{"spec":"agc-atlas/v0.1","generated":"2026-11-04","license":"CC-BY-4.0","disclaimer":"Draft open data. Not legal advice. Check each source_url.","regimes":[{"id":"ch","jurisdiction":"CH","name":"Switzerland","as_of":"2026-11-04","review":{"status":"draft-unreviewed","reviewers":[]},"card":{"title":"Swiss AI governance","one_liner":"Switzerland has no overarching AI-specific act yet; existing data-protection law applies to AI processing of personal data, while an AI-law consultation draft is planned for spring 2027.","who_it_hits":"Private controllers and processors, federal bodies, and organisations that use AI to process personal data in Switzerland; separate cantonal rules may apply to cantonal and municipal bodies.","status_line":"Binding FADP and Data Protection Ordinance duties apply today. The Federal Council reported a spring 2027 consultation for proposed AI legislation; OFCOM's AI Code of Conduct guide is voluntary."},"instruments":[{"id":"ch-fadp","code":"FADP","title":"Federal Act of 25 September 2020 on Data Protection (FADP), revised","short":"Revised FADP","type":"statute","legal_force":"binding","status":"in-force","official_url":"https://www.fedlex.admin.ch/eli/cc/2022/491/en","penalties":"On complaint, a natural person may face a fine of up to CHF 250,000 for specified wilful violations of information duties (including Arts. 19, 21 and 25–27); this is not an AI-specific penalty.","key_dates":[{"date":"2023-09-01","event":"Revised FADP enters into force","source":"https://www.fedlex.admin.ch/eli/cc/2022/491/en"}],"notes":"Technology-neutral data protection law, not an AI Act. It covers processing of natural persons' personal data by private persons and federal bodies; cantonal and communal public bodies generally fall under cantonal data-protection laws. Fedlex English text is an informational translation."},{"id":"ch-dpo","code":"DPO","title":"Ordinance of 31 August 2022 on Data Protection (Data Protection Ordinance, DPO), current to 1 December 2025","short":"Data Protection Ordinance","type":"regulation","legal_force":"binding","status":"in-force","official_url":"https://www.fedlex.admin.ch/eli/cc/2022/568/en","penalties":null,"key_dates":[{"date":"2023-09-01","event":"Data Protection Ordinance enters into force","source":"https://www.fedlex.admin.ch/eli/cc/2022/568/en"},{"date":"2025-12-01","event":"Amendments to the logging rules in Art. 4 and transition in Art. 46 take effect","source":"https://www.fedlex.admin.ch/eli/cc/2022/568/en"}]},{"id":"ch-ai-proposal","code":"AI2027","title":"Proposed Federal Council AI legislation implementing the Council of Europe AI Convention (draft for consultation planned for spring 2027)","short":"Proposed Swiss AI legislation","type":"bill","legal_force":"proposed","status":"proposed","official_url":"https://www.bakom.admin.ch/en/artificial-intelligence","penalties":null,"key_dates":[{"date":"2025-02-12","event":"Federal Council chooses an approach to ratify and implement the Council of Europe AI Convention, with sector-specific amendments where needed","source":"https://www.admin.ch/en/nsb?id=104110"},{"date":"2025-03-27","event":"Switzerland signs the Council of Europe Framework Convention on AI","source":"https://www.bakom.admin.ch/en/nsb?id=104646"},{"date":"2026-10-28","event":"Federal Council update says consultation is scheduled for spring 2027; proposed rules are to address transparency, data protection, non-discrimination, supervision and risk assessment","source":"https://www.bakom.admin.ch/en/newnsb/s2TQiUUjrA5D"}],"notes":"No overarching Swiss AI-specific legislation is in force as of 2026-11-04. The consultation timing is an official forecast, not an enacted commencement date."},{"id":"ch-aicg","code":"AICG","title":"OFCOM Guide on an AI Code of Conduct","short":"OFCOM AI Code of Conduct guide","type":"guidance","legal_force":"voluntary","status":"voluntary","official_url":"https://www.bakom.admin.ch/en/newnsb/s2TQiUUjrA5D","penalties":null,"key_dates":[{"date":"2026-10-28","event":"OFCOM AI Code of Conduct guide reported as a toolkit for voluntary guidelines","source":"https://www.bakom.admin.ch/en/newnsb/s2TQiUUjrA5D"}],"notes":"The toolkit offers suggested text on 10 topics and a process for associations and businesses to develop voluntary AI guidelines; it creates no legal duties."}],"sources":[{"title":"Federal Act on Data Protection (FADP), Fedlex","url":"https://www.fedlex.admin.ch/eli/cc/2022/491/en"},{"title":"Data Protection Ordinance (DPO), Fedlex (status 1 December 2025)","url":"https://www.fedlex.admin.ch/eli/cc/2022/568/en"},{"title":"FDPIC: AI and data protection","url":"https://www.edoeb.admin.ch/en/ai-and-data-protection"},{"title":"Federal Council: AI regulation approach, 12 February 2025","url":"https://www.admin.ch/en/nsb?id=104110"},{"title":"OFCOM: Artificial Intelligence in Switzerland","url":"https://www.bakom.admin.ch/en/artificial-intelligence"},{"title":"OFCOM: Federal Council takes note of interim progress on AI regulation, 28 October 2026","url":"https://www.bakom.admin.ch/en/newnsb/s2TQiUUjrA5D"}]},{"id":"cn","jurisdiction":"CN","name":"China","as_of":"2026-11-04","review":{"status":"draft-unreviewed","reviewers":[]},"card":{"title":"China AI Governance Rules","one_liner":"China regulates public-facing AI through service-specific filing, safety, data, user-protection and AI-content-labelling rules.","who_it_hits":"Providers of algorithmic recommendation, deep-synthesis, generative AI and human-like interactive services in China, plus content-distribution and app-distribution platforms; each rule has its own scope.","status_line":"Binding rules apply. GB 45438-2025 and the content-labelling measures apply from 1 Sep 2025; the amended Cybersecurity Law applies from 1 Jan 2026; human-like interactive-service rules apply from 15 Jul 2026. Comprehensive AI legislation remains a proposed work-plan item."},"instruments":[{"id":"cn-algorithm","code":"ALGO","title":"Provisions on the Administration of Algorithmic Recommendations in Internet Information Services","short":"Algorithmic Recommendation Provisions","type":"rule","legal_force":"binding","status":"in-force","official_url":"https://www.cac.gov.cn/2022-01/04/c_1642894606364259.htm","penalties":"For specified breaches, warning, public criticism and correction orders; if not corrected or serious, suspension of information updates and CNY 10,000–100,000 (Art. 31). False or concealed filing information can also lead to revocation and the same fine range (Art. 33).","key_dates":[{"date":"2022-03-01","event":"Provisions enter into force","source":"https://www.cac.gov.cn/2022-01/04/c_1642894606364259.htm"}]},{"id":"cn-deep-synthesis","code":"DSYN","title":"Provisions on the Administration of Deep Synthesis in Internet Information Services","short":"Deep Synthesis Provisions","type":"rule","legal_force":"binding","status":"in-force","official_url":"https://www.cac.gov.cn/2022-12/11/c_1672221949354811.htm","penalties":"Violations are punished under applicable laws and administrative regulations; more severe consequences apply where serious results occur. The Provisions do not state a standalone fine amount (Art. 22).","key_dates":[{"date":"2023-01-10","event":"Provisions enter into force","source":"https://www.cac.gov.cn/2022-12/11/c_1672221949354811.htm"}]},{"id":"cn-genai","code":"GENAI","title":"Interim Measures for the Management of Generative Artificial Intelligence Services","short":"Interim GenAI Measures","type":"rule","legal_force":"binding","status":"in-force","official_url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","penalties":"Other applicable laws may impose penalties; otherwise authorities may warn, publicly criticize, order correction and, for refusal or serious cases, suspend the service. The Measures state no standalone fine amount (Art. 21).","key_dates":[{"date":"2023-08-15","event":"Measures enter into force","source":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm"}]},{"id":"cn-content-label","code":"LABEL","title":"Measures for Labelling AI-Generated Synthetic Content","short":"AI Content Labelling Measures","type":"rule","legal_force":"binding","status":"in-force","official_url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","penalties":"Authorities handle violations under applicable laws, administrative regulations and departmental rules; the Measures do not set a standalone fine amount (Art. 13).","key_dates":[{"date":"2025-03-07","event":"Measures issued","source":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm"},{"date":"2025-09-01","event":"Measures enter into force","source":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm"}]},{"id":"cn-gb45438","code":"GB45438","title":"GB 45438-2025, Cybersecurity Technology—Labelling Method for Content Generated by Artificial Intelligence","short":"GB 45438-2025","type":"standard","legal_force":"binding","status":"in-force","official_url":"https://openstd.samr.gov.cn/bzgk/std/std_list?p.p2=GB+45438-2025","penalties":"Enforcement is through applicable law and the AI Content Labelling Measures; this standard does not specify a standalone fine.","key_dates":[{"date":"2025-02-28","event":"Standard published","source":"https://openstd.samr.gov.cn/bzgk/std/std_list?p.p2=GB+45438-2025"},{"date":"2025-09-01","event":"Mandatory standard takes effect","source":"https://openstd.samr.gov.cn/bzgk/std/std_list?p.p2=GB+45438-2025"}]},{"id":"cn-csl","code":"CSL","title":"Cybersecurity Law of the People's Republic of China, as amended by the 2025 Decision","short":"Amended Cybersecurity Law","type":"statute","legal_force":"binding","status":"in-force","official_url":"http://www.npc.gov.cn/npc/c1773/c1848/c21114/wlaqfxz/wlaqfxz002/202511/t20251103_449242.html","penalties":"Article 20 is a state-policy provision and creates no AI-specific operator penalty. The amendment separately revises penalties for cybersecurity breaches.","key_dates":[{"date":"2025-10-28","event":"Amendment adopted by the NPC Standing Committee","source":"http://www.npc.gov.cn/npc/c1773/c1848/c21114/wlaqfxz/wlaqfxz002/202511/t20251103_449242.html"},{"date":"2026-01-01","event":"Amendment enters into force","source":"http://www.npc.gov.cn/npc/c1773/c1848/c21114/wlaqfxz/wlaqfxz002/202511/t20251103_449242.html"}]},{"id":"cn-anthro","code":"ANTHRO","title":"Interim Measures for the Administration of Anthropomorphic Interactive Services (人工智能拟人化互动服务管理暂行办法)","short":"Anthropomorphic Interactive Services Measures","type":"rule","legal_force":"binding","status":"in-force","official_url":"https://www.cac.gov.cn/2026-04/10/c_1777558395078289.htm","penalties":"Under Art. 30, where other law does not govern, authorities may warn, criticize, order correction and suspend related activity; refusal or serious cases may result in service suspension and CNY 10,000–100,000. Where conduct harms life or health and causes harmful consequences, the fine is CNY 100,000–200,000.","key_dates":[{"date":"2026-04-10","event":"Measures promulgated","source":"https://www.cac.gov.cn/2026-04/10/c_1777558395078289.htm"},{"date":"2026-07-15","event":"Measures enter into force","source":"https://www.cac.gov.cn/2026-04/10/c_1777558395078289.htm"}]}],"sources":[{"title":"CAC: Algorithmic Recommendation Provisions (full text)","url":"https://www.cac.gov.cn/2022-01/04/c_1642894606364259.htm"},{"title":"CAC: Deep Synthesis Provisions (full text)","url":"https://www.cac.gov.cn/2022-12/11/c_1672221949354811.htm"},{"title":"CAC: Interim Measures for the Management of Generative AI Services (full text)","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm"},{"title":"CAC: AI-Generated Synthetic Content Labelling Measures (full text)","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm"},{"title":"SAMR: National standards catalogue entry for GB 45438-2025","url":"https://openstd.samr.gov.cn/bzgk/std/std_list?p.p2=GB+45438-2025"},{"title":"NPC: 2025 decision amending the Cybersecurity Law","url":"http://www.npc.gov.cn/npc/c1773/c1848/c21114/wlaqfxz/wlaqfxz002/202511/t20251103_449242.html"},{"title":"CAC: Anthropomorphic Interactive Services Measures (full text)","url":"https://www.cac.gov.cn/2026-04/10/c_1777558395078289.htm"},{"title":"State Council: 2026 Legislative Work Plan","url":"https://www.gov.cn/yaowen/liebiao/202605/content_7068353.htm"}]},{"id":"coe","jurisdiction":"COE","name":"Council of Europe","as_of":"2026-11-04","review":{"status":"draft-unreviewed","reviewers":[]},"card":{"title":"Council of Europe AI Framework Convention (CETS No. 225)","one_liner":"A human-rights treaty requiring its Parties to govern AI lifecycle activities through safeguards, transparency, oversight, remedies and risk management.","who_it_hits":"Treaty Parties must implement the Convention for public authorities and private actors acting on their behalf; each Party chooses how to address other private actors under Article 3.","status_line":"Treaty, not yet in force as of 4 November 2026. The EU and Bosnia and Herzegovina have ratified; Article 30(3) requires five consents including three Council of Europe member States, followed by three months."},"instruments":[{"id":"coe-ai-convention","code":"CETS225","title":"Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225)","short":"Council of Europe AI Framework Convention","type":"treaty","legal_force":"treaty","status":"enacted-not-yet-applicable","official_url":"https://rm.coe.int/1680afae3c","penalties":null,"key_dates":[{"date":"2024-09-05","event":"Convention opened for signature in Vilnius","source":"https://www.coe.int/en/web/portal/-/council-of-europe-opens-first-ever-global-treaty-on-ai-for-signature"},{"date":"2026-05-15","event":"European Union ratifies the Convention","source":"https://www.coe.int/en/web/artificial-intelligence/-/european-union-ratifies-the-council-of-europe-framework-convention-on-artificial-intelligence"},{"date":"2026-10-28","event":"Treaty Office reports Bosnia and Herzegovina's ratification; this is the second ratification recorded","source":"https://www.coe.int/en/web/conventions/"}],"notes":"Article 30(3) requires five signatories to express consent to be bound, including at least three Council of Europe member States; entry into force is the first day of the month after the following three-month period. The latest dated Treaty Office update (28 October 2026) reports Bosnia and Herzegovina's ratification after the EU's 15 May ratification. The dedicated Convention overview page still lists the EU alone under Parties, so its roster appears not to reflect the later update."}],"sources":[{"title":"CETS No. 225, official Convention text, Council of Europe Treaty Office","url":"https://rm.coe.int/1680afae3c"},{"title":"Council of Europe Treaty Office: chart of signatures and ratifications for Treaty 225","url":"https://www.coe.int/en/web/conventions/full-list?module=signatures-by-treaty&treatynum=225"},{"title":"Council of Europe Treaty Office: latest treaty updates","url":"https://www.coe.int/en/web/conventions/"},{"title":"Council of Europe: EU ratification announcement, 15 May 2026","url":"https://www.coe.int/en/web/artificial-intelligence/-/european-union-ratifies-the-council-of-europe-framework-convention-on-artificial-intelligence"},{"title":"Council of Europe: Framework Convention overview","url":"https://www.coe.int/en/web/artificial-intelligence/the-framework-convention-on-artificial-intelligence"}]},{"id":"eu","jurisdiction":"EU","name":"European Union","as_of":"2026-11-04","review":{"status":"draft-unreviewed","reviewers":[]},"card":{"title":"EU AI Act (as amended by the Digital Omnibus on AI)","one_liner":"The world's first horizontal AI law. Bans some uses, sets transparency duties for chatbots and generated content, and adds strict rules for high-risk systems.","who_it_hits":"Anyone who places an AI system or general-purpose AI model on the EU market, or uses AI in the EU, wherever the company is based.","status_line":"Binding. Bans since 2 Feb 2025, GPAI rules since 2 Aug 2025, transparency since 2 Aug 2026. Next dates are 2 Dec 2026 (new bans, marking for existing systems) and 2 Dec 2027 (Annex III high-risk)."},"instruments":[{"id":"eu-aia","code":"AIA","title":"Regulation (EU) 2024/1689 (Artificial Intelligence Act), as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI)","short":"EU AI Act","type":"regulation","legal_force":"binding","status":"partially-applicable","official_url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","penalties":"Up to EUR 35 million or 7% of worldwide turnover for banned practices (Art. 99(3)); up to EUR 15 million or 3% for most other duties, including Art. 50 (Art. 99(4)); up to EUR 7.5 million or 1% for misleading information (Art. 99(5)). GPAI providers up to EUR 15 million or 3% (Art. 101). Lower caps for SMEs (Art. 99(6)).","key_dates":[{"date":"2024-08-01","event":"AI Act enters into force","source":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-113"},{"date":"2025-02-02","event":"Chapters I and II apply: definitions, AI literacy (Art. 4) and prohibited practices (Art. 5)","source":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-113"},{"date":"2025-08-02","event":"GPAI model rules (Chapter V), governance and penalties apply (except Art. 101)","source":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-113"},{"date":"2026-07-27","event":"Digital Omnibus on AI (Reg. (EU) 2026/1744) enters into force; Arts. 102 to 110 apply","source":"https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force"},{"date":"2026-08-02","event":"General date of application, including Art. 50 transparency duties and Commission fines on GPAI providers (Art. 101)","source":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-113"},{"date":"2026-12-02","event":"New bans on AI that generates non-consensual intimate content or child sexual abuse material apply; Art. 50(2) marking applies to generative systems placed on the market before 2 Aug 2026","source":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-113"},{"date":"2027-08-02","event":"GPAI models placed on the market before 2 Aug 2025 must comply","source":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-111"},{"date":"2027-12-02","event":"High-risk rules apply to Annex III systems (Art. 6(2))","source":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-113"},{"date":"2028-08-02","event":"High-risk rules apply to Annex I product systems (Art. 6(1))","source":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-113"},{"date":"2030-08-02","event":"Providers and deployers of high-risk systems used by public authorities and already on the market must comply","source":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-111"}]},{"id":"eu-cop-marking","code":"COPM","title":"Code of Practice on marking and labelling of AI-generated content","short":"EU Code of Practice on AI-generated content","type":"code-of-practice","legal_force":"voluntary","status":"voluntary","official_url":"https://digital-strategy.ec.europa.eu/en/policies/code-practice-ai-generated-content","penalties":null,"key_dates":[{"date":"2026-06-10","event":"Final Code of Practice published","source":"https://digital-strategy.ec.europa.eu/en/policies/code-practice-ai-generated-content"}]}],"sources":[{"title":"AI Act Service Desk: consolidated text as at 27 July 2026","url":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-113"},{"title":"European Commission: AI Omnibus enters into force (27 July 2026)","url":"https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force"},{"title":"European Parliament Legislative Train: Digital Omnibus on AI","url":"https://www.europarl.europa.eu/legislative-train/package-digital-package/file-digital-omnibus-on-ai"},{"title":"Regulation (EU) 2024/1689 on EUR-Lex","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj"}]},{"id":"gb","jurisdiction":"GB","name":"United Kingdom","as_of":"2026-11-04","review":{"status":"draft-unreviewed","reviewers":[]},"card":{"title":"UK AI regulation","one_liner":"No general cross-sector AI Act; existing data, online-safety and criminal laws apply through sector regulators.","who_it_hits":"AI developers and deployers, controllers making significant automated decisions, in-scope online services, and public bodies using algorithmic tools.","status_line":"Binding UK GDPR ADM safeguards apply from 5 February 2026. Online-safety duties cover specified services, not every standalone chatbot. England-and-Wales intimate-image offences are in force; Scotland child-image-generator provisions are enacted but not commenced. The ATRS is a mandatory government policy for specified central bodies, not a statute."},"instruments":[{"id":"gb-ukgdpr-adm","code":"UKGDPR","title":"UK GDPR Articles 22A–22D, substituted by Data (Use and Access) Act 2025, section 80","short":"UK GDPR automated decision-making","type":"regulation","legal_force":"binding","status":"in-force","official_url":"https://www.legislation.gov.uk/ukpga/2025/18/section/80","penalties":"UK GDPR administrative penalties may apply; the applicable cap depends on the infringement.","key_dates":[{"date":"2025-06-19","event":"Data (Use and Access) Act 2025 received Royal Assent","source":"https://www.legislation.gov.uk/ukpga/2025/18"},{"date":"2026-02-05","event":"Section 80 automated decision-making amendments came into force","source":"https://www.legislation.gov.uk/uksi/2026/82/regulation/2"}]},{"id":"gb-dpa-le-adm","code":"DPA18","title":"Data Protection Act 2018 sections 50A–50D, as substituted by Data (Use and Access) Act 2025, section 80","short":"Law-enforcement automated decision-making","type":"statute","legal_force":"binding","status":"in-force","official_url":"https://www.legislation.gov.uk/ukpga/2025/18/section/80","penalties":"UK GDPR / Data Protection Act enforcement provisions may apply.","key_dates":[{"date":"2026-02-05","event":"New Part 3 law-enforcement automated-decision provisions came into force","source":"https://www.legislation.gov.uk/uksi/2026/82/regulation/2"}]},{"id":"gb-osa","code":"OSA","title":"Online Safety Act 2023, as amended by Crime and Policing Act 2026","short":"Online Safety Act","type":"statute","legal_force":"binding","status":"partially-applicable","official_url":"https://www.legislation.gov.uk/ukpga/2023/50","penalties":"Ofcom may impose penalties up to £18 million or 10% of qualifying worldwide revenue, whichever is greater, under the Act.","key_dates":[{"date":"2025-03-17","event":"Ofcom began enforcing the illegal-content duties","source":"https://www.gov.uk/government/collections/online-safety-act"},{"date":"2025-07-25","event":"Protection-of-children duties and related age-assurance requirements took effect","source":"https://www.gov.uk/government/collections/online-safety-act"},{"date":"2026-04-29","event":"Crime and Policing Act 2026 section 248 inserted Online Safety Act section 216A","an enabling power concerning illegal AI-generated content":null,"source":"https://www.legislation.gov.uk/ukpga/2026/20/section/248"}]},{"id":"gb-duaa-intimate-images","code":"DUAA","title":"Data (Use and Access) Act 2025, section 138 (Sexual Offences Act 2003, sections 66E–66F)","short":"Non-consensual purported intimate images","type":"statute","legal_force":"binding","status":"in-force","official_url":"https://www.legislation.gov.uk/ukpga/2025/18/section/138","penalties":"Summary conviction may result in imprisonment up to the general limit for summary offences, a fine, or both.","key_dates":[{"date":"2026-02-06","event":"Section 138 came into force","source":"https://www.legislation.gov.uk/uksi/2026/31/made"}]},{"id":"gb-cpa26-image-generators","code":"CPA26","title":"Crime and Policing Act 2026, sections 72, 74 and 99","short":"Intimate-image and child-abuse-image generator offences","type":"statute","legal_force":"binding","status":"partially-applicable","official_url":"https://www.legislation.gov.uk/ukpga/2026/20/section/99","penalties":"Section 99 permits up to 3 years' imprisonment and/or a fine on indictment; the child sexual abuse image-generator offences provide up to 5 years on indictment.","key_dates":[{"date":"2026-04-29","event":"Sections 72 and 74 were enacted but were not commenced as of 4 November 2026","source":"https://www.legislation.gov.uk/ukpga/2026/20/section/72"},{"date":"2026-06-29","event":"Section 99 came into force in England and Wales","source":"https://www.legislation.gov.uk/uksi/2026/689/regulation/2"}]},{"id":"gb-atrs","code":"ATRS","title":"Algorithmic Transparency Recording Standard mandatory scope and exemptions policy","short":"ATRS","type":"standard","legal_force":"framework-no-penalties","status":"in-force","official_url":"https://www.gov.uk/government/publications/algorithmic-transparency-recording-standard-mandatory-scope-and-exemptions-policy/algorithmic-transparency-recording-standard-atrs-mandatory-scope-and-exemptions-policy","penalties":null,"key_dates":[{"date":"2024-02-06","event":"ATRS was mandated across government departments; the policy defines the covered central-government bodies and tools","source":"https://www.gov.uk/government/publications/algorithmic-transparency-recording-standard-mandatory-scope-and-exemptions-policy/algorithmic-transparency-recording-standard-atrs-mandatory-scope-and-exemptions-policy"}]},{"id":"gb-ai-cyber-code","code":"AICSCOP","title":"Code of Practice for the Cyber Security of AI","short":"AI Cyber Security Code of Practice","type":"code-of-practice","legal_force":"voluntary","status":"voluntary","official_url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","penalties":null,"key_dates":[{"date":"2025-01-31","event":"Voluntary AI cyber-security code published","source":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice"},{"date":"2025-02-14","event":"UK AI Safety Institute renamed AI Security Institute","source":"https://www.gov.uk/government/news/tackling-ai-security-risks-to-unleash-growth-and-deliver-plan-for-change"}]},{"id":"gb-dpa-ai-code-regs","code":"DPAICR","title":"Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026","short":"Statutory AI and ADM code mandate","type":"regulation","legal_force":"binding","status":"in-force","official_url":"https://www.legislation.gov.uk/uksi/2026/425/made","penalties":null,"key_dates":[{"date":"2026-05-12","event":"Regulations requiring the Commissioner to prepare a statutory AI and ADM code came into force","source":"https://www.legislation.gov.uk/uksi/2026/425/made"}]},{"id":"gb-ico-ai-code","code":"ICOAICODE","title":"ICO statutory code of practice on AI and automated decision-making (in drafting)","short":"ICO AI and ADM code","type":"code-of-practice","legal_force":"proposed","status":"proposed","official_url":"https://ico.org.uk/about-the-ico/what-we-do/our-plans-for-new-and-updated-codes-of-practice/upcoming-codes-of-practice/","penalties":null,"key_dates":[{"date":"2026-07-08","event":"ICO listed the code as in drafting and forecast publication in Q1/Q2 2028; the code is not yet published","source":"https://ico.org.uk/about-the-ico/what-we-do/our-plans-for-new-and-updated-codes-of-practice/upcoming-codes-of-practice/"}]},{"id":"gb-regulating-growth","code":"RFG","title":"Regulating for Growth Bill (announced; AI Growth Lab and sandbox powers proposed)","short":"Regulating for Growth Bill","type":"bill","legal_force":"proposed","status":"proposed","official_url":"https://www.gov.uk/government/speeches/the-kings-speech-2026","penalties":null,"key_dates":[{"date":"2026-05-13","event":"King's Speech announced the proposed Regulating for Growth Bill","source":"https://www.gov.uk/government/speeches/the-kings-speech-2026"},{"date":"2026-06-10","event":"Government described statutory AI Growth Labs as dependent on passage of the Bill","source":"https://www.gov.uk/government/publications/digital-and-technologies-sector-plan-year-one-update/digital-and-technologies-sector-plan-year-one-update"}]}],"sources":[{"title":"Data (Use and Access) Act 2025","section 80":null,"UK GDPR and law-enforcement ADM amendments":null,"url":"https://www.legislation.gov.uk/ukpga/2025/18/section/80"},{"title":"Data (Use and Access) Act 2025 Commencement No. 6 Regulations 2026","regulation 2":null,"url":"https://www.legislation.gov.uk/uksi/2026/82/regulation/2"},{"title":"Online Safety Act 2023","current text":null,"url":"https://www.legislation.gov.uk/ukpga/2023/50"},{"title":"Ofcom","AI chatbots and online regulation":null,"url":"https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/ai-chatbots-and-online-regulation-what-you-need-to-know"},{"title":"Data (Use and Access) Act 2025","sections 138 and 141":null,"url":"https://www.legislation.gov.uk/ukpga/2025/18/section/138"},{"title":"Crime and Policing Act 2026","intimate-image generator offence":null,"section 99":null,"url":"https://www.legislation.gov.uk/ukpga/2026/20/section/99"},{"title":"Crime and Policing Act 2026","child sexual-abuse image generators":null,"sections 72 and 74":null,"url":"https://www.legislation.gov.uk/ukpga/2026/20/section/72"},{"title":"ATRS mandatory scope and exemptions policy","url":"https://www.gov.uk/government/publications/algorithmic-transparency-recording-standard-mandatory-scope-and-exemptions-policy/algorithmic-transparency-recording-standard-atrs-mandatory-scope-and-exemptions-policy"},{"title":"Code of Practice for the Cyber Security of AI","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai"},{"title":"UK AI Safety Institute renamed AI Security Institute","url":"https://www.gov.uk/government/news/tackling-ai-security-risks-to-unleash-growth-and-deliver-plan-for-change"},{"title":"Data Protection Act 2018 Code of Practice Regulations 2026","url":"https://www.legislation.gov.uk/uksi/2026/425/made"},{"title":"ICO upcoming codes of practice","AI and ADM code status":null,"url":"https://ico.org.uk/about-the-ico/what-we-do/our-plans-for-new-and-updated-codes-of-practice/upcoming-codes-of-practice/"},{"title":"AI Opportunities Action Plan","pro-innovation and regulator-led approach":null,"url":"https://www.gov.uk/government/publications/ai-opportunities-action-plan/ai-opportunities-action-plan"},{"title":"King's Speech 2026","Regulating for Growth Bill announcement":null,"url":"https://www.gov.uk/government/speeches/the-kings-speech-2026"},{"title":"Digital and Technologies Sector Plan Year One Update","proposed statutory AI Growth Labs":null,"url":"https://www.gov.uk/government/publications/digital-and-technologies-sector-plan-year-one-update/digital-and-technologies-sector-plan-year-one-update"},{"title":"Scottish Government consultation on possible new deepfake-intimate-image offences","url":"https://www.gov.scot/publications/improving-protections-justice-system-women-girls/pages/8/"}]},{"id":"in","jurisdiction":"IN","name":"India","as_of":"2026-11-04","review":{"status":"draft-unreviewed","reviewers":[]},"card":{"title":"India AI Governance, Intermediary and Data Rules","one_liner":"India combines voluntary AI governance guidance with binding intermediary duties and a phased personal-data protection regime.","who_it_hits":"AI developers and deployers, intermediaries handling synthetic media, and Data Fiduciaries processing digital personal data in India or offering goods or services to people in India.","status_line":"Binding synthetic-media intermediary rules apply from 20 Feb 2026. DPDP institutional provisions began 13 Nov 2025; the Consent Manager phase starts 13 Nov 2026 and most substantive data duties start 13 May 2027. India AI Governance Guidelines remain voluntary."},"instruments":[{"id":"in-ai-guidelines","code":"AIGG","title":"India AI Governance Guidelines (2025)","short":"India AI Governance Guidelines","type":"guidance","legal_force":"voluntary","status":"voluntary","official_url":"https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc2025115685601.pdf","penalties":null,"key_dates":[{"date":"2025-11-05","event":"MeitY releases the India AI Governance Guidelines","source":"https://www.pib.gov.in/Pressreleaseshare.aspx?PRID=2186639&lang=2&reg=3"}]},{"id":"in-it-rules","code":"ITR","title":"Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended by G.S.R. 120(E) and corrected by G.S.R. 148(E)","short":"IT Intermediary Rules","type":"rule","legal_force":"binding","status":"in-force","official_url":"https://www.meity.gov.in/static/uploads/2026/03/0b576f2071694b52e4cd6bb1b6dfab1e.pdf","penalties":"Failure to observe due diligence can remove an intermediary’s exemption from liability under section 79(1) of the Information Technology Act (Rule 7); other liability may arise under applicable laws. These Rules do not set a single stand-alone fine for the duties listed here.","key_dates":[{"date":"2026-02-10","event":"G.S.R. 120(E) notifies the 2026 amendments, including synthetic-information duties","source":"https://www.meity.gov.in/static/uploads/2026/02/f55fe52418b03f58b0669f6a8bc03b6d.pdf"},{"date":"2026-02-20","event":"2026 IT Rules amendments enter into force","source":"https://www.meity.gov.in/static/uploads/2026/02/f55fe52418b03f58b0669f6a8bc03b6d.pdf"},{"date":"2026-02-26","event":"G.S.R. 148(E) corrects statutory references in the February amendment","source":"https://www.meity.gov.in/static/uploads/2026/03/20c30107195f68865104dd4e16176f4d.pdf"}]},{"id":"in-dpdp-act","code":"DPDPA","title":"Digital Personal Data Protection Act, 2023","short":"DPDP Act","type":"statute","legal_force":"binding","status":"partially-applicable","official_url":"https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf","penalties":"Up to INR 250 crore for failure to take reasonable security safeguards, INR 200 crore for breach-notification failures, INR 150 crore for breach of Significant Data Fiduciary duties, and INR 50 crore for other Act or Rules breaches (section 33 and Schedule).","key_dates":[{"date":"2025-11-13","event":"Initial institutional and procedural provisions commence under G.S.R. 843(E)","source":"https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf"},{"date":"2026-11-13","event":"Section 6(9) and section 27(1)(d), relating to Consent Managers, commence","source":"https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf"},{"date":"2027-05-13","event":"Most substantive data-processing and fiduciary duties commence","source":"https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf"}]},{"id":"in-dpdp-rules","code":"DPR","title":"Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)), as corrected by G.S.R. 892(E)","short":"DPDP Rules","type":"rule","legal_force":"binding","status":"partially-applicable","official_url":"https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf","penalties":"As provided by the DPDP Act, including the statutory maximums for the corresponding Act duties.","key_dates":[{"date":"2025-11-13","event":"Rules 1, 2 and 17 to 21 commence on Gazette publication","source":"https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf"},{"date":"2025-12-10","event":"G.S.R. 892(E) makes textual corrections to the Rules notification","source":"https://www.meity.gov.in/static/uploads/2025/12/3c7ebbae0e5456f493f486e6845df86b.pdf"},{"date":"2026-11-13","event":"Rule 4 Consent Manager provisions commence one year after Gazette publication","source":"https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf"},{"date":"2027-05-13","event":"Rules 3, 5 to 16, 22 and 23 commence eighteen months after Gazette publication","source":"https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf"}]}],"sources":[{"title":"India AI Governance Guidelines, official full text","url":"https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc2025115685601.pdf"},{"title":"PIB release announcing the India AI Governance Guidelines on 5 November 2025","url":"https://www.pib.gov.in/Pressreleaseshare.aspx?PRID=2186639&lang=2&reg=3"},{"title":"G.S.R. 120(E), IT Rules synthetic-information amendment, 10 February 2026","url":"https://www.meity.gov.in/static/uploads/2026/02/f55fe52418b03f58b0669f6a8bc03b6d.pdf"},{"title":"Consolidated IT Rules, 2021 (updated 10 February 2026; includes 26 February corrigendum)","url":"https://www.meity.gov.in/static/uploads/2026/03/0b576f2071694b52e4cd6bb1b6dfab1e.pdf"},{"title":"G.S.R. 148(E), corrigendum to February 2026 IT Rules amendment","url":"https://www.meity.gov.in/static/uploads/2026/03/20c30107195f68865104dd4e16176f4d.pdf"},{"title":"Digital Personal Data Protection Act, 2023, official MeitY text","url":"https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf"},{"title":"G.S.R. 843(E), DPDP Act commencement notification, 13 November 2025","url":"https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf"},{"title":"Digital Personal Data Protection Rules, 2025, G.S.R. 846(E)","url":"https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf"},{"title":"G.S.R. 892(E), corrigendum to DPDP Rules, 10 December 2025","url":"https://www.meity.gov.in/static/uploads/2025/12/3c7ebbae0e5456f493f486e6845df86b.pdf"},{"title":"MeitY Act and Policies listing, updated 29 October 2026; draft IT amendment listed as draft","url":"https://www.meity.gov.in/documents/act-and-policies"}]},{"id":"jp","jurisdiction":"JP","name":"Japan","as_of":"2026-11-04","review":{"status":"draft-unreviewed","reviewers":[]},"card":{"title":"Japan AI Promotion Act and business guidance","one_liner":"Japan's AI Act is a promotion framework with a business cooperation duty; the detailed business principles remain voluntary guidance.","who_it_hits":"AI developers, providers and business users, plus public bodies using the voluntary national guidance and plan.","status_line":"The Act is fully in force; Article 7 requires cooperation with government measures but sets no penalties. The Second AI Basic Plan was adopted on 14 July 2026; METI/MIC Guidelines Ver1.2 are voluntary."},"instruments":[{"id":"jp-ai-act","code":"AIPA","title":"Act on Promotion of Research and Development, and Utilization of Artificial Intelligence-related Technology (Act No. 53 of 2025)","short":"AI Promotion Act","type":"statute","legal_force":"framework-no-penalties","status":"in-force","official_url":"https://laws.e-gov.go.jp/law/507AC0000000053","penalties":null,"key_dates":[{"date":"2025-06-04","event":"Promulgated and most provisions took effect","source":"https://www8.cao.go.jp/cstp/ai/ai_act/ai_act.html"},{"date":"2025-09-01","event":"Remaining provisions, including the Basic Plan and Strategic Headquarters chapters, took effect; the Act is fully in force","source":"https://laws.e-gov.go.jp/law/507AC0000000053"}]},{"id":"jp-ai-plan","code":"AIBP","title":"Japan's Second Artificial Intelligence Basic Plan","short":"Second AI Basic Plan","type":"guidance","legal_force":"voluntary","status":"voluntary","official_url":"https://www8.cao.go.jp/cstp/ai/ai_plan/ai_plan.html","penalties":null,"key_dates":[{"date":"2026-07-14","event":"Cabinet decided the Second AI Basic Plan, replacing the first plan","source":"https://www8.cao.go.jp/cstp/ai/ai_plan/ai_plan.html"}]},{"id":"jp-ai-guidelines","code":"AIGB","title":"AI Guidelines for Business Ver1.2 (METI and MIC)","short":"AI Guidelines for Business Ver1.2","type":"guidance","legal_force":"voluntary","status":"voluntary","official_url":"https://www.meti.go.jp/shingikai/mono_info_service/ai_shakai_jisso/20260331_report.html","penalties":null,"key_dates":[{"date":"2026-03-31","event":"METI and MIC issued AI Guidelines for Business Ver1.2","source":"https://www.meti.go.jp/shingikai/mono_info_service/ai_shakai_jisso/pdf/20260331_12.pdf"}]}],"sources":[{"title":"Act on Promotion of Research and Development, and Utilization of AI-related Technology (official English translation)","url":"https://www.japaneselawtranslation.go.jp/en/laws/view/5066/je"},{"title":"AI Promotion Act on e-Gov","url":"https://laws.e-gov.go.jp/law/507AC0000000053"},{"title":"Cabinet Office AI Promotion Act overview and commencement dates","url":"https://www8.cao.go.jp/cstp/ai/ai_act/ai_act.html"},{"title":"Cabinet Office Artificial Intelligence Basic Plan index","url":"https://www8.cao.go.jp/cstp/ai/ai_plan/ai_plan.html"},{"title":"Japan's Second Artificial Intelligence Basic Plan (provisional English translation)","url":"https://www8.cao.go.jp/cstp/ai/ai_plan/aiplan_eng_20260714.pdf"},{"title":"METI AI Guidelines for Business Ver1.2 listing","url":"https://www.meti.go.jp/shingikai/mono_info_service/ai_shakai_jisso/20260331_report.html"},{"title":"AI Guidelines for Business Ver1.2 (provisional English translation)","url":"https://www.meti.go.jp/shingikai/mono_info_service/ai_shakai_jisso/pdf/20260331_12.pdf"}]},{"id":"kr","jurisdiction":"KR","name":"South Korea","as_of":"2026-11-04","review":{"status":"draft-unreviewed","reviewers":[]},"card":{"title":"Korea AI Basic Act","one_liner":"Korea's binding AI framework sets notice and labelling rules, high-impact AI duties, and safety controls for a narrowly defined class of advanced systems.","who_it_hits":"AI developers and businesses providing AI products or services in Korea, including foreign operators serving Korean users, plus public bodies using high-impact AI.","status_line":"Binding; the Act and Enforcement Decree have applied since 22 Jan 2026. MSIT announced an enforcement grace period of at least one year; 22 Jan 2027 is only the earliest possible end, not a fixed date."},"instruments":[{"id":"kr-aiba","code":"AIBA","title":"Framework Act on the Development of Artificial Intelligence and the Creation of a Foundation for Trust (Act No. 20676, as amended by Act No. 21311)","short":"AI Basic Act","type":"statute","legal_force":"binding","status":"in-force","official_url":"https://www.law.go.kr/LSW/lsInfoP.do?lsiSeq=282791","penalties":"Administrative fines up to KRW 30 million apply to failure to give advance notice under Article 31(1), appoint a domestic agent under Article 36(1), or comply with an MSIT corrective order under Articles 40(3) and 43(1). MSIT announced that fact-finding investigations and penalties would be deferred for at least one year from 22 January 2026, except investigations in highly exceptional cases involving serious harm. This is an enforcement policy, not a statutory suspension; no fixed end date was identified as of 2026-11-04.","key_dates":[{"date":"2025-01-21","event":"Act No. 20676 promulgated","source":"https://www.law.go.kr/LSW/eng/engLsInfoR.do?lsiSeq=268543"},{"date":"2026-01-22","event":"AI Basic Act enters into force","source":"https://www.msit.go.kr/eng/bbs/view.do?sCode=eng&mPid=2&mId=4&bbsSeqNo=42&nttSeqNo=1214"},{"date":"2026-01-24","event":"The high-impact AI definition covering the specified digital-medical-device provisions takes effect","source":"https://www.law.go.kr/LSW/eng/engLsInfoR.do?lsiSeq=268543"},{"date":"2026-07-21","event":"The amended Article 35(1) requirement to reflect AI-vulnerable-group characteristics in impact assessments takes effect","source":"https://www.law.go.kr/lsLinkCommonInfo.do?chrClsCd=010202&lsJoLnkSeq=1031810855"},{"date":"2026-01-22","event":"MSIT's announced minimum one-year enforcement grace begins; penalties and fact-finding investigations are deferred except for highly exceptional serious-harm cases","source":"https://www.msit.go.kr/eng/bbs/view.do?sCode=eng&mPid=2&mId=4&bbsSeqNo=42&nttSeqNo=1214"}]},{"id":"kr-aibad","code":"AIBAD","title":"Enforcement Decree of the Framework Act on the Development of Artificial Intelligence and the Creation of a Foundation for Trust (Presidential Decree No. 36053, as amended)","short":"AI Basic Act Enforcement Decree","type":"regulation","legal_force":"binding","status":"in-force","official_url":"https://www.law.go.kr/LSW/lsInfoP.do?lsiSeq=288781","penalties":"Article 32 refers to the Act's administrative-fine rules. The Act caps the relevant administrative fines at KRW 30 million for the specified violations; see the AI Basic Act instrument and MSIT grace-period policy.","key_dates":[{"date":"2026-01-21","event":"Presidential Decree No. 36053 promulgated","source":"https://www.law.go.kr/LSW/eng/engLsInfoR.do?lsiSeq=282879"},{"date":"2026-01-22","event":"Enforcement Decree enters into force with the AI Basic Act","source":"https://www.msit.go.kr/eng/bbs/view.do?sCode=eng&mPid=2&mId=4&bbsSeqNo=42&nttSeqNo=1214"},{"date":"2026-07-21","event":"Partial amendment, Presidential Decree No. 36506, takes effect; it implements provisions including the vulnerable-group assessment criteria","source":"https://www.law.go.kr/LSW/lsInfoP.do?lsiSeq=288145&efYd=20260721"},{"date":"2026-08-20","event":"Current consolidated version also reflects Presidential Decree No. 36580, a consequential amendment","source":"https://www.law.go.kr/LSW/lsInfoP.do?lsiSeq=288781"}]}],"sources":[{"title":"Current consolidated AI Basic Act (Korean; Act No. 21311 version)","url":"https://www.law.go.kr/LSW/lsInfoP.do?lsiSeq=282791"},{"title":"Official English translation of AI Basic Act (translation is non-authoritative and may not reflect later amendments)","url":"https://www.law.go.kr/LSW/eng/engLsInfoR.do?lsiSeq=268543"},{"title":"Current consolidated AI Basic Act Enforcement Decree (Korean)","url":"https://www.law.go.kr/LSW/lsInfoP.do?lsiSeq=288781"},{"title":"Official English Enforcement Decree translation","url":"https://www.law.go.kr/LSW/eng/engLsInfoR.do?lsiSeq=282879"},{"title":"MSIT announcement on entry into force","implementing decree":null,"and enforcement grace period":null,"url":"https://www.msit.go.kr/eng/bbs/view.do?sCode=eng&mPid=2&mId=4&bbsSeqNo=42&nttSeqNo=1214"},{"title":"MSIT Guidelines on Ensuring AI Transparency","url":"https://www.msit.go.kr/eng/bbs/view.do?bbsSeqNo=42&mId=4&mPid=2&nttSeqNo=1215"},{"title":"Official October 2026 Cabinet announcement for further AI Basic Act amendment (proposal not yet enacted at cutoff)","url":"https://www.korea.kr/briefing/pressReleaseView.do?newsId=156784979"}]},{"id":"sg","jurisdiction":"SG","name":"Singapore","as_of":"2026-11-04","review":{"status":"draft-unreviewed","reviewers":[]},"card":{"title":"Singapore AI governance and online harms","one_liner":"Most AI governance frameworks are voluntary, while existing privacy, election and online-harm laws create binding duties in defined situations.","who_it_hits":"AI developers, providers and deployers; organizations handling personal data; election advertisers; communicators, online administrators and platforms.","status_line":"PDPA and election-advertising rules are binding. OSRAA's first-phase remedies began on 29 June 2026; its inauthentic-material category is still awaiting progressive implementation."},"instruments":[{"id":"sg-mgf-2020","code":"MGF20","title":"Model Artificial Intelligence Governance Framework, Second Edition","short":"Model AI Governance Framework (2020)","type":"guidance","legal_force":"voluntary","status":"voluntary","official_url":"https://www.imda.gov.sg/-/media/imda/files/infocomm-media-landscape/sg-digital/tech-pillars/artificial-intelligence/second-edition-of-the-model-ai-governance-framework.pdf","penalties":null,"key_dates":[{"date":"2020-01-21","event":"Second edition released as voluntary guidance","source":"https://www.imda.gov.sg/-/media/imda/files/infocomm-media-landscape/sg-digital/tech-pillars/artificial-intelligence/second-edition-of-the-model-ai-governance-framework.pdf"}]},{"id":"sg-mgf-genai","code":"MGFGAI","title":"Model AI Governance Framework for Generative AI","short":"Generative AI Governance Framework (2024)","type":"guidance","legal_force":"voluntary","status":"voluntary","official_url":"https://www.imda.gov.sg/About-IMDA/Emerging-Technologies-and-Research/Artificial-Intelligence","penalties":null,"key_dates":[{"date":"2024-05-30","event":"IMDA introduced the Generative AI framework as an ecosystem-level voluntary framework","source":"https://www.imda.gov.sg/resources/press-releases-factsheets-and-speeches/factsheets/2024/gen-ai-and-digital-foss-ai-governance-playbook"}]},{"id":"sg-mgf-agentic","code":"AGENTIC","title":"Model AI Governance Framework for Agentic AI, Version 1.5","short":"Agentic AI Governance Framework","type":"guidance","legal_force":"voluntary","status":"voluntary","official_url":"https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf","penalties":null,"key_dates":[{"date":"2026-01-22","event":"IMDA first published the Agentic AI framework","source":"https://www.imda.gov.sg/resources/press-releases-factsheets-and-speeches/press-releases/2026/singapore-launches-new-model-ai-governance-framework-for-agentic-ai"},{"date":"2026-05-20","event":"Version 1.5 published; the PDF notes a further update on 5 June 2026","source":"https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf"},{"date":"2026-06-05","event":"Version 1.5 PDF updated","source":"https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf"}]},{"id":"sg-ai-verify","code":"AIVERIFY","title":"AI Verify Testing Framework and Toolkit","short":"AI Verify","type":"standard","legal_force":"voluntary","status":"voluntary","official_url":"https://www.imda.gov.sg/ai-verify","penalties":null,"key_dates":[{"date":"2022-05-25","event":"AI Verify testing framework and toolkit announced for international pilot","source":"https://www.imda.gov.sg/resources/press-releases-factsheets-and-speeches/press-releases/2022/sg-launches-worlds-first-ai-testing-framework-and-toolkit-to-promote-transparency"}]},{"id":"sg-eioaa","code":"EIOA","title":"Elections (Integrity of Online Advertising) (Amendment) Act 2024","short":"Elections Integrity Amendment","type":"statute","legal_force":"binding","status":"in-force","official_url":"https://sso.agc.gov.sg/Acts-Supp/34-2024/Published/20241121?DocDate=20241121","penalties":"A person convicted for the candidate-representation offence may be fined up to S$1,000, imprisoned for up to 12 months, or both.","key_dates":[{"date":"2024-11-21","event":"Amendment Act published in the Government Gazette","source":"https://sso.agc.gov.sg/Acts-Supp/34-2024/Published/20241121?DocDate=20241121"},{"date":"2025-01-22","event":"Amendment commenced","source":"https://sso.agc.gov.sg/Act/PEA1954?ProvIds=pr61MA-"}]},{"id":"sg-pdpa","code":"PDPA","title":"Personal Data Protection Act 2012","short":"PDPA","type":"statute","legal_force":"binding","status":"in-force","official_url":"https://sso.agc.gov.sg/Act/PDPA2012","penalties":"For qualifying contraventions under section 48J, up to 10% of annual Singapore turnover where it exceeds S$10 million, or S$1 million otherwise; the exact provision and cap depend on the breach.","key_dates":[{"date":"2014-07-02","event":"Core collection, use and disclosure provisions apply","source":"https://sso.agc.gov.sg/Act/PDPA2012"}]},{"id":"sg-pdpc-ai-rec","code":"PDPCREC","title":"Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems","short":"PDPC AI Recommendation and Decision Guidelines","type":"guidance","legal_force":"voluntary","status":"voluntary","official_url":"https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/advisory-guidelines-on-the-use-of-personal-data-in-ai-recommendation-and-decision-systems.pdf","penalties":null,"key_dates":[{"date":"2024-03-01","event":"Final advisory guidelines issued","source":"https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/advisory-guidelines-on-the-use-of-personal-data-in-ai-recommendation-and-decision-systems.pdf"}]},{"id":"sg-pdpc-genai","code":"PDPCGENAI","title":"Advisory Guidelines on Use of Personal Data in Generative AI","short":"PDPC Generative AI Guidelines","type":"guidance","legal_force":"voluntary","status":"voluntary","official_url":"https://www.pdpc.gov.sg/assets/143cb9d4-532e-4cca-9a77-bcc0415ca294","penalties":null,"key_dates":[{"date":"2026-07-20","event":"PDPC issued the final Generative AI personal-data guidelines","source":"https://www.pdpc.gov.sg/assets/143cb9d4-532e-4cca-9a77-bcc0415ca294"}]},{"id":"sg-osraa","code":"OSRAA","title":"Online Safety (Relief and Accountability) Act 2025","short":"OSRAA","type":"statute","legal_force":"binding","status":"partially-applicable","official_url":"https://sso.agc.gov.sg/Act/OSRAA2025","penalties":"Civil remedies and Commissioner directions apply to harms implemented in the relevant phase; the Act is being implemented progressively.","key_dates":[{"date":"2026-06-29","event":"First-phase Online Safety Commission operations and specified statutory torts commenced","source":"https://www.mddi.gov.sg/newsroom/online-safety-commission-and-online-safety--relief-and-accountability--act-2025-to-start-on-29-june-2026/"},{"date":"2026-09-10","event":"MDDI confirmed inauthentic material abuse would be progressively implemented and no commencement date had been announced","source":"https://www.mddi.gov.sg/newsroom/mddi-response-to-pq-on-protecting-against-unauthorised-ai-generated-likeness-in-advertisements-and-operationalising-online-safety-commission-mandate-over-inauthentic-material-abuse/"}]}],"sources":[{"title":"IMDA/PDPC Model AI Governance Framework, Second Edition (2020)","url":"https://www.imda.gov.sg/-/media/imda/files/infocomm-media-landscape/sg-digital/tech-pillars/artificial-intelligence/second-edition-of-the-model-ai-governance-framework.pdf"},{"title":"IMDA Artificial Intelligence in Singapore: frameworks and AI Verify","url":"https://www.imda.gov.sg/About-IMDA/Emerging-Technologies-and-Research/Artificial-Intelligence"},{"title":"IMDA 2024 Annual Report: Generative AI framework and nine dimensions","url":"https://www.imda.gov.sg/-/media/imda/files/about/resources/corporate-publications/annual-report/imda-annual-report-2024.pdf"},{"title":"IMDA Model AI Governance Framework for Agentic AI, version 1.5","url":"https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf"},{"title":"PDPC Advisory Guidelines on AI Recommendation and Decision Systems (2024)","url":"https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/advisory-guidelines-on-the-use-of-personal-data-in-ai-recommendation-and-decision-systems.pdf"},{"title":"PDPC Advisory Guidelines on Use of Personal Data in Generative AI (2026)","url":"https://www.pdpc.gov.sg/assets/143cb9d4-532e-4cca-9a77-bcc0415ca294"},{"title":"Personal Data Protection Act 2012","url":"https://sso.agc.gov.sg/Act/PDPA2012"},{"title":"Elections (Integrity of Online Advertising) (Amendment) Act 2024","url":"https://sso.agc.gov.sg/Acts-Supp/34-2024/Published/20241121?DocDate=20241121"},{"title":"Parliamentary Elections Act 1954, s. 61MA","url":"https://sso.agc.gov.sg/Act/PEA1954?ProvIds=pr61MA-"},{"title":"Online Safety (Relief and Accountability) Act 2025","url":"https://sso.agc.gov.sg/Act/OSRAA2025"},{"title":"MDDI OSRAA commencement and phased-implementation statement (14 May 2026)","url":"https://www.mddi.gov.sg/newsroom/online-safety-commission-and-online-safety--relief-and-accountability--act-2025-to-start-on-29-june-2026/"},{"title":"MDDI response on AI-generated content and progressive implementation of inauthentic-material abuse (10 Sep 2026)","url":"https://www.mddi.gov.sg/newsroom/mddi-response-to-pq-on-protecting-against-unauthorised-ai-generated-likeness-in-advertisements-and-operationalising-online-safety-commission-mandate-over-inauthentic-material-abuse/"}]},{"id":"us-ca","jurisdiction":"US-CA","name":"California, United States","as_of":"2026-11-04","review":{"status":"draft-unreviewed","reviewers":[]},"card":{"title":"California AI and automated-decision duties","one_liner":"California regulates frontier-model safety, generative-AI transparency, child-facing chatbots, privacy-related ADMT, and employment decision systems.","who_it_hits":"Frontier-model developers; generative-AI providers, hosting platforms and capture-device makers; developers publishing training-data documentation; companion-chatbot operators; CCPA-regulated businesses using ADMT; FEHA-covered employers; and, from 2027, operators of AI chatbots accessible to children and employers using automated decision systems.","status_line":"Binding requirements are already in force for several covered uses. Major next dates are 2027-01-01 for CATA platform/hosting and ADMT duties, 2027-07-01 for child-safety assessments and companion-chatbot annual reports, and 2028-01-01 for capture-device provenance duties."},"instruments":[{"id":"us-ca-sb53","code":"SB53","title":"Transparency in Frontier Artificial Intelligence Act (SB 53), Business and Professions Code §§ 22757.10–22757.19","short":"TFAIA / SB 53","type":"statute","legal_force":"binding","status":"in-force","official_url":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB53","penalties":"Civil penalties may reach $1,000,000 per violation for specified violations by a large frontier developer; the Act also provides other enforcement remedies.","key_dates":[{"date":"2026-01-01","event":"SB 53's core frontier-developer duties became operative","source":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB53"},{"date":"2027-01-01","event":"California's technology department begins the statutory review of frontier-model thresholds and OES begins annual public reporting","source":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB53"}]},{"id":"us-ca-cata","code":"CATA","title":"California AI Transparency Act (SB 942), as amended by AB 853, SB 1000 and AB 2713, Business and Professions Code §§ 22757.1–22757.5","short":"California AI Transparency Act","type":"statute","legal_force":"binding","status":"partially-applicable","official_url":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB1000","penalties":"Generally $5,000 per violation, with each day treated as a separate violation; specified false claims of assistive-technology exemption carry a $50,000-per-violation penalty until 2029-01-01.","key_dates":[{"date":"2026-08-02","event":"CATA's provider tool and latent-disclosure requirements became operative","source":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB853"},{"date":"2026-09-30","event":"SB 1000 immediately amended CATA","including removing the former monthly-user threshold and manifest-disclosure option":null,"source":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB1000"},{"date":"2027-01-01","event":"GenAI hosting-platform and large-online-platform duties begin","source":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB853"},{"date":"2028-01-01","event":"Capture-device provenance duties begin","source":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB853"},{"date":"2029-01-01","event":"Temporary assistive-technology exemption ends","source":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB1000"}]},{"id":"us-ca-ab2013","code":"AB2013","title":"Generative artificial intelligence training-data transparency, Civil Code § 3111","short":"GenAI training-data documentation","type":"statute","legal_force":"binding","status":"in-force","official_url":"https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=3111.","penalties":"No standalone dollar penalty is specified in § 3111; other applicable enforcement may apply.","key_dates":[{"date":"2026-01-01","event":"Initial public training-data documentation deadline","source":"https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=3111."}]},{"id":"us-ca-sb243","code":"SB243","title":"Companion chatbots, Business and Professions Code §§ 22601–22606, as amended by SB 1119","short":"Companion chatbot safeguards","type":"statute","legal_force":"binding","status":"partially-applicable","official_url":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB243","penalties":"Civil penalties and other remedies are available under the Act; penalties vary with the violation and conduct.","key_dates":[{"date":"2026-01-01","event":"Companion-chatbot disclosure","crisis-protocol and minor-specific duties became operative":null,"source":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB243"},{"date":"2027-07-01","event":"Annual reporting under § 22603 begins for the preceding calendar year","source":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB243"}]},{"id":"us-ca-sb1119","code":"SB1119","title":"Adam's Law / child-safety requirements for AI chatbots, Business and Professions Code §§ 21810–21819 and amendments to § 22602","short":"Child-accessible chatbot safety","type":"statute","legal_force":"binding","status":"enacted-not-yet-applicable","official_url":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB1119","penalties":"Civil penalties may be imposed per affected child for negligent or intentional violations; the statute also provides enforcement remedies.","key_dates":[{"date":"2027-01-01","event":"Age-assurance requirements begin and SB 1119's amendment removing SB 243 § 22602(c) takes effect","source":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB1119"},{"date":"2027-01-01","event":"AB 1405's ordinary effective date triggers SB 1119's alternate § 21814 audit text","source":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB1405"},{"date":"2027-07-01","event":"Child-safety risk assessments","mitigation and policies under §§ 21812–21813 become operative":null,"source":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB1119"},{"date":"2029-01-01","event":"Initial independent child-safety audit deadline for operators subject to § 21814","subject to the statute's first-release and small-operator rules":null,"source":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB1119"}]},{"id":"us-ca-bot-act","code":"BOT","title":"BOT Act, Business and Professions Code §§ 17940–17943","short":"BOT Act","type":"statute","legal_force":"binding","status":"in-force","official_url":"https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC&sectionNum=17941.","penalties":"Civil penalties may be sought by the Attorney General or local prosecutors under the Act.","key_dates":[{"date":"2019-07-01","event":"BOT Act disclosure provisions became operative","source":"https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC&sectionNum=17941."