AI Regulation Reference
AI Law Tracker
35 laws tracked across the EU, US federal government, US states, UK, and international bodies — filtered and explained for small teams.
Showing 35 of 35 laws
The world's first comprehensive AI law, classifying AI systems by risk level and imposing obligations that scale with risk. High-risk AI systems must undergo conformity assessment, maintain documentation, and implement human oversight. Under Regulation (EU) 2026/1744, obligations for Annex III high-risk systems now apply from December 2, 2027, moved back from August 2, 2026.
Effective: August 1, 2024
The EU's foundational data privacy law, governing how organizations collect, process, and store personal data of EU residents. Article 22 restricts solely automated decision-making that significantly affects individuals, with direct implications for AI-driven decisions.
Effective: May 25, 2018
The updated EU product liability framework extends liability to software and AI, allowing injured people to seek compensation when defective AI systems cause harm. National law can no longer limit liability with financial ceilings, and courts can presume defectiveness in certain cases. It applies to products placed on the market after December 9, 2026, which is also the deadline for member states to transpose it. Older products stay under the previous rules.
Effective: December 9, 2026
A voluntary framework from the National Institute of Standards and Technology helping organizations manage AI risks. Organized around four functions: Govern, Map, Measure, and Manage. Released January 26, 2023; NIST added a Generative AI Profile (NIST-AI-600-1) on July 26, 2024, and says AI RMF 1.0 is being revised as part of the White House AI Action Plan. Texas TRAIGA says a defendant may not be found liable for a violation it discovers through an internal review process while substantially complying with the most recent NIST Generative AI Profile or another nationally or internationally recognized risk management framework.
Effective: January 26, 2023
Signed January 23, 2025, three days after Executive Order 14148 revoked the Biden AI order (EO 14110). It directs officials to review every action taken under the revoked EO 14110 and to suspend, revise or rescind those that present obstacles to US AI dominance, and orders an AI action plan within 180 days. A follow-on order signed December 11, 2025, Ensuring a National Policy Framework for Artificial Intelligence, directs federal agencies to challenge or deter state AI laws, including through an AI Litigation Task Force.
Effective: January 23, 2025
Executive Order 14434, signed September 29, 2026 and published in the Federal Register on October 2, 2026, directs federal executive departments and agencies to use the terms Super Intelligence and SI instead of artificial intelligence and AI in official correspondence, public communications, websites, reports and policy documents. For now the new term is defined by reference to the existing statutory definition of artificial intelligence in 15 U.S.C. 9401(3). Within 60 days the assistant to the president for science and technology must submit proposed legislative language for a federal definition of Super Intelligence, including whether it should modify or supersede the current legal definition of AI. Previously issued regulations, contracts and grants do not have to be rewritten. The order creates no enforceable rights.
Effective: September 29, 2026
A non-binding White House document, released March 20, 2026, that sets out legislative recommendations for Congress on federal AI policy. Its priorities include protecting children and empowering parents, preempting unduly burdensome state AI regulation, channeling oversight through existing sector-specific agencies and industry-led standards, community and infrastructure impacts, intellectual property, free speech, innovation and workforce readiness. It does not create legal obligations.
SB 26-189, signed by Governor Polis on May 14, 2026 and effective January 1, 2027, repeals and re-enacts SB 24-205. It removes the 2024 duty of care, risk management program and impact assessment requirements and replaces them with a point-of-interaction notice, a post-adverse-outcome disclosure, and limited consumer rights for people affected by covered automated decision-making technology (ADMT) used in consequential decisions such as employment, education, housing and financial services. Enforcement is also on hold in xAI's lawsuit against the attorney general (X.AI LLC v. Weiser, D. Colo. No. 1:26-cv-01515): on April 27, 2026 the court granted the parties' stipulation and ordered that the attorney general not start enforcement under SB 24-205, or legislation replacing it enacted that session, until 14 days after the court rules on xAI's preliminary injunction motion. xAI files that motion within 28 days after final rules are adopted.
Effective: January 1, 2027
Requires developers of generative AI systems made available to Californians to post high-level documentation of the data used to train them, including dataset sources, types of data, whether copyrighted material or personal information is included, how the data was acquired, and how it was modified. It covers systems released or substantially modified since January 1, 2022. xAI sued to block the law (xAI v. Bonta); the district court denied a preliminary injunction on March 4, 2026; xAI's appeal is pending at the Ninth Circuit (No. 26-1591).
