AxiLayer AI crestAxiLayerAI™
AxiLayer AI Assurance Intelligence · Audit Mandates Map

Every AI Audit Rule, Everywhere You Operate

A global, source-linked register of the laws, regulations and official schemes that require or recognize an AI audit, assessment, registration or conformity check, across eight regions. Choose your industry and markets for an instant answer, or explore the map.

192
Mandates tracked, each linked to its official source
81
Countries and jurisdictions profiled
96
Mandates already in force
39
Mandates with a deadline in the next 12 months
8
Regions, from the Americas to Oceania
Get my instant answerExplore the world map

Last verified: 23 October 2026

Home / AxiLayer AI Assurance Intelligence / Audit Mandates Map
Instant answer

Which AI rules apply to you? Find out in seconds.

Choose your industry and the markets you operate in. The answer appears on screen at once, with every mandate, its next deadline and the official source. No sign-up needed.

Your markets
World map

AI audit and assessment rules around the world

Select a country to see where its AI regulation stands and every mandate we track there. Colors show the overall state of AI rules in each country as of 23 October 2026.

Select a country on the map.

Comprehensive AI lawSector rulesDraft AI lawGuidance onlyNo AI-specific rules yet
The register

Every mandate, source-linked and dated

United States 45

United States · IllinoisIn forceRisk management program

Biometric Information Privacy Act (BIPA)

740 ILCS 14
Who is covered
Private entities that collect or use biometric identifiers, including face geometry and voiceprints used by AI systems.
What is required
Written notice and release before collection, a public retention and destruction policy, and limits on sale or disclosure of biometric data.
Who performs it
The organization itself
Maximum penalty
liquidated damages of $1,000 per negligent and $5,000 per intentional or reckless violation
Industries
Biometrics & Digital Identity, AI Employment & Workforce Decisioning, Retail & E-commerce, Sports, Fitness & Wearables
How AxiLayer AI helps
Evidence that biometric AI pipelines capture consent, follow retention schedules and do not share data beyond what notices allow.
Source: ilga.gov (Aug 2024) · Last verified 23 October 2026
United States · CaliforniaIn forceImpact assessment

CCPA regulations on automated decisionmaking technology, risk assessments and cybersecurity audits

Cal. Code Regs. tit. 11, sec. 7001 et seq. (CPPA, approved Sep 2025)
Who is covered
Businesses subject to the CCPA that use automated decisionmaking technology for significant decisions or carry out high-risk processing.
What is required
Pre-use notices, opt-out and access rights for ADMT used in significant decisions, documented risk assessments with attestations filed with the agency, and annual cybersecurity audits for larger businesses.
Who performs it
Mixed (business risk assessments; independent auditor for cybersecurity audits)
Key dates
  • 1 Jan 2027 ADMT notice, opt-out and access duties apply
  • 31 Dec 2027 Risk assessments for processing that began before 2026 must be completed
  • 1 Apr 2028 First risk assessment submissions and first cybersecurity audit certifications (largest businesses) due
Maximum penalty
up to $2,500 per violation or $7,500 per intentional violation, adjusted for inflation
Industries
All industries
How AxiLayer AI helps
Risk assessment evidence and ADMT testing documentation in the form the regulations require for submission.
Source: cppa.ca.gov (Sep 2025) · Last verified 23 October 2026
United States · United States (federal)In forceRisk management program

CMS Medicare Advantage rule on algorithms in medical necessity decisions

CMS-4201-F (42 CFR 422.101(c))
Who is covered
Medicare Advantage organizations using algorithms or AI in coverage decisions.
What is required
Medical necessity determinations must be based on the individual enrollee's circumstances rather than an algorithm or software output alone.
Who performs it
Regulator
Maximum penalty
CMS enforcement and sanctions under Medicare Advantage rules
Industries
Insurance & Underwriting, Healthcare & Life Sciences
How AxiLayer AI helps
Decision-level evidence that coverage algorithms are reviewed against individual records and that humans make the final call.
Source: klrd.gov (2 Mar 2026) · Last verified 23 October 2026
United States · CaliforniaIn forceTransparency and labeling

California AI Transparency Act (SB 942, as amended by AB 853, SB 1000 and AB 2713)

Bus. & Prof. Code sec. 22757 et seq.
Who is covered
Providers of publicly accessible generative AI systems in California, large online platforms and, from 2028, capture device makers.
What is required
Providers must embed latent disclosures in AI-generated image, video and audio, offer a disclosure verification tool and let users add manifest disclosures; platforms must show available provenance data.
Who performs it
The organization itself
Key dates
  • 30 Sep 2026 SB 1000 urgency amendments in effect (all publicly accessible generative AI systems)
  • 1 Jan 2027 Large online platforms must surface provenance data (AB 2713)
  • 1 Jan 2028 Capture device manufacturer duties begin (AB 853)
Maximum penalty
$5,000 per violation per day
Industries
Synthetic Media & Deepfake Governance, Advertising, Media & Publishing, Online Platforms & Social Media
How AxiLayer AI helps
Testing evidence that watermarks and provenance data are embedded, survive common edits and are detected by the verification tool.
Source: wsgr.com (Oct 2026) · Last verified 23 October 2026
United States · CaliforniaIn forceRisk management program

California Department of Insurance Bulletin 2022-5 on AI and unfair discrimination

CDI Bulletin 2022-5 (30 Jun 2022)
Who is covered
Insurers and licensees using AI, algorithms or big data in marketing, rating, underwriting, claims or fraud work in California.
What is required
Licensees must avoid unfair discrimination from algorithms and data, conduct due diligence on models and data, and give specific reasons for adverse actions.
Who performs it
The organization itself
Maximum penalty
enforcement under the California Insurance Code
Industries
Insurance & Underwriting
How AxiLayer AI helps
Model fairness testing and adverse action reason validation evidence for Department of Insurance reviews.
Source: content.naic.org (8 Oct 2026) · Last verified 23 October 2026
United States · ColoradoIn forceRisk management program

Colorado governance and risk management framework for insurers' use of external consumer data, algorithms and predictive models

3 CCR 702-10 (Regulation 10-1-1), under SB 21-169
Who is covered
Life, private passenger auto and health benefit plan insurers using external consumer data, algorithms or predictive models in Colorado.
What is required
Insurers must maintain a governance and risk management framework, test for race-based unfair discrimination, remediate findings and file annual compliance reports.
Who performs it
The organization itself
Key dates
  • 15 Oct 2025 Amendments extend the rule to private passenger auto and health benefit plan insurers
  • 1 Jul 2026 First annual compliance report for newly covered insurers
  • 1 Jul 2027 Next annual compliance report due
Maximum penalty
enforcement under the Colorado Insurance Code
Industries
Insurance & Underwriting, Healthcare & Life Sciences
How AxiLayer AI helps
Quantitative unfair discrimination testing and framework documentation for the annual compliance report.
Source: willkie.com (Sep 2025) · Last verified 23 October 2026
United States · CaliforniaIn forceThird-party audit

Companion chatbot law (SB 243) as strengthened by Adam's Law (SB 1119)

California SB 243 (Stats. 2025); SB 1119 (Stats. 2026)
Who is covered
Operators of companion chatbots available to users in California.
What is required
Operators must disclose that the chatbot is AI, run crisis protocols, file annual reports, complete pre-release risk assessments, apply child safeguards and obtain an independent child safety audit every two years.
Who performs it
Mixed (operator assessments; third-party child safety audits)
Key dates
  • 1 Jan 2026 SB 243 disclosure and crisis protocol duties apply
  • 1 Jan 2027 SB 1119 effective
  • 1 Jul 2027 SB 1119 core obligations apply; SB 243 annual reports to the Office of Suicide Prevention begin
  • 1 Jan 2029 First child safety audit due for operators with $500 million or more in revenue (or before public release, if later)
  • 1 Jan 2032 First child safety audit due for other operators
Maximum penalty
private right of action, with damages of at least $1,000 per violation under SB 243
Industries
AI Companion Chatbots & Youth Digital Safety, Online Platforms & Social Media
How AxiLayer AI helps
Third-party child safety audit evidence and pre-release risk assessment reviews mapped to SB 243 and SB 1119.
Source: wsgr.com (Oct 2026) · Last verified 23 October 2026
United States · ConnecticutIn forceTransparency and labeling

Connecticut Artificial Intelligence Responsibility and Transparency (CART) Act (SB 5)

Connecticut SB 5 (2026)
Who is covered
Large generative AI providers, frontier developers, companion chatbot operators and employers using automated employment-related decision technology.
What is required
Provenance marking of AI-generated audio, image and video, chatbot disclosures and crisis protocols, and written notices to applicants and employees describing AEDT use, its purpose and the data it analyzes.
Who performs it
The organization itself
Key dates
  • 2 Jun 2026 Signed
  • 1 Oct 2026 Generative AI provenance duties and frontier whistleblower protections apply
  • 1 Jan 2027 Companion chatbot rules and frontier internal reporting apply
  • 1 Oct 2027 Employer notices for automated employment-related decision technology required
  • 31 Dec 2027 Discretionary 60-day cure period for AEDT violations ends
Maximum penalty
unfair trade practice enforcement by the Attorney General
Industries
AI Employment & Workforce Decisioning, Synthetic Media & Deepfake Governance, AI Companion Chatbots & Youth Digital Safety, Technology & Enterprise
How AxiLayer AI helps
Bias testing and AEDT documentation that employers can use for notices and as evidence in discrimination claims.
Source: ktslaw.com (29 Jun 2026) · Last verified 23 October 2026
United States · New YorkIn forceRisk management program

DFS Insurance Circular Letter No. 7: Use of AI and External Consumer Data in Underwriting and Pricing

NY DFS Insurance Circular Letter No. 7 (2024)
Who is covered
Insurers authorized in New York that use AI systems or external consumer data in underwriting or pricing.
What is required
Insurers must show their AI systems and data do not produce unfair or unlawful discrimination, test for disproportionate adverse effects, maintain governance and oversee third-party vendors.
Who performs it
The organization itself
Maximum penalty
enforcement under the New York Insurance Law
Industries
Insurance & Underwriting
How AxiLayer AI helps
Disparate impact testing and governance documentation that insurers can present in DFS examinations.
Source: content.naic.org (8 Oct 2026) · Last verified 23 October 2026
United States · United States (federal)In forceTransparency and labeling

Equal Credit Opportunity Act and Regulation B adverse action notices for AI credit decisions

15 U.S.C. 1691; 12 CFR 1002.9; CFPB Circulars 2022-03 and 2023-03
Who is covered
Creditors, including banks and fintech lenders, that use complex algorithms or AI models in credit decisions.
What is required
Creditors must give applicants the specific principal reasons for adverse action even when a complex or black-box model made the decision, which requires the ability to explain model outputs.
Who performs it
The organization itself
Key dates
  • 22 Apr 2026 CFPB final rule amending Regulation B (disparate impact, discouragement, special purpose credit programs)
Maximum penalty
actual and punitive damages up to $10,000 individually; class punitive damages up to the lesser of $500,000 or 1% of net worth
Industries
Banking, Financial Services & Fintech
How AxiLayer AI helps
Explainability testing and reason-code validation evidence showing adverse action reasons match what the model actually used.
Source: financialservicesperspectives.com (5 Aug 2026) · Last verified 23 October 2026
United States · United States (federal)In forceTransparency and labeling

FCC Declaratory Ruling: AI-generated voices are artificial voices under the TCPA

FCC 24-17 (CG Docket No. 23-362)
Who is covered
Anyone placing calls that use AI-generated or cloned voices to consumers in the United States.
What is required
Calls using AI-generated voices need the called party's prior express consent and must meet TCPA identification and disclosure rules.
Who performs it
Regulator
Maximum penalty
TCPA damages of $500 to $1,500 per call plus FCC forfeitures
Industries
Telecommunications AI Robocalls, Customer Service & Contact Centers, Elections and Political Advertising AI
How AxiLayer AI helps
Testing and records evidence that voice agents disclose their identity and that consent capture works before outbound AI calls.
Source: WWW.FCC.GOV (8 Feb 2024) · Last verified 23 October 2026
United States · United States (federal)In forceConformity assessment

FDA premarket review of AI-enabled device software functions, including Predetermined Change Control Plans

Final guidance on PCCPs for AI-enabled device software functions (Dec 2024); draft guidance FDA-2024-D-4488 (Jan 2025)
Who is covered
Manufacturers of medical devices with AI-enabled software functions reviewed through 510(k), De Novo or PMA.
What is required
Marketing submissions must document model development, validation and performance, and a PCCP must describe planned model changes, the validation methods and an impact assessment so changes can ship without a new submission.
Who performs it
Regulator
Key dates
  • 7 Jan 2025 Draft lifecycle and marketing submission guidance for AI-enabled device software functions published
Maximum penalty
device cannot be legally marketed without clearance or approval
Industries
Healthcare & Life Sciences, Pharmaceuticals & Biotech, Sports, Fitness & Wearables
How AxiLayer AI helps
Readiness evidence for FDA submissions: performance and bias testing, change-control validation and monitoring records mapped to FDA's guidance.
Source: fda.gov (Jan 2025) · Last verified 23 October 2026
United States · CaliforniaIn forceBias audit

FEHA regulations on automated-decision systems in employment

Civil Rights Council regulations on automated-decision systems (Cal. Code Regs., tit. 2)
Who is covered
Employers with five or more employees and their agents that use automated-decision systems in employment decisions.
What is required
Using an automated-decision system that discriminates is unlawful; anti-bias testing and its quality, scope and results are relevant evidence, and ADS records must be kept for four years.
Who performs it
The organization itself
Maximum penalty
FEHA remedies, including damages and attorneys' fees
Industries
AI Employment & Workforce Decisioning
How AxiLayer AI helps
Anti-bias testing evidence of the kind the regulations treat as relevant to an employer's defense.
Source: calcivilrights.ca.gov (Oct 2025) · Last verified 23 October 2026
United States · United States (federal)In forceRisk management program

GSA clause on Basic Safeguarding of Data within Large Language Model AI Systems

GSAR 552.239-7001 (GSAR class deviation)
Who is covered
Contractors and subcontractors supplying LLM, generative assistant, chatbot or agentic systems to GSA where Government Data is submitted to or produced by the system.
What is required
Contractors must safeguard, segregate and delete Government Data, may not train models on it, must configure LLMs to the Unbiased AI Principles, accept government automated assessments at any time and report material violations within 72 hours.
Who performs it
Mixed (contractor controls and attestations; government may test)
Key dates
  • 28 Sep 2026 Final clause text announced
  • 19 Oct 2026 Applies to new GSA task and delivery orders
Maximum penalty
contract remedies, including suspension of the AI service
Industries
Government & Public Sector, Technology & Enterprise
How AxiLayer AI helps
Third-party testing evidence and control attestations that contractors can rely on for flow-downs and the government's automated assessments.
Source: insidegovernmentcontracts.com (21 Oct 2026) · Last verified 23 October 2026
United States · CaliforniaIn forceTransparency and labeling

Generative AI Training Data Transparency Act (AB 2013)

Civ. Code sec. 3110 et seq.
Who is covered
Developers of generative AI systems made available to Californians.
What is required
Developers must post documentation on their websites summarizing the datasets used to train the system, including sources, data types and whether personal information or copyrighted data is included.
Who performs it
The organization itself
Maximum penalty
not specified
Industries
Technology & Enterprise, Synthetic Media & Deepfake Governance
How AxiLayer AI helps
Review of training data documentation against the statute's listed disclosure elements.
Source: leginfo.legislature.ca.gov (Sep 2024) · Last verified 23 October 2026
United States · IllinoisIn forceTransparency and labeling

Illinois Human Rights Act amendments on AI in employment (HB 3773)

Public Act 103-0804; 775 ILCS 5/2-102
Who is covered
Employers with one or more employees in Illinois that use AI in recruitment, hiring, promotion, discipline, discharge or other employment decisions.
What is required
Employers may not use AI that has a discriminatory effect on protected classes or use zip codes as a proxy, and must notify applicants and employees when AI is used.
Who performs it
The organization itself
Key dates
  • 2 Jun 2026 IDHR postponed its proposed notice rules
Maximum penalty
Illinois Human Rights Act remedies, including actual damages and attorneys' fees
Industries
AI Employment & Workforce Decisioning
How AxiLayer AI helps
Adverse impact testing across protected classes and proxy-variable review that supports an employer's non-discrimination position.
Source: seyfarth.com (8 Jun 2026) · Last verified 23 October 2026
United States · 27 states, DC and Puerto RicoIn forceRisk management program

NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers (state adoptions)

NAIC Model Bulletin (adopted Dec 2023), adopted by 29 jurisdictions as of 8 Oct 2026
Who is covered
Insurers using AI systems in adopting jurisdictions: AK, AR, CT, DE, DC, HI, IL, IA, KY, MD, MA, MI, MS, NE, NV, NH, NJ, NC, ND, OK, PA, PR, RI, SC, VT, VA, WA, WV and WI.
What is required
A written AI systems program with governance, risk management and internal controls, oversight of third-party AI vendors and data, and documentation regulators can request in market conduct exams.
Who performs it
The organization itself
Key dates
  • 8 Oct 2026 NAIC map shows 27 states, DC and Puerto Rico have adopted the bulletin
  • 14 Nov 2026 NAIC Fall National Meeting opens; AI evaluation tool and third-party vendor framework targeted for adoption
Maximum penalty
enforcement under each state's insurance code
Industries
Insurance & Underwriting
How AxiLayer AI helps
Third-party testing of insurer AI systems and vendor models, with documentation organized for market conduct examinations.
Source: content.naic.org (8 Oct 2026) · Last verified 23 October 2026
United States · New York CityIn forceBias audit

NYC Local Law 144: Automated Employment Decision Tools

NYC Local Law 144 of 2021; 6 RCNY 5-300
Who is covered
Employers and employment agencies using automated employment decision tools to screen candidates or employees for jobs in New York City.
What is required
An independent bias audit within one year before use, public posting of the audit summary, and notice to candidates and employees at least 10 business days before use.
Who performs it
Third party
Key dates
  • 5 Jul 2023 Enforcement began
Maximum penalty
$500 for a first violation and up to $1,500 for each later violation, per day of use
Industries
AI Employment & Workforce Decisioning
How AxiLayer AI helps
Bias audit evidence with impact ratios by sex and race or ethnicity categories, prepared to the DCWP rules for the annual audit and public summary.
Source: nyc.gov (Jul 2023) · Last verified 23 October 2026
United States · New YorkIn forceTransparency and labeling

New York AI companion models law

NY General Business Law Article 47
Who is covered
Operators of AI companion chatbots offered to users in New York.
What is required
Operators must detect and respond to suicidal ideation or self-harm with crisis referrals and remind users at least every three hours that they are not talking to a human.
Who performs it
The organization itself
Maximum penalty
Attorney General civil penalties of up to $15,000 per day
Industries
AI Companion Chatbots & Youth Digital Safety
How AxiLayer AI helps
Test evidence that crisis-detection protocols and recurring AI disclosures work in production conversations.
Source: privacyworld.blog (16 Sep 2026) · Last verified 23 October 2026
United States · United States (federal)In forceRisk management program

OMB M-25-21: Accelerating Federal Use of AI through Innovation, Governance, and Public Trust

OMB Memorandum M-25-21 (3 Apr 2025)
Who is covered
Federal executive agencies that develop, use or buy high-impact AI.
What is required
Before and during use of high-impact AI, agencies must run pre-deployment testing, complete an AI impact assessment, monitor performance and adverse impacts, train operators, keep human oversight and offer remedies or appeals, or stop using the system.
Who performs it
The organization itself
Key dates
  • 3 Apr 2025 Memo issued and effective
  • 3 Apr 2026 365-day deadline to document minimum risk practices for high-impact AI
Maximum penalty
not specified (agencies must discontinue non-compliant high-impact AI)
Industries
Government & Public Sector, Public Safety, Law Enforcement & Border, Defense & National Security
How AxiLayer AI helps
Pre-deployment test evidence and impact assessment documentation that agency and vendor teams can file against the memo's minimum practices.
Source: whitehouse.gov (3 Apr 2025) · Last verified 23 October 2026
United States · United States (federal)In forceRisk management program

OMB M-25-22: Driving Efficient Acquisition of Artificial Intelligence in Government

OMB Memorandum M-25-22 (3 Apr 2025)
Who is covered
Federal agencies acquiring AI systems or services and the vendors that supply them.
What is required
Agencies must build AI-specific requirements into acquisitions, including vendor documentation and testing information sufficient to manage high-impact AI risks and avoid lock-in.
Who performs it
Mixed (agency contracting officers, with vendor-supplied evidence)
Key dates
  • 30 Sep 2025 Applies to contracts awarded from solicitations issued on or after this date
  • 1 Oct 2025 Applies to option renewals and extensions exercised on or after this date
Maximum penalty
not specified (contract remedies)
Industries
Government & Public Sector, Technology & Enterprise, Defense & National Security
How AxiLayer AI helps
Vendor-side assessment evidence and documentation packages that answer agency AI solicitation requirements.
Source: sitepilot12.firmseek.com (Apr 2025) · Last verified 23 October 2026
United States · United States (federal)In forceTransparency and labeling

OMB M-26-04: Increasing Public Trust in AI Through Unbiased AI Principles

OMB Memorandum M-26-04 (11 Dec 2025), implementing EO 14319
Who is covered
Federal agencies buying large language models and the LLM vendors that sell to them, excluding national security systems.
What is required
LLM solicitations must require an acceptable use policy, model, system or data cards, end-user resources and a feedback mechanism, and agencies may ask for bias evaluation results, red teaming and benchmark information.
Who performs it
Mixed (vendors supply documentation; agencies evaluate)
Key dates
  • 11 Mar 2026 Agencies to update procurement policies
  • 11 Dec 2027 Memo expires two years after issuance unless OMB extends it
Maximum penalty
contract remedies, up to termination for default where designated material
Industries
Government & Public Sector, Technology & Enterprise
How AxiLayer AI helps
Bias evaluation results, benchmark testing and model documentation review that LLM vendors can submit with federal bids.
Source: whitehouse.gov (11 Dec 2025) · Last verified 23 October 2026
United States · 12 states (CA, CO, CT, GA, HI, ID, IA, NE, NH, NY, OR, WA)In forceTransparency and labeling

State companion chatbot laws (multistate)

Various state statutes enacted 2025 to 2026
Who is covered
Operators of companion or conversational chatbots that form ongoing relationships with users; customer service and productivity bots are generally excluded.
What is required
AI disclosures and periodic reminders, published suicide and self-harm protocols, blocking of sexual content for minors and, in some states, age estimation, parental controls and annual reports.
Who performs it
The organization itself
Key dates
  • 14 Jul 2026 Hawaii SB 3001 in force
  • 1 Jan 2027 Colorado, Connecticut, Oregon and Washington laws take effect
  • 1 Jul 2027 Georgia, Idaho, Iowa and Nebraska laws take effect
Maximum penalty
varies by state; private rights of action in California and Washington
Industries
AI Companion Chatbots & Youth Digital Safety, Online Platforms & Social Media
How AxiLayer AI helps
One test suite run against each state's disclosure, minor-protection and crisis-protocol rules, with findings mapped state by state.
Source: privacyworld.blog (16 Sep 2026) · Last verified 23 October 2026
United States · MultistateIn forceTransparency and labeling

State election deepfake and political advertising AI disclosure laws

Various, for example Texas Election Code sec. 255.004 (2019)
Who is covered
Candidates, committees, advertisers and others who distribute AI-generated or materially deceptive media about candidates or elections, usually within set pre-election periods.
What is required
More than 30 states regulate AI deepfakes in election communications (30 after Maryland signed on 13 May 2026), with on-screen disclaimers or bans on deceptive deepfakes of candidates close to an election. California AB 2839 (2025) and Hawaii Act 191 (30 Jan 2026) were struck down on First Amendment grounds.
Who performs it
The organization itself
Key dates
  • 3 Nov 2026 US general election; state pre-election deepfake windows apply
Maximum penalty
varies by state, from civil penalties and injunctions to criminal misdemeanors
Industries
Elections and Political Advertising AI, Advertising, Media & Publishing, Synthetic Media & Deepfake Governance
How AxiLayer AI helps
Review evidence that political ad workflows detect AI content and apply the disclaimer each state requires.
Source: citizen.org (13 May 2026) · Last verified 23 October 2026
United States · Multistate (including AZ, CA, MD, NE, TX)In forceRisk management program

State laws on AI in health insurance utilization review

CA SB 1120 (2024); AZ HB 2175, MD HB 820, NE LB 77, TX SB 815 (2025)
Who is covered
Health insurers, health plans and utilization review agents that use AI or algorithms in medical necessity and prior authorization decisions.
What is required
AI may not be the sole basis to deny, delay or modify care; a licensed clinician must make medical necessity denials, and tools must use individual clinical history and be open to state inspection or audit, with disclosure of AI use in some states.
Who performs it
Regulator
Key dates
  • 1 Jan 2025 California SB 1120 in force
  • 1 Sep 2025 Texas SB 815 in force
  • 1 Oct 2025 Maryland HB 820 in force
  • 1 Jan 2026 Nebraska LB 77 in force
  • 1 Jul 2026 Arizona HB 2175 in force
Maximum penalty
varies by state insurance code
Industries
Insurance & Underwriting, Healthcare & Life Sciences
How AxiLayer AI helps
Evidence that utilization review algorithms are tested, use individual records and route denials to licensed reviewers, ready for state inspection.
Source: klrd.gov (2 Mar 2026) · Last verified 23 October 2026
United States · United States (federal)In forceTransparency and labeling

TAKE IT DOWN Act

S. 146 (119th Congress), signed 19 May 2025
Who is covered
Covered online platforms that host user-generated content, and any person who publishes non-consensual intimate images, including AI-generated deepfakes.
What is required
Platforms must run a notice-and-removal process and remove reported non-consensual intimate imagery, including AI-generated depictions, within 48 hours of a valid request.
Who performs it
The organization itself
Key dates
  • 19 May 2026 Covered platforms must operate a notice-and-removal process
Maximum penalty
FTC Act civil penalties for platforms; criminal penalties for publishers
Industries
Online Platforms & Social Media, Synthetic Media & Deepfake Governance, AI Companion Chatbots & Youth Digital Safety
How AxiLayer AI helps
Evidence that takedown workflows, detection and 48-hour response times work as designed, from sampled testing of the removal process.
Source: congress.gov (19 May 2025) · Last verified 23 October 2026
United States · TexasIn forceTesting or sandbox

Texas Responsible Artificial Intelligence Governance Act (TRAIGA)

Texas HB 149 (89th Leg., 2025)
Who is covered
Developers and deployers of AI systems doing business in Texas, and Texas government entities.
What is required
Bans intentional harmful AI uses, requires government agencies to disclose AI interactions, offers a safe harbor for substantial compliance with the NIST AI RMF or similar standards and runs a 36-month regulatory sandbox.
Who performs it
Regulator
Key dates
  • 22 Jun 2025 Signed
Maximum penalty
up to $200,000 per uncurable violation and up to $40,000 per day for continuing violations
Industries
All industries
How AxiLayer AI helps
NIST AI RMF aligned assessments and red-team evidence that support the Act's safe harbors.
Source: bakerbotts.com (Jul 2025) · Last verified 23 October 2026
United States · CaliforniaIn forceRisk management program

Transparency in Frontier Artificial Intelligence Act (SB 53)

California SB 53 (Stats. 2025)
Who is covered
Frontier developers training models above 10^26 operations, with added duties for large frontier developers above $500 million in revenue.
What is required
Large developers must publish a frontier AI framework covering catastrophic risk assessment and use of third-party assessments, publish transparency reports at deployment, and report critical safety incidents to the Office of Emergency Services within 15 days.
Who performs it
The organization itself
Key dates
  • 29 Sep 2025 Signed
  • 1 Jan 2027 Office of Emergency Services begins annual anonymized incident reports
Maximum penalty
up to $1 million per violation
Industries
Technology & Enterprise
How AxiLayer AI helps
Third-party assessment evidence that large developers can cite in their frontier AI frameworks and transparency reports.
Source: afslaw.com (Oct 2025) · Last verified 23 October 2026
United States · UtahIn forceTesting or sandbox