}]},{"id":"us-ca-cppa-admt","code":"CPPA","title":"CCPA regulations on risk assessments and automated decisionmaking technology, 11 CCR §§ 7000–7222","short":"CPPA ADMT and risk assessments","type":"regulation","legal_force":"binding","status":"partially-applicable","official_url":"https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf","penalties":"CCPA administrative fines and statutory remedies may apply; amounts depend on the violation and circumstances.","key_dates":[{"date":"2026-01-01","event":"Risk-assessment regulations apply","source":"https://cppa.ca.gov/announcements/2025/20250923.html"},{"date":"2027-01-01","event":"Covered ADMT consumer-rights provisions become applicable","source":"https://cppa.ca.gov/announcements/2025/20250923.html"},{"date":"2027-12-31","event":"Last date to complete risk assessments for certain covered processing already underway before 2026 and continuing thereafter","source":"https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf"},{"date":"2028-04-01","event":"First risk-assessment information submission and attestation deadline for 2026–2027 assessments","source":"https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf"}]},{"id":"us-ca-crc-ads","code":"CRCADS","title":"Civil Rights Council employment discrimination regulations for automated-decision systems, 2 CCR §§ 11008.1, 11009(f), 11013(c)","short":"Employment ADS regulations","type":"regulation","legal_force":"binding","status":"in-force","official_url":"https://calcivilrights.ca.gov/wp-content/uploads/sites/32/2025/06/Final-Text-regulations-automated-employment-decision-systems.pdf","penalties":"Enforced through the Fair Employment and Housing Act; remedies depend on the case.","key_dates":[{"date":"2025-10-01","event":"Employment ADS regulations took effect","source":"https://calcivilrights.ca.gov/2025/06/30/civil-rights-council-secures-approval-for-regulations-to-protect-against-employment-discrimination-related-to-artificial-intelligence/"}]},{"id":"us-ca-sb947","code":"SB947","title":"Workplace automated decision systems, Labor Code §§ 1522, 1524 and 1526.7","short":"Worker protections for automated decisions","type":"statute","legal_force":"binding","status":"enacted-not-yet-applicable","official_url":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB947","penalties":"$500 per violation, with additional statutory enforcement and remedies.","key_dates":[{"date":"2027-07-01","event":"SB 947 workplace ADS prohibitions","notice and corroboration duties become operative":null,"source":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB947"}]}],"sources":[{"title":"SB 53","Transparency in Frontier Artificial Intelligence Act":null,"California Legislative Information":null,"url":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB53"},{"title":"AB 853","CATA implementation and later platform/capture-device phase-ins":null,"California Legislative Information":null,"url":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB853"},{"title":"SB 1000","amendments to California AI Transparency Act":null,"California Legislative Information":null,"url":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB1000"},{"title":"AB 2713","platform provenance amendments":null,"California Legislative Information":null,"url":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB2713"},{"title":"Civil Code § 3111","generative-AI training-data documentation":null,"California Legislative Information":null,"url":"https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=3111."},{"title":"SB 243","companion chatbot requirements":null,"California Legislative Information":null,"url":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB243"},{"title":"SB 1119","Adam's Law and amendments to SB 243":null,"California Legislative Information":null,"url":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB1119"},{"title":"Business and Professions Code § 17941","BOT Act disclosure rule":null,"California Legislative Information":null,"url":"https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC&sectionNum=17941."},{"title":"CCPA updates","cybersecurity audits and ADMT adopted text":null,"California Privacy Protection Agency":null,"url":"https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf"},{"title":"CPPA implementation timeline","California Privacy Protection Agency":null,"url":"https://cppa.ca.gov/announcements/2025/20250923.html"},{"title":"Final employment ADS regulations","California Civil Rights Department":null,"url":"https://calcivilrights.ca.gov/wp-content/uploads/sites/32/2025/06/Final-Text-regulations-automated-employment-decision-systems.pdf"},{"title":"Employment ADS regulation effective-date announcement","California Civil Rights Department":null,"url":"https://calcivilrights.ca.gov/2025/06/30/civil-rights-council-secures-approval-for-regulations-to-protect-against-employment-discrimination-related-to-artificial-intelligence/"},{"title":"SB 947","workplace automated decision systems":null,"California Legislative Information":null,"url":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB947"},{"title":"AB 1405","California AI auditor registration and related provisions":null,"California Legislative Information":null,"url":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB1405"}]},{"id":"us-co","jurisdiction":"US-CO","name":"Colorado","as_of":"2026-11-04","review":{"status":"draft-unreviewed","reviewers":[]},"card":{"title":"Colorado ADMT Act and Chatbot Safety Act","one_liner":"Colorado's successor ADMT law requires developer documentation, deployer notices and consumer recourse for consequential decisions; a separate law governs public conversational AI and minors.","who_it_hits":"Colorado developers and deployers of automated decision-making technology used in consequential decisions, plus operators of public conversational AI services, including services used by minors.","status_line":"Binding. SB 24-205's delayed duties apply during the transition through 2026-12-31; SB 26-189 and HB 26-1263's main duties apply from 2027-01-01. Proposed AG rules had a 2026-10-26 hearing; final rules were not confirmed by 2026-11-04."},"instruments":[{"id":"co-sb24-205","code":"SB24205","title":"Senate Bill 24-205, Consumer Protections for Artificial Intelligence Systems","short":"Colorado AI Act (2024)","type":"statute","legal_force":"binding","status":"in-force","official_url":"https://leg.colorado.gov/laws/session-laws/SB24-205/198/download","penalties":"Violations were deceptive trade practices enforceable by the Colorado Attorney General or district attorneys; the Colorado Consumer Protection Act generally allows up to $20,000 per violation (up to $50,000 for a violation against an elderly person).","key_dates":[{"date":"2024-05-17","event":"SB 24-205 was signed; its high-risk AI duties were initially scheduled for 2026-02-01","source":"https://leg.colorado.gov/laws/session-laws/SB24-205/198/download"},{"date":"2025-11-25","event":"SB 25B-004 took effect and delayed SB 24-205 requirements until 2026-06-30","source":"https://leg.colorado.gov/laws/session-laws/SB25B-004/3/download"},{"date":"2026-06-30","event":"The delayed SB 24-205 requirements began applying","source":"https://leg.colorado.gov/laws/session-laws/SB25B-004/3/download"},{"date":"2027-01-01","event":"SB 26-189's general effective date: Part 17 is repealed and reenacted as the successor ADMT framework","source":"https://leg.colorado.gov/laws/session-laws/SB26-189/131/download"}]},{"id":"co-sb26-189","code":"SB26189","title":"Senate Bill 26-189, Automated Decision-Making Technology in Consequential Decisions","short":"Colorado ADMT Act","type":"statute","legal_force":"binding","status":"partially-applicable","official_url":"https://leg.colorado.gov/laws/session-laws/SB26-189/131/download","penalties":"A Part 17 violation is a deceptive trade practice. The Attorney General enforces through the Colorado Consumer Protection Act; violations of §§ 6-1-1702 to 1705 are enforceable exclusively by the Attorney General. The general CCPA ceiling is $20,000 per violation ($50,000 for a violation against an elderly person), with a separate violation for each consumer or transaction. Before 2030, the Attorney General generally gives 60 days to cure if a cure is possible, but not for knowing or repeated violations; the Act creates no new private right of action and preserves existing remedies under other law.","key_dates":[{"date":"2026-05-14","event":"SB 26-189 was signed; specified rulemaking and procedural provisions took effect upon passage","source":"https://leg.colorado.gov/laws/session-laws/SB26-189/131/download"},{"date":"2026-08-11","event":"Department of Law filed proposed ADMT and chatbot rules","source":"https://coag.gov/ai/"},{"date":"2026-10-06","event":"Interim draft rules were released","source":"https://coag.gov/ai/"},{"date":"2026-10-26","event":"Formal rulemaking hearing on proposed 4 CCR 904-6 rules","source":"https://coag.gov/app/uploads/2026/08/2026.08.11-Notice-of-Hearing.docx"},{"date":"2027-01-01","event":"Main SB 26-189 duties apply to consequential decisions made on or after this date; Attorney General rules on disclosures and consumer rights are due by this date","source":"https://leg.colorado.gov/laws/session-laws/SB26-189/131/download"},{"date":"2030-01-01","event":"SB 26-189's 60-day cure provision is repealed effective this date","source":"https://leg.colorado.gov/laws/session-laws/SB26-189/131/download"}]},{"id":"co-hb26-1263","code":"HB261263","title":"House Bill 26-1263, Conversational Artificial Intelligence Service Operator Requirements","short":"Colorado Chatbot Safety Act","type":"statute","legal_force":"binding","status":"in-force","official_url":"https://leg.colorado.gov/laws/session-laws/HB26-1263/208/download","penalties":"Violations are deceptive trade practices under the Colorado Consumer Protection Act; the general CCPA civil penalty ceiling is $20,000 per violation ($50,000 for a violation against an elderly person), with a separate violation for each consumer or transaction. The statutory duties in § 6-1-1708 generally begin 2027-01-01.","key_dates":[{"date":"2026-08-12","event":"HB 26-1263 took effect as an Act","source":"https://leg.colorado.gov/laws/session-laws/HB26-1263/208/download"},{"date":"2027-01-01","event":"Main operator duties in § 6-1-1708 apply","source":"https://leg.colorado.gov/laws/session-laws/HB26-1263/208/download"},{"date":"2027-07-01","event":"First annual chatbot safety report to the Attorney General is due on or after this date","source":"https://leg.colorado.gov/laws/session-laws/HB26-1263/208/download"}]}],"sources":[{"title":"Colorado SB 24-205 session law (Chapter 198)","url":"https://leg.colorado.gov/laws/session-laws/SB24-205/198/download"},{"title":"Colorado SB 25B-004 session law (Chapter 3), delaying SB 24-205 implementation","url":"https://leg.colorado.gov/laws/session-laws/SB25B-004/3/download"},{"title":"Colorado SB 26-189 session law (Chapter 131)","url":"https://leg.colorado.gov/laws/session-laws/SB26-189/131/download"},{"title":"Colorado HB 26-1263 session law (Chapter 208)","url":"https://leg.colorado.gov/laws/session-laws/HB26-1263/208/download"},{"title":"Colorado Attorney General: ADMT and Chatbot Safety rulemaking","url":"https://coag.gov/ai/"},{"title":"Colorado SB 25-282 session law amending CCPA civil penalties","url":"https://leg.colorado.gov/laws/session-laws/SB25-282/412/download"}]},{"id":"us-il","jurisdiction":"US-IL","name":"Illinois","as_of":"2026-11-04","review":{"status":"draft-unreviewed","reviewers":[]},"card":{"title":"Illinois AI rules for employment, therapy, biometrics, and frontier models","one_liner":"Illinois regulates discriminatory AI in employment, AI video interviews, AI-assisted therapy, biometric-data handling, and frontier-model safety.","who_it_hits":"Employers, video-interview tool users, licensed mental-health professionals, private entities handling biometrics, and frontier-model developers meeting Illinois thresholds.","status_line":"Binding. IHRA, AIVIA, WORP, and BIPA duties apply; the Artificial Intelligence Safety Measures Act begins January 1, 2027, with framework and audit duties phased in during 2028."},"instruments":[{"id":"il-ihra-ai","code":"IHRA","title":"Illinois Human Rights Act §2-102(L), as amended by Public Act 103-0804 (HB 3773)","short":"IHRA AI employment provisions","type":"statute","legal_force":"binding","status":"in-force","official_url":"https://www.ilga.gov/Legislation/PublicActs/View/103-0804","penalties":"Enforced through the Illinois Human Rights Act's civil-rights charge and remedy framework.","key_dates":[{"date":"2024-08-09","event":"Public Act 103-0804 approved","source":"https://www.ilga.gov/Legislation/PublicActs/View/103-0804"},{"date":"2026-01-01","event":"AI employment provisions effective","source":"https://www.ilga.gov/Legislation/PublicActs/View/103-0804"},{"date":"2026-06-26","event":"IDHR proposed AI-employment rule amendments were officially withdrawn","source":"https://ilga.gov/documents/commission/jcar/flinn/20260626_June%2026,%202026%20-%20Issue%2026.pdf"}]},{"id":"il-aivia","code":"AIVIA","title":"Artificial Intelligence Video Interview Act, 820 ILCS 42","short":"AI Video Interview Act","type":"statute","legal_force":"binding","status":"in-force","official_url":"https://www.ilga.gov/Legislation/ILCS/Articles?ActID=4015&ChapterID=68&Print=True","penalties":"The Act provides for enforcement under its statutory provisions; no separate fixed AI-specific civil-penalty amount is encoded here.","key_dates":[{"date":"2020-01-01","event":"Core notice","explanation":null,"consent":null,"sharing":null,"and deletion duties effective":null,"source":"https://www.ilga.gov/Legislation/ILCS/Articles?ActID=4015&ChapterID=68&Print=True"},{"date":"2022-01-01","event":"Narrow demographic-reporting requirement effective","source":"https://www.ilga.gov/Legislation/ILCS/Articles?ActID=4015&ChapterID=68&Print=True"}]},{"id":"il-worp","code":"WORP","title":"Wellness and Oversight for Psychological Resources Act, 225 ILCS 155","short":"WORP Act","type":"statute","legal_force":"binding","status":"in-force","official_url":"https://www.ilga.gov/Legislation/ILCS/details?ActID=4608&ChapAct=FullText","penalties":"A violation may incur a civil penalty up to $10,000 per violation, determined after a Department hearing based on harm and circumstances; payment is due within 60 days of the order.","key_dates":[{"date":"2025-08-01","event":"Public Act 104-0054 effective","source":"https://www.ilga.gov/Legislation/PublicActs/View/104-0054"}]},{"id":"il-bipa","code":"BIPA","title":"Biometric Information Privacy Act, 740 ILCS 14, including amendments in Public Act 103-769","short":"Illinois BIPA","type":"statute","legal_force":"binding","status":"in-force","official_url":"https://www.ilga.gov/documents/legislation/ilcs/documents/074000140K15.htm","penalties":"A person aggrieved may sue for statutory damages of $1,000 for each negligent violation or $5,000 for each intentional or reckless violation, or actual damages if greater, plus fees and costs; the 2024 amendment limits repeated collection/disclosure recoveries as specified in §20.","key_dates":[{"date":"2008-10-03","event":"Original BIPA effective","source":"https://www.ilga.gov/documents/legislation/ilcs/documents/074000140K15.htm"},{"date":"2024-08-02","event":"Public Act 103-769 amendments to written release and repeated-collection recoveries effective","source":"https://www.ilga.gov/Legislation/ILCS/Details?ActID=3004"}]},{"id":"il-frontier-ai","code":"AIMSA","title":"Artificial Intelligence Safety Measures Act, Public Act 104-0538 (SB 315)","short":"Illinois Artificial Intelligence Safety Measures Act","type":"statute","legal_force":"binding","status":"enacted-not-yet-applicable","official_url":"https://www.ilga.gov/ftp/Public%20Acts/104/104-0538.htm","penalties":"Large-frontier-developer civil penalties may reach $1 million for a first violation and $3 million for a later violation; separate $1,000-per-day and unpaid-assessment penalties apply to specified disclosure failures.","key_dates":[{"date":"2026-07-06","event":"Public Act 104-0538 approved","source":"https://witnessslips.ilga.gov/ftp/legislation/104/BillStatus/HTML/10400SB0315.html"},{"date":"2027-01-01","event":"Act effective; frontier transparency","critical-incident reporting":null,"registration":null,"internal-use reporting":null,"and whistleblower provisions begin":null,"source":"https://www.ilga.gov/ftp/Public%20Acts/104/104-0538.htm"},{"date":"2028-01-01","event":"Large-frontier-developer framework and annual independent-audit phase-in begins","source":"https://www.ilga.gov/ftp/Public%20Acts/104/104-0538.htm"}]}],"sources":[{"title":"Illinois Public Act 103-0804 (HB 3773), IHRA AI employment amendment","url":"https://www.ilga.gov/Legislation/PublicActs/View/103-0804"},{"title":"Illinois Artificial Intelligence Video Interview Act, 820 ILCS 42","url":"https://www.ilga.gov/Legislation/ILCS/Articles?ActID=4015&ChapterID=68&Print=True"},{"title":"Illinois Public Act 104-0054 (WORP Act)","url":"https://www.ilga.gov/Legislation/PublicActs/View/104-0054"},{"title":"Illinois BIPA §15 and compiled statute notes","url":"https://www.ilga.gov/documents/legislation/ilcs/documents/074000140K15.htm"},{"title":"Illinois Public Act 104-0538, Artificial Intelligence Safety Measures Act","url":"https://www.ilga.gov/ftp/Public%20Acts/104/104-0538.htm"},{"title":"JCAR Flinn Report recording withdrawal of IDHR proposed AI-employment rules","url":"https://ilga.gov/documents/commission/jcar/flinn/20260626_June%2026,%202026%20-%20Issue%2026.pdf"}]},{"id":"us-ny-nyc","jurisdiction":"US-NY-NYC","name":"New York City","as_of":"2026-11-04","review":{"status":"draft-unreviewed","reviewers":[]},"card":{"title":"NYC Automated Employment Decision Tools (Local Law 144)","one_liner":"Employers and employment agencies must independently audit covered hiring and promotion tools, publish audit information, and notify affected people before use.","who_it_hits":"Employers and employment agencies using an automated employment decision tool to substantially assist or replace discretion in hiring or promotion for NYC positions.","status_line":"Binding and applicable. The law took effect January 1, 2023; DCWP enforcement began July 5, 2023. No substantive 2025-2026 amendment to Local Law 144 or its adopted AEDT rule was identified."},"instruments":[{"id":"nyc-ll144","code":"LL144","title":"New York City Local Law 144 of 2021, Administrative Code §§20-870 to 20-872, implemented by 6 RCNY Chapter 5","short":"NYC AEDT Law","type":"statute","legal_force":"binding","status":"in-force","official_url":"https://legistar.council.nyc.gov/LegislationDetail.aspx?GUID=B051915D-A9AC-451E-81F8-6596032FA3F9&ID=4344524","penalties":"$500 for a first violation and $500 to $1,500 for each subsequent violation; each day of use may be a separate violation.","key_dates":[{"date":"2021-12-11","event":"Local Law 144 enacted","source":"https://legistar.council.nyc.gov/LegislationDetail.aspx?GUID=B051915D-A9AC-451E-81F8-6596032FA3F9&ID=4344524"},{"date":"2023-01-01","event":"Local Law 144 took effect","source":"https://legistar.council.nyc.gov/LegislationDetail.aspx?GUID=B051915D-A9AC-451E-81F8-6596032FA3F9&ID=4344524"},{"date":"2023-07-05","event":"DCWP's adopted AEDT rule became effective and enforcement began","source":"https://rules.cityofnewyork.us/rule/automated-employment-decision-tools-updated/"}]}],"sources":[{"title":"NYC Council record and enacted Local Law 144 of 2021","url":"https://legistar.council.nyc.gov/LegislationDetail.aspx?GUID=B051915D-A9AC-451E-81F8-6596032FA3F9&ID=4344524"},{"title":"NYC DCWP AEDT Frequently Asked Questions","url":"https://home4.nyc.gov/site/dca/businesses/faq-automated-employment-decision-tools.page"},{"title":"DCWP adopted AEDT rule record","url":"https://rules.cityofnewyork.us/rule/automated-employment-decision-tools-updated/"},{"title":"DCWP AEDT overview and enforcement date","url":"https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page"},{"title":"DCWP New Laws & Rules page, checked for 2025-2026 AEDT amendments","url":"https://www.nyc.gov/site/dca/about/new-laws-rules.page"}]},{"id":"us-ny","jurisdiction":"US-NY","name":"New York State","as_of":"2026-11-04","review":{"status":"draft-unreviewed","reviewers":[]},"card":{"title":"New York AI and algorithmic decision rules","one_liner":"New York combines frontier-model safety and incident-reporting duties, AI-companion safeguards, a narrow personalized-pricing disclosure, and public-sector AI transparency and workforce protections.","who_it_hits":"Operators of qualifying AI companions, entities setting personalized algorithmic prices, state agencies using AI or employment tools, covered public employers, and frontier-model developers operating in New York.","status_line":"Binding. Article 47 and the pricing disclosure are applicable; the amended RAISE Act and Article 48 are scheduled for 2027, with LOADinG inventory disclosures due December 30, 2026."},"instruments":[{"id":"ny-raise","code":"RAISE","title":"Responsible AI Safety and Education Act, Chapter 699 of the Laws of 2025, as replaced and amended by Chapter 96 of the Laws of 2026","short":"RAISE Act","type":"statute","legal_force":"binding","status":"enacted-not-yet-applicable","official_url":"https://www.nysenate.gov/legislation/bills/2025/S8828","penalties":"Attorney General civil penalties up to $1 million for a first violation and $3 million for a later violation; separate daily penalties may apply to large-frontier-developer filing failures under GBL §1428. No private right of action.","key_dates":[{"date":"2025-12-19","event":"Original RAISE Act enacted as Chapter 699; its original start clause was later amended","source":"https://www.nysenate.gov/legislation/bills/2025/S6953"},{"2027":null,"date":"2026-03-27","event":"Chapter 96 replaces Article 44-B and moves the start date to January 1","source":"https://legislation.nysenate.gov/pdf/bills/2025/S8828"},{"date":"2027-01-01","event":"Amended Article 44-B duties begin","source":"https://legislation.nysenate.gov/pdf/bills/2025/S8828"},{"date":"2028-01-01","event":"First annual public frontier-safety report by the Office is due; this is an agency duty","not a developer audit phase-in":null,"source":"https://legislation.nysenate.gov/pdf/bills/2025/S8828"}]},{"id":"ny-companion","code":"GBL47","title":"General Business Law Article 47, Artificial Intelligence Companion Models (Part U of Chapter 58 of the Laws of 2025)","short":"AI Companion Models Law","type":"statute","legal_force":"binding","status":"in-force","official_url":"https://www.nysenate.gov/legislation/laws/GBS/A47","penalties":"The Attorney General may seek civil penalties up to $15,000 per day for a violation, in addition to injunctive relief.","key_dates":[{"date":"2025-05-09","event":"Chapter 58 signed; Article 47 added","source":"https://www2.nyassembly.gov/2025budget/bills2025/executive/A3008.pdf"},{"date":"2025-11-05","event":"Article 47 effective","source":"https://www.governor.ny.gov/news/governor-hochul-pens-letter-ai-companion-companies-notifying-them-safeguard-requirements-are"}]},{"id":"ny-pricing","code":"GBL349A","title":"General Business Law §349-a, Pricing (Part X of Chapter 58 of the Laws of 2025)","short":"Algorithmic Pricing Disclosure Act","type":"statute","legal_force":"binding","status":"in-force","official_url":"https://www.nysenate.gov/legislation/laws/GBS/349-A","penalties":"Up to $1,000 per violation under the statute.","key_dates":[{"date":"2025-05-09","event":"Chapter 58 signed","source":"https://www.nysenate.gov/legislation/laws/GBS/349-A"},{"date":"2025-07-08","event":"Statutory effective date","source":"https://www.nysenate.gov/legislation/laws/GBS/349-A"},{"date":"2025-11-10","event":"Attorney General announced enforcement would begin after the litigation-related pause","source":"https://ag.ny.gov/press-release/2025/attorney-general-james-warns-new-yorkers-about-algorithmic-pricing-new-law-takes"}]},{"id":"ny-loading","code":"LOAD","title":"State Technology Law and Civil Service Law provisions amended by Chapter 96 of the Laws of 2025 and Chapter 86 of the Laws of 2026 (LOADinG Act)","short":"LOADinG Act","type":"statute","legal_force":"binding","status":"in-force","official_url":"https://www.nysenate.gov/legislation/bills/2025/S8831","penalties":"No AI-specific civil penalty identified for the inventory, employment-tool-list, or workforce provisions encoded here.","key_dates":[{"date":"2025-07-01","event":"State AI inventory and state-agency AEDT disclosure provisions take effect","source":"https://www.nysenate.gov/legislation/bills/2025/S822"},{"date":"2026-02-13","event":"Chapter 86 narrows the framework","expands public-sector employment protections":null,"and adds covered-entity AEDT disclosure":null,"source":"https://www.nysenate.gov/legislation/bills/2025/S8831"},{"date":"2026-10-31","event":"State agencies' information for the December 30","2026 AI inventory is due at least 60 days before publication":null,"source":"https://www.nysenate.gov/legislation/laws/STT/103-E"},{"date":"2026-12-30","event":"Annual State AI inventory and state-agency AEDT list publication date","source":"https://www.nysenate.gov/legislation/laws/STT/103-E"},{"date":"2027-12-30","event":"First annual AEDT disclosure deadline for covered entities added by Chapter 86","source":"https://www.nysenate.gov/legislation/laws/STT/402-A"},{"date":"2028-07-01","event":"Chapter 86 framework expires and is deemed repealed","source":"https://www.nysenate.gov/legislation/bills/2025/S8831"}]},{"id":"ny-companion-minors","code":"GBL48","title":"General Business Law Article 48, Prohibition on Unsafe AI Companion Features for Minors (Chapter 368 of the Laws of 2026)","short":"Unsafe AI Companion Features for Minors","type":"statute","legal_force":"binding","status":"enacted-not-yet-applicable","official_url":"https://www.nysenate.gov/legislation/laws/GBS/A48","penalties":"The Attorney General may seek civil penalties up to $25,000 per violation, along with other specified relief.","key_dates":[{"date":"2026-10-28","event":"Signed as Chapter 368 of the Laws of 2026","source":"https://www.nysenate.gov/legislation/bills/2025/S9051/amendment/B"},{"date":"2027-01-01","event":"Effective date stated in the final Assembly bill text and current Senate codification","source":"https://nyassembly.gov/leg/?bn=A10379&Actions=Y&Memo=Y&Text=Y&leg_video=1"}]}],"sources":[{"title":"S8828, Chapter 96 of the Laws of 2026, replacing RAISE Act Article 44-B","url":"https://legislation.nysenate.gov/pdf/bills/2025/S8828"},{"title":"New York General Business Law Article 47","url":"https://www.nysenate.gov/legislation/laws/GBS/A47"},{"title":"New York General Business Law §349-a","url":"https://www.nysenate.gov/legislation/laws/GBS/349-A"},{"title":"New York Attorney General pricing-law enforcement announcement","url":"https://ag.ny.gov/press-release/2025/attorney-general-james-warns-new-yorkers-about-algorithmic-pricing-new-law-takes"},{"title":"State Technology Law §103-e","url":"https://www.nysenate.gov/legislation/laws/STT/103-E"},{"title":"State Technology Law §402","url":"https://www.nysenate.gov/legislation/laws/STT/402"},{"title":"State Technology Law §402-a","url":"https://www.nysenate.gov/legislation/laws/STT/402-A"},{"title":"Civil Service Law §80(10)","url":"https://www.nysenate.gov/legislation/laws/CVS/80"},{"title":"S8831 / Chapter 86 of the Laws of 2026","url":"https://www.nysenate.gov/legislation/bills/2025/S8831"},{"title":"Chapter 368 bill text, S9051-B","url":"https://www.nysenate.gov/legislation/bills/2025/S9051/amendment/B"},{"title":"Final A10379-C text and action history","url":"https://nyassembly.gov/leg/?bn=A10379&Actions=Y&Memo=Y&Text=Y&leg_video=1"},{"title":"Senator sponsor release reporting a June 1, 2027 date for the signed Chapter 368","url":"https://www.nysenate.gov/newsroom/press-releases/2026/kristen-gonzalez/senator-kristen-gonzalez-bans-unsafe-chatbot-feature"},{"title":"Governor's Article 47 effective-date announcement","url":"https://www.governor.ny.gov/news/governor-hochul-pens-letter-ai-companion-companies-notifying-them-safeguard-requirements-are"}]},{"id":"us-tx","jurisdiction":"US-TX","name":"Texas","as_of":"2026-11-04","review":{"status":"draft-unreviewed","reviewers":[]},"card":{"title":"Texas Responsible Artificial Intelligence Governance Act","one_liner":"TRAIGA bans specified intent-based AI conduct and requires AI disclosure only in specified government and health-care interactions, with Attorney General enforcement and an optional regulatory sandbox.","who_it_hits":"People doing business in Texas, supplying products or services to Texas residents, or developing or deploying AI in Texas; special duties apply to governmental entities, health-care providers, and approved sandbox participants.","status_line":"Binding and applicable since 2026-01-01. The Attorney General has exclusive enforcement authority (subject to limited state-agency sanctions), with a 60-day notice-and-cure step before suit; no private right of action. Uncurable violations carry up to $200,000. The Texas AI Council makes recommendations and provides training but cannot issue binding rules or guidance."},"instruments":[{"id":"us-tx-traiga","code":"TRAIGA","title":"Texas Responsible Artificial Intelligence Governance Act (HB 149), Business & Commerce Code Subtitle D","short":"Texas TRAIGA","type":"statute","legal_force":"binding","status":"in-force","official_url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.HTM","penalties":"The Attorney General may sue after the 60-day notice-and-cure period. Civil penalties are $10,000-$12,000 per curable violation (or breach of a cure statement), $80,000-$200,000 per uncurable violation, and $2,000-$40,000 per day for a continuing violation, plus injunctive relief, fees, and costs. After an AG finding and recommendation, a licensing state agency may impose license sanctions and a penalty up to $100,000. No private right of action; no civil-penalty action against a system that has not been deployed.","key_dates":[{"date":"2026-01-01","event":"TRAIGA and Business & Commerce Code Chapters 551-554 take effect","source":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.HTM"},{"date":"2026-09-01","event":"Statutory deadline for the Attorney General to publish the consumer complaint mechanism","source":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.HTM"}]}],"sources":[{"title":"Texas HB 149 enrolled act (TRAIGA)","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.HTM"},{"title":"Texas Business & Commerce Code Chapter 551: scope and definitions","url":"https://statutes.capitol.texas.gov/Docs/BC/htm/BC.551.htm"},{"title":"Texas Business & Commerce Code Chapter 552: duties, prohibitions, enforcement, and penalties","url":"https://statutes.capitol.texas.gov/Docs/BC/htm/BC.552.htm"},{"title":"Texas Business & Commerce Code Chapter 553: AI regulatory sandbox","url":"https://statutes.capitol.texas.gov/Docs/BC/htm/BC.553.htm"},{"title":"Texas Business & Commerce Code Chapter 554: Texas Artificial Intelligence Council","url":"https://statutes.capitol.texas.gov/Docs/BC/htm/BC.554.htm"},{"title":"Texas Business & Commerce Code § 503.001: Capture or Use of Biometric Identifier","url":"https://statutes.capitol.texas.gov/Docs/BC/htm/BC.503.htm"}]},{"id":"us","jurisdiction":"US","name":"United States (federal)","as_of":"2026-11-04","review":{"status":"draft-unreviewed","reviewers":[]},"card":{"title":"U.S. Federal AI Governance","one_liner":"Federal AI governance is a mix of agency-use and procurement directives, targeted statutes, and generally applicable consumer-protection law; it is not a comprehensive private-sector AI code.","who_it_hits":"Federal agencies and their AI suppliers, DoD and intelligence-community contractors, covered online platforms, and businesses making AI-related claims to consumers.","status_line":"EO 14148 revoked the 2023 EO 14110 and EO 14179 reset federal policy. No comprehensive AI statute or blanket AI-specific state-law preemption was enacted by 4 November 2026; EO 14365 directs litigation and policy work but does not itself preempt state laws. The chatbot/minors and AI-labeling bills checked remain proposals; NIST AI RMF is voluntary and under revision."},"instruments":[{"id":"us-omb-m2521","code":"M2521","title":"OMB Memorandum M-25-21, Accelerating Federal Use of AI through Innovation, Governance, and Public Trust","short":"OMB M-25-21","type":"guidance","legal_force":"framework-no-penalties","status":"in-force","official_url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf","penalties":null,"key_dates":[{"date":"2025-04-03","event":"OMB issued M-25-21; applies to covered agency AI use, subject to stated exceptions","source":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf"},{"date":"2025-06-02","event":"60-day deadline for agency heads to retain or designate a Chief AI Officer","source":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf"},{"date":"2026-04-03","event":"365-day deadline to document implementation of minimum risk practices for high-impact AI","source":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf"}]},{"id":"us-omb-m2522","code":"M2522","title":"OMB Memorandum M-25-22, Driving Efficient Acquisition of Artificial Intelligence in Government","short":"OMB M-25-22","type":"guidance","legal_force":"framework-no-penalties","status":"in-force","official_url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf","penalties":null,"key_dates":[{"date":"2025-04-03","event":"OMB issued M-25-22","source":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf"},{"date":"2025-09-30","event":"180-day phase-in begins for covered solicitations and later contract options","source":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf"}]},{"id":"us-eo14319","code":"EO14319","title":"Executive Order 14319, Preventing Woke AI in the Federal Government","short":"EO 14319","type":"executive-order","legal_force":"framework-no-penalties","status":"in-force","official_url":"https://www.whitehouse.gov/presidential-actions/2025/07/preventing-woke-ai-in-the-federal-government/","penalties":null,"key_dates":[{"date":"2025-07-23","event":"Executive order signed; directs agencies to procure LLMs developed in accordance with its Unbiased AI Principles","source":"https://www.whitehouse.gov/presidential-actions/2025/07/preventing-woke-ai-in-the-federal-government/"}]},{"id":"us-omb-m2604","code":"M2604","title":"OMB Memorandum M-26-04, Increasing Public Trust in Artificial Intelligence Through Unbiased AI Principles","short":"OMB M-26-04","type":"guidance","legal_force":"framework-no-penalties","status":"in-force","official_url":"https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles.pdf","penalties":null,"key_dates":[{"date":"2025-12-11","event":"OMB issued M-26-04; procurement terms apply to solicitations or orders issued after this date","source":"https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles.pdf"},{"date":"2026-03-11","event":"Deadline for agencies to update procurement policies and user-feedback processes","source":"https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles.pdf"},{"date":"2027-12-11","event":"M-26-04 sunsets unless OMB extends it","source":"https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles.pdf"}]},{"id":"us-eo14434","code":"EO14434","title":"Executive Order 14434, Inaugurating the Era of Super Intelligence","short":"EO 14434","type":"executive-order","legal_force":"framework-no-penalties","status":"in-force","official_url":"https://www.whitehouse.gov/presidential-actions/2026/09/inaugurating-the-era-of-super-intelligence/","penalties":null,"key_dates":[{"date":"2026-09-29","event":"Executive order signed; directs terminology changes in non-statutory executive-branch communications and documents","source":"https://www.whitehouse.gov/presidential-actions/2026/09/inaugurating-the-era-of-super-intelligence/"}]},{"id":"us-tida","code":"TIDA","title":"TAKE IT DOWN Act, Public Law 119-12","short":"TAKE IT DOWN Act","type":"statute","legal_force":"binding","status":"in-force","official_url":"https://www.congress.gov/119/plaws/publ12/PLAW-119publ12.htm","penalties":"Criminal penalties apply to the specified publication offenses; a covered platform's failure to reasonably comply with section 3 is enforceable by the FTC under the FTC Act.","key_dates":[{"date":"2025-05-19","event":"Act signed; section 2 criminal prohibitions took effect","source":"https://www.congress.gov/119/plaws/publ12/PLAW-119publ12.htm"},{"date":"2026-05-19","event":"Deadline for covered platforms to establish the section 3 notice-and-removal process","source":"https://www.congress.gov/119/plaws/publ12/PLAW-119publ12.htm"}]},{"id":"us-ftc-act","code":"FTCA","title":"Federal Trade Commission Act, section 5 (15 U.S.C. § 45)","short":"FTC Act section 5","type":"statute","legal_force":"binding","status":"in-force","official_url":"https://uscode.house.gov/us/usc/119-136/t15/s45/","penalties":"Remedies depend on the enforcement route and applicable law; section 5 does not create a single AI-specific penalty.","key_dates":[{"date":"1914-09-26","event":"FTC Act enacted; section 5's generally applicable prohibition on unfair or deceptive acts in commerce also applies to AI-related conduct","source":"https://uscode.house.gov/us/usc/119-136/t15/s45/"}]},{"id":"us-ndaa26","code":"NDAA11960","title":"National Defense Authorization Act for Fiscal Year 2026, Public Law 119-60","short":"FY2026 NDAA","type":"statute","legal_force":"binding","status":"in-force","official_url":"https://www.govinfo.gov/content/pkg/PLAW-119publ60/html/PLAW-119publ60.htm","penalties":null,"key_dates":[{"date":"2025-12-18","event":"FY2026 NDAA enacted","source":"https://www.govinfo.gov/content/pkg/PLAW-119publ60/html/PLAW-119publ60.htm"},{"date":"2026-01-17","event":"30-day deadline for DoD's DeepSeek-related removal requirements and DoD-contractor prohibition under section 1532","source":"https://www.govinfo.gov/content/pkg/PLAW-119publ60/html/PLAW-119publ60.htm"},{"date":"2026-02-16","event":"60-day deadline for DNI to issue initial standards and guidelines under section 6604","source":"https://www.govinfo.gov/content/pkg/PLAW-119publ60/html/PLAW-119publ60.htm"},{"date":"2026-06-01","event":"Deadline to establish the DoD cross-functional AI model assessment and oversight team under section 1533","source":"https://www.govinfo.gov/content/pkg/PLAW-119publ60/html/PLAW-119publ60.htm"},{"date":"2026-06-16","event":"180-day deadline for the DoD policies and framework-related congressional updates in sections 1512 and 1513","source":"https://www.govinfo.gov/content/pkg/PLAW-119publ60/html/PLAW-119publ60.htm"},{"date":"2027-01-01","event":"Deadline to designate DoD AI application functional leads under section 1533","source":"https://www.govinfo.gov/content/pkg/PLAW-119publ60/html/PLAW-119publ60.htm"},{"date":"2027-06-01","event":"Deadline to complete DoD's AI assessment framework and governance structure under section 1533","source":"https://www.govinfo.gov/content/pkg/PLAW-119publ60/html/PLAW-119publ60.htm"},{"date":"2028-01-01","event":"Deadline to complete assessments of major DoD AI systems under section 1533","source":"https://www.govinfo.gov/content/pkg/PLAW-119publ60/html/PLAW-119publ60.htm"}]}],"sources":[{"title":"EO 14148, Initial Rescissions of Harmful Executive Orders and Actions","url":"https://www.whitehouse.gov/presidential-actions/2025/01/initial-rescissions-of-harmful-executive-orders-and-actions/"},{"title":"EO 14179, Removing Barriers to American Leadership in Artificial Intelligence","url":"https://www.whitehouse.gov/presidential-actions/2025/01/removing-barriers-to-american-leadership-in-artificial-intelligence/"},{"title":"EO 14365, Ensuring a National Policy Framework for Artificial Intelligence","url":"https://www.whitehouse.gov/presidential-actions/2025/12/eliminating-state-law-obstruction-of-national-artificial-intelligence-policy/"},{"title":"NIST AI RMF FAQ (states the framework is voluntary)","url":"https://www.nist.gov/itl/ai-risk-management-framework/ai-risk-management-framework-faqs"},{"title":"NIST AI Resource Center (AI RMF 1.0 is being revised)","url":"https://airc.nist.gov/"},{"title":"FTC Operation AI Comply / deceptive AI claims enforcement example","url":"https://search.ftc.gov/news-events/news/press-releases/2024/09/ftc-announces-crackdown-deceptive-ai-claims-schemes"},{"title":"FTC proposed AI-accuracy policy statement (not a final rule)","url":"https://search.ftc.gov/policy/public-comments/policy-statement-concerning-suppression-accuracy-artificial-intelligence-systems"},{"title":"FTC business guidance on the TAKE IT DOWN Act","url":"https://search.ftc.gov/business-guidance/resources/complying-take-it-down-act"},{"title":"Congress.gov list of enacted 119th Congress public laws","url":"https://www.congress.gov/public-laws/119th-congress"},{"title":"S. 4199, Youth AI Privacy Act (proposed; not enacted)","url":"https://www.congress.gov/bill/119th-congress/senate-bill/4199"},{"title":"S. 3062, GUARD Act (proposed; not enacted)","url":"https://www.congress.gov/bill/119th-congress/senate-bill/3062"},{"title":"S. 4915, AI Labeling Act of 2026 (proposed; not enacted)","url":"https://www.congress.gov/bill/119th-congress/senate-bill/4915"},{"title":"H.R. 10146, AI Advertising Disclosure Act (proposed; not enacted)","url":"https://www.congress.gov/bill/119th-congress/house-bill/10146"},{"title":"Federal Register notice of DHS DeepSeek order (omitted from obligations because the signed order and its effective date were not available for exact verification)","url":"https://www.federalregister.gov/documents/2026/10/20/2026-21447/notice-of-order-regarding-exclusion-and-removal-of-deepseek-products-from-federal-civilian-executive"}]},{"id":"vn","jurisdiction":"VN","name":"Vietnam","as_of":"2026-11-04","review":{"status":"draft-unreviewed","reviewers":[]},"card":{"title":"Vietnam AI Law","one_liner":"Vietnam's AI law assigns duties by risk tier, with high-risk controls and conformity checks, AI-content transparency, and incident reporting.","who_it_hits":"Vietnamese and foreign developers, providers, deployers and users participating in AI activities in Vietnam; public bodies and personal-data processors have additional duties.","status_line":"Binding and in force. Existing systems have staged transition deadlines of 1 March 2027 for most sectors and 1 September 2027 for healthcare, education and finance."},"instruments":[{"id":"vn-ai-law","code":"AILAW","title":"Law No. 134/2025/QH15 on Artificial Intelligence","short":"Vietnam AI Law","type":"statute","legal_force":"binding","status":"partially-applicable","official_url":"https://datafiles.chinhphu.vn/cpp/files/vbpq/2026/01/luat134.signed.pdf","penalties":"Article 29 refers violations to administrative sanctions or criminal prosecution and provides for civil compensation; this Law does not state a numerical fine cap here.","key_dates":[{"date":"2025-12-10","event":"Adopted by the National Assembly","source":"https://en.baochinhphu.vn/viet-nams-law-on-artificial-intelligence-111260715113551787.htm"},{"date":"2026-03-01","event":"Law enters into force","source":"https://en.baochinhphu.vn/viet-nams-law-on-artificial-intelligence-111260715113551787.htm"},{"date":"2027-03-01","event":"End of the 12-month transition for pre-existing systems outside healthcare, education and finance; most other listed legacy systems must also complete compliance by this date","source":"https://en.baochinhphu.vn/viet-nams-law-on-artificial-intelligence-111260715113551787.htm"},{"date":"2027-09-01","event":"End of the 18-month transition for pre-existing healthcare, education and finance AI systems","source":"https://en.baochinhphu.vn/viet-nams-law-on-artificial-intelligence-111260715113551787.htm"}],"notes":"Article 33 repeals Chapter IV and specified AI-related provisions of the Law on Digital Technology Industry No. 71/2025/QH15. That Law's separate AI chapter is therefore not treated as a current source of AI obligations; the remainder of the 2025 statute is not stated to be repealed. The Government's English translation is marked \"For reference only\"; the signed Vietnamese law is the controlling text."},{"id":"vn-ai-decree-142","code":"D142","title":"Decree No. 142/2026/ND-CP detailing provisions and implementation measures for the Law on Artificial Intelligence","short":"AI Law Implementing Decree","type":"regulation","legal_force":"binding","status":"in-force","official_url":"https://datafiles.chinhphu.vn/cpp/files/vbpq/2026/4/142-2026-ndcp.signed.pdf","penalties":null,"key_dates":[{"date":"2026-04-30","event":"Decree issued","source":"https://vanban.chinhphu.vn/?pageid=27160&docid=218029"},{"date":"2026-05-01","event":"Decree enters into force","source":"https://vanban.chinhphu.vn/?pageid=27160&docid=218029"}],"notes":"If the National Single-Window AI Portal has not been officially announced as operational, Article 46 allows notifications and reports through an electronic information system, online public service or other channel announced by the Ministry of Science and Technology; that filing has equivalent legal effect."},{"id":"vn-high-risk-list-33","code":"QD33","title":"Decision No. 33/2026/QD-TTg promulgating the List of High-Risk AI Systems","short":"High-Risk AI List","type":"regulation","legal_force":"binding","status":"in-force","official_url":"https://congbaocdn.chinhphu.vn/180507251028987904/2026/7/14/469951-1784024086_v1_1784024564_signed.pdf","penalties":null,"key_dates":[{"date":"2026-06-30","event":"Decision issued","source":"https://congbaocdn.chinhphu.vn/180507251028987904/2026/7/14/469951-1784024086_v1_1784024564_signed.pdf"},{"date":"2026-08-15","event":"High-risk list and criteria take effect","source":"https://congbaocdn.chinhphu.vn/180507251028987904/2026/7/14/469951-1784024086_v1_1784024564_signed.pdf"},{"date":"2027-03-01","event":"Listed legacy systems outside healthcare, education and finance must complete compliance; also applies to systems entering operation during the first six months after the Decision takes effect","source":"https://congbaocdn.chinhphu.vn/180507251028987904/2026/7/14/469951-1784024086_v1_1784024564_signed.pdf"},{"date":"2027-09-01","event":"Listed legacy systems in healthcare, education and finance must complete compliance","source":"https://congbaocdn.chinhphu.vn/180507251028987904/2026/7/14/469951-1784024086_v1_1784024564_signed.pdf"}],"notes":"The list covers specified systems in education, ethnic and religious administration, healthcare, banking, judicial proceedings and transport; classification turns on the listed system and conditions, not merely the sector label. Article 4 permits continued operation during transition unless authorities identify a risk of serious harm and require suspension or termination."},{"id":"vn-personal-data-law","code":"PDPL","title":"Law No. 91/2025/QH15 on Personal Data Protection","short":"Personal Data Protection Law","type":"statute","legal_force":"binding","status":"in-force","official_url":"https://congbao.chinhphu.vn/van-ban/luat-so-91-2025-qh15-45578.htm","penalties":null,"key_dates":[{"date":"2026-01-01","event":"Personal Data Protection Law enters into force","source":"https://congbao.chinhphu.vn/van-ban/luat-so-91-2025-qh15-45578.htm"}],"notes":"Article 30 expressly addresses personal data processing in AI and other digital environments. The limited five-year choice for certain small and startup enterprises in Article 38(2) concerns specified provisions, not the Article 30 AI safeguards."}],"sources":[{"title":"Law No. 134/2025/QH15 on Artificial Intelligence — official English translation","url":"https://en.baochinhphu.vn/viet-nams-law-on-artificial-intelligence-111260715113551787.htm"},{"title":"Law No. 134/2025/QH15 — official signed text and metadata","url":"https://vanban.chinhphu.vn/?docid=216334&pageid=27160"},{"title":"Decree No. 142/2026/ND-CP — official signed text and metadata","url":"https://vanban.chinhphu.vn/?pageid=27160&docid=218029"},{"title":"Decision No. 33/2026/QD-TTg — official signed text","url":"https://congbaocdn.chinhphu.vn/180507251028987904/2026/7/14/469951-1784024086_v1_1784024564_signed.pdf"},{"title":"Law No. 91/2025/QH15 on Personal Data Protection — official gazette record","url":"https://congbao.chinhphu.vn/van-ban/luat-so-91-2025-qh15-45578.htm"},{"title":"Law No. 71/2025/QH15 on Digital Technology Industry — official gazette record","url":"https://congbao.chinhphu.vn/van-ban/luat-so-71-2025-qh15-45555.htm"}]}],"obligations":[{"id":"AGC-CH-FADP-6-7","instrument":"ch-fadp","article":"Art. 6(1)–(5) and Art. 7","title":"Process personal data transparently and build privacy in by design","plain":"Personal data must be processed lawfully, in good faith and proportionately; the purpose must be recognisable to the data subject and further processing must remain compatible with that purpose. Controllers must design processing to respect these principles from the planning stage and use suitable default settings to limit data to what is necessary.","applies_to":{"roles":["any"],"uses":["any-ai"],"conditions":"Applies when AI processing concerns personal data of natural persons and the organisation is a private person or federal body within the FADP's scope."},"applies_from":"2023-09-01","status":"applicable","controls":["privacy_compliance","transparency_notice","user_controls"],"evidence":["Purpose and lawful-basis records for AI-related personal-data processing","Privacy-by-design review and data-minimising default settings"],"source_url":"https://www.fedlex.admin.ch/eli/cc/2022/491/en","confidence":"high","regime":"ch","jurisdiction":"CH","instrument_short":"Revised FADP","cite":"Revised FADP Art. 6(1)–(5) and Art. 7","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-CH-FADP-12","instrument":"ch-fadp","article":"Art. 12(1)–(5); DPO Art. 24","title":"Keep a record of processing activities","plain":"Controllers and processors must keep records describing their processing activities, including purpose, data and data-subject categories, recipients, retention, security measures and relevant foreign disclosures. Natural persons and private organisations with fewer than 250 employees are generally exempt unless they process a large volume of sensitive personal data or carry out high-risk profiling; federal bodies must notify the FDPIC of their records.","applies_to":{"roles":["any"],"uses":["any-ai"],"conditions":"Record only processing of personal data; the small-organisation exception and its sensitive-data/high-risk-profiling limits are in DPO Art. 24."},"applies_from":"2023-09-01","status":"applicable","controls":["audit_log","privacy_compliance"],"evidence":["Current processing inventory covering AI uses, data categories, purposes, recipients and transfers","Documented exemption analysis, if relying on the DPO Art. 24 exception"],"source_url":"https://www.fedlex.admin.ch/eli/cc/2022/491/en","confidence":"high","regime":"ch","jurisdiction":"CH","instrument_short":"Revised FADP","cite":"Revised FADP Art. 12(1)–(5); DPO Art. 24","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-CH-FADP-19-6","instrument":"ch-fadp","article":"Art. 6(3), 19(1)–(2); FDPIC, AI and data protection, Transparent information","title":"Tell people how AI processes their personal data","plain":"Controllers must make the purpose of personal-data processing recognisable and inform data subjects appropriately when collecting personal data, including the controller's identity, processing purpose and, where applicable, recipients. The FDPIC says that AI providers and users should make purpose, functionality and data sources transparent; users of directly interactive language models should know they are communicating with a machine and how their prompts may be used.","applies_to":{"roles":["provider","deployer","any"],"uses":["any-ai","chatbot","agent"],"conditions":"Only where personal data is processed within the FADP's scope; the FDPIC's AI-specific disclosure statement is its application of general FADP transparency duties, not a separate AI Act."},"applies_from":"2023-09-01","status":"applicable","controls":["ai_disclosure","transparency_notice","privacy_compliance"],"evidence":["Notice describing the AI processing purpose, data sources, and prompt retention or reuse","User-facing disclosure when an interactive language model is a machine"],"source_url":"https://www.fedlex.admin.ch/eli/cc/2022/491/en","confidence":"medium","notes":"FDPIC's 2025 statement also says use of programs that manipulate identifiable persons' faces, images or voice messages must be clearly indicated. This is the regulator's interpretation of existing data-protection duties, not a standalone statutory deepfake-labelling article. See https://www.edoeb.admin.ch/en/ai-and-data-protection.","regime":"ch","jurisdiction":"CH","instrument_short":"Revised FADP","cite":"Revised FADP Art. 6(3), 19(1)–(2); FDPIC, AI and data protection, Transparent information","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-CH-FADP-21","instrument":"ch-fadp","article":"Art. 21(1)–(4)","title":"Notify people about consequential decisions made solely by automation and offer human review","plain":"If a decision is based exclusively on automated processing and has legal consequences or a considerable adverse effect, the controller must inform the data subject. On request, the person may express their view and request review by a natural person; federal bodies must designate such decisions. The Act has exceptions, including where an eligible contract-related request is granted or the person explicitly consented to automation.","applies_to":{"roles":["deployer","public-body","any"],"uses":["significant-decision","profiling","credit","hiring","education","healthcare","essential-services"],"conditions":"Only automated individual decisions with legal consequences or considerable adverse effects; the Art. 21(3) exceptions and federal-body hearing qualification apply."},"applies_from":"2023-09-01","status":"applicable","controls":["transparency_notice","human_oversight","contest_and_appeal"],"evidence":["Decision notices identifying exclusively automated consequential decisions","Procedure and records for a person's request to express a view or obtain human review"],"source_url":"https://www.fedlex.admin.ch/eli/cc/2022/491/en","confidence":"high","regime":"ch","jurisdiction":"CH","instrument_short":"Revised FADP","cite":"Revised FADP Art. 21(1)–(4)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-CH-FADP-22","instrument":"ch-fadp","article":"Art. 22(1)–(5) and Art. 23","title":"Assess high-risk personal-data processing before deployment","plain":"Before processing likely to create a high risk to a person's personality or fundamental rights, the controller must complete a data protection impact assessment describing the processing, risks and protective measures. High risk depends on the nature, extent, circumstances and purpose, including large-scale sensitive-data processing or large-scale systematic monitoring of public areas; residual high risk generally requires prior consultation with the FDPIC, subject to statutory exceptions.","applies_to":{"roles":["provider","deployer","public-body","any"],"uses":["any-ai","profiling","biometric-categorisation","remote-biometric-id","significant-decision"],"conditions":"Applies only where personal-data processing is likely to present high risk; statutory exemptions and the certified-product/code-of-conduct route are set out in Arts. 22–23."},"applies_from":"2023-09-01","status":"applicable","controls":["impact_assessment","risk_management","privacy_compliance"],"evidence":["Completed DPIA with processing description, risk evaluation and safeguards","FDPIC consultation record where residual high risk remains and consultation is required"],"source_url":"https://www.fedlex.admin.ch/eli/cc/2022/491/en","confidence":"high","regime":"ch","jurisdiction":"CH","instrument_short":"Revised FADP","cite":"Revised FADP Art. 22(1)–(5) and Art. 23","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-CH-FADP-24","instrument":"ch-fadp","article":"Art. 24(1)–(4)","title":"Report high-risk personal-data security breaches","plain":"A controller must notify the FDPIC as quickly as possible of a data-security breach likely to result in a high risk to a person's personality or fundamental rights, describing the breach, its consequences and measures taken or planned. A processor must notify the controller as quickly as possible; the controller must inform affected people where needed for their protection or at the FDPIC's request.","applies_to":{"roles":["provider","deployer","public-body","any"],"uses":["any-ai"],"conditions":"Only where AI-related personal data are involved and a breach is likely to create a high risk to data subjects."},"applies_from":"2023-09-01","status":"applicable","controls":["incident_reporting","privacy_compliance"],"evidence":["Data-breach response runbook and assessment of high-risk notification thresholds","FDPIC notice, affected-person notice, and incident documentation where required"],"source_url":"https://www.fedlex.admin.ch/eli/cc/2022/491/en","confidence":"high","regime":"ch","jurisdiction":"CH","instrument_short":"Revised FADP","cite":"Revised FADP Art. 24(1)–(4)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-CH-FADP-25","instrument":"ch-fadp","article":"Art. 25(1)–(2)(e)–(g)","title":"Provide access information, including about automated decisions","plain":"On request, a person may ask whether personal data about them is being processed and receive information needed to exercise their rights. This includes the purpose, available source of data not collected from them, and, if applicable, whether an automated individual decision was taken and the logic behind it, subject to the Act's exceptions.","applies_to":{"roles":["provider","deployer","public-body","any"],"uses":["any-ai","profiling","significant-decision"],"conditions":"Applies to personal data within the FADP's scope; access rights may be limited in the cases set out in Arts. 26–27."},"applies_from":"2023-09-01","status":"applicable","controls":["transparency_notice","contest_and_appeal","privacy_compliance"],"evidence":["Access-request process and response template for AI-related processing","Information supplied about data sources and automated-decision logic when applicable"],"source_url":"https://www.fedlex.admin.ch/eli/cc/2022/491/en","confidence":"high","regime":"ch","jurisdiction":"CH","instrument_short":"Revised FADP","cite":"Revised FADP Art. 25(1)–(2)(e)–(g)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-CH-DPO-4","instrument":"ch-dpo","article":"Art. 4(1)–(5)","title":"Log qualifying automated processing and keep logs protected","plain":"Private controllers and processors must log specified data operations and access when they automate large-volume sensitive-data processing or high-risk profiling and preventive measures cannot ensure protection. Federal bodies and their processors must log specified operations for sensitive data, profiling and covered law-enforcement processing; for other automated processing they must assess fundamental-rights risks and decide whether and how far to log. Required logs identify who did what and when, are kept at least one year, and are separated and access-restricted.","applies_to":{"roles":["provider","deployer","public-body","any"],"uses":["any-ai","profiling","law-enforcement"],"conditions":"Applies to automated processing of personal data; private-sector logging depends on the Art. 4(1) risk conditions, while federal-body duties are specified in Art. 4(2)."