Effective: January 1, 2026
Requires developers of frontier models (trained with more than 10²⁶ computing operations) to publish a transparency report before deploying a frontier model, and large frontier developers (annual revenue above $500 million) to publish a documented frontier AI framework. Developers must report critical safety incidents to the Office of Emergency Services within 15 days of discovery, or 24 hours where there is imminent risk of death or serious injury, and the law protects employees who report catastrophic risks from retaliation. The Attorney General can seek civil penalties of up to $1 million per violation. Narrower in scope than the vetoed SB 1047.
Effective: January 1, 2026
Would have required developers of covered AI models (trained with more than 10²⁶ operations at a compute cost above $100M) to implement a full shutdown capability and a written safety and security protocol before training, and from 2026 to retain a third-party auditor every year. It would also have created a Board of Frontier Models. The legislature gave final passage on August 29, 2024, and Governor Newsom vetoed it on September 29, 2024 on grounds that the bill was too broad and could inhibit AI development.
Took effect January 1, 2023, with enforcement beginning July 5, 2023. Requires employers and employment agencies in New York City to conduct independent bias audits of AI tools used in hiring decisions, publish audit results, and notify candidates that automated decision tools are being used.
Effective: January 1, 2023
Requires employers using AI to analyze video interviews to notify applicants, explain how the AI works and what characteristics it evaluates, obtain consent, limit who can access the videos, and destroy the videos within 30 days of the applicant's request.
Effective: January 1, 2020
Governor Hochul signed the RAISE Act on December 19, 2025 (Chapter 699), and a chapter amendment signed on March 27, 2026 (Chapter 96) is the final version. It covers frontier developers, meaning companies that trained a model with more than 10²⁶ operations: each must publish a transparency report when it deploys a new frontier model and report critical safety incidents to a new oversight office in the Department of Financial Services within 72 hours. Large frontier developers, those with annual revenue above $500 million, must also publish a frontier AI framework and file a disclosure statement with the office. The Attorney General can seek civil penalties from a large frontier developer of up to $1 million for a first violation and up to $3 million for later ones; the office can separately impose $1,000 per day for a missing disclosure statement. There is no private right of action. The law takes effect January 1, 2027.
Effective: January 1, 2027
HB 149, signed by Governor Abbott on June 22, 2025 and effective January 1, 2026. TRAIGA prohibits developing or deploying AI systems for specified harmful purposes under an intent-based standard, including behavioral manipulation, unlawful discrimination, unlawful deepfakes and child sexual abuse material, and infringement of constitutional rights. The Texas Attorney General has exclusive enforcement authority and must allow a 60-day cure period. There is no private right of action.
Effective: January 1, 2026
HB 2094 passed the Virginia legislature on February 20, 2025 and was vetoed by Governor Youngkin on March 24, 2025. It would have required developers and deployers of high-risk AI used in consequential decisions to disclose risks and limits and to maintain a risk management plan. The House sustained the veto on April 2, 2025. Virginia has no comprehensive AI law in force. Governor Spanberger's Executive Order 22 (September 18, 2026) rescinded Executive Order No. 30 (2024), but the AI policies, standards and guidelines published under it stay in effect until a later executive or agency action replaces them. EO 22 also set up a rapid-response AI Task Force.
Connecticut SB 5 (Public Act 26-15), signed by Governor Lamont on May 27, 2026, is formally titled An Act Concerning Online Safety and is also called the Connecticut Artificial Intelligence Responsibility and Transparency (CART) Act. It covers employment AI, AI companions, frontier models, and online safety. The first obligations start October 1, 2026, including the statutory framework for automated employment-related decision technology (AEDT), a rule that an employer's use of AEDT is not a defense to a discrimination complaint, and a requirement that WARN notices tell the Connecticut Department of Labor whether the layoffs are related to the employer's use of AI. AI companion rules follow on January 1, 2027. Employee and applicant notice duties and the developer information-sharing duty apply to AEDTs deployed on or after October 1, 2027, with further provisions phasing in through January 2028.
Effective: October 1, 2026
SB 1119, signed by Governor Newsom on September 10, 2026, expands California's companion chatbot rules for children. The law takes effect January 1, 2027, with most operator obligations starting July 1, 2027, including a pre-release risk assessment of harms to children for new or substantially modified chatbots. Operators must also undergo an independent child safety audit, first due by January 1, 2029 or before the chatbot is first made publicly available (whichever is later), and every two years after.