Utah Artificial Intelligence Policy Act and AI learning laboratory

Utah SB 149 (2024), amended by SB 226 and SB 332 (2025)
Who is covered
Businesses using generative AI with consumers in Utah and persons in regulated occupations.
What is required
Generative AI use must be disclosed when asked and up front in high-risk interactions or regulated services; companies may apply to the learning laboratory for regulatory mitigation agreements.
Who performs it
Regulator
Maximum penalty
up to $2,500 per violation
Industries
All industries
How AxiLayer AI helps
Testing evidence on disclosures and system safeguards to support a learning laboratory application.
Source: le.utah.gov (Mar 2024) · Last verified 23 October 2026
United States · UtahIn forceTransparency and labeling

Utah mental health chatbot law (HB 452)

Utah HB 452 (2025)
Who is covered
Suppliers of AI mental health chatbots used by Utah residents.
What is required
Clear AI disclosures, limits on advertising and on use of user health data, with an affirmative defense for suppliers that maintain and file a written safety policy.
Who performs it
The organization itself
Maximum penalty
up to $2,500 per violation
Industries
Healthcare & Life Sciences, AI Companion Chatbots & Youth Digital Safety
How AxiLayer AI helps
Evidence supporting the written safety policy, including testing of disclosures and crisis responses.
Source: le.utah.gov (May 2025) · Last verified 23 October 2026
United States · IllinoisIn forceRisk management program

Wellness and Oversight for Psychological Resources Act (HB 1806)

Illinois HB 1806 (2025)
Who is covered
Any person or entity offering therapy or psychotherapy services in Illinois, including through AI.
What is required
AI may not provide therapeutic decision-making or therapy to clients; licensed professionals may use AI only for administrative and supplementary support.
Who performs it
Regulator
Maximum penalty
up to $10,000 per violation
Industries
Healthcare & Life Sciences, AI Companion Chatbots & Youth Digital Safety
How AxiLayer AI helps
Scope testing evidence that an AI tool stays within administrative or supplementary support and does not deliver therapy.
Source: idfpr.illinois.gov (4 Aug 2025) · Last verified 23 October 2026
United States · CaliforniaEnacted, future dateCertification scheme

AI Auditor Registry (AB 1405)

California AB 1405, Chapter 178, Statutes of 2026
Who is covered
Persons offering, selling or conducting covered AI audits, meaning audits of AI controls, processes or systems needed to comply with California law.
What is required
Auditors must register with the Government Operations Agency, display their registration number, meet independence rules and give the auditee a signed, dated statement that the audit followed the law.
Who performs it
Registered auditor
Key dates
  • 9 Sep 2026 Chaptered
  • 1 Jan 2029 Registry must be live; unregistered persons may not offer or conduct covered AI audits
Maximum penalty
removal from the registry and referral to the Attorney General
Industries
All industries
How AxiLayer AI helps
Audit reports structured with signed, dated attestations and independence records that match the registry's requirements.
Source: calmatters.digitaldemocracy.org (9 Sep 2026) · Last verified 23 October 2026
United States · IllinoisEnacted, future dateThird-party audit

Artificial Intelligence Safety Measures Act (SB 315)

Illinois SB 315 (2026)
Who is covered
Frontier AI developers, with the strictest duties on large frontier developers with more than $500 million in annual revenue.
What is required
Large frontier developers must retain a qualified third-party auditor for an annual compliance audit, publish audit summaries and file them within 30 days, adopt a frontier AI framework, publish transparency reports and report critical safety incidents within 72 hours.
Who performs it
Third party
Key dates
  • 6 Jul 2026 Signed by the Governor
  • 1 Jan 2027 Act effective; large frontier developers must keep a disclosure statement on file
  • 1 Jan 2028 Frontier AI framework and annual third-party audits begin
Maximum penalty
up to $1 million for a first violation and $3 million for each later violation
Industries
Technology & Enterprise
How AxiLayer AI helps
Annual third-party compliance audit work and signed findings against the Act's framework, reporting and incident requirements.
Source: gtlaw.com (Jul 2026) · Last verified 23 October 2026
United States · CaliforniaEnacted, future dateRisk management program

California clinical AI laws (AB 1979, SB 503, AB 3030)

California AB 1979 (2026); SB 503 (2026); AB 3030 (Stats. 2024)
Who is covered
Health facilities, clinics, physician practices, health chatbot providers, and developers and deployers of clinical decision support AI.
What is required
Developers must identify systems with foreseeable biased impact and give deployers documentation on intended use, training data, performance evaluation and bias mitigation; deployers must monitor and mitigate, AI may not perform functions reserved for licensed providers, and AI-generated patient communications need disclaimers.
Who performs it
The organization itself
Key dates
  • 1 Jan 2025 AB 3030 generative AI patient communication disclaimers apply
  • 1 Jan 2027 AB 1979 and SB 503 take effect
Maximum penalty
not specified
Industries
Healthcare & Life Sciences, Pharmaceuticals & Biotech, Sports, Fitness & Wearables
How AxiLayer AI helps
Bias and performance evaluation evidence for clinical AI documentation and ongoing deployer monitoring.
Source: wsgr.com (Oct 2026) · Last verified 23 October 2026
United States · ColoradoEnacted, future dateTransparency and labeling

Colorado Automated Decision-Making Technology Act (SB 26-189)

Colorado SB 26-189
Who is covered
Developers and deployers of covered ADMT that materially influences consequential decisions in employment, housing, credit, insurance, health care, education and essential government services.
What is required
Developers must give deployers documentation and keep records for three years; deployers must give notices, post-adverse-outcome explanations, human review or reconsideration, and data access and correction rights.
Who performs it
The organization itself
Key dates
  • 14 May 2026 Signed, repealing and reenacting the 2024 Colorado AI Act
  • 11 Aug 2026 Attorney General filed proposed rules
  • 1 Jan 2027 Act and rules take effect
  • 1 Jan 2030 60-day cure right reported to expire
Maximum penalty
deceptive trade practice enforcement by the Attorney General
Industries
AI Employment & Workforce Decisioning, Financial Services & Fintech, Insurance & Underwriting, Real Estate & Housing, Healthcare & Life Sciences, AI in Education & Academic Governance and more
How AxiLayer AI helps
Evidence packages documenting ADMT purpose, testing and human review steps that developers and deployers can keep for the Attorney General.
Source: coag.gov (21 Oct 2026) · Last verified 23 October 2026
United States · ColoradoEnacted, future dateRegistration or filing

Colorado Chatbot Safety Act (HB 26-1263)

Colorado HB 26-1263
Who is covered
Operators of publicly accessible conversational AI services in Colorado.
What is required
Operators must disclose AI, protect minors, run self-harm protocols and file annual reports with the Attorney General.
Who performs it
The organization itself
Key dates
  • 1 Jan 2027 Takes effect
Maximum penalty
Colorado Consumer Protection Act penalties, reported at up to $20,000 per violation
Industries
AI Companion Chatbots & Youth Digital Safety, Customer Service & Contact Centers
How AxiLayer AI helps
Testing evidence on minor protections and crisis protocols to support the annual report to the Attorney General.
Source: labs.cloudsecurityalliance.org (20 Oct 2026) · Last verified 23 October 2026
United States · CaliforniaEnacted, future dateTransparency and labeling

Customer service chatbot disclosure (AB 1609)

California AB 1609 (2026)
Who is covered
Businesses with more than $500 million in national gross annual revenue that use customer service chatbots.
What is required
Chatbots may not be represented as human, must be clearly disclosed, and customers must be able to reach a human agent within set timeframes.
Who performs it
The organization itself
Key dates
  • 1 Jan 2027 Takes effect
Maximum penalty
not specified
Industries
Customer Service & Contact Centers, Retail & E-commerce, Hospitality, Travel & Tourism
How AxiLayer AI helps
Conversation testing evidence that disclosures appear and human handoff works within the required times.
Source: wsgr.com (Oct 2026) · Last verified 23 October 2026
United States · CaliforniaEnacted, future dateCertification scheme

Independent Verification Organizations framework (SB 813)

California SB 813 (2026)
Who is covered
Organizations seeking state designation to verify AI systems and models, and developers that choose to use them.
What is required
Designated organizations must show AI risk expertise, technical competence and independence; an audit under an identified standard is relevant to, but not conclusive of, a harm claim.
Who performs it
Accredited body
Key dates
  • 9 Sep 2026 Signed
  • 1 Jan 2028 Government Operations Agency criteria for designating verification organizations due
Maximum penalty
not specified (voluntary designation)
Industries
All industries
How AxiLayer AI helps
Assessment evidence aligned to the standards a designated verification organization will apply, ready for designation-based reviews.
Source: wsgr.com (Oct 2026) · Last verified 23 October 2026
United States · CaliforniaEnacted, future dateRisk management program

No Robo Bosses Act (SB 947)

California SB 947 (2026)
Who is covered
California employers using automated decision systems in discipline or termination decisions.
What is required
Employers may not rely solely on ADS output for discipline or termination; when they rely primarily on it, a human must review and corroborate it and the worker must receive written notice.
Who performs it
The organization itself
Key dates
  • 30 Sep 2026 Signed
  • 1 Jul 2027 Compliance date
Maximum penalty
$500 per violation plus injunctive relief and punitive damages
Industries
AI Employment & Workforce Decisioning
How AxiLayer AI helps
Evidence that human review steps happen and that ADS outputs used in discipline are validated and documented.
Source: dwt.com (19 Oct 2026) · Last verified 23 October 2026
United States · New YorkEnacted, future dateRegistration or filing

Responsible AI Safety and Education (RAISE) Act

NY General Business Law Article 44-B, as amended by S8828 (2026)
Who is covered
Frontier developers of models trained above 10^26 operations that develop, deploy or operate them in New York, with added duties for large frontier developers above $500 million in revenue.
What is required
Large developers must publish and follow a frontier AI framework, file disclosure statements with the DFS oversight office, submit quarterly confidential catastrophic risk summaries, and all frontier developers must publish transparency reports and report critical safety incidents within 72 hours.
Who performs it
The organization itself
Key dates
  • 27 Mar 2026 Chapter amendment enacted aligning the Act with California SB 53
  • 1 Jan 2027 Act takes effect
  • 1 Jan 2028 Oversight office begins annual reporting
Maximum penalty
up to $1 million for a first violation and $3 million for later violations
Industries
Technology & Enterprise
How AxiLayer AI helps
Third-party assessment evidence and framework reviews that support transparency reports and the risk summaries filed with the oversight office.
Source: mofo.com (3 Apr 2026) · Last verified 23 October 2026
United States · UtahEnacted, future dateTransparency and labeling

Utah Digital Content Provenance Standards Act

Utah 2026 General Session
Who is covered
Developers and platforms that create or distribute AI-generated content in Utah.
What is required
Provenance metadata and consumer-facing cues for AI-generated content, especially deepfakes.
Who performs it
The organization itself
Key dates
  • 1 Jan 2027 Takes effect
Maximum penalty
not specified
Industries
Synthetic Media & Deepfake Governance, Online Platforms & Social Media
How AxiLayer AI helps
Testing evidence that provenance metadata is applied and preserved across the content pipeline.
Source: privacyworld.blog (16 Sep 2026) · Last verified 23 October 2026
United States · WashingtonEnacted, future dateTransparency and labeling

Washington AI companion chatbot law (HB 2225)

Washington HB 2225 (2026)
Who is covered
Operators of AI companion chatbots used in Washington.
What is required
AI disclosure at the start and every three hours (hourly for minors), protections against sexual content and manipulative engagement for minors, and published self-harm protocols with annual crisis referral counts.
Who performs it
The organization itself
Key dates
  • 24 Mar 2026 Signed
  • 1 Jan 2027 Takes effect
Maximum penalty
Consumer Protection Act enforcement by the Attorney General and a private right of action
Industries
AI Companion Chatbots & Youth Digital Safety
How AxiLayer AI helps
Conversation testing evidence on disclosures, minor protections and crisis referrals.
Source: hunton.com (Mar 2026) · Last verified 23 October 2026
United States · WashingtonEnacted, future dateTransparency and labeling

Washington AI provenance law (HB 1170)

Washington HB 1170 (2026)
Who is covered
Providers of generative AI systems and covered platforms in Washington.
What is required
Provenance and transparency marking of AI-generated content.
Who performs it
The organization itself
Key dates
  • 1 Feb 2027 Takes effect
Maximum penalty
not specified
Industries
Synthetic Media & Deepfake Governance, Online Platforms & Social Media
How AxiLayer AI helps
Testing evidence that provenance markers are applied and remain detectable.
Source: privacyworld.blog (16 Sep 2026) · Last verified 23 October 2026
United States · United States (federal)VoluntaryRisk management program

NIST AI Risk Management Framework (AI RMF 1.0) and Generative AI Profile

NIST AI 100-1 (Jan 2023); NIST AI 600-1 (Jul 2024)
Who is covered
Any organization that designs, develops, deploys or uses AI; referenced by federal procurement and by state laws such as Texas TRAIGA as a safe harbor.
What is required
Voluntary framework organized around Govern, Map, Measure and Manage functions for identifying, measuring and managing AI risks.
Who performs it
The organization itself
Maximum penalty
not specified (voluntary)
Industries
All industries
How AxiLayer AI helps
Assessments mapped to the AI RMF functions and the Generative AI Profile, producing evidence usable for state-law safe harbors.
Source: nist.gov (Jul 2024) · Last verified 23 October 2026

Canada and Latin America 21

Brazil · Brazil (federal judiciary)In forceImpact assessment

CNJ rules on AI in the Judiciary

Resolucao CNJ 615/2025 (replacing Resolucao 332/2020)
Who is covered
Brazilian courts and judges developing, contracting or using AI systems, including commercial tools.
What is required
Risk classification of AI systems; high-risk systems require continuous algorithmic impact assessment and regular audits, with registration and reports on the Sinapses platform and a 12-month transition for courts.
Who performs it
Mixed (courts assess; audits may be required by the CNJ National AI Committee)
Maximum penalty
not specified (non-compliant systems may be suspended)
Industries
AI in the Legal Profession and Courts, Government & Public Sector
How AxiLayer AI helps
Algorithmic impact assessment and audit evidence for high-risk judicial AI systems.
Source: mattosfilho.com.br (Mar 2025) · Last verified 23 October 2026
Brazil · Brazil (federal)In forceRisk management program

ECA Digital: Digital Statute of Children and Adolescents

Lei 15.211/2025; Decreto 12.880/2026
Who is covered
Providers of digital products and services likely to be accessed by children and adolescents, including app stores, operating systems, social networks, games and AI chatbots.
What is required
Age verification and age signals, safety by default, a ban on manipulative design and on loot boxes for children, disclosure that AI chatbots are automated, and child safety impact assessments; the ANPD has said compliance enforcement, focused on age verification, starts in January 2027.
Who performs it
Mixed (the organization; ANPD supervises and sets age-verification certification rules)
Key dates
  • 17 Sep 2025 Law signed; ANPD given competence by Decree 12.622
  • 17 Mar 2026 Law takes effect
  • 18 Mar 2026 Decree 12.880 published and in force
Maximum penalty
up to 10% of the economic group's revenue in Brazil, capped at BRL 50 million per infraction, plus suspension
Industries
Online Platforms & Social Media, AI Companion Chatbots & Youth Digital Safety, Gaming, Gambling & Betting, Consumer IoT & Smart Home
How AxiLayer AI helps
Child safety impact assessment support and testing evidence for age assurance and chatbot disclosure controls.
Source: www2.camara.leg.br (18 Mar 2026) · Last verified 23 October 2026
Brazil · Brazil (federal)In forceTransparency and labeling

LGPD right to review of automated decisions

Lei 13.709/2018 (LGPD), art. 20
Who is covered
Controllers that make decisions based solely on automated processing of personal data that affect data subjects' interests, including profiling.
What is required
Provide review of automated decisions and clear information on the criteria and procedures used; where trade secrets are claimed, the ANPD may audit for discriminatory aspects.
Who performs it
Mixed (the organization; the ANPD may audit)
Maximum penalty
up to 2% of revenue in Brazil, capped at BRL 50 million per infraction
Industries
All industries
How AxiLayer AI helps
Documentation of decision criteria and bias testing evidence that supports reviews and any ANPD audit.
Source: planalto.gov.br (Aug 2018) · Last verified 23 October 2026
Brazil · Brazil (federal)In forceTransparency and labeling

TSE rules on AI in electoral propaganda for the 2026 elections

Resolucao TSE 23.610/2019 as amended by Resolucao 23.732/2024 and Resolucao 23.755/2026
Who is covered
Candidates, parties, campaign advertisers and internet platforms during Brazilian elections.
What is required
AI-generated or manipulated campaign content must carry a prominent label naming the technology; deepfakes that harm or favor candidates are banned; platforms must keep integrity policies, remove unlawful content and offer an AI-use declaration field for boosted content; AI tools may not recommend candidates.
Who performs it
The organization itself
Key dates
  • 4 Mar 2026 Resolution 23.755 published
  • 4 Oct 2026 First round of general elections
  • 25 Oct 2026 Runoff, where applicable
Maximum penalty
not specified
Industries
Elections and Political Advertising AI, Synthetic Media & Deepfake Governance, Online Platforms & Social Media, Advertising, Media & Publishing
How AxiLayer AI helps
Testing evidence for AI content labeling and synthetic media detection controls on platforms.
Source: barbieriadvogados.com (Mar 2026) · Last verified 23 October 2026
Canada · Canada (federal)In forceImpact assessment

Directive on Automated Decision-Making and Algorithmic Impact Assessment

Treasury Board of Canada Secretariat, Directive on Automated Decision-Making (amended 24 June 2025)
Who is covered
Federal government institutions that use automated decision systems, including AI, to make or support administrative decisions about clients and, since 2023, internal services such as hiring and performance management.
What is required
Complete and publish an Algorithmic Impact Assessment before launch, with mitigations scaled to impact level I to IV; higher-impact systems need peer review with findings published before production, plus bias testing, data governance, explanation and monitoring.
Who performs it
Mixed (the institution completes the AIA; peer review is done by qualified reviewers outside the project team)
Key dates
  • 4 Mar 2019 Directive launched
  • 1 Apr 2020 All new automated decision systems must comply
  • 25 Apr 2023 Third-review amendments take effect (scope extended to internal services; AIA and peer review publication before launch)
  • 7 Jan 2025 Guide to Peer Review of Automated Decision Systems released
  • 24 Jun 2025 Fourth-review amendments take effect (transparency, senior accountability, testing and monitoring); AIA tool updated
Maximum penalty
not specified (Treasury Board policy compliance framework)
Industries
Government & Public Sector, Public Safety, Law Enforcement & Border, AI Employment & Workforce Decisioning
How AxiLayer AI helps
Peer review evidence and impact level documentation for Algorithmic Impact Assessments, including bias testing and monitoring findings mapped to the Directive.
Source: canada.ca (Sep 2026) · Last verified 23 October 2026
Canada · OntarioIn forceTransparency and labeling

Ontario AI disclosure in publicly advertised job postings

Employment Standards Act, 2000 as amended by the Working for Workers Four Act, 2024; O. Reg. 476/24
Who is covered
Ontario employers with 25 or more employees on the day a publicly advertised job posting is published.
What is required
State in the posting whether AI is used to screen, assess or select applicants, and keep postings and related application forms for three years.
Who performs it
The organization itself
Key dates
  • 1 Jan 2026 AI disclosure requirement for job postings takes effect
Maximum penalty
not specified
Industries
AI Employment & Workforce Decisioning
How AxiLayer AI helps
An inventory of AI hiring tools and assessment of how they screen or select applicants, supporting accurate disclosure.
Source: mccarthy.ca (Jan 2026) · Last verified 23 October 2026
Canada · Canada (federal)In forceConformity assessment

Pre-market guidance for machine learning-enabled medical devices

Health Canada guidance document under the Medical Devices Regulations (SOR/98-282)
Who is covered
Manufacturers seeking new or amended licences for Class II, III and IV machine learning-enabled medical devices.
What is required
Licence applications should include evidence on data representativeness, bias assessment including subgroup performance, performance and robustness testing, transparency labeling and, where used, a predetermined change control plan.
Who performs it
Regulator
Maximum penalty
not specified
Industries
Healthcare & Life Sciences, Pharmaceuticals & Biotech
How AxiLayer AI helps
Readiness evidence for license applications: subgroup performance and bias testing, robustness testing and transparency documentation.
Source: canada.ca (17 Sep 2026) · Last verified 23 October 2026
Canada · QuebecIn forceTransparency and labeling

Quebec Law 25: decisions based exclusively on automated processing

Act respecting the protection of personal information in the private sector, s. 12.1; Act respecting Access to documents held by public bodies and the Protection of personal information, s. 65.2 (as amended by S.Q. 2021, c. 25)
Who is covered
Private enterprises and public bodies in Quebec that make decisions about individuals based exclusively on automated processing of personal information.
What is required
Inform the person that the decision was made exclusively by automated processing, disclose on request the personal information used and the main factors and parameters, and allow review by a staff member; public bodies must also complete a privacy impact assessment before deploying such systems.
Who performs it
The organization itself
Key dates
  • 22 Sep 2023 Automated decision provisions take effect
Maximum penalty
private sector: administrative penalties up to CAD 10 million or 2% of worldwide turnover; penal fines up to CAD 25 million or 4%
Industries
All industries
How AxiLayer AI helps
Documentation of decision factors and parameters, explainability testing and privacy impact assessment support for automated decision systems.
Source: cdn-contenu.quebec.ca (Sep 2023) · Last verified 23 October 2026
Colombia · Colombia (national)In forceImpact assessment

SIC instructions on personal data processing in AI systems

Superintendencia de Industria y Comercio, Circular Externa 002 de 2024
Who is covered
Organizations that process personal data in AI systems in Colombia under Law 1581 of 2012.
What is required
Apply a suitability, necessity, reasonableness and proportionality test, obtain authorization for scraped private or sensitive data, and complete a privacy impact study before designing high-risk AI.
Who performs it
The organization itself
Maximum penalty
up to 2,000 monthly minimum wages
Industries
All industries
How AxiLayer AI helps
Privacy impact study support and proportionality documentation for AI systems processing personal data.
Source: slash-digital.io (26 Sep 2026) · Last verified 23 October 2026
Mexico · Mexico (federal)In forceTransparency and labeling

Federal Labor Law reform on digital platform work: algorithmic management

Ley Federal del Trabajo, Chapter IX Bis (arts. 291-A et seq., incl. 291-K and 291-P), reform published in the DOF on 24 December 2024
Who is covered
Digital platforms that engage platform workers in Mexico, such as ride-hailing and delivery apps.
What is required
Issue and update an algorithmic management policy explaining the elements algorithms use in decisions affecting workers, and provide review of decisions on platform access by human staff rather than algorithms.
Who performs it
The organization itself
Key dates
  • 24 Dec 2024 Reform published in the Diario Oficial de la Federacion
  • 22 Jun 2025 Obligations enforceable, 180 days after publication
Maximum penalty
fines up to 25,000 UMA
Industries
AI Employment & Workforce Decisioning, Online Platforms & Social Media, Autonomous Vehicles & Mobility
How AxiLayer AI helps
Assessment of algorithmic management systems and documentation supporting the required policy and human review mechanisms.
Source: gtlaw.com (Jan 2025) · Last verified 23 October 2026
Peru · Peru (national)In forceTransparency and labeling

Regulation of the AI Law (Law 31814)

Ley 31814; Reglamento approved by Decreto Supremo 115-2025-PCM
Who is covered
Public and private entities that develop or use AI systems in Peru, with phased adaptation periods of one to four years for the private sector.
What is required
Classification of AI uses as improper, high-risk or acceptable, with prior transparency required for high-risk uses under article 25.
Who performs it
The organization itself
Maximum penalty
not specified
Industries
All industries
How AxiLayer AI helps
Risk classification and transparency documentation for high-risk AI uses under the regulation.
Source: slash-digital.io (26 Sep 2026) · Last verified 23 October 2026
Canada · QuebecEnacted, future dateRisk management program

AMF Guideline for the Use of Artificial Intelligence

Autorite des marches financiers, Guideline for the Use of Artificial Intelligence (March 2026), issued under Insurers Act s. 463, Act respecting financial services cooperatives s. 565.1, Deposit Institutions and Deposit Protection Act s. 42.2, Trust Companies and Savings Companies Act s. 254
Who is covered
Authorized insurers, financial services cooperatives, authorized trust companies and other authorized deposit institutions in Quebec, for any use of an AI system.
What is required
A centralized AI system inventory with risk ratings, lifecycle controls including validation and explainability assessment and review of third-party components, bias and discrimination risk management, and client-facing disclosure, plain-language explanation of AI decisions and labeling of AI-generated content.
Who performs it
The organization itself
Key dates
  • 1 May 2027 Guideline takes effect
Maximum penalty
not specified (supervisory guideline)
Industries
Insurance & Underwriting, Banking, Financial Services & Fintech
How AxiLayer AI helps
Third-party validation, explainability and bias assessment evidence for AI systems in the AMF inventory, with findings mapped to the guideline's expectations.
Source: lautorite.qc.ca (Mar 2026) · Last verified 23 October 2026
Canada · OntarioEnacted, future dateRisk management program

Enhancing Digital Security and Trust Act, 2024: AI use by public sector entities

Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024, S.O. 2024, c. 24, Schedule 1
Who is covered
Ontario public sector entities prescribed by regulation, such as ministries, hospitals, school boards and children's aid societies, that use AI systems.
What is required
The Act came into force in January 2025 and authorizes regulations setting accountability, risk management and transparency requirements and technical standards for public sector AI use; as of March 2026 no AI regulation had been issued.
Who performs it
The organization itself
Maximum penalty
not specified
Industries
Government & Public Sector, Healthcare & Life Sciences, AI in Education & Academic Governance
How AxiLayer AI helps
Readiness evidence for expected accountability, risk management and transparency requirements, including AI inventories and risk assessments.
Source: ola.org (Mar 2026) · Last verified 23 October 2026
Canada · Canada (federal)Enacted, future dateRisk management program

OSFI Guideline E-23: Model Risk Management (2027)

OSFI Guideline E-23, Model Risk Management (final, September 2025)
Who is covered
All federally regulated financial institutions, including banks, insurers and foreign bank and insurance branches; federally regulated pension plans are excluded.
What is required
An enterprise model risk management framework covering all models, explicitly including AI and machine learning: a model inventory, risk ratings, lifecycle controls, monitoring for issues such as drift, and model review independent of model development, scaled to risk.
Who performs it
Mixed (the institution, using internal reviewers or objective third parties for independent model review)
Key dates
  • 11 Sep 2025 Final guideline published after consultation
  • 1 May 2027 Guideline takes effect after an 18-month transition
Maximum penalty
not specified (supervisory guideline)
Industries
Banking, Insurance & Underwriting, Financial Services & Fintech
How AxiLayer AI helps
Objective third-party model review and validation findings for AI and machine learning models, mapped to E-23 inventory, risk rating and monitoring expectations.
Source: osfi-bsif.gc.ca (11 Sep 2025) · Last verified 23 October 2026
Chile · Chile (national)Enacted, future dateTransparency and labeling

Personal Data Protection Law: automated individual decisions

Ley 21.719 (art. 8 bis)
Who is covered
Controllers processing personal data in Chile, including those using automated decision-making with legal or significant effects such as credit scoring or hiring.
What is required
Inform data subjects whether automated decisions are made, provide an explanation of automated decisions and honor the right to object to decisions based solely on automated processing.
Who performs it
The organization itself
Key dates
  • 1 Dec 2026 Law takes full effect; Agencia de Proteccion de Datos Personales begins enforcement
Maximum penalty
up to 20,000 UTM; repeated serious violations by larger companies up to 2% or 4% of annual revenue
Industries
All industries
How AxiLayer AI helps
Explainability testing and documentation of automated decision logic to support data subject explanations and objections.
Source: minsegpres.gob.cl (Nov 2025) · Last verified 23 October 2026
Brazil · Brazil (federal)ProposedImpact assessment

Brazilian AI Legal Framework bill (Marco Legal da Inteligencia Artificial)