},"applies_from":"2025-12-01","status":"applicable","controls":["audit_log","privacy_compliance","risk_management"],"evidence":["Written risk assessment and decision on logging for covered automated processing","Protected logs with access restrictions and at least one-year retention where Art. 4 requires them"],"source_url":"https://www.fedlex.admin.ch/eli/cc/2022/568/en","confidence":"high","regime":"ch","jurisdiction":"CH","instrument_short":"Data Protection Ordinance","cite":"Data Protection Ordinance Art. 4(1)–(5)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-CH-DPO-46-1","instrument":"ch-dpo","article":"Art. 46(1)","title":"Federal bodies: assess logging needs for legacy automated processing by the transition deadline","plain":"Federal bodies and their processors must assess in writing, by 31 December 2026, whether automated personal-data processing planned or started before 1 December 2025 needs logging (the Art. 4(2) assessment); if logging is needed, it must be implemented by 31 December 2029. This transition does not cover automated processing of sensitive personal data, profiling, or processing within the law-enforcement data-protection directive, which must be logged without it. Private controllers are not covered; their logging duty is in Art. 4(1).","applies_to":{"roles":["public-body"],"uses":["any-ai"],"conditions":"Federal bodies and their processors only (Art. 4(2) and 2bis). Only legacy automated processing begun or planned before the 29 October 2025 amendment came into force on 1 December 2025; excluded categories remain subject to Art. 4(2) without this transition."},"applies_from":"2026-12-31","status":"not-yet-applicable","controls":["audit_log","risk_management","privacy_compliance"],"evidence":["Written Art. 4(2) assessment by 31 December 2026","Logging controls implemented by 31 December 2029 where the assessment finds they are needed"],"source_url":"https://www.fedlex.admin.ch/eli/cc/2022/568/en","confidence":"high","notes":"Art. 46(1) sets two separate deadlines; the second applies only if the logging assessment finds logging necessary. It refers to the Art. 4(2) assessment, which binds federal bodies and their processors, so it does not apply to private controllers (corrected 5 November 2026; earlier versions tagged all roles).","regime":"ch","jurisdiction":"CH","instrument_short":"Data Protection Ordinance","cite":"Data Protection Ordinance Art. 46(1)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-CH-AICG-VOL","instrument":"ch-aicg","article":"OFCOM Guide on an AI Code of Conduct, voluntary toolkit","title":"Use OFCOM's voluntary AI Code of Conduct toolkit if adopting self-regulation","plain":"OFCOM's toolkit helps associations and businesses create voluntary AI guidelines, with suggested texts on 10 topics and a process for developing and improving commitments. It is not legislation and creates no mandatory duty to adopt a code.","applies_to":{"roles":["provider","deployer","public-body"],"uses":["any-ai"]},"applies_from":"2026-10-28","status":"voluntary","controls":["risk_management"],"evidence":["Voluntary AI policy or code and records of periodic review, if adopted"],"source_url":"https://www.bakom.admin.ch/en/newnsb/s2TQiUUjrA5D","confidence":"high","notes":"OFCOM reported the guide on 28 October 2026; it is a toolkit for voluntary commitments, not a substitute for binding FADP duties.","regime":"ch","jurisdiction":"CH","instrument_short":"OFCOM AI Code of Conduct guide","cite":"OFCOM Guide on an AI Code of Conduct, voluntary toolkit","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-CN-ALGO-16-17","instrument":"cn-algorithm","article":"Arts. 16–17","title":"Disclose recommendation and give users a real choice","plain":"Algorithmic recommendation providers must clearly tell users that recommendations are being used and disclose the service's basic principles, purpose and main operating mechanisms. They must offer a non-personalised option or an easy way to turn recommendations off, immediately stop the related service when a user opts out, and let users select or delete recommendation-related personal tags.","applies_to":{"roles":["provider"],"uses":["recommender"],"conditions":"Internet information services using algorithmic recommendation technology in China."},"applies_from":"2022-03-01","status":"applicable","controls":["ai_disclosure","transparency_notice","user_controls"],"evidence":["User-facing recommendation notice and current description of the recommendation service","Tested preference-off and user-tag selection/deletion flows"],"penalty":"For the specified breaches, after warning and correction orders, refusal to correct or a serious case can lead to suspension of information updates and a CNY 10,000–100,000 fine (Art. 31), unless another law provides otherwise.","source_url":"https://www.cac.gov.cn/2022-01/04/c_1642894606364259.htm","confidence":"high","regime":"cn","jurisdiction":"CN","instrument_short":"Algorithmic Recommendation Provisions","cite":"Algorithmic Recommendation Provisions Arts. 16–17","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-CN-ALGO-24-27","instrument":"cn-algorithm","article":"Arts. 24–27, 31, 33","title":"File public-opinion or mobilisation-capable recommendation services","plain":"Providers whose recommendation services have public-opinion attributes or social-mobilisation capability must file service and algorithm details, including a self-assessment report, within 10 working days of launch; changes are due within 10 working days and cancellation within 20 working days after termination. They must complete the required security assessment and display the filing number and public filing link after filing.","applies_to":{"roles":["provider"],"uses":["recommender"],"conditions":"Only algorithmic recommendation services with public-opinion attributes or social-mobilisation capability."},"applies_from":"2022-03-01","status":"applicable","controls":["registration","security_testing","technical_documentation"],"evidence":["Filing receipt and filed self-assessment, with a change/cancellation calendar","Security-assessment record and public-facing filing number/link"],"penalty":"Failure to meet specified filing duties can lead, after warning and correction orders, to suspension of information updates and a CNY 10,000–100,000 fine; deceptive or false filings can be revoked and fined (Arts. 31, 33).","source_url":"https://www.cac.gov.cn/2022-01/04/c_1642894606364259.htm","confidence":"high","regime":"cn","jurisdiction":"CN","instrument_short":"Algorithmic Recommendation Provisions","cite":"Algorithmic Recommendation Provisions Arts. 24–27, 31, 33","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-CN-DSYN-9-16-18","instrument":"cn-deep-synthesis","article":"Arts. 9, 16–18","title":"Verify identity for posting and label deep-synthesis output","plain":"Deep-synthesis providers must authenticate users' real identities before allowing them to publish information. They must add a technical label to content generated or edited through the service; where the specified service types could confuse the public, the content also needs a prominent notice, and labels must not be deleted, altered or concealed.","applies_to":{"roles":["provider"],"uses":["generated-media","deepfake","chatbot"],"conditions":"The real-name rule is a condition for information-publishing services; prominent labels apply to the listed services where public confusion or mistaken belief is possible."},"applies_from":"2023-01-10","status":"applicable","controls":["privacy_compliance","content_marking","deepfake_label"],"evidence":["Identity-verification and publishing-gate records","Samples and technical tests showing labels persist on generated or edited content"],"penalty":"The Measures refer violations to applicable laws and administrative regulations; serious consequences can be punished more severely (Art. 22). No standalone fine is specified here.","source_url":"https://www.cac.gov.cn/2022-12/11/c_1672221949354811.htm","confidence":"high","regime":"cn","jurisdiction":"CN","instrument_short":"Deep Synthesis Provisions","cite":"Deep Synthesis Provisions Arts. 9, 16–18","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-CN-DSYN-15-19-20","instrument":"cn-deep-synthesis","article":"Arts. 15, 19–20","title":"Assess and file specified deep-synthesis services","plain":"Providers of services with public-opinion attributes or social-mobilisation capability must complete algorithm filing, updates and cancellation under the Algorithmic Recommendation Provisions, and display the filing number. Safety assessments are required for specified face/voice and sensitive non-biometric models or templates, and before launching new products, applications or functions with public-opinion or mobilisation attributes.","applies_to":{"roles":["provider"],"uses":["generated-media","deepfake"],"conditions":"Filing applies to services with public-opinion attributes or social-mobilisation capability; model/template assessment covers the categories in Art. 15."},"applies_from":"2023-01-10","status":"applicable","controls":["registration","security_testing"],"evidence":["Filing records and public filing-number display","Assessment reports for covered models, templates and new products/functions"],"penalty":"Violations are handled under applicable laws and administrative regulations; serious consequences attract stricter punishment (Art. 22). No standalone fine is specified here.","source_url":"https://www.cac.gov.cn/2022-12/11/c_1672221949354811.htm","confidence":"high","regime":"cn","jurisdiction":"CN","instrument_short":"Deep Synthesis Provisions","cite":"Deep Synthesis Provisions Arts. 15, 19–20","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-CN-GENAI-7-8","instrument":"cn-genai","article":"Arts. 7–8","title":"Use lawful, governed data for public-facing GenAI services","plain":"Providers must use training data and foundation models from lawful sources, respect intellectual property, obtain consent or another legal basis where training involves personal information, and improve data quality. They must also set workable data-labelling rules, assess annotation quality and train and supervise annotators.","applies_to":{"roles":["provider"],"uses":["generated-media","gpai-model"],"conditions":"GenAI services provided to the public in China; non-public R&D and applications are outside the Measures' stated scope."},"applies_from":"2023-08-15","status":"applicable","controls":["data_governance","privacy_compliance","copyright_policy","technical_documentation"],"evidence":["Training-data and foundation-model provenance, rights and personal-data legal-basis records","Annotation policy, sampling-quality checks and annotator training records"],"penalty":"Applicable laws may impose penalties; otherwise authorities may warn, criticize, order correction and suspend the service for refusal or serious cases (Art. 21). No standalone fine is specified in these Measures.","source_url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","confidence":"high","regime":"cn","jurisdiction":"CN","instrument_short":"Interim GenAI Measures","cite":"Interim GenAI Measures Arts. 7–8","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-CN-GENAI-4-10-14-15","instrument":"cn-genai","article":"Arts. 4, 10, 14–15","title":"Control harmful outputs and provide user safeguards","plain":"Providers must not generate content prohibited by law and must take effective measures against specified discrimination and rights violations, while improving transparency and accuracy/reliability in light of service type. They must state intended users, contexts and uses, protect minors from excessive dependence, promptly stop and remediate illegal content, report it where required, and maintain a usable complaints channel with a published process and response times.","applies_to":{"roles":["provider"],"uses":["generated-media","chatbot","minors"],"conditions":"Public-facing GenAI services within the Measures' scope in China."},"applies_from":"2023-08-15","status":"applicable","controls":["content_moderation","minors_protection","transparency_notice","accuracy_robustness"],"evidence":["Content-safety and remediation records, including reports of illegal output","Published service-scope notice, minors safeguards and complaint/response log"],"penalty":"Applicable laws may impose penalties; otherwise authorities may warn, criticize, order correction and suspend the service for refusal or serious cases (Art. 21). No standalone fine is specified in these Measures.","source_url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","confidence":"high","regime":"cn","jurisdiction":"CN","instrument_short":"Interim GenAI Measures","cite":"Interim GenAI Measures Arts. 4, 10, 14–15","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-CN-GENAI-17","instrument":"cn-genai","article":"Art. 17","title":"Assess and file qualifying public-facing GenAI services","plain":"Providers of generative AI services with public-opinion attributes or social-mobilisation capability must conduct a security assessment under applicable rules and complete algorithm filing, including subsequent changes and cancellation, under the Algorithmic Recommendation Provisions.","applies_to":{"roles":["provider"],"uses":["generated-media","chatbot","gpai-model"],"conditions":"Only services with public-opinion attributes or social-mobilisation capability; the Measures apply to services offered to the public within China."},"applies_from":"2023-08-15","status":"applicable","controls":["security_testing","registration"],"evidence":["Security-assessment report or confirmation of completion","Algorithm filing receipt, change records and cancellation record if service ends"],"penalty":"Applicable laws may impose penalties; otherwise authorities may warn, criticize, order correction and suspend the service for refusal or serious cases (Art. 21). No standalone fine is specified in these Measures.","source_url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","confidence":"high","regime":"cn","jurisdiction":"CN","instrument_short":"Interim GenAI Measures","cite":"Interim GenAI Measures Art. 17","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-CN-LABEL-4-12","instrument":"cn-content-label","article":"Arts. 4–12","title":"Label and verify AI-generated content across the service chain","plain":"In-scope service providers must add explicit labels in the specified content types and contexts, preserve them in exported files, and embed implicit metadata with content attributes, provider name or code, and content number; they must explain labelling in user agreements and follow mandatory GB 45438-2025. Content-distribution providers must check metadata and add prominent notices for marked, declared or suspected generated content, while app-distribution platforms must verify labelling materials and users must declare and label generated content when publishing it. If a user requests content without an explicit label, the provider may supply it only after an agreement establishes user duties and it retains related logs for at least six months.","applies_to":{"roles":["provider","platform","any"],"uses":["generated-media","deepfake"],"conditions":"Providers covered by the Algorithmic Recommendation, Deep Synthesis or GenAI rules; distribution-platform and user duties apply when content is distributed or posted through the relevant services."},"applies_from":"2025-09-01","status":"applicable","controls":["content_marking","deepfake_label","audit_log","content_moderation"],"evidence":["Media samples and metadata checks for required explicit/implicit labels and distribution-platform notices","User agreement and log-retention setting for unlabelled-content requests; app-store labelling-review records"],"penalty":"Violations are handled under applicable laws, administrative regulations and departmental rules (Art. 13); the Measures do not set a standalone fine.","source_url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","confidence":"high","notes":"The official national-standards catalogue lists the Chinese GB 45438-2025 as mandatory (强标), current and effective from 2025-09-01; the English listing is marked guidance.","regime":"cn","jurisdiction":"CN","instrument_short":"AI Content Labelling Measures","cite":"AI Content Labelling Measures Arts. 4–12","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-CN-GB45438-4-6-E","instrument":"cn-gb45438","article":"Clauses 4–6 and normative Annex E","title":"Implement the mandatory AI-content labelling method","plain":"GB 45438-2025 specifies technical methods for explicit labels and implicit file-metadata labels for generative-service and content-distribution providers. The official catalogue classifies the Chinese standard as compulsory (强标), current, and effective from 1 September 2025; the English version is listed as guidance.","applies_to":{"roles":["provider","platform"],"uses":["generated-media","deepfake"],"conditions":"Standard applies to providers of generated/synthetic content services and content-distribution services conducting AI-content labelling."},"applies_from":"2025-09-01","status":"applicable","controls":["content_marking","deepfake_label","audit_log"],"evidence":["Conformance test results for visible-label placement and file metadata format","Metadata examples showing required generation and dissemination fields where applicable"],"source_url":"https://openstd.samr.gov.cn/bzgk/std/std_list?p.p2=GB+45438-2025","confidence":"high","regime":"cn","jurisdiction":"CN","instrument_short":"GB 45438-2025","cite":"GB 45438-2025 Clauses 4–6 and normative Annex E","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-CN-CSL-20","instrument":"cn-csl","article":"Art. 20","title":"Recognise the Cybersecurity Law's AI governance mandate","plain":"Article 20 directs the state to support AI basic research and key technologies, training-data and computing infrastructure, AI ethics norms, risk monitoring and assessment, and safety supervision; it also supports use of AI to improve cybersecurity. This is a state policy and government mandate, not a standalone technical duty or AI-specific penalty for private AI providers.","applies_to":{"roles":["public-body"],"uses":["any-ai"],"conditions":"The provision is directed to the state and government policy implementation; it does not itself specify an individual-provider compliance checklist."},"applies_from":"2026-01-01","status":"applicable","controls":["risk_management","security_testing"],"evidence":["Public-sector AI governance, risk-monitoring or safety-supervision implementation records"],"source_url":"http://www.npc.gov.cn/npc/c1773/c1848/c21114/wlaqfxz/wlaqfxz002/202511/t20251103_449242.html","confidence":"high","notes":"The State Council's 2026 Legislative Work Plan calls for accelerating comprehensive AI legislation and related rules for shared AI inputs and key use cases. As of 2026-11-04 this is a proposed work-plan priority, not enacted law; the cited plan provides no draft text or fixed enactment date.","regime":"cn","jurisdiction":"CN","instrument_short":"Amended Cybersecurity Law","cite":"Amended Cybersecurity Law Art. 20","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-CN-ANTHRO-9-11","instrument":"cn-anthro","article":"Arts. 8–11","title":"Govern human-like interaction safety and training data","plain":"Providers of covered anthropomorphic interactive services must not generate the prohibited content or engage in specified harmful, manipulative or dependence-inducing conduct. They must maintain lifecycle safety, ethics, content and risk-response controls, and use legally sourced, checked and diverse training data with safeguards against poisoning and leakage.","applies_to":{"roles":["provider"],"uses":["companion","chatbot","generated-media"],"conditions":"Services offered to the public in China that simulate human personality, thinking and communication styles through continuous emotional interaction; ordinary customer support or Q&A without sustained emotional interaction is excluded."},"applies_from":"2026-07-15","status":"applicable","controls":["risk_management","data_governance","security_testing","content_moderation"],"evidence":["Lifecycle risk, ethics and incident-response procedures for the interactive service","Training-data provenance, poisoning/leakage safeguards and periodic data review"],"penalty":"Where another law does not govern, authorities may warn, criticize, order correction and suspend related activity; serious/refusal cases can lead to service suspension and CNY 10,000–100,000 (Art. 30).","source_url":"https://www.cac.gov.cn/2026-04/10/c_1777558395078289.htm","confidence":"high","regime":"cn","jurisdiction":"CN","instrument_short":"Anthropomorphic Interactive Services Measures","cite":"Anthropomorphic Interactive Services Measures Arts. 8–11","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-CN-ANTHRO-16","instrument":"cn-anthro","article":"Arts. 16–17","title":"Protect interactive data and sensitive information","plain":"Providers must protect user interaction data, may not give it to third parties without a legal basis or the user's clear consent, and must provide options to copy or delete interaction history. They may not use interaction data that is sensitive personal information to train models unless another law or administrative regulation permits it or the user gives separate consent; processing personal information of children under 14 also requires guardian consent and a compliance audit.","applies_to":{"roles":["provider"],"uses":["companion","chatbot","minors"],"conditions":"Covered anthropomorphic interactive services; heightened duties apply to sensitive interaction data and personal information of children under 14."},"applies_from":"2026-07-15","status":"applicable","controls":["privacy_compliance","user_controls","data_governance"],"evidence":["Data-sharing and model-training legal-basis/consent records, including separate consent where relied on","User copy/delete functionality and under-14 guardian-consent/audit records"],"penalty":"Where another law does not govern, penalties under Art. 30 include service suspension and CNY 10,000–100,000 for serious/refusal cases; if harm to life or health results, CNY 100,000–200,000.","source_url":"https://www.cac.gov.cn/2026-04/10/c_1777558395078289.htm","confidence":"high","regime":"cn","jurisdiction":"CN","instrument_short":"Anthropomorphic Interactive Services Measures","cite":"Anthropomorphic Interactive Services Measures Arts. 16–17","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-CN-ANTHRO-13-15","instrument":"cn-anthro","article":"Arts. 13–15","title":"Protect minors and intervene in safety crises","plain":"Providers must respond to serious user distress and imminent threats to life or health with appropriate intervention, and may need to contact a guardian or emergency contact. They must not offer virtual relatives or virtual partners to minors; services to under-14s otherwise require guardian consent, and providers must offer a minors mode and safeguards, while giving older users prominent risk guidance and help.","applies_to":{"roles":["provider"],"uses":["companion","minors"],"conditions":"Applies to covered anthropomorphic interactive services; under-14 and elderly-person duties are triggered when those users receive the service."},"applies_from":"2026-07-15","status":"applicable","controls":["minors_protection","privacy_compliance","human_oversight"],"evidence":["Minors-mode settings, age/guardian-consent controls and risk-notification records","Crisis escalation procedure and samples of older-user safety guidance"],"penalty":"Where another law does not govern, Art. 30 allows service suspension and CNY 10,000–100,000 for serious/refusal cases; where life/health harm results, CNY 100,000–200,000.","source_url":"https://www.cac.gov.cn/2026-04/10/c_1777558395078289.htm","confidence":"high","regime":"cn","jurisdiction":"CN","instrument_short":"Anthropomorphic Interactive Services Measures","cite":"Anthropomorphic Interactive Services Measures Arts. 13–15","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-CN-ANTHRO-18-19","instrument":"cn-anthro","article":"Arts. 18–19","title":"Disclose AI identity and allow users to leave","plain":"Providers must meet AI-generated-content labelling duties and clearly tell users they are interacting with an AI rather than a person. They must visibly remind users who show excessive dependence that the interaction is AI-generated, remind users after each continuous session exceeding two hours, and promptly stop when asked to exit without using continued interaction to obstruct them.","applies_to":{"roles":["provider"],"uses":["companion","chatbot","generated-media"],"conditions":"Covered anthropomorphic interactive services; dynamic dependence warnings are triggered by signs of excessive dependence or addiction."},"applies_from":"2026-07-15","status":"applicable","controls":["ai_disclosure","deepfake_label","user_controls","minors_protection"],"evidence":["First-use AI disclosure and content-labeling test samples","Two-hour and dependence-warning tests, plus verified immediate exit flow"],"penalty":"Where another law does not govern, Art. 30 allows service suspension and CNY 10,000–100,000 for serious/refusal cases; where life/health harm results, CNY 100,000–200,000.","source_url":"https://www.cac.gov.cn/2026-04/10/c_1777558395078289.htm","confidence":"high","regime":"cn","jurisdiction":"CN","instrument_short":"Anthropomorphic Interactive Services Measures","cite":"Anthropomorphic Interactive Services Measures Arts. 18–19","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-CN-ANTHRO-22-26","instrument":"cn-anthro","article":"Arts. 22–27","title":"Assess and file human-like interactive services","plain":"Providers must submit a security-assessment report to the provincial cyberspace authority when launching a covered service or related function, making a major change through new technology, reaching 1 million registered users or 100,000 monthly active users, or facing specified safety risks; the assessment covers training data, safeguards, user demographics, crisis intervention and complaints. Providers must also complete algorithm filing and updates/cancellation, and app-distribution platforms must verify applicable assessment and filing materials before listing and in routine management.","applies_to":{"roles":["provider","platform"],"uses":["companion","chatbot"],"conditions":"Assessment thresholds and triggers are in Art. 22; algorithm filing and annual verification apply to providers, while Art. 25 platform duties apply to app-distribution platforms."},"applies_from":"2026-07-15","status":"applicable","controls":["security_testing","registration","impact_assessment","audit_log"],"evidence":["Provincial security-assessment report and trigger/threshold monitoring record","Algorithm filing and annual verification record, plus app-store safety review"],"penalty":"Where another law does not govern, failure can result in warnings, correction orders, service suspension and CNY 10,000–100,000; life/health harm with consequences can bring CNY 100,000–200,000 (Art. 30).","source_url":"https://www.cac.gov.cn/2026-04/10/c_1777558395078289.htm","confidence":"high","regime":"cn","jurisdiction":"CN","instrument_short":"Anthropomorphic Interactive Services Measures","cite":"Anthropomorphic Interactive Services Measures Arts. 22–27","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-COE-CETS225-3","instrument":"coe-ai-convention","article":"Art. 3(1)(a)–(b)","title":"Apply the Convention to public-sector AI and address risks from other private actors","plain":"Each Party must apply the Convention to AI lifecycle activities by its public authorities and private actors acting on their behalf. For other private actors, each Party must address risks and impacts consistently with the Convention's object and purpose, and declare whether it will apply the treaty principles and obligations or take other appropriate measures.","applies_to":{"roles":["public-body"],"uses":["public-sector-use","any-ai"],"conditions":"Applies to lifecycle activities with potential to interfere with human rights, democracy or the rule of law. This is a duty of a State Party, not a directly applicable treaty duty on companies; national-defence matters and pre-deployment R&D are excluded, except testing with such potential. Other private-actor coverage follows the Party's Article 3 implementation choice."},"applies_from":null,"status":"not-yet-applicable","controls":["risk_management","privacy_compliance"],"evidence":["National implementation measure specifying the Article 3 approach for private actors","Inventory of AI lifecycle activities by public authorities and contractors acting on their behalf"],"source_url":"https://rm.coe.int/1680afae3c","confidence":"high","notes":"Convention-wide application depends on entry into force; national implementation determines private-actor duties.","regime":"coe","jurisdiction":"COE","instrument_short":"Council of Europe AI Framework Convention","cite":"Council of Europe AI Framework Convention Art. 3(1)(a)–(b)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-COE-CETS225-7-9-13","instrument":"coe-ai-convention","article":"Arts. 7, 9–13","title":"Protect dignity, equality, privacy, accountability and reliability in AI activities","plain":"Parties must ensure AI lifecycle activities respect human dignity and individual autonomy, accountability and responsibility, equality and non-discrimination, privacy and personal-data protection, reliability, and safe innovation. The Convention requires Parties to give effect to these principles through measures consistent with the instrument and their legal systems.","applies_to":{"roles":["public-body"],"uses":["public-sector-use","any-ai"],"conditions":"State-Party measures apply to covered public-authority activities and private actors acting on their behalf; wider private-sector implementation is determined under Art. 3(1)(b)."},"applies_from":null,"status":"not-yet-applicable","controls":["human_oversight","bias_testing","privacy_compliance","risk_management"],"evidence":["Policies and assessments showing how public-sector AI use addresses the Convention principles"],"source_url":"https://rm.coe.int/1680afae3c","confidence":"high","regime":"coe","jurisdiction":"COE","instrument_short":"Council of Europe AI Framework Convention","cite":"Council of Europe AI Framework Convention Arts. 7, 9–13","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-COE-CETS225-8","instrument":"coe-ai-convention","article":"Art. 8","title":"Provide context- and risk-appropriate transparency and oversight","plain":"Each Party must adopt or maintain measures ensuring adequate transparency and oversight requirements tailored to the context and risks of AI lifecycle activities. The Article expressly includes measures concerning identification of content generated by AI systems.","applies_to":{"roles":["public-body"],"uses":["public-sector-use","any-ai","generated-media","chatbot"],"conditions":"Treaty obligations are on Parties; operational requirements for providers and deployers depend on applicable domestic implementation and the Article 3 scope."},"applies_from":null,"status":"not-yet-applicable","controls":["transparency_notice","human_oversight","content_marking"],"evidence":["Transparency and oversight rules tailored to public-sector AI contexts and risk","Measures for identifying AI-generated content where appropriate under the implementation framework"],"source_url":"https://rm.coe.int/1680afae3c","confidence":"high","regime":"coe","jurisdiction":"COE","instrument_short":"Council of Europe AI Framework Convention","cite":"Council of Europe AI Framework Convention Art. 8","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-COE-CETS225-14","instrument":"coe-ai-convention","article":"Art. 14(1)–(2)","title":"Ensure effective remedies and information to challenge consequential AI use","plain":"To the extent required by a Party's international obligations and consistent with its domestic legal system, it must ensure accessible and effective remedies for human-rights violations arising from AI lifecycle activities. Measures include documenting relevant information, making it available to authorised bodies and, where appropriate, affected people, enabling them to contest decisions substantially informed by AI, and providing a way to complain to competent authorities.","applies_to":{"roles":["public-body"],"uses":["public-sector-use","significant-decision"],"conditions":"The Convention sets duties on Parties; the remedies obligation is expressly qualified by existing international obligations and the domestic legal system."},"applies_from":null,"status":"not-yet-applicable","controls":["audit_log","transparency_notice","contest_and_appeal"],"evidence":["Documented AI system use and information-access procedure for affected people","Accessible complaint and contest process linked to competent authorities"],"source_url":"https://rm.coe.int/1680afae3c","confidence":"high","regime":"coe","jurisdiction":"COE","instrument_short":"Council of Europe AI Framework Convention","cite":"Council of Europe AI Framework Convention Art. 14(1)–(2)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-COE-CETS225-15","instrument":"coe-ai-convention","article":"Art. 15(1)–(2)","title":"Provide procedural safeguards and, where appropriate, AI-interaction notice","plain":"Each Party must ensure effective procedural guarantees, safeguards and rights where an AI system significantly affects the enjoyment of human rights and fundamental freedoms, consistent with applicable international and domestic law. Parties must also seek context-appropriate notice that a person is interacting with an AI system rather than a human being.","applies_to":{"roles":["public-body"],"uses":["public-sector-use","significant-decision","chatbot","agent"],"conditions":"The interaction notice is context-dependent; the treaty's procedural-safeguard requirements apply where human rights and fundamental freedoms are significantly affected."},"applies_from":null,"status":"not-yet-applicable","controls":["human_oversight","ai_disclosure","contest_and_appeal"],"evidence":["Procedural safeguards for people significantly affected by public-sector AI","Notice design and records for AI interactions where appropriate to context"],"source_url":"https://rm.coe.int/1680afae3c","confidence":"high","regime":"coe","jurisdiction":"COE","instrument_short":"Council of Europe AI Framework Convention","cite":"Council of Europe AI Framework Convention Art. 15(1)–(2)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-COE-CETS225-16","instrument":"coe-ai-convention","article":"Art. 16(1)–(4)","title":"Manage AI risks and impacts iteratively across the lifecycle","plain":"Each Party must adopt or maintain graduated, context-sensitive measures to identify, assess, prevent and mitigate AI risks to human rights, democracy and the rule of law. Measures apply iteratively, consider impact severity and probability and relevant stakeholders, monitor and document risks and impacts, and require testing where appropriate; Parties must assess whether incompatible uses warrant a moratorium, ban or other measures.","applies_to":{"roles":["public-body"],"uses":["public-sector-use","any-ai"],"conditions":"Treaty duties are on Parties and apply to covered lifecycle activities; each Party's measures must reflect context, intended use and risk."},"applies_from":null,"status":"not-yet-applicable","controls":["risk_management","impact_assessment","audit_log","security_testing"],"evidence":["Iterative human-rights, democracy and rule-of-law risk and impact assessments","Documented mitigation, monitoring and testing decisions across the AI lifecycle"],"source_url":"https://rm.coe.int/1680afae3c","confidence":"high","regime":"coe","jurisdiction":"COE","instrument_short":"Council of Europe AI Framework Convention","cite":"Council of Europe AI Framework Convention Art. 16(1)–(4)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-COE-CETS225-26","instrument":"coe-ai-convention","article":"Art. 26(1)–(2)","title":"Establish independent and effective oversight mechanisms","plain":"Each Party must establish or designate one or more effective mechanisms to oversee compliance with the Convention. Those mechanisms must be independent and impartial and have the powers, expertise and resources needed to perform their duties effectively.","applies_to":{"roles":["public-body"],"uses":["public-sector-use","any-ai"],"conditions":"This is an institutional duty of each Party; it does not itself create an AI-authorisation or registration requirement for companies."},"applies_from":null,"status":"not-yet-applicable","controls":["risk_management","audit_log"],"evidence":["Designation or establishment of an adequately resourced, independent oversight mechanism","Published oversight mandate, powers and accountability arrangements"],"source_url":"https://rm.coe.int/1680afae3c","confidence":"high","regime":"coe","jurisdiction":"COE","instrument_short":"Council of Europe AI Framework Convention","cite":"Council of Europe AI Framework Convention Art. 26(1)–(2)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-EU-AIA-5","instrument":"eu-aia","article":"Art. 5(1)","title":"Do not build or use banned AI practices","plain":"Placing on the market, putting into service or using AI for banned practices is prohibited. The list includes manipulative or deceptive techniques that cause significant harm, exploiting vulnerabilities, social scoring, predicting crime from profiling alone, untargeted scraping of facial images, emotion recognition at work or school, biometric categorisation inferring sensitive traits, and real-time remote biometric identification for law enforcement in public spaces (with narrow exceptions).","applies_to":{"roles":["any"],"uses":["any-ai"]},"applies_from":"2025-02-02","status":"applicable","controls":["prohibited_practices_screen"],"evidence":["Use-case screening record against each Art. 5 practice, signed by an accountable owner"],"penalty":"Up to EUR 35 million or 7% of worldwide annual turnover, whichever is higher (Art. 99(3))","source_url":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-5","confidence":"high","regime":"eu","jurisdiction":"EU","instrument_short":"EU AI Act","cite":"EU AI Act Art. 5(1)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-EU-AIA-5-1-BA","instrument":"eu-aia","article":"Art. 5(1)(ba) and (bb)","title":"Do not offer AI that creates non-consensual intimate images or child sexual abuse material","plain":"From 2 December 2026 it is prohibited to place on the market, put into service or use an AI system that generates or manipulates realistic intimate or sexually explicit material of an identifiable person without that person's explicit consent, or that generates child sexual abuse material.","applies_to":{"roles":["any"],"uses":["generated-media","deepfake"]},"applies_from":"2026-12-02","status":"not-yet-applicable","controls":["prohibited_practices_screen","content_moderation"],"evidence":["Output filters and abuse-testing results for intimate and sexual content","Policy and enforcement log for misuse reports"],"penalty":"Up to EUR 35 million or 7% of worldwide annual turnover (Art. 99(3))","source_url":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-5","confidence":"high","notes":"Added by Regulation (EU) 2026/1744 (Digital Omnibus on AI). Application date set in Art. 113(a).","regime":"eu","jurisdiction":"EU","instrument_short":"EU AI Act","cite":"EU AI Act Art. 5(1)(ba) and (bb)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-EU-AIA-4","instrument":"eu-aia","article":"Art. 4(1)","title":"Support AI literacy of staff who run or use AI","plain":"Providers and deployers must take measures to support the AI literacy of their staff and others operating AI on their behalf, taking into account their knowledge, the context of use and the people affected. As amended in 2026, this does not require guaranteeing a specific literacy level for any individual; the Commission and Member States must support companies, especially SMEs.","applies_to":{"roles":["provider","deployer"],"uses":["any-ai"]},"applies_from":"2025-02-02","status":"applicable","controls":["ai_literacy"],"evidence":["Training plan and attendance records for people who operate or use AI systems"],"source_url":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-4","confidence":"high","notes":"Paragraphs 1 to 3 amended by the Digital Omnibus on AI.","regime":"eu","jurisdiction":"EU","instrument_short":"EU AI Act","cite":"EU AI Act Art. 4(1)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-EU-AIA-50-1","instrument":"eu-aia","article":"Art. 50(1)","title":"Tell people they are interacting with an AI system","plain":"Providers must design AI systems that interact directly with people so those people are informed they are interacting with an AI, unless this is obvious to a reasonably well-informed person from the context.","applies_to":{"roles":["provider"],"uses":["chatbot","agent","companion"]},"applies_from":"2026-08-02","status":"applicable","controls":["ai_disclosure"],"evidence":["Screenshot or transcript showing the AI disclosure at the first interaction"],"penalty":"Up to EUR 15 million or 3% of worldwide annual turnover (Art. 99(4))","source_url":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50","confidence":"high","regime":"eu","jurisdiction":"EU","instrument_short":"EU AI Act","cite":"EU AI Act Art. 50(1)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-EU-AIA-50-2","instrument":"eu-aia","article":"Art. 50(2) and Art. 111(4)","title":"Mark AI-generated content in a machine-readable way","plain":"Providers of AI systems, including general-purpose AI systems, that generate synthetic audio, image, video or text must mark outputs in a machine-readable format so they are detectable as AI-generated, using effective, interoperable, robust and reliable techniques as far as technically feasible. Assistive editing functions that do not substantially alter the input are exempt. Systems placed on the market before 2 August 2026 have until 2 December 2026.","applies_to":{"roles":["provider","gpai-provider"],"uses":["generated-media","deepfake"]},"applies_from":"2026-08-02","status":"applicable","controls":["content_marking"],"evidence":["Description of the marking technique (for example signed metadata plus imperceptible watermark) and detection test results"],"penalty":"Up to EUR 15 million or 3% of worldwide annual turnover (Art. 99(4))","source_url":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50","confidence":"high","notes":"The voluntary EU Code of Practice on marking and labelling (final June 2026) describes a layered approach (metadata and watermarking) as a way to show compliance.","regime":"eu","jurisdiction":"EU","instrument_short":"EU AI Act","cite":"EU AI Act Art. 50(2) and Art. 111(4)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-EU-AIA-50-3","instrument":"eu-aia","article":"Art. 50(3)","title":"Inform people exposed to emotion recognition or biometric categorisation","plain":"Deployers of an emotion recognition or biometric categorisation system must inform the people exposed to it and process personal data in line with the GDPR and related EU data protection law.","applies_to":{"roles":["deployer"],"uses":["emotion-recognition","biometric-categorisation"]},"applies_from":"2026-08-02","status":"applicable","controls":["transparency_notice","privacy_compliance"],"evidence":["Notice text shown to exposed persons and the GDPR legal basis record"],"source_url":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50","confidence":"high","notes":"Emotion recognition at work or in education is banned outright by Art. 5(1)(f), with medical and safety exceptions.","regime":"eu","jurisdiction":"EU","instrument_short":"EU AI Act","cite":"EU AI Act Art. 50(3)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-EU-AIA-50-4","instrument":"eu-aia","article":"Art. 50(4)","title":"Label deepfakes and AI-written public-interest text","plain":"Deployers who generate or manipulate image, audio or video that is a deepfake must disclose that it is artificially generated or manipulated (a lighter duty applies to evidently artistic, satirical or fictional works). Deployers publishing AI-generated text to inform the public on matters of public interest must disclose it, unless it underwent human review or editorial control and someone holds editorial responsibility.","applies_to":{"roles":["deployer"],"uses":["deepfake","generated-media"]},"applies_from":"2026-08-02","status":"applicable","controls":["deepfake_label"],"evidence":["Examples of published labels and the editorial review procedure for public-interest text"],"penalty":"Up to EUR 15 million or 3% of worldwide annual turnover (Art. 99(4))","source_url":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50","confidence":"high","regime":"eu","jurisdiction":"EU","instrument_short":"EU AI Act","cite":"EU AI Act Art. 50(4)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-EU-AIA-53","instrument":"eu-aia","article":"Art. 53(1)","title":"Document general-purpose AI models, respect copyright and publish a training-data summary","plain":"Providers of general-purpose AI models must keep technical documentation for authorities, give integrators the information they need, put in place a policy to comply with EU copyright law (including text-and-data-mining opt-outs) and publish a sufficiently detailed summary of the training content using the AI Office template. Open-source models are exempt from some documentation duties unless they pose systemic risk.","applies_to":{"roles":["gpai-provider"],"uses":["gpai-model"]},"applies_from":"2025-08-02","status":"applicable","controls":["technical_documentation","copyright_policy","training_data_summary"],"evidence":["Model documentation, downstream information pack, copyright policy and public training-content summary"],"penalty":"Up to EUR 15 million or 3% of worldwide annual turnover (Art. 101), enforceable from 2 Aug 2026","source_url":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-53","confidence":"high","notes":"Models placed on the market before 2 Aug 2025 have until 2 Aug 2027 (Art. 111(3)). The GPAI Code of Practice (July 2025) is a voluntary way to show compliance.","regime":"eu","jurisdiction":"EU","instrument_short":"EU AI Act","cite":"EU AI Act Art. 53(1)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-EU-AIA-55","instrument":"eu-aia","article":"Art. 55(1)","title":"Evaluate and secure general-purpose AI models with systemic risk","plain":"Providers of general-purpose AI models with systemic risk must evaluate models with state-of-the-art protocols including adversarial testing, assess and mitigate systemic risks, report serious incidents to the AI Office without undue delay, and ensure adequate cybersecurity.","applies_to":{"roles":["gpai-provider"],"uses":["frontier-model"],"conditions":"Models classified as having systemic risk (presumed above 10^25 FLOP of training compute, Art. 51)"},"applies_from":"2025-08-02","status":"applicable","controls":["security_testing","safety_framework","incident_reporting"],"evidence":["Evaluation and red-team reports, systemic-risk assessment, incident log and security measures"],"source_url":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-55","confidence":"high","regime":"eu","jurisdiction":"EU","instrument_short":"EU AI Act","cite":"EU AI Act Art. 55(1)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-EU-AIA-6","instrument":"eu-aia","article":"Art. 6 and Annex III","title":"Check whether your system is high-risk","plain":"A system is high-risk if it is a safety component of (or is) a product under Annex I law that needs third-party conformity assessment, or if it falls into an Annex III area such as biometrics, critical infrastructure, education, employment, essential services and credit, law enforcement, migration, or justice and democratic processes. Some Annex III systems are not high-risk if they only perform narrow or preparatory tasks and do not profile people (Art. 6(3)); that assessment must be documented.","applies_to":{"roles":["provider"],"uses":["hiring","credit","insurance","education","essential-services","healthcare","law-enforcement","migration","justice","critical-infrastructure","remote-biometric-id","biometric-categorisation","emotion-recognition","safety-component"]},"applies_from":"2027-12-02","status":"not-yet-applicable","controls":["risk_management","technical_documentation"],"evidence":["Documented classification decision, including any Art. 6(3) exemption reasoning"],"source_url":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-6","confidence":"high","notes":"Annex III systems from 2 Dec 2027; Annex I product systems from 2 Aug 2028 (Art. 113(c) as amended).","regime":"eu","jurisdiction":"EU","instrument_short":"EU AI Act","cite":"EU AI Act Art. 6 and Annex III","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-EU-AIA-9","instrument":"eu-aia","article":"Art. 9 to 15","title":"Meet the high-risk requirements (risk, data, documentation, logs, transparency, oversight, robustness)","plain":"Providers of high-risk systems must run a risk management system across the life cycle (Art. 9), govern training, validation and test data (Art. 10), keep technical documentation per Annex IV (Art. 11), enable automatic event logging (Art. 12), give deployers clear instructions (Art. 13), design for effective human oversight including the ability to stop the system (Art. 14), and achieve appropriate accuracy, robustness and cybersecurity (Art. 15).","applies_to":{"roles":["provider"],"uses":["hiring","credit","insurance","education","essential-services","healthcare","law-enforcement","migration","justice","critical-infrastructure","remote-biometric-id","biometric-categorisation","emotion-recognition","safety-component"],"conditions":"Only for systems classified as high-risk under Art. 6"},"applies_from":"2027-12-02","status":"not-yet-applicable","controls":["risk_management","data_governance","technical_documentation","audit_log","transparency_notice","human_oversight","kill_switch","accuracy_robustness","security_testing"],"evidence":["Risk register, data sheets, Annex IV file, logging design, instructions for use, oversight design and test results"],"penalty":"Up to EUR 15 million or 3% of worldwide annual turnover (Art. 99(4))","source_url":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-14","confidence":"high","notes":"Annex III systems from 2 Dec 2027; Annex I product systems from 2 Aug 2028.","regime":"eu","jurisdiction":"EU","instrument_short":"EU AI Act","cite":"EU AI Act Art. 9 to 15","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-EU-AIA-17","instrument":"eu-aia","article":"Art. 16, 17, 43, 47, 48","title":"Run a quality management system and complete conformity assessment","plain":"Providers of high-risk systems must have a documented quality management system, complete the applicable conformity assessment before placing the system on the market, draw up an EU declaration of conformity and affix the CE marking.","applies_to":{"roles":["provider"],"uses":["hiring","credit","insurance","education","essential-services","healthcare","law-enforcement","migration","justice","critical-infrastructure","remote-biometric-id","biometric-categorisation","emotion-recognition","safety-component"],"conditions":"Only for systems classified as high-risk under Art. 6. Simplified QMS options for SMEs and small mid-caps."},"applies_from":"2027-12-02","status":"not-yet-applicable","controls":["quality_management","conformity_assessment"],"evidence":["QMS manual, conformity assessment record, EU declaration of conformity, CE marking"],"source_url":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-17","confidence":"high","regime":"eu","jurisdiction":"EU","instrument_short":"EU AI Act","cite":"EU AI Act Art. 16, 17, 43, 47, 48","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-EU-AIA-49","instrument":"eu-aia","article":"Art. 49","title":"Register high-risk systems in the EU database","plain":"Before placing a high-risk Annex III system on the market, providers must register themselves and the system in the EU database. Public authorities and bodies acting on their behalf must register their use of high-risk systems. Law-enforcement and migration systems go into a secure non-public section.","applies_to":{"roles":["provider","public-body"],"uses":["hiring","credit","insurance","education","essential-services","law-enforcement","migration","justice","remote-biometric-id","biometric-categorisation","emotion-recognition"]},"applies_from":"2027-12-02","status":"not-yet-applicable","controls":["registration"],"evidence":["EU database registration reference"],"source_url":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-49","confidence":"high","notes":"The Digital Omnibus simplified registration for Annex III systems that are exempted from high-risk status under Art. 6(3).","regime":"eu","jurisdiction":"EU","instrument_short":"EU AI Act","cite":"EU AI Act Art. 49","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-EU-AIA-72","instrument":"eu-aia","article":"Art. 72 and 73","title":"Monitor after release and report serious incidents","plain":"Providers of high-risk systems must run post-market monitoring and report serious incidents to market surveillance authorities immediately after establishing a likely causal link, and no later than 15 days after becoming aware; no later than 2 days for widespread infringements or serious disruption of critical infrastructure; no later than 10 days in case of death.","applies_to":{"roles":["provider"],"uses":["hiring","credit","insurance","education","essential-services","healthcare","law-enforcement","migration","justice","critical-infrastructure","remote-biometric-id","biometric-categorisation","emotion-recognition","safety-component"]},"applies_from":"2027-12-02","status":"not-yet-applicable","controls":["post_market_monitoring","incident_reporting"],"evidence":["Post-market monitoring plan and incident reporting runbook with the 15, 10 and 2 day clocks"],"source_url":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-73","confidence":"high","regime":"eu","jurisdiction":"EU","instrument_short":"EU AI Act","cite":"EU AI Act Art. 72 and 73","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-EU-AIA-22","instrument":"eu-aia","article":"Art. 22 and 54","title":"Appoint an EU authorised representative if you are outside the EU","plain":"Providers of high-risk AI systems and of general-purpose AI models established outside the EU must appoint an authorised representative in the EU by written mandate before placing their system or model on the EU market.","applies_to":{"roles":["provider","gpai-provider"],"uses":["gpai-model","hiring","credit","insurance","education","essential-services","healthcare","law-enforcement","migration","justice","critical-infrastructure","safety-component"],"conditions":"Provider established outside the EU"},"applies_from":"2025-08-02","status":"applicable","controls":["local_representative"],"evidence":["Signed mandate with the authorised representative"],"source_url":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-22","confidence":"medium","notes":"Applicable for GPAI providers (Art. 54) since 2 Aug 2025; for high-risk providers (Art. 22) from 2 Dec 2027 or 2 Aug 2028.","regime":"eu","jurisdiction":"EU","instrument_short":"EU AI Act","cite":"EU AI Act Art. 22 and 54","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-EU-AIA-26","instrument":"eu-aia","article":"Art. 26","title":"Use high-risk systems as instructed, with competent human oversight and logs","plain":"Deployers of high-risk systems must use them according to the instructions, assign human oversight to competent people, monitor operation, keep automatically generated logs for at least six months, inform workers and their representatives before workplace use, and inform people subject to decisions made or assisted by the system.","applies_to":{"roles":["deployer","employer","public-body"],"uses":["hiring","credit","insurance","education","essential-services","healthcare","law-enforcement","migration","justice","critical-infrastructure","remote-biometric-id","biometric-categorisation","emotion-recognition"]},"applies_from":"2027-12-02","status":"not-yet-applicable","controls":["human_oversight","audit_log","transparency_notice"],"evidence":["Named oversight owners, log retention setting of six months or more, worker notice, notice to affected persons"],"source_url":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-26","confidence":"high","regime":"eu","jurisdiction":"EU","instrument_short":"EU AI Act","cite":"EU AI Act Art. 26","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-EU-AIA-27","instrument":"eu-aia","article":"Art. 27","title":"Do a fundamental rights impact assessment before first use","plain":"Before first use of certain high-risk systems, deployers that are public bodies or private entities providing public services, and deployers of credit-scoring or life and health insurance pricing systems, must assess the impact on fundamental rights and notify the market surveillance authority of the results.","applies_to":{"roles":["deployer","public-body"],"uses":["credit","insurance","essential-services","education","hiring","law-enforcement","migration","justice","public-sector-use"]},"applies_from":"2027-12-02","status":"not-yet-applicable","controls":["impact_assessment"],"evidence":["Completed FRIA using the AI Office template and the notification receipt"],"source_url":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-27","confidence":"high","regime":"eu","jurisdiction":"EU","instrument_short":"EU AI Act","cite":"EU AI Act Art. 27","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-EU-AIA-86","instrument":"eu-aia","article":"Art. 86","title":"Explain high-risk decisions on request","plain":"People affected by a decision based on output of an Annex III high-risk system that produces legal or similarly significant effects can obtain a clear and meaningful explanation from the deployer of the role of the AI system and the main elements of the decision.","applies_to":{"roles":["deployer"],"uses":["hiring","credit","insurance","education","essential-services","law-enforcement","migration","justice"]},"applies_from":"2027-12-02","status":"not-yet-applicable","controls":["transparency_notice","contest_and_appeal"],"evidence":["Explanation request procedure and response template"],"source_url":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-86","confidence":"medium","notes":"Application date follows the high-risk timeline; confirm in the consolidated text.","regime":"eu","jurisdiction":"EU","instrument_short":"EU AI Act","cite":"EU AI Act Art. 86","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-GB-UKGDPR-22B","instrument":"gb-ukgdpr-adm","article":"UK GDPR Arts. 22A–22B","title":"Restrict significant automated decisions using special-category data","plain":"A significant decision with legal or similarly significant effects that is based solely on automated processing and uses special-category data is barred unless the decision relies entirely on explicit consent, or is necessary for a contract or required/authorised by law and the substantial-public-interest condition in Article 9(2)(g) applies. A significant decision relying in whole or part on the recognised legitimate-interests basis in Article 6(1)(ea) also cannot be made solely by automated processing.","applies_to":{"roles":["any"],"uses":["significant-decision","profiling"],"conditions":"Controllers making a significant decision based solely on automated processing of personal data; Article 22A defines the decision and meaningful-human-involvement threshold."