Effective: January 1, 2027
HB 26-1263, signed by Governor Polis on May 29, 2026, adds chatbot rules to Part 17 of the Colorado Consumer Protection Act, the part that also holds the state's automated decision-making law. From January 1, 2027, operators of conversational AI services open to the general public must tell users they are talking to AI, run a suicide and self-harm protocol, and add protections for users they know to be minors. The Attorney General's office calls it the Chatbot Safety Act and is writing one set of rules for it and SB 26-189.
Effective: January 1, 2027
SB 951 (Chapter 860), signed on September 30, 2026, adds AI to California's WARN Act. When a mass layoff, relocation or termination is caused in whole or in substantial part by an AI system or other automated technology that replaces or automates jobs, the employer's 60-day notice must say so and give details. The bill has no operative date of its own, so it takes effect January 1, 2027 under the state constitution's default rule.
Effective: January 1, 2027
The California Privacy Protection Agency's updated CCPA regulations, approved by the Office of Administrative Law on September 22, 2025 and in effect since January 1, 2026, add rules for automated decisionmaking technology (ADMT), risk assessments and cybersecurity audits. A business that uses ADMT to make a significant decision about a consumer, such as hiring, work allocation, pay, promotion, demotion, suspension, termination or access to healthcare services, must give a pre-use notice, offer an opt-out or a permitted alternative, and answer access requests. Businesses already using ADMT for such decisions must comply by January 1, 2027.
Effective: January 1, 2026
The UK's deliberate choice not to pass comprehensive AI legislation, instead directing existing regulators (ICO, CMA, FCA, etc.) to apply their existing powers to AI within their sectors. Prioritizes 'pro-innovation' flexibility over prescriptive rules, unlike the EU AI Act's single horizontal law.
Effective: March 29, 2023
On October 8, 2026 the Law Commission of England and Wales published Consultation Paper 279 on reforming Part 1 of the Consumer Protection Act 1987, the strict liability regime for defective products. Software and AI systems would be treated as products in their own right, whether embedded in a device, downloaded or accessed remotely. These are provisional proposals: the consultation runs until January 14, 2027 and final recommendations are expected in late 2027.
China's regulation governing generative AI services offered to the public in China, in force since August 15, 2023. Providers must follow content rules, including respect for socialist core values, sign service agreements with users, and protect users' input information and usage records. AI-generated content must be labeled under the separate Measures for Labeling AI-Generated Synthetic Content, in force since September 1, 2025. Services with public opinion properties or the capacity for social mobilization must complete a security assessment and file their algorithms. Since July 15, 2026, AI companion and other emotional-interaction services that simulate a human personality also fall under the Interim Measures for the Administration of AI Anthropomorphic Interactive Services (CAC Order No. 21, published April 10, 2026).
Effective: August 15, 2023
The international standard for AI management systems, published by ISO and IEC. Provides a framework for organizations to establish, implement, maintain, and continuously improve their AI governance practices. Certification to ISO 42001 is emerging as a signal of AI governance maturity in enterprise procurement.
Effective: December 18, 2023
AIDA was Part 3 of Bill C-27, which would have regulated high-impact AI systems. The bill died when the parliamentary session ended on January 6, 2025, so it never became law and Canada has no federal AI statute in force. AI Minister Evan Solomon has said he will not revive AIDA. The government's new privacy bill, C-36 (the Protecting Privacy and Consumer Data Act), had its first reading on June 15, 2026 and is at second reading in the House of Commons.
The Federal Trade Commission applies existing consumer protection law, the FTC Act's prohibition on unfair or deceptive acts, to AI products and services. Operation AI Comply (September 2024) brought five actions over deceptive AI product claims, an AI review generator, and AI-themed income schemes. The posture has since shifted: in December 2025 the FTC set aside its 2024 Rytr order, saying the complaint did not meet FTC Act requirements and the order unduly burdened AI innovation. Deceptive AI claims that harm consumers remain enforceable.
