AI Regulation Tracker
Live statusAI regulation is the fast-growing body of law, standards, and enforcement action governing how organizations build, deploy, and monitor artificial intelligence. This tracker covers 119+ regulations, frameworks, and enforcement actions across major jurisdictions, including the EU AI Act, the NIST AI Risk Management Framework, state laws, and voluntary standards. Each entry links to its primary source and updates when its status changes.
Singapore's AI Verify Testing Framework
Singapore's Infocomm Media Development Authority developed this voluntary AI governance framework and toolkit. Organizations use its standardized technical tests and process checks to demonstrate responsible AI practices.
America's AI Action Plan
America's AI Action Plan is the White House's AI policy agenda, released on 23 July 2025. It sets out more than 90 federal actions under three pillars: accelerating AI innovation, building American AI infrastructure, and leading in international AI diplomacy and security. It favors removing regulatory barriers over adding new rules.
Australia AI Ethics Framework
Australia's 2019 AI Ethics Principles set eight voluntary principles for designing, developing, and using AI. Since October 2025 the government's main guidance has been the Guidance for AI Adoption, which builds on them.
Australian Standards for AI (Data Centres and Frontier AI Training)
On 15 July 2026 Australia's Prime Minister announced mandatory Australian Standards for AI, with legislation planned for early 2027. They would set minimum requirements for large data centres and conditions for frontier AI training in Australia. A public consultation closes on 9 October 2026.
Australia Guidance for AI Adoption (AI6)
Australia's National AI Centre published the Guidance for AI Adoption on 21 October 2025. It sets six voluntary essential practices for organisations that develop or deploy AI, and replaces the 2024 Voluntary AI Safety Standard's ten guardrails. It builds on Australia's 2019 AI Ethics Principles.
Bletchley Declaration on AI Safety
At the inaugural AI Safety Summit, 28 governments signed this political declaration. They recognized risks from frontier (most advanced) AI and committed to international cooperation on safety, evaluation, and information sharing.
California AI Auditor Registration Act (AB 1405)
AB 1405 creates California’s first registry for independent AI auditors. Auditors must register with the Government Operations Agency and disclose their credentials and methods. They must also follow recognized independence standards. From January 1, 2029, only registered auditors may perform covered audits in California.
California Generative AI Transparency Requirements - AB 2013
California Assembly Bill (AB) 2013 requires public training-data disclosures from developers of generative AI systems accessible to the California public. Developers must publish the documentation on their websites. The disclosures explain training datasets’ origins and composition. The requirement applies regardless of where the developer is headquartered.
California AI Transparency Act (SB 942 as amended by AB 853)
The California AI Transparency Act applies to makers of generative AI systems with over 1 million monthly users that are publicly accessible in California. They must offer a free detection tool, offer users a visible disclosure option, and embed latent disclosures in AI-generated images, video, and audio. Licenses must let them revoke access within 96 hours if a licensee disables disclosures.
California Executive Order N-9-26 on Independent AI Oversight and an AI Kill Switch
Governor Newsom signed Executive Order N-9-26 on 18 September 2026. It convenes experts to recommend, within two months, changes to California's frontier AI safety laws, including independent verification and an emergency shutoff for frontier models. It imposes no new duties on companies itself.
California AB 3030: Generative AI Disclosure in Health Care Communications
California AB 3030 has applied since 1 January 2025. Health facilities, clinics, and physician offices must tell patients when generative AI writes communications about their clinical information, and explain how to reach a human. Messages reviewed by a licensed provider are exempt.
California Independent Verification Organizations Act (SB 813)
California SB 813, signed on 9 September 2026, lets the Government Operations Agency designate independent verification organizations (IVOs), meaning approved AI auditors. Using an IVO is voluntary. The agency must set designation requirements by 1 January 2028.
California Transparency in Frontier Artificial Intelligence Act (SB 53)
California's Transparency in Frontier Artificial Intelligence Act (SB 53) applies to developers of the largest AI models. Signed in September 2025 and in force since 1 January 2026, it requires published safety frameworks and transparency reports, and prompt reporting of critical safety incidents. The law also protects employees who report risks.
China AI Standardization White Paper (CESI, 2021 edition)
Chinese standards authorities issued this non-binding policy document to map AI standards work. It identifies priorities and outlines planned national and international standardization efforts.
China Algorithm Recommendation Regulations
China's dedicated regulation on recommendation algorithms covers internet services operating in China or targeting Chinese users. Providers must meet transparency, user-control, and content-moderation duties.