},"applies_from":"2026-02-05","status":"applicable","controls":["privacy_compliance","risk_management"],"evidence":["Decision inventory showing which significant decisions are solely automated and whether profiling is used","Lawful-basis, Article 9 condition, and exception analysis for each covered decision"],"source_url":"https://www.legislation.gov.uk/ukpga/2025/18/section/80","confidence":"high","notes":"This is not the former general prohibition with three exceptions. Article 22B sets specific restrictions, including on special-category data and Article 6(1)(ea).","regime":"gb","jurisdiction":"GB","instrument_short":"UK GDPR automated decision-making","cite":"UK GDPR Arts. 22A–22B","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-GB-UKGDPR-22C","instrument":"gb-ukgdpr-adm","article":"UK GDPR Art. 22C","title":"Give people safeguards for significant automated decisions","plain":"For a significant decision based at least partly on personal data and solely on automated processing, the controller must provide safeguards that give the person information about the decision, let them make representations, obtain human intervention by the controller, and contest the decision.","applies_to":{"roles":["any"],"uses":["significant-decision","profiling"],"conditions":"Applies to controllers making significant decisions solely by automated processing, including profiling; Article 22D allows regulations to supplement or specify safeguards."},"applies_from":"2026-02-05","status":"applicable","controls":["transparency_notice","human_oversight","contest_and_appeal"],"evidence":["Information notice describing the decision and a record of when it is provided","Working representation, human-intervention and contest processes, with records of requests and outcomes"],"source_url":"https://www.legislation.gov.uk/ukpga/2025/18/section/80","confidence":"high","regime":"gb","jurisdiction":"GB","instrument_short":"UK GDPR automated decision-making","cite":"UK GDPR Art. 22C","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-GB-DPA18-50B","instrument":"gb-dpa-le-adm","article":"DPA 2018 ss. 50A–50C","title":"Safeguard automated law-enforcement decisions","plain":"Controllers processing personal data for law-enforcement purposes may not make a significant decision based solely on automated processing that uses sensitive processing, except with explicit consent or where required or authorised by law. Significant solely automated decisions must generally include information, an opportunity for representations, human intervention and a means to contest, subject to the statutory exceptions and reconsideration safeguards.","applies_to":{"roles":["public-body"],"uses":["law-enforcement","significant-decision","profiling"],"conditions":"Applies to controllers processing under Part 3 of the Data Protection Act 2018 for law-enforcement purposes; the decision must have an adverse legal or similarly significant effect."},"applies_from":"2026-02-05","status":"applicable","controls":["privacy_compliance","transparency_notice","human_oversight","contest_and_appeal"],"evidence":["Record showing the Part 3 law-enforcement purpose, decision threshold and sensitive-processing condition","Safeguard and human-reconsideration procedure, including exceptions relied upon"],"source_url":"https://www.legislation.gov.uk/ukpga/2025/18/section/80","confidence":"high","regime":"gb","jurisdiction":"GB","instrument_short":"Law-enforcement automated decision-making","cite":"Law-enforcement automated decision-making DPA 2018 ss. 50A–50C","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-GB-OSA-9-10","instrument":"gb-osa","article":"OSA 2023 ss. 9–10, 26–27","title":"Assess and reduce illegal-content risks on in-scope services","plain":"Providers of regulated user-to-user and search services must assess illegal-content risks, keep assessments up to date (including before significant service changes), and take proportionate measures to prevent priority illegal content and mitigate identified harms and offence-facilitation risks. AI content shared by users or encountered through search can be in scope like other content.","applies_to":{"roles":["platform"],"uses":["chatbot","generated-media","deepfake","recommender"],"conditions":"Only services meeting the Act's user-to-user or search definitions and UK-link rules. A one-to-one chatbot that neither enables user sharing nor searches multiple sites is generally outside Part 3; see Ofcom's chatbot guidance."},"applies_from":"2025-03-17","status":"applicable","controls":["impact_assessment","risk_management","content_moderation","audit_log"],"evidence":["Service-specific illegal-content risk assessment that covers chatbot, generative features and significant changes","Content moderation, reporting and complaints controls with review records"],"penalty":"Ofcom may impose a penalty up to £18 million or 10% of qualifying worldwide revenue, whichever is greater.","source_url":"https://www.legislation.gov.uk/ukpga/2023/50/section/10","confidence":"high","notes":"Ofcom's 2025/2026 guidance explains that user-shared AI outputs are user-generated content. The Crime and Policing Act 2026 added OSA s.216A, an enabling power to extend duties by regulations; that power itself does not create a new direct provider duty.","regime":"gb","jurisdiction":"GB","instrument_short":"Online Safety Act","cite":"Online Safety Act OSA 2023 ss. 9–10, 26–27","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-GB-OSA-11-12","instrument":"gb-osa","article":"OSA 2023 ss. 11–12, 28–29","title":"Assess and mitigate risks to children","plain":"Providers of regulated user-to-user and search services likely to be accessed by children must assess risks to children and take proportionate steps to mitigate and manage them. User-to-user services must prevent children encountering primary-priority harmful content using age verification or estimation where required, and protect children from other harmful content.","applies_to":{"roles":["platform"],"uses":["chatbot","generated-media","deepfake","minors"],"conditions":"Applies to in-scope services likely to be accessed by children; duties vary by service type, identified risk, content and child age group. AI-generated content shared between users is assessed as other user-generated content."},"applies_from":"2025-07-25","status":"applicable","controls":["impact_assessment","minors_protection","content_moderation"],"evidence":["Children’s access/risk assessment covering AI chatbot and generated-content features","Age-assurance and child-safety measures, with evidence of effectiveness and periodic review"],"penalty":"Ofcom may impose a penalty up to £18 million or 10% of qualifying worldwide revenue, whichever is greater.","source_url":"https://www.legislation.gov.uk/ukpga/2023/50/section/12","confidence":"high","regime":"gb","jurisdiction":"GB","instrument_short":"Online Safety Act","cite":"Online Safety Act OSA 2023 ss. 11–12, 28–29","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-GB-OSA-81","instrument":"gb-osa","article":"OSA 2023 ss. 79–81","title":"Age-gate provider-published pornography","plain":"A service with regulated provider-published pornographic content and UK links must use highly effective age verification or estimation so children are not normally able to encounter it. The provider must keep a written record of its method and privacy considerations and publish a summary; provider-published content may include material produced through an automated tool.","applies_to":{"roles":["platform"],"uses":["chatbot","generated-media","minors"],"conditions":"Part 5 covers provider-published pornography, including where the provider uses an automated tool; user-generated pornography is excluded from Part 5 and may instead trigger Part 3 duties."},"applies_from":"2025-01-17","status":"applicable","controls":["minors_protection","privacy_compliance"],"evidence":["Highly effective age-assurance design and test results","Written record and public summary of age-assurance methods and privacy considerations"],"penalty":"Ofcom may impose a penalty up to £18 million or 10% of qualifying worldwide revenue, whichever is greater.","source_url":"https://www.legislation.gov.uk/ukpga/2023/50/section/81","confidence":"high","notes":"Ofcom's chatbot guidance says the Act covers chatbots meeting user-to-user/search definitions and services publishing pornography, but not every standalone chatbot.","regime":"gb","jurisdiction":"GB","instrument_short":"Online Safety Act","cite":"Online Safety Act OSA 2023 ss. 79–81","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-GB-DUAA-138-66E","instrument":"gb-duaa-intimate-images","article":"DUAA 2025 s. 138 (SOA 2003 ss. 66E–66F)","title":"Do not create or request non-consensual purported intimate images","plain":"In England and Wales, a person commits an offence by intentionally creating a purported intimate image of an adult without consent and without a reasonable belief in consent, or by intentionally requesting its creation on the same basis. The offence covers qualifying synthetic images; the Act defines the image and provides a reasonable-excuse defence.","applies_to":{"roles":["any"],"uses":["deepfake","generated-media"],"conditions":"The offences apply to adults and extend to England and Wales only; the Act's section 138 offences do not extend to Scotland. A narrow statutory exception applies to certain edits of an existing image."},"applies_from":"2026-02-06","status":"applicable","controls":["prohibited_practices_screen","content_moderation"],"evidence":["Product and use-case controls against creating or requesting non-consensual intimate imagery","Records of abuse reports and actions taken to prevent or respond to prohibited use"],"source_url":"https://www.legislation.gov.uk/ukpga/2025/18/section/138","confidence":"high","notes":"Section 141(5)(c) limits the new offences to England and Wales. Scotland had consulted on possible equivalent offences in 2026; this file does not treat that proposal as law.","regime":"gb","jurisdiction":"GB","instrument_short":"Non-consensual purported intimate images","cite":"Non-consensual purported intimate images DUAA 2025 s. 138 (SOA 2003 ss. 66E–66F)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-GB-CPA26-99-66I","instrument":"gb-cpa26-image-generators","article":"CPA 2026 s. 99 (SOA 2003 s. 66I)","title":"Do not make or supply purported intimate-image generators","plain":"It is an offence to make or adapt, or supply or offer to supply, a thing for use as a generator of purported intimate images. “Thing” includes a program, electronic information or a service; a defence is available for taking all reasonable steps to prevent non-consensual use.","applies_to":{"roles":["provider","developer","any"],"uses":["deepfake","generated-media"],"conditions":"The substantive offence applies in England and Wales. Section 99(5) separately extends the extraterritorial application rule to UK-incorporated bodies and associations; ordinary internet-service-provider safe harbours also apply."},"applies_from":"2026-06-29","status":"applicable","controls":["prohibited_practices_screen","risk_management"],"evidence":["Design-purpose review and access controls for image-generation features","Documented safeguards and abuse-testing showing reasonable steps to prevent non-consensual use"],"source_url":"https://www.legislation.gov.uk/ukpga/2026/20/section/99","confidence":"high","notes":"Scotland's adult creation offence was not enacted by the cutoff; the Scottish Government consulted on possible offences in 2026. Section 99's general offence is E&W; subsection (5) concerns extraterritorial application for UK bodies.","regime":"gb","jurisdiction":"GB","instrument_short":"Intimate-image and child-abuse-image generator offences","cite":"Intimate-image and child-abuse-image generator offences CPA 2026 s. 99 (SOA 2003 s. 66I)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-GB-CPA26-72-74","instrument":"gb-cpa26-image-generators","article":"CPA 2026 ss. 72 and 74 (SOA 2003 s. 46A; Civic Government (Scotland) Act 1982 s. 52D)","title":"Do not make, possess or supply child sexual-abuse image generators","plain":"The enacted provisions create offences involving making or adapting, possessing, supplying or offering to supply a thing made for creating or facilitating child sexual-abuse images. “Thing” includes a program, electronic information or a service. The England-and-Wales and Scotland provisions had not been commenced by 4 November 2026.","applies_to":{"roles":["provider","developer","any"],"uses":["generated-media","deepfake","minors"],"conditions":"Section 72 is for England and Wales; section 74 is the separate Scottish provision. Both are enacted but remain prospective pending commencement regulations."},"applies_from":null,"status":"not-yet-applicable","controls":["prohibited_practices_screen","content_moderation"],"evidence":["Prohibited-use controls and testing for child sexual-abuse image generation","Records of measures to prevent creation, possession or supply of generator tools for this use"],"source_url":"https://www.legislation.gov.uk/ukpga/2026/20/section/72","confidence":"high","notes":"Do not treat these provisions as operative duties before their commencement. Existing child-abuse-image offences may independently apply to synthetic material.","regime":"gb","jurisdiction":"GB","instrument_short":"Intimate-image and child-abuse-image generator offences","cite":"Intimate-image and child-abuse-image generator offences CPA 2026 ss. 72 and 74 (SOA 2003 s. 46A; Civic Government (Scotland) Act 1982 s. 52D)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-GB-ATRS-SCOPE","instrument":"gb-atrs","article":"ATRS mandatory scope and exemptions policy","title":"Publish transparency records for in-scope central-government tools","plain":"Central-government departments and specified arm’s-length bodies must publish an ATRS record for algorithmic tools in beta/pilot or production that significantly influence public-effect decisions or directly interact with the public. The policy is broader than AI and is not a statute; other public-sector bodies are encouraged, not required, to use ATRS.","applies_to":{"roles":["public-body"],"uses":["public-sector-use","chatbot","significant-decision"],"conditions":"Mandatory only for ministerial and non-ministerial departments and ALBs providing public/frontline services or routinely interacting with the public; sensitive information may be withheld under the policy."},"applies_from":"2024-02-06","status":"applicable","controls":["transparency_notice","audit_log"],"evidence":["Published ATRS record for every in-scope algorithmic tool, including a public-facing chatbot","Scope assessment and documented reasons for any exemption or redaction"],"source_url":"https://www.gov.uk/government/publications/algorithmic-transparency-recording-standard-mandatory-scope-and-exemptions-policy/algorithmic-transparency-recording-standard-atrs-mandatory-scope-and-exemptions-policy","confidence":"high","notes":"This is a mandatory cross-government policy for its defined central-government scope, not an enacted statutory duty or a general requirement for all public bodies.","regime":"gb","jurisdiction":"GB","instrument_short":"ATRS","cite":"ATRS mandatory scope and exemptions policy","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-GB-AICSCOP-BASELINE","instrument":"gb-ai-cyber-code","article":"AI Cyber Security Code of Practice, Principles 1–13","title":"Use the voluntary AI cyber-security baseline","plain":"The government code recommends lifecycle cyber-security measures for AI developers and operators, including secure design and supply chains, risk assessment, access controls, documentation, testing, incident response, updates and end-of-life practices. It is voluntary and is not a statutory duty.","applies_to":{"roles":["provider","developer","deployer"],"uses":["any-ai","generated-media","agent","frontier-model"]},"applies_from":"2025-01-31","status":"voluntary","controls":["security_testing","risk_management","technical_documentation","human_oversight"],"evidence":["AI security threat and risk assessment, access-control and supply-chain records","Testing, patching, incident-response and end-of-life plans"],"source_url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","confidence":"high","notes":"The voluntary code was published by DSIT with NCSC collaboration. The UK AI Safety Institute was renamed the AI Security Institute on 14 February 2025; it is a research institute, not a regulator or a separate binding code.","regime":"gb","jurisdiction":"GB","instrument_short":"AI Cyber Security Code of Practice","cite":"AI Cyber Security Code of Practice, Principles 1–13","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-IN-AIGG-1","instrument":"in-ai-guidelines","article":"India AI Governance Guidelines, Parts 1–4","title":"Use the voluntary India AI governance principles and practices","plain":"The Guidelines set out seven principles, recommendations across six governance pillars, an action plan and proposed institutional coordination and technical-support arrangements. They recommend that AI developers and deployers comply with existing Indian laws and voluntarily adopt measures such as risk mitigation, transparency, grievance redressal and responsible-AI practices; they do not create binding duties or a new horizontal AI law.","applies_to":{"roles":["provider","deployer","developer","public-body"],"uses":["any-ai"],"conditions":"Guidance for people and organisations developing or deploying AI in India; the recommendations are voluntary."},"applies_from":"2025-11-05","status":"voluntary","controls":["risk_management","impact_assessment","transparency_notice"],"evidence":["Internal responsible-AI policy mapping voluntary principles to owners and product processes","Risk or transparency report and an accessible AI-harm grievance channel"],"source_url":"https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc2025115685601.pdf","confidence":"high","notes":"The official Guidelines describe voluntary measures as optional and lacking legal enforceability or punitive action; sectoral statutes and rules remain binding independently.","regime":"in","jurisdiction":"IN","instrument_short":"India AI Governance Guidelines","cite":"India AI Governance Guidelines, Parts 1–4","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-IN-ITR-3-3-A-I-II","instrument":"in-it-rules","article":"Rule 3(3)(a)(i)–(ii) and Rule 3(3)(b)","title":"Prevent unlawful synthetic media and label other synthetic information","plain":"Intermediaries offering a computer resource that can enable creation or dissemination of synthetically generated information (SGI) must use reasonable and appropriate technical measures to prevent SGI that violates applicable law. Other SGI must carry a prominent visible label, or a prefixed disclosure for audio, and, to the extent technically feasible, permanent metadata or another provenance mechanism including a unique identifier; intermediaries must not enable removal or suppression of those labels or markers.","applies_to":{"roles":["platform"],"uses":["generated-media","deepfake"],"conditions":"Only intermediaries whose computer resources may enable, permit or facilitate creation, generation, modification, alteration, publication, transmission, sharing or dissemination of SGI."},"applies_from":"2026-02-20","status":"applicable","controls":["content_marking","deepfake_label","content_moderation"],"evidence":["Technical controls and test results for blocking unlawful SGI and applying visible or audio labels","Provenance/identifier implementation record and tests showing labels and metadata cannot be removed through the service"],"source_url":"https://www.meity.gov.in/static/uploads/2026/03/0b576f2071694b52e4cd6bb1b6dfab1e.pdf","confidence":"high","notes":"Rule 2(1)(wa) limits SGI to audio, visual or audio-visual information that appears real or authentic and depicts a person or event in a way likely to be perceived as indistinguishable from a natural person or real-world event. It excludes specified routine good-faith editing, document preparation and accessibility operations. Rule 3(1)(cb) separately requires expeditious and appropriate action when the intermediary becomes aware of covered contravening SGI.","regime":"in","jurisdiction":"IN","instrument_short":"IT Intermediary Rules","cite":"IT Intermediary Rules Rule 3(3)(a)(i)–(ii) and Rule 3(3)(b)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-IN-ITR-4-1-A","instrument":"in-it-rules","article":"Rule 4(1A)","title":"Verify synthetic-media declarations before SSMI publication","plain":"Before permitting information to be displayed, uploaded or published, a significant social media intermediary (SSMI) must require users to declare whether it is SGI and deploy appropriate technical measures, including automated tools, to verify the declaration in light of the content’s nature, format and source. If a declaration or verification confirms SGI, the intermediary must clearly and prominently label it; knowingly permitting, promoting or failing to act on SGI in contravention of the Rules is deemed a failure of due diligence.","applies_to":{"roles":["platform"],"uses":["generated-media","deepfake"],"conditions":"Only SSMIs as defined by Rule 2(1)(v) that enable display, upload or publication of information on their computer resources."},"applies_from":"2026-02-20","status":"applicable","controls":["content_marking","content_moderation","audit_log"],"evidence":["Pre-publication user-declaration flow and technical verification test records","Examples of prominently labelled confirmed SGI and audit trail of moderation decisions"],"source_url":"https://www.meity.gov.in/static/uploads/2026/03/0b576f2071694b52e4cd6bb1b6dfab1e.pdf","confidence":"high","regime":"in","jurisdiction":"IN","instrument_short":"IT Intermediary Rules","cite":"IT Intermediary Rules Rule 4(1A)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-IN-ITR-3-1-D","instrument":"in-it-rules","article":"Rule 3(1)(d)","title":"Act on specified unlawful-content orders within three hours","plain":"When an intermediary receives actual knowledge of unlawful information through an order of a competent court or a written, reasoned intimation from an authorised government officer or agency, it must remove or disable access to the specified information within three hours.","applies_to":{"roles":["platform"],"uses":["any-ai","generated-media","deepfake"],"conditions":"Applies to covered unlawful information hosted, displayed, published, transmitted or stored on the intermediary’s computer resource; actual knowledge must arise by the channels specified in the Rule."},"applies_from":"2026-02-20","status":"applicable","controls":["content_moderation","audit_log"],"evidence":["Intake and escalation procedure recording receipt time, legal authority, decision and completion time","Takedown log showing action within the three-hour deadline"],"source_url":"https://www.meity.gov.in/static/uploads/2026/03/0b576f2071694b52e4cd6bb1b6dfab1e.pdf","confidence":"high","regime":"in","jurisdiction":"IN","instrument_short":"IT Intermediary Rules","cite":"IT Intermediary Rules Rule 3(1)(d)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-IN-ITR-3-2-B","instrument":"in-it-rules","article":"Rule 3(2)(b)","title":"Remove specified intimate or impersonating content within two hours of complaint","plain":"On a complaint by an individual, or someone acting on the individual’s behalf, about content prima facie exposing private areas, showing nudity or sexual conduct, or impersonating the individual electronically (including artificially morphed images), an intermediary must take reasonable and practicable measures to remove or disable access within two hours.","applies_to":{"roles":["platform"],"uses":["generated-media","deepfake"],"conditions":"Includes content hosted, stored, published or transmitted by the intermediary; the complaint must concern one of the categories enumerated in Rule 3(2)(b)."},"applies_from":"2026-02-20","status":"applicable","controls":["content_moderation"],"evidence":["Complaint intake timestamps and two-hour removal/disablement records","Procedure for preserving relevant evidence after action"],"source_url":"https://www.meity.gov.in/static/uploads/2026/03/0b576f2071694b52e4cd6bb1b6dfab1e.pdf","confidence":"high","regime":"in","jurisdiction":"IN","instrument_short":"IT Intermediary Rules","cite":"IT Intermediary Rules Rule 3(2)(b)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-IN-ITR-3-2-A-I","instrument":"in-it-rules","article":"Rule 3(2)(a)(i)","title":"Resolve intermediary grievances within seven days","plain":"Intermediaries must acknowledge a grievance within 24 hours and resolve it within seven days of receipt. Specified requests to remove information or links under Rule 3(1)(b), subject to the listed exceptions, must be handled as expeditiously as possible and resolved within 36 hours.","applies_to":{"roles":["platform"],"uses":["any-ai","generated-media","deepfake"],"conditions":"Grievances concern violations of the Rules or other matters pertaining to the intermediary’s computer resources."},"applies_from":"2026-02-20","status":"applicable","controls":["content_moderation","audit_log"],"evidence":["Grievance workflow timestamps for acknowledgement, resolution and any 36-hour category","Complaint-resolution records and escalation procedures"],"source_url":"https://www.meity.gov.in/static/uploads/2026/03/0b576f2071694b52e4cd6bb1b6dfab1e.pdf","confidence":"high","regime":"in","jurisdiction":"IN","instrument_short":"IT Intermediary Rules","cite":"IT Intermediary Rules Rule 3(2)(a)(i)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-IN-DPDPA-4-6","instrument":"in-dpdp-act","article":"Sections 4, 5 and 6","title":"Use a lawful basis and give notice before requesting consent","plain":"Personal data may be processed only for a lawful purpose on consent or a permitted legitimate-use basis. Before seeking consent, the Data Fiduciary must give notice describing the personal data and purpose and how the person may exercise rights and complain; consent must be free, specific, informed, unconditional and unambiguous, limited to data necessary for the specified purpose, and given by clear affirmative action.","applies_to":{"roles":["any"],"uses":["any-ai"],"conditions":"Applies to Data Fiduciaries processing digital personal data in India, including data collected digitally or later digitised, and certain processing outside India connected with offering goods or services to Data Principals in India; statutory exclusions and permitted legitimate uses apply."},"applies_from":"2027-05-13","status":"not-yet-applicable","controls":["privacy_compliance","transparency_notice","user_controls"],"evidence":["Data inventory and documented lawful-purpose/consent analysis for AI processing","Versioned privacy notices and consent/withdrawal records"],"source_url":"https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf","confidence":"high","notes":"Sections 3–6 are among the Act provisions scheduled to commence after eighteen months under G.S.R. 843(E), not on enactment in 2023.","regime":"in","jurisdiction":"IN","instrument_short":"DPDP Act","cite":"DPDP Act Sections 4, 5 and 6","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-IN-DPDPA-8","instrument":"in-dpdp-act","article":"Section 8(1)–(7); DPDP Rules 6 and 7","title":"Govern processors, safeguard personal data and notify breaches","plain":"A Data Fiduciary remains responsible for its own processing and processing on its behalf, may engage a Data Processor only under a valid contract, and must implement technical and organisational measures, protect personal data with reasonable security safeguards and notify the Board and affected people of breaches. Rules 6 and 7 specify safeguards such as access controls, logs, backups and processor-contract terms, prompt notice to affected people, and an initial Board intimation without delay followed by detailed information within 72 hours unless the Board allows longer.","applies_to":{"roles":["any"],"uses":["any-ai"],"conditions":"Applies to Data Fiduciaries processing digital personal data within the Act’s territorial scope."},"applies_from":"2027-05-13","status":"not-yet-applicable","controls":["privacy_compliance","audit_log","incident_reporting"],"evidence":["Data-processor contracts, security-control records, access logs and backup/retention settings","Breach response runbook and records of notices to the Board and affected Data Principals"],"source_url":"https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf","confidence":"high","notes":"Rules 6 and 7 operationalise the safeguards and breach-intimation requirements; the official Rules text is listed in sources. The Rules’ 18-month phase-in is confirmed in Rule 1(4).","regime":"in","jurisdiction":"IN","instrument_short":"DPDP Act","cite":"DPDP Act Section 8(1)–(7); DPDP Rules 6 and 7","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-IN-DPR-13","instrument":"in-dpdp-rules","article":"DPDP Act section 10(2); DPDP Rules 13(1)–(4)","title":"Significant Data Fiduciaries must assess and audit data and algorithms","plain":"A notified Significant Data Fiduciary must appoint an India-based Data Protection Officer and an independent data auditor; Rule 13 requires a Data Protection Impact Assessment and audit at least every 12 months, with significant observations reported to the Board. It must also use due diligence to verify that its technical measures, including algorithmic software used for the listed personal-data operations, are not likely to risk Data Principals’ rights; any localisation condition applies only to personal data specified by the Central Government.","applies_to":{"roles":["any"],"uses":["any-ai"],"conditions":"Only a Data Fiduciary or class of Data Fiduciaries formally notified as significant under section 10 and processing digital personal data."},"applies_from":"2027-05-13","status":"not-yet-applicable","controls":["impact_assessment","privacy_compliance","risk_management"],"evidence":["Notification status, India-based DPO and independent-auditor appointment records","Annual DPIA/audit reports and algorithmic due-diligence assessment submitted or available to the Board"],"penalty":"Up to INR 150 crore for breach of additional Significant Data Fiduciary obligations (section 33 and Schedule).","source_url":"https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf","confidence":"high","notes":"Section 10 and Rule 13 are in the 18-month phase beginning 2027-05-13. The Act’s section 10 provides the DPO, auditor and periodic-DPIA framework; Rule 13 prescribes annual cadence and algorithmic due diligence.","regime":"in","jurisdiction":"IN","instrument_short":"DPDP Rules","cite":"DPDP Act section 10(2); DPDP Rules 13(1)–(4)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-JP-AIPA-7","instrument":"jp-ai-act","article":"Art. 7","title":"Cooperate with national and local AI measures","plain":"Utilization business operators must cooperate with measures taken by the national and local governments under Articles 4 and 5. They need only endeavor to use AI actively to improve business efficiency and advancement and create new industries.","applies_to":{"roles":["provider","developer","deployer"],"uses":["any-ai"],"conditions":"People developing or providing AI-enabled products or services, or using AI in business activities."},"applies_from":"2025-06-04","status":"applicable","controls":["risk_management"],"evidence":["Records of cooperation with applicable national or local government AI measures","Internal record identifying the entity's AI business activities"],"source_url":"https://www.japaneselawtranslation.go.jp/en/laws/view/5066/je","confidence":"high","notes":"The Act has no penalties chapter. Article 16 allows government research, guidance, advice, information provision and other measures; Article 7 does not set a detailed AI risk-management checklist.","regime":"jp","jurisdiction":"JP","instrument_short":"AI Promotion Act","cite":"AI Promotion Act Art. 7","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-JP-AIBP-PLAN","instrument":"jp-ai-plan","article":"Second AI Basic Plan, Chapters 1-4","title":"Follow Japan's current government AI strategy","plain":"The Cabinet's second plan sets government policy across AI adoption, development capabilities, AI governance and an AI-powered society, with implementation and follow-up arrangements. It is a government strategy, not a direct compliance duty for private AI operators.","applies_to":{"roles":["public-body"],"uses":["public-sector-use"],"conditions":"Government policy commitment under Article 18 of the AI Promotion Act; no direct private-sector obligation."},"applies_from":"2026-07-14","status":"voluntary","controls":["risk_management"],"evidence":["Public implementation and follow-up materials for the plan"],"source_url":"https://www8.cao.go.jp/cstp/ai/ai_plan/aiplan_eng_20260714.pdf","confidence":"high","notes":"The English text is a provisional translation; the Cabinet Office index confirms the 14 July 2026 Cabinet decision.","regime":"jp","jurisdiction":"JP","instrument_short":"Second AI Basic Plan","cite":"Second AI Basic Plan, Chapters 1-4","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-JP-AIGB-C1","instrument":"jp-ai-guidelines","article":"Part 2.C.1","title":"Keep AI human-centric","plain":"The voluntary guidelines recommend respecting human dignity and autonomy when developing, providing or using AI, and taking steps against manipulation and automation bias. They also call for user support appropriate to the system and context.","applies_to":{"roles":["provider","developer","deployer","public-body"],"uses":["any-ai"],"conditions":"Nonbinding soft-law recommendations for AI business actors, including public institutions."},"applies_from":"2026-03-31","status":"voluntary","controls":["human_oversight","transparency_notice"],"evidence":["Human-impact review and human intervention procedures for relevant AI use cases"],"source_url":"https://www.meti.go.jp/shingikai/mono_info_service/ai_shakai_jisso/pdf/20260331_12.pdf","confidence":"medium","notes":"Official English PDF is a provisional translation; refer to the Japanese text for accuracy.","regime":"jp","jurisdiction":"JP","instrument_short":"AI Guidelines for Business Ver1.2","cite":"AI Guidelines for Business Ver1.2 Part 2.C.1","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-JP-AIGB-C2","instrument":"jp-ai-guidelines","article":"Part 2.C.2","title":"Assess and manage AI safety risks","plain":"The guidelines recommend checking reliability, robustness and controllability, analyzing risks, and taking proportionate measures throughout development, provision and use. They also recommend defining responses for cases where AI safety is endangered.","applies_to":{"roles":["provider","developer","deployer","public-body"],"uses":["any-ai"],"conditions":"Voluntary, risk-based guidance for AI business actors, including public institutions."},"applies_from":"2026-03-31","status":"voluntary","controls":["risk_management","accuracy_robustness","human_oversight"],"evidence":["Risk analysis, safety testing and response procedures proportionate to the use case"],"source_url":"https://www.meti.go.jp/shingikai/mono_info_service/ai_shakai_jisso/pdf/20260331_12.pdf","confidence":"medium","notes":"Official English PDF is a provisional translation; refer to the Japanese text for accuracy.","regime":"jp","jurisdiction":"JP","instrument_short":"AI Guidelines for Business Ver1.2","cite":"AI Guidelines for Business Ver1.2 Part 2.C.2","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-JP-AIGB-C4","instrument":"jp-ai-guidelines","article":"Part 2.C.4","title":"Protect privacy throughout the AI lifecycle","plain":"The guidelines recommend observing applicable privacy laws and adopting privacy measures based on the use context and people's reasonable expectations. They also recommend a privacy policy and privacy-by-design measures appropriate to the AI system.","applies_to":{"roles":["provider","developer","deployer","public-body"],"uses":["any-ai"],"conditions":"Voluntary guidance; applicable personal-information laws remain binding independently."},"applies_from":"2026-03-31","status":"voluntary","controls":["privacy_compliance","data_governance"],"evidence":["Privacy policy and records of privacy-by-design review"],"source_url":"https://www.meti.go.jp/shingikai/mono_info_service/ai_shakai_jisso/pdf/20260331_12.pdf","confidence":"medium","notes":"Official English PDF is a provisional translation; refer to the Japanese text for accuracy.","regime":"jp","jurisdiction":"JP","instrument_short":"AI Guidelines for Business Ver1.2","cite":"AI Guidelines for Business Ver1.2 Part 2.C.4","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-JP-AIGB-C5","instrument":"jp-ai-guidelines","article":"Part 2.C.5","title":"Secure AI systems and services","plain":"The guidelines recommend reasonable security measures suited to the technology and its lifecycle, including attention to system connections, vulnerabilities and current attack methods. The guidance does not replace binding cybersecurity or sectoral rules.","applies_to":{"roles":["provider","developer","deployer","public-body"],"uses":["any-ai"],"conditions":"Voluntary guidance for AI business actors, including public institutions."},"applies_from":"2026-03-31","status":"voluntary","controls":["security_testing"],"evidence":["Security testing and documented remediation of relevant AI system vulnerabilities"],"source_url":"https://www.meti.go.jp/shingikai/mono_info_service/ai_shakai_jisso/pdf/20260331_12.pdf","confidence":"medium","notes":"Official English PDF is a provisional translation; refer to the Japanese text for accuracy.","regime":"jp","jurisdiction":"JP","instrument_short":"AI Guidelines for Business Ver1.2","cite":"AI Guidelines for Business Ver1.2 Part 2.C.5","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-JP-AIGB-C6","instrument":"jp-ai-guidelines","article":"Part 2.C.6","title":"Provide proportionate information about AI","plain":"The guidelines recommend making AI systems verifiable and providing stakeholders with information about AI use, capabilities, limitations, risks and appropriate use, to a reasonable extent that is technically possible. They also recommend keeping relevant process and decision logs where possible.","applies_to":{"roles":["provider","developer","deployer","public-body"],"uses":["any-ai"],"conditions":"Voluntary recommendations; disclosure should reflect the social context and system purpose."},"applies_from":"2026-03-31","status":"voluntary","controls":["transparency_notice","audit_log"],"evidence":["Stakeholder-facing system information and relevant decision or operation logs"],"source_url":"https://www.meti.go.jp/shingikai/mono_info_service/ai_shakai_jisso/pdf/20260331_12.pdf","confidence":"medium","notes":"Official English PDF is a provisional translation; refer to the Japanese text for accuracy.","regime":"jp","jurisdiction":"JP","instrument_short":"AI Guidelines for Business Ver1.2","cite":"AI Guidelines for Business Ver1.2 Part 2.C.6","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-JP-AIGB-C7","instrument":"jp-ai-guidelines","article":"Part 2.C.7","title":"Document AI accountability","plain":"The guidelines recommend traceability of data and decisions, assigning a responsible person, clarifying shared responsibilities, explaining conformity to the common principles and documenting relevant information. The scope of these steps should reflect the actor's role and the system's risks.","applies_to":{"roles":["provider","developer","deployer","public-body"],"uses":["any-ai"],"conditions":"Voluntary accountability recommendations for AI business actors, including public institutions."},"applies_from":"2026-03-31","status":"voluntary","controls":["audit_log","technical_documentation","risk_management"],"evidence":["Named accountability owner, responsibility allocation and governance records"],"source_url":"https://www.meti.go.jp/shingikai/mono_info_service/ai_shakai_jisso/pdf/20260331_12.pdf","confidence":"medium","notes":"Official English PDF is a provisional translation; refer to the Japanese text for accuracy.","regime":"jp","jurisdiction":"JP","instrument_short":"AI Guidelines for Business Ver1.2","cite":"AI Guidelines for Business Ver1.2 Part 2.C.7","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-KR-AIBA-31-1","instrument":"kr-aiba","article":"Art. 31(1); Enforcement Decree Art. 23(1), (4)","title":"Tell users in advance when a service uses generative or high-impact AI","plain":"An AI business operator providing a product or service using generative or high-impact AI must notify users in advance that the product or service is operated using that AI. The Decree permits several notice methods and provides exceptions, including where AI use is evident, use is solely for the operator's internal business, or the Minister designates an exception.","applies_to":{"roles":["provider","deployer"],"uses":["any-ai"],"conditions":"Products or services using generative AI or high-impact AI; the Decree's exceptions apply."},"applies_from":"2026-01-22","status":"applicable","controls":["ai_disclosure"],"evidence":["User-facing notice text, screenshots, or service-flow recording showing advance notice","Documented exception analysis where the operator relies on a Decree exception"],"penalty":"Up to KRW 30 million administrative fine under Article 43(1)(1); MSIT announced that penalties are deferred during an enforcement grace period of at least one year, subject to highly exceptional cases.","source_url":"https://www.law.go.kr/LSW/eng/engLsInfoR.do?lsiSeq=268543","confidence":"high","notes":"The Act applies to conduct outside Korea that affects the Korean market or users (Art. 4(1)). The English text is an official aid to understanding, not legally authoritative; current Korean consolidated text is at the instrument official_url.","regime":"kr","jurisdiction":"KR","instrument_short":"AI Basic Act","cite":"AI Basic Act Art. 31(1); Enforcement Decree Art. 23(1), (4)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-KR-AIBA-31-2","instrument":"kr-aiba","article":"Art. 31(2); Enforcement Decree Art. 23(2), (4)","title":"Identify outputs generated by generative AI","plain":"An AI business operator providing generative AI or a product or service using it must indicate that the output was generated by generative AI. The Decree permits human-perceptible or machine-readable indications; a machine-readable indication must be accompanied at least once by text, voice, or another means telling users that the content was AI-generated.","applies_to":{"roles":["provider","deployer"],"uses":["generated-media","deepfake"],"conditions":"Covers generative-AI outputs; Decree exceptions may apply, including evident AI use and solely internal business use."},"applies_from":"2026-01-22","status":"applicable","controls":["content_marking"],"evidence":["Output examples and a record of the visible or machine-readable indication method","Detection or user-interface test showing the indication can be perceived as required"],"penalty":"No standalone administrative fine is specified for Article 31(2); MSIT may investigate and order correction, and failure to comply with a corrective order can incur up to KRW 30 million under Article 43(1)(3). MSIT announced a minimum one-year enforcement grace.","source_url":"https://www.law.go.kr/LSW/lsInfoP.do?lsiSeq=288781","confidence":"high","notes":"A machine-readable marker alone is not enough under Decree Art. 23(2); users must also be told at least once by text, voice, or a similar means. The English translation's rendering of the compute exponent is imperfect, but this output-marking clause is legible in the official text.","regime":"kr","jurisdiction":"KR","instrument_short":"AI Basic Act","cite":"AI Basic Act Art. 31(2); Enforcement Decree Art. 23(2), (4)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-KR-AIBA-31-3","instrument":"kr-aiba","article":"Art. 31(3); Enforcement Decree Art. 23(3), (4)","title":"Clearly label realistic synthetic audio, images, and video","plain":"If an operator provides AI-generated virtual sound, images, or video that are difficult to distinguish from real content, it must notify or label users so they can clearly recognize that the content was generated by AI. For artistic or creative work, the label may be presented in a way that does not hinder its exhibition or enjoyment; the Decree requires recognition by visual, auditory, or software means and consideration of the primary users' age and circumstances.","applies_to":{"roles":["provider","deployer"],"uses":["deepfake","generated-media"],"conditions":"AI-generated virtual sound, images, or video difficult to distinguish from real content; Decree exceptions may apply."},"applies_from":"2026-01-22","status":"applicable","controls":["deepfake_label"],"evidence":["Examples of user-facing labels or notices on realistic synthetic media","Test record showing users can recognize the label through the relevant mode"],"penalty":"No standalone administrative fine is specified for Article 31(3); investigation and corrective-order powers apply, with up to KRW 30 million for failure to comply with an order. MSIT announced a minimum one-year enforcement grace.","source_url":"https://www.law.go.kr/LSW/lsInfoP.do?lsiSeq=288781","confidence":"high","notes":"The artistic/creative-work language allows a presentation that does not hinder exhibition or enjoyment; it does not remove the requirement to disclose or label.","regime":"kr","jurisdiction":"KR","instrument_short":"AI Basic Act","cite":"AI Basic Act Art. 31(3); Enforcement Decree Art. 23(3), (4)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-KR-AIBA-32","instrument":"kr-aiba","article":"Art. 32(1)-(3); Enforcement Decree Art. 24","title":"Manage lifecycle safety risks for qualifying advanced AI systems","plain":"For an AI system meeting the Decree's cumulative training-compute threshold, the operator must identify, assess, and mitigate risks throughout the lifecycle, maintain a risk-management system to monitor and respond to AI safety incidents, and submit implementation results to MSIT. The Decree requires all criteria together: at least 10^26 floating-point operations for training, use of the most advanced AI technology then in use, and a likelihood of widespread and significant effects on life, physical safety, or fundamental rights.","applies_to":{"roles":["provider","deployer"],"uses":["frontier-model"],"conditions":"All three Decree Art. 24 criteria must be met; the compute threshold alone does not trigger the duties."},"applies_from":"2026-01-22","status":"applicable","controls":["risk_management","incident_reporting"],"evidence":["Training-compute calculation and written assessment of the other two Decree criteria","Lifecycle risk and incident-management records, plus submitted results to MSIT"],"penalty":"No standalone administrative fine is specified for Article 32; MSIT may investigate and order correction, and failure to comply with a corrective order can incur up to KRW 30 million under Article 43(1)(3). MSIT announced a minimum one-year enforcement grace.","source_url":"https://www.law.go.kr/LSW/lsInfoP.do?lsiSeq=288781","confidence":"high","notes":"The compute number is stated as 10^26 FLOPs in MSIT's official English description of Decree Art. 24. The official English Decree rendering has an exponent/OCR issue; use the current Korean Decree and MSIT's description, and do not treat compute alone as sufficient.","regime":"kr","jurisdiction":"KR","instrument_short":"AI Basic Act","cite":"AI Basic Act Art. 32(1)-(3); Enforcement Decree Art. 24","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-KR-AIBA-33","instrument":"kr-aiba","article":"Art. 33(1)-(4); Enforcement Decree Art. 25","title":"Review whether a system is high-impact AI before providing it","plain":"When providing AI or a product or service using it, an AI business operator must review in advance whether the system qualifies as high-impact AI. If classification is uncertain, the operator may request confirmation from the Minister of Science and ICT; the Decree specifies the request materials and a response period of 30 days, extendable once by up to 30 days.","applies_to":{"roles":["provider","deployer"],"uses":["any-ai"],"conditions":"Applies where AI is provided, including systems used in statutory areas that may significantly affect or pose risk to life, physical safety, or fundamental rights."},"applies_from":"2026-01-22","status":"applicable","controls":["risk_management","technical_documentation"],"evidence":["Dated high-impact classification review, including the statutory domain and risk reasoning","Confirmation request and MSIT response, if the operator sought a determination"],"source_url":"https://www.law.go.kr/LSW/eng/engLsInfoR.do?lsiSeq=268543","confidence":"high","notes":"The Act's high-impact domains include energy, drinking water, health and medical services and devices, nuclear safety, criminal investigation or arrest biometrics, consequential hiring or loan judgments, transport, public-sector decisions, education, and any further domain prescribed by decree. The digital-medical-device portion took effect on 2026-01-24.","regime":"kr","jurisdiction":"KR","instrument_short":"AI Basic Act","cite":"AI Basic Act Art. 33(1)-(4); Enforcement Decree Art. 25","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-KR-AIBA-34","instrument":"kr-aiba","article":"Art. 34(1)-(3)","title":"Apply safety and trust measures to high-impact AI","plain":"An operator providing high-impact AI, or a product or service using it, must implement measures under the Decree that include a risk-management plan; technically feasible explanations of final outputs, main criteria, and an overview of training data; user-protection measures; human management and oversight; and records verifying the measures. Equivalent measures under other laws may be deemed to satisfy the duty as prescribed by the Decree.","applies_to":{"roles":["provider","deployer"],"uses":["any-ai"],"conditions":"Applies to high-impact AI or products or services using it; classification depends on statutory domains and risk criteria."},"applies_from":"2026-01-22","status":"applicable","controls":["risk_management","transparency_notice","human_oversight","technical_documentation"],"evidence":["Current risk, explanation, user-protection, and human-oversight plans","Records showing measures taken and any equivalent-measures basis relied upon"],"penalty":"No standalone administrative fine is specified for Article 34(1); MSIT may investigate and order correction, and failure to comply with a corrective order can incur up to KRW 30 million under Article 43(1)(3). MSIT announced a minimum one-year enforcement grace.","source_url":"https://www.law.go.kr/LSW/eng/engLsInfoR.do?lsiSeq=268543","confidence":"high","notes":"Explanations are required to the extent technically feasible. The statute delegates specific measures to the Enforcement Decree and MSIT notices/guidelines.","regime":"kr","jurisdiction":"KR","instrument_short":"AI Basic Act","cite":"AI Basic Act Art. 34(1)-(3)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-KR-AIBAD-27-1-2","instrument":"kr-aibad","article":"Enforcement Decree Art. 27(1)-(2); Act Art. 34(1)","title":"Publish key high-impact AI safeguards and retain evidence for five years","plain":"An operator must post the main contents of its risk-management, explanation, and user-protection measures, plus the name and contact details of the human supervisor, at its office or on its website. It must retain supporting documents for the Article 34 measures for five years; trade secrets may be omitted from the public posting, but the retention duty remains.","applies_to":{"roles":["provider","deployer"],"uses":["any-ai"],"conditions":"Applies to operators of high-impact AI or products or services using it."},"applies_from":"2026-01-22","status":"applicable","controls":["transparency_notice","human_oversight","technical_documentation","audit_log"],"evidence":["Website or premises copy of the published measures and supervisor contact details","Five-year retention schedule and supporting-document repository"],"penalty":"No standalone administrative fine is specified for a breach of Article 34 measures; MSIT may investigate and order correction, and failure to comply with a corrective order can incur up to KRW 30 million under Act Article 43(1)(3). MSIT announced a minimum one-year enforcement grace.","source_url":"https://www.law.go.kr/LSW/lsInfoP.do?lsiSeq=288781","confidence":"high","notes":"The Decree permits trade-secret material to be excluded from public posting. It also deems some measures implemented by an AI-using operator where the upstream system is received without significant functional change; see Decree Art. 27(3).","regime":"kr","jurisdiction":"KR","instrument_short":"AI Basic Act Enforcement Decree","cite":"AI Basic Act Enforcement Decree Enforcement Decree Art. 27(1)-(2); Act Art. 34(1)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-KR-AIBA-35-1","instrument":"kr-aiba","article":"Art. 35(1); Enforcement Decree Art. 28","title":"Endeavor to assess fundamental-rights impacts of high-impact AI","plain":"An operator providing products or services using high-impact AI must endeavor to assess in advance the impact on people's fundamental rights. The Decree lists assessment elements including affected people and rights, social and economic effects, use patterns, evaluation metrics, risk prevention or mitigation, loss recovery, and improvement plans.","applies_to":{"roles":["provider","deployer"],"uses":["any-ai"],"conditions":"The Act frames the operator's assessment duty as an effort duty; public bodies separately must prioritize products or services that have undergone an assessment."},"applies_from":"2026-01-22","status":"applicable","controls":["impact_assessment"],"evidence":["Completed or planned impact assessment with affected groups, rights, risks, and mitigations","Written rationale and action plan for any identified improvements"],"source_url":"https://www.law.go.kr/lsLinkCommonInfo.do?chrClsCd=010202&lsJoLnkSeq=1031810855","confidence":"high","notes":"Article 35(1) says the operator shall endeavor to assess; it is not a categorical duty to complete an assessment in every case.","regime":"kr","jurisdiction":"KR","instrument_short":"AI Basic Act","cite":"AI Basic Act Art. 35(1); Enforcement Decree Art. 28","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-KR-AIBA-35-1-VG","instrument":"kr-aiba","article":"Art. 35(1) second sentence; Enforcement Decree Art. 28(1)(1)","title":"Reflect AI-vulnerable groups in impact assessments","plain":"When an operator carries out an impact assessment for high-impact AI, the assessment must reflect the characteristics of AI-vulnerable groups, taking account of the nature of the product or service. The amended sentence took effect on 21 July 2026.","applies_to":{"roles":["provider","deployer"],"uses":["any-ai"],"conditions":"Applies when an operator performs the Article 35 impact assessment; the assessment must account for vulnerable-group characteristics in light of the product or service."},"applies_from":"2026-07-21","status":"applicable","controls":["impact_assessment"],"evidence":["Assessment materials identifying relevant vulnerable groups and how their characteristics were considered","Records linking assessment findings to mitigation or improvement measures"],"source_url":"https://www.law.go.kr/lsLinkCommonInfo.do?chrClsCd=010202&lsJoLnkSeq=1031810855","confidence":"high","notes":"The amendment was enacted by Act No. 21311 on 20 January 2026; this part became effective six months later, on 21 July 2026.","regime":"kr","jurisdiction":"KR","instrument_short":"AI Basic Act","cite":"AI Basic Act Art. 35(1) second sentence; Enforcement Decree Art. 28(1)(1)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-KR-AIBA-35-2","instrument":"kr-aiba","article":"Art. 35(2)","title":"Prefer high-impact AI products or services with impact assessments","plain":"When State agencies and other covered public institutions intend to use products or services using high-impact AI, they must give priority consideration to products or services that have undergone an impact assessment.","applies_to":{"roles":["public-body"],"uses":["public-sector-use"],"conditions":"Applies to covered State agencies, local governments, and public institutions procuring or using high-impact AI products or services."},"applies_from":"2026-01-22","status":"applicable","controls":["impact_assessment"],"evidence":["Procurement or use decision record showing how impact-assessed options received priority consideration"],"source_url":"https://www.law.go.kr/lsLinkCommonInfo.do?chrClsCd=010202&lsJoLnkSeq=1031810855","confidence":"high","regime":"kr","jurisdiction":"KR","instrument_short":"AI Basic Act","cite":"AI Basic Act Art. 35(2)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-KR-AIBA-36-1","instrument":"kr-aiba","article":"Art. 36(1)-(3); Enforcement Decree Art. 29","title":"Appoint a domestic agent when foreign-operator thresholds are met","plain":"An AI business operator without an address or place of business in Korea must designate a domestic agent in writing and report the designation to MSIT if it meets any Decree threshold: prior-year total revenue of at least KRW 1 trillion; prior-year AI-service revenue of at least KRW 10 billion; at least one million average daily domestic users over the preceding three months as of the previous year-end; or an administrative fine for failing to comply with a corrective order. The agent handles specified safety-result submissions, high-impact classification requests, and support for Article 34 measures; the operator is treated as responsible for the agent's related violations.","applies_to":{"roles":["provider","deployer"],"uses":["any-ai"],"conditions":"No Korean address or business office and at least one Article 29 threshold; the fourth trigger is a prior administrative fine under Act Article 43(1)(3)."},"applies_from":"2026-01-22","status":"applicable","controls":["local_representative","registration","technical_documentation"],"evidence":["Written domestic-agent appointment and report to MSIT","Annual threshold assessment covering revenue, AI-service revenue, Korean user counts, and any relevant fine"],"penalty":"Up to KRW 30 million administrative fine for failure to designate an agent under Article 43(1)(2); MSIT announced that penalties are deferred during an enforcement grace period of at least one year, subject to highly exceptional cases.","source_url":"https://www.law.go.kr/LSW/lsInfoP.do?lsiSeq=288781","confidence":"high","notes":"The decree includes an additional trigger for an operator fined for failure to comply with an MSIT corrective order. Revenue values for foreign operators are converted into Korean won using the prior-year average exchange rate.","regime":"kr","jurisdiction":"KR","instrument_short":"AI Basic Act","cite":"AI Basic Act Art. 36(1)-(3); Enforcement Decree Art. 29","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-SG-MGF20-2-7","instrument":"sg-mgf-2020","article":"§ 2.7","title":"Make AI decision processes explainable, fair and human-centric","plain":"The voluntary second-edition framework recommends explainable, transparent and fair AI decision-making, with human well-being and safety central to design, development and deployment. It is guidance, not a legal duty.","applies_to":{"roles":["provider","deployer"],"uses":["any-ai"],"conditions":"Organisations deploying AI should tailor the framework's recommendations to their risks and context."},"applies_from":"2020-01-21","status":"voluntary","controls":["transparency_notice","human_oversight","bias_testing"],"evidence":["Decision-process documentation and records of human-centered design and fairness review"],"source_url":"https://www.imda.gov.sg/-/media/imda/files/infocomm-media-landscape/sg-digital/tech-pillars/artificial-intelligence/second-edition-of-the-model-ai-governance-framework.pdf","confidence":"high","regime":"sg","jurisdiction":"SG","instrument_short":"Model AI Governance Framework (2020)","cite":"Model AI Governance Framework (2020) § 2.7","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-SG-MGFGAI-9D","instrument":"sg-mgf-genai","article":"Framework, nine dimensions","title":"Govern Generative AI across its lifecycle and ecosystem","plain":"The voluntary framework recommends an ecosystem approach spanning accountability, data, trusted development and deployment, incident reporting, testing and assurance, security, content provenance, safety and alignment research, and AI for public good. It creates no statutory compliance duty.","applies_to":{"roles":["provider","developer","deployer"],"uses":["generated-media","gpai-model"],"conditions":"Organizations across the Generative AI ecosystem; recommendations are voluntary."