AI Regulations: Global Directory of Binding AI Laws
Binding AI laws currently in force or adopted, from the EU AI Act to state-level US statutes. Each entry links to the official text and its compliance requirements.
California AI Auditor Registration Act (AB 1405)
AB 1405 creates California’s first registry for independent AI auditors. Auditors must register with the Government Operations Agency and disclose their credentials and methods. They must also follow recognized independence standards. From January 1, 2029, only registered auditors may perform covered audits in California.
California Generative AI Transparency Requirements - AB 2013
California Assembly Bill (AB) 2013 requires public training-data disclosures from developers of generative AI systems accessible to the California public. Developers must publish the documentation on their websites. The disclosures explain training datasets’ origins and composition. The requirement applies regardless of where the developer is headquartered.
California AI Transparency Act (SB 942 as amended by AB 853)
The California AI Transparency Act applies to makers of generative AI systems with over 1 million monthly users that are publicly accessible in California. They must offer a free detection tool, offer users a visible disclosure option, and embed latent disclosures in AI-generated images, video, and audio. Licenses must let them revoke access within 96 hours if a licensee disables disclosures.
California AB 3030: Generative AI Disclosure in Health Care Communications
California AB 3030 has applied since 1 January 2025. Health facilities, clinics, and physician offices must tell patients when generative AI writes communications about their clinical information, and explain how to reach a human. Messages reviewed by a licensed provider are exempt.
California Independent Verification Organizations Act (SB 813)
California SB 813, signed on 9 September 2026, lets the Government Operations Agency designate independent verification organizations (IVOs), meaning approved AI auditors. Using an IVO is voluntary. The agency must set designation requirements by 1 January 2028.
California Transparency in Frontier Artificial Intelligence Act (SB 53)
California's Transparency in Frontier Artificial Intelligence Act (SB 53) applies to developers of the largest AI models. Signed in September 2025 and in force since 1 January 2026, it requires published safety frameworks and transparency reports, and prompt reporting of critical safety incidents. The law also protects employees who report risks.
China Algorithm Recommendation Regulations
China's dedicated regulation on recommendation algorithms covers internet services operating in China or targeting Chinese users. Providers must meet transparency, user-control, and content-moderation duties.
China Deep Synthesis Regulations
China's deep synthesis provisions regulate deep synthesis internet information services provided within China. They cover AI-generated or manipulated text, images, audio, video, and virtual humans. Duties include labeling, filing, security assessments, and content moderation.
China's Interim Measures for the Management of Generative Artificial Intelligence Services
China’s Interim Measures for Generative AI Services cover providers serving the Chinese public. They impose duties for training data governance, content safety, algorithmic transparency, and registration.
China's Interim Measures for Artificial Intelligence Anthropomorphic Interactive Services
China's Interim Measures for AI Anthropomorphic Interactive Services took effect on 15 July 2026. They cover AI services offering continuous emotional interaction that imitates a person's personality, thinking, and communication style. Providers must avoid fostering emotional dependence, protect minors and older users, and complete assessments and filing.
China's Measures for Labelling AI-Generated and Synthetic Content
China's labelling measures require AI-generated and synthetic content shown to users in China to carry labels. Visible labels are needed in many cases, and implicit labels must be embedded in file metadata. Platforms must check for labels and add notices to AI-generated content.
Colorado AI Act (SB 24-205), repealed
Colorado's SB 24-205, signed in May 2024, would have regulated developers and deployers of high-risk AI. It never took effect: its start date slipped from February 2026 to June 2026. In May 2026 Colorado repealed it and replaced it with SB 26-189, a narrower automated decision-making law effective 1 January 2027.
Colorado SB 26-189: Automated Decision-Making Technology Act
Colorado's SB 26-189, signed on 14 May 2026, repeals and replaces the state's 2024 AI Act. From 1 January 2027 it regulates automated decision-making technology used in consequential decisions about consumers. Deployers must give notice before use, explain adverse outcomes, and offer human review. Developers must give deployers the information they need.
Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law
This Council of Europe treaty is the first legally binding international instrument on AI. It covers AI used by public authorities and private actors acting for them; Parties decide how to address other private actors. It opened for signature on 5 September 2024 and was not yet in force as of mid-2026.
CCPA Regulations on Automated Decisionmaking Technology, Risk Assessments, and Cybersecurity Audits
California's privacy agency finalized rules on automated decisionmaking technology (ADMT), risk assessments, and cybersecurity audits under the CCPA. They took effect on 1 January 2026, with phased deadlines. Businesses that use ADMT for significant decisions must give notice, offer opt-outs in most cases, and answer access requests.
European Commission Enforcement Powers for Advanced AI Models under the AI Act
The European Commission enforces the EU AI Act's obligations for all general-purpose AI model providers, wherever they are based. Its fining powers apply from 2 August 2026. It can request information, evaluate models, require measures, and fine up to 3 percent of worldwide turnover or EUR 15 million.
EU AI Act (Regulation (EU) 2024/1689)
The EU AI Act is the European Union's law on artificial intelligence. It sorts AI systems by risk, bans a short list of practices, and sets duties for high-risk systems and general-purpose AI models. It applies to any organization that builds, sells, or uses AI in the EU, wherever that organization is based. Obligations phase in between February 2025 and August 2028.