China Deep Synthesis Regulations
China's deep synthesis provisions regulate deep synthesis internet information services provided within China. They cover AI-generated or manipulated text, images, audio, video, and virtual humans. Duties include labeling, filing, security assessments, and content moderation.
China Draft AI Law
China is developing a proposed national AI law. It would establish legal duties for AI development, deployment, and governance across sectors.
China's Interim Measures for the Management of Generative Artificial Intelligence Services
China’s Interim Measures for Generative AI Services cover providers serving the Chinese public. They impose duties for training data governance, content safety, algorithmic transparency, and registration.
Implementation Opinions on the Standardized Application and Innovative Development of Intelligent Agents
Three Chinese regulators released these Implementation Opinions on 8 May 2026, China's first policy framework dedicated to AI agents. The document is a policy framework rather than a binding regulation. It sets principles on user control and agent authority, with filing, compliance testing, and recall expected in sensitive sectors.
China's Interim Measures for Artificial Intelligence Anthropomorphic Interactive Services
China's Interim Measures for AI Anthropomorphic Interactive Services took effect on 15 July 2026. They cover AI services offering continuous emotional interaction that imitates a person's personality, thinking, and communication style. Providers must avoid fostering emotional dependence, protect minors and older users, and complete assessments and filing.
China's Measures for Labelling AI-Generated and Synthetic Content
China's labelling measures require AI-generated and synthetic content shown to users in China to carry labels. Visible labels are needed in many cases, and implicit labels must be embedded in file metadata. Platforms must check for labels and add notices to AI-generated content.
Colorado AI Act (SB 24-205), repealed
Colorado's SB 24-205, signed in May 2024, would have regulated developers and deployers of high-risk AI. It never took effect: its start date slipped from February 2026 to June 2026. In May 2026 Colorado repealed it and replaced it with SB 26-189, a narrower automated decision-making law effective 1 January 2027.
Colorado SB 26-189: Automated Decision-Making Technology Act
Colorado's SB 26-189, signed on 14 May 2026, repeals and replaces the state's 2024 AI Act. From 1 January 2027 it regulates automated decision-making technology used in consequential decisions about consumers. Deployers must give notice before use, explain adverse outcomes, and offer human review. Developers must give deployers the information they need.
Commerce Department Evaluation of State AI Laws
The December 11, 2025 executive order gives Commerce 90 days to evaluate state AI laws conflicting with federal policy. The review targets compelled changes to truthful AI outputs and disclosures that may implicate First Amendment protections. Identified laws may be referred to the AI Litigation Task Force for possible federal preemption action.
Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law
This Council of Europe treaty is the first legally binding international instrument on AI. It covers AI used by public authorities and private actors acting for them; Parties decide how to address other private actors. It opened for signature on 5 September 2024 and was not yet in force as of mid-2026.
CCPA Regulations on Automated Decisionmaking Technology, Risk Assessments, and Cybersecurity Audits
California's privacy agency finalized rules on automated decisionmaking technology (ADMT), risk assessments, and cybersecurity audits under the CCPA. They took effect on 1 January 2026, with phased deadlines. Businesses that use ADMT for significant decisions must give notice, offer opt-outs in most cases, and answer access requests.
European Commission Enforcement Powers for Advanced AI Models under the AI Act
The European Commission enforces the EU AI Act's obligations for all general-purpose AI model providers, wherever they are based. Its fining powers apply from 2 August 2026. It can request information, evaluate models, require measures, and fine up to 3 percent of worldwide turnover or EUR 15 million.
Executive Order 14318: Accelerating Federal Permitting of Data Center Infrastructure
Executive Order 14318, signed on 23 July 2025, directs federal agencies to speed permitting for large AI data centers. It covers projects needing over 100 MW of new load, and offers financial support and faster environmental reviews for qualifying projects.
Executive Order 14319: Preventing Woke AI in the Federal Government
Executive Order 14319, signed on 23 July 2025, directs federal agencies to buy only large language models that follow two Unbiased AI Principles: truth-seeking and ideological neutrality. OMB implemented it in Memorandum M-26-04 on 11 December 2025.
EU Action Plan on Cybersecurity and Artificial Intelligence
The European Commission presented its Action Plan on Cybersecurity and Artificial Intelligence on 7 July 2026. It aims to promote safe use of advanced AI, strengthen EU cybersecurity, and build European AI capabilities for cybersecurity. It creates no new obligations and relies on existing laws such as NIS2, DORA, and the Cyber Resilience Act.