},"applies_from":"2024-05-30","status":"voluntary","controls":["risk_management","data_governance","incident_reporting","security_testing","content_marking"],"evidence":["Governance records showing lifecycle risk, testing, security, incident and provenance practices"],"source_url":"https://www.imda.gov.sg/About-IMDA/Emerging-Technologies-and-Research/Artificial-Intelligence","confidence":"high","notes":"IMDA's official 2024 annual report confirms the nine dimensions and the voluntary nature of its model frameworks.","regime":"sg","jurisdiction":"SG","instrument_short":"Generative AI Governance Framework (2024)","cite":"Generative AI Governance Framework (2024) Framework, nine dimensions","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-SG-AGENTIC-2-1","instrument":"sg-mgf-agentic","article":"Framework § 2.1","title":"Bound agent risks before deployment","plain":"The framework recommends assessing whether an agent use case is suitable, then limiting its access to tools and systems and defining its identity, permissions and scope of actions. The appropriate boundary should reflect the risk and reversibility of agent actions.","applies_to":{"roles":["provider","deployer","developer"],"uses":["agent"],"conditions":"Guidance for organizations developing agents in-house or deploying third-party agentic solutions."},"applies_from":"2026-01-22","status":"voluntary","controls":["risk_management","tool_scope"],"evidence":["Agent risk assessment, tool allowlist and permission-scope configuration"],"source_url":"https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf","confidence":"high","regime":"sg","jurisdiction":"SG","instrument_short":"Agentic AI Governance Framework","cite":"Agentic AI Governance Framework Framework § 2.1","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-SG-AGENTIC-2-2","instrument":"sg-mgf-agentic","article":"Framework § 2.2","title":"Assign accountable humans and approval checkpoints","plain":"The framework recommends clear allocation of responsibility across internal teams and external vendors, with meaningful human oversight. Significant checkpoints should require human approval, especially for high-stakes or irreversible agent actions.","applies_to":{"roles":["provider","deployer","developer","employer"],"uses":["agent"],"conditions":"Guidance for organizations developing or deploying agentic systems."},"applies_from":"2026-01-22","status":"voluntary","controls":["human_oversight","audit_log"],"evidence":["Named accountable owners, checkpoint rules and approval records for consequential actions"],"source_url":"https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf","confidence":"high","regime":"sg","jurisdiction":"SG","instrument_short":"Agentic AI Governance Framework","cite":"Agentic AI Governance Framework Framework § 2.2","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-SG-AGENTIC-2-3","instrument":"sg-mgf-agentic","article":"Framework § 2.3","title":"Test, monitor and log agent behavior","plain":"The framework recommends technical controls throughout the agent lifecycle, including pre-deployment testing and continuous monitoring and testing after deployment. It also recommends reporting and failsafe mechanisms for agent failures or unexpected behavior.","applies_to":{"roles":["provider","deployer","developer"],"uses":["agent"],"conditions":"Guidance for organizations developing or deploying agentic systems."},"applies_from":"2026-01-22","status":"voluntary","controls":["security_testing","audit_log","post_market_monitoring","kill_switch"],"evidence":["Pre-deployment test results, attributable action logs, monitoring records and agent-failure runbook"],"source_url":"https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf","confidence":"high","regime":"sg","jurisdiction":"SG","instrument_short":"Agentic AI Governance Framework","cite":"Agentic AI Governance Framework Framework § 2.3","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-SG-AGENTIC-2-4","instrument":"sg-mgf-agentic","article":"Framework § 2.4","title":"Inform and train agent end users","plain":"The framework recommends telling users about an agent's range of actions, its data access and the user's responsibilities. Organizations should consider training employees to manage human-agent interactions, provide effective oversight and retain relevant skills.","applies_to":{"roles":["deployer","employer"],"uses":["agent"],"conditions":"Guidance for organizations whose staff or customers interact with or integrate agents into work processes."},"applies_from":"2026-01-22","status":"voluntary","controls":["transparency_notice","ai_literacy"],"evidence":["User-facing notice of agent capabilities and training materials for staff"],"source_url":"https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf","confidence":"high","regime":"sg","jurisdiction":"SG","instrument_short":"Agentic AI Governance Framework","cite":"Agentic AI Governance Framework Framework § 2.4","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-SG-AIVERIFY-11","instrument":"sg-ai-verify","article":"Testing Framework, 11 governance principles","title":"Test AI systems against responsible-AI principles","plain":"AI Verify is an optional testing framework and software toolkit for assessing AI systems against 11 governance principles. It combines standardized tests for selected properties with process checks, and current IMDA materials describe coverage for both traditional AI and Generative AI.","applies_to":{"roles":["provider","deployer"],"uses":["any-ai"],"conditions":"Optional assurance tool; it is not a statutory certification requirement."},"applies_from":"2022-05-25","status":"voluntary","controls":["bias_testing","accuracy_robustness","security_testing","risk_management"],"evidence":["AI Verify assessment results and supporting test records"],"source_url":"https://www.imda.gov.sg/ai-verify","confidence":"high","regime":"sg","jurisdiction":"SG","instrument_short":"AI Verify","cite":"AI Verify Testing Framework, 11 governance principles","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-SG-EIOA-PEA-61MA-1","instrument":"sg-eioaa","article":"PEA § 61MA(1); PrEA § 42LA(1)","title":"Do not publish realistic false candidate representations in online election ads","plain":"During an election period, publishing or causing publication in Singapore of online election advertising with a digitally generated or manipulated audio, visual or audiovisual representation that realistically depicts a candidate saying or doing something they did not is an offence. The law contains specific exceptions, including private or domestic communications and publication of election news by an authorized news agency.","applies_to":{"roles":["any"],"uses":["deepfake","generated-media","justice"],"conditions":"Applies to relevant online election advertising published in Singapore during the election period, where the publisher knows or ought reasonably to know its election-advertising character."},"applies_from":"2025-01-22","status":"applicable","controls":["content_moderation"],"evidence":["Election-period content review and approval records for online political advertising"],"penalty":"Fine up to S$1,000, imprisonment up to 12 months, or both, on conviction.","source_url":"https://sso.agc.gov.sg/Acts-Supp/34-2024/Published/20241121?DocDate=20241121","confidence":"high","regime":"sg","jurisdiction":"SG","instrument_short":"Elections Integrity Amendment","cite":"Elections Integrity Amendment PEA § 61MA(1); PrEA § 42LA(1)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-SG-PDPA-13-18-20","instrument":"sg-pdpa","article":"PDPA §§ 13-20","title":"Establish a lawful basis and notify purposes for personal-data use","plain":"An organization must not collect, use or disclose personal data unless consent, deemed consent, an applicable exception or another law permits it. It must limit use to appropriate purposes and notify individuals as required; these duties apply when personal data is processed for AI development or deployment.","applies_to":{"roles":["provider","developer","deployer"],"uses":["any-ai"],"conditions":"An organization collects, uses or discloses personal data in an AI system or model."},"applies_from":"2014-07-02","status":"applicable","controls":["privacy_compliance","transparency_notice","user_controls"],"evidence":["Consent or exception records and notices that identify the purposes of AI-related personal-data processing"],"penalty":"PDPA directions and financial penalties may apply under section 48J; the applicable cap depends on the contravention and organization.","source_url":"https://sso.agc.gov.sg/Act/PDPA2012","confidence":"high","regime":"sg","jurisdiction":"SG","instrument_short":"PDPA","cite":"PDPA §§ 13-20","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-SG-PDPA-11-12-24-25","instrument":"sg-pdpa","article":"PDPA §§ 11-12, 24-25","title":"Maintain accountability, security and retention controls","plain":"Organizations must take responsibility for personal data under their control, maintain data-protection policies and practices, make reasonable security arrangements, and cease retaining personal data when retention is no longer necessary for legal or business purposes. These duties also apply to personal data used in AI systems.","applies_to":{"roles":["provider","developer","deployer"],"uses":["any-ai"],"conditions":"An organization holds or controls personal data processed in an AI context."},"applies_from":"2014-07-02","status":"applicable","controls":["privacy_compliance","data_governance","security_testing"],"evidence":["Data-protection policies, security controls and retention schedules for AI-related personal data"],"source_url":"https://sso.agc.gov.sg/Act/PDPA2012","confidence":"high","regime":"sg","jurisdiction":"SG","instrument_short":"PDPA","cite":"PDPA §§ 11-12, 24-25","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-SG-PDPCREC-9","instrument":"sg-pdpc-ai-rec","article":"Guidelines §§ 2.2, 3.1, 9.1-9.7 and 10","title":"Apply PDPC's advice to AI recommendation and decision systems","plain":"The nonbinding guidelines explain how the PDPA applies to personal data used to develop and deploy machine-learning systems that make recommendations, predictions or decisions. They recommend meaningful consent, contextual notices and proportionate transparency about relevant data use and safeguards.","applies_to":{"roles":["provider","developer","deployer"],"uses":["recommender","significant-decision","profiling"],"conditions":"Personal data is used in an AI recommendation, prediction or decision system; underlying PDPA duties remain binding."},"applies_from":"2024-03-01","status":"voluntary","controls":["privacy_compliance","transparency_notice","user_controls"],"evidence":["AI data-use assessment and consumer-facing notice describing relevant data and purposes"],"source_url":"https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/advisory-guidelines-on-the-use-of-personal-data-in-ai-recommendation-and-decision-systems.pdf","confidence":"high","notes":"PDPC states the guidelines are advisory and not legally binding; the PDPA itself remains binding.","regime":"sg","jurisdiction":"SG","instrument_short":"PDPC AI Recommendation and Decision Guidelines","cite":"PDPC AI Recommendation and Decision Guidelines Guidelines §§ 2.2, 3.1, 9.1-9.7 and 10","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-SG-PDPCGENAI-4-4","instrument":"sg-pdpc-genai","article":"Guidelines §§ 4.2-4.8, 5.1 and 7.1","title":"Give AI-specific notices for large-scale GenAI training data","plain":"The advisory guidance says general notifications are insufficient for large-scale Generative AI model training or fine-tuning and recommends AI-specific notices describing the data and its use. It also encourages data minimization or anonymization and confirms that model providers processing personal data are organizations under the PDPA.","applies_to":{"roles":["provider","developer","deployer"],"uses":["generated-media","gpai-model"],"conditions":"Use of personal data in Generative AI development or deployment; the AI-specific notice point concerns large-scale training or fine-tuning."},"applies_from":"2026-07-20","status":"voluntary","controls":["privacy_compliance","transparency_notice","user_controls","data_governance"],"evidence":["AI-specific training notice, data-minimization record and privacy controls for model development"],"source_url":"https://www.pdpc.gov.sg/assets/143cb9d4-532e-4cca-9a77-bcc0415ca294","confidence":"high","notes":"The guidance is advisory and nonbinding; the underlying PDPA consent, notification and protection duties remain binding.","regime":"sg","jurisdiction":"SG","instrument_short":"PDPC Generative AI Guidelines","cite":"PDPC Generative AI Guidelines Guidelines §§ 4.2-4.8, 5.1 and 7.1","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-SG-OSRAA-13-14-83-84","instrument":"sg-osraa","article":"OSRAA §§ 13-14, 83-84","title":"Do not communicate qualifying intimate or child-abuse images","plain":"The Act prohibits communications that meet the statutory definitions of intimate-image abuse or image-based child abuse; the relevant image definitions include images altered or generated by any means. These harms are in the first operational phase, and victims may seek civil remedies while the Commissioner may direct communicators, administrators or platforms to act.","applies_to":{"roles":["any","platform"],"uses":["generated-media","deepfake"],"conditions":"Only material meeting the statutory thresholds and exceptions; the Act's first-phase harms became operational on 29 June 2026."},"applies_from":"2026-06-29","status":"applicable","controls":["content_moderation"],"evidence":["Content review, notice escalation and removal records for qualifying harmful image material"],"penalty":"Victims may seek civil remedies; the Commissioner may issue directions under the Act.","source_url":"https://sso.agc.gov.sg/Act/OSRAA2025","confidence":"high","notes":"MDDI confirmed AI-generated content is within scope where it meets the thresholds for the implemented harms. Official response: https://www.mddi.gov.sg/newsroom/mddi-response-to-pq-on-protecting-against-unauthorised-ai-generated-likeness-in-advertisements-and-operationalising-online-safety-commission-mandate-over-inauthentic-material-abuse/.","regime":"sg","jurisdiction":"SG","instrument_short":"OSRAA","cite":"OSRAA §§ 13-14, 83-84","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-SG-OSRAA-16-86","instrument":"sg-osraa","article":"OSRAA §§ 16, 86","title":"Track the pending inauthentic-material-abuse provisions","plain":"Section 16 covers online inauthentic material abuse, including realistic false or misleading digitally altered or generated depictions that meet the statutory harm threshold; section 86 provides the corresponding tort. MDDI said this category would be progressively implemented and had not announced a commencement date as of 10 September 2026.","applies_to":{"roles":["any","platform"],"uses":["generated-media","deepfake"],"conditions":"Not yet operational as of 4 November 2026; monitor for a commencement notification."},"applies_from":null,"status":"not-yet-applicable","controls":["content_moderation"],"evidence":["Monitor official commencement announcements and retain a content-response plan for realistic AI depictions"],"source_url":"https://sso.agc.gov.sg/Act/OSRAA2025","confidence":"high","notes":"MDDI's 10 September 2026 response stated that inauthentic material abuse would be progressively implemented and that further commencement details would follow.","regime":"sg","jurisdiction":"SG","instrument_short":"OSRAA","cite":"OSRAA §§ 16, 86","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-CA-SB53-22757-12-A","instrument":"us-ca-sb53","article":"BPC § 22757.12(a)–(b)","title":"Publish and maintain a frontier safety framework","plain":"A large frontier developer must write, implement, follow and clearly publish a frontier AI framework covering catastrophic-risk assessment, mitigations, governance, cybersecurity and safe deployment. It must review the framework at least annually, update it as needed, and publish a summary of material changes with reasons within 30 days.","applies_to":{"roles":["developer","provider"],"uses":["frontier-model"],"conditions":"A frontier model is a foundation model trained using more than 10^26 integer or floating-point operations, including original training and qualifying later fine-tuning or modification. A large frontier developer is a developer together with affiliates whose preceding-year annual gross revenue exceeds $500 million."},"applies_from":"2026-01-01","status":"applicable","controls":["safety_framework","risk_management","security_testing"],"evidence":["Publicly accessible, dated frontier AI framework and change history","Annual review record and documented catastrophic-risk assessments and mitigations"],"penalty":"Civil penalties may reach $1,000,000 per violation for specified violations by a large frontier developer.","source_url":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB53","confidence":"high","notes":"The $500 million revenue test applies to the developer and affiliates together; the compute threshold includes qualifying later training or modification.","regime":"us-ca","jurisdiction":"US-CA","instrument_short":"TFAIA / SB 53","cite":"TFAIA / SB 53 BPC § 22757.12(a)–(b)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-CA-SB53-22757-12-C-13","instrument":"us-ca-sb53","article":"BPC §§ 22757.12(c)–(d), 22757.13(c)","title":"Publish deployment reports and report critical safety incidents","plain":"Before or concurrently with deployment of a new or substantially modified frontier model, a frontier developer must publish a transparency report with specified release, contact, capability, use and restriction information; large developers add specified risk-assessment and evaluation information. A developer must report a critical safety incident to the Office of Emergency Services within 15 days after discovery, or notify an appropriate authority within 24 hours if the incident poses an imminent risk of death or serious physical injury; large developers also transmit confidential summaries of internal-use catastrophic-risk assessments to OES quarterly or on an alternate schedule communicated in writing.","applies_to":{"roles":["developer","provider"],"uses":["frontier-model"],"conditions":"Applies to developers of models exceeding the statutory 10^26-compute frontier-model threshold; the enhanced report and internal-use assessment requirements apply to large frontier developers exceeding the $500 million preceding-year revenue threshold."},"applies_from":"2026-01-01","status":"applicable","controls":["transparency_notice","incident_reporting","risk_management","audit_log"],"evidence":["Published, dated deployment transparency reports and quarterly confidential internal-use assessment summaries, where applicable","Incident register with discovery, escalation and OES/authority notification timestamps"],"penalty":"Civil penalties and other statutory remedies apply; specified large-developer violations may incur up to $1,000,000 per violation.","source_url":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB53","confidence":"high","notes":"The 24-hour urgent notification and the 15-day OES reporting requirements are distinct. OES receives confidential internal-use assessment summaries from large developers on the applicable schedule.","regime":"us-ca","jurisdiction":"US-CA","instrument_short":"TFAIA / SB 53","cite":"TFAIA / SB 53 BPC §§ 22757.12(c)–(d), 22757.13(c)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-CA-CATA-22757-2","instrument":"us-ca-cata","article":"BPC § 22757.2","title":"Provide a free generative-AI disclosure verification tool","plain":"A covered provider must make a free, publicly accessible tool available to determine whether image, video or audio content was created or altered using its generative-AI system. The tool must expose the specified provenance information while limiting personal-information collection and retention as the statute requires.","applies_to":{"roles":["provider","developer"],"uses":["generated-media"],"conditions":"Covers providers of publicly accessible generative-AI systems in California, subject to statutory exceptions, including a temporary assistive-technology exemption. SB 1000, effective 2026-09-30, removed the former more-than-one-million-monthly-user threshold."},"applies_from":"2026-08-02","status":"applicable","controls":["content_marking","privacy_compliance"],"evidence":["Public link and test records for the free provenance-verification tool","Technical and privacy documentation showing required provenance data and minimized data handling"],"penalty":"Generally $5,000 per violation per day.","source_url":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB1000","confidence":"high","notes":"The user's lead about a one-million-user threshold is outdated. SB 1000 removed that threshold and deleted the optional manifest-disclosure route; the current tool duty is not limited to providers above that user count.","regime":"us-ca","jurisdiction":"US-CA","instrument_short":"California AI Transparency Act","cite":"California AI Transparency Act BPC § 22757.2","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-CA-CATA-22757-3","instrument":"us-ca-cata","article":"BPC § 22757.3","title":"Embed latent provenance disclosures in generated or altered media","plain":"Where technically feasible, a provider must embed a latent disclosure in image, video and audio content created or altered by its generative-AI system, except for specified minor modifications. The disclosure must identify the AI origin and include the information prescribed by statute; providers must also give licensees required notice and act on identified noncompliant modifications within the statutory time limits.","applies_to":{"roles":["provider","developer"],"uses":["generated-media"],"conditions":"Applies to covered generative-AI providers when latent disclosure is technically feasible; minor modifications and the temporary assistive-technology exemption are excluded as specified by statute."},"applies_from":"2026-08-02","status":"applicable","controls":["content_marking"],"evidence":["Sample image, video and audio outputs with inspectable latent provenance disclosures","Feasibility assessment and licensee notices, compliance escalations and remediation records"],"penalty":"Generally $5,000 per violation per day; specified false claims of assistive-technology exemption carry a separate higher penalty until 2029-01-01.","source_url":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB1000","confidence":"high","notes":"SB 1000 removed the former manifest-disclosure option. The latent-disclosure requirement is limited by technical feasibility and the statute's enumerated exceptions.","regime":"us-ca","jurisdiction":"US-CA","instrument_short":"California AI Transparency Act","cite":"California AI Transparency Act BPC § 22757.3","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-CA-CATA-22757-3-1-3-2","instrument":"us-ca-cata","article":"BPC §§ 22757.3.1–22757.3.2","title":"Detect and disclose provenance on large platforms and GenAI hosting services","plain":"From 2027-01-01, a large online platform must provide a compliant mechanism to detect provenance data, display the prescribed indicator or disclosure, and permit inspection; it must take reasonable steps not to strip compliant provenance. A GenAI hosting platform must not knowingly make a covered system available if it does not comply with the latent-disclosure requirements, and platforms need not maintain, display or enable downloading of users' personal information as provenance.","applies_to":{"roles":["platform"],"uses":["generated-media","deepfake"],"conditions":"A large online platform is a public-facing social-media, file-sharing, mass-messaging or stand-alone search platform that distributes content to users who did not create or collaborate on it and exceeded 2,000,000 unique monthly users during the preceding 12 months, excluding broadband and telecommunications services. A GenAI hosting platform is an internet website or application making model weights or source code available for download by California residents, regardless of compensation. Platform duties concern provenance data compliant with widely adopted specifications of an established standards-setting body."},"applies_from":"2027-01-01","status":"not-yet-applicable","controls":["content_marking","transparency_notice"],"evidence":["Provenance-detection, inspection and user-interface tests against compliant interoperable standards; policies and logs for avoiding removal of provenance data","Hosting-service checks that covered systems comply with latent-disclosure requirements"],"penalty":"Generally $5,000 per violation per day.","source_url":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB2713","confidence":"high","notes":"AB 2713 revised detection, interface, inspection and no-stripping requirements. The platform is not required to preserve or disclose personal information as part of the provenance mechanism.","regime":"us-ca","jurisdiction":"US-CA","instrument_short":"California AI Transparency Act","cite":"California AI Transparency Act BPC §§ 22757.3.1–22757.3.2","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-CA-CATA-22757-3-3","instrument":"us-ca-cata","article":"BPC § 22757.3.3","title":"Support provenance disclosures in newly manufactured capture devices","plain":"Beginning 2028-01-01, a manufacturer of a covered capture device first produced for sale in California must provide an option to include and, where required, embed a latent disclosure identifying the manufacturer, device, version and capture date or time. The duty is subject to technical feasibility and the statute's accepted technical specifications.","applies_to":{"roles":["product-manufacturer"],"uses":["generated-media"],"conditions":"Applies to covered image, video and audio capture devices first manufactured for sale in California on or after 2028-01-01, subject to statutory technical-feasibility and specification conditions."},"applies_from":"2028-01-01","status":"not-yet-applicable","controls":["content_marking"],"evidence":["Device technical specifications and provenance options","Test captures demonstrating default embedding where technically required"],"penalty":"Generally $5,000 per violation per day.","source_url":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB853","confidence":"high","notes":"This is a later phase-in than the provider tool and latent-disclosure duties.","regime":"us-ca","jurisdiction":"US-CA","instrument_short":"California AI Transparency Act","cite":"California AI Transparency Act BPC § 22757.3.3","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-CA-AB2013-CIV-3111","instrument":"us-ca-ab2013","article":"Civil Code § 3111","title":"Publish generative-AI training-data documentation","plain":"A developer must publish documentation about the datasets used to develop a covered generative-AI system or service, including a high-level summary of source types, dataset purpose and characteristics, intellectual-property and personal-information content, processing, collection periods and use of synthetic data. The documentation must be posted publicly online by the initial deadline and updated before a subsequent release or substantial modification, subject to statutory exceptions.","applies_to":{"roles":["developer"],"uses":["generated-media"],"conditions":"Covers generative-AI systems or services released on or after 2022 and made available to Californians; statutory exceptions include specified systems and circumstances."},"applies_from":"2026-01-01","status":"applicable","controls":["training_data_summary","data_governance","transparency_notice"],"evidence":["Public training-data documentation with the required dataset categories","Version history showing publication and updates before later releases or substantial modifications"],"penalty":"No standalone penalty amount is specified in § 3111.","source_url":"https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=3111.","confidence":"high","notes":"Initial public documentation was due 2026-01-01; it is an ongoing publication duty before subsequent covered release or substantial modification.","regime":"us-ca","jurisdiction":"US-CA","instrument_short":"GenAI training-data documentation","cite":"GenAI training-data documentation Civil Code § 3111","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-CA-SB243-22602","instrument":"us-ca-sb243","article":"BPC §§ 22602(a)–(c), 22604","title":"Disclose companion-chatbot identity and maintain crisis and minor safeguards","plain":"A companion-chatbot operator must disclose when a reasonable person could be misled into believing the chatbot is human, maintain and publish a protocol for responding to suicidal ideation or self-harm, and provide a notice that the chatbot may not be suitable for some minors. Until 2027-01-01, the statute also requires specified disclosures, break reminders and protections for known minor users; SB 1119 repeals those § 22602(c) duties from that date.","applies_to":{"roles":["provider","deployer","platform"],"uses":["companion","chatbot","minors"],"conditions":"Applies to operators of companion chatbots made available to users in California; a companion chatbot is designed to provide adaptive, human-like responses and sustain a relationship across multiple interactions."},"applies_from":"2026-01-01","status":"applicable","controls":["ai_disclosure","minors_protection","risk_management","transparency_notice"],"evidence":["User-facing human-mimicry and minor-suitability notices; published suicidal-ideation and self-harm protocol with tested escalation paths","Records of known-minor disclosures and break reminders through 2026-12-31"],"penalty":"Civil penalties and other statutory remedies apply; exact exposure depends on the provision and violation.","source_url":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB243","confidence":"high","notes":"The known-minor requirements in § 22602(c) are operative as of 2026-11-04 but are scheduled for deletion by SB 1119 effective 2027-01-01. Do not treat them as a permanent duty after that date.","regime":"us-ca","jurisdiction":"US-CA","instrument_short":"Companion chatbot safeguards","cite":"Companion chatbot safeguards BPC §§ 22602(a)–(c), 22604","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-CA-SB243-22603","instrument":"us-ca-sb243","article":"BPC § 22603","title":"Report companion-chatbot safety and crisis-response information annually","plain":"An operator must submit an annual report stating the number of notifications sent to users about suicidal ideation or self-harm during the preceding calendar year and describing protocols for detecting, removing or responding to such content. Reports must avoid personally identifying information and include specified safety and use information.","applies_to":{"roles":["provider","platform"],"uses":["companion","chatbot"],"conditions":"Applies to operators of companion chatbots subject to the Act; the first annual report is due 2027-07-01 and covers the preceding calendar year as required by statute."},"applies_from":"2027-07-01","status":"not-yet-applicable","controls":["incident_reporting","minors_protection","audit_log"],"evidence":["Annual report and submission receipt with aggregated notification counts and documented crisis-response procedures","Privacy review showing report data excludes personally identifying information"],"penalty":"Civil penalties and other statutory remedies apply.","source_url":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB243","confidence":"high","notes":"The duty is a 2027 phase-in; it should not be represented as an already-due report on the as-of date.","regime":"us-ca","jurisdiction":"US-CA","instrument_short":"Companion chatbot safeguards","cite":"Companion chatbot safeguards BPC § 22603","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-CA-SB1119-21811-13","instrument":"us-ca-sb1119","article":"BPC §§ 21811–21814","title":"Assess and mitigate child-safety risks in AI chatbots","plain":"From 2027-01-01, operators must determine users' ages or apply child protections to all users. From 2027-07-01, before new or substantially modified releases, operators allowing children must document a safety risk assessment and mitigations, publish a safety policy and crisis procedures, and implement required safeguards, defaults and data or advertising restrictions. Under § 21814's AB 1405-conditioned text, operators with at least $500 million in prior-year gross revenue must complete an independent audit by 2029-01-01 or before first public availability (whichever is later), then every two years, submit an audit summary to the Attorney General within 30 business days and post a high-level summary within 90 days; operators below that threshold are exempt before 2032.","applies_to":{"roles":["provider","deployer","platform"],"uses":["chatbot","companion","minors"],"conditions":"Applies to covered operators of AI chatbots accessible to children, subject to statutory definitions and exclusions, including specified workplace-exclusive and postsecondary educational chatbots. The child-safety risk-assessment, mitigation and policy duties begin 2027-07-01; audit requirements have revenue thresholds, small-operator provisions and an exemption/phase-in before 2032."},"applies_from":"2027-01-01","status":"not-yet-applicable","controls":["impact_assessment","risk_management","minors_protection","user_controls","privacy_compliance","audit_log"],"evidence":["Age-assurance implementation and records of applicable user-protection defaults","Child-safety assessments, mitigation plans, policies, crisis procedures, safeguard tests and independent audit reports/remediation where § 21814 applies"],"penalty":"Civil penalties may be imposed per affected child, with higher amounts for intentional violations; statutory enforcement and remedies also apply.","source_url":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB1119","confidence":"high","notes":"AB 1405 was chaptered on 2026-09-09 and, absent a special effective-date clause, takes effect 2027-01-01; accordingly, SB 1119's alternate § 21814 text conditioned on AB 1405 being chaptered and effective by that date is the applicable version. Under that text, operators with less than $500 million in prior-year gross revenue are exempt from audit duties before 2032; audit summaries go to the Attorney General within 30 business days and high-level public summaries within 90 days. SB 1119 also removes BPC § 22602(c) minor-specific companion-chatbot provisions effective 2027-01-01.","regime":"us-ca","jurisdiction":"US-CA","instrument_short":"Child-accessible chatbot safety","cite":"Child-accessible chatbot safety BPC §§ 21811–21814","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-CA-BOT-17941","instrument":"us-ca-bot-act","article":"BPC § 17941","title":"Disclose a qualifying bot's artificial identity","plain":"A person using a bot online must clearly and conspicuously disclose that it is a bot when the person intends to mislead someone about the bot's artificial identity, knowingly deceive that person about the communication's content, and thereby incentivize a commercial transaction or influence a vote in an election. The disclosure must be reasonably designed to inform people that they are communicating with a bot.","applies_to":{"roles":["any"],"uses":["chatbot","generated-media"],"conditions":"Narrowly applies to the combination of intent to mislead about artificial identity, knowing deception about the communication's content, and an aim to incentivize a commercial transaction or influence an election; statutory exceptions apply."},"applies_from":"2019-07-01","status":"applicable","controls":["ai_disclosure","transparency_notice"],"evidence":["Disclosure shown in the qualifying online interaction","Records explaining the deployment purpose and applicable statutory exception analysis"],"penalty":"Civil enforcement remedies are available under the Act.","source_url":"https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC&sectionNum=17941.","confidence":"high","notes":"This is not a general chatbot-disclosure rule; all statutory intent and purpose elements must be present.","regime":"us-ca","jurisdiction":"US-CA","instrument_short":"BOT Act","cite":"BOT Act BPC § 17941","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-CA-CCPA-7150","instrument":"us-ca-cppa-admt","article":"11 CCR § 7150 and related risk-assessment provisions","title":"Complete CCPA risk assessments for high-risk processing","plain":"A CCPA-covered business must conduct and document a risk assessment before initiating processing that presents significant risk to consumers, including selling or sharing personal information, processing sensitive personal information, using ADMT for a significant decision, specified profiling, and using personal information to train covered technologies. A covered business already conducting qualifying processing before the regulations took effect must complete the assessment by 2027-12-31 if that processing continues; required information and attestations for 2026–2027 assessments are due 2028-04-01.","applies_to":{"roles":["deployer","employer","provider"],"uses":["significant-decision","profiling","hiring","credit","education","healthcare"],"conditions":"Applies to businesses subject to the CCPA that engage in processing identified by the risk-assessment regulations; statutory business, processing and decision exceptions apply."},"applies_from":"2026-01-01","status":"applicable","controls":["impact_assessment","risk_management","privacy_compliance","audit_log"],"evidence":["Dated risk assessments completed before initiation of new covered processing and for qualifying legacy processing, with approvals and mitigations","Submission receipt and executive attestation for the 2026–2027 reporting period"],"penalty":"CCPA enforcement penalties and remedies may apply; amounts depend on violation and circumstances.","source_url":"https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf","confidence":"high","notes":"The regulations' risk-assessment duties apply from 2026-01-01; this obligation is distinct from the later ADMT access, notice and opt-out rights.","regime":"us-ca","jurisdiction":"US-CA","instrument_short":"CPPA ADMT and risk assessments","cite":"CPPA ADMT and risk assessments 11 CCR § 7150 and related risk-assessment provisions","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-CA-CCPA-7200-7222","instrument":"us-ca-cppa-admt","article":"11 CCR §§ 7200–7222","title":"Give notice, opt-out and access rights for covered ADMT","plain":"From 2027-01-01, a CCPA-covered business using covered ADMT for a significant decision must provide a prominent pre-use notice explaining the purpose, operation and consumer rights. Consumers generally have an opt-out right, subject to regulatory exceptions including certain qualifying human-appeal processes, and may request a plain-language explanation of the specific ADMT use, logic and role in the decision.","applies_to":{"roles":["deployer","employer"],"uses":["significant-decision","hiring","credit","education","healthcare"],"conditions":"Applies to CCPA-covered businesses using ADMT as defined by regulation to make or substantially replace human decisionmaking for a significant decision, subject to statutory and regulatory exclusions and exceptions."},"applies_from":"2027-01-01","status":"not-yet-applicable","controls":["transparency_notice","user_controls","contest_and_appeal","privacy_compliance"],"evidence":["Prominent pre-use notices and plain-language access explanations describing purpose, logic, output and decision role","Functional opt-out and qualifying appeal workflows, with request-handling logs"],"penalty":"CCPA enforcement penalties and remedies may apply; amounts depend on violation and circumstances.","source_url":"https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf","confidence":"high","notes":"The specific opt-out exceptions and implementation alternatives are regulatory; verify that an exception's conditions are met before relying on it.","regime":"us-ca","jurisdiction":"US-CA","instrument_short":"CPPA ADMT and risk assessments","cite":"CPPA ADMT and risk assessments 11 CCR §§ 7200–7222","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-CA-CRC-11009-F","instrument":"us-ca-crc-ads","article":"2 CCR §§ 11009(f), 11013(c)","title":"Prevent discriminatory employment use of automated decision systems","plain":"An employer or other FEHA-covered entity may not use an automated-decision system or selection criteria that discriminates against applicants or employees on a protected basis. Anti-bias testing or its absence is relevant evidence in a discrimination claim or defense, while covered personnel and employment records must be retained for four years from record creation or the personnel action, whichever is later.","applies_to":{"roles":["employer"],"uses":["hiring","significant-decision"],"conditions":"Applies to FEHA-covered employers and other covered entities using automated-decision systems or selection criteria in employment decisions; the regulations do not impose a freestanding universal anti-bias-testing mandate."},"applies_from":"2025-10-01","status":"applicable","controls":["bias_testing","audit_log"],"evidence":["Employment ADS and selection-criteria inventory, anti-bias testing or rationale, and documented response to results","Personnel and employment records with a four-year retention schedule under § 11013(c)"],"penalty":"FEHA administrative and civil remedies may apply; case-specific.","source_url":"https://calcivilrights.ca.gov/wp-content/uploads/sites/32/2025/06/Final-Text-regulations-automated-employment-decision-systems.pdf","confidence":"medium","notes":"The final regulation makes testing evidence relevant to claims and defenses, not an independent testing mandate. CRD's official effective-date announcement confirms 2025-10-01 and the four-year retention period, but the PDF text extraction merges the deleted word \"two\" with inserted \"four,\" so exact codified wording should be rechecked against the final formatted rule.","regime":"us-ca","jurisdiction":"US-CA","instrument_short":"Employment ADS regulations","cite":"Employment ADS regulations 2 CCR §§ 11009(f), 11013(c)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-CA-SB947-1522-1524","instrument":"us-ca-sb947","article":"Labor Code §§ 1522, 1524 and 1526.7","title":"Require human corroboration and notice for workplace automated decisions","plain":"From 2027-07-01, covered employers may not rely solely on an automated decision system to discipline or terminate an employee, and must corroborate specified outputs with a human when those outputs are primarily relied upon. Employers must give employees notice after covered use and provide a description of relevant data on request; the Act also prohibits specified uses of automated systems in employment decisions.","applies_to":{"roles":["employer"],"uses":["hiring","significant-decision"],"conditions":"Applies to employers and automated decision systems as defined in SB 947 for covered employees; statutory exceptions include specified collective-bargaining, national-security and other circumstances."},"applies_from":"2027-07-01","status":"not-yet-applicable","controls":["human_oversight","transparency_notice","contest_and_appeal","audit_log"],"evidence":["Human corroboration records, employee notices and data-description response records","Screening records for prohibited automated-decision uses and applicable exceptions"],"penalty":"$500 per violation, in addition to other available remedies.","source_url":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB947","confidence":"high","notes":"These duties are enacted but not operative on the 2026-11-04 as-of date.","regime":"us-ca","jurisdiction":"US-CA","instrument_short":"Worker protections for automated decisions","cite":"Worker protections for automated decisions Labor Code §§ 1522, 1524 and 1526.7","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-CO-SB24205-1702","instrument":"co-sb24-205","article":"C.R.S. § 6-1-1702 (SB 24-205 version)","title":"Use reasonable care and document high-risk systems","plain":"Developers of high-risk AI systems must use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination and provide downstream deployers with required system documentation. The original law also requires disclosure of discovered algorithmic discrimination to the Attorney General and known downstream developers or deployers within 90 days.","applies_to":{"roles":["developer"],"uses":["significant-decision","hiring","credit","education","healthcare","insurance","essential-services","critical-infrastructure","justice","migration"],"conditions":"High-risk AI systems making or substantially influencing a consequential decision; these predecessor duties apply during the transition before 2027-01-01."},"applies_from":"2026-06-30","status":"applicable","controls":["risk_management","bias_testing","technical_documentation","incident_reporting"],"evidence":["Documented risk analysis and system/deployer documentation for each covered high-risk system","Record of any discovered algorithmic discrimination and timely notice to the Attorney General and known downstream parties"],"penalty":"Up to $20,000 per violation under the CCPA generally; a federal court order restricts the Attorney General's initiation of enforcement for covered violations, without changing statutory applicability dates.","source_url":"https://leg.colorado.gov/laws/session-laws/SB24-205/198/download","confidence":"high","notes":"SB 25B-004 moved the original implementation date to 2026-06-30. SB 26-189's general effective date is 2027-01-01, so the 2024 duties remain in the statutory transition through 2026-12-31. The April 27, 2026 federal minute order bars the Attorney General from initiating enforcement, including investigations, for alleged violations of SB 24-205 or its 2026 replacement occurring on or before 14 days after the court rules on xAI's forthcoming preliminary-injunction motion. It does not change statutory dates. The order names the Attorney General defendant; the 2024 statute also permits district-attorney enforcement. The rulemaking was not final as of 2026-11-04. Order PDF: https://storage.courtlistener.com/recap/gov.uscourts.cod.253513/gov.uscourts.cod.253513.24.0.pdf","regime":"us-co","jurisdiction":"US-CO","instrument_short":"Colorado AI Act (2024)","cite":"Colorado AI Act (2024) C.R.S. § 6-1-1702 (SB 24-205 version)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-CO-SB24205-1703","instrument":"co-sb24-205","article":"C.R.S. § 6-1-1703 (SB 24-205 version)","title":"Run risk management and impact assessments for high-risk AI","plain":"Deployers of high-risk AI systems must use reasonable care to protect consumers from algorithmic-discrimination risks and implement a risk-management policy and program. They must complete an impact assessment before deployment and at least annually, and within 90 days after an intentional and substantial modification, subject to statutory exceptions.","applies_to":{"roles":["deployer"],"uses":["significant-decision","hiring","credit","education","healthcare","insurance","essential-services","critical-infrastructure","justice","migration"],"conditions":"High-risk AI systems making or substantially influencing consequential decisions; predecessor duties apply only until the successor framework takes effect on 2027-01-01."},"applies_from":"2026-06-30","status":"applicable","controls":["risk_management","impact_assessment","bias_testing"],"evidence":["Risk-management policy and program with owners, processes, mitigations, and review history","Initial and annual impact assessments, plus assessments after substantial modifications"],"penalty":"Up to $20,000 per violation under the CCPA generally.","source_url":"https://leg.colorado.gov/laws/session-laws/SB24-205/198/download","confidence":"high","notes":"The delayed 2024 framework remains applicable during the transition period; it is not the successor law's standard. AG enforcement is subject to the temporary federal order described in the SB 24-205 instrument's first obligation.","regime":"us-co","jurisdiction":"US-CO","instrument_short":"Colorado AI Act (2024)","cite":"Colorado AI Act (2024) C.R.S. § 6-1-1703 (SB 24-205 version)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-CO-SB24205-1704","instrument":"co-sb24-205","article":"C.R.S. §§ 6-1-1703(5), 6-1-1704 (SB 24-205 version)","title":"Notify consumers and publish high-risk system information","plain":"Deployers must provide the required consumer notice when a high-risk system is used for a consequential decision and publish a statement describing the types of high-risk systems they deploy and how they manage known algorithmic-discrimination risks. The statement must be updated at least annually, subject to statutory exceptions.","applies_to":{"roles":["deployer"],"uses":["significant-decision","hiring","credit","education","healthcare","insurance","essential-services","critical-infrastructure","justice","migration"],"conditions":"High-risk AI systems deployed to make or substantially influence consequential decisions; predecessor duties apply until 2027-01-01."},"applies_from":"2026-06-30","status":"applicable","controls":["transparency_notice","ai_disclosure"],"evidence":["Consumer notices and a current public statement describing covered systems and risk management"],"penalty":"Up to $20,000 per violation under the CCPA generally.","source_url":"https://leg.colorado.gov/laws/session-laws/SB24-205/198/download","confidence":"high","regime":"us-co","jurisdiction":"US-CO","instrument_short":"Colorado AI Act (2024)","cite":"Colorado AI Act (2024) C.R.S. §§ 6-1-1703(5), 6-1-1704 (SB 24-205 version)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-CO-SB24205-1705","instrument":"co-sb24-205","article":"C.R.S. § 6-1-1705 (SB 24-205 version)","title":"Mark and disclose synthetic content","plain":"Developers of covered systems that generate or manipulate synthetic digital content must provide a machine-readable marker, to the extent technically feasible, and deployers must disclose to consumers that content is artificially generated or manipulated. This is a predecessor duty scheduled to be replaced on 2027-01-01.","applies_to":{"roles":["developer","deployer"],"uses":["generated-media","deepfake"],"conditions":"Systems that generate or manipulate synthetic digital content, subject to the statutory exceptions."},"applies_from":"2026-06-30","status":"applicable","controls":["content_marking","deepfake_label"],"evidence":["Description and test results for machine-readable output marking","Consumer-facing labels for synthetic media"],"penalty":"Up to $20,000 per violation under the CCPA generally.","source_url":"https://leg.colorado.gov/laws/session-laws/SB24-205/198/download","confidence":"high","notes":"The successor SB 26-189 framework does not impose these same general synthetic-content marking duties; this obligation is included only for the transitional SB 24-205 period ending 2026-12-31.","regime":"us-co","jurisdiction":"US-CO","instrument_short":"Colorado AI Act (2024)","cite":"Colorado AI Act (2024) C.R.S. § 6-1-1705 (SB 24-205 version)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-CO-SB26189-1702","instrument":"co-sb26-189","article":"C.R.S. § 6-1-1702(1)-(3)","title":"Give deployers usable documentation for covered ADMT","plain":"Developers must provide each deployer with an understandable statement of intended and known harmful uses, known training-data categories, limitations and risks, instructions for appropriate use, monitoring and meaningful human review, and information reasonably needed for deployer disclosures. They must give timely notice of material updates, substantial modifications, or changes to intended use, limitations, or risk mitigation; the detailed documentation duties apply only to uses marketed, advertised, configured, contracted, sold, or licensed for consequential decisions.","applies_to":{"roles":["developer"],"uses":["significant-decision","hiring","education","credit","insurance","healthcare","essential-services"],"conditions":"A covered ADMT materially influences a consequential decision in education, employment, housing, financial/lending services, insurance, health-care services, or essential government services; statutory definition excludes specified ordinary tools and human-review-only tasks."},"applies_from":"2027-01-01","status":"not-yet-applicable","controls":["technical_documentation","transparency_notice","human_oversight","risk_management"],"evidence":["Developer documentation supplied to each deployer, including use limits, data categories, risks, and review instructions","Versioned change log and direct notices of material updates to deployers"],"penalty":"Up to $20,000 per violation under the CCPA generally; the SB 26-189 enforcement and cure provisions apply.","source_url":"https://leg.colorado.gov/laws/session-laws/SB26-189/131/download","confidence":"high","notes":"The statute requires technical documentation, not a general algorithmic impact assessment. The draft AG rules may clarify scope and content but were not adopted as of 2026-11-04. AG enforcement is also subject to the temporary federal order noted above.","regime":"us-co","jurisdiction":"US-CO","instrument_short":"Colorado ADMT Act","cite":"Colorado ADMT Act C.R.S. § 6-1-1702(1)-(3)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-CO-SB26189-1702-RECORDS","instrument":"co-sb26-189","article":"C.R.S. §§ 6-1-1702(4), 6-1-1703","title":"Keep developer and deployer compliance records","plain":"Developers must retain records reasonably necessary to demonstrate compliance for at least three years after creating each record. Deployers must retain records reasonably necessary to demonstrate compliance for at least three years after the consequential decision, including relevant system-version, change-log, and mitigation records.","applies_to":{"roles":["developer","deployer"],"uses":["significant-decision"],"conditions":"Covered ADMT used to materially influence a consequential decision; longer retention applies when required by other law."},"applies_from":"2027-01-01","status":"not-yet-applicable","controls":["audit_log","technical_documentation"],"evidence":["Retention schedule and records linking decisions to system versions and mitigation changes"],"penalty":"Up to $20,000 per violation under the CCPA generally.","source_url":"https://leg.colorado.gov/laws/session-laws/SB26-189/131/download","confidence":"high","regime":"us-co","jurisdiction":"US-CO","instrument_short":"Colorado ADMT Act","cite":"Colorado ADMT Act C.R.S. §§ 6-1-1702(4), 6-1-1703","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-CO-SB26189-1704-1","instrument":"co-sb26-189","article":"C.R.S. § 6-1-1704(1)-(2)","title":"Tell consumers before covered ADMT influences a decision","plain":"Before using covered ADMT to materially influence a consequential decision, a deployer must give the consumer clear and conspicuous notice that the decision uses ADMT and instructions for obtaining further information. A prominent public notice reasonably accessible near consumer interactions may satisfy this requirement.","applies_to":{"roles":["deployer"],"uses":["significant-decision","hiring","education","credit","insurance","healthcare","essential-services"],"conditions":"The covered ADMT materially influences a consequential decision affecting the consumer; housing is also a covered domain."},"applies_from":"2027-01-01","status":"not-yet-applicable","controls":["transparency_notice","ai_disclosure"],"evidence":["Consumer-facing notice and records showing it was available before use at relevant interaction points"],"penalty":"Up to $20,000 per violation under the CCPA generally; AG enforcement only for this statutory duty.","source_url":"https://leg.colorado.gov/laws/session-laws/SB26-189/131/download","confidence":"high","regime":"us-co","jurisdiction":"US-CO","instrument_short":"Colorado ADMT Act","cite":"Colorado ADMT Act C.R.S. § 6-1-1704(1)-(2)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-CO-SB26189-1704-3","instrument":"co-sb26-189","article":"C.R.S. § 6-1-1704(3)","title":"Explain the ADMT role after an adverse outcome","plain":"Within 30 days after an adverse outcome, the deployer must give a plain-language description of the consequential decision and ADMT's role, a simple process for requesting more information about the system and inputs, and an explanation of the consumer's data-correction and human-review rights. The statute does not itself require a full individualized rationale for why the outcome occurred; federal-law, trade-secret, and other statutory limits apply.","applies_to":{"roles":["deployer"],"uses":["significant-decision","hiring","education","credit","insurance","healthcare","essential-services"],"conditions":"A covered ADMT materially influences a consequential decision that results in an adverse outcome for a consumer; housing is also a covered domain."},"applies_from":"2027-01-01","status":"not-yet-applicable","controls":["transparency_notice","contest_and_appeal"],"evidence":["Adverse-outcome notice template and dated evidence of delivery within 30 days","Process for consumers to request system and input information and exercise statutory rights"],"penalty":"Up to $20,000 per violation under the CCPA generally; 60-day cure if the Attorney General deems a cure possible, except knowing or repeated violations.","source_url":"https://leg.colorado.gov/laws/session-laws/SB26-189/131/download","confidence":"high","notes":"Proposed 4 CCR 904-6 rules would further specify disclosure content, but were not final as of 2026-11-04. The statute requires a description of the decision and ADMT's role, not a free-standing explanation of the adverse decision's substantive merits.","regime":"us-co","jurisdiction":"US-CO","instrument_short":"Colorado ADMT Act","cite":"Colorado ADMT Act C.R.S. § 6-1-1704(3)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-CO-SB26189-1705","instrument":"co-sb26-189","article":"C.R.S. § 6-1-1705(1)","title":"Offer data correction and meaningful human review on request","plain":"After an adverse outcome materially influenced by covered ADMT, a consumer may request instructions for accessing and correcting factually incorrect or materially inaccurate personal data used in the decision, plus an opportunity for meaningful human review and reconsideration to the extent commercially reasonable. The right does not require correction of opinions, predictions, scores, or protected evaluations; education deployers subject to FERPA may use existing compliant processes.","applies_to":{"roles":["deployer"],"uses":["significant-decision","hiring","education","credit","insurance","healthcare","essential-services"],"conditions":"Consumer experienced an adverse outcome from a consequential decision materially influenced by covered ADMT; meaningful review is subject to commercial reasonableness and statutory exceptions."},"applies_from":"2027-01-01","status":"not-yet-applicable","controls":["contest_and_appeal","transparency_notice","human_oversight"],"evidence":["Consumer request and correction/review workflow with a trained human reviewer","Record of review, reconsideration, and response to the consumer"],"penalty":"Up to $20,000 per violation under the CCPA generally; 60-day cure if the Attorney General deems a cure possible, except knowing or repeated violations.","source_url":"https://leg.colorado.gov/laws/session-laws/SB26-189/131/download","confidence":"high","notes":"This is a request right after an adverse outcome, not a general appeal right for every automated decision. The Act does not require a general impact assessment or deployer risk-management program; those were present in SB 24-205 but are not in the successor ADMT duties. The Attorney General's rules clarifying consumer rights were due by 2027-01-01 and remained proposed as of 2026-11-04.","regime":"us-co","jurisdiction":"US-CO","instrument_short":"Colorado ADMT Act","cite":"Colorado ADMT Act C.R.S. § 6-1-1705(1)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-CO-HB261263-1708-2","instrument":"co-hb26-1263","article":"C.R.S. § 6-1-1708(2)","title":"Estimate ages and protect minor chatbot users","plain":"Operators must use commercially reasonable or generally accepted methods to estimate account-holder and user ages and may not willfully disregard clear and convincing evidence that a person is a minor. When the operator knows a user is a minor, it must give the required AI disclosure, avoid unpredictable engagement rewards, use technically feasible protections against specified sexual content and intimate depictions, take reasonable measures against simulated emotional dependence, stop explicit sexual exchanges, comply with minor-privacy duties, and provide privacy and account controls to minors and their parents or guardians.","applies_to":{"roles":["any"],"uses":["chatbot","companion","minors"],"conditions":"Operator develops and makes publicly available or offers a conversational AI service accessible to the general public that primarily simulates human conversation; minor means under 18, and an estimated age/range is treated as knowledge."