PL 2338/2023
Who is covered
Developers, distributors and deployers of AI systems in Brazil, with heavier duties for high-risk systems.
What is required
Risk-based regime with prohibited uses, preliminary risk assessment, algorithmic impact assessments and governance measures for high-risk systems, under a national system coordinated by the ANPD.
Who performs it
Mixed (the organization, with algorithmic impact assessments under the bill's governance system coordinated by the ANPD)
Key dates
  • 10 Dec 2024 Approved by the Federal Senate
  • 20 May 2025 Chamber of Deputies special committee installed; rapporteur Aguinaldo Ribeiro designated
  • 24 Aug 2026 Rapporteur states the Chamber vote will follow the October 2026 elections
Maximum penalty
Senate text: up to BRL 50 million per infraction or 2% of revenue
Industries
All industries
How AxiLayer AI helps
Readiness evidence: risk classification and algorithmic impact assessment documentation aligned to the bill's high-risk duties.
Source: bairogonzalez.com (Oct 2026) · Last verified 23 October 2026
Canada · Canada (federal)ProposedTransparency and labeling

Protecting Privacy and Consumer Data Act (Bill C-36)

Bill C-36, 45th Parliament, 1st Session (first reading 15 June 2026)
Who is covered
Private-sector organizations that use automated decision systems, including machine learning, to make predictions, recommendations or decisions with a legal or similarly significant effect on individuals.
What is required
On request, explain an automated decision, including the types and sources of personal information and the main factors, and allow review by a human; privacy impact assessments are required before cross-border transfers and to rely on the legitimate interest exception.
Who performs it
The organization itself
Key dates
  • 15 Jun 2026 Tabled and given first reading in the House of Commons
Maximum penalty
administrative penalties up to the greater of CAD 10 million or 3% of gross global revenue; offences up to CAD 25 million or 5%
Industries
All industries
How AxiLayer AI helps
Readiness evidence: automated decision system inventories, explanation testing and impact assessment documentation.
Source: gowlingwlg.com (Jun 2026) · Last verified 23 October 2026
Canada · Canada (federal)ProposedRisk management program

Safe Social Media Act (Bill C-34), Digital Safety Act duties for AI chatbots

Bill C-34, 45th Parliament, 1st Session (introduced 10 June 2026)
Who is covered
Regulated social media services and certain AI chatbot services.
What is required
Chatbot operators must mitigate the risk of harmful content and harmful behavior and be transparent about crisis reporting thresholds; regulated services must identify risks of harm and file publicly disclosed digital safety plans, with oversight by a proposed Digital Safety Commission that may audit.
Who performs it
Mixed (the organization assesses and reports; the proposed Digital Safety Commission may audit)
Key dates
  • 10 Jun 2026 Bill introduced
Maximum penalty
not specified
Industries
AI Companion Chatbots & Youth Digital Safety, Online Platforms & Social Media
How AxiLayer AI helps
Readiness evidence: chatbot safety testing and documented harm-risk assessments for digital safety plans.
Source: canada.ca (10 Jun 2026) · Last verified 23 October 2026
Chile · Chile (national)ProposedRisk management program

Bill regulating artificial intelligence systems

Boletin 16821-19 (merged with 15869-19)
Who is covered
Providers and deployers of AI systems in Chile, with duties scaled across unacceptable, high, limited and no evident risk tiers.
What is required
Prohibition of unacceptable-risk systems, requirements for high-risk systems such as those used in hiring or credit, and transparency duties for limited-risk systems including deepfake provisions, enforced by the Agencia de Proteccion de Datos Personales.
Who performs it
The organization itself
Key dates
  • 7 May 2024 Introduced by presidential message
  • 13 Oct 2025 Dispatched by the Chamber of Deputies to the Senate
  • 1 Sep 2026 Executive renews simple urgency in the Senate
Maximum penalty
up to 20,000 UTM (text passed by the Chamber)
Industries
All industries
How AxiLayer AI helps
Readiness evidence: risk tier classification and high-risk system assessment documentation.
Source: camara.cl (1 Sep 2026) · Last verified 23 October 2026
Brazil · Brazil (federal)VoluntaryTesting or sandbox

ANPD regulatory sandbox on AI and personal data protection

ANPD Sandbox Regulatorio de IA e Protecao de Dados (final selection 14 October 2025)
Who is covered
Selected AI developers testing solutions under ANPD supervision.
What is required
Supervised experimentation focused on algorithmic transparency and personal data protection, running until December 2026.
Who performs it
Regulator
Key dates
  • 14 Oct 2025 Final selection of three participants announced
Maximum penalty
not specified
Industries
Technology & Enterprise
How AxiLayer AI helps
Algorithmic transparency documentation and testing evidence for sandbox participants.
Source: dplnews.com (15 Oct 2025) · Last verified 23 October 2026
Canada · Canada (federal)VoluntaryRisk management program

Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems

Innovation, Science and Economic Development Canada, voluntary code (September 2023)
Who is covered
Developers and managers of advanced generative AI systems that sign the code.
What is required
Signatories commit to measures on accountability, safety, fairness, transparency, human oversight and robustness, including risk assessment and testing.
Who performs it
The organization itself
Maximum penalty
not specified (voluntary)
Industries
Technology & Enterprise, Synthetic Media & Deepfake Governance
How AxiLayer AI helps
Third-party testing and assessment evidence that supports signatories' safety, fairness and robustness commitments.
Source: regulations.ai (2026) · Last verified 23 October 2026

Europe 36

European Union · EUIn forceRisk management program

Digital Operational Resilience Act ICT risk management and threat-led penetration testing

Regulation (EU) 2022/2554, Articles 5 to 16 and 24 to 27
Who is covered
Banks, insurers, investment firms, payment institutions and other EU financial entities, including their ICT systems that use AI.
What is required
Maintain an ICT risk management framework covering all ICT systems and third-party providers, with digital operational resilience testing; significant entities must run threat-led penetration testing at least every three years using qualified testers.
Who performs it
Mixed (the organization, with threat-led penetration tests by qualified external testers)
Maximum penalty
Set by Member States
Industries
Banking, Financial Services & Fintech, Insurance & Underwriting
How AxiLayer AI helps
Testing evidence on the resilience and security of AI components within the ICT risk framework.
Source: eur-lex.europa.eu (27 Dec 2022) · Last verified 23 October 2026
European Union · EUIn forceThird-party audit

Digital Services Act independent audits of very large online platforms and search engines

Regulation (EU) 2022/2065, Article 37; Commission Delegated Regulation (EU) 2024/436
Who is covered
Very large online platforms and very large online search engines designated by the Commission.
What is required
At least once a year, an audit by an organization independent of the provider of compliance with DSA obligations, including risk assessment and mitigation for recommender and other algorithmic systems, producing an audit report with an opinion and implementation report.
Who performs it
Third party
Maximum penalty
Up to 6% of worldwide annual turnover
Industries
Online Platforms & Social Media, Advertising, Media & Publishing, Technology & Enterprise, Retail & E-commerce
How AxiLayer AI helps
Algorithmic system testing and evidence on recommender and moderation systems that supports the provider's audit readiness.
Source: eur-lex.europa.eu (Feb 2024) · Last verified 23 October 2026
European Union · EUIn forceRisk management program

Digital Services Act systemic risk assessment

Regulation (EU) 2022/2065, Articles 34 and 35
Who is covered
Very large online platforms and very large online search engines.
What is required
Annually assess systemic risks stemming from the design and functioning of the service, including algorithmic systems, recommender systems and content moderation, and put in place mitigation measures.
Who performs it
The organization itself
Maximum penalty
Up to 6% of worldwide annual turnover
Industries
Online Platforms & Social Media, Advertising, Media & Publishing, Elections and Political Advertising AI, AI Companion Chatbots & Youth Digital Safety
How AxiLayer AI helps
Testing of recommender and generative features for systemic risk, with findings mapped to Articles 34 and 35.
Source: eur-lex.europa.eu (27 Oct 2022) · Last verified 23 October 2026
European Union · EUIn forceRisk management program

EU AI Act obligations for general-purpose AI models

Regulation (EU) 2024/1689, Articles 53 to 55 and 101
Who is covered
Providers of general-purpose AI models placed on the EU market, with additional duties for models with systemic risk.
What is required
Maintain technical documentation, give information to downstream providers, adopt a copyright policy and publish a training content summary; systemic-risk models must also perform model evaluations including adversarial testing, assess and mitigate systemic risks, report serious incidents and ensure cybersecurity.
Who performs it
Mixed (the provider, with model evaluations and adversarial testing that can involve external evaluators; enforcement by the Commission AI Office)
Key dates
  • 2 Aug 2025 GPAI model obligations apply to new models
  • 2 Aug 2026 Commission fining powers for GPAI providers apply
  • 2 Aug 2027 Models placed on the market before 2 Aug 2025 must comply
Maximum penalty
Up to EUR 15 million or 3% of worldwide annual turnover
Industries
Technology & Enterprise
How AxiLayer AI helps
Third-party evaluation and red-teaming evidence and documentation review mapped to Articles 53 and 55.
Source: eur-lex.europa.eu (12 Jul 2024) · Last verified 23 October 2026
European Union · EUIn forceRisk management program

EU AI Act prohibited practices, including new prohibitions on intimate imagery and CSAM

Regulation (EU) 2024/1689, Article 5, including points (1)(ba) and (1)(bb) added by Regulation (EU) 2026/1744
Who is covered
All providers and deployers of AI systems placed on the EU market or whose output is used in the EU.
What is required
Organizations must ensure no system performs a prohibited practice, which in practice requires screening of use cases and, for generative systems, safeguards against foreseeable generation of prohibited content.
Who performs it
The organization itself
Key dates
  • 2 Feb 2025 Original Article 5 prohibitions apply
  • 2 Dec 2026 New prohibitions apply: AI generating realistic intimate images of identifiable persons without consent, and AI generating child sexual abuse material
Maximum penalty
Up to EUR 35 million or 7% of worldwide annual turnover
Industries
All industries
How AxiLayer AI helps
A documented prohibited-practices screen and safeguard testing for generative systems, with signed findings.
Source: eur-lex.europa.eu (24 Jul 2026) · Last verified 23 October 2026
European Union · EUIn forceTransparency and labeling

EU AI Act transparency obligations for chatbots, generated content and deepfakes

Regulation (EU) 2024/1689, Article 50; Article 111 transitional rule added by Regulation (EU) 2026/1744
Who is covered
Providers of AI that interacts with people or generates synthetic audio, image, video or text, and deployers of emotion recognition, biometric categorization and deepfake systems.
What is required
Inform people they are interacting with AI, mark AI-generated content in a machine-readable and detectable format, and disclose deepfakes and AI-generated text published on matters of public interest.
Who performs it
The organization itself
Key dates
  • 2 Aug 2026 Article 50 applies
  • 2 Dec 2026 End of grace period for Article 50(2) machine-readable marking by generative systems placed on the market before 2 Aug 2026
Maximum penalty
Up to EUR 15 million or 3% of worldwide annual turnover
Industries
Synthetic Media & Deepfake Governance, AI Companion Chatbots & Youth Digital Safety, Customer Service & Contact Centers, Advertising, Media & Publishing, Online Platforms & Social Media, Technology & Enterprise and more
How AxiLayer AI helps
Testing evidence that disclosures and content marking work as designed, with signed findings mapped to Article 50.
Source: eur-lex.europa.eu (24 Jul 2026) · Last verified 23 October 2026
European Union · EUIn forceImpact assessment

GDPR automated decision-making rules and data protection impact assessments

Regulation (EU) 2016/679, Articles 22 and 35
Who is covered
Controllers processing personal data, including through AI systems, in the EU.
What is required
Carry out a DPIA before high-risk processing such as systematic evaluation or profiling with significant effects, and provide safeguards, including human intervention, for solely automated decisions with legal or similarly significant effects.
Who performs it
The organization itself
Maximum penalty
Up to EUR 20 million or 4% of worldwide annual turnover
Industries
All industries
How AxiLayer AI helps
Third-party review of AI-related DPIAs and testing of human intervention safeguards, with signed findings.
Source: eur-lex.europa.eu (4 May 2016) · Last verified 23 October 2026
European Union · EUIn forceConformity assessment

Medical Device Regulation conformity assessment for AI software

Regulation (EU) 2017/745
Who is covered
Manufacturers of medical device software, including AI-based diagnostic and therapeutic software.
What is required
Software in class IIa and above requires conformity assessment by a notified body, including clinical evaluation and quality management; from 2 Aug 2028 AI Act requirements are assessed within the same procedure.
Who performs it
Notified body
Maximum penalty
Set by Member States
Industries
Healthcare & Life Sciences, Pharmaceuticals & Biotech, Sports, Fitness & Wearables
How AxiLayer AI helps
Readiness evidence for notified body review: model validation, bias and performance testing, and documentation mapped to MDR and AI Act requirements.
Source: eur-lex.europa.eu (5 May 2017) · Last verified 23 October 2026
Germany · Germany (federal)In forceTesting or sandbox

AI Market Surveillance and Innovation Promotion Act (KI-MIG)

KI-Marktüberwachungs-und-Innovationsförderungs-Gesetz of 22 Jul 2026, BGBl. 2026 I Nr. 223
Who is covered
Providers and deployers of AI systems in Germany, with BaFin covering AI tied to regulated financial activities.
What is required
Implements AI Act supervision, creates an AI regulatory sandbox at the Bundesnetzagentur, and requires providers testing high-risk AI in real-world conditions outside a sandbox to submit a test plan to the market surveillance authority, deemed approved after 30 days without reply.
Who performs it
Regulator
Key dates
  • 29 Jul 2026 KI-MIG in force; Bundesnetzagentur becomes market surveillance authority and single point of contact
Maximum penalty
Up to EUR 50,000 for listed national violations, plus AI Act fines
Industries
All industries
How AxiLayer AI helps
Real-world test plans and readiness evidence for sandbox entry and market surveillance review.
Source: gesetze-im-internet.de (22 Jul 2026) · Last verified 23 October 2026
Italy · Italy (national)In forceTransparency and labeling

Italian national AI law and AI Act implementing decree

Law No. 132 of 23 Sep 2025; Legislative Decree No. 179 of 7 Oct 2026
Who is covered
Organizations developing or using AI in Italy, including employers, professionals, healthcare providers and public administrations.
What is required
Employers must inform workers when AI is used, professionals must inform clients about AI use, and AI in healthcare and public administration must keep human decision-making; the 2026 decree assigns supervision to ACN, Banca d'Italia, CONSOB, IVASS and the Garante.
Who performs it
Regulator
Key dates
  • 10 Oct 2025 Law No. 132/2025 in force
  • 23 Oct 2026 Legislative Decree No. 179/2026 in force, designating market surveillance authorities and sanctions
Maximum penalty
AI Act fines as applied by the designated authorities
Industries
AI Employment & Workforce Decisioning, Healthcare & Life Sciences, Government & Public Sector, Professional Services & Accounting, AI in the Legal Profession and Courts, Banking and more
How AxiLayer AI helps
Evidence that worker and client disclosures and human oversight controls are in place, with findings mapped to the Italian law and the AI Act.
Source: normattiva.it (8 Oct 2026) · Last verified 23 October 2026
Poland · Poland (national)In forceTesting or sandbox

Act on Artificial Intelligence Systems

Ustawa o systemach sztucznej inteligencji (2026)
Who is covered
Providers and deployers of AI systems in Poland.
What is required
Creates the KRiBSI commission to supervise the AI Act and handle complaints, and provides a legal basis for a regulatory sandbox in which certain provisions can be set aside for testing.
Who performs it
Regulator
Key dates
  • 11 Aug 2026 Act in force
  • 28 Oct 2026 Inspection, proceedings and penalty provisions apply
Maximum penalty
AI Act fines applied by KRiBSI
Industries
All industries
How AxiLayer AI helps
Readiness evidence for KRiBSI supervision and sandbox applications.
Source: samorzad.gov.pl (27 Jul 2026) · Last verified 23 October 2026
Switzerland · Switzerland (federal)In forceImpact assessment

Federal Act on Data Protection: automated individual decisions and DPIAs

Federal Act on Data Protection (FADP), SR 235.1, Articles 21 and 22
Who is covered
Private persons and federal bodies processing personal data in Switzerland, including through AI.
What is required
Inform data subjects of decisions based exclusively on automated processing with legal or significant effects and allow them to request human review; carry out a DPIA where processing may pose a high risk.
Who performs it
The organization itself
Maximum penalty
Fines of up to CHF 250,000 on responsible individuals
Industries
All industries
How AxiLayer AI helps
Review of AI-related DPIAs and testing of automated decision notices and human review, with signed findings.
Source: fedlex.admin.ch (1 Sep 2023) · Last verified 23 October 2026
United Kingdom · United Kingdom (central government)In forceRegistration or filing

Algorithmic Transparency Recording Standard

Algorithmic Transparency Recording Standard (ATRS)
Who is covered
UK central government departments and arm's-length bodies using algorithmic tools that affect the public.
What is required
Publish ATRS records describing algorithmic tools, their purpose, data, human oversight and risks.
Who performs it
The organization itself
Maximum penalty
not specified
Industries
Government & Public Sector, Public Safety, Law Enforcement & Border
How AxiLayer AI helps
Assessment evidence and documentation that public bodies can use in ATRS records.
Source: gov.uk (Feb 2024) · Last verified 23 October 2026
United KingdomIn forceRisk management program

Online Safety Act illegal content and children's risk assessments

Online Safety Act 2023
Who is covered
User-to-user and search services with UK users, including services with generative AI features.
What is required
Services must assess risks of illegal content and, where likely accessed by children, risks to children, and apply Ofcom's codes; Category 1 and 2A services must give Ofcom risk assessment records and publish summaries.
Who performs it
The organization itself
Key dates
  • 16 Mar 2025 Illegal content risk assessments due
  • 24 Jul 2025 Children's risk assessments due
Maximum penalty
Up to GBP 18 million or 10% of qualifying worldwide revenue
Industries
Online Platforms & Social Media, AI Companion Chatbots & Youth Digital Safety, Synthetic Media & Deepfake Governance, Gaming, Gambling & Betting
How AxiLayer AI helps
Testing evidence on recommender and generative AI features that feeds the service's risk assessments.
Source: ofcom.org.uk (24 Aug 2026) · Last verified 23 October 2026
United KingdomIn forceRisk management program

PRA Model risk management principles for banks

PRA Supervisory Statement SS1/23
Who is covered
UK banks, building societies and PRA-designated investment firms with internal model approval for credit, market or counterparty credit risk.
What is required
Firms must manage model risk across the model lifecycle, including AI and machine learning models, with third-party model validation as a core principle.
Who performs it
Mixed (the firm, with validation independent of model development)
Key dates
  • 17 May 2024 Original version effective
  • 23 Apr 2026 Updated version effective
Maximum penalty
not specified
Industries
Banking, Financial Services & Fintech
How AxiLayer AI helps
Third-party model validation evidence for AI and machine learning models, with signed findings mapped to the SS1/23 principles.
Source: bankofengland.co.uk (23 Apr 2026) · Last verified 23 October 2026
United KingdomIn forceImpact assessment

UK GDPR automated decision-making safeguards as amended by the Data (Use and Access) Act 2025

Data (Use and Access) Act 2025, section 80; SI 2026/82
Who is covered
Controllers making significant decisions about individuals based solely on automated processing.
What is required
Controllers must provide safeguards for significant solely automated decisions, including information, the ability to make representations, human intervention and the ability to contest, and must carry out DPIAs for high-risk processing.
Who performs it
The organization itself
Key dates
  • 5 Feb 2026 Section 80 automated decision-making provisions commence
  • 19 Jun 2026 New data protection complaints duties commence
Maximum penalty
Up to GBP 17.5 million or 4% of worldwide annual turnover
Industries
All industries
How AxiLayer AI helps
Testing of automated decision safeguards and review of DPIAs, with signed findings.
Source: legislation.gov.uk (29 Jan 2026) · Last verified 23 October 2026
European Union · EUEnacted, future dateTesting or sandbox

AI regulatory sandboxes and real-world testing under the EU AI Act

Regulation (EU) 2024/1689, Articles 57 to 60, as amended by Regulation (EU) 2026/1744
Who is covered
Providers and prospective providers of AI systems, with priority access for SMEs and start-ups.
What is required
Participants develop and test AI under a sandbox plan agreed with the competent authority and can receive an exit report usable as evidence in conformity assessment.
Who performs it
Regulator
Key dates
  • 2 Aug 2027 Each Member State must have at least one national AI regulatory sandbox operational
Maximum penalty
not specified
Industries
All industries
How AxiLayer AI helps
Test plans, documentation and assessment evidence prepared for sandbox entry and exit reports.
Source: eur-lex.europa.eu (24 Jul 2026) · Last verified 23 October 2026
European Union · EUEnacted, future dateRisk management program

Consumer Credit Directive creditworthiness assessment and automated processing safeguards

Directive (EU) 2023/2225, Article 18
Who is covered
Creditors offering consumer credit in the EU.
What is required
Creditworthiness assessments must use relevant and accurate information, and where they involve automated processing consumers can request human intervention, an explanation of the assessment and a review of the decision.
Who performs it
The organization itself
Key dates
  • 20 Nov 2026 National measures transposing the Directive apply
Maximum penalty
Set by Member States
Industries
Banking, Financial Services & Fintech, Retail & E-commerce
How AxiLayer AI helps
Testing of automated credit decisioning for accuracy, bias and explainability, with evidence of working human review.
Source: eur-lex.europa.eu (30 Oct 2023) · Last verified 23 October 2026
European Union · Council of Europe treaty (ratified by the EU)Enacted, future dateRisk management program

Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law

CETS No. 225
Who is covered
States that ratify it, which must apply it to AI activities of public authorities and address risks from private actors.
What is required
Parties must adopt measures for the identification, assessment, prevention and mitigation of risks and impacts of AI systems on human rights, democracy and the rule of law, including documentation and oversight.
Who performs it
Regulator
Key dates
  • 5 Sep 2024 Opened for signature in Vilnius
  • 15 May 2026 European Union deposits its instrument of ratification
Maximum penalty
not specified
Industries
All industries
How AxiLayer AI helps
Risk and impact assessment evidence aligned to the Convention's principles for public bodies and their suppliers.
Source: coe.int (15 May 2026) · Last verified 23 October 2026
European Union · EUEnacted, future dateConformity assessment

Cyber Resilience Act conformity assessment for products with digital elements

Regulation (EU) 2024/2847
Who is covered
Manufacturers, importers and distributors of hardware and software products with digital elements, including AI-enabled products.
What is required
Meet essential cybersecurity requirements and complete a conformity assessment; important and critical products may need a third-party assessment, and high-risk AI systems that comply are deemed to meet the AI Act cybersecurity requirement.
Who performs it
Mixed (self-assessment for most products; notified body for certain important and critical products)
Key dates
  • 11 Jun 2026 Provisions on notification of conformity assessment bodies apply
  • 11 Sep 2026 Reporting of actively exploited vulnerabilities and severe incidents applies
  • 11 Dec 2027 Main obligations, including essential cybersecurity requirements, apply
Maximum penalty
Up to EUR 15 million or 2.5% of worldwide annual turnover
Industries
Consumer IoT & Smart Home, Technology & Enterprise, Manufacturing & Industrial AI, Sports, Fitness & Wearables, Robotics & Physical AI
How AxiLayer AI helps
Security testing evidence for AI components and documentation mapped to the Act's essential requirements.
Source: eur-lex.europa.eu (20 Nov 2024) · Last verified 23 October 2026
European Union · EUEnacted, future dateImpact assessment

EU AI Act fundamental rights impact assessment

Regulation (EU) 2024/1689, Article 27, as amended by Regulation (EU) 2026/1744
Who is covered
Deployers of Annex III high-risk AI that are public bodies or private entities providing public services, and deployers using AI for creditworthiness or credit scoring and for life and health insurance risk assessment and pricing.
What is required
Before first use, the deployer must assess the system's impact on fundamental rights, notify the market surveillance authority of the results, and may refer to or incorporate an existing GDPR data protection impact assessment.
Who performs it
The organization itself
Key dates
  • 2 Dec 2027 Duty applies with the Annex III high-risk obligations
Maximum penalty
Up to EUR 15 million or 3% of worldwide annual turnover
Industries
Government & Public Sector, Banking, Financial Services & Fintech, Insurance & Underwriting, AI in Education & Academic Governance, Healthcare & Life Sciences and more
How AxiLayer AI helps
A structured fundamental rights impact assessment with third-party review and signed findings that can be filed with the authority.
Source: eur-lex.europa.eu (24 Jul 2026) · Last verified 23 October 2026
European Union · EUEnacted, future dateConformity assessment

EU AI Act high-risk requirements and conformity assessment for Annex III systems

Regulation (EU) 2024/1689, Articles 6(2), 8 to 17 and 43, Annex III, as amended by Regulation (EU) 2026/1744
Who is covered
Providers and deployers of stand-alone high-risk AI in areas such as biometrics, critical infrastructure, education, employment, essential services, credit, insurance, law enforcement, migration and justice.
What is required
Providers must operate a risk management system, data governance, technical documentation, logging, human oversight and accuracy and robustness controls, then complete a conformity assessment, sign an EU declaration of conformity and affix CE marking before placing the system on the market.
Who performs it
Mixed (internal control by the provider for most Annex III systems; a notified body for Annex III point 1 biometric systems where harmonized standards are not fully applied)
Key dates
  • 2 Dec 2027 Chapter III Sections 1 to 3 apply to Annex III high-risk systems
  • 2 Aug 2030 Deadline for high-risk systems used by public authorities, including those already in service
Maximum penalty
Up to EUR 15 million or 3% of worldwide annual turnover
Industries
AI Employment & Workforce Decisioning, AI in Education & Academic Governance, Banking, Financial Services & Fintech, Insurance & Underwriting, Biometrics & Digital Identity and more
How AxiLayer AI helps
Third-party assessment evidence, technical documentation review and signed findings mapped to Articles 9 to 15 and Annex IV to support the provider's conformity assessment.
Source: eur-lex.europa.eu (24 Jul 2026) · Last verified 23 October 2026
European Union · EUEnacted, future dateConformity assessment

EU AI Act high-risk requirements for AI in products under Annex I legislation

Regulation (EU) 2024/1689, Articles 6(1) and 43(3), Annex I, as amended by Regulation (EU) 2026/1744
Who is covered
Providers of AI systems that are safety components of, or are themselves, products covered by EU harmonization legislation such as medical devices, machinery, toys, lifts and radio equipment.
What is required
The AI Act requirements are checked within the product's existing third-party conformity assessment, so the technical documentation must also show compliance with the AI Act high-risk requirements.
Who performs it
Notified body
Key dates
  • 28 Jan 2028 Notified bodies under Annex I Section A legislation must apply for designation under the AI Act
  • 2 Aug 2028 Chapter III Sections 1 to 3 apply to Annex I product-embedded high-risk AI
Maximum penalty
Up to EUR 15 million or 3% of worldwide annual turnover
Industries
Healthcare & Life Sciences, Manufacturing & Industrial AI, Robotics & Physical AI, Consumer IoT & Smart Home, Autonomous Vehicles & Mobility, Aviation & Aeronautics and more
How AxiLayer AI helps
Readiness evidence for notified body review: gap assessment, test results and documentation mapped to the AI Act requirements and the product legislation.
Source: eur-lex.europa.eu (24 Jul 2026) · Last verified 23 October 2026
European Union · EUEnacted, future dateRegistration or filing

EU AI Act registration in the EU database for high-risk AI

Regulation (EU) 2024/1689, Articles 49 and 71, as amended by Regulation (EU) 2026/1744
Who is covered
Providers of Annex III high-risk AI, providers who self-assess an Annex III system as not high-risk under Article 6(3), and public-sector deployers.
What is required
Register the system and its key information in the EU database before placing it on the market or putting it into service; the omnibus simplifies the registration for Article 6(3) systems.
Who performs it
The organization itself
Key dates
  • 2 Dec 2027 Registration duties apply with the Annex III high-risk obligations
Maximum penalty
Up to EUR 15 million or 3% of worldwide annual turnover
Industries
All industries
How AxiLayer AI helps
Documented classification analysis, including Article 6(3) non-high-risk determinations, with third-party review to support the database entry.
Source: eur-lex.europa.eu (24 Jul 2026) · Last verified 23 October 2026
European Union · EUEnacted, future dateConformity assessment

Machinery Regulation third-party conformity assessment for self-evolving machine learning safety functions