Regulation (EU) 2026/1744: Digital Omnibus on AI (EU AI Act Amendment)
Regulation (EU) 2026/1744 defers the AI Act’s high-risk compliance deadlines. Stand-alone Annex III systems move from August 2, 2026 to December 2, 2027. Product-embedded high-risk systems have until August 2, 2028. General-purpose AI (GPAI) duties remain applicable from August 2025. Prohibited practices and AI literacy requirements have applied since February 2025. The amendment adds two bans from December 2026 and softens the literacy duty.
EU Cyber Resilience Act
The EU Cyber Resilience Act sets mandatory cybersecurity requirements for products with digital elements sold in the EU. It includes hardware and software containing AI components. Duties cover the lifecycle from design through end-of-life.
EU Data Act
The EU Data Act governs access to personal and non-personal data from connected products and related services. Data holders must share covered data with users and third parties. It also sets conditions for public bodies accessing privately held data in exceptional circumstances.
EU Data Governance Act
The EU Data Governance Act regulates data intermediaries, data altruism organizations, and reuse of protected public-sector data. It establishes structures for trusted sharing across sectors and member states as part of the European Data Strategy.
EU Digital Operational Resilience Act
DORA (the Digital Operational Resilience Act), Regulation (EU) 2022/2554, governs digital operational resilience for EU financial entities. Requirements cover technology risk management, incident reporting, resilience testing, and third-party oversight. These affect financial AI systems and their technology providers.
EU Digital Services Act, AI and Algorithmic Accountability Provisions
The Digital Services Act regulates online intermediaries’ recommender systems, targeted advertising, and systemic risks. Duties cover transparency, accountability, and risk management. Requirements increase with platform size, with the strictest applying to very large online platforms and search engines (VLOPs and VLOSEs).
EU General-Purpose AI Model Training Data Public Summary Template
The European Commission published a template for general-purpose AI providers’ public training-data summaries. It supports disclosure obligations under the EU AI Act. Providers are expected to follow its structure when preparing those summaries.
General Data Protection Regulation (GDPR)
The GDPR is the EU's data protection law. It applies whenever an AI system uses personal data about people in the EU, from training a model to making decisions about individuals. Organizations need a lawful basis for each use, must tell people how their data is used, and must respect their rights. It also limits decisions made solely by automated means that significantly affect people.
Illinois AI Safety Measures Act (SB 315)
The Illinois AI Safety Measures Act was signed on 6 July 2026 and takes effect on 1 January 2027. Frontier AI developers with over $500 million in annual revenue must publish a frontier AI framework and undergo annual independent compliance audits from 2028. The Attorney General enforces it.
Illinois Biometric Information Privacy Act, AI Provisions
Illinois BIPA, 740 ILCS 14, restricts collection, storage, use, and disclosure of biometric identifiers and information. It affects AI processing facial geometry, voiceprints, iris scans, and similar data. BIPA has generated extensive biometric privacy litigation.
Korea AI Basic Act
South Korea’s foundational AI statute sets risk-based duties for developers and deployers. High-impact systems face additional requirements. The law also establishes national AI safety infrastructure.
New York's Responsible AI Safety and Education Act (RAISE Act) for Large Developers
New York's RAISE Act was signed on 19 December 2025 and amended on 27 March 2026. From 1 January 2027, frontier model developers with over $500 million in annual revenue must publish a frontier AI framework, issue transparency reports, and report critical safety incidents. A new office in the Department of Financial Services oversees them.
New York City Local Law 144 of 2021, Automated Employment Decision Tools
NYC employers and employment agencies using covered automated tools for hiring or promotion must arrange annual bias audits. They must publish results and notify candidates before use.
Singapore Personal Data Protection Act, AI and Automated Decision-Making Amendments
Singapore’s 2020 personal data amendments and Personal Data Protection Commission (PDPC) guidance address AI and automated decisions. They add mandatory breach notification, expanded accountability, and responsible deployment guidance under the Model AI Governance Framework.
Texas Responsible AI Governance Act
The Texas Responsible AI Governance Act (HB 149), signed on 22 June 2025, took effect on 1 January 2026. It applies to anyone doing business in Texas or developing or deploying AI there. It bans certain intentional AI uses, requires AI disclosure by government agencies and health care providers, and is enforced by the Attorney General.
UK Regulations Requiring an ICO Code of Practice on AI and Automated Decision-Making (SI 2026/425)
UK regulations in force since 12 May 2026 require the Information Commissioner to prepare a statutory code. It covers personal data in developing and using AI, and in automated decision-making. Once the code is in force, the ICO and courts must take it into account.
Utah Artificial Intelligence Policy Act (SB 149, as amended in 2025)
Utah's AI Policy Act took effect on 1 May 2024 and was amended in 2025. Businesses must disclose generative AI use to consumers when asked, and regulated professions must disclose it upfront in high-risk interactions. The Act created the Office of Artificial Intelligence Policy and runs until 1 July 2027.
Washington State SB 5395 and SB 5886 (AI in Health Care and Right of Publicity)
Washington enacted two relevant statutes in 2026. SB 5395 bars health insurance carriers and state employee health plans from using AI as the sole basis to deny prior authorization. SB 5886 extends publicity rights to AI-generated likenesses, affecting organizations producing or deploying representations of individuals.