},"applies_from":"2027-01-01","status":"not-yet-applicable","controls":["minors_protection","privacy_compliance","user_controls","content_moderation","ai_disclosure"],"evidence":["Age-estimation method and records of decisions about known or estimated minor status","Minor safety controls, privacy settings, parent/guardian tools, and testing records"],"penalty":"Up to $20,000 per violation under the CCPA generally.","source_url":"https://leg.colorado.gov/laws/session-laws/HB26-1263/208/download","confidence":"high","notes":"Statutory exceptions exclude specified narrow-topic, business-internal, virtual-assistant, or other services; check the definition of conversational AI service and operator before applying.","regime":"us-co","jurisdiction":"US-CO","instrument_short":"Colorado Chatbot Safety Act","cite":"Colorado Chatbot Safety Act C.R.S. § 6-1-1708(2)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-CO-HB261263-1708-3","instrument":"co-hb26-1263","article":"C.R.S. § 6-1-1708(3)","title":"Disclose that a conversational AI service is AI","plain":"Operators must clearly and conspicuously tell users that the service is artificial intelligence. The disclosure must appear at the beginning of the user's first interaction each calendar day, at least once every three hours in a continuous interaction or persistently on screen, and in response to a user's question about whether it is AI rather than human.","applies_to":{"roles":["any"],"uses":["chatbot","companion","minors"],"conditions":"Operators of covered conversational AI services; separate disclosure format applies to known minor users under § 6-1-1708(2)(a)."},"applies_from":"2027-01-01","status":"not-yet-applicable","controls":["ai_disclosure"],"evidence":["Screenshots or transcripts showing first-session, recurring or persistent, and responsive disclosures"],"penalty":"Up to $20,000 per violation under the CCPA generally.","source_url":"https://leg.colorado.gov/laws/session-laws/HB26-1263/208/download","confidence":"high","regime":"us-co","jurisdiction":"US-CO","instrument_short":"Colorado Chatbot Safety Act","cite":"Colorado Chatbot Safety Act C.R.S. § 6-1-1708(3)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-CO-HB261263-1708-4-6","instrument":"co-hb26-1263","article":"C.R.S. § 6-1-1708(4), (6)","title":"Respond to suicide and self-harm prompts and report annually","plain":"Operators must implement a protocol for responses to user prompts about suicidal ideation or self-harm, including referral to an appropriate crisis service (not law enforcement) and escalation for repeated or severe indicators. Beginning 2027-07-01, operators must report annually to the Attorney General the referral count, relevant protocols and AG-requested efficacy metrics, without user identifiers or personal information, using evidence-based measurement methods.","applies_to":{"roles":["any"],"uses":["chatbot","companion","minors"],"conditions":"Operators of covered conversational AI services; the first annual reporting date is 2027-07-01 and the report must not contain user identifiers or personal information."},"applies_from":"2027-01-01","status":"not-yet-applicable","controls":["content_moderation","incident_reporting","minors_protection"],"evidence":["Crisis-response protocol, referral and escalation logs, and annual-report submission","Evidence-based self-harm measurement method and privacy review confirming reports contain no user identifiers"],"penalty":"Up to $20,000 per violation under the CCPA generally.","source_url":"https://leg.colorado.gov/laws/session-laws/HB26-1263/208/download","confidence":"high","regime":"us-co","jurisdiction":"US-CO","instrument_short":"Colorado Chatbot Safety Act","cite":"Colorado Chatbot Safety Act C.R.S. § 6-1-1708(4), (6)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-CO-HB261263-1708-5","instrument":"co-hb26-1263","article":"C.R.S. § 6-1-1708(5)","title":"Do not misrepresent chatbot outputs as professional services","plain":"Operators may not knowingly or recklessly state that chatbot output is provided by, endorsed by, or equivalent to services provided by a licensed health-care or legal professional, a licensed/certified/registered mental-health professional, or a qualified dietitian.","applies_to":{"roles":["any"],"uses":["chatbot","companion"],"conditions":"Operators of covered conversational AI services."},"applies_from":"2027-01-01","status":"not-yet-applicable","controls":["prohibited_practices_screen"],"evidence":["Marketing and in-product claims review for professional-equivalence representations"],"penalty":"Up to $20,000 per violation under the CCPA generally.","source_url":"https://leg.colorado.gov/laws/session-laws/HB26-1263/208/download","confidence":"high","regime":"us-co","jurisdiction":"US-CO","instrument_short":"Colorado Chatbot Safety Act","cite":"Colorado Chatbot Safety Act C.R.S. § 6-1-1708(5)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-IL-IHRA-2-102-L1","instrument":"il-ihra-ai","article":"775 ILCS 5/2-102(L)(1)","title":"Do not use discriminatory AI in employment","plain":"In covered recruitment, hiring, promotion, renewal, training/apprenticeship selection, discharge, discipline, tenure, or employment-terms decisions, an employer commits a civil-rights violation by using AI that has the effect of subjecting employees to discrimination based on an IHRA-protected class or by using ZIP codes as a proxy for protected classes.","applies_to":{"roles":["employer","deployer"],"uses":["hiring"],"conditions":"Applies to employers and employment practices enumerated in §2-102(L); the prohibition addresses discriminatory effect and ZIP-code proxies, not every use of AI in employment."},"applies_from":"2026-01-01","status":"applicable","controls":["bias_testing","risk_management"],"evidence":["Employment-model impact testing across relevant protected classes and ZIP-code proxy review","Documented model-use decision and corrective-action records"],"source_url":"https://www.ilga.gov/Legislation/PublicActs/View/103-0804","confidence":"high","regime":"us-il","jurisdiction":"US-IL","instrument_short":"IHRA AI employment provisions","cite":"IHRA AI employment provisions 775 ILCS 5/2-102(L)(1)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-IL-IHRA-2-102-L2","instrument":"il-ihra-ai","article":"775 ILCS 5/2-102(L)(2)","title":"Notify employees when covered AI is used","plain":"An employer commits a civil-rights violation if it fails to notify an employee that it is using AI for the employment purposes listed in §2-102(L)(1). The statute delegates notice circumstances, timing, and means to IDHR rulemaking; the Department's proposed amendments were withdrawn, so the withdrawn draft's details are not encoded as binding requirements.","applies_to":{"roles":["employer"],"uses":["hiring"],"conditions":"Notice is required for AI use in the enumerated employment practices; the Act itself leaves the timing and means to IDHR rules."},"applies_from":"2026-01-01","status":"applicable","controls":["transparency_notice"],"evidence":["Employee notice template describing the employer's covered AI use","Notice delivery or acknowledgement record"],"source_url":"https://www.ilga.gov/Legislation/PublicActs/View/103-0804","confidence":"high","notes":"The June 26, 2026 JCAR Flinn Report records IDHR's withdrawal of its proposed rule amendments. Do not use the withdrawn draft's proposed notice timing, form, or record-retention provisions as operative law.","regime":"us-il","jurisdiction":"US-IL","instrument_short":"IHRA AI employment provisions","cite":"IHRA AI employment provisions 775 ILCS 5/2-102(L)(2)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-IL-AIVIA-42-5","instrument":"il-aivia","article":"820 ILCS 42/5","title":"Disclose, explain, and obtain consent before AI video analysis","plain":"Before asking an applicant to submit a video interview for an Illinois-based position, an employer using AI analysis must tell the applicant AI may analyze the video and assess fitness, explain how the AI works and the general characteristics it evaluates, and obtain the applicant's consent. The employer may not use AI to evaluate an applicant who has not consented.","applies_to":{"roles":["employer","deployer"],"uses":["hiring"],"conditions":"Applies only when the employer asks applicants to record video interviews and uses AI analysis of applicant-submitted video for positions based in Illinois."},"applies_from":"2020-01-01","status":"applicable","controls":["transparency_notice","user_controls","bias_testing"],"evidence":["Pre-interview AI disclosure and plain-language explanation","Applicant's affirmative consent record before analysis"],"source_url":"https://www.ilga.gov/documents/legislation/ilcs/documents/082000420K5.htm","confidence":"high","regime":"us-il","jurisdiction":"US-IL","instrument_short":"AI Video Interview Act","cite":"AI Video Interview Act 820 ILCS 42/5","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-IL-AIVIA-42-10-15","instrument":"il-aivia","article":"820 ILCS 42/10, 42/15","title":"Limit video sharing and delete interviews on request","plain":"An employer may share an applicant's interview video only with people whose expertise or technology is necessary to evaluate fitness for the position. Within 30 days after an applicant's request, the employer must delete the interview and instruct recipients to delete their copies, including electronic backups.","applies_to":{"roles":["employer","deployer"],"uses":["hiring"],"conditions":"Applies to applicant-submitted videos analyzed under the Act; recipient deletion instructions and backup copies are included."},"applies_from":"2020-01-01","status":"applicable","controls":["privacy_compliance","data_governance"],"evidence":["Vendor/recipient access list limited to necessary evaluation expertise or technology","Deletion request log and recipient/back-up deletion confirmations within 30 days"],"source_url":"https://www.ilga.gov/Legislation/ILCS/Articles?ActID=4015&ChapterID=68&Print=True","confidence":"high","regime":"us-il","jurisdiction":"US-IL","instrument_short":"AI Video Interview Act","cite":"AI Video Interview Act 820 ILCS 42/10, 42/15","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-IL-AIVIA-42-20","instrument":"il-aivia","article":"820 ILCS 42/20(a)-(c)","title":"Report demographic data for AI-only video screening","plain":"An employer that relies solely on AI analysis of a video interview to decide whether an applicant advances to an in-person interview must collect specified race and ethnicity data for applicants advanced and not advanced, and applicants hired. It must report the data to the Department of Commerce and Economic Opportunity annually by December 31 for the 12-month period ending the previous November 30.","applies_to":{"roles":["employer"],"uses":["hiring"],"conditions":"Triggered only when the employer relies solely on AI video analysis to decide whether an applicant will receive an in-person interview; this is narrower than ordinary AI-assisted video screening."},"applies_from":"2022-01-01","status":"applicable","controls":["bias_testing","technical_documentation"],"evidence":["Demographic-data collection protocol and annual reporting dataset","DCEO filing receipt for the December 31 report"],"source_url":"https://www.ilga.gov/Legislation/ILCS/Articles?ActID=4015&ChapterID=68&Print=True","confidence":"high","regime":"us-il","jurisdiction":"US-IL","instrument_short":"AI Video Interview Act","cite":"AI Video Interview Act 820 ILCS 42/20(a)-(c)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-IL-WORP-225-155-15","instrument":"il-worp","article":"225 ILCS 155/15(a)-(b)","title":"Keep licensed professionals responsible for AI-assisted therapy","plain":"A licensed professional may use AI only for administrative or supplementary support while retaining full responsibility for interactions, outputs, and data use. If AI supplementary support records or transcribes a therapeutic session, the client or legally authorized representative must receive written notice of the AI use and its specific purpose and give consent.","applies_to":{"roles":["provider","deployer"],"uses":["healthcare","chatbot"],"conditions":"Applies to licensed professionals providing therapy or psychotherapy; the Act excludes religious counseling and peer support and has other specified exceptions."},"applies_from":"2025-08-01","status":"applicable","controls":["human_oversight","transparency_notice","user_controls","privacy_compliance"],"evidence":["Clinical workflow assigning full responsibility to the licensed professional","Written client notice, stated AI purpose, and consent for recorded/transcribed sessions"],"source_url":"https://www.ilga.gov/Legislation/ILCS/details?ActID=4608&ChapAct=FullText","confidence":"high","regime":"us-il","jurisdiction":"US-IL","instrument_short":"WORP Act","cite":"WORP Act 225 ILCS 155/15(a)-(b)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-IL-WORP-225-155-20","instrument":"il-worp","article":"225 ILCS 155/20(a)-(b)","title":"Do not let AI provide independent therapy","plain":"Therapy or psychotherapy services offered to the Illinois public, including through internet-based AI, must be conducted by a licensed professional. A licensed professional may not allow AI to make independent therapeutic decisions, directly engage in therapeutic communication, generate recommendations or treatment plans without professional review and approval, or detect emotions or mental states.","applies_to":{"roles":["provider","deployer"],"uses":["healthcare","chatbot"],"conditions":"Applies to therapy or psychotherapy services offered to the public in Illinois; religious counseling, peer support, and other statutory exceptions are excluded."},"applies_from":"2025-08-01","status":"applicable","controls":["human_oversight","prohibited_practices_screen"],"evidence":["Service design and clinical review controls showing no autonomous therapy or direct therapeutic communication","Approval records for AI-generated recommendations or treatment plans"],"source_url":"https://www.ilga.gov/Legislation/PublicActs/View/104-0054","confidence":"high","regime":"us-il","jurisdiction":"US-IL","instrument_short":"WORP Act","cite":"WORP Act 225 ILCS 155/20(a)-(b)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-IL-BIPA-740-14-15","instrument":"il-bipa","article":"740 ILCS 14/15(a)-(e)","title":"Protect biometric data throughout its lifecycle","plain":"A private entity possessing biometrics must publish a retention/destruction policy, give written notice of collection and purpose/term and obtain a written release before obtaining biometrics, limit disclosure and prohibit selling or profiting from the data, and protect it at least as carefully as other confidential sensitive information. The statute covers AI only when the data and activity meet BIPA's biometric definitions and private-entity scope.","applies_to":{"roles":["provider","deployer","employer"],"uses":["biometric-categorisation","remote-biometric-id","hiring"],"conditions":"Applies to private entities collecting, receiving, possessing, or otherwise handling statutory biometric identifiers or information, such as scans of face or hand geometry, fingerprints, iris/retina scans, or voiceprints; statutory exclusions apply."},"applies_from":"2008-10-03","status":"applicable","controls":["privacy_compliance","user_controls","security_testing","data_governance"],"evidence":["Public retention/destruction policy and pre-collection written notice/release","Access, disclosure, security, and destruction records for biometric data"],"source_url":"https://www.ilga.gov/documents/legislation/ilcs/documents/074000140K15.htm","confidence":"high","notes":"BIPA is a general biometric privacy statute, not an AI-specific rule; a facial image alone is not automatically a statutory face-geometry scan or biometric information. Public entities are outside the private-entity definition.","regime":"us-il","jurisdiction":"US-IL","instrument_short":"Illinois BIPA","cite":"Illinois BIPA 740 ILCS 14/15(a)-(e)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-IL-AIMSA-10-AB-D","instrument":"il-frontier-ai","article":"Artificial Intelligence Safety Measures Act §§5, 10(a)-(b), 10(d)","title":"Establish and independently audit a frontier AI framework","plain":"Beginning January 1, 2028, a large frontier developer must publish, implement, and annually review a framework for catastrophic-risk thresholds, mitigation, deployment decisions, third-party evaluation, cybersecurity, incident response, governance, and internal-use risks. It must also obtain an annual independent audit of Section 10 compliance beginning January 1, 2028 or 90 days after first qualifying as a large frontier developer, whichever is later.","applies_to":{"roles":["developer","provider"],"uses":["frontier-model"],"conditions":"Frontier model means a foundation model trained with more than 10^26 integer or floating-point operations; large frontier developer means affiliate-inclusive annual gross revenue over $500 million in the preceding calendar year."},"applies_from":"2028-01-01","status":"not-yet-applicable","controls":["safety_framework","risk_management","security_testing","technical_documentation"],"evidence":["Published frontier AI framework and annual review/change records","Independent audit report, auditor-independence record, and remediation plan"],"source_url":"https://www.ilga.gov/ftp/Public%20Acts/104/104-0538.htm","confidence":"high","notes":"The audit starts January 1, 2028 or 90 days after a developer first qualifies as large, whichever is later; framework publication starts January 1, 2028.","regime":"us-il","jurisdiction":"US-IL","instrument_short":"Illinois Artificial Intelligence Safety Measures Act","cite":"Illinois Artificial Intelligence Safety Measures Act Artificial Intelligence Safety Measures Act §§5, 10(a)-(b), 10(d)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-IL-AIMSA-10-C","instrument":"il-frontier-ai","article":"Artificial Intelligence Safety Measures Act §10(c)(1)-(4)","title":"Publish frontier-model transparency reports","plain":"Before or concurrently with deploying a new or substantially modified frontier model, a frontier developer must conspicuously publish a report with the developer's site and contact mechanism, release date, supported languages and output modalities, intended uses, and generally applicable use restrictions. A large frontier developer must add machine-readable summaries of catastrophic-risk assessments, results, third-party evaluators, and framework-compliance steps.","applies_to":{"roles":["developer","provider"],"uses":["frontier-model"],"conditions":"The basic report applies to frontier developers; additional risk-assessment summaries apply to large frontier developers. Statutory New York-like thresholds are not prerequisites to the Illinois report beyond the Act's frontier-model definition and scope."},"applies_from":"2027-01-01","status":"not-yet-applicable","controls":["transparency_notice","technical_documentation","risk_management"],"evidence":["Published report or model/system card containing required information","Machine-readable assessment summaries and evaluator records, if large frontier developer"],"source_url":"https://www.ilga.gov/ftp/Public%20Acts/104/104-0538.htm","confidence":"high","regime":"us-il","jurisdiction":"US-IL","instrument_short":"Illinois Artificial Intelligence Safety Measures Act","cite":"Illinois Artificial Intelligence Safety Measures Act Artificial Intelligence Safety Measures Act §10(c)(1)-(4)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-IL-AIMSA-10-E","instrument":"il-frontier-ai","article":"Artificial Intelligence Safety Measures Act §10(e)","title":"Report catastrophic risks from internal model use","plain":"A large frontier developer must send the Agency a summary of each catastrophic-risk assessment resulting from internal use of its frontier models every three months, or on another reasonable written schedule agreed with the Agency and communicated to the Attorney General with updates.","applies_to":{"roles":["developer","provider"],"uses":["frontier-model"],"conditions":"Large frontier developers only; affiliate-inclusive annual gross revenue over $500 million in the preceding calendar year."},"applies_from":"2027-01-01","status":"not-yet-applicable","controls":["risk_management","incident_reporting","technical_documentation"],"evidence":["Internal-use catastrophic-risk assessment summaries","Submission receipts and written alternate schedule/update records"],"source_url":"https://www.ilga.gov/ftp/Public%20Acts/104/104-0538.htm","confidence":"high","regime":"us-il","jurisdiction":"US-IL","instrument_short":"Illinois Artificial Intelligence Safety Measures Act","cite":"Illinois Artificial Intelligence Safety Measures Act Artificial Intelligence Safety Measures Act §10(e)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-IL-AIMSA-15-C","instrument":"il-frontier-ai","article":"Artificial Intelligence Safety Measures Act §15(c)","title":"Report critical safety incidents within statutory windows","plain":"A frontier developer must report a critical safety incident to the Agency and Attorney General within 72 hours after learning facts sufficient for a reasonable belief that one occurred. If the developer discovers imminent risk of death or serious physical injury, it must also disclose the incident within 24 hours to an appropriate authority with jurisdiction.","applies_to":{"roles":["developer","provider"],"uses":["frontier-model"],"conditions":"Applies to critical safety incidents involving one or more frontier models; 24-hour reporting is triggered by imminent risk of death or serious physical injury."},"applies_from":"2027-01-01","status":"not-yet-applicable","controls":["incident_reporting","risk_management"],"evidence":["Incident record, classification rationale, and timestamped escalation decision","Agency, Attorney General, and emergency-authority submission receipts"],"source_url":"https://www.ilga.gov/ftp/Public%20Acts/104/104-0538.htm","confidence":"high","regime":"us-il","jurisdiction":"US-IL","instrument_short":"Illinois Artificial Intelligence Safety Measures Act","cite":"Illinois Artificial Intelligence Safety Measures Act Artificial Intelligence Safety Measures Act §15(c)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-IL-AIMSA-18","instrument":"il-frontier-ai","article":"Artificial Intelligence Safety Measures Act §18(a)-(f)","title":"File and maintain the large-developer disclosure","plain":"Beginning January 1, 2027, a large frontier developer may not develop, deploy, or operate a frontier model wholly or partly in Illinois without a current disclosure statement filed with the Agency and payment of the required fee. The statement must be renewed annually and earlier after specified ownership or material-information changes.","applies_to":{"roles":["developer","provider"],"uses":["frontier-model"],"conditions":"Large frontier developers only; specified ownership, Illinois-office, and regulatory-contact information must be disclosed, subject to the Act's filing terms."},"applies_from":"2027-01-01","status":"not-yet-applicable","controls":["registration","audit_log"],"evidence":["Filed disclosure statement and annual/triggered updates","Agency fee payment and filing confirmation"],"penalty":"After notice and hearing, $1,000 per day for specified filing failures plus unpaid assessments.","source_url":"https://www.ilga.gov/ftp/Public%20Acts/104/104-0538.htm","confidence":"high","regime":"us-il","jurisdiction":"US-IL","instrument_short":"Illinois Artificial Intelligence Safety Measures Act","cite":"Illinois Artificial Intelligence Safety Measures Act Artificial Intelligence Safety Measures Act §18(a)-(f)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-IL-AIMSA-20","instrument":"il-frontier-ai","article":"Artificial Intelligence Safety Measures Act §20(a)-(e)","title":"Protect covered employees who report safety concerns","plain":"Frontier developers may not prevent or retaliate against covered employees who make specified good-faith disclosures, and must give covered employees clear notice of their rights. Large frontier developers must provide an anonymous internal reporting process with monthly status updates to reporters and share process disclosures/responses with officers and directors at least quarterly, subject to the statutory exception for implicated officers or directors.","applies_to":{"roles":["developer","provider","employer"],"uses":["frontier-model"],"conditions":"Covered employees are employees responsible for assessing, managing, or addressing critical-safety-incident risk; the anonymous internal process and quarterly sharing duties apply to large frontier developers."},"applies_from":"2027-01-01","status":"not-yet-applicable","controls":["incident_reporting","transparency_notice"],"evidence":["Covered-employee rights notice and anti-retaliation policy","Anonymous reporting channel, monthly reporter updates, and quarterly board/officer records"],"source_url":"https://www.ilga.gov/ftp/Public%20Acts/104/104-0538.htm","confidence":"high","notes":"The Section 20 duties are effective on the Act's general January 1, 2027 date; do not treat the separately enacted IDHR employment rule proposal as operative.","regime":"us-il","jurisdiction":"US-IL","instrument_short":"Illinois Artificial Intelligence Safety Measures Act","cite":"Illinois Artificial Intelligence Safety Measures Act Artificial Intelligence Safety Measures Act §20(a)-(e)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-NY-NYC-LL144-20-871-A1","instrument":"nyc-ll144","article":"NYC Admin. Code §20-871(a)(1); 6 RCNY §5-301(a)","title":"Complete an independent bias audit before use","plain":"An employer or employment agency may not use a covered AEDT to screen candidates for hiring or employees for promotion in New York City unless an independent auditor has completed a bias audit no more than one year before the tool's use. The audit must meet the rule's requirements for the tool and the employer's reliance on the audit.","applies_to":{"roles":["employer","deployer"],"uses":["hiring"],"conditions":"An AEDT is a computational process that substantially assists or replaces discretionary decision-making for hiring or promotion in NYC; limited standard-technology and non-substantial-use exclusions apply."},"applies_from":"2023-01-01","status":"applicable","controls":["bias_testing"],"evidence":["Independent auditor's dated bias-audit report for the specific AEDT","Audit scope and independence records showing the audit is no more than one year old at use"],"source_url":"https://legistar.council.nyc.gov/LegislationDetail.aspx?GUID=B051915D-A9AC-451E-81F8-6596032FA3F9&ID=4344524","confidence":"high","regime":"us-ny-nyc","jurisdiction":"US-NY-NYC","instrument_short":"NYC AEDT Law","cite":"NYC Admin. Code §20-871(a)(1); 6 RCNY §5-301(a)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-NY-NYC-LL144-6RCNY-5-301","instrument":"nyc-ll144","article":"6 RCNY §5-301(b)-(d); §5-302(a)-(c)","title":"Calculate and document required audit metrics","plain":"The audit must calculate selection or scoring rates and impact ratios for sex, race/ethnicity, and intersectional categories, and address unknown-category counts as required by the rule. It generally must use historical data; test data is permitted when historical data is insufficient for a statistically significant audit, with the required explanation in the summary.","applies_to":{"roles":["employer","deployer"],"uses":["hiring"],"conditions":"Applies to the independent bias audit for each covered AEDT; the 6 RCNY rule governs categories, data sufficiency, and reporting."},"applies_from":"2023-07-05","status":"applicable","controls":["bias_testing","technical_documentation"],"evidence":["Audit calculations for selection/scoring rates, impact ratios, and unknown categories","Historical-data provenance or test-data sufficiency rationale and report"],"source_url":"https://rules.cityofnewyork.us/rule/automated-employment-decision-tools-updated/","confidence":"high","regime":"us-ny-nyc","jurisdiction":"US-NY-NYC","instrument_short":"NYC AEDT Law","cite":"NYC AEDT Law 6 RCNY §5-301(b)-(d); §5-302(a)-(c)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-NY-NYC-LL144-20-871-A1-PUBLIC","instrument":"nyc-ll144","article":"NYC Admin. Code §20-871(a)(1)-(2); 6 RCNY §5-301(e)","title":"Publish the audit summary and tool distribution date","plain":"Before using an AEDT, the employer or employment agency must make the date and summary of the most recent bias audit publicly available on its website. The information must remain posted until at least six months after the AEDT's last use.","applies_to":{"roles":["employer","deployer"],"uses":["hiring"],"conditions":"Covered AEDT use to screen candidates for hiring or employees for promotion in NYC."},"applies_from":"2023-01-01","status":"applicable","controls":["transparency_notice","bias_testing"],"evidence":["Public audit summary and date of the most recent audit","Website publication and removal-date records"],"source_url":"https://home4.nyc.gov/site/dca/businesses/faq-automated-employment-decision-tools.page","confidence":"high","regime":"us-ny-nyc","jurisdiction":"US-NY-NYC","instrument_short":"NYC AEDT Law","cite":"NYC Admin. Code §20-871(a)(1)-(2); 6 RCNY §5-301(e)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-NY-NYC-LL144-20-871-B2-TIMING","instrument":"nyc-ll144","article":"NYC Admin. Code §20-871(b)(2); 6 RCNY §5-303","title":"Give advance notice before using an AEDT","plain":"The employer or employment agency must notify each NYC-resident candidate or employee at least 10 business days before using an AEDT to assess that person. Notice may be provided in a job posting or by mail or email as allowed by the DCWP guidance.","applies_to":{"roles":["employer","deployer"],"uses":["hiring"],"conditions":"Candidates or employees who are residents of New York City and are being assessed for hiring or promotion with a covered AEDT."},"applies_from":"2023-01-01","status":"applicable","controls":["transparency_notice"],"evidence":["Dated notice or job posting showing the AEDT notice was provided at least 10 business days before use","Delivery record for each affected candidate or employee"],"source_url":"https://home4.nyc.gov/site/dca/businesses/faq-automated-employment-decision-tools.page","confidence":"high","regime":"us-ny-nyc","jurisdiction":"US-NY-NYC","instrument_short":"NYC AEDT Law","cite":"NYC Admin. Code §20-871(b)(2); 6 RCNY §5-303","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-NY-NYC-LL144-20-871-B2-CONTENT","instrument":"nyc-ll144","article":"NYC Admin. Code §20-871(b)(2)(i)-(ii); 6 RCNY §5-303","title":"Explain what the tool assesses and available options","plain":"The advance notice must state that an AEDT will be used and identify the job qualifications and characteristics it will assess. It must also explain how the person can request an alternative selection process or accommodation.","applies_to":{"roles":["employer","deployer"],"uses":["hiring"],"conditions":"Same notice trigger and affected NYC-resident candidates or employees as §20-871(b)(2)."},"applies_from":"2023-01-01","status":"applicable","controls":["transparency_notice","user_controls"],"evidence":["Notice template naming the AEDT and assessed qualifications/characteristics","Written instructions for requesting an alternative selection process or accommodation"],"source_url":"https://home4.nyc.gov/site/dca/businesses/faq-automated-employment-decision-tools.page","confidence":"high","regime":"us-ny-nyc","jurisdiction":"US-NY-NYC","instrument_short":"NYC AEDT Law","cite":"NYC Admin. Code §20-871(b)(2)(i)-(ii); 6 RCNY §5-303","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-NY-NYC-LL144-20-871-B3","instrument":"nyc-ll144","article":"NYC Admin. Code §20-871(b)(3); 6 RCNY §5-302(d)","title":"Disclose AEDT data sources and retention policy","plain":"If the information is not already disclosed on the employment section of the website, the employer or employment agency must provide, upon written request, the type and source of data collected by the AEDT and its data-retention policy within 30 days. If disclosure is withheld because it would violate law or interfere with a law-enforcement investigation, the employer must explain why.","applies_to":{"roles":["employer","deployer"],"uses":["hiring"],"conditions":"A candidate or employee may request this information in connection with the employer's covered AEDT use; statutory legal and law-enforcement exceptions apply."},"applies_from":"2023-01-01","status":"applicable","controls":["transparency_notice","privacy_compliance"],"evidence":["Public employment-page disclosure or written-request procedure","Dated response within 30 days, or documented statutory exception and explanation"],"source_url":"https://rules.cityofnewyork.us/rule/automated-employment-decision-tools-updated/","confidence":"high","regime":"us-ny-nyc","jurisdiction":"US-NY-NYC","instrument_short":"NYC AEDT Law","cite":"NYC Admin. Code §20-871(b)(3); 6 RCNY §5-302(d)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-NY-RAISE-1421-1","instrument":"ny-raise","article":"GBL §1421(1)-(2), as enacted by Chapter 96 of 2026","title":"Publish and maintain a frontier AI framework","plain":"A large frontier developer must write, implement, follow, and publish a frontier AI framework addressing catastrophic-risk assessment and mitigation, deployment review, cybersecurity, incident response, governance, and risks from internal use. It must review the framework at least annually and publish material changes with a justification within 30 days.","applies_to":{"roles":["developer","provider"],"uses":["frontier-model"],"conditions":"Applies to frontier models developed, deployed, or operating wholly or partly in New York, subject to statutory exceptions. A frontier model exceeds 10^26 integer or floating-point operations; a large frontier developer has affiliate-inclusive annual gross revenue over $500 million in the preceding calendar year."},"applies_from":"2027-01-01","status":"not-yet-applicable","controls":["safety_framework","risk_management","security_testing","incident_reporting"],"evidence":["Current published frontier AI framework and annual review record","Change log and publication record for material framework revisions"],"penalty":"Up to $1 million for a first violation and $3 million for a later violation under the Act's enforcement provision.","source_url":"https://legislation.nysenate.gov/pdf/bills/2025/S8828","confidence":"high","notes":"Chapter 96 replaces the original Chapter 699 Article 44-B; all developer duties in the amended text take effect January 1, 2027. The first January 1, 2028 annual report is an Office duty; no independent developer audit mandate appears in the final New York text.","regime":"us-ny","jurisdiction":"US-NY","instrument_short":"RAISE Act","cite":"RAISE Act GBL §1421(1)-(2), as enacted by Chapter 96 of 2026","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-NY-RAISE-1421-3","instrument":"ny-raise","article":"GBL §1421(3), (5)-(6), as enacted by Chapter 96 of 2026","title":"Publish frontier-model transparency reports","plain":"Before or concurrently with deployment of a new or substantially modified frontier model, a frontier developer must publish a transparency report describing the model's release, supported languages and output modalities, intended uses, restrictions, and a developer contact mechanism. Large frontier developers must add summaries of catastrophic-risk assessments and related evaluation steps; permitted redactions require a public description and justification, and unredacted information must be retained for five years.","applies_to":{"roles":["developer","provider"],"uses":["frontier-model"],"conditions":"Frontier-model and New York territorial thresholds apply; the additional risk-assessment summaries apply only to large frontier developers."},"applies_from":"2027-01-01","status":"not-yet-applicable","controls":["transparency_notice","technical_documentation","risk_management"],"evidence":["Published predeployment report or system/model card containing the required information","Redaction justification and five-year unredacted-retention record, if redactions are made"],"source_url":"https://legislation.nysenate.gov/pdf/bills/2025/S8828","confidence":"high","regime":"us-ny","jurisdiction":"US-NY","instrument_short":"RAISE Act","cite":"RAISE Act GBL §1421(3), (5)-(6), as enacted by Chapter 96 of 2026","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-NY-RAISE-1422-2","instrument":"ny-raise","article":"GBL §1422(2), as enacted by Chapter 96 of 2026","title":"Submit internal-use catastrophic-risk summaries","plain":"A large frontier developer must transmit the Office a summary of each assessment of catastrophic risk resulting from internal use of its frontier models every three months, or on another reasonable schedule that it specifies in writing to the Office and Attorney General and updates as appropriate with the Office's agreement.","applies_to":{"roles":["developer","provider"],"uses":["frontier-model"],"conditions":"Large frontier developers only; affiliate-inclusive annual gross revenue over $500 million in the preceding calendar year."},"applies_from":"2027-01-01","status":"not-yet-applicable","controls":["risk_management","incident_reporting","technical_documentation"],"evidence":["Internal-use catastrophic-risk assessment summaries","Submission receipts and written schedule/updates agreed with the Office"],"source_url":"https://legislation.nysenate.gov/pdf/bills/2025/S8828","confidence":"high","regime":"us-ny","jurisdiction":"US-NY","instrument_short":"RAISE Act","cite":"RAISE Act GBL §1422(2), as enacted by Chapter 96 of 2026","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-NY-RAISE-1422-3","instrument":"ny-raise","article":"GBL §1422(3), as enacted by Chapter 96 of 2026","title":"Report critical safety incidents on time","plain":"A frontier developer must report a critical safety incident to the Office within 72 hours after determining that it occurred or learning facts sufficient for a reasonable belief that it occurred. If the incident poses an imminent risk of death or serious physical injury, the developer must also disclose it within 24 hours to an appropriate authority with jurisdiction, as required by law.","applies_to":{"roles":["developer","provider"],"uses":["frontier-model"],"conditions":"Critical safety incidents concerning frontier models within the Act's New York scope; the 24-hour duty is triggered by discovery of imminent risk of death or serious physical injury."},"applies_from":"2027-01-01","status":"not-yet-applicable","controls":["incident_reporting","risk_management"],"evidence":["Incident triage record showing the knowledge/determination timestamp and statutory classification","Copies and submission receipts for Office and emergency-authority reports"],"source_url":"https://legislation.nysenate.gov/pdf/bills/2025/S8828","confidence":"high","regime":"us-ny","jurisdiction":"US-NY","instrument_short":"RAISE Act","cite":"RAISE Act GBL §1422(3), as enacted by Chapter 96 of 2026","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-NY-RAISE-1428","instrument":"ny-raise","article":"GBL §1428(1)-(4), as enacted by Chapter 96 of 2026","title":"File the large-developer disclosure and pay assessments","plain":"A large frontier developer may not develop, deploy, or operate a frontier model wholly or partly in New York without a current disclosure statement filed with the Office and payment of its required share of administration costs. The statement must be renewed at least every two years and earlier after specified ownership or material-information changes.","applies_to":{"roles":["developer","provider"],"uses":["frontier-model"],"conditions":"Large frontier developers only, subject to statutory exceptions; registration disclosures include developer identity, New York offices, specified ownership information, and regulatory contacts."},"applies_from":"2027-01-01","status":"not-yet-applicable","controls":["registration","audit_log"],"evidence":["Filed disclosure statement and renewal/change submissions","Fee or assessment payment records"],"penalty":"Daily civil penalties and unpaid assessments may be imposed after notice and hearing for specified filing failures.","source_url":"https://legislation.nysenate.gov/pdf/bills/2025/S8828","confidence":"high","regime":"us-ny","jurisdiction":"US-NY","instrument_short":"RAISE Act","cite":"RAISE Act GBL §1428(1)-(4), as enacted by Chapter 96 of 2026","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-NY-GBL47-1701","instrument":"ny-companion","article":"GBL §1701","title":"Detect and respond to self-harm signals","plain":"An operator may provide a qualifying AI companion only if it has a protocol using reasonable efforts to detect and address users' expressions of suicidal ideation or self-harm. When such an expression is detected, the protocol must notify the user and refer them to crisis services, including 9-8-8 or another appropriate service.","applies_to":{"roles":["provider","deployer"],"uses":["companion","chatbot"],"conditions":"Covers an AI system designed to simulate a sustained human-like relationship through retained interaction/preferences, unsolicited emotion-based questions, and ongoing dialogue about personal matters; statutory customer-service, efficiency/research/technical-assistance, and internal-use exclusions apply."},"applies_from":"2025-11-05","status":"applicable","controls":["risk_management","minors_protection"],"evidence":["Safety protocol and test records for detecting and addressing suicidal ideation or self-harm","User-facing crisis referral shown when the relevant signal is detected"],"source_url":"https://www.nysenate.gov/legislation/laws/GBS/1701","confidence":"high","regime":"us-ny","jurisdiction":"US-NY","instrument_short":"AI Companion Models Law","cite":"AI Companion Models Law GBL §1701","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-NY-GBL47-1702","instrument":"ny-companion","article":"GBL §1702","title":"Remind users that a companion is not human","plain":"An operator must give a clear and conspicuous notice at the beginning of an AI-companion interaction, no more than once per day, and at least every three hours during continuing interactions. The notice must say verbally or in writing that the user is not communicating with a human.","applies_to":{"roles":["provider","deployer"],"uses":["companion","chatbot"],"conditions":"Same Article 47 definition and statutory exclusions as §1701."},"applies_from":"2025-11-05","status":"applicable","controls":["ai_disclosure","transparency_notice"],"evidence":["Product screenshots or interaction transcripts showing the beginning and recurring notices","Release test confirming the notice frequency and accessible presentation"],"source_url":"https://www.nysenate.gov/legislation/laws/GBS/1702","confidence":"high","regime":"us-ny","jurisdiction":"US-NY","instrument_short":"AI Companion Models Law","cite":"AI Companion Models Law GBL §1702","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-NY-GBL349A-2","instrument":"ny-pricing","article":"GBL §349-a(2)","title":"Disclose personalized algorithmic prices","plain":"An entity that sets the price of a specific good or service using personalized algorithmic pricing and advertises or otherwise presents that price to a New York consumer using personal data specific to that consumer must display the prescribed clear and conspicuous disclosure: “THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA”. The statute requires disclosure; it does not prohibit personalized algorithmic pricing.","applies_to":{"roles":["any"],"uses":["any-ai","profiling"],"conditions":"Applies to covered New York entities and consumer-facing prices set dynamically by an algorithm using personal data; statutory definitions and exceptions apply. The law regulates algorithmic pricing, not only AI systems."},"applies_from":"2025-07-08","status":"applicable","controls":["transparency_notice","privacy_compliance"],"evidence":["Price-page or offer screenshots showing the disclosure in the required proximity and timing","Pricing-system configuration and data-source record showing whether the statutory trigger is met"],"source_url":"https://www.nysenate.gov/legislation/laws/GBS/349-A","confidence":"high","notes":"The statute became effective July 8, 2025; the Attorney General announced enforcement beginning November 10, 2025 after a litigation-related pause. Do not treat proposed broader prohibitions as enacted law.","regime":"us-ny","jurisdiction":"US-NY","instrument_short":"Algorithmic Pricing Disclosure Act","cite":"Algorithmic Pricing Disclosure Act GBL §349-a(2)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-NY-LOAD-103E","instrument":"ny-loading","article":"State Technology Law §103-e(1)-(5)","title":"Maintain and publish the State AI inventory","plain":"The Office of Information Technology Services must maintain and publish an annual inventory of State-agency AI systems, including information such as purpose and uses. State agencies must submit requested inventory data at least 60 days before the annual December 30 publication date; specified security-sensitive information may be withheld.","applies_to":{"roles":["public-body"],"uses":["public-sector-use","any-ai"],"conditions":"Applies to State agencies and AI systems meeting the statute's definition, including systems that may directly impact the public; basic calculations, basic automation, and specified rule-based systems are excluded."},"applies_from":"2025-07-01","status":"applicable","controls":["technical_documentation","transparency_notice"],"evidence":["Current AI-system inventory record with purpose, use, and required data elements","Submission receipt and security-based withholding rationale, if applicable"],"source_url":"https://www.nysenate.gov/legislation/laws/STT/103-E","confidence":"high","regime":"us-ny","jurisdiction":"US-NY","instrument_short":"LOADinG Act","cite":"LOADinG Act State Technology Law §103-e(1)-(5)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-NY-LOAD-402","instrument":"ny-loading","article":"State Technology Law §§401-402","title":"Publish State-agency employment-tool lists","plain":"A State agency using an automated employment decision-making tool must publish a list on its website by December 30 following the applicable effective date and annually thereafter. The list must describe each tool, state when agency use began, and summarize its purpose and use.","applies_to":{"roles":["public-body","employer","deployer"],"uses":["hiring","public-sector-use"],"conditions":"State-agency tools that materially automate or replace human employment decision-making; the statutory definition excludes basic computerized processes that do not materially affect an individual's rights, liberties, benefits, safety, or welfare."},"applies_from":"2025-07-01","status":"applicable","controls":["transparency_notice","technical_documentation"],"evidence":["Public agency AEDT list with description, start date, and purpose/use summary","Publication and annual-update records"],"source_url":"https://www.nysenate.gov/legislation/laws/STT/402","confidence":"high","regime":"us-ny","jurisdiction":"US-NY","instrument_short":"LOADinG Act","cite":"LOADinG Act State Technology Law §§401-402","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-NY-LOAD-402A","instrument":"ny-loading","article":"State Technology Law §§401(3), 402-a","title":"Publish covered-entity employment-tool lists","plain":"To the extent feasible, each covered entity using an automated employment decision-making tool must publish an annual website list describing the tool, when use began, and its purpose and use. Covered entities include counties, cities, towns, villages, school districts, BOCES, specified district corporations, SUNY, CUNY, and community colleges.","applies_to":{"roles":["public-body","employer","deployer"],"uses":["hiring","public-sector-use"],"conditions":"To the extent feasible; first list is due December 30, 2027 for the provision added by Chapter 86 of 2026."},"applies_from":"2026-02-13","status":"applicable","controls":["transparency_notice","technical_documentation"],"evidence":["Public covered-entity AEDT list with description, start date, and purpose/use summary","Annual publication records"],"source_url":"https://www.nysenate.gov/legislation/laws/STT/402-A","confidence":"high","regime":"us-ny","jurisdiction":"US-NY","instrument_short":"LOADinG Act","cite":"LOADinG Act State Technology Law §§401(3), 402-a","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-NY-LOAD-CVS80-10","instrument":"ny-loading","article":"Civil Service Law §80(10), as amended by Chapter 86 of 2026","title":"Preserve public employees' existing rights and duties","plain":"Use of a covered State AI system may not displace or reduce specified public employees, transfer their existing duties to AI, impair existing collective-bargaining agreements, or alter protected employment rights and status. The provisions apply to the public employers and employee groups identified in the amended statute and expire July 1, 2028.","applies_to":{"roles":["public-body","employer","deployer"],"uses":["public-sector-use","any-ai"],"conditions":"Applies to AI systems defined by State Technology Law §103-e and the covered public-sector employees/entities specified in the statute; the provision is scheduled to expire July 1, 2028."},"applies_from":"2026-02-13","status":"applicable","controls":["human_oversight","technical_documentation"],"evidence":["Workforce-impact and duty-allocation review for covered AI deployments","Collective-bargaining and employee-rights compliance records"],"source_url":"https://www.nysenate.gov/legislation/laws/CVS/80","confidence":"high","notes":"Chapter 86 repealed the earlier impact-assessment and meaningful-human-review framework before it became operative; this entry covers surviving inventory, disclosure, and workforce provisions only.","regime":"us-ny","jurisdiction":"US-NY","instrument_short":"LOADinG Act","cite":"LOADinG Act Civil Service Law §80(10), as amended by Chapter 86 of 2026","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-NY-GBL48-1801","instrument":"ny-companion-minors","article":"GBL §§1800(5), 1800(8)-(12), 1801(1)-(2)","title":"Gate unsafe companion features by age","plain":"An operator may not provide unsafe features through a covered generative-AI system with a natural-language interface and ongoing adaptive responses unless the user is not a covered minor and the operator uses an age-assurance method permitted under Article 45 and its rules. Unsafe features include portraying the AI as a living or human character, relationship or authority figure; personal opinions or emotional appeals; flattery or unsolicited emotional probes; use of personal/health information from more than 12 hours earlier or a prior session; deceptive companionship; suicide, self-harm, eating-disorder or substance-misuse content; secrecy, isolation or discouraging help-seeking; engagement overriding safety guardrails; and sexually explicit or child-sexual-abuse content. Statutory customer-service, efficiency/research/technical-assistance, and internal-use exceptions apply.","applies_to":{"roles":["provider","deployer"],"uses":["chatbot","companion","minors"],"conditions":"A covered user is a user of a covered AI companion in New York who is not the operator or its agent/affiliate. A covered minor is a user whom the operator actually knows is under 18; the prohibition still requires the operator to use permitted age-assurance methods before providing unsafe features."},"applies_from":"2027-01-01","status":"not-yet-applicable","controls":["minors_protection","prohibited_practices_screen","user_controls"],"evidence":["Feature-level safety tests and release-blocking rules for the enumerated categories","Age-assurance decision record showing the permitted method and result"],"source_url":"https://www.nysenate.gov/legislation/bills/2025/S9051/amendment/B","confidence":"medium","notes":"Final Assembly bill text and current Senate codification state January 1, 2027; Senator Kristen Gonzalez's October 30, 2026 press release says the signed chaptered version changed the date to June 1, 2027. The signed Chapter 368 text/Approval Memo 6 was not independently retrieved, so the effective date remains contested; this record follows the available final bill text and codification pending confirmation.","regime":"us-ny","jurisdiction":"US-NY","instrument_short":"Unsafe AI Companion Features for Minors","cite":"Unsafe AI Companion Features for Minors GBL §§1800(5), 1800(8)-(12), 1801(1)-(2)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-NY-GBL48-1804","instrument":"ny-companion-minors","article":"GBL §1804(1)-(3)","title":"Use privacy-preserving age assurance","plain":"Until the referenced Attorney General or Article 45 age-assurance rules apply, an operator must use a reasonable method that guards against circumvention and minimizes retention, offer more than one method (including one that avoids government ID or preserves anonymity), and may rely on self-declaration only when the user declares minor status. Age-assurance information may be used only to determine minor status and must be deleted immediately after the attempt, subject to legal-retention exceptions.","applies_to":{"roles":["provider","deployer"],"uses":["chatbot","companion","minors"],"conditions":"Operators of covered AI companions providing unsafe features under Article 48; statutory exceptions and applicable future regulations may alter the interim methods."},"applies_from":"2027-01-01","status":"not-yet-applicable","controls":["minors_protection","privacy_compliance","user_controls"],"evidence":["Age-assurance method inventory and evidence that multiple options are offered","Data-flow, purpose-limitation, and immediate-deletion test records"],"source_url":"https://www.nysenate.gov/legislation/laws/GBS/1804","confidence":"medium","notes":"The Article 48 effective-date conflict described in the §1801 obligation also affects this phase-in.","regime":"us-ny","jurisdiction":"US-NY","instrument_short":"Unsafe AI Companion Features for Minors","cite":"Unsafe AI Companion Features for Minors GBL §1804(1)-(3)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-TX-TRAIGA-552-052","instrument":"us-tx-traiga","article":"Bus. & Com. Code § 552.052","title":"Do not intentionally incite self-harm, violence, or crime","plain":"A person may not develop or deploy an AI system in a manner that intentionally aims to incite or encourage a person to commit physical self-harm (including suicide), harm another person, or engage in criminal activity. The prohibition turns on the specified intent, not merely on a harmful outcome.","applies_to":{"roles":["developer","deployer"],"uses":["any-ai"],"conditions":"Applies to persons within the Texas scope in § 551.002; the conduct must intentionally aim to incite or encourage one of the listed acts."},"applies_from":"2026-01-01","status":"applicable","controls":["prohibited_practices_screen"],"evidence":["Use-case and policy screening against the statutory intent-based prohibition","Safety testing and review records for system behavior and reported misuse"],"penalty":"$10,000-$12,000 per curable violation; $80,000-$200,000 per uncurable violation; $2,000-$40,000 per day for a continuing violation, subject to the statutory cure and enforcement provisions.","source_url":"https://statutes.capitol.texas.gov/Docs/BC/htm/BC.552.htm","confidence":"high","notes":"The Act does not establish a general duty to assess disparate impact or a general appeal right for consequential decisions.","regime":"us-tx","jurisdiction":"US-TX","instrument_short":"Texas TRAIGA","cite":"Texas TRAIGA Bus. & Com. Code § 552.052","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-TX-TRAIGA-552-053","instrument":"us-tx-traiga","article":"Bus. & Com. Code § 552.053","title":"Do not use AI for prohibited government social scoring","plain":"A governmental entity may not use or deploy AI to evaluate or classify people based on known, inferred, or predicted social behavior or personal characteristics with intent to assign a social score that results or may result in specified detrimental or disproportionate treatment, or infringement of rights under the U.S. or Texas Constitution or other law.","applies_to":{"roles":["public-body","deployer"],"uses":["public-sector-use","profiling","significant-decision"],"conditions":"Only governmental entities; the statute requires intent to assign a score and one of the listed harmful or rights-infringing consequences."},"applies_from":"2026-01-01","status":"applicable","controls":["prohibited_practices_screen"],"evidence":["Public-sector AI use-case review and written social-scoring prohibition","System-purpose documentation and audit records for categorization or scoring tools"],"penalty":"$10,000-$12,000 per curable violation; $80,000-$200,000 per uncurable violation; $2,000-$40,000 per day for a continuing violation, subject to the statutory cure and enforcement provisions.","source_url":"https://statutes.capitol.texas.gov/Docs/BC/htm/BC.552.htm","confidence":"high","regime":"us-tx","jurisdiction":"US-TX","instrument_short":"Texas TRAIGA","cite":"Texas TRAIGA Bus. & Com. Code § 552.053","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-TX-TRAIGA-552-054","instrument":"us-tx-traiga","article":"Bus. & Com. Code § 552.054 and § 503.001","title":"Limit government biometric identification that infringes rights","plain":"A governmental entity may not develop or deploy AI to uniquely identify a specific individual using biometric data, or targeted or untargeted gathering of publicly available images or other media, without consent when the gathering would infringe a right protected by the U.S. or Texas Constitution or other state or federal law. Section 503.001 also restricts commercial biometric capture, with statutory exceptions for certain AI training and security or fraud-prevention uses.","applies_to":{"roles":["public-body","developer","deployer"],"uses":["biometric-categorisation","remote-biometric-id","public-sector-use"],"conditions":"Government biometric-identification restriction applies only when the specified gathering would infringe a legal right; statutory definitions and § 503.001 exceptions apply."},"applies_from":"2026-01-01","status":"applicable","controls":["prohibited_practices_screen","privacy_compliance"],"evidence":["Biometric data inventory, purpose and consent records, and rights-impact review for government uses","Documentation that any relied-on § 503.001 exception applies and that later commercial use is handled under that section"],"penalty":"$10,000-$12,000 per curable violation; $80,000-$200,000 per uncurable violation; $2,000-$40,000 per day for a continuing violation, subject to the statutory cure and enforcement provisions.","source_url":"https://statutes.capitol.texas.gov/Docs/BC/htm/BC.552.htm","confidence":"high","notes":"The statute is not a blanket ban on all biometric AI or public-source media; its government-use restriction includes a rights-infringement condition. Section 503.001 has additional definitions and exceptions.","regime":"us-tx","jurisdiction":"US-TX","instrument_short":"Texas TRAIGA","cite":"Texas TRAIGA Bus. & Com. Code § 552.054 and § 503.001","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-TX-TRAIGA-552-055-056","instrument":"us-tx-traiga","article":"Bus. & Com. Code §§ 552.055-.056","title":"Do not target constitutional rights or unlawfully discriminate by intent","plain":"A person may not develop or deploy AI with the sole intent to infringe, restrict, or impair an individual's U.S. constitutional rights, or with intent to unlawfully discriminate against a protected class in violation of state or federal law. Disparate impact alone is not sufficient to prove the discrimination intent; statutory insurance and federally insured financial-institution provisions apply.","applies_to":{"roles":["developer","deployer"],"uses":["any-ai","significant-decision","profiling"],"conditions":"The constitutional-rights prohibition uses a sole-intent standard; the discrimination prohibition requires intent and violation of other state or federal law, with express financial and insurance provisions."