Regulation (EU) 2023/1230, Annex I Part A
Who is covered
Manufacturers of machinery and safety components, including those whose safety functions use fully or partially self-evolving machine learning.
What is required
Machinery and safety components with self-evolving machine learning behavior that ensures safety functions are listed as high-risk and require third-party conformity assessment against essential health and safety requirements.
Who performs it
Notified body
Key dates
  • 20 Jan 2027 Machinery Regulation applies, replacing the Machinery Directive
Maximum penalty
Set by Member States
Industries
Manufacturing & Industrial AI, Robotics & Physical AI, Construction & Built Environment, Agriculture & AgriFood Tech, Mining & Natural Resources
How AxiLayer AI helps
Readiness evidence for notified body review: test results and documentation on machine learning safety functions.
Source: eur-lex.europa.eu (29 Jun 2023) · Last verified 23 October 2026
European Union · EUEnacted, future dateImpact assessment

Platform Work Directive algorithmic management safeguards

Directive (EU) 2024/2831, Chapter III
Who is covered
Digital labor platforms organizing work through automated monitoring or decision-making systems.
What is required
Platforms must inform workers about automated systems, ensure human oversight, and evaluate the impact of automated monitoring and decision-making systems on working conditions at least every two years, involving workers' representatives.
Who performs it
The organization itself
Key dates
  • 2 Dec 2026 Transposition deadline for Member States
Maximum penalty
Set by Member States
Industries
AI Employment & Workforce Decisioning, Online Platforms & Social Media, Hospitality, Travel & Tourism, Retail & E-commerce
How AxiLayer AI helps
Third-party evaluation of algorithmic management systems with signed findings for the biennial review.
Source: eur-lex.europa.eu (11 Nov 2024) · Last verified 23 October 2026
Ireland · Ireland (national)Enacted, future dateTesting or sandbox

Regulation of Artificial Intelligence Act 2026

Regulation of Artificial Intelligence Act 2026
Who is covered
Providers and deployers of AI systems subject to the AI Act in Ireland.
What is required
Sets up the AI Office of Ireland, gives market surveillance authorities enforcement powers, lets the Central Bank and the CCPC impose administrative sanctions, and provides for regulatory sandboxes and real-world testing; provisions take effect by ministerial commencement order.
Who performs it
Regulator
Key dates
  • 21 Jul 2026 Signed into law
  • 2 Aug 2026 AI Office of Ireland expected to be operational
Maximum penalty
Administrative sanctions under the AI Act
Industries
All industries
How AxiLayer AI helps
Readiness evidence for supervision by Irish sector regulators and sandbox applications.
Source: matheson.com (Jul 2026) · Last verified 23 October 2026
United KingdomEnacted, future dateConformity assessment

Automated Vehicles Act 2024 authorisation and statement of safety principles

Automated Vehicles Act 2024
Who is covered
Developers and operators of self-driving vehicles in Great Britain.
What is required
Vehicles must pass the self-driving test before authorization, with safety assessed against statutory safety principles requiring performance at least equal to careful and competent human drivers, using simulation, track and real-world evidence.
Who performs it
Regulator
Key dates
  • 17 Jun 2026 Statement of safety principles consultation opened
  • 9 Sep 2026 Consultation closed
Maximum penalty
not specified
Industries
Autonomous Vehicles & Mobility
How AxiLayer AI helps
Readiness evidence for authorization: scenario testing and safety case documentation.
Source: gov.uk (1 Oct 2026) · Last verified 23 October 2026
France · France (national)ProposedConformity assessment

Bill adapting French law to EU law (designation of AI Act authorities)

Assemblée nationale bill no. 2518
Who is covered
Providers and deployers of AI systems in France.
What is required
Would designate France's AI Act market surveillance authorities, with the DGCCRF coordinating and the CNIL, ACPR and other sector regulators covering their domains, and set the national penalty regime.
Who performs it
Regulator
Key dates
  • 18 Feb 2026 Adopted by the Senate
  • 20 Feb 2026 Transmitted to the National Assembly
Maximum penalty
not specified
Industries
All industries
How AxiLayer AI helps
Readiness evidence for supervision by the CNIL, DGCCRF and sector regulators.
Source: gouvernanceia.fr (5 Oct 2026) · Last verified 23 October 2026
Netherlands · Netherlands (national)ProposedConformity assessment

AI Act Implementation Act (draft)

Uitvoeringswet AI-verordening
Who is covered
Providers and deployers of AI systems in the Netherlands.
What is required
Would assign AI Act supervision to existing sector supervisors, with the AP as supervisor for areas lacking a clear supervisor and the AP and RDI coordinating.
Who performs it
Regulator
Key dates
  • 20 Apr 2026 Draft published for internet consultation
  • 1 Jun 2026 Consultation closed
Maximum penalty
not specified
Industries
All industries
How AxiLayer AI helps
Readiness evidence for supervision by Dutch sector supervisors.
Source: rijksoverheid.nl (20 Apr 2026) · Last verified 23 October 2026
Spain · Spain (national)ProposedTesting or sandbox

Organic Law on the good use and governance of artificial intelligence (bill)

Proyecto de Ley Orgánica para el buen uso y la gobernanza de la inteligencia artificial
Who is covered
Providers and deployers of AI systems in Spain.
What is required
Designates AESIA, the AEPD and the CGPJ as supervisors, sets a national AI sandbox run by AESIA, prohibits AI that generates sexual deepfakes and sets graded infringements.
Who performs it
Regulator
Key dates
  • 26 May 2026 Approved by the Council of Ministers and sent to Congress
Maximum penalty
Up to EUR 35 million or 7% of turnover
Industries
All industries
How AxiLayer AI helps
Readiness evidence for AESIA supervision and sandbox participation.
Source: digital.gob.es (26 May 2026) · Last verified 23 October 2026
Turkey · Turkey (national)ProposedTransparency and labeling

Draft law amending certain laws regarding artificial intelligence

Draft law submitted to the Grand National Assembly of Turkey (dated 7 Nov 2025)
Who is covered
AI developers, content providers and service providers in Turkey.
What is required
Would require clear, non-removable 'Generated by Artificial Intelligence' labels on deepfakes, auditable and traceable training data management, human oversight for high-risk categories and regular cybersecurity testing.
Who performs it
Regulator
Key dates
  • 7 Nov 2025 Draft dated and submitted to the Grand National Assembly
Maximum penalty
Proposed administrative fines up to TRY 10 million
Industries
Synthetic Media & Deepfake Governance, Online Platforms & Social Media, Technology & Enterprise
How AxiLayer AI helps
Readiness evidence on labeling, data governance and human oversight controls.
Source: morogluarseven.com (18 Dec 2025) · Last verified 23 October 2026
Netherlands · Netherlands (national government)VoluntaryRegistration or filing

Dutch Government Algorithm Register

Algoritmeregister van de Nederlandse overheid
Who is covered
Dutch government organizations using algorithms that affect citizens.
What is required
Public bodies publish descriptions of the algorithms they use, including purpose, data, human oversight and risk management.
Who performs it
The organization itself
Maximum penalty
not specified
Industries
Government & Public Sector, Public Safety, Law Enforcement & Border
How AxiLayer AI helps
Assessment evidence and plain-language documentation that public bodies can publish in the register.
Source: algoritmes.overheid.nl (Dec 2022) · Last verified 23 October 2026
United KingdomVoluntaryTesting or sandbox

FCA AI Live Testing

FCA AI Live Testing (second cohort)
Who is covered
Financial services firms preparing to deploy AI applications in UK markets.
What is required
Selected firms test AI applications with FCA support and a technical partner, focusing on risk management and live monitoring; testing for the second cohort ends by the end of 2026.
Who performs it
Regulator
Key dates
  • 21 Apr 2026 Second cohort of eight firms announced; testing began April 2026
Maximum penalty
not specified
Industries
Financial Services & Fintech, Banking, Insurance & Underwriting
How AxiLayer AI helps
Testing and monitoring evidence prepared for live testing participation.
Source: fca.org.uk (21 Apr 2026) · Last verified 23 October 2026
United KingdomVoluntaryTesting or sandbox

MHRA AI Airlock regulatory sandbox for AI as a medical device

MHRA AI Airlock
Who is covered
Developers of AI as a medical device.
What is required
Selected products are tested with the MHRA to identify regulatory challenges, with case study reports informing the UK framework for AI medical devices.
Who performs it
Regulator
Key dates
  • 9 Jun 2026 Phase 2 program report published (phase 2 ran April 2025 to May 2026)
Maximum penalty
not specified
Industries
Healthcare & Life Sciences
How AxiLayer AI helps
Validation and performance evidence prepared for sandbox participation and UK conformity assessment.
Source: gov.uk (9 Jun 2026) · Last verified 23 October 2026
United KingdomVoluntaryCertification scheme

Trusted Third-Party AI Assurance Roadmap

DSIT, Trusted third-party AI assurance roadmap (3 Sep 2025)
Who is covered
Providers of third-party AI assurance services in the UK and the organizations that use them.
What is required
Sets a path to professionalize AI assurance through a consortium developing a code of ethics and a skills and competencies framework, accredited ISO/IEC 42001 certification, and a GBP 11 million AI Assurance Innovation Fund.
Who performs it
Third party
Key dates
  • 3 Sep 2025 Roadmap published
  • 28 Sep 2026 One-year review event
Maximum penalty
not specified
Industries
All industries
How AxiLayer AI helps
Third-party AI assurance evidence and signed findings aligned to the roadmap's quality expectations.
Source: gov.uk (3 Sep 2025) · Last verified 23 October 2026

Middle East 13

Qatar · Qatar (QCB)In forceRegistration or filing

Artificial Intelligence Guideline for QCB-licensed entities

Qatar Central Bank AI Guideline, September 2024
Who is covered
Financial institutions licensed by the Qatar Central Bank.
What is required
Detailed reporting to QCB on each AI tool's intended use, data and expected outcomes before it is put into service, with prior QCB approval for high-risk AI and its outsourcing, plus governance, human oversight, customer disclosure and regular audits to detect bias.
Who performs it
Mixed (QCB approval, with the institution responsible for audits and oversight)
Key dates
  • 4 Sep 2024 QCB issues the guideline
Maximum penalty
not specified
Industries
Banking, Financial Services & Fintech
How AxiLayer AI helps
Pre-deployment assessment and bias audit evidence that supports a QCB approval submission.
Source: babl.ai (Sep 2024) · Last verified 23 October 2026
Saudi Arabia · Saudi Arabia (national)In forceImpact assessment

Personal Data Protection Law: risk assessment and consent for automated decisions

Personal Data Protection Law (Royal Decree M/19, as amended) and Implementing Regulations
Who is covered
Controllers processing personal data in Saudi Arabia, including those making decisions based on automated processing.
What is required
A data protection risk assessment for listed activities including decisions based on automated processing, explicit consent and added transparency for automated decision-making.
Who performs it
The organization itself
Key dates
  • 14 Sep 2023 PDPL enters into force
  • 14 Sep 2024 One-year transition ends and enforcement begins
Maximum penalty
Fines up to SAR 5 million, doubled for repeat violations
Industries
All industries
How AxiLayer AI helps
Assessment evidence for automated decision systems that supports the controller's PDPL risk assessment.
Source: lw.com (Dec 2023) · Last verified 23 October 2026
United Arab Emirates · Abu DhabiIn forceRisk management program

DOH Policy on Use of Artificial Intelligence in the Healthcare Sector and DOH Responsible AI Standard

Department of Health Abu Dhabi policy (2018) and Responsible Artificial Intelligence Standard (2025)
Who is covered
Healthcare entities in Abu Dhabi that develop or use AI.
What is required
AI governance structures, regular audits of AI functionality reported to DOH, incident reporting where patient safety is affected, and under the 2025 standard updated technical, data privacy, transparency and explainability conditions.
Who performs it
The organization itself (with reporting to DOH)
Maximum penalty
DOH sanctions (amount not specified)
Industries
Healthcare & Life Sciences
How AxiLayer AI helps
Periodic AI functionality audits, explainability testing and audit reports formatted for submission to DOH.
Source: ibanet.org (2025) · Last verified 23 October 2026
United Arab Emirates · DubaiIn forceRisk management program

Policy for Use of Artificial Intelligence in Healthcare in the Emirate of Dubai

Dubai Health Authority policy, August 2021
Who is covered
Designers, developers, operators and users of AI in Dubai healthcare.
What is required
AI must be free of bias, designed so failures can be diagnosed and controlled, and explainable to users regarding the AI's role and data; compliance is monitored by the DHA Health Regulation Sector.
Who performs it
Regulator (DHA monitors compliance)
Maximum penalty
DHA sanctions (amount not specified)
Industries
Healthcare & Life Sciences
How AxiLayer AI helps
Bias and explainability testing with documented findings that show conformity with the DHA policy.
Source: ibanet.org (Aug 2021) · Last verified 23 October 2026
United Arab Emirates · Dubai International Financial Centre (DIFC)In forceRisk management program

Regulation 10: Processing of Personal Data through Autonomous and Semi-Autonomous Systems

DIFC Data Protection Regulations, Regulation 10 (under DIFC Data Protection Law No. 5 of 2020)
Who is covered
Deployers and operators of AI and other autonomous or semi-autonomous systems that process personal data in or from the DIFC.
What is required
Notice to individuals at first use, a register of system use cases and processing activities, documented risk and impact assessments with human-intervention triggers, and for high-risk processing either Commissioner-set audit and certification requirements, human-defined purposes or an appointed Autonomous Systems Officer.
Who performs it
Mixed (the deployer or operator, with audit and certification requirements to be set by the Commissioner)
Key dates
  • 7 Sep 2023 DIFC announces enactment of amended Data Protection Regulations including Regulation 10
Maximum penalty
not specified
Industries
All industries
How AxiLayer AI helps
Readiness evidence for Regulation 10: AI register review, risk and impact assessment documentation and assessment findings that support future certification.
Source: mayerbrown.com (19 Jan 2026) · Last verified 23 October 2026
Bahrain · Bahrain (national)ProposedRisk management program

Artificial Intelligence Regulation Law proposal

38-article AI law proposal approved by the Shura Council, April 2024
Who is covered
Developers and users of AI in Bahrain, subject to the final text.
What is required
A standalone legal framework for AI use with criminal penalties for violations; detailed obligations depend on the text the government drafts and Parliament adopts.
Who performs it
Not specified
Key dates
  • 28 Apr 2024 Shura Council unanimously approves the proposal
Maximum penalty
Prison terms of at least three years or fines up to BD 2,000 (as proposed)
Industries
All industries
How AxiLayer AI helps
Readiness assessments that document AI governance controls ahead of a final law.
Source: gdnonline.com (29 Apr 2024) · Last verified 23 October 2026
Israel · Israel (national)ProposedImpact assessment

Privacy Protection Authority draft guidance on applying the Protection of Privacy Law to AI systems

PPA draft directive, 2025
Who is covered
Organizations that develop, train or use AI systems that process personal data in Israel.
What is required
Encourages data protection impact assessments for high-risk AI, particularly with biometric data, profiling or legally consequential decisions, a lawful basis for training data and limits on scraping.
Who performs it
The organization itself
Maximum penalty
not specified
Industries
All industries
How AxiLayer AI helps
AI impact assessment evidence and documentation aligned with the PPA's draft expectations.
Source: babl.ai (2 May 2025) · Last verified 23 October 2026
United Arab Emirates · Dubai International Financial Centre (DIFC)ProposedCertification scheme

Amended DIFC Data Protection Regulations (Regulation 10 update and new Regulation 11 on accreditation and certification)

DIFC Consultation Paper No. 3 of 2026
Who is covered
Controllers and processors in the DIFC that design, deploy or operate AI and other autonomous systems processing personal data.
What is required
Would clarify system certification obligations as a foundation for privacy by design, add a defined safety concept, set detailed Autonomous Systems Officer duties and skills, and empower the Commissioner to recognize accreditation and certification frameworks.
Who performs it
Mixed (certification under frameworks recognized by the DIFC Commissioner; details pending enactment)
Key dates
  • 18 Jun 2026 30-day public consultation opens
  • 18 Jul 2026 Consultation comment deadline
Maximum penalty
not specified
Industries
All industries
How AxiLayer AI helps
Pre-certification readiness assessments and documented evidence of privacy-by-design and safety controls for DIFC systems.
Source: difc.com (18 Jun 2026) · Last verified 23 October 2026
Saudi Arabia · Saudi Arabia (national)VoluntaryTransparency and labeling

Deepfakes Guidelines: Mitigating Risks While Fostering Innovation

SDAIA-P119
Who is covered
Developers of deepfake technology and creators of synthetic media in Saudi Arabia.
What is required
Embedded digital watermarks, model documentation, consent records that can be audited, human oversight and misuse detection; regulators are advised to keep annual use-case inventories and audits for high-risk areas.
Who performs it
The organization itself
Maximum penalty
not specified
Industries
Synthetic Media & Deepfake Governance, Advertising, Media & Publishing, Online Platforms & Social Media, Elections and Political Advertising AI
How AxiLayer AI helps
Testing of watermarking and provenance controls and review of consent records against the guidelines.
Source: arabnews.jp (May 2025) · Last verified 23 October 2026
Saudi Arabia · Saudi Arabia (national)VoluntaryRisk management program

National Artificial Intelligence Risk Management Framework

SDAIA National AI Risk Management Framework (2026)
Who is covered
All government and private organizations in the Kingdom that develop, operate or set policy for AI systems; SDAIA has not stated that it is mandatory.
What is required
A phased lifecycle method to define context, identify and score risks across seven categories using a likelihood and impact matrix, treat risks and keep a risk register under continuous monitoring and review.
Who performs it
The organization itself
Key dates
  • 14 Jul 2026 SDAIA announces the framework
Maximum penalty
not specified
Industries
All industries
How AxiLayer AI helps
Third-party review of AI risk registers and risk scoring, with findings mapped to the framework's seven risk categories.
Source: spa.gov.sa (14 Jul 2026) · Last verified 23 October 2026
Saudi Arabia · Saudi Arabia (national)VoluntaryCertification scheme

SDAIA AI Ethics Incentive Badges and accreditation certificates for AI service providers

SDAIA incentive badges (five levels) under the AI Ethics Principles
Who is covered
Entities offering AI products or services in Saudi Arabia that submit them for assessment.
What is required
Assessment of AI ethics maturity and product standards through SDAIA's evaluation tools, leading to one of five badge levels valid for one year and, for qualifying entities, an accreditation certificate.
Who performs it
Regulator (SDAIA)
Maximum penalty
not specified
Industries
Technology & Enterprise
How AxiLayer AI helps
Readiness assessments against SDAIA's AI Ethics Principles that prepare evidence for a badge or accreditation application.
Source: forbes.kz (3 Feb 2025) · Last verified 23 October 2026
United Arab Emirates · DubaiVoluntaryCertification scheme

Dubai AI Seal

Dubai Centre for Artificial Intelligence certification programme
Who is covered
Companies licensed to operate in Dubai that offer AI-based products or services or build AI into their offerings.
What is required
Companies apply to be certified and receive a serial number and a classification tier (Tier S is the highest); certification is described as a prerequisite for participation in upcoming government-led AI initiatives and projects.
Who performs it
Regulator (Dubai Centre for Artificial Intelligence)
Maximum penalty
not specified
Industries
Technology & Enterprise, Government & Public Sector
How AxiLayer AI helps
Assessment evidence and documentation packs that support an application for the Dubai AI Seal.
Source: mediaoffice.ae (15 May 2025) · Last verified 23 October 2026
United Arab Emirates · United Arab Emirates (federal, CBUAE)VoluntaryRisk management program

Guidance Note on the Consumer Protection and Responsible Adoption and Use of AI and Machine Learning by Licensed Financial Institutions

CBUAE Guidance Note, February 2026
Who is covered
All licensed financial institutions supervised by the CBUAE, including banks and insurers.
What is required
Supervisory expectations for an AI governance framework, an AI inventory with risk classification, model validation, bias testing at least annually and after material changes, explainability to customers and meaningful human oversight of high-impact decisions such as credit, pricing and insurance claims; the note is not legally binding but is expected to feature in supervisory assessments.
Who performs it
Mixed (the institution's board and control functions, with independent validation expected where AI affects access to products)
Key dates
  • 23 Feb 2026 CBUAE guidance note publicly reported as issued
Maximum penalty
not specified
Industries
Banking, Financial Services & Fintech, Insurance & Underwriting
How AxiLayer AI helps
Third-party model validation and bias testing evidence, AI inventory review and signed findings mapped to the guidance note's expectations.
Source: hadefpartners.com (8 Apr 2026) · Last verified 23 October 2026

Africa 7

Nigeria · Nigeria (federal, NITDA)In forceRegistration or filing

Guidelines for Clearance of IT Projects by Federal Public Institutions

NITDA guidelines, February 2025
Who is covered
Federal public institutions procuring AI-enabled IT systems valued at NGN 10 million or more.
What is required
Obtain NITDA clearance before procuring qualifying AI-enabled IT systems.
Who performs it
Regulator (NITDA)
Maximum penalty
not specified
Industries
Government & Public Sector
How AxiLayer AI helps
Pre-procurement assessment evidence for AI systems submitted for NITDA clearance.
Source: digitalpolicyalert.org (Feb 2025) · Last verified 23 October 2026
Nigeria · Nigeria (federal, NCC)In forceRegistration or filing

Internet Code of Practice 2026: AI deployment notification

NCC Internet Code of Practice 2026, section 5.4
Who is covered
Internet access service providers (telecom operators) licensed by the NCC.
What is required
Notify the NCC before deploying AI tools for network management or customer engagement, explaining why and how the tool works, and inform affected subscribers before changes take effect.
Who performs it
Regulator (NCC receives notifications)
Key dates
  • 13 Feb 2026 NCC releases the Internet Code of Practice 2026
Maximum penalty
not specified
Industries
Telecommunications AI Robocalls, Customer Service & Contact Centers, Technology & Enterprise
How AxiLayer AI helps
Pre-deployment assessment documentation that supports an NCC AI notification.
Source: technext24.com (13 Mar 2026) · Last verified 23 October 2026
Nigeria · Nigeria (federal)In forceImpact assessment

Nigeria Data Protection Act General Application and Implementation Directive

NDPC GAID 2025 under the Nigeria Data Protection Act 2023
Who is covered
Data controllers and processors subject to the Nigeria Data Protection Act 2023, including those deploying AI.
What is required
Mandatory data protection impact assessments for high-risk processing, with AI safeguards in system design, low-risk testing, post-deployment monitoring and discontinuation where risks cannot be mitigated.
Who performs it
The organization itself
Maximum penalty
not specified
Industries
All industries
How AxiLayer AI helps
AI impact assessment and post-deployment monitoring evidence that supports the controller's DPIA under the directive.
Source: digitalpolicyalert.org (Sep 2025) · Last verified 23 October 2026
Nigeria · Nigeria (federal, CBN)Enacted, future dateThird-party audit

Baseline Standards for Automated Anti-Money Laundering Solutions

Central Bank of Nigeria, June 2025
Who is covered
CBN-regulated financial institutions, which must deploy automated AML systems by March 2028.
What is required
Third-party annual validation of AI and machine learning models used in automated AML solutions.
Who performs it
Third party
Maximum penalty
not specified
Industries
Banking, Financial Services & Fintech
How AxiLayer AI helps
Third-party annual validation of AI and ML models used in AML monitoring with signed findings.
Source: digitalpolicyalert.org (Jun 2025) · Last verified 23 October 2026
Nigeria · Nigeria (federal)ProposedThird-party audit

National Digital Economy and E-Governance Bill

National Digital Economy and E-Governance Bill 2024
Who is covered
Developers and deployers of AI systems in Nigeria, with enhanced scrutiny for public administration, finance, automated decision-making and surveillance.
What is required
As reported, a risk-based framework with licensing or registration before deployment and mandatory annual audits for AI used in public administration, finance, automated decision-making and surveillance; the bill was at third reading in July 2026.
Who performs it
Not specified (NITDA would gain oversight powers)
Maximum penalty
Up to NGN 10 million or 2% of annual gross revenue (as reported)
Industries
Government & Public Sector, Financial Services & Fintech, Public Safety, Law Enforcement & Border, Technology & Enterprise
How AxiLayer AI helps
Annual AI audit readiness and third-party audit evidence for systems likely to fall in the bill's enhanced-scrutiny categories.
Source: iafrica.com (13 Jan 2026) · Last verified 23 October 2026
African Union · African Union (continental)VoluntaryRisk management program

Continental Artificial Intelligence Strategy

Endorsed by the AU Executive Council, 45th Ordinary Session, Accra, 18 to 19 July 2024
Who is covered
African Union member states.
What is required
Calls on member states to harmonize national AI strategies and create legal protections against AI bias and misuse, supported by a five-year implementation plan; it creates no direct obligations on companies.
Who performs it
Not applicable (policy framework for member states)
Key dates
  • 19 Jul 2024 AU Executive Council endorses the strategy
Maximum penalty
not specified
Industries
All industries
How AxiLayer AI helps
Assessment evidence mapped to the strategy's responsible AI principles for organizations operating across several African markets.
Source: au.int (28 Aug 2024) · Last verified 23 October 2026
Egypt · Egypt (national)VoluntaryConformity assessment

National AI Governance Framework (Edition 2.0)

NCAI document 2026-02FW-GOV-NCAI-EG
Who is covered
Developers and deployers of AI systems in Egypt, with the heaviest duties on high-risk systems in critical infrastructure and biometrics.
What is required
High-risk systems need a pre-deployment ethical AI impact assessment and technical testing, evaluation, verification and validation, a technical conformity certificate to enter the market, entry in an AI risk registry and post-deployment monitoring and incident reporting; conformity assessments are planned to become mandatory for high-risk sectors in the framework's second phase (months 12 to 24).
Who performs it
Accredited body (SECC under ITIDA conducts or oversees technical audits and accredits private audit firms)
Key dates
  • 15 Mar 2026 Framework edition 2.0 authorized for publication
Maximum penalty
not specified
Industries
All industries
How AxiLayer AI helps
Ethical impact assessment and technical testing evidence prepared for review by Egypt's conformity body and sector regulators.
Source: ai.gov.eg (15 Mar 2026) · Last verified 23 October 2026

Asia 42

China · China (national)In forceRisk management program

Amended Cybersecurity Law (AI provision and higher penalties)

Cybersecurity Law of the PRC, as amended by the NPC Standing Committee in October 2025
Who is covered
Network operators in mainland China, including AI service operators.
What is required
Adds the law's first explicit AI provision supporting AI development alongside stronger ethical norms and safety oversight, and raises penalties for cybersecurity violations.
Who performs it
The organization itself
Key dates
  • 1 Jan 2026 Amendments in force
Maximum penalty
up to RMB 10 million for entities and RMB 1 million for individuals
Industries
All industries
How AxiLayer AI helps
Readiness evidence: AI security control testing records aligned to cybersecurity obligations (rules described only).
Source: insideprivacy.com (Oct 2025) · Last verified 23 October 2026
China · China (national)In forceRisk management program

Interim Measures for the Administration of Anthropomorphic AI Interactive Services

CAC Order No. 21 (with NDRC, MIIT, MPS and SAMR)
Who is covered
Providers of AI companion, virtual relationship and other human-like emotional interaction services to users in mainland China.
What is required
Run a security assessment and submit a report to the provincial cyberspace authority at launch, on major changes, or on reaching 1 million registered or 100,000 monthly active users; complete algorithm filing; provide a minor mode and usage reminders; and have the handling of minors' personal information audited internally or by a qualified third party.
Who performs it
Mixed (provider assessment reviewed annually by provincial authorities; minors' data audit internal or by a qualified third party)
Key dates
  • 10 Apr 2026 Measures published
  • 15 Jul 2026 Measures in force
Maximum penalty
fines of RMB 10,000 to 100,000, up to RMB 200,000 where life or health is harmed, and service suspension
Industries
AI Companion Chatbots & Youth Digital Safety, Online Platforms & Social Media, Technology & Enterprise
How AxiLayer AI helps
Readiness evidence: safety, minor-protection and dependency-control test records mapped to the assessment report contents (rules described only).
Source: cac.gov.cn (10 Apr 2026) · Last verified 23 October 2026
China · China (national)In forceRegistration or filing

Interim Measures for the Management of Generative Artificial Intelligence Services

