves if the information is clear and accessible (Art. 4(4)).
• Healthcare: AI systems are support tools, and medical decisions remain with clinicians (Art. 7). The law also sets up an AGENAS-run national AI platform to support care (Art. 10).
• Professional services: in licensed professions (e.g., legal, accounting), AI may be used only in support, with clear disclosure to clients (Art. 13).
• Copyright and text and data mining: works created with AI assistance are protected if they result from human intellectual effort; AI text and data mining must comply with copyright law (Art. 25).
• Criminal law: unlawful dissemination of AI-generated or altered content (deepfakes) causing harm is punishable by 1–5 years' imprisonment, and the use of AI is an aggravating circumstance for certain crimes (Art. 26).
• Investment: up to €1 billion in equity and quasi-equity investments for AI, cybersecurity and enabling technologies through CDP Venture Capital (Art. 23).

Regional

Italy has no separate regional AI law; implementation runs through national authorities (AgID, ACN) alongside existing regulators such as the Garante.

Additional Resources

• Official text of Law 132/2025 (Gazzetta Ufficiale and Normattiva).
• Authorities and roles (Art. 20); minors' consent (Art. 4(4)); healthcare (Arts. 7 and 10); copyright (Art. 25); deepfakes and aggravating circumstances (Art. 26); investment (Art. 23).

Peru

Legislation

National

Peru has a dedicated national AI law and implementing regulation:

• Law No. 31814 (July 5, 2023): promotes the use of AI for economic and social development, establishes principles for safe, ethical, transparent and human-centric AI, and designates the Presidency of the Council of Ministers (PCM), through the Secretariat of Government and Digital Transformation (SGTD), as the national technical-regulatory authority.
• Supreme Decree No. 115-2025-PCM (September 9, 2025): approves the regulation of Law 31814 (6 titles, 36 articles). It entered into force 90 working days after publication (January 2026), with some provisions effective the day after publication.

Scope and exclusions: the regulation applies to public bodies, state-owned enterprises under FONAFE, private-sector organizations, academia and civil society within the National Digital Transformation System. Personal uses are excluded; national defense and security uses follow reinforced principles of proportionality, oversight and human rights.

Prohibited and high-risk uses: prohibited uses include manipulative AI that exploits vulnerabilities, mass surveillance without a legal basis, predictive policing, profiling based on sensitive data with discriminatory outcomes, and autonomous lethal capability in the civil sphere. High-risk systems carry heightened transparency and explanation duties.

Core obligations:

• maintain up-to-date documentation and controls for high-risk systems; ensure transparency, accountability and privacy; train staff on AI risks and safe adoption; and ensure human oversight with the ability to stop or override AI decisions;
• follow international technical standards (e.g., ISO/IEC standards on security, risk management and AI governance) as good practice;
• cooperate with SGTD supervision: SGTD can request information, coordinates with Peru's CSIRT and other authorities, and runs citizen reporting channels (gob.pe/iaperu).

Phased implementation (from publication):

• Public sector: Executive, Legislative and Judicial branches and autonomous constitutional bodies within 1 year; EsSalud, regional governments, public universities and FONAFE companies within 2 years; local governments within 3 years.
• Private sector by activity: health, education, justice, security, economy and finance within 1 year; transport, commerce and labor within 2 years; production, agriculture, energy and mining within 3 years; other uses within 4 years.
• Smaller firms: small enterprises (more than 150 and up to 1,700 UIT) within 2 years; micro-enterprises (up to 150 UIT) within 3 years.

Regional

Peru is a unitary state; AI governance is centralized under PCM–SGTD.

Additional Resources

• Official text of Supreme Decree 115-2025-PCM; Law No. 31814 (official gazette).
• Government explainer (Andina) on rights, prohibited uses, transparency and human oversight.
• gob.pe/iaperu (normative references, tools and reporting channel).
• Draft National AI Strategy (ENIA) 2026–2030.