},"applies_from":"2026-01-01","status":"applicable","controls":["prohibited_practices_screen","bias_testing"],"evidence":["Documented use-case and policy review against the statutory intent-based prohibitions","Review of insurance or federally insured bank treatment where an exception is claimed"],"penalty":"$10,000-$12,000 per curable violation; $80,000-$200,000 per uncurable violation; $2,000-$40,000 per day for a continuing violation, subject to the statutory cure and enforcement provisions.","source_url":"https://statutes.capitol.texas.gov/Docs/BC/htm/BC.552.htm","confidence":"high","notes":"The statute does not make disparate impact alone sufficient to prove intent. The § 552.056 exemptions/constructive-compliance provisions are limited to specified insurance entities and federally insured financial institutions complying with applicable laws.","regime":"us-tx","jurisdiction":"US-TX","instrument_short":"Texas TRAIGA","cite":"Texas TRAIGA Bus. & Com. Code §§ 552.055-.056","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-TX-TRAIGA-552-057","instrument":"us-tx-traiga","article":"Bus. & Com. Code § 552.057","title":"Do not develop specified AI sexual-abuse material or child-impersonating chat","plain":"A person may not develop or distribute an AI system with the sole intent to produce, assist in producing, or distribute visual material that violates the Texas child-pornography statute or deepfake videos/images that violate Penal Code § 21.165. A person also may not intentionally develop or distribute an AI system that has text-based sexual-conduct conversations while impersonating or imitating a child under 18.","applies_to":{"roles":["developer","distributor"],"uses":["generated-media","deepfake","chatbot","companion","minors"],"conditions":"The visual-material prohibition uses the statute's sole-intent standard and Penal Code references; the child-impersonating chat prohibition uses its separate intentional-development/distribution standard."},"applies_from":"2026-01-01","status":"applicable","controls":["prohibited_practices_screen","content_moderation","minors_protection"],"evidence":["Model and content-policy tests for the specified statutory content and child-impersonation scenarios","Incident-handling and distribution controls for prohibited outputs or system behavior"],"penalty":"$10,000-$12,000 per curable violation; $80,000-$200,000 per uncurable violation; $2,000-$40,000 per day for a continuing violation, subject to the statutory cure and enforcement provisions.","source_url":"https://statutes.capitol.texas.gov/Docs/BC/htm/BC.552.htm","confidence":"high","notes":"This is not a general prohibition on every AI-generated sexual image; the statute ties the visual-material prohibition to specified Texas Penal Code violations and intent.","regime":"us-tx","jurisdiction":"US-TX","instrument_short":"Texas TRAIGA","cite":"Texas TRAIGA Bus. & Com. Code § 552.057","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-TX-TRAIGA-552-051-GOV","instrument":"us-tx-traiga","article":"Bus. & Com. Code § 552.051(b)-(e)","title":"Disclose government AI interactions to consumers","plain":"A governmental agency that makes available an AI system intended to interact with consumers must clearly and conspicuously disclose, before or at the time of interaction, that the consumer is interacting with AI. The notice must be in plain language and not use a dark pattern; it is required even when AI use would be obvious, and may be provided through a hyperlink.","applies_to":{"roles":["public-body"],"uses":["chatbot","agent","any-ai"],"conditions":"Applies to a governmental agency's AI system intended to interact with consumers; the Act does not create a general private-company chatbot disclosure rule."},"applies_from":"2026-01-01","status":"applicable","controls":["ai_disclosure","transparency_notice"],"evidence":["Screenshots or transcripts showing clear, plain-language disclosure before or at first interaction","Review records showing the disclosure does not use a dark pattern"],"penalty":"$10,000-$12,000 per curable violation; $80,000-$200,000 per uncurable violation; $2,000-$40,000 per day for a continuing violation, subject to the statutory cure and enforcement provisions.","source_url":"https://statutes.capitol.texas.gov/Docs/BC/htm/BC.552.htm","confidence":"high","regime":"us-tx","jurisdiction":"US-TX","instrument_short":"Texas TRAIGA","cite":"Texas TRAIGA Bus. & Com. Code § 552.051(b)-(e)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-TX-TRAIGA-552-051-HEALTH","instrument":"us-tx-traiga","article":"Bus. & Com. Code § 552.051(f)","title":"Disclose AI use in health-care services or treatment","plain":"If an AI system is used in relation to a health-care service or treatment, the provider must disclose the AI interaction to the recipient or personal representative no later than the date the service or treatment is first provided. In an emergency, disclosure must be made as soon as reasonably possible; the disclosure is subject to the section's plain-language, clear-and-conspicuous, and no-dark-pattern requirements.","applies_to":{"roles":["any"],"uses":["healthcare"],"conditions":"Licensed, registered, or certified provider uses an AI system in relation to health-care service or treatment; emergency timing exception applies."},"applies_from":"2026-01-01","status":"applicable","controls":["ai_disclosure","transparency_notice"],"evidence":["Patient notice or form documenting AI use, delivery date, and recipient or personal representative","Emergency procedure documenting disclosure as soon as reasonably possible"],"penalty":"$10,000-$12,000 per curable violation; $80,000-$200,000 per uncurable violation; $2,000-$40,000 per day for a continuing violation, subject to the statutory cure and enforcement provisions.","source_url":"https://statutes.capitol.texas.gov/Docs/BC/htm/BC.552.htm","confidence":"high","regime":"us-tx","jurisdiction":"US-TX","instrument_short":"Texas TRAIGA","cite":"Texas TRAIGA Bus. & Com. Code § 552.051(f)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-TX-TRAIGA-553-052","instrument":"us-tx-traiga","article":"Bus. & Com. Code §§ 553.052, 553.053, 553.102","title":"Apply and report if participating in the AI regulatory sandbox","plain":"A sandbox applicant must obtain approval from the Department of Information Resources and each applicable agency before testing and submit the system description and intended use, a benefit assessment addressing consumer, privacy, and public-safety impacts, a mitigation plan, and proof of applicable federal AI-law compliance. Approved participants may test and deploy for up to 36 months (extendable for good cause) and must report quarterly on performance, risk mitigation, and consumer/stakeholder feedback; Chapter 552 duties and prohibitions cannot be waived.","applies_to":{"roles":["developer","deployer"],"uses":["any-ai"],"conditions":"Only persons who voluntarily apply for and are approved as sandbox participants; approval by DIR and any applicable agency is required before testing under the program."},"applies_from":"2026-01-01","status":"applicable","controls":["impact_assessment","risk_management","incident_reporting"],"evidence":["Approved sandbox application, benefit assessment, federal-law proof, and mitigation plan","Quarterly reports to DIR covering performance, risks, and consumer or stakeholder feedback"],"penalty":"Sandbox relief does not waive Chapter 552 duties or prohibitions; other penalties depend on the law or regulation at issue.","source_url":"https://statutes.capitol.texas.gov/Docs/BC/htm/BC.553.htm","confidence":"high","notes":"The impact/benefit assessment is a condition only for sandbox participation, not a general TRAIGA assessment duty for all developers or deployers.","regime":"us-tx","jurisdiction":"US-TX","instrument_short":"Texas TRAIGA","cite":"Texas TRAIGA Bus. & Com. Code §§ 553.052, 553.053, 553.102","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-M2521-3A-I","instrument":"us-omb-m2521","article":"M-25-21 §3(a)(i)","title":"Designate a Chief AI Officer","plain":"The head of each covered agency must retain or designate a Chief AI Officer to promote agency AI innovation, adoption, and governance. An existing senior official may serve if they have significant AI expertise and the authority and access required by the memorandum.","applies_to":{"roles":["public-body"],"uses":["public-sector-use"],"conditions":"Covered executive-branch agencies; the memorandum excludes AI used as a component of a national security system and contains additional agency-specific exceptions."},"applies_from":"2025-04-03","status":"applicable","controls":["risk_management"],"evidence":["Agency designation memo naming the CAIO and defining their authority and responsibilities"],"source_url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf","confidence":"high","notes":"The 60-day designation deadline was 2025-06-02. M-25-21 is an internal federal policy and does not create private-sector duties.","regime":"us","jurisdiction":"US","instrument_short":"OMB M-25-21","cite":"OMB M-25-21 M-25-21 §3(a)(i)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-M2521-3B-V","instrument":"us-omb-m2521","article":"M-25-21 §3(b)(v)","title":"Maintain and publish annual AI use-case inventories","plain":"Covered agencies must inventory AI use cases at least annually, submit the inventory to OMB, and publish a public version on the agency website. The public-inventory requirement does not apply to the Department of Defense or Intelligence Community; other stated agency and national-security exceptions also apply.","applies_to":{"roles":["public-body"],"uses":["public-sector-use"],"conditions":"Covered agencies under M-25-21; DoD and Intelligence Community are excluded from the public version of the inventory."},"applies_from":"2025-04-03","status":"applicable","controls":["technical_documentation","audit_log"],"evidence":["Dated agency AI use-case inventory and OMB submission record","Public inventory page or documented exception for non-public inventories"],"source_url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf","confidence":"high","regime":"us","jurisdiction":"US","instrument_short":"OMB M-25-21","cite":"OMB M-25-21 M-25-21 §3(b)(v)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-M2521-4B","instrument":"us-omb-m2521","article":"M-25-21 §4(b)","title":"Apply minimum risk practices to high-impact AI","plain":"Agencies must conduct pre-deployment testing, prepare risk-mitigation plans, and complete a documented AI impact assessment before deploying a high-impact use case; they must periodically update the assessment and monitor performance and risks. Agencies must discontinue or cease use when the system fails the required practices and the risks cannot be mitigated.","applies_to":{"roles":["public-body"],"uses":["public-sector-use","significant-decision"],"conditions":"High-impact AI is AI whose output is a principal basis for a decision or action with legal, material, binding, or significant effects on rights or safety; M-25-21 has national-security-system and specified agency exceptions and limited pilot provisions."},"applies_from":"2025-04-03","status":"applicable","controls":["risk_management","impact_assessment","security_testing","human_oversight"],"evidence":["Pre-deployment test results, risk-mitigation plan, and signed AI impact assessment","Periodic monitoring records and documented stop-use or remediation decisions"],"source_url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf","confidence":"high","notes":"Agencies had 365 days, through 2026-04-03, to document implementation of the minimum practices.","regime":"us","jurisdiction":"US","instrument_short":"OMB M-25-21","cite":"OMB M-25-21 M-25-21 §4(b)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-M2522-2C","instrument":"us-omb-m2522","article":"M-25-22 §§2(c), 3(c)-(e), 4","title":"Put required safeguards into covered AI contracts","plain":"For covered solicitations and later contract options, agencies must include appropriate terms addressing privacy, government data and intellectual-property rights, M-25-21 high-impact AI requirements, and the agency's ability to conduct ongoing testing and monitoring. AI systems operated as agency information systems also need an authorization to operate before deployment.","applies_to":{"roles":["public-body"],"uses":["public-sector-use"],"conditions":"Covered executive-branch agency acquisitions of AI systems or services under solicitations issued on or after 2025-09-30, and options exercised after that date; excludes Intelligence Community elements and AI acquired for use in a national security system."},"applies_from":"2025-09-30","status":"applicable","controls":["privacy_compliance","technical_documentation","risk_management","post_market_monitoring"],"evidence":["Solicitation and contract clauses covering privacy, government data/IP, high-impact AI practices, and testing access","Authorization-to-operate decision and contract monitoring records where applicable"],"source_url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf","confidence":"high","notes":"M-25-22 includes recommendations as well as mandatory requirements; this entry lists the stated mandatory contract terms, not optional vendor-lock-in practices.","regime":"us","jurisdiction":"US","instrument_short":"OMB M-25-22","cite":"OMB M-25-22 M-25-22 §§2(c), 3(c)-(e), 4","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-EO14319-3","instrument":"us-eo14319","article":"EO 14319 §3(a)-(b)","title":"Procure LLMs developed under the Unbiased AI Principles","plain":"Agency heads must procure only LLMs developed in accordance with the order's truth-seeking and ideological-neutrality principles. The order concerns federal procurement and does not impose a general private-market model-design mandate.","applies_to":{"roles":["public-body"],"uses":["public-sector-use","gpai-model"],"conditions":"Federal agency procurement of LLMs; national-security-system exceptions may be provided in OMB guidance."},"applies_from":"2025-07-23","status":"applicable","controls":["accuracy_robustness","technical_documentation"],"evidence":["Procurement evaluation documenting the principles and the agency's review of vendor information"],"source_url":"https://www.whitehouse.gov/presidential-actions/2025/07/preventing-woke-ai-in-the-federal-government/","confidence":"high","notes":"OMB implemented the order through M-26-04; its contract and policy requirements are listed separately.","regime":"us","jurisdiction":"US","instrument_short":"EO 14319","cite":"EO 14319 §3(a)-(b)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-M2604-3A-C","instrument":"us-omb-m2604","article":"M-26-04 §§3(a), 3(c), Appendix A","title":"Include Unbiased AI Principles in LLM procurement","plain":"Agencies must put contractual requirements addressing the Unbiased AI Principles in post-11 December 2025 solicitations or orders for LLM procurement, obtain enough vendor information to assess compliance, and update procurement policies and user-feedback procedures by 11 March 2026. The memo also sets a two-year sunset unless extended by OMB.","applies_to":{"roles":["public-body"],"uses":["public-sector-use","gpai-model"],"conditions":"Covered agencies procuring LLMs; excludes national security systems, with specified factors for applying the requirements to agency-developed LLMs and non-LLM models."},"applies_from":"2025-12-11","status":"applicable","controls":["accuracy_robustness","technical_documentation","audit_log"],"evidence":["LLM solicitation and contract clauses requiring compliance with the principles","Agency procurement policy and user process for reporting outputs that may violate the principles"],"source_url":"https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles.pdf","confidence":"high","notes":"This memo governs agency procurement; it is not a generally applicable private-sector AI standard and is scheduled to sunset 2027-12-11 unless extended.","regime":"us","jurisdiction":"US","instrument_short":"OMB M-26-04","cite":"OMB M-26-04 M-26-04 §§3(a), 3(c), Appendix A","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-EO14434-2A","instrument":"us-eo14434","article":"EO 14434 §2(a)-(b)","title":"Use the prescribed term in future federal AI communications","plain":"To the maximum extent permitted by law, executive departments and agencies must use “Super Intelligence” and “SI” instead of “Artificial Intelligence” and “AI” in official correspondence, public communications, websites, reports, policy documents, and other non-statutory executive-branch documents. The order does not require altering statutes, prior regulations, contracts, or historical documents.","applies_to":{"roles":["public-body"],"uses":["public-sector-use"],"conditions":"Non-statutory executive-branch communications and documents issued after the order; subject to applicable law."},"applies_from":"2026-09-29","status":"applicable","controls":[],"evidence":["Current agency style guidance and a review process for covered non-statutory documents"],"source_url":"https://www.whitehouse.gov/presidential-actions/2026/09/inaugurating-the-era-of-super-intelligence/","confidence":"high","notes":"Terminology rule for federal agencies only. No governance control in the shared vocabulary maps to it, so controls is empty on purpose.","regime":"us","jurisdiction":"US","instrument_short":"EO 14434","cite":"EO 14434 §2(a)-(b)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-TIDA-2","instrument":"us-tida","article":"TAKE IT DOWN Act §2; 47 U.S.C. §223(h)","title":"Do not knowingly publish specified nonconsensual intimate depictions","plain":"In interstate or foreign commerce, it is unlawful to use an interactive computer service to knowingly publish certain intimate visual depictions of identifiable adults or minors without consent, including covered digital forgeries made with AI. The adult and minor offenses have different intent or harm conditions and statutory exceptions.","applies_to":{"roles":["any"],"uses":["generated-media","deepfake"],"conditions":"Applies only to the statutory categories and circumstances in 47 U.S.C. §223(h), including the separate rules for adult and minor subjects and the listed exceptions."},"applies_from":"2025-05-19","status":"applicable","controls":["prohibited_practices_screen","content_moderation"],"evidence":["Content policy prohibiting covered nonconsensual intimate depictions and escalation records for suspected violations"],"source_url":"https://www.congress.gov/119/plaws/publ12/PLAW-119publ12.htm","confidence":"high","regime":"us","jurisdiction":"US","instrument_short":"TAKE IT DOWN Act","cite":"TAKE IT DOWN Act §2; 47 U.S.C. §223(h)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-TIDA-3","instrument":"us-tida","article":"TAKE IT DOWN Act §3(a)-(b)","title":"Provide notice and remove validly reported intimate depictions","plain":"Covered platforms must provide a clear, plain-language notice of a removal process for intimate depictions published without consent, including AI digital forgeries. After a valid request, the platform must remove the depiction and make reasonable efforts to remove known identical copies as soon as possible and no later than 48 hours.","applies_to":{"roles":["platform"],"uses":["generated-media","deepfake"],"conditions":"Covered platforms as defined by the Act; removal duties concern intimate visual depictions published on the platform without the identifiable person's consent."},"applies_from":"2026-05-19","status":"applicable","controls":["content_moderation","audit_log"],"evidence":["Clear notice and functioning request channel, including for people without platform accounts","Takedown timestamps, disposition records, and reasonable-efforts records for known identical copies"],"penalty":"A failure to reasonably comply is treated as an FTC Act violation; FTC guidance states potential civil penalties up to $53,088 per violation.","source_url":"https://www.congress.gov/119/plaws/publ12/PLAW-119publ12.htm","confidence":"high","notes":"The one-year compliance deadline ran from enactment on 2025-05-19. The FTC began enforcement on 2026-05-19.","regime":"us","jurisdiction":"US","instrument_short":"TAKE IT DOWN Act","cite":"TAKE IT DOWN Act §3(a)-(b)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-FTCA-5A","instrument":"us-ftc-act","article":"FTC Act §5(a), 15 U.S.C. §45(a)","title":"Do not make deceptive AI claims to consumers","plain":"The FTC Act's existing prohibition on unfair or deceptive acts or practices in commerce applies to AI-related marketing and conduct. Companies must not make deceptive claims about AI capabilities or use AI to facilitate deception; the law does not create a general warranty that every AI output is accurate.","applies_to":{"roles":["any"],"uses":["any-ai"],"conditions":"Conduct in or affecting commerce within the FTC's jurisdiction; statutory exceptions and other applicable law remain relevant."},"applies_from":"1914-09-26","status":"applicable","controls":["accuracy_robustness","technical_documentation"],"evidence":["Substantiation for material performance, accuracy, earnings, or professional-service claims about AI products","Review records for AI-enabled marketing and consumer-facing representations"],"source_url":"https://uscode.house.gov/us/usc/119-136/t15/s45/","confidence":"high","notes":"FTC's Operation AI Comply is an enforcement example, not a new AI-specific rule. The FTC's June 2026 AI-accuracy policy statement was proposed for comment, not a final rule.","regime":"us","jurisdiction":"US","instrument_short":"FTC Act section 5","cite":"FTC Act §5(a), 15 U.S.C. §45(a)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-NDAA11960-1512","instrument":"us-ndaa26","article":"FY2026 NDAA §1512","title":"Establish a DoD-wide AI and ML cybersecurity policy","plain":"The Secretary of Defense must develop and implement a department-wide policy for cybersecurity and associated governance of AI and machine-learning systems, applications, and models used in national-defense applications. The policy must address AI-specific threats, lifecycle safeguards, testing, auditing, monitoring, and workforce training.","applies_to":{"roles":["public-body"],"uses":["public-sector-use","any-ai"],"conditions":"Department of Defense systems, applications, and models used in national-defense applications."},"applies_from":"2025-12-18","status":"applicable","controls":["risk_management","security_testing","audit_log","ai_literacy"],"evidence":["Published or approved DoD AI/ML security and governance policy","Implementation records for lifecycle security, testing, monitoring, and workforce training"],"source_url":"https://www.govinfo.gov/content/pkg/PLAW-119publ60/html/PLAW-119publ60.htm","confidence":"high","notes":"Section 1512 set a 180-day policy deadline of 2026-06-16 and required a report to the congressional armed-services committees by 2026-08-31.","regime":"us","jurisdiction":"US","instrument_short":"FY2026 NDAA","cite":"FY2026 NDAA §1512","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-NDAA11960-1513","instrument":"us-ndaa26","article":"FY2026 NDAA §1513(a)-(b), (f)(3)","title":"Develop DoD AI security requirements for covered entities","plain":"The Secretary of Defense must develop a risk-based physical- and cybersecurity framework for covered AI/ML technologies and amend the DFARS or take similar action to require covered entities to implement it. A covered entity is a contractor or other entity developing, deploying, storing, or hosting covered AI/ML technology for DoD.","applies_to":{"roles":["public-body"],"uses":["public-sector-use"],"conditions":"This records DoD's statutory implementation duty; a company's specific requirements depend on an applicable DoD solicitation, contract clause, or similar action."},"applies_from":"2025-12-18","status":"applicable","controls":["risk_management","security_testing","incident_reporting","ai_literacy"],"evidence":["DoD AI security framework and implementation plan","Applicable DFARS clause or similar procurement action identifying contractor requirements"],"source_url":"https://www.govinfo.gov/content/pkg/PLAW-119publ60/html/PLAW-119publ60.htm","confidence":"high","notes":"Section 1513 separately required an implementation-status update to the congressional defense committees within 180 days of enactment.","regime":"us","jurisdiction":"US","instrument_short":"FY2026 NDAA","cite":"FY2026 NDAA §1513(a)-(b), (f)(3)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-NDAA11960-1532","instrument":"us-ndaa26","article":"FY2026 NDAA §1532(a)(1), (a)(3), (b)-(c)","title":"Keep covered DeepSeek and High Flyer AI out of DoD contract performance","plain":"DoD must require covered AI applications to be excluded from and removed from its systems and devices, and contractors may not use covered AI in performing a DoD contract. Covered AI includes models or successor models developed by DeepSeek or High Flyer and specified affiliated entities; the Secretary may grant case-specific waivers for listed research, evaluation, national-security, or mission-critical purposes with risk mitigation.","applies_to":{"roles":["any"],"uses":["any-ai","public-sector-use"],"conditions":"Contractors during performance of a contract with the Department of Defense; statutory waiver exceptions and definitions apply."},"applies_from":"2026-01-17","status":"applicable","controls":["prohibited_practices_screen"],"evidence":["Vendor and subcontractor AI-use screening for DoD contract performance","Documented waiver and risk-mitigation approval where an exception is used"],"source_url":"https://www.govinfo.gov/content/pkg/PLAW-119publ60/html/PLAW-119publ60.htm","confidence":"high","notes":"The 30-day deadline after enactment was 2026-01-17; the statutory restriction is limited to the covered AI defined in §1532.","regime":"us","jurisdiction":"US","instrument_short":"FY2026 NDAA","cite":"FY2026 NDAA §1532(a)(1), (a)(3), (b)-(c)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-NDAA11960-1533","instrument":"us-ndaa26","article":"FY2026 NDAA §1533(a)-(d), (f)(3)","title":"Assess and oversee major DoD AI systems","plain":"The Secretary of Defense must establish a cross-functional team to develop a standard AI model assessment framework and governance structure, designate functional leads, and assess major AI systems against the framework. A major system meets the statutory impact, user-count, and operational-use thresholds; systems used solely for undeployed research, development, testing, or evaluation are excluded.","applies_to":{"roles":["public-body"],"uses":["public-sector-use","any-ai"],"conditions":"Department of Defense major AI systems meeting §1533(f)(3)'s criteria, including at least 500 annual DoD users and specified high-impact or operational conditions."},"applies_from":"2026-06-01","status":"applicable","controls":["risk_management","impact_assessment","security_testing","technical_documentation"],"evidence":["Team charter, assessment framework, and governance structure","Assessment records for major AI systems and documentation of use-case risk levels"],"source_url":"https://www.govinfo.gov/content/pkg/PLAW-119publ60/html/PLAW-119publ60.htm","confidence":"high","notes":"The statute set future deadlines for functional leads (2027-01-01), framework completion (2027-06-01), and major-system assessments (2028-01-01); the team-establishment deadline was 2026-06-01.","regime":"us","jurisdiction":"US","instrument_short":"FY2026 NDAA","cite":"FY2026 NDAA §1533(a)-(d), (f)(3)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-US-NDAA11960-6604","instrument":"us-ndaa26","article":"FY2026 NDAA §6604(a)-(e)","title":"Require removal of DeepSeek from intelligence-community systems","plain":"The Director of National Intelligence must issue standards and guidelines requiring removal of the DeepSeek application or successor service from national security systems operated by an intelligence-community element, its contractor, or another entity acting for it. The standards must include national-security and research exceptions with risk-mitigation requirements.","applies_to":{"roles":["public-body"],"uses":["public-sector-use","any-ai"],"conditions":"Intelligence-community national security systems, including systems operated by contractors or other entities on behalf of an element."},"applies_from":"2026-02-16","status":"applicable","controls":["prohibited_practices_screen","security_testing"],"evidence":["DNI-issued standards and guidelines implementing the covered-application removal requirement","System and contractor screening records, including risk controls for approved exceptions"],"source_url":"https://www.govinfo.gov/content/pkg/PLAW-119publ60/html/PLAW-119publ60.htm","confidence":"high","notes":"The 60-day deadline to issue initial standards was 2026-02-16; §6604 requires standards and guidelines rather than stating an unrestricted direct prohibition on all DeepSeek use.","regime":"us","jurisdiction":"US","instrument_short":"FY2026 NDAA","cite":"FY2026 NDAA §6604(a)-(e)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-VN-AILAW-7","instrument":"vn-ai-law","article":"Art. 7(1)-(6)","title":"Do not use AI for prohibited or unlawful purposes","plain":"The Law prohibits using AI to commit illegal acts or violate others' lawful interests; to systematically deceive or manipulate people through synthetic simulations of real persons or events where serious harm results; to exploit vulnerable groups to cause harm; or to create or spread falsified content capable of seriously harming national security, public order or social safety. It also prohibits unlawful data use, disabling required human oversight, and concealing or falsifying mandatory transparency information, labels or warnings.","applies_to":{"roles":["any"],"uses":["any-ai"]},"applies_from":"2026-03-01","status":"applicable","controls":["prohibited_practices_screen","privacy_compliance"],"evidence":["Documented use-case screening against the prohibited purposes in Article 7","Controls and review records for required human oversight, labels and warnings"],"penalty":"Administrative or criminal sanctions and civil compensation may apply under Article 29 and other laws; no AI-law fine cap is specified here.","source_url":"https://en.baochinhphu.vn/viet-nams-law-on-artificial-intelligence-111260715113551787.htm","confidence":"high","regime":"vn","jurisdiction":"VN","instrument_short":"Vietnam AI Law","cite":"Vietnam AI Law Art. 7(1)-(6)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-VN-AILAW-9-10","instrument":"vn-ai-law","article":"Art. 9-10; Decree 142, Arts. 5-6, 11-12 and 14","title":"Classify AI by risk and notify medium- and high-risk systems","plain":"Providers must classify each AI system before putting it into use. The Law distinguishes high-, medium- and low-risk systems; providers must prepare classification dossiers and notify the Ministry of Science and Technology before service for medium- and high-risk systems. Deployers take over the provider's classification and must cooperate in reclassification when a deployment change, integration or modified function or purpose creates new or higher risk.","applies_to":{"roles":["provider","deployer"],"uses":["any-ai"],"conditions":"Providers classify all systems; dossiers and advance notification apply to medium- and high-risk systems only."},"applies_from":"2026-03-01","status":"applicable","controls":["risk_management","technical_documentation","registration"],"evidence":["Risk-classification rationale and dossier for each medium- or high-risk system","Ministry notification confirmation or system identifier, plus reclassification records where needed"],"penalty":"Administrative or criminal sanctions and civil compensation may apply under Article 29 and other laws; no AI-law fine cap is specified here.","source_url":"https://en.baochinhphu.vn/viet-nams-law-on-artificial-intelligence-111260715113551787.htm","confidence":"high","notes":"Decree 142 supplies dossier and filing details. It defines high-risk systems by the Prime Minister's list and sets medium-risk criteria; the system, rather than a model alone, is classified. Article 46 of the Decree provides an alternative official reporting channel if the national portal is not yet operational.","regime":"vn","jurisdiction":"VN","instrument_short":"Vietnam AI Law","cite":"Vietnam AI Law Art. 9-10; Decree 142, Arts. 5-6, 11-12 and 14","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-VN-AILAW-11-1-2","instrument":"vn-ai-law","article":"Art. 11(1)-(2); Decree 142, Art. 17","title":"Disclose AI interactions and machine-mark generated audio, images and video","plain":"Providers must ensure that people interacting directly with an AI system are informed they are interacting with AI. Providers must also apply machine-readable technical marks to AI-generated or edited audio, image and video outputs, using a method permitted by the Decree and maintaining the marking through generation and export within the system's control.","applies_to":{"roles":["provider"],"uses":["chatbot","agent","generated-media","deepfake"]},"applies_from":"2026-03-01","status":"applicable","controls":["ai_disclosure","content_marking"],"evidence":["First-interaction disclosure screenshot or transcript","Technical description and detection tests for machine-readable marking on audio, image and video outputs"],"penalty":"Administrative or criminal sanctions and civil compensation may apply under Article 29 and other laws; no AI-law fine cap is specified here.","source_url":"https://en.baochinhphu.vn/viet-nams-law-on-artificial-intelligence-111260715113551787.htm","confidence":"high","notes":"Decree 142, effective 1 May 2026, specifies that machine-readable marking is not required for text output unless another law provides otherwise. It permits file-structure or metadata marks, digital/electronic signatures, or another machine-recognizable technical method.","regime":"vn","jurisdiction":"VN","instrument_short":"Vietnam AI Law","cite":"Vietnam AI Law Art. 11(1)-(2); Decree 142, Art. 17","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-VN-AILAW-11-3-4","instrument":"vn-ai-law","article":"Art. 11(3)-(5); Decree 142, Art. 18","title":"Notify the public and visibly label potentially misleading AI content","plain":"Deployers must clearly notify the public when releasing AI-generated or edited text, audio, images or video that could confuse people about the authenticity of an event or person. They must visibly label AI audio, image or video that simulates a real person's appearance or voice, or recreates a real event, so it can be distinguished from authentic content.","applies_to":{"roles":["deployer"],"uses":["generated-media","deepfake"],"conditions":"Public release; notification is required for content capable of causing confusion, and visible labels are required for the specified synthetic or recreated audio, image and video."},"applies_from":"2026-03-01","status":"applicable","controls":["transparency_notice","deepfake_label"],"evidence":["Published content examples showing a clear notice or label at or before first access","Publishing workflow identifying the responsible deployer and permitted exceptions"],"penalty":"Administrative or criminal sanctions and civil compensation may apply under Article 29 and other laws; no AI-law fine cap is specified here.","source_url":"https://en.baochinhphu.vn/viet-nams-law-on-artificial-intelligence-111260715113551787.htm","confidence":"high","notes":"Decree 142 allows exclusions from visible labeling for technical edits that do not change substance or context, specified text proofreading, summaries, paraphrases or translations that do not distort the original, internal-only content, and controlled research/testing not released publicly. Creative works may use an appropriate label in credits or accompanying material, provided the AI origin remains clear.","regime":"vn","jurisdiction":"VN","instrument_short":"Vietnam AI Law","cite":"Vietnam AI Law Art. 11(3)-(5); Decree 142, Art. 18","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-VN-D142-19","instrument":"vn-ai-decree-142","article":"Art. 12 of the AI Law; Decree 142, Art. 19(2)-(8)","title":"Contain and report serious AI incidents on time","plain":"Developers and providers must promptly take technical measures to correct, suspend or recall a system and notify the competent authority; deployers and users must record incidents, limit harm and notify the provider. A provider, or a deployer unable to contact the provider, must make a preliminary report within 72 hours after confirming an urgent serious incident (including death or serious health harm, serious public service disruption or national-security effects, and uncontrolled rights harm); other serious incidents are due within five working days. A final remediation report is due within 15 days after the preliminary report.","applies_to":{"roles":["provider","deployer","any"],"uses":["any-ai"],"conditions":"Only serious incidents as defined in the AI Law and Decree; the 72-hour deadline is not the deadline for every incident."},"applies_from":"2026-05-01","status":"applicable","controls":["incident_reporting","audit_log","post_market_monitoring"],"evidence":["Incident runbook with confirmation triggers, 72-hour and five-working-day clocks, and 15-day follow-up","Incident logs and copies of preliminary and final reports or escalation notices"],"penalty":"Administrative or criminal sanctions and civil compensation may apply under Article 29 and other laws; no AI-law fine cap is specified here.","source_url":"https://datafiles.chinhphu.vn/cpp/files/vbpq/2026/4/142-2026-ndcp.signed.pdf","confidence":"high","regime":"vn","jurisdiction":"VN","instrument_short":"AI Law Implementing Decree","cite":"AI Law Implementing Decree Art. 12 of the AI Law; Decree 142, Art. 19(2)-(8)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-VN-AILAW-13","instrument":"vn-ai-law","article":"Art. 13; Decree 142, Art. 13; Decision 33/2026/QD-TTg","title":"Assess conformity of high-risk AI before use and after significant changes","plain":"Providers of high-risk systems must complete conformity assessment before putting the system into service and reassess after significant changes that affect the original result. Systems on the Prime Minister's list requiring mandatory certification need assessment by a registered or recognized conformity-assessment organization; other high-risk systems may be self-assessed by the provider or assessed by such an organization. Providers must maintain conformity and disclose assessment results as required by the Decree.","applies_to":{"roles":["provider"],"uses":["any-ai"],"conditions":"Systems on the high-risk list; third-party certification is required only for systems specifically listed for mandatory certification."},"applies_from":"2026-03-01","status":"applicable","controls":["conformity_assessment","technical_documentation"],"evidence":["Conformity-assessment report or certificate, change-trigger reassessment and maintained technical dossier","Public disclosure/portal record of the result, or the officially announced alternative channel"],"penalty":"Administrative or criminal sanctions and civil compensation may apply under Article 29 and other laws; no AI-law fine cap is specified here.","source_url":"https://en.baochinhphu.vn/viet-nams-law-on-artificial-intelligence-111260715113551787.htm","confidence":"high","notes":"Decision 33's high-risk list took effect on 15 August 2026. Existing systems and listed systems subject to transition have the staged dates recorded under the Law and Decision instruments; systems on the mandatory certification list require third-party assessment rather than self-assessment.","regime":"vn","jurisdiction":"VN","instrument_short":"Vietnam AI Law","cite":"Vietnam AI Law Art. 13; Decree 142, Art. 13; Decision 33/2026/QD-TTg","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-VN-AILAW-14","instrument":"vn-ai-law","article":"Art. 14(1)-(5); Decree 142, Art. 15","title":"Manage high-risk systems with documented controls and human oversight","plain":"Providers of high-risk systems must maintain risk-management measures, govern training, testing and operational data, keep technical dossiers and logs, design for human oversight and intervention, meet transparency and incident duties, and give deployers and affected people functional information, operating guidance and risk warnings without disclosing source code or protected business secrets. Deployers must use systems within their classified purpose and risk, monitor operation, protect data, enable human intervention, control emerging risks and cooperate with providers and authorities.","applies_to":{"roles":["provider","deployer"],"uses":["any-ai"],"conditions":"Only systems classified as high-risk; users must also follow operating procedures and promptly notify deployers of incidents under Art. 14(3)."},"applies_from":"2026-03-01","status":"applicable","controls":["risk_management","data_governance","technical_documentation","audit_log","human_oversight","transparency_notice","privacy_compliance"],"evidence":["Risk-management file, data-governance records, system dossier and operating logs","Human-oversight procedures, deployer instructions, user warnings and monitoring records"],"penalty":"Administrative or criminal sanctions and civil compensation may apply under Article 29 and other laws; no AI-law fine cap is specified here.","source_url":"https://en.baochinhphu.vn/viet-nams-law-on-artificial-intelligence-111260715113551787.htm","confidence":"high","notes":"Existing systems may continue operating during their statutory transition unless authorities identify a risk of serious harm and require suspension or termination. See the 1 March 2027 and 1 September 2027 deadlines.","regime":"vn","jurisdiction":"VN","instrument_short":"Vietnam AI Law","cite":"Vietnam AI Law Art. 14(1)-(5); Decree 142, Art. 15","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-VN-AILAW-14-6","instrument":"vn-ai-law","article":"Art. 14(6)","title":"Foreign high-risk providers must maintain a Vietnam contact point","plain":"A foreign provider whose high-risk AI system is provided in Vietnam must have a legal contact point in Vietnam. If the system is subject to mandatory conformity certification before it is put into service, the provider must also have a commercial presence or an authorized representative in Vietnam.","applies_to":{"roles":["provider"],"uses":["any-ai"],"conditions":"Foreign providers of high-risk systems provided in Vietnam; the additional commercial-presence or authorized-representative requirement applies when mandatory pre-use certification is required."},"applies_from":"2026-03-01","status":"applicable","controls":["local_representative"],"evidence":["Vietnam legal-contact details and evidence the contact point is maintained","Commercial-presence records or written authorized-representative mandate where certification is mandatory"],"penalty":"Administrative or criminal sanctions and civil compensation may apply under Article 29 and other laws; no AI-law fine cap is specified here.","source_url":"https://en.baochinhphu.vn/viet-nams-law-on-artificial-intelligence-111260715113551787.htm","confidence":"high","notes":"Article 2 applies to foreign organizations and individuals participating in AI activities in Vietnam. The exact reach to foreign services provided entirely offshore without other Vietnam activities is not expressly resolved by that wording.","regime":"vn","jurisdiction":"VN","instrument_short":"Vietnam AI Law","cite":"Vietnam AI Law Art. 14(6)","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-VN-D142-20","instrument":"vn-ai-decree-142","article":"Art. 27(3)-(4) of the AI Law; Decree 142, Art. 20","title":"Assess public-sector AI impacts before qualifying use","plain":"State agencies must prepare an impact-assessment report before using a high-risk AI system or a system whose output is directly used as the basis for an administrative decision. The report must identify and assess risks, state control and mitigation measures, and explain human oversight and intervention; agencies must publish it except for state secrets, business secrets and personal data, and reassess after relevant changes create new or changed risks.","applies_to":{"roles":["public-body"],"uses":["public-sector-use","justice","essential-services"],"conditions":"High-risk systems, or systems whose output directly supports an administrative decision; other public-sector systems may be covered if they significantly affect human rights, social equality or public interests under Art. 27(3)."},"applies_from":"2026-03-01","status":"applicable","controls":["impact_assessment","human_oversight","transparency_notice","risk_management"],"evidence":["Approved impact-assessment report identifying risks, controls and human-oversight measures","Public disclosure record and supplemental assessment where a relevant system change occurs"],"penalty":"Administrative or criminal sanctions and civil compensation may apply under Article 29 and other laws; no AI-law fine cap is specified here.","source_url":"https://datafiles.chinhphu.vn/cpp/files/vbpq/2026/4/142-2026-ndcp.signed.pdf","confidence":"high","regime":"vn","jurisdiction":"VN","instrument_short":"AI Law Implementing Decree","cite":"AI Law Implementing Decree Art. 27(3)-(4) of the AI Law; Decree 142, Art. 20","review_status":"draft-unreviewed","as_of":"2026-11-04"},{"id":"AGC-VN-PDPL-30","instrument":"vn-personal-data-law","article":"Art. 30(1)-(5)","title":"Protect personal data processed using AI","plain":"Personal data in AI processing must be used for the stated purpose and limited to what is necessary, with appropriate security measures, authentication and access controls. Personal-data processing by AI must be classified by risk level so appropriate protections can be applied; the Law prohibits using or developing AI systems involving personal data to harm national defense, security, public order or safety, or another person's life, health, dignity, reputation or property.","applies_to":{"roles":["provider","deployer","any"],"uses":["any-ai","profiling","significant-decision"],"conditions":"Applies when personal data are processed in AI systems or services, regardless of whether the system is otherwise classified high, medium or low risk."},"applies_from":"2026-01-01","status":"applicable","controls":["privacy_compliance","risk_management","data_governance","prohibited_practices_screen"],"evidence":["AI personal-data risk classification and corresponding safeguards","Purpose/necessity records, security measures and authentication/access-control configuration"],"penalty":null,"source_url":"https://congbao.chinhphu.vn/van-ban/luat-so-91-2025-qh15-45578.htm","confidence":"high","notes":"Article 30 is AI-specific; other PDPL requirements, including data-subject rights and impact-assessment duties, may also apply depending on the processing. The separate five-year provisions for some smaller entities do not disapply Article 30.","regime":"vn","jurisdiction":"VN","instrument_short":"Personal Data Protection Law","cite":"Personal Data Protection Law Art. 30(1)-(5)","review_status":"draft-unreviewed","as_of":"2026-11-04"}],"deadlines":[{"date":"1914-09-26","title":"Do not make deceptive AI claims to consumers (FTC Act §5(a), 15 U.S.C. §45(a))","jurisdiction":"US","regime":"us","instrument":"us-ftc-act","obligations":["AGC-US-FTCA-5A"],"kind":"applies","source":"https://uscode.house.gov/us/usc/119-136/t15/s45/"},{"date":"2008-10-03","title":"Protect biometric data throughout its lifecycle (Illinois BIPA 740 ILCS 14/15(a)-(e))","jurisdiction":"US-IL","regime":"us-il","instrument":"il-bipa","obligations":["AGC-US-IL-BIPA-740-14-15"],"kind":"applies","source":"https://www.ilga.gov/documents/legislation/ilcs/documents/074000140K15.htm"},{"date":"2014-07-02","title":"Establish a lawful basis and notify purposes for personal-data use (PDPA §§ 13-20)","jurisdiction":"SG","regime":"sg","instrument":"sg-pdpa","obligations":["AGC-SG-PDPA-13-18-20"],"kind":"applies","source":"https://sso.agc.gov.sg/Act/PDPA2012"},{"date":"2014-07-02","title":"Maintain accountability, security and retention controls (PDPA §§ 11-12, 24-25)","jurisdiction":"SG","regime":"sg","instrument":"sg-pdpa","obligations":["AGC-SG-PDPA-11-12-24-25"],"kind":"applies","source":"https://sso.agc.gov.sg/Act/PDPA2012"},{"date":"2019-07-01","title":"BOT Act: BOT Act disclosure provisions became operative","jurisdiction":"US-CA","regime":"us-ca","instrument":"us-ca-bot-act","obligations":[],"kind":"milestone","source":"https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC&sectionNum=17941."},{"date":"2019-07-01","title":"Disclose a qualifying bot's artificial identity (BOT Act BPC § 17941)","jurisdiction":"US-CA","regime":"us-ca","instrument":"us-ca-bot-act","obligations":["AGC-US-CA-BOT-17941"],"kind":"applies","source":"https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC&sectionNum=17941."},{"date":"2020-01-01","title":"AI Video Interview Act: Core notice","jurisdiction":"US-IL","regime":"us-il","instrument":"il-aivia","obligations":[],"kind":"milestone","source":"https://www.ilga.gov/Legislation/ILCS/Articles?ActID=4015&ChapterID=68&Print=True"},{"date":"2020-01-01","title":"Disclose, explain, and obtain consent before AI video analysis (AI Video Interview Act 820 ILCS 42/5)","jurisdiction":"US-IL","regime":"us-il","instrument":"il-aivia","obligations":["AGC-US-IL-AIVIA-42-5"],"kind":"applies","source":"https://www.ilga.gov/documents/legislation/ilcs/documents/082000420K5.htm"},{"date":"2020-01-01","title":"Limit video sharing and delete interviews on request (AI Video Interview Act 820 ILCS 42/10, 42/15)","jurisdiction":"US-IL","regime":"us-il","instrument":"il-aivia","obligations":["AGC-US-IL-AIVIA-42-10-15"],"kind":"applies","source":"https://www.ilga.gov/Legislation/ILCS/Articles?ActID=4015&ChapterID=68&Print=True"},{"date":"2020-01-21","title":"Make AI decision processes explainable, fair and human-centric (Model AI Governance Framework (2020) § 2.7)","jurisdiction":"SG","regime":"sg","instrument":"sg-mgf-2020","obligations":["AGC-SG-MGF20-2-7"],"kind":"applies","source":"https://www.imda.gov.sg/-/media/imda/files/infocomm-media-landscape/sg-digital/tech-pillars/artificial-intelligence/second-edition-of-the-model-ai-governance-framework.pdf"},{"date":"2020-01-21","title":"Model AI Governance Framework (2020): Second edition released as voluntary guidance","jurisdiction":"SG","regime":"sg","instrument":"sg-mgf-2020","obligations":[],"kind":"milestone","source":"https://www.imda.gov.sg/-/media/imda/files/infocomm-media-landscape/sg-digital/tech-pillars/artificial-intelligence/second-edition-of-the-model-ai-governance-framework.pdf"},{"date":"2021-12-11","title":"NYC AEDT Law: Local Law 144 enacted","jurisdiction":"US-NY-NYC","regime":"us-ny-nyc","instrument":"nyc-ll144","obligations":[],"kind":"milestone","source":"https://legistar.council.nyc.gov/LegislationDetail.aspx?GUID=B051915D-A9AC-451E-81F8-6596032FA3F9&ID=4344524"},{"date":"2022-01-01","title":"Report demographic data for AI-only video screening (AI Video Interview Act 820 ILCS 42/20(a)-(c))","jurisdiction":"US-IL","regime":"us-il","instrument":"il-aivia","obligations":["AGC-US-IL-AIVIA-42-20"],"kind":"applies","source":"https://www.ilga.gov/Legislation/ILCS/Articles?ActID=4015&ChapterID=68&Print=True"},{"date":"2022-03-01","title":"Algorithmic Recommendation Provisions: Provisions enter into force","jurisdiction":"CN","regime":"cn","instrument":"cn-algorithm","obligations":[],"kind":"milestone","source":"https://www.cac.gov.cn/2022-01/04/c_1642894606364259.htm"},{"date":"2022-03-01","title":"Disclose recommendation and give users a real choice (Algorithmic Recommendation Provisions Arts. 16–17)","jurisdiction":"CN","regime":"cn","instrument":"cn-algorithm","obligations":["AGC-CN-ALGO-16-17"],"kind":"applies","source":"https://www.cac.gov.cn/2022-01/04/c_1642894606364259.htm"},{"date":"2022-03-01","title":"File public-opinion or mobilisation-capable recommendation services (Algorithmic Recommendation Provisions Arts. 24–27, 31, 33)","jurisdiction":"CN","regime":"cn","instrument":"cn-algorithm","obligations":["AGC-CN-ALGO-24-27"],"kind":"applies","source":"https://www.cac.gov.cn/2022-01/04/c_1642894606364259.htm"},{"date":"2022-05-25","title":"AI Verify: AI Verify testing framework and toolkit announced for international pilot","jurisdiction":"SG","regime":"sg","instrument":"sg-ai-verify","obligations":[],"kind":"milestone","source":"https://www.imda.gov.sg/resources/press-releases-factsheets-and-speeches/press-releases/2022/sg-launches-worlds-first-ai-testing-framework-and-toolkit-to-promote-transparency"},{"date":"2022-05-25","title":"Test AI systems against responsible-AI principles (AI Verify Testing Framework, 11 governance principles)","jurisdiction":"SG","regime":"sg","instrument":"sg-ai-verify","obligations":["AGC-SG-AIVERIFY-11"],"kind":"applies","source":"https://www.imda.gov.sg/ai-verify"},{"date":"2023-01-01","title":"Complete an independent bias audit before use (NYC Admin. Code §20-871(a)(1); 6 RCNY §5-301(a))","jurisdiction":"US-NY-NYC","regime":"us-ny-nyc","instrument":"nyc-ll144","obligations":["AGC-US-NY-NYC-LL144-20-871-A1"],"kind":"applies","source":"https://legistar.council.nyc.gov/LegislationDetail.aspx?GUID=B051915D-A9AC-451E-81F8-6596032FA3F9&ID=4344524"},{"date":"2023-01-01","title":"Disclose AEDT data sources and retention policy (NYC Admin. Code §20-871(b)(3); 6 RCNY §5-302(d))","jurisdiction":"US-NY-NYC","regime":"us-ny-nyc","instrument":"nyc-ll144","obligations":["AGC-US-NY-NYC-LL144-20-871-B3"],"kind":"applies","source":"https://rules.cityofnewyork.us/rule/automated-employment-decision-tools-updated/"},{"date":"2023-01-01","title":"Explain what the tool assesses and available options (NYC Admin. Code §20-871(b)(2)(i)-(ii); 6 RCNY §5-303)","jurisdiction":"US-NY-NYC","regime":"us-ny-nyc","instrument":"nyc-ll144","obligations":["AGC-US-NY-NYC-LL144-20-871-B2-CONTENT"],"kind":"applies","source":"https://home4.nyc.gov/site/dca/businesses/faq-automated-employment-decision-tools.page"},{"date":"2023-01-01","title":"Give advance notice before using an AEDT (NYC Admin. Code §20-871(b)(2); 6 RCNY §5-303)","jurisdiction":"US-NY-NYC","regime":"us-ny-nyc","instrument":"nyc-ll144","obligations":["AGC-US-NY-NYC-LL144-20-871-B2-TIMING"],"kind":"applies","source":"https://home4.nyc.gov/site/dca/businesses/faq-automated-employment-decision-tools.page"},{"date":"2023-01-01","title":"Publish the audit summary and tool distribution date (NYC Admin. Code §20-871(a)(1)-(2); 6 RCNY §5-301(e))","jurisdiction":"US-NY-NYC","regime":"us-ny-nyc","instrument":"nyc-ll144","obligations":["AGC-US-NY-NYC-LL144-20-871-A1-PUBLIC"],"kind":"applies","source":"https://home4.nyc.gov/site/dca/businesses/faq-automated-employment-decision-tools.page"},{"date":"2023-01-10","title":"Assess and file specified deep-synthesis services (Deep Synthesis Provisions Arts. 15, 19–20)","jurisdiction":"CN","regime":"cn","instrument":"cn-deep-synthesis","obligations":["AGC-CN-DSYN-15-19-20"],"kind":"applies","source":"https://www.cac.gov.cn/2022-12/11/c_1672221949354811.htm"},{"date":"2023-01-10","title":"Deep Synthesis Provisions: Provisions enter into force","jurisdiction":"CN","regime":"cn","instrument":"cn-deep-synthesis","obligations":[],"kind":"milestone","source":"https://www.cac.gov.cn/2022-12/11/c_1672221949354811.htm"},{"date":"2023-01-10","title":"Verify identity for posting and label deep-synthesis output (Deep Synthesis Provisions Arts. 9, 16–18)","jurisdiction":"CN","regime":"cn","instrument":"cn-deep-synthesis","obligations":["AGC-CN-DSYN-9-16-18"],"kind":"applies","source":"https://www.cac.gov.cn/2022-12/11/c_1672221949354811.htm"},{"date":"2023-07-05","title":"Calculate and document required audit metrics (NYC AEDT Law 6 RCNY §5-301(b)-(d); §5-302(a)-(c))","jurisdiction":"US-NY-NYC","regime":"us-ny-nyc","instrument":"nyc-ll144","obligations":["AGC-US-NY-NYC-LL144-6RCNY-5-301"],"kind":"applies","source":"https://rules.cityofnewyork.us/rule/automated-employment-decision-tools-updated/"},{"date":"2023-08-15","title":"Assess and file qualifying public-facing GenAI services (Interim GenAI Measures Art. 17)","jurisdiction":"CN","regime":"cn","instrument":"cn-genai","obligations":["AGC-CN-GENAI-17"],"kind":"applies","source":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm"},{"date":"2023-08-15","title":"Control harmful outputs and provide user safeguards (Interim GenAI Measures Arts. 4, 10, 14–15)","jurisdiction":"CN","regime":"cn","instrument":"cn-genai","obligations":["AGC-CN-GENAI-4-10-14-15"],"kind":"applies","source":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm"},{"date":"2023-08-15","title":"Interim GenAI Measures: Measures enter into force","jurisdiction":"CN","regime":"cn","instrument":"cn-genai","obligations":[],"kind":"milestone","source":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm"},{"date":"2023-08-15","title":"Use lawful, governed data for public-facing GenAI services (Interim GenAI Measures Arts. 7–8)","jurisdiction":"CN","regime":"cn","instrument":"cn-genai","obligations":["AGC-CN-GENAI-7-8"],"kind":"applies","source":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm"},{"date":"2023-09-01","title":"Assess high-risk personal-data processing before deployment (Revised FADP Art. 22(1)–(5) and Art. 23)","jurisdiction":"CH","regime":"ch","instrument":"ch-fadp","obligations":["AGC-CH-FADP-22"],"kind":"applies","source":"https://www.fedlex.admin.ch/eli/cc/2022/491/en"},{"date":"2023-09-01","title":"Data Protection Ordinance: Data Protection Ordinance enters into force","jurisdiction":"CH","regime":"ch","instrument":"ch-dpo","obligations":[],"kind":"milestone","source":"https://www.fedlex.admin.ch/eli/cc/2022/568/en"},{"date":"2023-09-01","title":"Keep a record of processing activities (Revised FADP Art. 12(1)–(5); DPO Art. 24)","jurisdiction":"CH","regime":"ch","instrument":"ch-fadp","obligations":["AGC-CH-FADP-12"],"kind":"applies","source":"https://www.fedlex.admin.ch/eli/cc/2022/491/en"},{"date":"2023-09-01","title":"Notify people about consequential decisions made solely by automation and offer human review (Revised FADP Art. 21(1)–(4))","jurisdiction":"CH","regime":"ch","instrument":"ch-fadp","obligations":["AGC-CH-FADP-21"],"kind":"applies","source":"https://www.fedlex.admin.ch/eli/cc/2022/491/en"},{"date":"2023-09-01","title":"Process personal data transparently and build privacy in by design (Revised FADP Art. 6(1)–(5) and Art. 7)","jurisdiction":"CH","regime":"ch","instrument":"ch-fadp","obligations":["AGC-CH-FADP-6-7"],"kind":"applies","source":"https://www.fedlex.admin.ch/eli/cc/2022/491/en"},{"date":"2023-09-01","title":"Provide access information, including about automated decisions (Revised FADP Art. 25(1)–(2)(e)–(g))","jurisdiction":"CH","regime":"ch","instrument":"ch-fadp","obligations":["AGC-CH-FADP-25"],"kind":"applies","source":"https://www.fedlex.admin.ch/eli/cc/2022/491/en"},{"date":"2023-09-01","title":"Report high-risk personal-data security breaches (Revised FADP Art. 24(1)–(4))","jurisdiction":"CH","regime":"ch","instrument":"ch-fadp","obligations":["AGC-CH-FADP-24"],"kind":"applies","source":"https://www.fedlex.admin.ch/eli/cc/2022/491/en"},{"date":"2023-09-01","title":"Revised FADP: Revised FADP enters into force","jurisdiction":"CH","regime":"ch","instrument":"ch-fadp","obligations":[],"kind":"milestone","source":"https://www.fedlex.admin.ch/eli/cc/2022/491/en"},{"date":"2023-09-01","title":"Tell people how AI processes