CAC and six other agencies, issued 10 July 2023, effective 15 August 2023
Who is covered
Providers of generative AI services to the public in mainland China, whether based inside or outside China.
What is required
Services with public opinion attributes or social mobilization capacity must complete a security assessment and algorithm filing before launch; the CAC publishes the list of filed services every two months.
Who performs it
Mixed (provider self-assessment, filing reviewed by the CAC)
Key dates
  • 10 Jul 2023 Final measures issued
  • 15 Aug 2023 Measures in force
  • 14 Sep 2026 CAC announced 124 newly filed generative AI services for July to August 2026
Maximum penalty
not specified
Industries
Technology & Enterprise, Online Platforms & Social Media, Synthetic Media & Deepfake Governance
How AxiLayer AI helps
Readiness evidence: security self-assessment support and test records mapped to the measures, for providers preparing filings (rules described only).
Source: reedsmith.com (2024) · Last verified 23 October 2026
China · China (national)In forceTransparency and labeling

Measures for Labeling AI-Generated and Synthetic Content, with mandatory national standard GB 45438-2025

CAC, MIIT, MPS and NRTA Labeling Measures (published 14 March 2025); GB 45438-2025
Who is covered
Generative and deep synthesis service providers and online content distribution platforms serving mainland China.
What is required
Add explicit visible labels and implicit metadata labels to AI-generated content, and platforms must take technical measures to regulate dissemination of synthetic content; removing or forging labels is prohibited.
Who performs it
The organization itself
Key dates
  • 14 Mar 2025 Measures and standard published
  • 1 Sep 2025 Measures and mandatory standard in force
Maximum penalty
not specified
Industries
Synthetic Media & Deepfake Governance, Online Platforms & Social Media, Advertising, Media & Publishing, Technology & Enterprise
How AxiLayer AI helps
Readiness evidence: label and metadata test results showing outputs meet the standard's explicit and implicit labeling methods (rules described only).
Source: cac.gov.cn (14 Mar 2025) · Last verified 23 October 2026
China · China (national)In forceImpact assessment

Measures for the Administration of AI Technology Ethics Review and Services (Trial)

MIIT Joint Science [2026] No. 75
Who is covered
Universities, research institutes, healthcare institutions and enterprises conducting AI research and development that may pose ethical risks.
What is required
Establish an AI ethics review committee or commission a qualified ethics review service center; listed high-risk activities (human-machine systems affecting behavior or health, opinion mobilization capabilities, highly autonomous decisions in safety scenarios) need expert re-review, with follow-up reviews generally at least every 12 months.
Who performs it
Mixed (internal committee or qualified third-party service center; expert re-review organized by authorities)
Key dates
  • 20 Mar 2026 Measures issued and in force
Maximum penalty
no standalone penalty; existing laws apply
Industries
Technology & Enterprise, Healthcare & Life Sciences, AI in Education & Academic Governance, Robotics & Physical AI, Neurotechnology & Neural Data
How AxiLayer AI helps
Readiness evidence: structured ethical risk documentation that review committees can use (rules described only).
Source: elawcn.com (9 Apr 2026) · Last verified 23 October 2026
China · China (national)In forceRegistration or filing

Provisions on the Administration of Algorithmic Recommendation for Internet Information Services (algorithm filing)

CAC and co-issuing agencies, Algorithmic Recommendation Provisions, effective 1 March 2022
Who is covered
Providers of algorithmic recommendation services with public opinion attributes or social mobilization capacity offered to users in mainland China.
What is required
File the algorithm with the CAC within 10 working days of providing the service, including a self-assessment report, security monitoring policy and emergency response plan; update filings within 10 working days of changes and cancel within 20 working days of ceasing service.
Who performs it
Regulator
Key dates
  • 1 Mar 2022 Provisions in force
Maximum penalty
fines up to RMB 100,000 for filing violations, plus possible service suspension
Industries
Online Platforms & Social Media, Advertising, Media & Publishing, Retail & E-commerce, Technology & Enterprise
How AxiLayer AI helps
Readiness evidence: algorithm documentation, self-assessment drafting support and control testing records mapped to the filing's required materials.
Source: reedsmith.com (2024) · Last verified 23 October 2026
China · China (national)In forceRegistration or filing

Provisions on the Administration of Deep Synthesis of Internet Information Services

CAC, MIIT and MPS, issued 25 November 2022, effective 10 January 2023
Who is covered
Deep synthesis service providers and technical supporters serving users in mainland China.
What is required
Both the service provider and the technical supporter must separately file their algorithms with the CAC, and generated content must carry labels.
Who performs it
Regulator
Key dates
  • 25 Nov 2022 Provisions issued
  • 10 Jan 2023 Provisions in force
Maximum penalty
not specified
Industries
Synthetic Media & Deepfake Governance, Online Platforms & Social Media, Advertising, Media & Publishing, Technology & Enterprise
How AxiLayer AI helps
Readiness evidence: documentation of synthesis models and labeling controls prepared for the filing and for labeling checks.
Source: reedsmith.com (2024) · Last verified 23 October 2026
Hong KongIn forceRisk management program

HKMA ART Framework and Supervisory Guidance for Responsible Adoption of AI

HKMA press release, 15 October 2026
Who is covered
Banks supervised by the HKMA.
What is required
Supervisory guidance on accountable, resilient and trustworthy AI adoption; an upcoming discussion paper will propose an agentic AI supervisory framework including a registry of material AI agents and intervention mechanisms.
Who performs it
The organization itself
Key dates
  • 15 Oct 2026 ART Framework and updated supervisory guidance announced
Maximum penalty
not specified
Industries
Banking, Financial Services & Fintech
How AxiLayer AI helps
Third-party assessment evidence and signed findings on AI governance, testing and agent controls mapped to the HKMA guidance.
Source: info.gov.hk (15 Oct 2026) · Last verified 23 October 2026
Hong KongIn forceRisk management program

SFC Circular to licensed corporations: Use of generative AI language models

SFC circular, 12 November 2024
Who is covered
SFC-licensed corporations using generative AI language models.
What is required
Senior management oversight, model risk management with validation and testing, cybersecurity and third-party controls; high-risk uses such as investment advice need model validation, human review and disclosure, and the SFC must be notified of plans to deploy them.
Who performs it
The organization itself (validation may be delegated, responsibility stays with the firm)
Key dates
  • 12 Nov 2024 Circular issued, effective immediately
Maximum penalty
not specified
Industries
Financial Services & Fintech
How AxiLayer AI helps
Model validation and robustness testing evidence for high-risk use cases, delivered as signed findings mapped to the circular.
Source: cliffordchance.com (2 Dec 2024) · Last verified 23 October 2026
India · India (national)In forceTransparency and labeling

IT (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules 2026 on synthetically generated information

MeitY amendment to the IT Rules 2021, notified 10 February 2026
Who is covered
Intermediaries, with added duties for significant social media intermediaries (over 5 million registered users in India).
What is required
Prominently label permitted synthetic content and embed permanent metadata or provenance identifiers; significant platforms must collect user declarations and use technical measures to verify them.
Who performs it
The organization itself
Key dates
  • 10 Feb 2026 Amendment notified
  • 20 Feb 2026 Amendment in force
Maximum penalty
not specified (loss of due diligence compliance and action under the IT Act)
Industries
Online Platforms & Social Media, Synthetic Media & Deepfake Governance, Advertising, Media & Publishing, Elections and Political Advertising AI
How AxiLayer AI helps
Test evidence on label, metadata and declaration-verification controls mapped to the amended rules.
Source: hlc.com (Feb 2026) · Last verified 23 October 2026
Japan · Japan (national)In forceRisk management program

Act on Promotion of Research and Development, and Deployment of AI-related Technology (AI Promotion Act) and Appropriateness Guidelines

Act No. 53 of 2025; AI Strategic Headquarters guidelines of 19 December 2025
Who is covered
AI business actors in Japan, which must cooperate with national AI policies.
What is required
Follow government AI policies and the appropriateness guidelines; the government analyzes AI risks and may request cooperation, and the second Basic Plan commits to reviewing the legal framework, including possible penalties.
Who performs it
The organization itself
Key dates
  • 28 May 2025 Act passed by the Diet
  • 19 Dec 2025 Guidelines on ensuring appropriateness of AI decided
  • 23 Dec 2025 First AI Basic Plan adopted
  • 14 Jul 2026 Second AI Basic Plan adopted
Maximum penalty
no monetary penalties
Industries
All industries
How AxiLayer AI helps
Assessment evidence showing alignment with the appropriateness guidelines and AISI evaluation themes.
Source: www8.cao.go.jp (14 Jul 2026) · Last verified 23 October 2026
Kazakhstan · Kazakhstan (national)In forceCertification scheme

Law on Artificial Intelligence: risk classification, high-risk risk management and trusted AI systems list

Law No. 230-VIII "On Artificial Intelligence"
Who is covered
Owners and proprietors of AI systems in Kazakhstan, with added duties for high-risk systems.
What is required
Classify systems as minimum, medium or high risk, run continuous lifecycle risk management and keep technical documentation for high-risk systems; inclusion on the list of trusted AI systems requires an audit by specialized private auditors.
Who performs it
Mixed (owner self-classification; audit for the trusted list by specialized private auditors)
Key dates
  • 17 Nov 2025 Law signed
  • 18 Jan 2026 Law in force
Maximum penalty
up to 200 MCI (about USD 1,700) for repeat violations by large enterprises
Industries
All industries
How AxiLayer AI helps
Readiness evidence: risk classification and lifecycle risk management records ahead of a trusted-list audit.
Source: ey.com (9 Dec 2025) · Last verified 23 October 2026
Kazakhstan · Kazakhstan (national)In forceTransparency and labeling

Law on Artificial Intelligence: synthetic content labeling and AI interaction notice

Law No. 230-VIII "On Artificial Intelligence"
Who is covered
Persons distributing synthetic AI output and operators of AI systems interacting with users in Kazakhstan.
What is required
Synthetic output may be distributed only with machine-readable labeling and a visual warning, and users must be told when they interact with AI.
Who performs it
The organization itself
Key dates
  • 18 Jan 2026 Law in force
Maximum penalty
up to 200 MCI (about USD 1,700) for repeat violations by large enterprises
Industries
Synthetic Media & Deepfake Governance, Online Platforms & Social Media, Advertising, Media & Publishing
How AxiLayer AI helps
Test evidence that labels and user notices meet the Law's requirements.
Source: ey.com (9 Dec 2025) · Last verified 23 October 2026
South Korea · South Korea (national)In forceImpact assessment

AI Basic Act: fundamental rights impact assessment (Article 35)

AI Basic Act, Article 35
Who is covered
Operators providing products or services that use high-impact AI.
What is required
Operators should make efforts to assess the impact on fundamental rights in advance; public agencies give priority in procurement to products and services that completed the assessment.
Who performs it
The organization itself or an outside assessor
Key dates
  • 22 Jan 2026 Provision in force
Maximum penalty
not specified
Industries
Government & Public Sector, Healthcare & Life Sciences, AI in Education & Academic Governance, AI Employment & Workforce Decisioning, Financial Services & Fintech
How AxiLayer AI helps
Third-party fundamental rights impact assessment reports with signed findings that support public procurement priority.
Source: fpf.org (Jan 2025) · Last verified 23 October 2026
South Korea · South Korea (national)In forceTransparency and labeling

AI Basic Act: generative AI notice and labeling (Article 31)

AI Basic Act, Article 31 and Enforcement Decree
Who is covered
Operators of high-impact or generative AI products and services in Korea.
What is required
Give advance notice that AI is used, label generative outputs in human-recognizable or machine-readable form, and clearly label realistic deepfake content.
Who performs it
The organization itself
Key dates
  • 22 Jan 2026 Notice and labeling duties in force
Maximum penalty
administrative fine up to KRW 30 million for notice violations; corrective orders for labeling
Industries
Synthetic Media & Deepfake Governance, Online Platforms & Social Media, Advertising, Media & Publishing, Technology & Enterprise
How AxiLayer AI helps
Test evidence that notices, visible labels and watermarks meet the Article 31 requirements.
Source: shinkim.com (11 Feb 2026) · Last verified 23 October 2026
South Korea · South Korea (national)In forceRisk management program

AI Basic Act: high-impact AI operator duties

Framework Act on the Development of Artificial Intelligence and Establishment of Trust (promulgated 21 January 2025) and Enforcement Decree
Who is covered
Operators of high-impact AI in areas such as energy, healthcare, nuclear operations, biometric analysis, public decision-making and education, plus large foreign operators via a domestic representative.
What is required
Pre-review whether a system is high-impact, then implement a risk management plan, explanation plan, user protection measures and human oversight, keep safety documentation for five years and publish key measures.
Who performs it
The organization itself (MSIT may confirm high-impact status on request)
Key dates
  • 21 Jan 2025 Act promulgated
  • 22 Jan 2026 Act and Enforcement Decree in force; MSIT grace period of at least one year for investigations and fines begins
Maximum penalty
administrative fine up to KRW 30 million
Industries
Energy & Grid Infrastructure, Healthcare & Life Sciences, Biometrics & Digital Identity, Government & Public Sector, AI in Education & Academic Governance, AI Employment & Workforce Decisioning and more
How AxiLayer AI helps
Third-party assessment evidence and signed findings mapped to the Act's high-impact risk management and documentation duties.
Source: shinkim.com (11 Feb 2026) · Last verified 23 October 2026
South Korea · South Korea (national)In forceRisk management program

AI Basic Act: safety duties for large-scale AI systems

AI Basic Act and Enforcement Decree (training compute threshold of 10^26 FLOPs)
Who is covered
Developers and operators of AI systems trained with at least 10^26 FLOPs of cumulative compute, among other criteria.
What is required
Identify, assess and mitigate risks across the lifecycle and submit results of safety measures to MSIT.
Who performs it
The organization itself, reporting to the regulator
Key dates
  • 22 Jan 2026 Safety duties in force
Maximum penalty
not specified
Industries
Technology & Enterprise
How AxiLayer AI helps
Readiness evidence: risk evaluation and red-team test records supporting the safety submission.
Source: trade.gov (29 May 2026) · Last verified 23 October 2026
TaiwanIn forceImpact assessment

Artificial Intelligence Basic Act: government AI risk assessment (Article 19)

Presidential Order Hua-Zong-Yi-Yi-Zi No. 11500001671, 14 January 2026, Article 19
Who is covered
Government agencies that use AI to perform duties or provide services.
What is required
Conduct a risk assessment and plan mitigation measures before using AI, and set usage rules or internal control mechanisms.
Who performs it
The organization itself
Key dates
  • 23 Dec 2025 Passed by the Legislative Yuan
  • 14 Jan 2026 Promulgated and in force
  • 14 Jan 2028 Two-year deadline for competent authorities to align laws and administrative measures
Maximum penalty
not specified
Industries
Government & Public Sector
How AxiLayer AI helps
Third-party risk assessment evidence and signed findings that agencies can attach to their Article 19 assessments.
Source: leeandli.com (Jan 2026) · Last verified 23 October 2026
Thailand · Thailand (national)In forceRisk management program

BOT AI Risk Management Guidelines for Financial Service Providers

Bank of Thailand, issued 12 September 2025
Who is covered
Financial institutions, specialized financial institutions and payment service providers supervised by the BOT, for in-house and third-party AI.
What is required
Board accountability, an AI usage policy, lifecycle risk management covering data, model and cybersecurity risk, testing and monitoring before and after deployment, customer notice and human oversight scaled to risk.
Who performs it
The organization itself
Key dates
  • 12 Sep 2025 Guidelines issued
Maximum penalty
not specified
Industries
Banking, Financial Services & Fintech
How AxiLayer AI helps
Third-party testing and assessment evidence mapped to the Guidelines' risk areas.
Source: tilleke.com (Sep 2025) · Last verified 23 October 2026
Vietnam · Vietnam (national)In forceTransparency and labeling

Law on Artificial Intelligence: AI interaction disclosure and content marking

Law No. 134/2025/QH15; Decree 142/2026/ND-CP
Who is covered
Providers and deployers of AI systems generating audio, image or video content in Vietnam.
What is required
Tell users when they interact with AI, apply machine-readable markings to AI-generated audio, images and video, and visibly label content simulating real people or events.
Who performs it
The organization itself
Key dates
  • 1 Mar 2026 Law in force
  • 1 May 2026 Decree 142 marking rules in force
Maximum penalty
not specified
Industries
Synthetic Media & Deepfake Governance, Online Platforms & Social Media, Advertising, Media & Publishing
How AxiLayer AI helps
Test evidence that disclosures and machine-readable markings meet the Law and Decree.
Source: rajahtannasia.com (20 Jan 2026) · Last verified 23 October 2026
Vietnam · Vietnam (national)In forceConformity assessment

Law on Artificial Intelligence: conformity assessment of high-risk AI systems

Law No. 134/2025/QH15; Decree 142/2026/ND-CP; Decision 33/2026/QD-TTg
Who is covered
Providers of the 46 high-risk AI system categories listed for education, ethnic affairs and religion, healthcare, banking, judicial proceedings and transport, and other systems classified as high-risk.
What is required
Conformity assessment before deployment and after significant changes covering risk management, data governance, documentation, human oversight, transparency and incident management; designated categories need mandatory third-party certification.
Who performs it
Mixed (registered or recognized conformity assessment organizations for designated systems; self-assessment allowed for others)
Key dates
  • 10 Dec 2025 Law passed by the National Assembly
  • 1 Mar 2026 Law in force
  • 1 May 2026 Decree 142 in force
  • 15 Aug 2026 Decision 33 high-risk list in force
  • 1 Mar 2027 Compliance deadline for covered systems
  • 1 Sep 2027 Deadline for healthcare, education and financial systems operating before 15 Aug 2026
Maximum penalty
not specified
Industries
AI in Education & Academic Governance, Healthcare & Life Sciences, Banking, Financial Services & Fintech, AI in the Legal Profession and Courts, Autonomous Vehicles & Mobility and more
How AxiLayer AI helps
Third-party assessment evidence and signed findings mapped to the Law's high-risk requirements, for self-assessment routes and as readiness evidence for designated certification.
Source: hlc.com (Jul 2026) · Last verified 23 October 2026
Vietnam · Vietnam (national)In forceRegistration or filing

Law on Artificial Intelligence: risk classification dossier and pre-deployment notification

Law No. 134/2025/QH15; Decree 142/2026/ND-CP
Who is covered
Providers of medium-risk and high-risk AI systems in Vietnam.
What is required
Prepare a risk classification dossier and notify the Ministry of Science and Technology through the national AI one-stop portal before deployment; report serious incidents within 72 hours or five working days.
Who performs it
The organization itself
Key dates
  • 1 May 2026 Decree 142 notification rules in force (national AI portal pending launch)
Maximum penalty
not specified
Industries
All industries
How AxiLayer AI helps
Risk classification analysis and supporting evidence for the dossier and notification.
Source: tilleke.com (May 2026) · Last verified 23 October 2026
India · India (national)Enacted, future dateImpact assessment

DPDP Rules 2025: Significant Data Fiduciary annual DPIA, audit and algorithmic due diligence (Rule 13)

Digital Personal Data Protection Rules 2025, Rule 13
Who is covered
Data fiduciaries designated as Significant Data Fiduciaries.
What is required
Conduct a data protection impact assessment and an audit every 12 months, and verify that technical measures including algorithmic software do not pose risks to data principals' rights.
Who performs it
Mixed (DPIA by the fiduciary; periodic audit by an auditor)
Key dates
  • 13 Nov 2025 Rules notified; Data Protection Board provisions in force
  • 13 Nov 2026 Consent manager provisions commence
  • 13 May 2027 Remaining provisions, including Rule 13, commence
Maximum penalty
up to INR 250 crore per breach under the DPDP Act
Industries
All industries
How AxiLayer AI helps
Algorithmic due diligence and AI risk assessment evidence that feeds the annual DPIA and audit.
Source: conventuslaw.com (Nov 2025) · Last verified 23 October 2026
SingaporeEnacted, future dateRisk management program

MAS Guidelines on Artificial Intelligence Risk Management

MAS Guidelines, issued 7 October 2026 (response to consultation P017-2025)
Who is covered
All financial institutions regulated by MAS, for all forms of AI including generative AI and AI agents.
What is required
Board and senior management oversight, an AI inventory, a risk materiality methodology for every use case, lifecycle controls proportionate to risk, third-party AI risk management, and independent validation before deployment of high-risk use cases.
Who performs it
The organization itself (independent validation for high-risk use cases)
Key dates
  • 7 Oct 2026 Final guidelines issued
  • 7 Oct 2027 Sections 3 and 4 apply (governance, AI inventory, risk materiality)
  • 7 Oct 2028 Sections 5 and 6 apply (lifecycle controls, capabilities)
Maximum penalty
not specified (non-statutory guidelines considered in MAS supervisory assessment)
Industries
Banking, Financial Services & Fintech, Insurance & Underwriting
How AxiLayer AI helps
Third-party validation evidence and signed findings for high-risk AI use cases, mapped to the Guidelines' sections.
Source: mas.gov.sg (7 Oct 2026) · Last verified 23 October 2026
TaiwanEnacted, future dateRisk management program

Artificial Intelligence Basic Act: high-risk AI warnings, risk classification and verification tools (Articles 5, 16, 17)

AI Basic Act, Articles 5, 16 and 17
Who is covered
Providers of AI products and systems that competent authorities classify as high-risk.
What is required
High-risk AI must display clear warnings; MODA must promote a risk classification framework and provide or recommend assessment and verification tools; government must set liability rules and remedy, compensation or insurance mechanisms for high-risk AI.
Who performs it
Regulator (classification); obligations implemented by sector rules
Key dates
  • 14 Jan 2026 Act in force; implementing rules pending
Maximum penalty
not specified
Industries
All industries
How AxiLayer AI helps
Readiness evidence: risk classification and verification testing records prepared ahead of sector rules.
Source: leeandli.com (Jan 2026) · Last verified 23 October 2026
Bangladesh · Bangladesh (national)ProposedImpact assessment

Draft National AI Policy 2026-2030: algorithmic impact assessments

Draft National Artificial Intelligence Policy 2026-2030 (public consultation, January 2026)
Who is covered
Public authorities using high-risk AI in law enforcement, healthcare, employment and public service delivery.
What is required
Mandatory algorithmic impact assessments and anti-discrimination safeguards for high-risk systems; social scoring and mass surveillance banned.
Who performs it
Not specified
Key dates
  • 29 Jan 2026 Draft reported released for consultation
Maximum penalty
not specified
Industries
Government & Public Sector, Public Safety, Law Enforcement & Border, Healthcare & Life Sciences, AI Employment & Workforce Decisioning
How AxiLayer AI helps
Algorithmic impact assessment reports that public bodies can use if the policy is adopted.
Source: thefinancialexpress.com.bd (29 Jan 2026) · Last verified 23 October 2026
India · India (national)ProposedRisk management program

RBI draft Guidance on Regulatory Principles for Model Risk Management, 2026

RBI Press Release 2026-2027/528, 24 June 2026
Who is covered
Eleven categories of RBI-regulated entities, including banks, NBFCs, payments banks and co-operative banks, for all models including AI, ML and third-party models.
What is required
Maintain a model inventory, validate every model independently before and after deployment and periodically, test AI for bias and adversarial conditions, red-team customer-facing and generative AI, disclose AI interaction, and keep kill-switch arrangements.
Who performs it
Mixed (validation function separate from developers; third-party models still need validation regardless of vendor certification)
Key dates
  • 24 Jun 2026 Draft released for comment
  • 24 Jul 2026 Comment period closed
Maximum penalty
not specified
Industries
Banking, Financial Services & Fintech
How AxiLayer AI helps
Third-party validation reports, bias and adversarial test results and signed findings mapped to the draft guidance.
Source: snrlaw.in (24 Jun 2026) · Last verified 23 October 2026
Indonesia · Indonesia (national)ProposedRisk management program

Draft Presidential Regulation on AI Roadmap and AI Ethics

Komdigi announcement, 27 July 2026
Who is covered
AI developers and users in Indonesia.
What is required
Draft national rules on AI ethics and development, including design and testing standards; final content not yet published.
Who performs it
Not specified
Key dates
  • 27 Jul 2026 Drafting completed; under deliberation
Maximum penalty
not specified
Industries
All industries
How AxiLayer AI helps
Readiness evidence: AI ethics and testing assessments that can be mapped once the regulation is issued.
Source: digitalpolicyalert.org (27 Jul 2026) · Last verified 23 October 2026
Malaysia · Malaysia (federal)ProposedRisk management program

BNM Discussion Paper on Artificial Intelligence in the Malaysian Financial Sector

Bank Negara Malaysia, 5 August 2025
Who is covered
Banks, insurers, takaful operators and other financial service providers regulated by BNM.
What is required
Sets out BNM's proposed technology-neutral, proportionate approach to responsible AI adoption as a basis for future regulatory expectations.
Who performs it
The organization itself
Key dates
  • 5 Aug 2025 Discussion paper issued
  • 17 Oct 2025 Feedback deadline
Maximum penalty
not specified
Industries
Banking, Financial Services & Fintech, Insurance & Underwriting
How AxiLayer AI helps
Readiness evidence on AI governance and model controls ahead of BNM policy.
Source: bnm.gov.my (5 Aug 2025) · Last verified 23 October 2026
Malaysia · Malaysia (federal)ProposedRisk management program

Proposed AI Governance Bill

Ministry of Digital and NAIO consultation launched 10 July 2026
Who is covered
Parties across the AI lifecycle, with duties assigned by role and level of control.
What is required
Proposed risk-based governance duties across the AI lifecycle, incident reporting systems, safeguards and AI sandboxes.
Who performs it
The organization itself
Key dates
  • 10 Jul 2026 Engagement sessions and public consultation launched
Maximum penalty
not specified
Industries
All industries
How AxiLayer AI helps
Readiness evidence: lifecycle risk assessments aligned to the bill's proposed approach.
Source: digital.gov.my (10 Jul 2026) · Last verified 23 October 2026
Philippines · Philippines (national)ProposedRegistration or filing

Proposed Artificial Intelligence Development and Regulation Act (House substitute bill)

House Committee on ICT technical working group draft substitute bill
Who is covered
Providers of high-risk AI systems that decide on people's loans, jobs and health.
What is required
Registration and safety checks for high-risk systems only, a regulatory sandbox for startups, and a bar on dismissals decided by an algorithm alone.
Who performs it
Not specified
Key dates
  • 13 Jul 2026 Technical working group deliberations
  • 20 Jul 2026 Deadline for stakeholder amendments
Maximum penalty
not specified
Industries
Financial Services & Fintech, AI Employment & Workforce Decisioning, Healthcare & Life Sciences
How AxiLayer AI helps
Readiness evidence: safety check and risk assessment records for high-risk systems.
Source: philstar.com (14 Jul 2026) · Last verified 23 October 2026
Thailand · Thailand (national)ProposedRisk management program

Draft Artificial Intelligence Act (ETDA draft of 2 July 2026)

ETDA draft AI Act, public consultation 9 July to 14 August 2026
Who is covered
Providers and deployers of high-risk AI designated by royal decree in sectors such as national security, health, energy, telecoms, transport and utilities, and foreign providers serving Thailand.
What is required
High-risk systems must be fit for purpose, transparent, fair and under meaningful human control; deployers must run risk management, assign oversight staff, keep logs for six months and report unforeseen risks; designated systems may need notification, registration or licensing.
Who performs it
The organization itself
Key dates
  • 2 Jul 2026 New draft released
  • 14 Aug 2026 Public consultation closed
Maximum penalty
proposed administrative fines of THB 1 million to 5 million, suspension orders and strict liability for damages
Industries
Defense & National Security, Healthcare & Life Sciences, Energy & Grid Infrastructure, Autonomous Vehicles & Mobility, Infrastructure & Smart Cities, Government & Public Sector
How AxiLayer AI helps
Readiness evidence: risk assessments and control testing mapped to the draft's high-risk duties.
Source: tilleke.com (2 Jul 2026) · Last verified 23 October 2026
Hong KongVoluntaryRisk management program