El Salvador

Legislation

National

El Salvador enacted a dedicated national AI law, the Law for the Promotion of Artificial Intelligence and Technologies (Ley de Fomento a la Inteligencia Artificial y Tecnologías, Legislative Decree No. 234). It was issued on February 26, 2025, published in the Diario Oficial on March 3, 2025, and entered into force eight days after publication.

Scope and objectives: the law promotes the development, research and application of AI while ensuring responsible, fair and secure use. It applies to natural and legal persons developing, training or deploying AI, or carrying out related data activities, in El Salvador.

National authority: the law creates the National Artificial Intelligence Agency (ANIA), headed by an Executive Director appointed by the President. ANIA coordinates compliance, provides technical assistance and training, runs a National Registry of AI Development, Innovation and Application, and helps integrate AI education into curricula.

Risk and oversight: ANIA must establish a risk-evaluation framework for AI systems, and sectoral security rules must align with the State Cybersecurity Agency (ACE). When AI is used commercially or to access rights or services, users must be told if a decision was made or driven by AI, receive an understandable explanation, and be able to contest it before a competent human authority.

Safeguards and responsibilities:

•  research and sandbox activities do not create liability as long as systems are not deployed commercially or used in ways that infringe users' rights;
• developers and operators are not liable for third-party misuse if they show reasonable efforts to meet security, ethics and operational standards;
• models, weights, training data and outputs should not be subject to licensing conditions that unduly restrict reuse, analysis or improvement, provided IP, privacy and ethics rules are respected;
• developers, implementers, service providers and end users have defined duties across the AI lifecycle, and personal data must be used in line with the national data protection law (Personal Data Protection Law, 2024).

Regional

El Salvador is a unitary state; AI governance is centralized under ANIA.

Additional Resources

• Official law text (Diario Oficial, March 3, 2025: Decree No. 234) and the Legislative Assembly listing.
• Press coverage of the law's entry into force and implementation.

Viet Nam

Legislation

National

Vietnam now has two laws covering AI:

• Law on Artificial Intelligence (Law No. 134/2025/QH15): passed on December 10, 2025 and in force since March 1, 2026, it is Vietnam's first standalone AI law and Southeast Asia's first comprehensive one. It applies to Vietnamese and foreign organizations and individuals carrying out AI activities in Vietnam (excluding defense, security and cryptography uses), introduces a three-tier, risk-based classification framework influenced by the EU AI Act, and replaces the AI provisions of the Law on Digital Technology Industry. Many details will be set by implementing decrees.
• Law on Digital Technology Industry (Law No. 71/2025/QH15): enacted on June 14, 2025 and in force since January 1, 2026 (with some incentives from July 1, 2025), it covers AI alongside semiconductors and digital assets, including risk-based categories with human oversight, a national database and labeling of AI-generated digital products, and a regulatory sandbox. The Ministry of Science and Technology (MoST) is the lead authority.

Participants must comply with Vietnam's laws on cybersecurity, data (including the Law on Personal Data Protection, in force since January 1, 2026) and consumer protection when developing or deploying AI systems.

Provincial

Vietnam's AI rules are national in scope. Provinces may host concentrated digital technology zones under MoST guidance.

Additional Resources

• Government news release on the Law on Digital Technology Industry.
• English text and extracts of Law No. 71/2025/QH15.
• Practitioner summaries of the Law on Artificial Intelligence (Law No. 134/2025/QH15).

Taiwan, Province Of China

Legislation

National

Artificial Intelligence Basic Act (2026): the Executive Yuan approved the draft Act on August 28, 2025. The Legislative Yuan passed it on December 23, 2025, and it was promulgated and took effect on January 14, 2026.

The enacted Act is a short framework law of 20 articles. It codifies seven principles – including sustainability and well-being, human autonomy, privacy and data governance, security and safety, transparency and explainability, fairness and non-discrimination, and accountability – and designates the National Science and Technology Council as the central competent authority. It requires the Executive Yuan to set up a National AI Strategy Special Committee, delegates AI risk classification to the Ministry of Digital Affairs (MODA), and asks sector agencies to issue guidelines and to review and amend related laws within 24 months. It does not set penalties or impose immediate operational obligations on private companies.