EU AI Act (Regulation (EU) 2024/1689)
The EU AI Act is the European Union's law on artificial intelligence. It sorts AI systems by risk, bans a short list of practices, and sets duties for high-risk systems and general-purpose AI models. It applies to any organization that builds, sells, or uses AI in the EU, wherever that organization is based. Obligations phase in between February 2025 and August 2028.
Regulation (EU) 2026/1744: Digital Omnibus on AI (EU AI Act Amendment)
Regulation (EU) 2026/1744 defers the AI Act’s high-risk compliance deadlines. Stand-alone Annex III systems move from August 2, 2026 to December 2, 2027. Product-embedded high-risk systems have until August 2, 2028. General-purpose AI (GPAI) duties remain applicable from August 2025. Prohibited practices and AI literacy requirements have applied since February 2025. The amendment adds two bans from December 2026 and softens the literacy duty.
EN 18286:2026, Quality Management System for EU AI Act Regulatory Purposes
EN 18286:2026 sets quality management system requirements for AI providers under the EU AI Act. CEN and CENELEC published it in July 2026, the first European standard supporting the Act. It gives a presumption of conformity only once cited in the Official Journal.
EU AI Liability Directive (withdrawn proposal)
The proposed EU AI Liability Directive would have lowered evidentiary barriers for people seeking compensation for AI harm. It proposed disclosure mechanisms and presumptions of causation. The Commission approved its withdrawal on 16 July 2025, and the notice was published on 6 October 2025.
AI Act Governance and Enforcement Framework
EU AI Act supervision is shared across Union bodies and national authorities. Responsibilities involve the AI Office, European Data Protection Supervisor, and national competent authorities. Developers and deployers must identify the authority responsible for their systems and prepare compliance evidence.
EU Code of Practice on Transparency of AI-Generated Content
The European Commission published this voluntary Code of Practice to support Article 50 compliance under the EU AI Act. It addresses generative AI providers and deployers serving the EU. The Code covers content labeling, controls that record where content came from, and disclosure workflows.
EU Cyber Resilience Act
The EU Cyber Resilience Act sets mandatory cybersecurity requirements for products with digital elements sold in the EU. It includes hardware and software containing AI components. Duties cover the lifecycle from design through end-of-life.
EU Data Act
The EU Data Act governs access to personal and non-personal data from connected products and related services. Data holders must share covered data with users and third parties. It also sets conditions for public bodies accessing privately held data in exceptional circumstances.
EU Data Governance Act
The EU Data Governance Act regulates data intermediaries, data altruism organizations, and reuse of protected public-sector data. It establishes structures for trusted sharing across sectors and member states as part of the European Data Strategy.
EU Proposal for a Regulation for the Digital Networks Act (DNA)
The European Commission proposed the Digital Networks Act (COM(2026) 16) on 21 January 2026. It would replace the European Electronic Communications Code with a single regulation for telecoms networks. It aims to enable AI and cloud adoption but sets no AI-specific governance duties.
EU Digital Operational Resilience Act
DORA (the Digital Operational Resilience Act), Regulation (EU) 2022/2554, governs digital operational resilience for EU financial entities. Requirements cover technology risk management, incident reporting, resilience testing, and third-party oversight. These affect financial AI systems and their technology providers.
EU Digital Services Act, AI and Algorithmic Accountability Provisions
The Digital Services Act regulates online intermediaries’ recommender systems, targeted advertising, and systemic risks. Duties cover transparency, accountability, and risk management. Requirements increase with platform size, with the strictest applying to very large online platforms and search engines (VLOPs and VLOSEs).
EU General-Purpose AI Model Training Data Public Summary Template
The European Commission published a template for general-purpose AI providers’ public training-data summaries. It supports disclosure obligations under the EU AI Act. Providers are expected to follow its structure when preparing those summaries.
Executive Order 14110 on Safe, Secure, and Trustworthy Artificial Intelligence
Executive Order 14110, signed on 30 October 2023, set federal requirements for safe AI development, including safety reporting on the most powerful models and NIST standards work. EO 14148 revoked it on 20 January 2025. Some agency rules and guidance it started may still apply.
FATF AI Anti-Money Laundering Guidance
A 2021 Financial Action Task Force (FATF) report on new technologies, including AI, for fighting money laundering and terrorist financing. It sets out benefits, challenges, and suggested actions for governments, and is non-binding.
Federal Communications Commission AI Model Reporting and Disclosure Proceeding
The Federal Communications Commission (FCC) is opening a proceeding on possible federal AI model reporting and disclosure standards. It follows the Commerce Department’s evaluation of state AI laws. An adopted standard could preempt conflicting state disclosure and reporting requirements.