Artificial Intelligence: Model Personal Data Protection Framework

PCPD, issued 11 June 2024
Who is covered
Organizations procuring, implementing or using AI systems that process personal data.
What is required
Documented AI risk assessments, risk-proportionate human oversight, periodic internal AI audits and model reviews, supplier assurances and an AI incident response plan.
Who performs it
The organization itself
Key dates
  • 11 Jun 2024 Framework issued
Maximum penalty
not specified
Industries
All industries
How AxiLayer AI helps
Periodic AI audit and risk assessment evidence aligned to the framework's recommended practices.
Source: mayerbrown.com (26 Jun 2024) · Last verified 23 October 2026
Hong KongVoluntaryTesting or sandbox

HKMA GenAI Sandbox and GenA.I. Sandbox++

HKMA ART Framework announcement, 15 October 2026
Who is covered
Banks participating in the HKMA sandbox cohorts.
What is required
Supervised technical trials of generative and agentic AI use cases within defined boundaries and controls.
Who performs it
Mixed (banks test under HKMA supervision)
Key dates
  • 15 Oct 2026 Second cohort results reported; further agentic AI testing via GenA.I. Sandbox++
Maximum penalty
not specified
Industries
Banking
How AxiLayer AI helps
Test plans, evaluation results and control evidence that sandbox participants can present to the HKMA.
Source: info.gov.hk (15 Oct 2026) · Last verified 23 October 2026
India · India (national)VoluntaryRisk management program

India AI Governance Guidelines

MeitY, released 5 November 2025
Who is covered
AI developers, deployers and regulators in India.
What is required
Principles-based guidance relying on existing law, voluntary measures, techno-legal approaches and value chain transparency.
Who performs it
The organization itself
Key dates
  • 5 Nov 2025 Guidelines released
Maximum penalty
not specified
Industries
All industries
How AxiLayer AI helps
Assessment evidence showing alignment with the guidelines' principles.
Source: ssrana.in (6 Nov 2025) · Last verified 23 October 2026
India · India (national)VoluntaryRisk management program

RBI FREE-AI Framework (Framework for Responsible and Ethical Enablement of AI)

FREE-AI Committee Report, 13 August 2025
Who is covered
RBI-regulated entities.
What is required
Recommends board-approved AI policies, extending product approval, consumer protection and audit processes to AI, and AI disclosures to customers.
Who performs it
The organization itself
Key dates
  • 13 Aug 2025 Committee report published
Maximum penalty
not specified
Industries
Banking, Financial Services & Fintech
How AxiLayer AI helps
AI audit evidence aligned to the FREE-AI sutras and recommendations.
Source: rbi.org.in (13 Aug 2025) · Last verified 23 October 2026
Indonesia · Indonesia (national)VoluntaryRisk management program

OJK AI Governance for Indonesian Banking (Tata Kelola Kecerdasan Artifisial Perbankan Indonesia)

OJK guideline, 2025
Who is covered
Banks in Indonesia using AI.
What is required
Risk-based classification with stricter oversight for uses such as lending, board and management accountability, documentation of data and model logic, human review and customer appeals for high-stakes decisions.
Who performs it
The organization itself
Maximum penalty
not specified
Industries
Banking
How AxiLayer AI helps
Assessment evidence mapped to the guideline's risk classification and explainability expectations.
Source: babl.ai (May 2025) · Last verified 23 October 2026
Japan · Japan (national)VoluntaryRisk management program

FSA AI Discussion Paper: Preliminary Discussion Points for Promoting the Sound Utilization of AI in the Financial Sector

FSA, version 1.0 of 4 March 2025, version 1.1 of 3 March 2026
Who is covered
Financial institutions in Japan using AI, including generative AI.
What is required
Non-binding discussion points on AI risk management and use cases that frame supervisory dialogue with the FSA.
Who performs it
The organization itself
Key dates
  • 4 Mar 2025 Version 1.0 published
  • 3 Mar 2026 Version 1.1 published
Maximum penalty
not specified
Industries
Banking, Financial Services & Fintech, Insurance & Underwriting
How AxiLayer AI helps
Assessment evidence on AI risk controls that institutions can use in FSA supervisory dialogue.
Source: fsa.go.jp (3 Mar 2026) · Last verified 23 October 2026
SingaporeVoluntaryCertification scheme

AI Tester Accreditation Programme (AI TAP)

AI Verify Foundation press release, 14 October 2026
Who is covered
Third-party providers of AI testing services.
What is required
Providers must show technical competency in their AI testing services and meet operational readiness, financial sustainability and good standing requirements.
Who performs it
Accredited body (AI Verify Foundation accredits testers)
Key dates
  • 14 Oct 2026 Programme launched and first batch of accredited testers announced
Maximum penalty
not specified
Industries
All industries
How AxiLayer AI helps
Testing methodology and evidence packages structured to the program's competency expectations.
Source: aiverifyfoundation.sg (14 Oct 2026) · Last verified 23 October 2026
SingaporeVoluntaryTesting or sandbox

Global AI Assurance Sandbox (IMDA and AI Verify Foundation)

IMDA and AI Verify Foundation initiative
Who is covered
Organizations deploying generative AI applications and specialist technical testing firms.
What is required
Pairs deployers with technical testers for benchmarking, red-teaming or automated evaluation, with testing and a case study completed within three months.
Who performs it
Third party
Key dates
  • 9 Sep 2026 Sandbox page reports 30 applications across 12 geographies and 14 industries
Maximum penalty
not specified
Industries
All industries
How AxiLayer AI helps
Technical test results and case study evidence for generative AI applications.
Source: aiverifyfoundation.sg (9 Sep 2026) · Last verified 23 October 2026
SingaporeVoluntaryRisk management program

Model AI Governance Framework for Agentic AI

IMDA, launched 22 January 2026
Who is covered
Organizations developing or deploying AI agents.
What is required
Assess and bound agent risks up front, keep humans accountable through approval checkpoints, apply technical controls such as baseline testing across the lifecycle, and enable end-user responsibility.
Who performs it
The organization itself
Key dates
  • 22 Jan 2026 Framework launched
Maximum penalty
not specified
Industries
All industries
How AxiLayer AI helps
Agent testing and control assessment evidence mapped to the framework's four dimensions.
Source: mddi.gov.sg (22 Jan 2026) · Last verified 23 October 2026
South Korea · South Korea (national)VoluntaryRisk management program

FSC AI Guidelines in the Financial Sector (updated)

FSC press release, 18 June 2026
Who is covered
All financial companies, including fintechs; high-impact AI must follow the AI Basic Act requirements rather than discretionary application.
What is required
Seven self-regulatory principles including human accountability for final decisions, executive oversight and security; the FSS will provide an AI risk management framework.
Who performs it
The organization itself
Key dates
  • 18 Jun 2026 Updated guidelines announced
  • 22 Jun 2026 Updated guidelines take effect
Maximum penalty
not specified
Industries
Banking, Financial Services & Fintech, Insurance & Underwriting
How AxiLayer AI helps
Assessment evidence mapped to the seven principles and to the AI Basic Act duties for high-impact financial AI.
Source: fsc.go.kr (18 Jun 2026) · Last verified 23 October 2026

Oceania 18

Australia · Australia (federal)In forceRisk management program

APRA Prudential Standard CPS 230 Operational Risk Management, with APRA AI expectations

APRA CPS 230 and CPG 230; APRA Letter to Industry on Artificial Intelligence (30 April 2026)
Who is covered
APRA-regulated banks, insurers and superannuation trustees.
What is required
Operational risk, critical operations and material service provider controls; APRA's AI letter expects an inventory of AI use cases, human involvement in high-risk decisions, contractual audit rights over AI suppliers, and pre-deployment risk and security assessments with ongoing monitoring.
Who performs it
The organization itself
Key dates
  • 1 Jul 2025 CPS 230 takes effect
  • 30 Apr 2026 APRA finalizes CPS 230 amendments and issues AI letter to all regulated entities
  • 1 Jul 2026 Updated CPS 230 takes effect; pre-existing service provider contracts covered by this date or next renewal
Maximum penalty
not specified
Industries
Banking, Insurance & Underwriting, Financial Services & Fintech
How AxiLayer AI helps
Third-party assessment of AI use cases and AI suppliers that supports CPS 230 service provider oversight and the assurance APRA's AI letter calls for.
Source: apra.gov.au (30 Apr 2026) · Last verified 23 October 2026
Australia · New South WalesIn forceImpact assessment

NSW AI Assessment Framework and AI Review Committee referral

NSW Department of Customer Service Circular DCS-2026-02 (replacing DCS-2024-04)
Who is covered
NSW Government departments, agencies, statutory bodies and state owned corporations that develop, procure or use AI.
What is required
Mandatory assessment of AI systems across the lifecycle; residual high and very high risk systems must be submitted to the NSW AI Review Committee.
Who performs it
Mixed (agency self-assessment, with AI Review Committee review of high-risk systems)
Key dates
  • 1 Jul 2024 Circular DCS-2024-04 makes the framework mandatory for agencies using AI
  • 27 Jan 2026 Modernized, standards-aligned framework announced
Maximum penalty
not specified
Industries
Government & Public Sector
How AxiLayer AI helps
Third-party testing evidence and documentation that supports agency assessments and Review Committee submissions.
Source: arp.nsw.gov.au (27 Jan 2026) · Last verified 23 October 2026
Australia · Australia (federal)In forceRisk management program

Phase 2 online safety industry codes (age-restricted material), including AI companion chatbots

Online Safety Act 2021 (Cth), industry codes for Class 1C and Class 2 material
Who is covered
Online service providers in Australia, including social media, app distribution and services with AI companion chatbot features.
What is required
Services with AI companion chatbots must run a separate risk assessment of whether the chatbot could generate harmful content for or by Australian children; higher-risk services must apply age assurance, test its effectiveness and report to the eSafety Commissioner.
Who performs it
The organization itself
Key dates
  • 27 Jun 2025 First three codes registered
  • 9 Sep 2025 Remaining six codes registered
  • 27 Dec 2025 First three codes take effect
  • 9 Mar 2026 Remaining six codes take effect
Maximum penalty
civil penalties up to AU$49.5 million
Industries
AI Companion Chatbots & Youth Digital Safety, Online Platforms & Social Media
How AxiLayer AI helps
Third-party testing evidence on chatbot output risks to children and on age assurance effectiveness, mapped to the code requirements.
Source: cm.twobirds.com (Sep 2025) · Last verified 23 October 2026
Australia · Australia (federal)In forceImpact assessment

Policy for the responsible use of AI in government, version 2.0

Digital Transformation Agency, Policy for the responsible use of AI in government v2.0
Who is covered
Australian Government agencies that adopt or use AI, including AI supplied by vendors.
What is required
AI impact assessments for in-scope use cases, an accountable official for each use case, an internal register of AI use cases, a published AI transparency statement updated annually, and mandatory responsible AI training for staff; high-risk use cases need formal governance and annual review.
Who performs it
The organization itself
Key dates
  • 2 Dec 2025 DTA announces overhauled policy, AI impact assessment tool and procurement guidance
  • 15 Dec 2025 Version 2.0 takes effect
Maximum penalty
not specified
Industries
Government & Public Sector
How AxiLayer AI helps
Third-party assessment evidence and documentation that agencies and their AI suppliers can use in impact assessments, registers and transparency statements.
Source: dta.gov.au (2 Dec 2025) · Last verified 23 October 2026
Australia · Australia (federal)In forceConformity assessment

Regulation of medical device software including AI (ARTG inclusion)

Therapeutic Goods Act 1989 (Cth) and TGA medical device software rules; TGA report on medical device software including AI (July 2025)
Who is covered
Manufacturers and sponsors of software and AI that meet the medical device definition, including digital scribes that generate diagnoses or treatment recommendations and chatbots with medical device functions.
What is required
Products must meet the Essential Principles and be included in the ARTG before supply; the TGA is planning consultations on the digital mental health tool exclusion, definitions, and transparency such as listing AI devices in the ARTG.
Who performs it
Mixed (manufacturer evidence, with the TGA deciding ARTG inclusion)
Key dates
  • 1 Nov 2024 Transition period for software-based medical devices ends
Maximum penalty
not specified
Industries
Healthcare & Life Sciences
How AxiLayer AI helps
Readiness evidence on AI performance, bias and monitoring that manufacturers can use in Essential Principles documentation; ARTG decisions rest with the TGA.
Source: tga.gov.au (Jul 2026) · Last verified 23 October 2026
Australia · Australia (federal)In forceRisk management program

Social Media Minimum Age

Online Safety Act 2021 (Cth), as amended by the Online Safety Amendment (Social Media Minimum Age) Act 2024
Who is covered
Age-restricted social media platforms available to Australian users.
What is required
Platforms must take reasonable steps to prevent under-16s from holding accounts, which in practice relies on age assurance systems such as facial age estimation; eSafety examines whether systems and processes actually work, including retry loopholes.
Who performs it
The organization itself
Key dates
  • 10 Dec 2025 Under-16 account restriction takes effect
  • 31 Mar 2026 eSafety opens compliance investigation into Facebook, Instagram, Snapchat, TikTok and YouTube
Maximum penalty
civil penalties up to AU$49.5 million
Industries
Online Platforms & Social Media, Biometrics & Digital Identity
How AxiLayer AI helps
Testing evidence on age assurance accuracy, demographic performance and circumvention, documented for regulator engagement.
Source: mobileworldlive.com (31 Mar 2026) · Last verified 23 October 2026
New ZealandIn forceImpact assessment

Biometric Processing Privacy Code 2025

Biometric Processing Privacy Code 2025, issued under the Privacy Act 2020
Who is covered
Agencies in New Zealand that collect or use biometric information, including facial recognition and biometric categorization systems.
What is required
A documented proportionality assessment before processing, backed by objective effectiveness evidence such as trials or performance metrics, clear notice, and limits on inferring health, emotion, personality or protected characteristics.
Who performs it
The organization itself
Key dates
  • 6 Aug 2025 Code issued
  • 3 Nov 2025 Applies to new biometric processing
  • 3 Aug 2026 Existing biometric processing must comply
Maximum penalty
not specified
Industries
Biometrics & Digital Identity, Retail & E-commerce, Public Safety, Law Enforcement & Border
How AxiLayer AI helps
Third-party testing of biometric system accuracy and demographic performance to support the proportionality assessment.
Source: minterellison.co.nz (Nov 2025) · Last verified 23 October 2026
New ZealandIn forceTransparency and labeling

Notification for indirect collection of personal information (IPP 3A)

Privacy Act 2020, Information Privacy Principle 3A, inserted by the Privacy Amendment Act 2025
Who is covered
Agencies that collect personal information from a source other than the individual, including data obtained for AI systems.
What is required
Take reasonable steps to tell individuals when their personal information has been collected indirectly, unless an exception applies.
Who performs it
The organization itself
Key dates
  • 1 May 2026 IPP 3A takes effect
Maximum penalty
not specified
Industries
All industries
How AxiLayer AI helps
Data lineage review of AI training and input data with documented findings on indirect collection.
Source: bellgully.com (25 Sep 2025) · Last verified 23 October 2026
Australia · Australia (federal)Enacted, future dateTransparency and labeling

Automated decision-making transparency in privacy policies (APP 1.7 to 1.9)

Privacy Act 1988 (Cth), Australian Privacy Principle 1.7 to 1.9, as amended by the Privacy and Other Legislation Amendment Act 2024
Who is covered
APP entities that use computer programs, including AI and rule-based tools, to make or substantially assist decisions that could significantly affect an individual's rights or interests using personal information.
What is required
Privacy policies must describe the kinds of personal information used and the kinds of decisions made solely by, or substantially and directly assisted by, computer programs; human review does not take a tool out of scope.
Who performs it
The organization itself
Key dates
  • 30 Sep 2026 OAIC releases updated APP 1 Guidelines and an APP 1.7 to 1.9 fact sheet
  • 10 Dec 2026 Automated decision-making disclosure obligations commence
Maximum penalty
not specified
Industries
All industries
How AxiLayer AI helps
An inventory and assessment of automated decision systems, with documented findings that support accurate privacy policy disclosures.
Source: allens.com.au (Oct 2026) · Last verified 23 October 2026
Australia · Australia (federal)Enacted, future dateRisk management program

Scams Prevention Framework

Competition and Consumer Act 2010 (Cth), Part IVF; SPF Rules and sector SPF Codes (drafts released 2026)
Who is covered
Designated banks, telecommunications providers and digital platforms.
What is required
Documented governance with metrics, and reasonable steps to prevent, detect, report, disrupt and respond to scams under sector codes enforced by ACCC, ASIC and ACMA; AI-based detection and disruption controls form part of the evidence base.
Who performs it
The organization itself
Key dates
  • 13 Feb 2025 Parliament passes the Scams Prevention Framework legislation
  • 28 May 2026 Parts of banking, telecommunications and digital platform sectors designated
  • 1 Sep 2026 Membership of an authorized external dispute resolution scheme required
  • 31 Mar 2027 Most mandatory SPF obligations expected to commence
Maximum penalty
up to AU$50 million per contravention
Industries
Banking, Financial Services & Fintech, Online Platforms & Social Media, Telecommunications AI Robocalls
How AxiLayer AI helps
Third-party testing and signed findings on AI-driven scam detection and disruption controls, mapped to SPF principles and codes.
Source: bakermckenzie.com (Jun 2026) · Last verified 23 October 2026
Australia · New South WalesEnacted, future dateRisk management program

Work health and safety duty for digital work systems

Work Health and Safety Amendment (Digital Work Systems) Act 2026 (NSW)
Who is covered
Persons conducting a business or undertaking in NSW that use digital work systems, defined to include algorithms, AI, automation and online platforms.
What is required
Take reasonably practicable steps so digital work systems do not create health and safety risks, including excessive workloads, metrics or surveillance and unlawful discrimination; union entry permit holders may inspect relevant systems.
Who performs it
The organization itself
Key dates
  • 18 Feb 2026 Assent; most provisions commence by proclamation after SafeWork NSW publishes guidelines
Maximum penalty
up to $66,770 for a corporation that refuses to assist an entry permit holder
Industries
AI Employment & Workforce Decisioning, Customer Service & Contact Centers
How AxiLayer AI helps
Third-party assessment of algorithmic work allocation and monitoring tools, with findings that document the reasonably practicable steps taken.
Source: safework.nsw.gov.au (Apr 2026) · Last verified 23 October 2026
Australia · Australia (federal)ProposedRisk management program

Mandatory national AI Standards (proposed)

Prime Minister's announcement of 15 July 2026; PM&C consultation paper Getting it right: Building AI infrastructure that works for Australia (September 2026)
Who is covered
Proposed: large AI data centres (baseline requirements from 30 MW) and frontier AI training in Australia; broader scope still being designed.
What is required
Proposed minimum security and safety expectations for frontier AI training and disclosure of defined reportable AI incidents, plus energy, water and community requirements for data centres; the government has said developers will need to show their safety systems work, with standards due by end of 2026 and legislation in 2027.
Who performs it
Regulator (administering agency not yet decided)
Key dates
  • 15 Jul 2026 Mandatory national AI Standards announced; Office of AI established in PM&C
  • 17 Sep 2026 Consultation paper on AI infrastructure and frontier AI training released
  • 9 Oct 2026 Consultation submissions closed
Maximum penalty
not specified
Industries
Data Center & Large-Load Development, Technology & Enterprise, Energy & Grid Infrastructure
How AxiLayer AI helps
Readiness assessments and documented evidence that safety and incident processes operate as designed, ahead of the final standards.
Source: pmc.gov.au (17 Sep 2026) · Last verified 23 October 2026
New ZealandProposedRisk management program

Online Safety (Minimum Age and Child Safety Risk Assessment) Bill

Government bill announced 24 August 2026
Who is covered
High-risk social media platforms such as Instagram, TikTok, Snapchat and Facebook.
What is required
Reasonable steps to verify users are 16 or older, using methods such as facial age estimation or ID, and child safety risk assessments updated at least annually, overseen by a new regulator in the Department of Internal Affairs.
Who performs it
The organization itself
Key dates
  • 24 Aug 2026 Government announces introduction of the bill
Maximum penalty
proposed fines up to 10% of global revenue
Industries
Online Platforms & Social Media, Biometrics & Digital Identity, AI Companion Chatbots & Youth Digital Safety
How AxiLayer AI helps
Readiness testing of age assurance systems and support for child safety risk assessments.
Source: thespinoff.co.nz (24 Aug 2026) · Last verified 23 October 2026
Papua New GuineaProposedRisk management program

Draft PNG Government Artificial Intelligence Adoption Framework

Ministry of Information and Communications Technology press statement of 24 February 2026
Who is covered
Government agencies adopting AI.
What is required
Whole-of-government direction on AI governance, accountability, security and sovereign control, with an AI Taskforce and a future AI legislative framework under consideration.
Who performs it
The organization itself
Key dates
  • 27 Feb 2026 Draft framework published for public consultation
  • 23 Mar 2026 Draft National Sovereign Digital Transformation and AI Strategy published for consultation
Maximum penalty
not specified
Industries
Government & Public Sector
How AxiLayer AI helps
Readiness assessment of government AI use cases against the draft framework.
Source: ict.gov.pg (24 Feb 2026) · Last verified 23 October 2026
Australia · Australia (federal)VoluntaryRisk management program

Guidance for AI Adoption (successor to the Voluntary AI Safety Standard)

Department of Industry, Science and Resources, National AI Centre, Guidance for AI Adoption (October 2025)
Who is covered
Any organization developing or deploying AI in Australia, with foundation and extended versions.
What is required
Six essential practices for AI governance, risk management, testing, transparency and human oversight.
Who performs it
The organization itself
Key dates
  • 21 Oct 2025 Guidance published, condensing the 10 voluntary guardrails into 6 essential practices
Maximum penalty
not specified
Industries
All industries
How AxiLayer AI helps
Third-party assessment evidence mapped to the six practices.
Source: industry.gov.au (21 Oct 2025) · Last verified 23 October 2026
New ZealandVoluntaryImpact assessment

Algorithm Charter for Aotearoa New Zealand

Algorithm Charter for Aotearoa New Zealand (Stats NZ, data.govt.nz)
Who is covered
Government agencies that have signed the Charter.
What is required
Signatories commit to assess the impact of algorithms used in decisions affecting people, provide transparency, maintain human oversight and manage bias and privacy risks.
Who performs it
The organization itself
Maximum penalty
not specified
Industries
Government & Public Sector
How AxiLayer AI helps
Third-party algorithm assessment evidence that supports Charter commitments.
Source: data.govt.nz (Jul 2020) · Last verified 23 October 2026
New ZealandVoluntaryRisk management program

Public Service AI Framework

Government Chief Digital Officer, Public Service AI Framework (January 2025)
Who is covered
New Zealand public service agencies developing or deploying AI.
What is required
Non-binding principles based on the OECD AI Principles and six pillars covering governance, guardrails, capability, innovation, social license and global voice.
Who performs it
The organization itself
Key dates
  • 29 Jan 2025 Framework released
Maximum penalty
not specified
Industries
Government & Public Sector
How AxiLayer AI helps
Third-party assessment evidence that agencies can use to show alignment with the framework's guardrails.
Source: russellmcveagh.com (31 Jan 2025) · Last verified 23 October 2026
New ZealandVoluntaryRisk management program

Responsible AI Guidance for Businesses

Ministry of Business, Innovation and Employment, Responsible AI Guidance for Businesses (July 2025)
Who is covered
New Zealand businesses adopting AI.
What is required
A practical, voluntary guide to managing AI risks in line with the OECD AI Principles.
Who performs it
The organization itself
Key dates
  • 8 Jul 2025 Guidance released alongside the national AI strategy
Maximum penalty
not specified
Industries
All industries
How AxiLayer AI helps
Third-party assessment evidence mapped to the guidance.
Source: mbie.govt.nz (8 Jul 2025) · Last verified 23 October 2026

Global standards and schemes 10

Global · Council of Europe (international treaty)Enacted, future dateRisk management program

Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law

CETS No. 225
Who is covered
States and the EU that ratify, covering AI activities of public authorities and, as each Party chooses, private actors.
What is required
Parties must put in place measures for AI risk and impact management, transparency, oversight and remedies consistent with human rights, democracy and the rule of law.
Who performs it
Mixed (each Party designates its own mechanisms)
Key dates
  • 5 Sep 2024 Opened for signature in Vilnius
  • 15 May 2026 European Union deposits its ratification
Maximum penalty
not specified
Industries
All industries
How AxiLayer AI helps
Risk and impact assessment evidence that helps organizations meet national measures adopted to implement the Convention.
Source: coe.int (15 May 2026) · Last verified 23 October 2026
Global · International (ISO/IEC)VoluntaryImpact assessment

AI system impact assessment

ISO/IEC 42005:2025
Who is covered
Organizations that develop, provide or use AI systems, of any size or sector.
What is required
Guidance on when and how to assess the impacts of AI systems on individuals and societies across the lifecycle, how to document the assessment, and how to integrate it into AI risk management and an AI management system.
Who performs it
The organization itself
Key dates
  • 28 May 2025 Edition 1.0 published
Maximum penalty
not specified
Industries
All industries
How AxiLayer AI helps
Third-party review of AI impact assessments against ISO/IEC 42005, with signed findings.
Source: webstore.iec.ch (28 May 2025) · Last verified 23 October 2026
Global · International (industry scheme)VoluntaryCertification scheme

AIUC-1 AI agent standard and certification

AIUC-1 (Artificial Intelligence Underwriting Company)
Who is covered
Companies that build or deploy AI agents and want certification that can support insurance cover.
What is required
Testing against about 5,000 adversarial scenarios across safety, security, reliability, accountability, data privacy and societal risk, with quarterly recertification and quarterly updates to the standard.
Who performs it
Third party (AIUC-run testing with human-verified audits)
Key dates
  • 23 Jul 2025 AIUC launches with AIUC-1, described as SOC 2 for AI agents
  • 12 Feb 2026 ElevenLabs announces AIUC-1 certification and linked AI agent insurance
  • 15 Sep 2026 AIUC raises a US$40 million Series A to extend audits to frontier models
Maximum penalty
not specified
Industries
Technology & Enterprise, Customer Service & Contact Centers, Insurance & Underwriting
How AxiLayer AI helps
Pre-certification testing evidence on agent failure modes such as hallucination, unauthorized actions and data leakage.
Source: siliconangle.com (15 Sep 2026) · Last verified 23 October 2026
Global · International (Cloud Security Alliance)VoluntaryCertification scheme

CSA STAR for AI (Levels 1 and 2)

Cloud Security Alliance STAR for AI, AI Controls Matrix (AICM) and AI-CAIQ
Who is covered
AI and cloud service providers that want to publish AI security and governance assurance in the CSA STAR Registry.
What is required
Level 1: an AI-CAIQ self-assessment built on the AI Controls Matrix. Level 2: a Valid-AI-ted AI-CAIQ combined with ISO/IEC 42001 certification.
Who performs it
Mixed (Level 1 self-assessment; Level 2 adds ISO/IEC 42001 certification by a certification body)
Key dates
  • 20 Nov 2025 STAR for AI Level 2 becomes available
Maximum penalty
not specified
Industries
Technology & Enterprise
How AxiLayer AI helps
Third-party assessment evidence mapped to AICM controls to support AI-CAIQ submissions and ISO/IEC 42001 readiness.
Source: cloudsecurityalliance.org (20 Nov 2025) · Last verified 23 October 2026
Global · International (ISO/IEC)VoluntaryRisk management program

Guidance on AI risk management

ISO/IEC 23894:2023
Who is covered
Organizations that develop, deploy or use AI and want to apply ISO 31000 style risk management to AI.
What is required
Guidance on identifying, assessing and treating AI-specific risks and integrating AI risk management into organizational processes.
Who performs it
The organization itself
Maximum penalty
not specified
Industries
All industries
How AxiLayer AI helps
Third-party assessment of AI risk management processes against ISO/IEC 23894 guidance.
Source: iso.org (Feb 2023) · Last verified 23 October 2026
Global · International (ISO/IEC)VoluntaryCertification scheme

ISO/IEC 42001 AI management system certification

ISO/IEC 42001:2023
Who is covered
Any organization that develops, provides or uses AI systems and seeks a certifiable AI management system.
What is required
An AI management system covering AI risk management, impact assessment, data governance, human oversight and continual improvement, certified through audit by an accredited certification body.
Who performs it
Accredited body
Maximum penalty
not specified
Industries
All industries
How AxiLayer AI helps
Pre-certification readiness assessment and evidence packs mapped to ISO/IEC 42001 clauses and Annex A controls.
Source: standards.org.au (16 Feb 2024) · Last verified 23 October 2026
Global · United States (used internationally)VoluntaryRisk management program

NIST AI Risk Management Framework

NIST AI 100-1, AI RMF 1.0
Who is covered
Any organization designing, developing, deploying or using AI, in the US or elsewhere.
What is required
Voluntary Govern, Map, Measure and Manage functions for AI risk, widely referenced by regulators and contracts outside the US.
Who performs it
The organization itself
Maximum penalty
not specified
Industries
All industries
How AxiLayer AI helps
Third-party assessment evidence mapped to the AI RMF functions and categories.
Source: nist.gov (Jan 2023) · Last verified 23 October 2026
Global · International (ISO/IEC)VoluntaryCertification scheme

Requirements for bodies auditing and certifying AI management systems

ISO/IEC 42006:2025
Who is covered
Certification bodies that audit and certify ISO/IEC 42001 AI management systems, and the accreditation bodies that assess them.
What is required
Additional requirements on top of ISO/IEC 17021-1 for auditor competence, audit time and the conduct of AI management system audits.
Who performs it
Accredited body
Maximum penalty
not specified
Industries
All industries
How AxiLayer AI helps
Readiness evidence for organizations preparing for an ISO/IEC 42001 audit conducted under ISO/IEC 42006 rules.
Source: iso.org (Jul 2025) · Last verified 23 October 2026
Global · International (ISO/IEC CASCO)VoluntaryConformity assessment

Requirements for bodies performing inspection, 2026 edition

ISO/IEC 17020:2026
Who is covered
Inspection bodies seeking or holding accreditation, including bodies that inspect AI systems.
What is required
Stronger impartiality and independence requirements, controls over technology systems including AI and remote tools, validation of non-standard inspection methods, and a new section on data and information control.
Who performs it
Accredited body
Key dates
  • 27 Mar 2026 ISO/IEC 17020:2026 published
  • 1 Sep 2026 UKAS accepts new applications only to the 2026 edition
  • 1 Jan 2027 UKAS initial assessments of new applicants move to the 2026 edition
  • 1 Jan 2028 All UKAS assessments use the 2026 edition
  • 27 Mar 2029 Accreditations to ISO/IEC 17020:2012 cease to be valid
Maximum penalty
not specified
Industries
All industries
How AxiLayer AI helps
AxiLayer AI's ISO/IEC 17020:2026 Type A application is in process, alongside a parallel ISO/IEC 42001 application, both with a U.S.-based accreditation body signatory to the ILAC MRA and IAF MLA.
Source: ukas.com (30 Mar 2026) · Last verified 23 October 2026
Global · Financial Stability BoardVoluntaryRisk management program

Sound Practices for Responsible Adoption of AI

FSB final report, 15 Oct 2026
Who is covered
Financial institutions and their supervisors in FSB member jurisdictions.
What is required
Twelve non-binding sound practices for governing AI adoption, including human-approval triggers for agentic AI.
Who performs it
The organization itself
Key dates
  • 15 Oct 2026 Final report published
Maximum penalty
not specified (non-binding)
Industries
Banking, Financial Services & Fintech, Insurance & Underwriting
How AxiLayer AI helps
Third-party evidence mapped to each sound practice, with signed findings supervisors can review.
Source: fsb.org (15 Oct 2026) · Last verified 23 October 2026
Country profiles

Where AI regulation stands, country by country

99 countries and jurisdictions across eight regions, including those with no AI-specific rules yet, so you can see the whole picture.

