Regulatory source register.

EU Artificial Intelligence Act

In force with phased application through 2 August 2027.

Applicability depends on role, system classification, use case, market connection, and territorial scope.

EU General Data Protection Regulation

In force.

Applies to covered personal-data processing. Article 22 addresses certain decisions based solely on automated processing.

UK GDPR

UK data-protection law in force.

Requirements depend on processing role, purpose, data, and context; official guidance reflects the Data (Use and Access) Act 2025.

FTC Act, Section 5

In force.

Prohibits unfair or deceptive acts or practices in or affecting commerce within the FTC's jurisdiction.

CCPA, as amended by CPRA

In force.

Applies to covered businesses and California consumers; duties depend on thresholds, data, purpose, and role.

Colorado Senate Bill 26-189

Became law 14 May 2026; core developer and deployer duties begin 1 January 2027.

Addresses developers and deployers of covered automated decision-making technology that materially influences consequential decisions, subject to statutory definitions and exemptions.

NYC Automated Employment Decision Tools law

Enforced since 5 July 2023.

Applies to covered tools used for specified New York City employment decisions.

Texas Responsible AI Governance Act

Effective 1 January 2026.

Applies to covered developers and deployers under Texas law, with role-specific duties, prohibitions, and exceptions.

Illinois AI employment amendments

Effective 1 January 2026.

Addresses AI use in covered employment decisions and employer notice obligations.

Canada PIPEDA

Current federal statute; official consolidation current to 26 May 2026.

Applies to personal information in commercial activities within statutory scope, subject to provincial and other exceptions.

Korea AI Basic Act

Effective 22 January 2026.

Applies under the Act's definitions, territorial provisions, high-impact AI rules, transparency duties, and exceptions.

Brazil LGPD

In force.

Applies to covered personal-data processing under its material and territorial provisions, subject to exceptions.

China generative-AI and algorithm rules

Generative-AI Measures effective 15 August 2023; algorithm-recommendation rules effective 1 March 2022.

Each instrument has its own service, territorial, and activity scope.

DSA, NIS2, and DORA

DSA and DORA are applicable regulations; NIS2 is implemented through national law.

DSA applies to covered intermediary services, NIS2 to covered entities in specified sectors, and DORA to specified financial entities and ICT arrangements.

NIST AI RMF 1.0

Voluntary framework; revision process announced.

Risk-management resource for voluntary use; not law and not proof of legal compliance.

NIST Cybersecurity Framework 2.0

Current voluntary cybersecurity framework.

General cybersecurity guidance; not an AI-specific law and not a certification.

ISO/IEC 42001:2023

International standard published December 2023.

Management-system standard; use or certification does not itself establish compliance with applicable law.

Model AI Governance Framework for Agentic AI, Version 1.5

Version 1.5 published 20 May 2026; updated 5 June 2026.

Voluntary governance guidance for organizations deploying agentic AI; not a substitute for applicable Singapore law.

Japan AI Guidelines for Business v1.2

Version 1.2 published 31 March 2026.

Non-binding guidance for AI business actors; applicable law and sector rules remain controlling.

Australia Guidance for AI Adoption

Version 1.0 published October 2025.

Voluntary responsible-adoption guidance; it does not itself create new legal obligations.

UK AI regulatory principles

Voluntary initial guidance published 6 February 2024.

Cross-sector principles for regulators; does not replace applicable law or regulator-specific rules.

MIT AI Risk Repository

Research repository.

Research taxonomy and evidence resource; not law, regulation, a compliance standard, or a certification.