FDA AI/ML Software as Medical Device Guidance
FDA’s action plan and guidance address AI and machine learning (AI/ML) Software as a Medical Device. They introduce a total product lifecycle approach and predetermined change control plans. Self-updating clinical algorithms also face transparency and monitoring requirements.
Sound Practices for Responsible Adoption of Artificial Intelligence (Consultation Report)
The Financial Stability Board proposes 12 practices for responsible AI adoption throughout its lifecycle. They cover banks, insurers, and other regulated financial entities developing or deploying AI. Institutions should map them to governance, model risk, third-party oversight, and lifecycle controls.
Five Eyes Guidance on the Careful Adoption of Agentic AI Services
This joint Five Eyes advisory addresses enterprises and public bodies deploying autonomous AI agents. It covers agents taking independent actions, accessing systems, or interacting with other agents. The guidance calls for low-risk tasks, minimum necessary access, and integration into existing security governance.
FTC Enforcement on AI (Section 5 of the FTC Act)
The Federal Trade Commission (FTC) enforces US consumer protection law against companies that make deceptive claims about AI or use AI in unfair ways. It relies on Section 5 of the FTC Act, which bans unfair or deceptive practices, plus trade rules on fake reviews and impersonation. There is no exemption for AI. Any company selling AI products or using AI with US consumers is in scope.
G7 Hiroshima AI Code of Conduct
The G7 Hiroshima AI Process issued this voluntary international code of conduct. It sets eleven principles and corresponding actions for advanced AI developers and operators, particularly frontier (most capable) and general-purpose models. The code uses voluntary commitments to guide responsible development.
General Data Protection Regulation (GDPR)
The GDPR is the EU's data protection law. It applies whenever an AI system uses personal data about people in the EU, from training a model to making decisions about individuals. Organizations need a lawful basis for each use, must tell people how their data is used, and must respect their rights. It also limits decisions made solely by automated means that significantly affect people.
U.S. General Services Administration AI Strategies and Compliance Plan
The GSA AI Strategies and Compliance Plan from the US General Services Administration (GSA) establishes governance for internal agency AI use. An AI Governance Board and oversight committee review and approve use requests. Requirements cover privacy controls, security reviews, use-case intake, and compliance evidence.
Guaranteeing and Upholding Americans' Right to Decide Responsible AI Laws and Standards Act (GUARDRAILS Act)
Democratic lawmakers introduced the GUARDRAILS Act in the House on 20 March 2026 (H.R.8031) and in the Senate on 26 March 2026 (S.4216). It would void Executive Order 14365, which directs federal action against state AI laws, and bar federal funds for carrying it out.
H.R.8094 - AI Foundation Model Transparency Act of 2026
Bipartisan lawmakers introduced H.R.8094 on March 26, 2026. It would require large foundation model developers to disclose training data, model design, limitations, risks, and evaluation methods. The bill seeks public scrutiny through transparency without directly restricting model use or deployment.
Illinois AI Safety Measures Act (SB 315)
The Illinois AI Safety Measures Act was signed on 6 July 2026 and takes effect on 1 January 2027. Frontier AI developers with over $500 million in annual revenue must publish a frontier AI framework and undergo annual independent compliance audits from 2028. The Attorney General enforces it.
Illinois Biometric Information Privacy Act, AI Provisions
Illinois BIPA, 740 ILCS 14, restricts collection, storage, use, and disclosure of biometric identifiers and information. It affects AI processing facial geometry, voiceprints, iris scans, and similar data. BIPA has generated extensive biometric privacy litigation.
Illinois High-Impact AI Governance Principles and Disclosure Act
Illinois HB 3529 would require businesses with 10 or more employees using AI in Illinois to publish a yearly report. The report would explain how they meet five AI governance principles. Violations would carry a $1,000 civil penalty. The bill has stalled in committee since March 2025.
Singapore Model AI Governance Framework for Agentic AI
Singapore's IMDA launched the Model AI Governance Framework for Agentic AI in January 2026. It is the first government framework written for AI agents that plan and act on their own. It is voluntary, but organizations remain legally accountable for their agents' actions.
IMDA Model AI Governance Framework
Singapore’s media and data regulators, IMDA and PDPC, issued this voluntary AI governance framework. It guides responsible deployment through human oversight, decision accountability, and operational transparency.
India AI Governance Guidelines (MeitY, 2025)
MeitY released the India AI Governance Guidelines on 5 November 2025 under the IndiaAI Mission. They are voluntary principles and recommendations that favour self-regulation over approvals or licensing. Binding labelling of AI-generated content comes separately from the 2026 amendments to India's IT Rules.