The Equal Employment Opportunity Commission issued technical assistance on May 18, 2023 explaining how Title VII disparate impact analysis applies to software, algorithms and AI used in hiring, promotion and performance management. The EEOC removed its AI guidance documents from its website on January 27, 2025. Technical assistance was never law: Title VII itself still applies. Executive Order 14281 (April 23, 2025) tells federal agencies to deprioritize enforcement of disparate-impact liability, naming the Title VII provision, and told the EEOC chair to review pending matters that rely on that theory. On June 4, 2026 the EEOC rescinded its 2024-2028 Strategic Enforcement Plan and replaced it with a National Enforcement Plan for fiscal years 2025-2029, which says the agency will eliminate disparate impact theories in investigations to the maximum degree possible and will not commence, develop, or continue litigation advancing disparate impact claims. These change federal enforcement priorities, not the statute: Title VII still contains its disparate-impact section (42 U.S.C. 2000e-2(k)). Correction, October 21, 2026: an earlier version of this entry said the 2024-2028 Strategic Enforcement Plan still listed technology-related discrimination as a priority; that plan was rescinded in June 2026.
In 2022 the CFPB issued Circular 2022-03, saying lenders must give specific, accurate reasons for adverse action even when a complex algorithm made the decision. The CFPB withdrew that circular on May 12, 2025, along with many other guidance documents. The underlying rule still applies: ECOA and Regulation B require specific reasons in an adverse action notice, so 'the model said no' is not enough. Separately, a final rule published April 22, 2026 and effective July 21, 2026 amended Regulation B to provide that ECOA does not authorize disparate-impact liability.
The FDA regulates AI and machine learning software that meets the definition of a medical device (Software as a Medical Device, or SaMD). Its January 2021 AI/ML action plan led to guidance on pre-market review and on predetermined change control plans (PCCPs). The FDA finalized its PCCP guidance for AI-enabled device software functions on December 4, 2024 and re-issued it on August 18, 2025, letting manufacturers pre-authorize planned modifications as part of a 510(k), De Novo or PMA submission instead of filing a new one for each change. On August 18, 2026 the FDA also published a discussion paper on regulating generative AI-enabled devices, with comments due by October 19, 2026 under docket FDA-2026-N-7874; the paper is not draft or final guidance. The FDA says it had authorized over 1,600 AI-enabled devices as of September 2026.
Effective: January 12, 2021
The SEC has no AI-specific disclosure rule. It applies existing antifraud, disclosure and marketing rules to AI claims and has brought 'AI washing' cases: on March 18, 2024 it charged two investment advisers, Delphia (USA) Inc. (a $225,000 penalty) and Global Predictions Inc. ($175,000), for false statements about their use of AI, and on January 14, 2025 it announced settled charges against Presto Automation Inc., a restaurant-technology company, for misleading statements about an AI product. Public companies must accurately disclose material AI risks and capabilities under existing rules.
On September 25, 2024 the European Commission announced that more than 100 companies had signed the EU AI Pact, a voluntary programme run ahead of the AI Act's full application. Signatories commit to three core actions: an AI governance strategy, mapping of AI systems likely to be high-risk under the AI Act, and AI literacy for staff. More than half also made further pledges such as human oversight, risk mitigation and labelling of deepfakes. It is not legally binding, and companies can join at any moment until the AI Act fully applies.
Effective: September 25, 2024
Canada's federal private-sector privacy law, in force in stages from January 1, 2001 and fully in force since January 1, 2004, governing how organizations collect, use, and disclose personal information in the course of commercial activity. The Office of the Privacy Commissioner has issued guidance on how PIPEDA applies to AI, including automated decision-making and AI training data. Quebec's Law 25 (phased in over three years starting September 22, 2022) is stricter and acts as the provincial overlay for Quebec residents.
Effective: January 1, 2001
The National AI Centre published Guidance for AI Adoption on October 21, 2025. The government describes it as updated and simplified guidance that evolves the 2024 Voluntary AI Safety Standard and its 10 guardrails. It sets out six essential practices: decide who is accountable, understand impacts and plan accordingly, measure and manage risks, share essential information, test and monitor, and maintain human control. It is voluntary.
Effective: October 21, 2025
Published by Singapore's Personal Data Protection Commission (PDPC), the second edition of the Model AI Governance Framework (January 21, 2020) provides non-binding, practical guidance for organizations deploying AI. It is organized around four areas: internal governance structures and measures, the level of human involvement in AI-augmented decisions, operations management, and stakeholder interaction and communication. IMDA added a Model AI Governance Framework for Generative AI on May 30, 2024. The Monetary Authority of Singapore has separate guidance for financial institutions, including its 2018 FEAT principles.
Effective: January 21, 2020
Status guide
Unfamiliar terms?
Conformity assessment, GPAI model, high-risk AI — all defined in plain English.
Browse the glossary →