United States 18

United StatesSector rules45 mandates

The United States has no comprehensive federal AI statute as of October 2026; federal rules come from OMB memoranda for agency AI use and purchasing (M-25-21, M-25-22 and M-26-04), sector regulators (FDA, CFPB, FCC, FTC) and the voluntary NIST AI RMF. Executive Order 14365 (11 Dec 2025) directs a DOJ AI Litigation Task Force, a Commerce review of state laws and an FTC policy statement aimed at limiting state AI laws, and the White House released legislative recommendations for a national framework on 20 Mar 2026, but no federal statute preempts state AI law and the FTC policy statement (proposed 1 Jul 2026) is not final. Most binding AI obligations therefore come from states, led by California, Colorado, Connecticut, Illinois, New York and Texas.

Regulators: Office of Management and Budget, General Services Administration, Food and Drug Administration, Consumer Financial Protection Bureau, Federal Trade Commission, Federal Communications Commission, NIST (voluntary standards)

Source: ailawsbystate.com (Oct 2026)

CaliforniaSector rules

California has the largest body of state AI law: the frontier model law SB 53 and the companion chatbot law SB 243 have applied since 1 Jan 2026, and the CCPA automated decisionmaking regulations require compliance from 1 Jan 2027. In September 2026 the Governor signed more than two dozen AI bills, including an AI Auditor Registry (AB 1405, registration required from 1 Jan 2029), a framework for designating AI verification organizations (SB 813), stronger companion chatbot rules with audits (SB 1119), clinical AI rules (AB 1979, SB 503) and the No Robo Bosses Act (SB 947, from 1 Jul 2027).

Regulators: Attorney General, California Privacy Protection Agency, Civil Rights Council, Government Operations Agency, Office of Emergency Services, Labor Commissioner, Department of Insurance

Source: wsgr.com (Oct 2026)

ColoradoComprehensive AI law

Colorado repealed and reenacted its 2024 AI Act as an automated decision-making technology statute (SB 26-189, signed 14 May 2026) covering consequential decisions in employment, housing, credit, insurance, health care, education and government services, effective 1 Jan 2027. A separate Chatbot Safety Act (HB 26-1263) also takes effect 1 Jan 2027, and the Attorney General scheduled its rulemaking hearing on both for 26 Oct 2026. Insurance Regulation 3 CCR 702-10 already requires AI governance and testing for life, auto and health insurers.

Regulators: Attorney General, Division of Insurance

Source: coag.gov (Oct 2026)

ConnecticutSector rules

Connecticut enacted the Artificial Intelligence Responsibility and Transparency (CART) Act, SB 5, signed 2 Jun 2026. Provenance duties for large generative AI providers and frontier developer whistleblower protections apply from 1 Oct 2026, companion chatbot rules from 1 Jan 2027 and employer notice duties for automated employment decision technology from 1 Oct 2027.

Regulators: Attorney General, Insurance Department

Source: ktslaw.com (29 Jun 2026)

IllinoisSector rules

Illinois regulates AI in employment through the Human Rights Act amendments of HB 3773 (in force 1 Jan 2026), biometric data through BIPA, and AI therapy through HB 1806 (in force 1 Aug 2025). The AI Safety Measures Act (SB 315, signed 6 Jul 2026) takes effect 1 Jan 2027 and requires annual third-party audits of large frontier AI developers from 1 Jan 2028.

Regulators: Attorney General, Department of Human Rights, Department of Financial and Professional Regulation, Illinois Emergency Management Agency and Office of Homeland Security, Department of Insurance

Source: gtlaw.com (Jul 2026)

New YorkSector rules

New York City has required annual bias audits of automated employment decision tools under Local Law 144 since 5 Jul 2023. At state level, the RAISE Act on frontier models, as amended on 27 Mar 2026, takes effect 1 Jan 2027 with an oversight office inside the Department of Financial Services, a companion chatbot law has applied since November 2025, and DFS Circular Letter No. 7 (2024) sets AI expectations for insurers.

Regulators: NYC Department of Consumer and Worker Protection, Attorney General, Department of Financial Services

Source: mofo.com (3 Apr 2026)

TexasComprehensive AI law

The Texas Responsible Artificial Intelligence Governance Act (HB 149) took effect 1 Jan 2026. It bans certain intentional harmful AI uses, requires government agencies to disclose AI interactions, gives a safe harbor for substantial compliance with the NIST AI RMF and creates a 36-month regulatory sandbox; SB 815 (2025) bars AI-only adverse medical necessity determinations by health payors.

Regulators: Attorney General, Department of Information Resources, Department of Insurance

Source: bakerbotts.com (Jul 2025)

UtahSector rules

Utah's Artificial Intelligence Policy Act (2024) requires generative AI disclosure in regulated occupations and consumer transactions and created the Office of Artificial Intelligence Policy and its AI learning laboratory, and HB 452 (2025) regulates mental health chatbots. A Digital Content Provenance Standards Act enacted in 2026 takes effect 1 Jan 2027.

Regulators: Division of Consumer Protection, Office of Artificial Intelligence Policy

Source: privacyworld.blog (16 Sep 2026)

WashingtonSector rules

Washington enacted an AI companion chatbot law (HB 2225, signed 24 Mar 2026, effective 1 Jan 2027) with a private right of action, and an AI provenance law (HB 1170) effective 1 Feb 2027. Washington has also adopted the NAIC AI Model Bulletin for insurers.

Regulators: Attorney General, Office of the Insurance Commissioner

Source: hunton.com (Mar 2026)

OregonSector rules

Oregon enacted an AI companion chatbot law (SB 1546, 31 Mar 2026) effective 1 Jan 2027, adding to a 2025 law that bars AI systems from using licensed medical professional titles.

Regulators: Attorney General

Source: privacyworld.blog (16 Sep 2026)

IdahoSector rules

Idaho enacted the Conversational AI Safety Act (S1297, 31 Mar 2026) for companion chatbots, effective 1 Jul 2027.

Regulators: Attorney General

Source: privacyworld.blog (16 Sep 2026)

IowaSector rules

Iowa enacted a companion chatbot law (SF 2417, 2 May 2026) effective 1 Jul 2027, and its insurance regulator has adopted the NAIC AI Model Bulletin.

Regulators: Attorney General, Insurance Division

Source: privacyworld.blog (16 Sep 2026)

NebraskaSector rules

Nebraska requires disclosure of AI use in health insurance utilization review and bars AI as the sole basis for denials (LB 77, 2025), and enacted a Conversational AI Safety Act for chatbots (14 Apr 2026) effective 1 Jul 2027.

Regulators: Attorney General, Department of Insurance

Source: privacyworld.blog (16 Sep 2026)

GeorgiaSector rules

Georgia enacted an AI companion chatbot law (signed 11 May 2026) that takes effect 1 Jul 2027.

Regulators: Attorney General

Source: privacyworld.blog (16 Sep 2026)

HawaiiSector rules

Hawaii's AI Disclosure and Safety Act (SB 3001), signed 13 Jul 2026 and in force since 14 Jul 2026, regulates companion chatbots, including hourly AI reminders for minors; Hawaii has also adopted the NAIC AI Model Bulletin.

Regulators: Attorney General, Insurance Division

Source: privacyworld.blog (16 Sep 2026)

New HampshireSector rules

New Hampshire is one of three states whose companion chatbot law was already in force before the 2026 wave, and it has adopted the NAIC AI Model Bulletin for insurers.

Regulators: Attorney General, Insurance Department

Source: privacyworld.blog (16 Sep 2026)

MarylandSector rules

Maryland HB 820 (2025) requires AI used in health insurance utilization review to rest on individual clinical circumstances and be open to state audit; Maryland has adopted the NAIC AI Model Bulletin.

Regulators: Maryland Insurance Administration

Source: klrd.gov (2 Mar 2026)

ArizonaSector rules

Arizona HB 2175 (2025) requires individual review by a medical director before a health insurer denies a claim or prior authorization on medical necessity grounds, rather than reliance on automated tools.

Regulators: Department of Insurance and Financial Institutions

Source: klrd.gov (2 Mar 2026)

Canada and Latin America 6

CanadaSector rules10 mandates

Canada has no general AI statute: the Artificial Intelligence and Data Act in Bill C-27 died when Parliament was prorogued on 6 January 2025, and the National AI Strategy launched on 5 June 2026 relies on privacy and online safety bills (Bill C-36, tabled 15 June 2026, and Bill C-34, tabled 10 June 2026) rather than a standalone AI act. Binding AI rules today are sectoral: the Treasury Board Directive on Automated Decision-Making for federal institutions (last amended 24 June 2025), Quebec Law 25 automated decision duties (since 22 September 2023) and Ontario AI disclosure in job postings (since 1 January 2026). OSFI Guideline E-23 and the AMF Quebec Guideline for the Use of AI both take effect on 1 May 2027 for financial institutions.

Regulators: Treasury Board of Canada Secretariat, Office of the Superintendent of Financial Institutions (OSFI), Autorite des marches financiers (AMF, Quebec), Commission d'acces a l'information du Quebec, Office of the Privacy Commissioner of Canada, Health Canada, Ontario Ministry of Labour, Immigration, Training and Skills Development

Source: canada.ca (Sep 2026)

BrazilSector rules6 mandates

Brazil's general AI bill, PL 2338/2023, passed the Senate on 10 December 2024 and is still before a special committee of the Chamber of Deputies; on 24 August 2026 the rapporteur said the vote would come after the October 2026 elections, after which the text returns to the Senate. Binding AI-related rules already apply through the LGPD right to review of automated decisions, the ECA Digital child online safety law (in force 17 March 2026, regulated by Decree 12.880 of 18 March 2026), TSE electoral rules on AI content for the 2026 elections and CNJ Resolution 615/2025 for courts. The ANPD, made a regulatory agency in 2026, enforces the LGPD and ECA Digital and runs an AI regulatory sandbox through December 2026.

Regulators: Agencia Nacional de Protecao de Dados (ANPD), Tribunal Superior Eleitoral (TSE), Conselho Nacional de Justica (CNJ), Banco Central do Brasil

Source: bairogonzalez.com (Oct 2026)

MexicoDraft AI law1 mandate

Mexico has no general AI law as of October 2026; federal initiatives are pending, including an April 2026 proposal to amend Article 73 of the Constitution to let Congress legislate on AI and a 24 July 2026 Chamber of Deputies bill for a Federal Law for the Ethical, Sovereign and Inclusive Development of AI with a proposed National Algorithmic Audit Platform. The main binding AI-specific rule is the December 2024 reform of the Federal Labor Law on digital platform work, which requires an algorithmic management policy and human review of decisions affecting platform workers. Several states have amended criminal codes on AI-generated fake content.

Regulators: Secretaria del Trabajo y Prevision Social, Centro Federal de Conciliacion y Registro Laboral, Congreso de la Union (pending legislation)

Source: itsitio.com (3 Aug 2026)

ChileDraft AI law2 mandates

Chile's risk-based AI bill (Boletin 16821-19, merged with 15869-19) was dispatched by the Chamber of Deputies to the Senate on 13 October 2025 and is in its second constitutional stage in the Senate committee on Future Challenges, Science, Technology and Innovation, with simple urgency last renewed on 1 September 2026. The new personal data law, Ley 21.719, takes full effect on 1 December 2026 and adds rights regarding automated individual decisions, enforced by the new Agencia de Proteccion de Datos Personales. The Cybersecurity Framework Law 21.663 already applies to operators of vital importance, including AI used in critical services.

Regulators: Agencia de Proteccion de Datos Personales, Agencia Nacional de Ciberseguridad (ANCI), Ministerio de Ciencia, Tecnologia, Conocimiento e Innovacion

Source: camara.cl (1 Sep 2026)

ColombiaDraft AI law1 mandate

Colombia has no AI law: the government bill (PL 043/2025 Senado, 324/2025 Camara) was archived at the end of the 2025 to 2026 legislative session without a first-debate vote, and new bills such as PL 025 de 2026 Camara (filed 21 July 2026) are pending. National AI policy is set by CONPES 4144 of 14 February 2025, and the Superintendencia de Industria y Comercio applies data protection law to AI through External Circular 002 of 21 August 2024, which calls for privacy impact studies before high-risk AI is designed.

Regulators: Superintendencia de Industria y Comercio (SIC), Ministerio de Ciencia, Tecnologia e Innovacion, Departamento Nacional de Planeacion

Source: slash-digital.io (26 Sep 2026)

PeruComprehensive AI law1 mandate

Peru has an AI framework law, Law 31814 of 2023, and its implementing regulation approved by Supreme Decree 115-2025-PCM is in force. The regulation classifies AI uses as improper, high-risk or acceptable, requires prior transparency for high-risk uses (article 25) and gives the private sector phased periods of one to four years to adapt.

Regulators: Presidencia del Consejo de Ministros, Secretaria de Gobierno y Transformacion Digital

Source: slash-digital.io (26 Sep 2026)

Europe 34

European UnionComprehensive AI law18 mandates

The EU AI Act has applied in stages since 2 Feb 2025, and the Digital Omnibus on AI (Regulation (EU) 2026/1744, published 24 Jul 2026, in force 27 Jul 2026) moved stand-alone Annex III high-risk obligations to 2 Dec 2027 and product-embedded Annex I obligations to 2 Aug 2028. Article 50 transparency duties have applied since 2 Aug 2026, two new prohibitions (non-consensual intimate imagery and child sexual abuse material) apply from 2 Dec 2026, and general-purpose AI model obligations have applied since 2 Aug 2025. AI is also governed by the Digital Services Act, DORA, the Cyber Resilience Act, the new Product Liability Directive, the Machinery Regulation, the GDPR and the Data Act.

Regulators: European Commission (AI Office), European Artificial Intelligence Board, National market surveillance authorities, European Data Protection Board

Source: eur-lex.europa.eu (24 Jul 2026)

AustriaComprehensive AI law

The EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744) applies directly. As of mid-2026 Austria had not formally designated its AI Act market surveillance and notifying authorities; an AI Service Desk operates within the regulator RTR.

Regulators: RTR (AI Service Desk), Austrian Data Protection Authority

Source: artificialintelligenceact.eu (17 Jun 2026)

BelgiumComprehensive AI law

The EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744) applies directly. As of mid-2026 Belgium had not formally designated its AI Act market surveillance authority and had no national implementing law.

Regulators: Belgian Data Protection Authority

Source: artificialintelligenceact.eu (17 Jun 2026)

BulgariaComprehensive AI law

The EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744) applies directly. As of mid-2026 Bulgaria had not formally designated its AI Act market surveillance and notifying authorities.

Regulators: Commission for Personal Data Protection

Source: artificialintelligenceact.eu (17 Jun 2026)

CroatiaComprehensive AI law

The EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744) applies directly. As of mid-2026 Croatia had not formally designated its AI Act market surveillance and notifying authorities.

Regulators: Croatian Personal Data Protection Agency (AZOP)

Source: artificialintelligenceact.eu (17 Jun 2026)

CyprusComprehensive AI law

The EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744) applies directly. Cyprus designated the Commissioner of Communications as its market surveillance authority, notifying authority and single point of contact for the AI Act.

Regulators: Commissioner of Communications (OCECPR)

Source: artificialintelligenceact.eu (17 Jun 2026)

Czech RepublicComprehensive AI law

The EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744) applies directly. A national implementing law was still in draft in mid-2026; it proposes the Czech Telecommunication Office as market surveillance authority and the Office for Standards, Metrology and Testing as notifying authority, with the Ministry of Industry and Trade leading.

Regulators: Ministry of Industry and Trade, Czech Telecommunication Office (proposed), Office for Standards, Metrology and Testing (proposed)

Source: artificialintelligenceact.eu (17 Jun 2026)

DenmarkComprehensive AI law

The EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744) applies directly. Denmark adopted national implementing Law No. 467, in force since 2 Aug 2025, designating the Agency for Digital Government as coordinating market surveillance authority, notifying authority and single point of contact, with the Data Protection Agency and the Court Administration supervising specific areas.

Regulators: Agency for Digital Government (Digitaliseringsstyrelsen), Danish Data Protection Agency (Datatilsynet), Danish Court Administration (Domstolsstyrelsen)

Source: artificialintelligenceact.eu (17 Jun 2026)

EstoniaComprehensive AI law

The EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744) applies directly. As of mid-2026 Estonia had not formally designated its AI Act market surveillance and notifying authorities.

Regulators: Estonian Data Protection Inspectorate

Source: artificialintelligenceact.eu (17 Jun 2026)

FinlandComprehensive AI law

The EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744) applies directly. Finland's national implementing legislation (Act 1377/2025) has been in force since 1 Jan 2026, with Traficom as single point of contact and supervision split among existing authorities.

Regulators: Traficom (single point of contact), Finnish Medicines Agency (Fimea), Data Protection Ombudsman, Ministry of Economic Affairs and Employment

Source: artificialintelligenceact.eu (17 Jun 2026)

FranceComprehensive AI law1 mandate

The EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744) applies directly. France has not yet enacted the law designating its AI Act authorities: the EU-law adaptation bill was adopted by the Senate on 18 Feb 2026 and was still awaiting committee review in the National Assembly (bill no. 2518) as of 5 Oct 2026. The government's designation scheme of 9 Sep 2025 gives the DGCCRF a coordinating market surveillance role and the CNIL competence over prohibited practices and several Annex III uses.

Regulators: CNIL, DGCCRF (proposed coordinating authority), Directorate General for Enterprise (DGE), ACPR (proposed, financial sector)

Source: gouvernanceia.fr (5 Oct 2026)

GermanyComprehensive AI law1 mandate

The EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744) applies directly. The national implementing act KI-MIG (Act of 22 Jul 2026, BGBl. 2026 I Nr. 223) has been in force since 29 Jul 2026, making the Bundesnetzagentur the default market surveillance authority, single point of contact and complaints body, with BaFin covering AI tied to regulated financial activities.

Regulators: Bundesnetzagentur (BNetzA), BaFin, German Accreditation Body (DAkkS), Federal Office for Information Security (BSI)

Source: gesetze-im-internet.de (22 Jul 2026)

GreeceComprehensive AI law

The EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744) applies directly. As of mid-2026 Greece had not formally designated its AI Act market surveillance and notifying authorities; the Ministry of Digital Governance leads implementation work.

Regulators: Ministry of Digital Governance, Hellenic Data Protection Authority

Source: artificialintelligenceact.eu (17 Jun 2026)

HungaryComprehensive AI law

The EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744) applies directly. Hungary completed its designations in 2025, naming a government minister as market surveillance authority and single point of contact and the National Accreditation Authority as notifying authority.

Regulators: Designated minister (market surveillance and single point of contact), National Accreditation Authority (NAH)

Source: artificialintelligenceact.eu (17 Jun 2026)

IrelandComprehensive AI law1 mandate

The EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744) applies directly. The Regulation of Artificial Intelligence Act 2026, signed into law on 21 Jul 2026, establishes the AI Office of Ireland as central coordinator and single point of contact, operational from 2 Aug 2026, within a distributed model of existing sector regulators designated under S.I. No. 366 of 2025.

Regulators: AI Office of Ireland, Central Bank of Ireland, Competition and Consumer Protection Commission, Data Protection Commission

Source: enterprise.gov.ie (30 Jul 2026)

ItalyComprehensive AI law1 mandate

The EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744) applies directly. Italy's national AI law (Law No. 132/2025) has been in force since 10 Oct 2025, and Legislative Decree No. 179 of 7 Oct 2026, in force 23 Oct 2026, designates AgID as notifying authority and ACN, Banca d'Italia, CONSOB, IVASS and the Garante as market surveillance authorities.

Regulators: Agency for Digital Italy (AgID), National Cybersecurity Agency (ACN), Banca d'Italia, CONSOB, IVASS, Garante per la protezione dei dati personali

Source: normattiva.it (8 Oct 2026)

LatviaComprehensive AI law

The EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744) applies directly. As of mid-2026 Latvia had no national implementing act; a government report proposed spreading supervision across sector authorities, with the Consumer Rights Protection Centre as single point of contact.

Regulators: Consumer Rights Protection Centre (proposed), Ministry of Economics (proposed notifying authority)

Source: artificialintelligenceact.eu (17 Jun 2026)

LithuaniaComprehensive AI law

The EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744) applies directly. Lithuania designated the Communications Regulatory Authority (RRT) as market surveillance authority and single point of contact and the Innovation Agency as notifying authority.

Regulators: Communications Regulatory Authority (RRT), Innovation Agency

Source: artificialintelligenceact.eu (17 Jun 2026)

LuxembourgComprehensive AI law

The EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744) applies directly. A draft implementing law introduced in December 2024, which would make the National Commission for Data Protection (CNPD) the default market surveillance authority, was still pending in 2026.

Regulators: National Commission for Data Protection (CNPD), CSSF (financial sector, proposed)

Source: artificialintelligenceact.eu (17 Jun 2026)

MaltaComprehensive AI law

The EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744) applies directly. Malta designated the Malta Digital Innovation Authority as lead market surveillance authority, notifying authority and single point of contact, with the Information and Data Protection Commissioner covering personal-data uses.

Regulators: Malta Digital Innovation Authority (MDIA), Information and Data Protection Commissioner

Source: artificialintelligenceact.eu (17 Jun 2026)

NetherlandsComprehensive AI law2 mandates

The EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744) applies directly. The draft AI Act Implementation Act (Uitvoeringswet AI-verordening) was put to public consultation from 20 Apr to 1 Jun 2026; it uses existing sector supervisors, with the Dutch Data Protection Authority (AP) and the State Inspectorate for Digital Infrastructure (RDI) coordinating.

Regulators: Autoriteit Persoonsgegevens (AP), Rijksinspectie Digitale Infrastructuur (RDI)

Source: rijksoverheid.nl (20 Apr 2026)

PolandComprehensive AI law1 mandate

The EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744) applies directly. Poland's Act on Artificial Intelligence Systems, signed by the President in July 2026, entered into force on 11 Aug 2026, creating the Commission for the Development and Safety of AI (KRiBSI) as supervisor and a legal basis for a regulatory sandbox; inspection, proceedings and penalty provisions apply from 28 Oct 2026.

Regulators: Commission for the Development and Safety of Artificial Intelligence (KRiBSI), Minister of Digital Affairs

Source: akademialtca.pl (Aug 2026)

PortugalComprehensive AI law

The EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744) applies directly. Portugal announced in September 2025 that the National Communications Authority (ANACOM) would act as market surveillance authority and single point of contact; national implementing legislation was not confirmed as of mid-2026.

Regulators: National Communications Authority (ANACOM)

Source: artificialintelligenceact.eu (17 Jun 2026)

RomaniaComprehensive AI law

The EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744) applies directly. A government memorandum of March 2026 proposed the communications regulator ANCOM as market surveillance authority and single point of contact and the Authority for the Digitalisation of Romania as notifying authority.

Regulators: ANCOM (proposed), Authority for the Digitalisation of Romania (proposed)

Source: artificialintelligenceact.eu (17 Jun 2026)

SlovakiaComprehensive AI law

The EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744) applies directly. As of mid-2026 Slovakia's implementing legislation was still in draft and its AI Act authorities were not finally designated.

Regulators: Office for Personal Data Protection of the Slovak Republic

Source: artificialintelligenceact.eu (17 Jun 2026)

SloveniaComprehensive AI law

The EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744) applies directly. Slovenia named the Agency for Communication Networks and Services (AKOS) as single point of contact and central coordinator for AI Act supervision, alongside other sector authorities.

Regulators: Agency for Communication Networks and Services (AKOS)

Source: artificialintelligenceact.eu (17 Jun 2026)

SpainComprehensive AI law1 mandate

The EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744) applies directly. Spain's AI Supervisory Agency (AESIA) is the central supervisor, and on 26 May 2026 the Council of Ministers sent the Organic Law on the good use and governance of AI to Congress, setting fines of up to EUR 35 million or 7% of turnover and a national sandbox run by AESIA.

Regulators: Spanish AI Supervisory Agency (AESIA), Spanish Data Protection Agency (AEPD), General Council of the Judiciary (CGPJ)

Source: digital.gob.es (26 May 2026)

SwedenComprehensive AI law

The EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744) applies directly. By a government decision of June 2026, valid on an interim basis to 31 Dec 2026, Sweden assigned AI Act supervision to the Post and Telecom Authority (PTS, coordinator and single point of contact) together with IMY, Finansinspektionen, the Medical Products Agency and Swedac; a permanent statute has not yet been adopted.

Regulators: Swedish Post and Telecom Authority (PTS), Swedish Authority for Privacy Protection (IMY), Finansinspektionen, Medical Products Agency, Swedac

Source: agentliability.eu (17 Aug 2026)

NorwayDraft AI law

The EU AI Act has not yet been made applicable in the EEA, and Norway is preparing national legislation to implement it. The Norwegian Communications Authority (Nkom) has been named national coordinating supervisory authority.