Indonesia Draft Presidential Regulations on the National AI Roadmap 2026-2029 and AI Ethics
Indonesia is preparing two Presidential Regulations: one on a National AI Roadmap for 2026 to 2029, and one on AI Ethics. Both finished inter-ministry harmonisation in 2026 and await the President's signature. The ethics regulation uses three risk tiers but sets no sanctions of its own.
ISO/IEC 42001:2023 - Artificial Intelligence Management System
ISO and IEC published ISO/IEC 42001:2023 in December 2023 as the first international AI management system standard. It sets requirements for establishing, maintaining, and improving an AI Management System. Organizations developing or using AI products and services can seek independent certification.
ISO/IEC 23894 AI Risk Management
ISO/IEC 23894 explains how to integrate AI risks into enterprise risk management. It adapts ISO 31000 risk terms and processes to traits specific to AI. These include unexpected behavior, reliance on data, hard-to-explain decisions, and complex effects on people and organizations.
ISO/IEC TR 24028:2020, Overview of Trustworthiness in Artificial Intelligence
ISO/IEC 24028:2020 explains AI trustworthiness concepts, characteristics, and threats. It provides technical and organizational approaches for assessing and improving trustworthiness throughout an AI system's life.
ISO/IEC 24029 Robustness of Neural Networks (TR 24029-1:2021 and 24029-2:2023)
ISO/IEC 24029 covers mathematical proof methods and practical assessments of artificial neural network robustness (how reliably a network performs when its inputs are unusual or manipulated). Its parts address deliberately misleading inputs, shifts in real-world data, and other failure modes relevant to trustworthy deployment.
ITU Focus Group on Trust and Identity for Humans and Agentic AI
The International Telecommunication Union (ITU) launched a Focus Group on trusted digital identity and accountable behavior throughout the lifecycles of AI agents. It addresses agent identification, credentials, authorization, and agent-to-agent interactions. The work concerns organizations developing or deploying agents with delegated authority or external system access.
Japan AI Guidelines for Business
Japan's AI Guidelines for Business, issued jointly by MIC and METI, help companies govern AI across its life cycle. First published in April 2024, they are a living document, and version 1.2 of 31 March 2026 adds guidance on AI agents and physical AI.
Japan AI Basic Plan (second plan, July 2026)
Japan's Cabinet adopted its second AI Basic Plan on 14 July 2026, replacing the first plan of December 2025. It responds to the rapid rise of agentic AI and puts domain-specific 'vertical AI' and physical AI at the centre of Japan's strategy. It directs government policy and places no direct duties on companies.
Japan Principles-Code for Protection of Intellectual Property and Transparency for the Appropriate Use of Generative AI
Japan's Intellectual Property Strategy Headquarters adopted this code on 25 August 2026, after a draft in December 2025. It asks generative AI developers and providers, including overseas businesses serving Japan, to protect IP and be transparent on a comply-or-explain basis. Notifications open on 26 October 2026.
Korea AI Basic Act
South Korea’s foundational AI statute sets risk-based duties for developers and deployers. High-impact systems face additional requirements. The law also establishes national AI safety infrastructure.
MAS Guidelines on Artificial Intelligence Risk Management
The Monetary Authority of Singapore (MAS) issued final guidelines on 7 October 2026 requiring financial institutions to manage AI-related risks across the full lifecycle of their AI systems. The guidelines apply to banks, insurers, capital market firms, and other MAS-regulated entities operating in Singapore. They set expectations for board-level accountability, AI inventories, risk classification, and ongoing monitoring, with phased compliance deadlines running through 2027 and 2028.
Principles to Promote Fairness, Ethics, Accountability and Transparency (FEAT) in the Use of Artificial Intelligence and Data Analytics in Singapore's Financial Sector
MAS FEAT is a voluntary framework for Singapore financial institutions using AI and data analytics. Its four principles are Fairness, Ethics, Accountability, and Transparency.
New York's Responsible AI Safety and Education Act (RAISE Act) for Large Developers
New York's RAISE Act was signed on 19 December 2025 and amended on 27 March 2026. From 1 January 2027, frontier model developers with over $500 million in annual revenue must publish a frontier AI framework, issue transparency reports, and report critical safety incidents. A new office in the Department of Financial Services oversees them.
New Zealand Responsible AI Guidance for Business
New Zealand's MBIE released voluntary Responsible AI Guidance for Businesses on 8 July 2025, alongside the country's first AI Strategy. It helps businesses, including sole traders and non-profits, use and develop AI in a trustworthy way under existing New Zealand law.