Additional Resources

• Official announcement: Executive Yuan press release (Aug 28, 2025).
• Official text of the Artificial Intelligence Basic Act (Laws & Regulations Database of the Republic of China).

The European Union

As with data privacy regulations in the form of the General Data Protection Regulation, the European Union (EU) looks increasingly likely to provide the rest of the world with an appropriate blueprint on how to proceed with AI regulation.

Legislation

The AI Act

The proposed AI Act provides a standardized definition of what constitutes an AI system and contains provisions that protect the rights of individuals in relation to the use of AI systems. One of the key highlights of the Act is that it classifies AI systems into four distinct categories depending on the four levels of risks for AI systems:

These include:

• Unacceptable Risk AI systems: AI systems that pose a clear threat to the safety, livelihoods, and fundamental rights of people, the use of such AI systems is prohibited.
• High-Risk AI systems: AI systems that create a high risk to the health and safety or fundamental rights of natural persons, the use of such AI systems is permitted subject to compliance with certain requirements, including ex-ante conformity assessment.
• Limited risk AI systems: AI systems with specific transparency obligations.
• Minimal risk AI systems: AI systems representing minimal or no risk for citizens’ risks or safety, such as AI-enabled video games or spam filters.

Depending on their classification, different legal provisions, obligations, and penalties will apply to AI technologies. For example, any automated service or technology that can alter a human's behavior that constitutes a high-risk AI system, leading to potential or actual physical or psychological harm and carries fines of up to €30,000,000 per offense or 6% of a company’s annual turnover for the preceding financial year, whichever is higher.

The Act elaborates at great length on how different technologies are categorized.

An AI system is deemed as having an Unacceptable Risk if it clearly endangers people's safety, livelihood, and fundamental rights. Such AI systems are completely prohibited.

Since the mechanism that will be used to categorize systems as either High Risk or Low Risk is still being debated, the aforementioned criteria is likely to be adjusted in the future.

The AI Act is expected to be adopted by the end of 2023 after due consideration, discussion, and necessary adjustments due to dynamic AI developments.

Additional Resources

In June 2023, the Confederation of European Data Protection Organisations (CEDPO) published an AI and Personal Data guidance for Data Protection Officers. In the guidance, the CEDPO answered some fundamental questions that arise in relation to the intersection of the data protection legislative framework and the use of artificial intelligence and machine learning.

The guidance delves into matters such as the need for the AI Act, whether the GDPR regulates artificial intelligence and machine learning and which core data protection principles apply thereto, and the role of DPOs in the ever-evolving digital and technological landscape. The European Commission has also released guidelines on the Ethical Use of Artificial Intelligence in educational settings.

Regulatory Actions

EU member countries have been in the headlines for their regulatory actions against emerging AI technologies. Italy became the first European country to temporarily ban the use of ChatGPT after its data protection authority, Garante, raised serious suspicions about ChatGPT's collection, use, and maintenance of users' personal data. The ban led other regulatory bodies in EU countries, such as France and Spain, to review the use of the famous chatbot in their own jurisdictions.

The Italian DPA also issued a provisional limitation on further processing of data by Replika - a chatbot with a written and vocal interface based on AI that generates a “virtual friend” - highlighting violations of the GDPR.

Recently, the French DPA issued a 20 million Euro fine on Clearview AI for processing biometric data without an appropriate legal basis and the failure to exercise data subjects’ rights and requests to erase their data. The Austrian DPA has also ruled that Clearview AI cannot process biometric data and must delete complainants' existing personal data.

The Finnish DPA has warned healthcare providers that automated decisions for detecting patients’ healthcare needs can fail to meet data protection requirements.

Finally, in April 2023, the European Data Protection Board set up a taskforce dedicated to cooperation and exchange of information on possible enforcement actions by various data protection agencies across the EU. The EU Advocate General has also issued an opinion on the lawfulness of processing and automated decision-making under the GDPR and noted that an appropriate legal basis of data processing for AI systems to ensure compliance with the requirements of the GDPR.