Regulators: Norwegian Communications Authority (Nkom), Norwegian Data Protection Authority (Datatilsynet)

Source: artificialintelligenceact.eu (17 Jun 2026)

IcelandSector rules

As an EEA state Iceland applies the GDPR, but the EU AI Act had not yet been made applicable in the EEA as of mid-2026 and no AI Act authorities had been appointed.

Regulators: Icelandic Data Protection Authority (Persónuvernd)

Source: artificialintelligenceact.eu (17 Jun 2026)

LiechtensteinSector rules

As an EEA state Liechtenstein applies the GDPR, but the EU AI Act had not yet been made applicable in the EEA as of mid-2026 and no AI Act authorities had been appointed. Liechtenstein signed the Council of Europe AI Convention in February 2025.

Regulators: Data Protection Authority of Liechtenstein

Source: artificialintelligenceact.eu (17 Jun 2026)

United KingdomSector rules8 mandates

The UK has no AI-specific statute and regulates AI through existing sector regulators, supported by the Trusted Third-Party AI Assurance Roadmap (3 Sep 2025) and a GBP 11 million AI Assurance Innovation Fund. Automated decision-making reforms in the Data (Use and Access) Act 2025 commenced on 5 Feb 2026, the PRA updated its model risk statement SS1/23 on 23 Apr 2026, and the FCA published AI good and poor practice on 19 Oct 2026.

Regulators: Department for Science, Innovation and Technology (DSIT), Information Commissioner's Office (ICO), Financial Conduct Authority (FCA), Prudential Regulation Authority (PRA), Ofcom, Medicines and Healthcare products Regulatory Agency (MHRA), Competition and Markets Authority (CMA)

Source: gov.uk (3 Sep 2025)

SwitzerlandSector rules1 mandate

Switzerland has no AI-specific law; on 12 Feb 2025 the Federal Council decided to incorporate the Council of Europe AI Convention into Swiss law through targeted sector amendments, with a consultation draft due by the end of 2026. The revised Federal Act on Data Protection, in force since 1 Sep 2023, already applies to AI, including duties on automated individual decisions.

Regulators: Federal Office of Communications (OFCOM/BAKOM), Federal Data Protection and Information Commissioner (FDPIC), Federal Department of Justice and Police

Source: bakom.admin.ch (10 Mar 2025)

TurkeyDraft AI law1 mandate

Turkey has no AI-specific law; a draft law amending several statutes for AI, including mandatory deepfake labeling, was submitted to the Grand National Assembly in late 2025. Presidential Circular No. 2026/9 (Official Gazette 18 Aug 2026) sets the AI Action Plan 2026 to 2030, including governance as a pillar.

Regulators: Personal Data Protection Authority (KVKK), Information and Communication Technologies Authority (BTK), Ministry of Industry and Technology

Source: erdem-erdem.av.tr (18 Aug 2026)

Middle East 8

United Arab EmiratesSector rules6 mandates

The UAE has no federal AI statute. On 14 June 2026 the Cabinet announced a federal Artificial Intelligence and Data Authority that merges the AI Office, the digital government sector of TDRA and the UAE Data Office, while the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) is in force with implementing regulations still pending. Binding or supervisory AI rules come from sector and free zone regulators, including the CBUAE Guidance Note on AI and machine learning (February 2026), DIFC Regulation 10 on processing through autonomous systems (enacted September 2023, amendments consulted on June to July 2026) and health regulator policies in Abu Dhabi and Dubai.

Regulators: Artificial Intelligence and Data Authority, Central Bank of the UAE (CBUAE), DIFC Commissioner of Data Protection, ADGM Office of Data Protection, Telecommunications and Digital Government Regulatory Authority (TDRA), Dubai Centre for Artificial Intelligence, Department of Health Abu Dhabi, Dubai Health Authority

Source: uaecabinet.ae (14 Jun 2026)

Saudi ArabiaGuidance only4 mandates

Saudi Arabia has no AI-specific statute; SDAIA is the national data and AI authority and governs AI mainly through frameworks and guidelines, most recently the National AI Risk Management Framework announced on 14 July 2026. The Personal Data Protection Law has been in force since 14 September 2023, with enforcement after a one-year transition, and requires risk assessments for decisions based on automated processing. Other instruments include the AI Ethics Principles, the Deepfakes Guidelines (SDAIA-P119) and a draft Global AI Hub Law released for consultation by CST on 14 April 2025.

Regulators: Saudi Data and Artificial Intelligence Authority (SDAIA), National Data Management Office, Communications, Space and Technology Commission (CST), Saudi Central Bank (SAMA)

Source: spa.gov.sa (14 Jul 2026)

QatarSector rules1 mandate

Qatar has no general AI law. The Qatar Central Bank issued an Artificial Intelligence Guideline on 4 September 2024 for QCB-licensed entities, covering governance, risk management, outsourcing, human oversight and QCB approvals before high-risk AI is deployed. Personal data processing by AI systems falls under the Personal Data Privacy Protection Law (Law No. 13 of 2016).

Regulators: Qatar Central Bank (QCB), Ministry of Communications and Information Technology (MCIT)

Source: qna.org.qa (4 Sep 2024)

BahrainDraft AI law1 mandate

Bahrain's Shura Council unanimously approved a 38-article AI regulation law proposal in April 2024, which has since been under review by the Council of Representatives and has not been enacted. A General Policy for the Use of Artificial Intelligence (May 2025), developed by the Information and eGovernment Authority, applies to all government entities. AI processing of personal data is subject to the Personal Data Protection Law (Law No. 30 of 2018).

Regulators: Information and eGovernment Authority, Personal Data Protection Authority, Central Bank of Bahrain

Source: middleeastainews.com (29 Jul 2025)

OmanGuidance only

Oman's Ministry of Transport, Communications and Information Technology issued a public policy for the safe and ethical use of AI systems in 2025, covering public and private sector use, with oversight by the ministry and sector regulators. In May 2026 the Shura Council was reviewing amendments to the Personal Data Protection Law that would clarify rules on automated processing. Royal Decree No. 50/2026 of 30 April 2026 created an AI Special Zone in Muscat, which offers incentives but no AI rules.

Regulators: Ministry of Transport, Communications and Information Technology (MTCIT)

Source: trowers.com (Jun 2026)

KuwaitNo AI-specific rules yet

Kuwait has no binding AI-specific law as of October 2026. A national AI strategy aligned with Kuwait Vision 2035 has been reported, and AI use is governed by existing data privacy, cybersecurity and telecommunications rules.

Regulators: Communication and Information Technology Regulatory Authority (CITRA)

Source: digital.nemko.com (2025)

JordanGuidance only

Jordan relies on the Jordanian AI Strategy and Implementation Plan (2023 to 2027) and a National Charter of Ethics for Artificial Intelligence; there is no AI-specific statute. The Personal Data Protection Law (Law No. 24 of 2023), published on 17 September 2023, became fully operational after its grace period ended in March 2025 and regulates profiling.

Regulators: Ministry of Digital Economy and Entrepreneurship, Personal Data Protection Council

Source: securiti.ai (2025)

IsraelGuidance only1 mandate

Israel has no AI statute; a December 2023 government AI policy favors sector-based, responsible innovation over horizontal regulation. Amendment 13 to the Protection of Privacy Law took effect on 14 August 2025 and applies to AI systems that process personal data, and the Privacy Protection Authority published draft guidance in 2025 on applying privacy law to AI that remained a draft at the start of 2026.

Regulators: Privacy Protection Authority, Israel Securities Authority, Ministry of Innovation, Science and Technology

Source: barlaw.co.il (1 Jan 2026)

Africa 11

EgyptGuidance only1 mandate

Egypt's National Council for AI approved the National AI Governance Framework (edition 2.0) on 15 March 2026, with four risk tiers, pre-deployment ethical impact and technical conformity assessments for high-risk systems, an AI risk registry and a phased plan to make conformity assessments mandatory for high-risk sectors; a dedicated AI law may follow. The Personal Data Protection Law (Law No. 151 of 2020) gained executive regulations on 1 November 2025, starting a one-year compliance period.

Regulators: National Council for Artificial Intelligence (NCAI), Egyptian Center for Responsible AI (ECRAI), ITIDA (SECC), Personal Data Protection Center, Central Bank of Egypt, Financial Regulatory Authority

Source: ai.gov.eg (15 Mar 2026)

NigeriaDraft AI law5 mandates

Nigeria has no enacted AI law, but several AI bills are pending, including the National Digital Economy and E-Governance Bill, which was at third reading in July 2026 and would set a risk-based AI framework, and SB 731 to create a National AI Commission. Binding AI-relevant rules already come from the Nigeria Data Protection Act 2023 and the NDPC's General Application and Implementation Directive (effective September 2025), the NCC Internet Code of Practice 2026 and the CBN's 2025 baseline standards for automated AML solutions.

Regulators: Nigeria Data Protection Commission (NDPC), National Information Technology Development Agency (NITDA), Nigerian Communications Commission (NCC), Central Bank of Nigeria (CBN)

Source: digitalpolicyalert.org (2026)

South AfricaNo AI-specific rules yet

South Africa has no AI-specific rules: a Draft National AI Policy gazetted on 10 April 2026 was withdrawn on 26 April 2026 after fictitious citations were found, and the department aims to publish a revised version in the first quarter of 2027. AI use is governed by POPIA, and the FSCA and Prudential Authority published a joint report on AI in the financial sector in late 2025.

Regulators: Department of Communications and Digital Technologies, Information Regulator, Financial Sector Conduct Authority (FSCA), Prudential Authority

Source: techcentral.co.za (21 Oct 2026)

KenyaGuidance only

Kenya launched its National AI Strategy 2025 to 2030 on 27 March 2025, which creates no binding obligations and points to future legislation. AI processing of personal data is subject to the Data Protection Act 2019, enforced by the Office of the Data Protection Commissioner, and the Kenya Robotics and AI Society Bill 2023 remains a private member's bill under review.

Regulators: Ministry of Information, Communications and the Digital Economy, Office of the Data Protection Commissioner

Source: regulations.ai (19 Sep 2026)

RwandaGuidance only

Rwanda's Cabinet approved a National AI Policy in April 2023, one of the first in Africa; it is policy rather than binding law. No AI-specific binding rules were identified as of October 2026, and AI processing of personal data falls under Rwanda's data protection law.

Regulators: Ministry of ICT and Innovation (MINICT), Rwanda Information Society Authority (RISA)

Source: levellers.ai (Jun 2026)

MauritiusGuidance only

Mauritius was the first African country to publish a national AI strategy, in 2018. No AI-specific law was identified as of October 2026; AI use that involves personal data is covered by the country's data protection law.

Regulators: Data Protection Office

Source: levellers.ai (Jun 2026)

MoroccoNo AI-specific rules yet

Morocco has no AI-specific binding rules; AI is addressed as a pillar of the Digital Morocco 2030 strategy. An AI-specific law and a national AI agency have been reported as in preparation or proposed, without an adopted text as of October 2026.

Regulators: National Commission for the Control of Personal Data Protection (CNDP)

Source: casrai.org (25 Sep 2026)

GhanaGuidance only

Ghana governs AI through policy rather than law, including the Digital Economy Policy and Strategy (May 2024) and a Readiness Assessment Measurement for the ethical use of AI launched on 30 September 2024. No AI-specific binding rules were identified; data protection and cybersecurity statutes apply.

Regulators: Data Protection Commission, Cyber Security Authority

Source: regulations.ai (19 Sep 2026)

TunisiaNo AI-specific rules yet

Tunisia has no AI-specific law as of October 2026. AI processing of personal data falls under the national data protection law overseen by the national data protection authority.

Regulators: Instance Nationale de Protection des Donnees Personnelles (INPDP)

Source: aipolicytracker.org (2026)

EthiopiaGuidance only

Ethiopia adopted a National AI Policy in June 2024, and its Artificial Intelligence Institute was established by Council of Ministers Regulation No. 510/2022. Drafting work on AI legislation was reported in May 2026, with no enacted AI law as of October 2026.

Regulators: Ethiopian Artificial Intelligence Institute

Source: regulations.ai (19 Sep 2026)

ZambiaGuidance only

Zambia published a national AI strategy in 2024 and has no AI-specific law. AI processing of personal data is subject to the national data protection law.

Regulators: Ministry of Technology and Science

Source: aipolicytracker.org (2026)

Asia 17

ChinaSector rules7 mandates

China regulates AI through a stack of targeted CAC-led rules: algorithm recommendation provisions (in force 1 Mar 2022), deep synthesis provisions (10 Jan 2023), generative AI interim measures (15 Aug 2023), AI-generated content labeling measures with a mandatory national standard (1 Sep 2025) and anthropomorphic AI interaction measures (15 Jul 2026). The amended Cybersecurity Law, in force 1 Jan 2026, adds the first explicit AI provision and raises maximum fines to RMB 10 million, and AI technology ethics review measures took effect on issuance on 20 Mar 2026.

Regulators: Cyberspace Administration of China (CAC), Ministry of Industry and Information Technology (MIIT), Ministry of Science and Technology (MOST), Ministry of Public Security, State Administration for Market Regulation (SAMR), National Radio and Television Administration

Source: cac.gov.cn (10 Apr 2026)

Hong KongGuidance only4 mandates

Hong Kong has no AI statute and relies on regulator guidance. On 15 Oct 2026 the HKMA announced its ART (Accountability, Resilience, Trust) Framework for banks, including new supervisory guidance and a planned discussion paper on agentic AI that will explore a registry of material AI agents. The SFC applies a Nov 2024 circular on generative AI to licensed corporations, and the PCPD's June 2024 Model Personal Data Protection Framework guides AI procurement and use.

Regulators: Hong Kong Monetary Authority (HKMA), Securities and Futures Commission (SFC), Office of the Privacy Commissioner for Personal Data (PCPD), Insurance Authority (IA)

Source: info.gov.hk (15 Oct 2026)

TaiwanComprehensive AI law2 mandates

Taiwan's Artificial Intelligence Basic Act passed the Legislative Yuan on 23 Dec 2025 and was promulgated and took effect on 14 Jan 2026. It is a framework law: the NSTC is the central competent authority, the Ministry of Digital Affairs must promote a risk classification framework and verification tools, government agencies must risk-assess their AI use, and competent authorities have two years (to Jan 2028) to align laws and rules.

Regulators: National Science and Technology Council (NSTC), Ministry of Digital Affairs (MODA), Sector competent authorities

Source: leeandli.com (Jan 2026)

JapanComprehensive AI law2 mandates

Japan's AI Promotion Act (Act No. 53 of 2025) passed the Diet on 28 May 2025 and fully entered into force in September 2025; it is a promotion-focused law with no monetary penalties. The AI Strategic Headquarters issued guidelines on ensuring the appropriateness of AI on 19 Dec 2025, the Cabinet adopted the first AI Basic Plan on 23 Dec 2025 and a revised second plan on 14 Jul 2026 that commits to reviewing the legal framework. Sector oversight comes from regulators such as the FSA, whose AI discussion paper was updated to version 1.1 on 3 Mar 2026.

Regulators: AI Strategic Headquarters (Cabinet Office), Japan AI Safety Institute (AISI), Financial Services Agency (FSA), Ministry of Economy, Trade and Industry (METI), Ministry of Internal Affairs and Communications (MIC)

Source: www8.cao.go.jp (14 Jul 2026)

South KoreaComprehensive AI law5 mandates

The Framework Act on the Development of Artificial Intelligence and Establishment of Trust (AI Basic Act), promulgated 21 Jan 2025, took effect with its Enforcement Decree on 22 Jan 2026. It imposes duties on high-impact AI operators, generative AI notice and labeling duties, safety duties for very large models, and domestic representative duties for large foreign operators, with fines up to KRW 30 million. MSIT has announced a grace period of at least one year for fact-finding investigations and fines, and the FSC's updated financial sector AI guidelines took effect on 22 Jun 2026.

Regulators: Ministry of Science and ICT (MSIT), Financial Services Commission (FSC), Financial Supervisory Service (FSS), Personal Information Protection Commission (PIPC)

Source: shinkim.com (11 Feb 2026)

IndiaSector rules5 mandates

India has no AI-specific statute and released non-binding India AI Governance Guidelines on 5 Nov 2025. Binding AI-relevant rules come from the IT Rules amendment on synthetically generated content (notified 10 Feb 2026, in force 20 Feb 2026) and the DPDP Rules 2025 (notified 13 Nov 2025, phased to 13 May 2027). Financial regulators are moving fastest: RBI published the FREE-AI framework report on 13 Aug 2025 and draft model risk management guidance covering AI on 24 Jun 2026, SEBI said on 10 Oct 2026 it will shortly issue AI/ML guidelines, and IRDAI formed an AI working group on 19 Jun 2026.

Regulators: Ministry of Electronics and Information Technology (MeitY), Reserve Bank of India (RBI), Securities and Exchange Board of India (SEBI), Insurance Regulatory and Development Authority of India (IRDAI), Data Protection Board of India

Source: hlc.com (Feb 2026)

SingaporeSector rules4 mandates

Singapore regulates AI mainly through sector regulators and voluntary frameworks. MAS issued final Guidelines on AI Risk Management for all financial institutions on 7 Oct 2026, with expectations phased in from 7 Oct 2027 and 7 Oct 2028. IMDA launched the Model AI Governance Framework for Agentic AI on 22 Jan 2026, and the AI Verify Foundation runs the Global AI Assurance Sandbox and launched the AI Tester Accreditation Programme on 14 Oct 2026.

Regulators: Monetary Authority of Singapore (MAS), Infocomm Media Development Authority (IMDA), AI Verify Foundation, Personal Data Protection Commission (PDPC), Ministry of Digital Development and Information (MDDI)

Source: mas.gov.sg (7 Oct 2026)

MalaysiaDraft AI law2 mandates

Malaysia is preparing its first horizontal AI law: the Ministry of Digital, through the National AI Office (NAIO), began engagement and a public consultation on a proposed AI Governance Bill on 10 Jul 2026. Bank Negara Malaysia issued a Discussion Paper on AI in the Malaysian Financial Sector on 5 Aug 2025, with feedback closing 17 Oct 2025.

Regulators: Ministry of Digital, National AI Office (NAIO), Bank Negara Malaysia (BNM)

Source: digital.gov.my (10 Jul 2026)

IndonesiaDraft AI law2 mandates

Indonesia has no binding AI law. On 27 Jul 2026 the Ministry of Communication and Digital Affairs announced it had completed drafting a Presidential Regulation on an AI Roadmap and AI Ethics, which remains under deliberation. OJK has published an AI governance guideline for Indonesian banking (2025) that sets risk classification, accountability and explainability expectations.

Regulators: Ministry of Communication and Digital Affairs (Komdigi), Financial Services Authority (OJK)

Source: digitalpolicyalert.org (27 Jul 2026)

VietnamComprehensive AI law3 mandates

Vietnam's Law on Artificial Intelligence No. 134/2025/QH15, passed 10 Dec 2025, took effect on 1 Mar 2026 with a three-tier risk model, pre-deployment notification, conformity assessment for high-risk systems and labeling duties. Decree 142/2026/ND-CP (effective 1 May 2026) implements the law, and Prime Minister Decision 33/2026/QD-TTg (effective 15 Aug 2026) lists high-risk AI systems in six sectors, with compliance due by 1 Mar 2027 and by 1 Sep 2027 for existing healthcare, education and financial systems.

Regulators: Ministry of Science and Technology (MOST), Prime Minister (high-risk list)

Source: tilleke.com (May 2026)

ThailandDraft AI law2 mandates

ETDA released a new draft Artificial Intelligence Act on 2 Jul 2026 and ran a public consultation from 9 Jul to 14 Aug 2026; the draft covers prohibited AI, high-risk AI designated by royal decree, deployer duties, local representatives for foreign providers and strict liability. In the financial sector, the Bank of Thailand issued AI Risk Management Guidelines for Financial Service Providers on 12 Sep 2025.

Regulators: Electronic Transactions Development Agency (ETDA), Ministry of Digital Economy and Society (MDES), Bank of Thailand (BOT)

Source: tilleke.com (2 Jul 2026)

PhilippinesDraft AI law1 mandate

The Philippines has no AI statute. In the House of Representatives, a technical working group of the Committee on ICT is consolidating 26 bills into a substitute Artificial Intelligence Development and Regulation Act; it met on 13 Jul 2026 and took stakeholder amendments until 20 Jul 2026. The draft would require registration and safety checks only for high-risk systems such as those deciding loans, jobs and health.

Regulators: House Committee on Information and Communications Technology (legislative), Department of Information and Communications Technology (DICT), National Privacy Commission (NPC)

Source: philstar.com (14 Jul 2026)

PakistanGuidance only

Pakistan's federal cabinet approved the National Artificial Intelligence Policy 2025 on 30 Jul 2025, focused on skills, funding and public sector adoption with an AI Council to oversee implementation. There is no binding AI-specific law or assessment mandate as of Oct 2026.

Regulators: Ministry of Information Technology and Telecommunication (MoITT), AI Council

Source: tribune.com.pk (30 Jul 2025)

BangladeshGuidance only1 mandate

Bangladesh released a draft National AI Policy 2026-2030 for public consultation in late January 2026. The draft proposes a risk-based structure, bans social scoring and mass surveillance, and calls for algorithmic impact assessments for high-risk public sector AI; it is policy, not law.

Regulators: Information and Communication Technology Division

Source: thefinancialexpress.com.bd (29 Jan 2026)

Sri LankaNo AI-specific rules yet

Sri Lanka has no AI-specific law or assessment mandate. In June 2025 national AI policy and implementation work was placed under ICTA in the interim, pending creation of GovTech and a Digital Economy Authority, and a National AI Strategy has been published by the Ministry of Technology.

Regulators: Information and Communication Technology Agency (ICTA)

Source: icta.lk (24 Jun 2025)

KazakhstanComprehensive AI law2 mandates

Kazakhstan's Law No. 230-VIII "On Artificial Intelligence" was signed on 17 Nov 2025 and took effect on 18 Jan 2026. It requires owners to classify AI systems by risk level, run lifecycle risk management for high-risk systems, label synthetic content and tell users when they interact with AI, and it ties inclusion on a list of trusted AI systems to an audit.

Regulators: Ministry of Artificial Intelligence and Digital Development

Source: ey.com (9 Dec 2025)

UzbekistanSector rules

Uzbekistan regulates AI through amendments to existing laws rather than a standalone act: Law No. LRU-1115, signed on 21 Jan 2026, defines artificial intelligence, sets general rules for AI use in information systems and makes unlawful processing or dissemination of personal data using AI an administrative offense.

Regulators: Ministry of Digital Technologies

Source: babl.ai (Feb 2026)

Oceania 4

AustraliaSector rules11 mandates

Australia has no AI-specific statute in force as of October 2026. AI is governed through privacy, online safety, consumer, prudential, workplace and therapeutic goods laws, plus a mandatory AI policy for Commonwealth agencies (version 2.0 from 15 December 2025). The National AI Plan of 2 December 2025 set aside mandatory guardrails, but on 15 July 2026 the Prime Minister announced mandatory national AI Standards and a new Office of AI in the Department of the Prime Minister and Cabinet, with an infrastructure and frontier AI consultation that closed on 9 October 2026 and legislation planned for early 2027.

Regulators: Office of AI (Department of the Prime Minister and Cabinet), Digital Transformation Agency, Office of the Australian Information Commissioner, eSafety Commissioner, ACCC, ASIC, APRA, ACMA, Therapeutic Goods Administration, SafeWork NSW

Source: whitecase.com (16 Jul 2026)

New ZealandGuidance only6 mandates

New Zealand relies on existing law and voluntary guidance rather than an AI-specific statute. The national AI strategy and a voluntary Responsible AI Guidance for Businesses were released on 8 July 2025, and the Public Service AI Framework followed on 29 January 2025. Binding rules that reach AI come through the Privacy Act 2020, including the Biometric Processing Privacy Code 2025 (in force 3 November 2025, existing processing by 3 August 2026), and a government bill on social media minimum age and child safety risk assessments was announced on 24 August 2026.

Regulators: Office of the Privacy Commissioner, Ministry of Business, Innovation and Employment, Government Chief Digital Officer (Department of Internal Affairs), Department of Internal Affairs (proposed online safety regulator)

Source: mbie.govt.nz (8 Jul 2025)

Papua New GuineaGuidance only1 mandate

Papua New Guinea has no AI law in force. The Ministry of Information and Communications Technology released a Draft PNG Government Artificial Intelligence Adoption Framework for consultation in February 2026 and a Draft National Sovereign Digital Transformation and Artificial Intelligence Strategy in March 2026, which proposes new laws on AI, digital identity and data governance and a National Digital Economy Authority for oversight.

Regulators: Ministry and Department of Information and Communications Technology

Source: ict.gov.pg (22 Mar 2026)

FijiNo AI-specific rules yet

Fiji has no AI-specific law; AI is folded into the National Digital Strategy 2025 to 2030 approved by Cabinet in 2025, and an AI ethics or user protection framework announced in 2024 has not been finalized. Regionally, Pacific Islands Forum Foreign Ministers in August 2026 backed Pacific Digital and Artificial Intelligence Technology Principles and the development of a regional AI Governance Framework for Leaders to consider in 2027.

Regulators: Ministry of Communications

Source: council.science (Feb 2026)

Global standards and schemes 1

GlobalGuidance only10 mandates

Global AI governance rests on voluntary international standards such as ISO/IEC 42001, 42005, 42006 and 23894, industry schemes such as CSA STAR for AI and AIUC-1, and widely used references such as the NIST AI RMF. The Council of Europe Framework Convention on AI (CETS No. 225), opened for signature on 5 September 2024, has 21 signatories including the EU; the EU ratified on 15 May 2026, and the treaty is not yet in force because it needs five ratifications including three Council of Europe member states. ISO/IEC 17020:2026 for inspection bodies was published on 27 March 2026 with a transition ending 27 March 2029.

Regulators: ISO/IEC JTC 1/SC 42, ISO CASCO, Council of Europe, International Accreditation Forum and ILAC member accreditation bodies

Source: coe.int (Oct 2026)

How we build it

Checked against official sources

Every entry links to the law, regulator or official publication it comes from and carries the date we last verified it. We add new mandates as they are enacted and review every entry at least once a quarter. Entries we could not confirm against a reliable source are left out until we can.

Spotted a change? Write to contactus@axilayerai.com.

Good to know

  • This map is general information, not legal advice.
  • AxiLayer AI is not a notified body under the EU AI Act. Where a law reserves an assessment for a notified body or a regulator, we provide readiness evidence for it.
  • For China, the map describes the rules only.
  • AxiLayer AI’s ISO/IEC 17020:2026 Type A application is in process, alongside a parallel ISO/IEC 42001 application, both with a U.S.-based accreditation body signatory to the ILAC MRA and IAF MLA.
Next step

Turn the rules that apply to you into signed evidence

AxiSentinel™ evaluates your AI systems against every mandate on this map that applies to you, and a qualified AxiLayer AI auditor reviews and signs every finding.

Request a briefing See every deadline
Questions

Frequently asked questions

Which countries require an AI audit or assessment in 2026?

The European Union requires conformity assessment for high-risk AI from 2 Dec 2027, New York City requires annual bias audits of hiring tools, Illinois will require third-party audits of large frontier developers from 1 Jan 2028, and many countries require impact assessments, registrations or risk programs. This map lists 192 mandates across 81 countries, each linked to its official source.

What is the difference between an AI audit and a conformity assessment?

An AI audit is a structured, evidence-based review of an AI system against stated criteria, often by a third party. A conformity assessment is a formal procedure a law requires before a product is placed on the market, such as under the EU AI Act, and may be done internally or by a notified body depending on the system.

Who can perform an AI audit?

It depends on the law. Some rules require a third-party auditor, some a notified or accredited body, and some let the organization assess itself. Each entry on this map says who performs the assessment. A qualified AxiLayer AI auditor reviews and signs every AxiLayer AI finding.

How often is the AxiLayer AI Audit Mandates Map updated?

Entries are added as new rules are enacted and every entry is reviewed at least once a quarter. Each card shows its source and the date we last verified it, currently 23 October 2026.

How can AxiLayer AI help with the AI rules that apply to my company?

AxiSentinel evaluates your AI systems continuously against the mandates that apply in each of your markets, and a qualified AxiLayer AI auditor reviews and signs every finding, so you have evidence ready for regulators, customers and insurers. Request a briefing to start.