NIST AI 600-1 Generative AI Profile
This companion to NIST AI RMF 1.0 addresses generative AI risks. It covers large language models and multimodal foundation models (general-purpose models that handle text, images, and audio).
NIST AI 300-1 (Initial Public Draft): Guidance and Templates for Public-Facing AI Documentation
NIST's initial public draft of AI 300-1 gives guidance and templates for public documentation of AI datasets and models. It is a 'Zero Draft' meant to feed voluntary consensus standards through ISO. NIST considered input received by 16 September 2026.
NIST AI Risk Management Framework (AI RMF 1.0) and Playbook
The NIST AI Risk Management Framework (AI RMF 1.0) is a voluntary US framework for managing the risks of AI systems. It organizes the work into four functions: Govern, Map, Measure, and Manage. Its companion Playbook suggests concrete actions for each part. Any organization that builds or uses AI can adopt it, and some laws and contracts point to it.
NIST Artificial Intelligence Technology Evaluation Program
NIST's AI Technology Evaluation (AITE) program, launched in July 2026, is a voluntary testing program. Data providers submit non-public datasets and tasks, model providers submit models, and NIST scores them in a sequestered testbed. It sets no requirements for organizations.
NIST IR 8587: Protecting Tokens and Assertions from Forgery, Theft, and Misuse
NIST IR 8587, finalized on 15 September 2026, gives federal agencies and cloud service providers recommendations to protect identity tokens, access tokens, and assertions from forgery, theft, and misuse. It builds on NIST SP 800-53 Release 5.1.1 and covers single sign-on, federation, and API access.
New York City Local Law 144 of 2021, Automated Employment Decision Tools
NYC employers and employment agencies using covered automated tools for hiring or promotion must arrange annual bias audits. They must publish results and notify candidates before use.
Interagency Revised Guidance on Model Risk Management (OCC Bulletin 2026-13, SR 26-2)
US bank regulators' April 2026 model risk guidance replaces SR 11-7 with a tailored, principles-based approach. It is most relevant to banks with over $30 billion in assets. Generative and agentic AI models are outside its scope.
OECD AI Principles
The OECD AI Principles were the first intergovernmental AI standard. They set five values-based principles and five government recommendations supporting trustworthy AI, human rights, and democratic values.
OECD Report: Governing with Artificial Intelligence
This OECD report examines government AI use across member and partner countries. Public-service improvements account for 57% of documented applications, while 45% support administrative decisions. Identified risks include biased data used to train systems, limited transparency, and overreliance on automated outputs.
OMB Memorandum M-26-04: Increasing Public Trust in AI Through Unbiased AI Principles
OMB Memorandum M-26-04, issued on 11 December 2025, implements Executive Order 14319. It requires federal agencies buying large language models to contract for two Unbiased AI Principles: truth-seeking and ideological neutrality. Vendors that fail to meet them can have contracts terminated.
OWASP Top 10 for Large Language Model Applications
OWASP's Top 10 for LLM Applications lists the most critical security risks in applications built on large language models. The current 2026 edition, published in August 2026, puts prompt injection, sensitive information disclosure, and excessive agency at the top. Development and security teams use it to prioritize safeguards.
The Role of Investors in AI Governance
This April 2026 research paper from Oxford's AI Governance Initiative reports how institutional investors approach AI governance. It draws on six roundtables with 62 investors and 60 interviews, mostly about public equities. It describes current practice and the support investors want, rather than setting requirements.
Protecting Consumers From Deceptive AI Act
The Protecting Consumers From Deceptive AI Act (H.R.8479) was introduced on 23 April 2026. Generative AI apps would have to add tamper-resistant disclosures to AI-made audio and visual content, and large platforms would have to show them. NIST task forces would inform technical standards, and the FTC would enforce.
SEC AI Governance Guidance
SEC rules, guidance, and proposals address investment advisers, broker-dealers, and public companies using AI. Topics include predictive-analytics conflicts, securities disclosures, and examination priorities for algorithmic systems.
Sectoral AI Governance Act of 2026
The Sectoral AI Governance Act of 2026 is a proposed US federal law that would authorize federal regulatory agencies to issue rules governing algorithmic decision-making systems within their existing enforcement domains. It applies to any organization deploying AI systems that could materially contribute to violations of federal law in regulated sectors. It places no direct duties on deployers; any would come from later agency rules.
Singapore Consensus on Global AI Safety Research Priorities
The Singapore Consensus is a research agenda for AI safety, written by an expert committee after a scientific exchange Singapore hosted in April 2025. It groups research priorities into development, assessment, and control. It is not a government declaration, has no signatories, and was updated by a 2026 edition.
The 2026 Singapore Consensus on Global AI Safety Research Priorities
The 2026 Singapore Consensus sets out global AI safety research priorities, including testing methods, alignment, and control of AI agents. More than 100 contributors from 13 countries produced it after an IMDA-convened exchange in May 2026, drawn from frontier AI developers, government safety institutes, academia, and civil society.
Singapore Global AI Assurance Sandbox
IMDA and the AI Verify Foundation launched the Global AI Assurance Sandbox on 7 July 2025. It matches builders and deployers of generative and agentic AI applications with specialist technical testing firms. It offers no regulatory relief, and test results stay confidential to the participants.
Singapore National AI Strategy 2.0
Singapore's National AI Strategy 2.0, launched on 4 December 2023, sets out 15 actions over three to five years. A May 2026 update added 10 refreshed priorities, building on it rather than replacing it.
Singapore Personal Data Protection Act, AI and Automated Decision-Making Amendments
Singapore’s 2020 personal data amendments and Personal Data Protection Commission (PDPC) guidance address AI and automated decisions. They add mandatory breach notification, expanded accountability, and responsible deployment guidance under the Model AI Governance Framework.
Texas Responsible AI Governance Act
The Texas Responsible AI Governance Act (HB 149), signed on 22 June 2025, took effect on 1 January 2026. It applies to anyone doing business in Texas or developing or deploying AI there. It bans certain intentional AI uses, requires AI disclosure by government agencies and health care providers, and is enforced by the Attorney General.
UK AI Growth Lab: Call for Evidence (closed January 2026)
The UK Department for Science, Innovation and Technology (DSIT) issued a call for evidence on the proposed UK AI Growth Lab on 21 October 2025, which closed in early January 2026. The government then announced the Regulating for Growth Bill on 13 May 2026 to create sandboxing powers. The sandbox would let firms test AI under relaxed or modified rules. Options include central government administration across sectors or individual sandboxes managed by lead regulators. The aim is reduced compliance barriers with continued oversight.
UK AI Opportunities Action Plan
The UK published its AI Opportunities Action Plan in January 2025. It sets the Labour government’s adoption and infrastructure agenda for public bodies, developers, and AI enterprises. Commitments include AI Growth Zones, expanded computing infrastructure, and a National Data Library giving developers access to public data.
UK AI Regulation Framework
The UK AI Regulation Framework assigns primary oversight to existing sector regulators using shared principles. Following January 2025’s AI Opportunities Action Plan, the approach is moving toward a more structured legislative basis.
AI Risk Management Toolkit
The UK Government published this toolkit to help organizations understand, assess, and manage risk throughout the full lifecycle of AI projects. It applies to teams involved in designing, procuring, or delivering AI products and services, including public and private sector buyers. The toolkit provides structured guidance for embedding risk management into project approval checks, procurement checklists, and delivery-stage governance.
UK-Canada Memorandum of Understanding on AI Compute
The UK and Canada signed a Memorandum of Understanding on compute in Ottawa on 31 January 2024. It sets out joint intent to collaborate, including exploring how to give researchers and industry secure, affordable access to computing capacity. It creates no binding commitments or private-sector duties.
UK DSIT Call for Evidence on Data Regulation in the Age of AI and Other Data-Intensive Technologies
DSIT ran a call for evidence on adapting UK data law to AI and other data-intensive technologies, including AI agents, from 15 July to 9 September 2026. It is now closed and awaiting the government's response.
UK Regulations Requiring an ICO Code of Practice on AI and Automated Decision-Making (SI 2026/425)
UK regulations in force since 12 May 2026 require the Information Commissioner to prepare a statutory code. It covers personal data in developing and using AI, and in automated decision-making. Once the code is in force, the ICO and courts must take it into account.
ICO Guidance on AI and Data Protection
The UK Information Commissioner's Office (ICO) secured commitments from ten major AI developers to strengthen data protection practices covering transparency, individuals' rights, lawful grounds for processing personal data, and safeguards for AI training and deployment. The ten companies named are Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI, and Stability AI. Alongside this, the ICO opened a six-week call for evidence on agentic AI, which refers to AI systems that act autonomously on behalf of users, completing tasks with little or no human input at each step.
Global Dialogue on AI Governance (UN General Assembly Resolution A/RES/79/325)
UN Resolution A/RES/79/325 established the Global Dialogue on AI Governance, open to states and other stakeholders. The first Dialogue met in Geneva on 6 and 7 July 2026, informed by 1,532 written submissions. The second is set for New York on 3 and 4 May 2027.
UN Independent International Scientific Panel on AI: Preliminary Report and AI Agents Thematic Brief
The UN's Independent International Scientific Panel on AI released its preliminary report on AI opportunities, risks, and impacts on 1 July 2026. Its first thematic brief, on AI agents and the risk of losing human control, followed on 21 September 2026. The Panel provides scientific assessment and does not set rules.
UNESCO Recommendation on the Ethics of Artificial Intelligence: 2026 Implementation Tools Update
UNESCO launched three tools under its 2021 Recommendation on the Ethics of AI in September 2026. It presented them at its fourth Global Forum on the Ethics of AI in Riyadh. They are for policymakers: an updated Readiness Assessment Methodology (RAM 2.0), an analysis of RAM findings, and an AI environment toolkit.
AI AGENT Act of 2026 (S.5051, Artificial Intelligence Access, Gatekeeper Exchange, and Nondiscriminatory Transfer Act)
The AI AGENT Act (S.5051), introduced on 21 July 2026, would let users of large online platforms delegate AI agents to act for them. Platforms would have to provide access interfaces, and agent providers would register with the FTC.
Stop Rogue AI Act (H.R.10362)
Representatives Gottheimer and Lawler introduced the Stop Rogue AI Act (H.R.10362) on 14 September 2026. It directs NIST to set standards for discovering, verifying, and controlling AI agents within a year. Federal contracts would then have to require compliance with them.
Executive Order 14179: Removing Barriers to American Leadership in Artificial Intelligence
Executive Order 14179, signed on 23 January 2025, set a policy of sustaining US AI leadership through reduced regulation. It ordered a review of actions taken under the revoked EO 14110 and called for an AI Action Plan, which the White House released on 23 July 2025.
Executive Order 14365: Ensuring a National Policy Framework for Artificial Intelligence
Executive Order 14365, signed on 11 December 2025, directs federal agencies to challenge state AI laws that conflict with national policy. It set up an AI Litigation Task Force and ordered a Commerce review of state laws. It also tied some broadband funding to state AI policy and asked the FCC and FTC to act on preemption.
United States v. Heppner (S.D.N.Y. 2026): AI Chatbot Documents Not Privileged
In United States v. Heppner, Judge Jed Rakoff of the Southern District of New York ruled in February 2026 that 31 documents a criminal defendant created with Anthropic's Claude were not privileged. Heppner, former CEO of Beneficient and chairman of GWG Holdings, had used consumer Claude on his own, not at his lawyers' direction.
Financial Services AI Risk Management Framework (FS AI RMF)
The US Treasury released the Financial Services AI Risk Management Framework on 19 February 2026, with the Cyber Risk Institute. It adapts the NIST AI RMF into 230 control objectives for financial institutions, organized by AI adoption stage. It is voluntary guidance, released alongside a shared AI lexicon.
Executive Order 14409: Promoting Advanced Artificial Intelligence Innovation and Security
This executive order, signed on 2 June 2026, sets up a classified process for assessing frontier AI models' cyber capabilities. Developers of models designated as covered frontier models can give the government early access for up to 30 days before wider release, and taking part is voluntary.
Utah Artificial Intelligence Policy Act (SB 149, as amended in 2025)
Utah's AI Policy Act took effect on 1 May 2024 and was amended in 2025. Businesses must disclose generative AI use to consumers when asked, and regulated professions must disclose it upfront in high-risk interactions. The Act created the Office of Artificial Intelligence Policy and runs until 1 July 2027.
Verifiable Semiconductor Manufacturing
An April 2026 research paper from Oxford's AI Governance Initiative on verifying the integrity of AI chips from design through manufacturing. It argues for defense in depth, tiered by chip criticality, with neutral third-party verifiers. It sets no requirements for anyone.
Veritas Consortium AI Fairness Testing Methodology
Singapore's financial regulator (MAS) and a financial-sector consortium developed this assessment method for responsible AI. It applies fairness, ethics, accountability, and transparency principles to financial services.
Washington State SB 5395 and SB 5886 (AI in Health Care and Right of Publicity)
Washington enacted two relevant statutes in 2026. SB 5395 bars health insurance carriers and state employee health plans from using AI as the sole basis to deny prior authorization. SB 5886 extends publicity rights to AI-generated likenesses, affecting organizations producing or deploying representations of individuals.
White House Artificial Intelligence Oversight Framework
The White House finalized a voluntary framework for testing the most advanced AI models' cyber capabilities before release, under the June 2026 executive order. It presented the framework to AI companies on 4 August 2026 and has not published the text.