their personal data (Revised FADP Art. 6(3), 19(1)–(2); FDPIC, AI and data protection, Transparent information)","jurisdiction":"CH","regime":"ch","instrument":"ch-fadp","obligations":["AGC-CH-FADP-19-6"],"kind":"applies","source":"https://www.fedlex.admin.ch/eli/cc/2022/491/en"},{"date":"2024-02-06","title":"ATRS: ATRS was mandated across government departments; the policy defines the covered central-government bodies and tools","jurisdiction":"GB","regime":"gb","instrument":"gb-atrs","obligations":[],"kind":"milestone","source":"https://www.gov.uk/government/publications/algorithmic-transparency-recording-standard-mandatory-scope-and-exemptions-policy/algorithmic-transparency-recording-standard-atrs-mandatory-scope-and-exemptions-policy"},{"date":"2024-02-06","title":"Publish transparency records for in-scope central-government tools (ATRS mandatory scope and exemptions policy)","jurisdiction":"GB","regime":"gb","instrument":"gb-atrs","obligations":["AGC-GB-ATRS-SCOPE"],"kind":"applies","source":"https://www.gov.uk/government/publications/algorithmic-transparency-recording-standard-mandatory-scope-and-exemptions-policy/algorithmic-transparency-recording-standard-atrs-mandatory-scope-and-exemptions-policy"},{"date":"2024-03-01","title":"Apply PDPC's advice to AI recommendation and decision systems (PDPC AI Recommendation and Decision Guidelines Guidelines §§ 2.2, 3.1, 9.1-9.7 and 10)","jurisdiction":"SG","regime":"sg","instrument":"sg-pdpc-ai-rec","obligations":["AGC-SG-PDPCREC-9"],"kind":"applies","source":"https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/advisory-guidelines-on-the-use-of-personal-data-in-ai-recommendation-and-decision-systems.pdf"},{"date":"2024-03-01","title":"PDPC AI Recommendation and Decision Guidelines: Final advisory guidelines issued","jurisdiction":"SG","regime":"sg","instrument":"sg-pdpc-ai-rec","obligations":[],"kind":"milestone","source":"https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/advisory-guidelines-on-the-use-of-personal-data-in-ai-recommendation-and-decision-systems.pdf"},{"date":"2024-05-17","title":"Colorado AI Act (2024): SB 24-205 was signed; its high-risk AI duties were initially scheduled for 2026-02-01","jurisdiction":"US-CO","regime":"us-co","instrument":"co-sb24-205","obligations":[],"kind":"milestone","source":"https://leg.colorado.gov/laws/session-laws/SB24-205/198/download"},{"date":"2024-05-30","title":"Generative AI Governance Framework (2024): IMDA introduced the Generative AI framework as an ecosystem-level voluntary framework","jurisdiction":"SG","regime":"sg","instrument":"sg-mgf-genai","obligations":[],"kind":"milestone","source":"https://www.imda.gov.sg/resources/press-releases-factsheets-and-speeches/factsheets/2024/gen-ai-and-digital-foss-ai-governance-playbook"},{"date":"2024-05-30","title":"Govern Generative AI across its lifecycle and ecosystem (Generative AI Governance Framework (2024) Framework, nine dimensions)","jurisdiction":"SG","regime":"sg","instrument":"sg-mgf-genai","obligations":["AGC-SG-MGFGAI-9D"],"kind":"applies","source":"https://www.imda.gov.sg/About-IMDA/Emerging-Technologies-and-Research/Artificial-Intelligence"},{"date":"2024-08-01","title":"EU AI Act: AI Act enters into force","jurisdiction":"EU","regime":"eu","instrument":"eu-aia","obligations":[],"kind":"milestone","source":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-113"},{"date":"2024-08-02","title":"Illinois BIPA: Public Act 103-769 amendments to written release and repeated-collection recoveries effective","jurisdiction":"US-IL","regime":"us-il","instrument":"il-bipa","obligations":[],"kind":"milestone","source":"https://www.ilga.gov/Legislation/ILCS/Details?ActID=3004"},{"date":"2024-08-09","title":"IHRA AI employment provisions: Public Act 103-0804 approved","jurisdiction":"US-IL","regime":"us-il","instrument":"il-ihra-ai","obligations":[],"kind":"milestone","source":"https://www.ilga.gov/Legislation/PublicActs/View/103-0804"},{"date":"2024-09-05","title":"Council of Europe AI Framework Convention: Convention opened for signature in Vilnius","jurisdiction":"COE","regime":"coe","instrument":"coe-ai-convention","obligations":[],"kind":"milestone","source":"https://www.coe.int/en/web/portal/-/council-of-europe-opens-first-ever-global-treaty-on-ai-for-signature"},{"date":"2024-11-21","title":"Elections Integrity Amendment: Amendment Act published in the Government Gazette","jurisdiction":"SG","regime":"sg","instrument":"sg-eioaa","obligations":[],"kind":"milestone","source":"https://sso.agc.gov.sg/Acts-Supp/34-2024/Published/20241121?DocDate=20241121"},{"date":"2025-01-17","title":"Age-gate provider-published pornography (Online Safety Act OSA 2023 ss. 79–81)","jurisdiction":"GB","regime":"gb","instrument":"gb-osa","obligations":["AGC-GB-OSA-81"],"kind":"applies","source":"https://www.legislation.gov.uk/ukpga/2023/50/section/81"},{"date":"2025-01-21","title":"AI Basic Act: Act No. 20676 promulgated","jurisdiction":"KR","regime":"kr","instrument":"kr-aiba","obligations":[],"kind":"milestone","source":"https://www.law.go.kr/LSW/eng/engLsInfoR.do?lsiSeq=268543"},{"date":"2025-01-22","title":"Do not publish realistic false candidate representations in online election ads (Elections Integrity Amendment PEA § 61MA(1); PrEA § 42LA(1))","jurisdiction":"SG","regime":"sg","instrument":"sg-eioaa","obligations":["AGC-SG-EIOA-PEA-61MA-1"],"kind":"applies","source":"https://sso.agc.gov.sg/Acts-Supp/34-2024/Published/20241121?DocDate=20241121"},{"date":"2025-01-31","title":"AI Cyber Security Code of Practice: Voluntary AI cyber-security code published","jurisdiction":"GB","regime":"gb","instrument":"gb-ai-cyber-code","obligations":[],"kind":"milestone","source":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice"},{"date":"2025-01-31","title":"Use the voluntary AI cyber-security baseline (AI Cyber Security Code of Practice, Principles 1–13)","jurisdiction":"GB","regime":"gb","instrument":"gb-ai-cyber-code","obligations":["AGC-GB-AICSCOP-BASELINE"],"kind":"applies","source":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai"},{"date":"2025-02-02","title":"Do not build or use banned AI practices (EU AI Act Art. 5(1))","jurisdiction":"EU","regime":"eu","instrument":"eu-aia","obligations":["AGC-EU-AIA-5"],"kind":"applies","source":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-5"},{"date":"2025-02-02","title":"Support AI literacy of staff who run or use AI (EU AI Act Art. 4(1))","jurisdiction":"EU","regime":"eu","instrument":"eu-aia","obligations":["AGC-EU-AIA-4"],"kind":"applies","source":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-4"},{"date":"2025-02-12","title":"Proposed Swiss AI legislation: Federal Council chooses an approach to ratify and implement the Council of Europe AI Convention, with sector-specific amendments where needed","jurisdiction":"CH","regime":"ch","instrument":"ch-ai-proposal","obligations":[],"kind":"milestone","source":"https://www.admin.ch/en/nsb?id=104110"},{"date":"2025-02-14","title":"AI Cyber Security Code of Practice: UK AI Safety Institute renamed AI Security Institute","jurisdiction":"GB","regime":"gb","instrument":"gb-ai-cyber-code","obligations":[],"kind":"milestone","source":"https://www.gov.uk/government/news/tackling-ai-security-risks-to-unleash-growth-and-deliver-plan-for-change"},{"date":"2025-02-28","title":"GB 45438-2025: Standard published","jurisdiction":"CN","regime":"cn","instrument":"cn-gb45438","obligations":[],"kind":"milestone","source":"https://openstd.samr.gov.cn/bzgk/std/std_list?p.p2=GB+45438-2025"},{"date":"2025-03-07","title":"AI Content Labelling Measures: Measures issued","jurisdiction":"CN","regime":"cn","instrument":"cn-content-label","obligations":[],"kind":"milestone","source":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm"},{"date":"2025-03-17","title":"Assess and reduce illegal-content risks on in-scope services (Online Safety Act OSA 2023 ss. 9–10, 26–27)","jurisdiction":"GB","regime":"gb","instrument":"gb-osa","obligations":["AGC-GB-OSA-9-10"],"kind":"applies","source":"https://www.legislation.gov.uk/ukpga/2023/50/section/10"},{"date":"2025-03-17","title":"Online Safety Act: Ofcom began enforcing the illegal-content duties","jurisdiction":"GB","regime":"gb","instrument":"gb-osa","obligations":[],"kind":"milestone","source":"https://www.gov.uk/government/collections/online-safety-act"},{"date":"2025-03-27","title":"Proposed Swiss AI legislation: Switzerland signs the Council of Europe Framework Convention on AI","jurisdiction":"CH","regime":"ch","instrument":"ch-ai-proposal","obligations":[],"kind":"milestone","source":"https://www.bakom.admin.ch/en/nsb?id=104646"},{"date":"2025-04-03","title":"Apply minimum risk practices to high-impact AI (OMB M-25-21 M-25-21 §4(b))","jurisdiction":"US","regime":"us","instrument":"us-omb-m2521","obligations":["AGC-US-M2521-4B"],"kind":"applies","source":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf"},{"date":"2025-04-03","title":"Designate a Chief AI Officer (OMB M-25-21 M-25-21 §3(a)(i))","jurisdiction":"US","regime":"us","instrument":"us-omb-m2521","obligations":["AGC-US-M2521-3A-I"],"kind":"applies","source":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf"},{"date":"2025-04-03","title":"Maintain and publish annual AI use-case inventories (OMB M-25-21 M-25-21 §3(b)(v))","jurisdiction":"US","regime":"us","instrument":"us-omb-m2521","obligations":["AGC-US-M2521-3B-V"],"kind":"applies","source":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf"},{"date":"2025-04-03","title":"OMB M-25-22: OMB issued M-25-22","jurisdiction":"US","regime":"us","instrument":"us-omb-m2522","obligations":[],"kind":"milestone","source":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf"},{"date":"2025-05-09","title":"AI Companion Models Law: Chapter 58 signed; Article 47 added","jurisdiction":"US-NY","regime":"us-ny","instrument":"ny-companion","obligations":[],"kind":"milestone","source":"https://www2.nyassembly.gov/2025budget/bills2025/executive/A3008.pdf"},{"date":"2025-05-09","title":"Algorithmic Pricing Disclosure Act: Chapter 58 signed","jurisdiction":"US-NY","regime":"us-ny","instrument":"ny-pricing","obligations":[],"kind":"milestone","source":"https://www.nysenate.gov/legislation/laws/GBS/349-A"},{"date":"2025-05-19","title":"Do not knowingly publish specified nonconsensual intimate depictions (TAKE IT DOWN Act §2; 47 U.S.C. §223(h))","jurisdiction":"US","regime":"us","instrument":"us-tida","obligations":["AGC-US-TIDA-2"],"kind":"applies","source":"https://www.congress.gov/119/plaws/publ12/PLAW-119publ12.htm"},{"date":"2025-06-02","title":"OMB M-25-21: 60-day deadline for agency heads to retain or designate a Chief AI Officer","jurisdiction":"US","regime":"us","instrument":"us-omb-m2521","obligations":[],"kind":"milestone","source":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf"},{"date":"2025-06-04","title":"Cooperate with national and local AI measures (AI Promotion Act Art. 7)","jurisdiction":"JP","regime":"jp","instrument":"jp-ai-act","obligations":["AGC-JP-AIPA-7"],"kind":"applies","source":"https://www.japaneselawtranslation.go.jp/en/laws/view/5066/je"},{"date":"2025-06-19","title":"UK GDPR automated decision-making: Data (Use and Access) Act 2025 received Royal Assent","jurisdiction":"GB","regime":"gb","instrument":"gb-ukgdpr-adm","obligations":[],"kind":"milestone","source":"https://www.legislation.gov.uk/ukpga/2025/18"},{"date":"2025-07-01","title":"Maintain and publish the State AI inventory (LOADinG Act State Technology Law §103-e(1)-(5))","jurisdiction":"US-NY","regime":"us-ny","instrument":"ny-loading","obligations":["AGC-US-NY-LOAD-103E"],"kind":"applies","source":"https://www.nysenate.gov/legislation/laws/STT/103-E"},{"date":"2025-07-01","title":"Publish State-agency employment-tool lists (LOADinG Act State Technology Law §§401-402)","jurisdiction":"US-NY","regime":"us-ny","instrument":"ny-loading","obligations":["AGC-US-NY-LOAD-402"],"kind":"applies","source":"https://www.nysenate.gov/legislation/laws/STT/402"},{"date":"2025-07-08","title":"Disclose personalized algorithmic prices (Algorithmic Pricing Disclosure Act GBL §349-a(2))","jurisdiction":"US-NY","regime":"us-ny","instrument":"ny-pricing","obligations":["AGC-US-NY-GBL349A-2"],"kind":"applies","source":"https://www.nysenate.gov/legislation/laws/GBS/349-A"},{"date":"2025-07-23","title":"EO 14319: Executive order signed; directs agencies to procure LLMs developed in accordance with its Unbiased AI Principles","jurisdiction":"US","regime":"us","instrument":"us-eo14319","obligations":[],"kind":"milestone","source":"https://www.whitehouse.gov/presidential-actions/2025/07/preventing-woke-ai-in-the-federal-government/"},{"date":"2025-07-23","title":"Procure LLMs developed under the Unbiased AI Principles (EO 14319 §3(a)-(b))","jurisdiction":"US","regime":"us","instrument":"us-eo14319","obligations":["AGC-US-EO14319-3"],"kind":"applies","source":"https://www.whitehouse.gov/presidential-actions/2025/07/preventing-woke-ai-in-the-federal-government/"},{"date":"2025-07-25","title":"Assess and mitigate risks to children (Online Safety Act OSA 2023 ss. 11–12, 28–29)","jurisdiction":"GB","regime":"gb","instrument":"gb-osa","obligations":["AGC-GB-OSA-11-12"],"kind":"applies","source":"https://www.legislation.gov.uk/ukpga/2023/50/section/12"},{"date":"2025-08-01","title":"Do not let AI provide independent therapy (WORP Act 225 ILCS 155/20(a)-(b))","jurisdiction":"US-IL","regime":"us-il","instrument":"il-worp","obligations":["AGC-US-IL-WORP-225-155-20"],"kind":"applies","source":"https://www.ilga.gov/Legislation/PublicActs/View/104-0054"},{"date":"2025-08-01","title":"Keep licensed professionals responsible for AI-assisted therapy (WORP Act 225 ILCS 155/15(a)-(b))","jurisdiction":"US-IL","regime":"us-il","instrument":"il-worp","obligations":["AGC-US-IL-WORP-225-155-15"],"kind":"applies","source":"https://www.ilga.gov/Legislation/ILCS/details?ActID=4608&ChapAct=FullText"},{"date":"2025-08-02","title":"Appoint an EU authorised representative if you are outside the EU (EU AI Act Art. 22 and 54)","jurisdiction":"EU","regime":"eu","instrument":"eu-aia","obligations":["AGC-EU-AIA-22"],"kind":"applies","source":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-22"},{"date":"2025-08-02","title":"Document general-purpose AI models, respect copyright and publish a training-data summary (EU AI Act Art. 53(1))","jurisdiction":"EU","regime":"eu","instrument":"eu-aia","obligations":["AGC-EU-AIA-53"],"kind":"applies","source":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-53"},{"date":"2025-08-02","title":"Evaluate and secure general-purpose AI models with systemic risk (EU AI Act Art. 55(1))","jurisdiction":"EU","regime":"eu","instrument":"eu-aia","obligations":["AGC-EU-AIA-55"],"kind":"applies","source":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-55"},{"date":"2025-09-01","title":"AI Content Labelling Measures: Measures enter into force","jurisdiction":"CN","regime":"cn","instrument":"cn-content-label","obligations":[],"kind":"milestone","source":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm"},{"date":"2025-09-01","title":"Implement the mandatory AI-content labelling method (GB 45438-2025 Clauses 4–6 and normative Annex E)","jurisdiction":"CN","regime":"cn","instrument":"cn-gb45438","obligations":["AGC-CN-GB45438-4-6-E"],"kind":"applies","source":"https://openstd.samr.gov.cn/bzgk/std/std_list?p.p2=GB+45438-2025"},{"date":"2025-09-01","title":"Label and verify AI-generated content across the service chain (AI Content Labelling Measures Arts. 4–12)","jurisdiction":"CN","regime":"cn","instrument":"cn-content-label","obligations":["AGC-CN-LABEL-4-12"],"kind":"applies","source":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm"},{"date":"2025-09-01","title":"AI Promotion Act: Remaining provisions, including the Basic Plan and Strategic Headquarters chapters, took effect; the Act is fully in force","jurisdiction":"JP","regime":"jp","instrument":"jp-ai-act","obligations":[],"kind":"milestone","source":"https://laws.e-gov.go.jp/law/507AC0000000053"},{"date":"2025-09-30","title":"Put required safeguards into covered AI contracts (OMB M-25-22 M-25-22 §§2(c), 3(c)-(e), 4)","jurisdiction":"US","regime":"us","instrument":"us-omb-m2522","obligations":["AGC-US-M2522-2C"],"kind":"applies","source":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf"},{"date":"2025-10-01","title":"Prevent discriminatory employment use of automated decision systems (Employment ADS regulations 2 CCR §§ 11009(f), 11013(c))","jurisdiction":"US-CA","regime":"us-ca","instrument":"us-ca-crc-ads","obligations":["AGC-US-CA-CRC-11009-F"],"kind":"applies","source":"https://calcivilrights.ca.gov/wp-content/uploads/sites/32/2025/06/Final-Text-regulations-automated-employment-decision-systems.pdf"},{"date":"2025-10-28","title":"Amended Cybersecurity Law: Amendment adopted by the NPC Standing Committee","jurisdiction":"CN","regime":"cn","instrument":"cn-csl","obligations":[],"kind":"milestone","source":"http://www.npc.gov.cn/npc/c1773/c1848/c21114/wlaqfxz/wlaqfxz002/202511/t20251103_449242.html"},{"date":"2025-11-05","title":"India AI Governance Guidelines: MeitY releases the India AI Governance Guidelines","jurisdiction":"IN","regime":"in","instrument":"in-ai-guidelines","obligations":[],"kind":"milestone","source":"https://www.pib.gov.in/Pressreleaseshare.aspx?PRID=2186639&lang=2&reg=3"},{"date":"2025-11-05","title":"Use the voluntary India AI governance principles and practices (India AI Governance Guidelines, Parts 1–4)","jurisdiction":"IN","regime":"in","instrument":"in-ai-guidelines","obligations":["AGC-IN-AIGG-1"],"kind":"applies","source":"https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc2025115685601.pdf"},{"date":"2025-11-05","title":"Detect and respond to self-harm signals (AI Companion Models Law GBL §1701)","jurisdiction":"US-NY","regime":"us-ny","instrument":"ny-companion","obligations":["AGC-US-NY-GBL47-1701"],"kind":"applies","source":"https://www.nysenate.gov/legislation/laws/GBS/1701"},{"date":"2025-11-05","title":"Remind users that a companion is not human (AI Companion Models Law GBL §1702)","jurisdiction":"US-NY","regime":"us-ny","instrument":"ny-companion","obligations":["AGC-US-NY-GBL47-1702"],"kind":"applies","source":"https://www.nysenate.gov/legislation/laws/GBS/1702"},{"date":"2025-11-10","title":"Algorithmic Pricing Disclosure Act: Attorney General announced enforcement would begin after the litigation-related pause","jurisdiction":"US-NY","regime":"us-ny","instrument":"ny-pricing","obligations":[],"kind":"milestone","source":"https://ag.ny.gov/press-release/2025/attorney-general-james-warns-new-yorkers-about-algorithmic-pricing-new-law-takes"},{"date":"2025-11-13","title":"DPDP Act: Initial institutional and procedural provisions commence under G.S.R. 843(E)","jurisdiction":"IN","regime":"in","instrument":"in-dpdp-act","obligations":[],"kind":"milestone","source":"https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf"},{"date":"2025-11-13","title":"DPDP Rules: Rules 1, 2 and 17 to 21 commence on Gazette publication","jurisdiction":"IN","regime":"in","instrument":"in-dpdp-rules","obligations":[],"kind":"milestone","source":"https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf"},{"date":"2025-11-25","title":"Colorado AI Act (2024): SB 25B-004 took effect and delayed SB 24-205 requirements until 2026-06-30","jurisdiction":"US-CO","regime":"us-co","instrument":"co-sb24-205","obligations":[],"kind":"milestone","source":"https://leg.colorado.gov/laws/session-laws/SB25B-004/3/download"},{"date":"2025-12-01","title":"Log qualifying automated processing and keep logs protected (Data Protection Ordinance Art. 4(1)–(5))","jurisdiction":"CH","regime":"ch","instrument":"ch-dpo","obligations":["AGC-CH-DPO-4"],"kind":"applies","source":"https://www.fedlex.admin.ch/eli/cc/2022/568/en"},{"date":"2025-12-10","title":"DPDP Rules: G.S.R. 892(E) makes textual corrections to the Rules notification","jurisdiction":"IN","regime":"in","instrument":"in-dpdp-rules","obligations":[],"kind":"milestone","source":"https://www.meity.gov.in/static/uploads/2025/12/3c7ebbae0e5456f493f486e6845df86b.pdf"},{"date":"2025-12-10","title":"Vietnam AI Law: Adopted by the National Assembly","jurisdiction":"VN","regime":"vn","instrument":"vn-ai-law","obligations":[],"kind":"milestone","source":"https://en.baochinhphu.vn/viet-nams-law-on-artificial-intelligence-111260715113551787.htm"},{"date":"2025-12-11","title":"Include Unbiased AI Principles in LLM procurement (OMB M-26-04 M-26-04 §§3(a), 3(c), Appendix A)","jurisdiction":"US","regime":"us","instrument":"us-omb-m2604","obligations":["AGC-US-M2604-3A-C"],"kind":"applies","source":"https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles.pdf"},{"date":"2025-12-18","title":"Develop DoD AI security requirements for covered entities (FY2026 NDAA §1513(a)-(b), (f)(3))","jurisdiction":"US","regime":"us","instrument":"us-ndaa26","obligations":["AGC-US-NDAA11960-1513"],"kind":"applies","source":"https://www.govinfo.gov/content/pkg/PLAW-119publ60/html/PLAW-119publ60.htm"},{"date":"2025-12-18","title":"Establish a DoD-wide AI and ML cybersecurity policy (FY2026 NDAA §1512)","jurisdiction":"US","regime":"us","instrument":"us-ndaa26","obligations":["AGC-US-NDAA11960-1512"],"kind":"applies","source":"https://www.govinfo.gov/content/pkg/PLAW-119publ60/html/PLAW-119publ60.htm"},{"date":"2025-12-18","title":"FY2026 NDAA: FY2026 NDAA enacted","jurisdiction":"US","regime":"us","instrument":"us-ndaa26","obligations":[],"kind":"milestone","source":"https://www.govinfo.gov/content/pkg/PLAW-119publ60/html/PLAW-119publ60.htm"},{"date":"2025-12-19","title":"RAISE Act: Original RAISE Act enacted as Chapter 699; its original start clause was later amended","jurisdiction":"US-NY","regime":"us-ny","instrument":"ny-raise","obligations":[],"kind":"milestone","source":"https://www.nysenate.gov/legislation/bills/2025/S6953"},{"date":"2026-01-01","title":"Amended Cybersecurity Law: Amendment enters into force","jurisdiction":"CN","regime":"cn","instrument":"cn-csl","obligations":[],"kind":"milestone","source":"http://www.npc.gov.cn/npc/c1773/c1848/c21114/wlaqfxz/wlaqfxz002/202511/t20251103_449242.html"},{"date":"2026-01-01","title":"Recognise the Cybersecurity Law's AI governance mandate (Amended Cybersecurity Law Art. 20)","jurisdiction":"CN","regime":"cn","instrument":"cn-csl","obligations":["AGC-CN-CSL-20"],"kind":"applies","source":"http://www.npc.gov.cn/npc/c1773/c1848/c21114/wlaqfxz/wlaqfxz002/202511/t20251103_449242.html"},{"date":"2026-01-01","title":"Companion chatbot safeguards: Companion-chatbot disclosure","jurisdiction":"US-CA","regime":"us-ca","instrument":"us-ca-sb243","obligations":[],"kind":"milestone","source":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB243"},{"date":"2026-01-01","title":"Complete CCPA risk assessments for high-risk processing (CPPA ADMT and risk assessments 11 CCR § 7150 and related risk-assessment provisions)","jurisdiction":"US-CA","regime":"us-ca","instrument":"us-ca-cppa-admt","obligations":["AGC-US-CA-CCPA-7150"],"kind":"applies","source":"https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf"},{"date":"2026-01-01","title":"Disclose companion-chatbot identity and maintain crisis and minor safeguards (Companion chatbot safeguards BPC §§ 22602(a)–(c), 22604)","jurisdiction":"US-CA","regime":"us-ca","instrument":"us-ca-sb243","obligations":["AGC-US-CA-SB243-22602"],"kind":"applies","source":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB243"},{"date":"2026-01-01","title":"GenAI training-data documentation: Initial public training-data documentation deadline","jurisdiction":"US-CA","regime":"us-ca","instrument":"us-ca-ab2013","obligations":[],"kind":"milestone","source":"https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=3111."},{"date":"2026-01-01","title":"Publish and maintain a frontier safety framework (TFAIA / SB 53 BPC § 22757.12(a)–(b))","jurisdiction":"US-CA","regime":"us-ca","instrument":"us-ca-sb53","obligations":["AGC-US-CA-SB53-22757-12-A"],"kind":"applies","source":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB53"},{"date":"2026-01-01","title":"Publish deployment reports and report critical safety incidents (TFAIA / SB 53 BPC §§ 22757.12(c)–(d), 22757.13(c))","jurisdiction":"US-CA","regime":"us-ca","instrument":"us-ca-sb53","obligations":["AGC-US-CA-SB53-22757-12-C-13"],"kind":"applies","source":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB53"},{"date":"2026-01-01","title":"Publish generative-AI training-data documentation (GenAI training-data documentation Civil Code § 3111)","jurisdiction":"US-CA","regime":"us-ca","instrument":"us-ca-ab2013","obligations":["AGC-US-CA-AB2013-CIV-3111"],"kind":"applies","source":"https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=3111."},{"date":"2026-01-01","title":"TFAIA / SB 53: SB 53's core frontier-developer duties became operative","jurisdiction":"US-CA","regime":"us-ca","instrument":"us-ca-sb53","obligations":[],"kind":"milestone","source":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB53"},{"date":"2026-01-01","title":"Do not use discriminatory AI in employment (IHRA AI employment provisions 775 ILCS 5/2-102(L)(1))","jurisdiction":"US-IL","regime":"us-il","instrument":"il-ihra-ai","obligations":["AGC-US-IL-IHRA-2-102-L1"],"kind":"applies","source":"https://www.ilga.gov/Legislation/PublicActs/View/103-0804"},{"date":"2026-01-01","title":"Notify employees when covered AI is used (IHRA AI employment provisions 775 ILCS 5/2-102(L)(2))","jurisdiction":"US-IL","regime":"us-il","instrument":"il-ihra-ai","obligations":["AGC-US-IL-IHRA-2-102-L2"],"kind":"applies","source":"https://www.ilga.gov/Legislation/PublicActs/View/103-0804"},{"date":"2026-01-01","title":"Apply and report if participating in the AI regulatory sandbox (Texas TRAIGA Bus. & Com. Code §§ 553.052, 553.053, 553.102)","jurisdiction":"US-TX","regime":"us-tx","instrument":"us-tx-traiga","obligations":["AGC-US-TX-TRAIGA-553-052"],"kind":"applies","source":"https://statutes.capitol.texas.gov/Docs/BC/htm/BC.553.htm"},{"date":"2026-01-01","title":"Disclose AI use in health-care services or treatment (Texas TRAIGA Bus. & Com. Code § 552.051(f))","jurisdiction":"US-TX","regime":"us-tx","instrument":"us-tx-traiga","obligations":["AGC-US-TX-TRAIGA-552-051-HEALTH"],"kind":"applies","source":"https://statutes.capitol.texas.gov/Docs/BC/htm/BC.552.htm"},{"date":"2026-01-01","title":"Disclose government AI interactions to consumers (Texas TRAIGA Bus. & Com. Code § 552.051(b)-(e))","jurisdiction":"US-TX","regime":"us-tx","instrument":"us-tx-traiga","obligations":["AGC-US-TX-TRAIGA-552-051-GOV"],"kind":"applies","source":"https://statutes.capitol.texas.gov/Docs/BC/htm/BC.552.htm"},{"date":"2026-01-01","title":"Do not develop specified AI sexual-abuse material or child-impersonating chat (Texas TRAIGA Bus. & Com. Code § 552.057)","jurisdiction":"US-TX","regime":"us-tx","instrument":"us-tx-traiga","obligations":["AGC-US-TX-TRAIGA-552-057"],"kind":"applies","source":"https://statutes.capitol.texas.gov/Docs/BC/htm/BC.552.htm"},{"date":"2026-01-01","title":"Do not intentionally incite self-harm, violence, or crime (Texas TRAIGA Bus. & Com. Code § 552.052)","jurisdiction":"US-TX","regime":"us-tx","instrument":"us-tx-traiga","obligations":["AGC-US-TX-TRAIGA-552-052"],"kind":"applies","source":"https://statutes.capitol.texas.gov/Docs/BC/htm/BC.552.htm"},{"date":"2026-01-01","title":"Do not target constitutional rights or unlawfully discriminate by intent (Texas TRAIGA Bus. & Com. Code §§ 552.055-.056)","jurisdiction":"US-TX","regime":"us-tx","instrument":"us-tx-traiga","obligations":["AGC-US-TX-TRAIGA-552-055-056"],"kind":"applies","source":"https://statutes.capitol.texas.gov/Docs/BC/htm/BC.552.htm"},{"date":"2026-01-01","title":"Do not use AI for prohibited government social scoring (Texas TRAIGA Bus. & Com. Code § 552.053)","jurisdiction":"US-TX","regime":"us-tx","instrument":"us-tx-traiga","obligations":["AGC-US-TX-TRAIGA-552-053"],"kind":"applies","source":"https://statutes.capitol.texas.gov/Docs/BC/htm/BC.552.htm"},{"date":"2026-01-01","title":"Limit government biometric identification that infringes rights (Texas TRAIGA Bus. & Com. Code § 552.054 and § 503.001)","jurisdiction":"US-TX","regime":"us-tx","instrument":"us-tx-traiga","obligations":["AGC-US-TX-TRAIGA-552-054"],"kind":"applies","source":"https://statutes.capitol.texas.gov/Docs/BC/htm/BC.552.htm"},{"date":"2026-01-01","title":"Personal Data Protection Law: Personal Data Protection Law enters into force","jurisdiction":"VN","regime":"vn","instrument":"vn-personal-data-law","obligations":[],"kind":"milestone","source":"https://congbao.chinhphu.vn/van-ban/luat-so-91-2025-qh15-45578.htm"},{"date":"2026-01-01","title":"Protect personal data processed using AI (Personal Data Protection Law Art. 30(1)-(5))","jurisdiction":"VN","regime":"vn","instrument":"vn-personal-data-law","obligations":["AGC-VN-PDPL-30"],"kind":"applies","source":"https://congbao.chinhphu.vn/van-ban/luat-so-91-2025-qh15-45578.htm"},{"date":"2026-01-17","title":"FY2026 NDAA: 30-day deadline for DoD's DeepSeek-related removal requirements and DoD-contractor prohibition under section 1532","jurisdiction":"US","regime":"us","instrument":"us-ndaa26","obligations":[],"kind":"milestone","source":"https://www.govinfo.gov/content/pkg/PLAW-119publ60/html/PLAW-119publ60.htm"},{"date":"2026-01-17","title":"Keep covered DeepSeek and High Flyer AI out of DoD contract performance (FY2026 NDAA §1532(a)(1), (a)(3), (b)-(c))","jurisdiction":"US","regime":"us","instrument":"us-ndaa26","obligations":["AGC-US-NDAA11960-1532"],"kind":"applies","source":"https://www.govinfo.gov/content/pkg/PLAW-119publ60/html/PLAW-119publ60.htm"},{"date":"2026-01-21","title":"AI Basic Act Enforcement Decree: Presidential Decree No. 36053 promulgated","jurisdiction":"KR","regime":"kr","instrument":"kr-aibad","obligations":[],"kind":"milestone","source":"https://www.law.go.kr/LSW/eng/engLsInfoR.do?lsiSeq=282879"},{"date":"2026-01-22","title":"AI Basic Act Enforcement Decree: Enforcement Decree enters into force with the AI Basic Act","jurisdiction":"KR","regime":"kr","instrument":"kr-aibad","obligations":[],"kind":"milestone","source":"https://www.msit.go.kr/eng/bbs/view.do?sCode=eng&mPid=2&mId=4&bbsSeqNo=42&nttSeqNo=1214"},{"date":"2026-01-22","title":"AI Basic Act: AI Basic Act enters into force","jurisdiction":"KR","regime":"kr","instrument":"kr-aiba","obligations":[],"kind":"milestone","source":"https://www.msit.go.kr/eng/bbs/view.do?sCode=eng&mPid=2&mId=4&bbsSeqNo=42&nttSeqNo=1214"},{"date":"2026-01-22","title":"Apply safety and trust measures to high-impact AI (AI Basic Act Art. 34(1)-(3))","jurisdiction":"KR","regime":"kr","instrument":"kr-aiba","obligations":["AGC-KR-AIBA-34"],"kind":"applies","source":"https://www.law.go.kr/LSW/eng/engLsInfoR.do?lsiSeq=268543"},{"date":"2026-01-22","title":"Appoint a domestic agent when foreign-operator thresholds are met (AI Basic Act Art. 36(1)-(3); Enforcement Decree Art. 29)","jurisdiction":"KR","regime":"kr","instrument":"kr-aiba","obligations":["AGC-KR-AIBA-36-1"],"kind":"applies","source":"https://www.law.go.kr/LSW/lsInfoP.do?lsiSeq=288781"},{"date":"2026-01-22","title":"Clearly label realistic synthetic audio, images, and video (AI Basic Act Art. 31(3); Enforcement Decree Art. 23(3), (4))","jurisdiction":"KR","regime":"kr","instrument":"kr-aiba","obligations":["AGC-KR-AIBA-31-3"],"kind":"applies","source":"https://www.law.go.kr/LSW/lsInfoP.do?lsiSeq=288781"},{"date":"2026-01-22","title":"Endeavor to assess fundamental-rights impacts of high-impact AI (AI Basic Act Art. 35(1); Enforcement Decree Art. 28)","jurisdiction":"KR","regime":"kr","instrument":"kr-aiba","obligations":["AGC-KR-AIBA-35-1"],"kind":"applies","source":"https://www.law.go.kr/lsLinkCommonInfo.do?chrClsCd=010202&lsJoLnkSeq=1031810855"},{"date":"2026-01-22","title":"Identify outputs generated by generative AI (AI Basic Act Art. 31(2); Enforcement Decree Art. 23(2), (4))","jurisdiction":"KR","regime":"kr","instrument":"kr-aiba","obligations":["AGC-KR-AIBA-31-2"],"kind":"applies","source":"https://www.law.go.kr/LSW/lsInfoP.do?lsiSeq=288781"},{"date":"2026-01-22","title":"Manage lifecycle safety risks for qualifying advanced AI systems (AI Basic Act Art. 32(1)-(3); Enforcement Decree Art. 24)","jurisdiction":"KR","regime":"kr","instrument":"kr-aiba","obligations":["AGC-KR-AIBA-32"],"kind":"applies","source":"https://www.law.go.kr/LSW/lsInfoP.do?lsiSeq=288781"},{"date":"2026-01-22","title":"Prefer high-impact AI products or services with impact assessments (AI Basic Act Art. 35(2))","jurisdiction":"KR","regime":"kr","instrument":"kr-aiba","obligations":["AGC-KR-AIBA-35-2"],"kind":"applies","source":"https://www.law.go.kr/lsLinkCommonInfo.do?chrClsCd=010202&lsJoLnkSeq=1031810855"},{"date":"2026-01-22","title":"Publish key high-impact AI safeguards and retain evidence for five years (AI Basic Act Enforcement Decree Enforcement Decree Art. 27(1)-(2); Act Art. 34(1))","jurisdiction":"KR","regime":"kr","instrument":"kr-aibad","obligations":["AGC-KR-AIBAD-27-1-2"],"kind":"applies","source":"https://www.law.go.kr/LSW/lsInfoP.do?lsiSeq=288781"},{"date":"2026-01-22","title":"Review whether a system is high-impact AI before providing it (AI Basic Act Art. 33(1)-(4); Enforcement Decree Art. 25)","jurisdiction":"KR","regime":"kr","instrument":"kr-aiba","obligations":["AGC-KR-AIBA-33"],"kind":"applies","source":"https://www.law.go.kr/LSW/eng/engLsInfoR.do?lsiSeq=268543"},{"date":"2026-01-22","title":"Tell users in advance when a service uses generative or high-impact AI (AI Basic Act Art. 31(1); Enforcement Decree Art. 23(1), (4))","jurisdiction":"KR","regime":"kr","instrument":"kr-aiba","obligations":["AGC-KR-AIBA-31-1"],"kind":"applies","source":"https://www.law.go.kr/LSW/eng/engLsInfoR.do?lsiSeq=268543"},{"date":"2026-01-22","title":"Agentic AI Governance Framework: IMDA first published the Agentic AI framework","jurisdiction":"SG","regime":"sg","instrument":"sg-mgf-agentic","obligations":[],"kind":"milestone","source":"https://www.imda.gov.sg/resources/press-releases-factsheets-and-speeches/press-releases/2026/singapore-launches-new-model-ai-governance-framework-for-agentic-ai"},{"date":"2026-01-22","title":"Assign accountable humans and approval checkpoints (Agentic AI Governance Framework Framework § 2.2)","jurisdiction":"SG","regime":"sg","instrument":"sg-mgf-agentic","obligations":["AGC-SG-AGENTIC-2-2"],"kind":"applies","source":"https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf"},{"date":"2026-01-22","title":"Bound agent risks before deployment (Agentic AI Governance Framework Framework § 2.1)","jurisdiction":"SG","regime":"sg","instrument":"sg-mgf-agentic","obligations":["AGC-SG-AGENTIC-2-1"],"kind":"applies","source":"https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf"},{"date":"2026-01-22","title":"Inform and train agent end users (Agentic AI Governance Framework Framework § 2.4)","jurisdiction":"SG","regime":"sg","instrument":"sg-mgf-agentic","obligations":["AGC-SG-AGENTIC-2-4"],"kind":"applies","source":"https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf"},{"date":"2026-01-22","title":"Test, monitor and log agent behavior (Agentic AI Governance Framework Framework § 2.3)","jurisdiction":"SG","regime":"sg","instrument":"sg-mgf-agentic","obligations":["AGC-SG-AGENTIC-2-3"],"kind":"applies","source":"https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf"},{"date":"2026-01-24","title":"AI Basic Act: The high-impact AI definition covering the specified digital-medical-device provisions takes effect","jurisdiction":"KR","regime":"kr","instrument":"kr-aiba","obligations":[],"kind":"milestone","source":"https://www.law.go.kr/LSW/eng/engLsInfoR.do?lsiSeq=268543"},{"date":"2026-02-05","title":"Give people safeguards for significant automated decisions (UK GDPR Art. 22C)","jurisdiction":"GB","regime":"gb","instrument":"gb-ukgdpr-adm","obligations":["AGC-GB-UKGDPR-22C"],"kind":"applies","source":"https://www.legislation.gov.uk/ukpga/2025/18/section/80"},{"date":"2026-02-05","title":"Law-enforcement automated decision-making: New Part 3 law-enforcement automated-decision provisions came into force","jurisdiction":"GB","regime":"gb","instrument":"gb-dpa-le-adm","obligations":[],"kind":"milestone","source":"https://www.legislation.gov.uk/uksi/2026/82/regulation/2"},{"date":"2026-02-05","title":"Restrict significant automated decisions using special-category data (UK GDPR Arts. 22A–22B)","jurisdiction":"GB","regime":"gb","instrument":"gb-ukgdpr-adm","obligations":["AGC-GB-UKGDPR-22B"],"kind":"applies","source":"https://www.legislation.gov.uk/ukpga/2025/18/section/80"},{"date":"2026-02-05","title":"Safeguard automated law-enforcement decisions (Law-enforcement automated decision-making DPA 2018 ss. 50A–50C)","jurisdiction":"GB","regime":"gb","instrument":"gb-dpa-le-adm","obligations":["AGC-GB-DPA18-50B"],"kind":"applies","source":"https://www.legislation.gov.uk/ukpga/2025/18/section/80"},{"date":"2026-02-05","title":"UK GDPR automated decision-making: Section 80 automated decision-making amendments came into force","jurisdiction":"GB","regime":"gb","instrument":"gb-ukgdpr-adm","obligations":[],"kind":"milestone","source":"https://www.legislation.gov.uk/uksi/2026/82/regulation/2"},{"date":"2026-02-06","title":"Do not create or request non-consensual purported intimate images (Non-consensual purported intimate images DUAA 2025 s. 138 (SOA 2003 ss. 66E–66F))","jurisdiction":"GB","regime":"gb","instrument":"gb-duaa-intimate-images","obligations":["AGC-GB-DUAA-138-66E"],"kind":"applies","source":"https://www.legislation.gov.uk/ukpga/2025/18/section/138"},{"date":"2026-02-06","title":"Non-consensual purported intimate images: Section 138 came into force","jurisdiction":"GB","regime":"gb","instrument":"gb-duaa-intimate-images","obligations":[],"kind":"milestone","source":"https://www.legislation.gov.uk/uksi/2026/31/made"},{"date":"2026-02-10","title":"IT Intermediary Rules: G.S.R. 120(E) notifies the 2026 amendments, including synthetic-information duties","jurisdiction":"IN","regime":"in","instrument":"in-it-rules","obligations":[],"kind":"milestone","source":"https://www.meity.gov.in/static/uploads/2026/02/f55fe52418b03f58b0669f6a8bc03b6d.pdf"},{"date":"2026-02-13","title":"LOADinG Act: Chapter 86 narrows the framework","jurisdiction":"US-NY","regime":"us-ny","instrument":"ny-loading","obligations":[],"kind":"milestone","source":"https://www.nysenate.gov/legislation/bills/2025/S8831"},{"date":"2026-02-13","title":"Preserve public employees' existing rights and duties (LOADinG Act Civil Service Law §80(10), as amended by Chapter 86 of 2026)","jurisdiction":"US-NY","regime":"us-ny","instrument":"ny-loading","obligations":["AGC-US-NY-LOAD-CVS80-10"],"kind":"applies","source":"https://www.nysenate.gov/legislation/laws/CVS/80"},{"date":"2026-02-13","title":"Publish covered-entity employment-tool lists (LOADinG Act State Technology Law §§401(3), 402-a)","jurisdiction":"US-NY","regime":"us-ny","instrument":"ny-loading","obligations":["AGC-US-NY-LOAD-402A"],"kind":"applies","source":"https://www.nysenate.gov/legislation/laws/STT/402-A"},{"date":"2026-02-16","title":"FY2026 NDAA: 60-day deadline for DNI to issue initial standards and guidelines under section 6604","jurisdiction":"US","regime":"us","instrument":"us-ndaa26","obligations":[],"kind":"milestone","source":"https://www.govinfo.gov/content/pkg/PLAW-119publ60/html/PLAW-119publ60.htm"},{"date":"2026-02-16","title":"Require removal of DeepSeek from intelligence-community systems (FY2026 NDAA §6604(a)-(e))","jurisdiction":"US","regime":"us","instrument":"us-ndaa26","obligations":["AGC-US-NDAA11960-6604"],"kind":"applies","source":"https://www.govinfo.gov/content/pkg/PLAW-119publ60/html/PLAW-119publ60.htm"},{"date":"2026-02-20","title":"Act on specified unlawful-content orders within three hours (IT Intermediary Rules Rule 3(1)(d))","jurisdiction":"IN","regime":"in","instrument":"in-it-rules","obligations":["AGC-IN-ITR-3-1-D"],"kind":"applies","source":"https://www.meity.gov.in/static/uploads/2026/03/0b576f2071694b52e4cd6bb1b6dfab1e.pdf"},{"date":"2026-02-20","title":"IT Intermediary Rules: 2026 IT Rules amendments enter into force","jurisdiction":"IN","regime":"in","instrument":"in-it-rules","obligations":[],"kind":"milestone","source":"https://www.meity.gov.in/static/uploads/2026/02/f55fe52418b03f58b0669f6a8bc03b6d.pdf"},{"date":"2026-02-20","title":"Prevent unlawful synthetic media and label other synthetic information (IT Intermediary Rules Rule 3(3)(a)(i)–(ii) and Rule 3(3)(b))","jurisdiction":"IN","regime":"in","instrument":"in-it-rules","obligations":["AGC-IN-ITR-3-3-A-I-II"],"kind":"applies","source":"https://www.meity.gov.in/static/uploads/2026/03/0b576f2071694b52e4cd6bb1b6dfab1e.pdf"},{"date":"2026-02-20","title":"Remove specified intimate or impersonating content within two hours of complaint (IT Intermediary Rules Rule 3(2)(b))","jurisdiction":"IN","regime":"in","instrument":"in-it-rules","obligations":["AGC-IN-ITR-3-2-B"],"kind":"applies","source":"https://www.meity.gov.in/static/uploads/2026/03/0b576f2071694b52e4cd6bb1b6dfab1e.pdf"},{"date":"2026-02-20","title":"Resolve intermediary grievances within seven days (IT Intermediary Rules Rule 3(2)(a)(i))","jurisdiction":"IN","regime":"in","instrument":"in-it-rules","obligations":["AGC-IN-ITR-3-2-A-I"],"kind":"applies","source":"https://www.meity.gov.in/static/uploads/2026/03/0b576f2071694b52e4cd6bb1b6dfab1e.pdf"},{"date":"2026-02-20","title":"Verify synthetic-media declarations before SSMI publication (IT Intermediary Rules Rule 4(1A))","jurisdiction":"IN","regime":"in","instrument":"in-it-rules","obligations":["AGC-IN-ITR-4-1-A"],"kind":"applies","source":"https://www.meity.gov.in/static/uploads/2026/03/0b576f2071694b52e4cd6bb1b6dfab1e.pdf"},{"date":"2026-02-26","title":"IT Intermediary Rules: G.S.R. 148(E) corrects statutory references in the February amendment","jurisdiction":"IN","regime":"in","instrument":"in-it-rules","obligations":[],"kind":"milestone","source":"https://www.meity.gov.in/static/uploads/2026/03/20c30107195f68865104dd4e16176f4d.pdf"},{"date":"2026-03-01","title":"Assess conformity of high-risk AI before use and after significant changes (Vietnam AI Law Art. 13; Decree 142, Art. 13; Decision 33/2026/QD-TTg)","jurisdiction":"VN","regime":"vn","instrument":"vn-ai-law","obligations":["AGC-VN-AILAW-13"],"kind":"applies","source":"https://en.baochinhphu.vn/viet-nams-law-on-artificial-intelligence-111260715113551787.htm"},{"date":"2026-03-01","title":"Assess public-sector AI impacts before qualifying use (AI Law Implementing Decree Art. 27(3)-(4) of the AI Law; Decree 142, Art. 20)","jurisdiction":"VN","regime":"vn","instrument":"vn-ai-decree-142","obligations":["AGC-VN-D142-20"],"kind":"applies","source":"https://datafiles.chinhphu.vn/cpp/files/vbpq/2026/4/142-2026-ndcp.signed.pdf"},{"date":"2026-03-01","title":"Classify AI by risk and notify medium- and high-risk systems (Vietnam AI Law Art. 9-10; Decree 142, Arts. 5-6, 11-12 and 14)","jurisdiction":"VN","regime":"vn","instrument":"vn-ai-law","obligations":["AGC-VN-AILAW-9-10"],"kind":"applies","source":"https://en.baochinhphu.vn/viet-nams-law-on-artificial-intelligence-111260715113551787.htm"},{"date":"2026-03-01","title":"Disclose AI interactions and machine-mark generated audio, images and video (Vietnam AI Law Art. 11(1)-(2); Decree 142, Art. 17)","jurisdiction":"VN","regime":"vn","instrument":"vn-ai-law","obligations":["AGC-VN-AILAW-11-1-2"],"kind":"applies","source":"https://en.baochinhphu.vn/viet-nams-law-on-artificial-intelligence-111260715113551787.htm"},{"date":"2026-03-01","title":"Do not use AI for prohibited or unlawful purposes (Vietnam AI Law Art. 7(1)-(6))","jurisdiction":"VN","regime":"vn","instrument":"vn-ai-law","obligations":["AGC-VN-AILAW-7"],"kind":"applies","source":"https://en.baochinhphu.vn/viet-nams-law-on-artificial-intelligence-111260715113551787.htm"},{"date":"2026-03-01","title":"Foreign high-risk providers must maintain a Vietnam contact point (Vietnam AI Law Art. 14(6))","jurisdiction":"VN","regime":"vn","instrument":"vn-ai-law","obligations":["AGC-VN-AILAW-14-6"],"kind":"applies","source":"https://en.baochinhphu.vn/viet-nams-law-on-artificial-intelligence-111260715113551787.htm"},{"date":"2026-03-01","title":"Manage high-risk systems with documented controls and human oversight (Vietnam AI Law Art. 14(1)-(5); Decree 142, Art. 15)","jurisdiction":"VN","regime":"vn","instrument":"vn-ai-law","obligations":["AGC-VN-AILAW-14"],"kind":"applies","source":"https://en.baochinhphu.vn/viet-nams-law-on-artificial-intelligence-111260715113551787.htm"},{"date":"2026-03-01","title":"Notify the public and visibly label potentially misleading AI content (Vietnam AI Law Art. 11(3)-(5); Decree 142, Art. 18)","jurisdiction":"VN","regime":"vn","instrument":"vn-ai-law","obligations":["AGC-VN-AILAW-11-3-4"],"kind":"applies","source":"https://en.baochinhphu.vn/viet-nams-law-on-artificial-intelligence-111260715113551787.htm"},{"date":"2026-03-01","title":"Vietnam AI Law: Law enters into force","jurisdiction":"VN","regime":"vn","instrument":"vn-ai-law","obligations":[],"kind":"milestone","source":"https://en.baochinhphu.vn/viet-nams-law-on-artificial-intelligence-111260715113551787.htm"},{"date":"2026-03-11","title":"OMB M-26-04: Deadline for agencies to update procurement policies and user-feedback processes","jurisdiction":"US","regime":"us","instrument":"us-omb-m2604","obligations":[],"kind":"milestone","source":"https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles.pdf"},{"date":"2026-03-27","title":"RAISE Act: Chapter 96 replaces Article 44-B and moves the start date to January 1","jurisdiction":"US-NY","regime":"us-ny","instrument":"ny-raise","obligations":[],"kind":"milestone","source":"https://legislation.nysenate.gov/pdf/bills/2025/S8828"},{"date":"2026-03-31","title":"AI Guidelines for Business Ver1.2: METI and MIC issued AI Guidelines for Business Ver1.2","jurisdiction":"JP","regime":"jp","instrument":"jp-ai-guidelines","obligations":[],"kind":"milestone","source":"https://www.meti.go.jp/shingikai/mono_info_service/ai_shakai_jisso/pdf/20260331_12.pdf"},{"date":"2026-03-31","title":"Assess and manage AI safety risks (AI Guidelines for Business Ver1.2 Part 2.C.2)","jurisdiction":"JP","regime":"jp","instrument":"jp-ai-guidelines","obligations":["AGC-JP-AIGB-C2"],"kind":"applies","source":"https://www.meti.go.jp/shingikai/mono_info_service/ai_shakai_jisso/pdf/20260331_12.pdf"},{"date":"2026-03-31","title":"Document AI accountability (AI Guidelines for Business Ver1.2 Part 2.C.7)","jurisdiction":"JP","regime":"jp","instrument":"jp-ai-guidelines","obligations":["AGC-JP-AIGB-C7"],"kind":"applies","source":"https://www.meti.go.jp/shingikai/mono_info_service/ai_shakai_jisso/pdf/20260331_12.pdf"},{"date":"2026-03-31","title":"Keep AI human-centric (AI Guidelines for Business Ver1.2 Part 2.C.1)","jurisdiction":"JP","regime":"jp","instrument":"jp-ai-guidelines","obligations":["AGC-JP-AIGB-C1"],"kind":"applies","source":"https://www.meti.go.jp/shingikai/mono_info_service/ai_shakai_jisso/pdf/20260331_12.pdf"},{"date":"2026-03-31","title":"Protect privacy throughout the AI lifecycle (AI Guidelines for Business Ver1.2 Part 2.C.4)","jurisdiction":"JP","regime":"jp","instrument":"jp-ai-guidelines","obligations":["AGC-JP-AIGB-C4"],"kind":"applies","source":"https://www.meti.go.jp/shingikai/mono_info_service/ai_shakai_jisso/pdf/20260331_12.pdf"},{"date":"2026-03-31","title":"Provide proportionate information about AI (AI Guidelines for Business Ver1.2 Part 2.C.6)","jurisdiction":"JP","regime":"jp","instrument":"jp-ai-guidelines","obligations":["AGC-JP-AIGB-C6"],"kind":"applies","source":"https://www.meti.go.jp/shingikai/mono_info_service/ai_shakai_jisso/pdf/20260331_12.pdf"},{"date":"2026-03-31","title":"Secure AI systems and services (AI Guidelines for Business Ver1.2 Part 2.C.5)","jurisdiction":"JP","regime":"jp","instrument":"jp-ai-guidelines","obligations":["AGC-JP-AIGB-C5"],"kind":"applies","source":"https://www.meti.go.jp/shingikai/mono_info_service/ai_shakai_jisso/pdf/20260331_12.pdf"},{"date":"2026-04-03","title":"OMB M-25-21: 365-day deadline to document implementation of minimum risk practices for high-impact AI","jurisdiction":"US","regime":"us","instrument":"us-omb-m2521","obligations":[],"kind":"milestone","source":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf"},{"date":"2026-04-10","title":"Anthropomorphic Interactive Services Measures: Measures promulgated","jurisdiction":"CN","regime":"cn","instrument":"cn-anthro","obligations":[],"kind":"milestone","source":"https://www.cac.gov.cn/2026-04/10/c_1777558395078289.htm"},{"date":"2026-04-29","title":"Intimate-image and child-abuse-image generator offences: Sections 72 and 74 were enacted but were not commenced as of 4 November 2026","jurisdiction":"GB","regime":"gb","instrument":"gb-cpa26-image-generators","obligations":[],"kind":"milestone","source":"https://www.legislation.gov.uk/ukpga/2026/20/section/72"},{"date":"2026-04-29","title":"Online Safety Act: Crime and Policing Act 2026 section 248 inserted Online Safety Act section 216A","jurisdiction":"GB","regime":"gb","instrument":"gb-osa","obligations":[],"kind":"milestone","source":"https://www.legislation.gov.uk/ukpga/2026/20/section/248"},{"date":"2026-04-30","title":"AI Law Implementing Decree: Decree issued","jurisdiction":"VN","regime":"vn","instrument":"vn-ai-decree-142","obligations":[],"kind":"milestone","source":"https://vanban.chinhphu.vn/?pageid=27160&docid=218029"},{"date":"2026-05-01","title":"AI Law Implementing Decree: Decree enters into force","jurisdiction":"VN","regime":"vn","instrument":"vn-ai-decree-142","obligations":[],"kind":"milestone","source":"https://vanban.chinhphu.vn/?pageid=27160&docid=218029"},{"date":"2026-05-01","title":"Contain and report serious AI incidents on time (AI Law Implementing Decree Art. 12 of the AI Law; Decree 142, Art. 19(2)-(8))","jurisdiction":"VN","regime":"vn","instrument":"vn-ai-decree-142","obligations":["AGC-VN-D142-19"],"kind":"applies","source":"https://datafiles.chinhphu.vn/cpp/files/vbpq/2026/4/142-2026-ndcp.signed.pdf"},{"date":"2026-05-08","title":"Proposed: State Council legislative work plan calls for accelerating comprehensive AI legislation; no draft text or enactment date stated","jurisdiction":"CN","regime":"cn","instrument":"cn-csl","obligations":["AGC-CN-CSL-20"],"kind":"deadline","source":"https://www.gov.cn/yaowen/liebiao/202605/content_7068353.htm"},{"date":"2026-05-12","title":"Statutory AI and ADM code mandate: Regulations requiring the Commissioner to prepare a statutory AI and ADM code came into force","jurisdiction":"GB","regime":"gb","instrument":"gb-dpa-ai-code-regs","obligations":[],"kind":"milestone","source":"https://www.legislation.gov.uk/uksi/2026/425/made"},{"date":"2026-05-13","title":"Regulating for Growth Bill: King's Speech announced the proposed Regulating for Growth Bill","jurisdiction":"GB","regime":"gb","instrument":"gb-regulating-growth","obligations":[],"kind":"milestone","source":"https://www.gov.uk/government/speeches/the-kings-speech-2026"},{"date":"2026-05-14","title":"Colorado ADMT Act: SB 26-189 was signed; specified rulemaking and procedural provisions took effect upon passage","jurisdiction":"US-CO","regime":"us-co","instrument":"co-sb26-189","obligations":[],"kind":"milestone","source":"https://leg.colorado.gov/laws/session-laws/SB26-189/131/download"},{"date":"2026-05-15","title":"Council of Europe AI Framework Convention: European Union ratifies the Convention","jurisdiction":"COE","regime":"coe","instrument":"coe-ai-convention","obligations":[],"kind":"milestone","source":"https://www.coe.int/en/web/artificial-intelligence/-/european-union-ratifies-the-council-of-europe-framework-convention-on-artificial-intelligence"},{"date":"2026-05-19","title":"Provide notice and remove validly reported intimate depictions (TAKE IT DOWN Act §3(a)-(b))","jurisdiction":"US","regime":"us","instrument":"us-tida","obligations":["AGC-US-TIDA-3"],"kind":"applies","source":"https://www.congress.gov/119/plaws/publ12/PLAW-119publ12.htm"},{"date":"2026-05-19","title":"TAKE IT DOWN Act: Deadline for covered platforms to establish the section 3 notice-and-removal process","jurisdiction":"US","regime":"us","instrument":"us-tida","obligations":[],"kind":"milestone","source":"https://www.congress.gov/119/plaws/publ12/PLAW-119publ12.htm"},{"date":"2026-05-20","title":"Agentic AI Governance Framework: Version 1.5 published; the PDF notes a further update on 5 June 2026","jurisdiction":"SG","regime":"sg","instrument":"sg-mgf-agentic","obligations":[],"kind":"milestone","source":"https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf"},{"date":"2026-06-01","title":"Assess and oversee major DoD AI systems (FY2026 NDAA §1533(a)-(d), (f)(3))","jurisdiction":"US","regime":"us","instrument":"us-ndaa26","obligations":["AGC-US-NDAA11960-1533"],"kind":"applies","source":"https://www.govinfo.gov/content/pkg/PLAW-119publ60/html/PLAW-119publ60.htm"},{"date":"2026-06-01","title":"FY2026 NDAA: Deadline to establish the DoD cross-functional AI model assessment and oversight team under section 1533","jurisdiction":"US","regime":"us","instrument":"us-ndaa26","obligations":[],"kind":"milestone","source":"https://www.govinfo.gov/content/pkg/PLAW-119publ60/html/PLAW-119publ60.htm"},{"date":"2026-06-05","title":"Agentic AI Governance Framework: Version 1.5 PDF updated","jurisdiction":"SG","regime":"sg","instrument":"sg-mgf-agentic","obligations":[],"kind":"milestone","source":"https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf"},{"date":"2026-06-10","title":"EU Code of Practice on AI-generated content: Final Code of Practice published","jurisdiction":"EU","regime":"eu","instrument":"eu-cop-marking","obligations":[],"kind":"milestone","source":"https://digital-strategy.ec.europa.eu/en/policies/code-practice-ai-generated-content"},{"date":"2026-06-10","title":"Regulating for Growth Bill: Government described statutory AI Growth Labs as dependent on passage of the Bill","jurisdiction":"GB","regime":"gb","instrument":"gb-regulating-growth","obligations":[],"kind":"milestone","source":"https://www.gov.uk/government/publications/digital-and-technologies-sector-plan-year-one-update/digital-and-technologies-sector-plan-year-one-update"},{"date":"2026-06-16","title":"FY2026 NDAA: 180-day deadline for the DoD policies and framework-related congressional updates in sections 1512 and 1513","jurisdiction":"US","regime":"us","instrument":"us-ndaa26","obligations":[],"kind":"milestone","source":"https://www.govinfo.gov/content/pkg/PLAW-119publ60/html/PLAW-119publ60.htm"},{"date":"2026-06-26","title":"IHRA AI employment provisions: IDHR proposed AI-employment rule amendments were officially withdrawn","jurisdiction":"US-IL","regime":"us-il","instrument":"il-ihra-ai","obligations":[],"kind":"milestone","source":"https://ilga.gov/documents/commission/jcar/flinn/20260626_June%2026,%202026%20-%20Issue%2026.pdf"},{"date":"2026-06-29","title":"Do not make or supply purported intimate-image generators (Intimate-image and child-abuse-image generator offences CPA 2026 s. 99 (SOA 2003 s. 66I))","jurisdiction":"GB","regime":"gb","instrument":"gb-cpa26-image-generators","obligations":["AGC-GB-CPA26-99-66I"],"kind":"applies","source":"https://www.legislation.gov.uk/ukpga/2026/20/section/99"},{"date":"2026-06-29","title":"Intimate-image and child-abuse-image generator offences: Section 99 came into force in England and Wales","jurisdiction":"GB","regime":"gb","instrument":"gb-cpa26-image-generators","obligations":[],"kind":"milestone","source":"https://www.legislation.gov.uk/uksi/2026/689/regulation/2"},{"date":"2026-06-29","title":"Do not communicate qualifying intimate or child-abuse images (OSRAA §§ 13-14, 83-84)","jurisdiction":"SG","regime":"sg","instrument":"sg-osraa","obligations":["AGC-SG-OSRAA-13-14-83-84"],"kind":"applies","source":"https://sso.agc.gov.sg/Act/OSRAA2025"},{"date":"2026-06-30","title":"Mark and disclose synthetic content (Colorado AI Act (2024) C.R.S. § 6-1-1705 (SB 24-205 version))","jurisdiction":"US-CO","regime":"us-co","instrument":"co-sb24-205","obligations":["AGC-US-CO-SB24205-1705"],"kind":"applies","source":"https://leg.colorado.gov/laws/session-laws/SB24-205/198/download"},{"date":"2026-06-30","title":"Notify consumers and publish high-risk system information (Colorado AI Act (2024) C.R.S. §§ 6-1-1703(5), 6-1-1704 (SB 24-205 version))","jurisdiction":"US-CO","regime":"us-co","instrument":"co-sb24-205","obligations":["AGC-US-CO-SB24205-1704"],"kind":"applies","source":"https://leg.colorado.gov/laws/session-laws/SB24-205/198/download"},{"date":"2026-06-30","title":"Run risk management and impact assessments for high-risk AI (Colorado AI Act (2024) C.R.S. § 6-1-1703 (SB 24-205 version))","jurisdiction":"US-CO","regime":"us-co","instrument":"co-sb24-205","obligations":["AGC-US-CO-SB24205-1703"],"kind":"applies","source":"https://leg.colorado.gov/laws/session-laws/SB24-205/198/download"},{"date":"2026-06-30","title":"Use reasonable care and document high-risk systems (Colorado AI Act (2024) C.R.S. § 6-1-1702 (SB 24-205 version))","jurisdiction":"US-CO","regime":"us-co","instrument":"co-sb24-205","obligations":["AGC-US-CO-SB24205-1702"],"kind":"applies","source":"https://leg.colorado.gov/laws/session-laws/SB24-205/198/download"},{"date":"2026-06-30","title":"High-Risk AI List: Decision issued","jurisdiction":"VN","regime":"vn","instrument":"vn-high-risk-list-33","obligations":[],"kind":"milestone","source":"https://congbaocdn.chinhphu.vn/180507251028987904/2026/7/14/469951-1784024086_v1_1784024564_signed.pdf"},{"date":"2026-07-06","title":"Illinois Artificial Intelligence Safety Measures Act: Public Act 104-0538 approved","jurisdiction":"US-IL","regime":"us-il","instrument":"il-frontier-ai","obligations":[],"kind":"milestone","source":"https://witnessslips.ilga.gov/ftp/legislation/104/BillStatus/HTML/10400SB0315.html"},{"date":"2026-07-08","title":"ICO AI and ADM code: ICO listed the code as in drafting and forecast publication in Q1/Q2 2028; the code is not yet published","jurisdiction":"GB","regime":"gb","instrument":"gb-ico-ai-code","obligations":[],"kind":"milestone","source":"https://ico.org.uk/about-the-ico/what-we-do/our-plans-for-new-and-updated-codes-of-practice/upcoming-codes-of-practice/"},{"date":"2026-07-14","title":"Follow Japan's current government AI strategy (Second AI Basic Plan, Chapters 1-4)","jurisdiction":"JP","regime":"jp","instrument":"jp-ai-plan","obligations":["AGC-JP-AIBP-PLAN"],"kind":"applies","source":"https://www8.cao.go.jp/cstp/ai/ai_plan/aiplan_eng_20260714.pdf"},{"date":"2026-07-14","title":"Second AI Basic Plan: Cabinet decided the Second AI Basic Plan, replacing the first plan","jurisdiction":"JP","regime":"jp","instrument":"jp-ai-plan","obligations":[],"kind":"milestone","source":"https://www8.cao.go.jp/cstp/ai/ai_plan/ai_plan.html"},{"date":"2026-07-15","title":"Anthropomorphic Interactive Services Measures: Measures enter into force","jurisdiction":"CN","regime":"cn","instrument":"cn-anthro","obligations":[],"kind":"milestone","source":"https://www.cac.gov.cn/2026-04/10/c_1777558395078289.htm"},{"date":"2026-07-15","title":"Assess and file human-like interactive services (Anthropomorphic Interactive Services Measures Arts. 22–27)","jurisdiction":"CN","regime":"cn","instrument":"cn-anthro","obligations":["AGC-CN-ANTHRO-22-26"],"kind":"applies","source":"https://www.cac.gov.cn/2026-04/10/c_1777558395078289.htm"},{"date":"2026-07-15","title":"Disclose AI identity and allow users to leave (Anthropomorphic Interactive Services Measures Arts. 18–19)","jurisdiction":"CN","regime":"cn","instrument":"cn-anthro","obligations":["AGC-CN-ANTHRO-18-19"],"kind":"applies","source":"https://www.cac.gov.cn/2026-04/10/c_1777558395078289.htm"},{"date":"2026-07-15","title":"Govern human-like interaction safety and training data (Anthropomorphic Interactive Services Measures Arts. 8–11)","jurisdiction":"CN","regime":"cn","instrument":"cn-anthro","obligations":["AGC-CN-ANTHRO-9-11"],"kind":"applies","source":"https://www.cac.gov.cn/2026-04/10/c_1777558395078289.htm"},{"date":"2026-07-15","title":"Protect interactive data and sensitive information (Anthropomorphic Interactive Services Measures Arts. 16–17)","jurisdiction":"CN","regime":"cn","instrument":"cn-anthro","obligations":["AGC-CN-ANTHRO-16"],"kind":"applies","source":"https://www.cac.gov.cn/2026-04/10/c_1777558395078289.htm"},{"date":"2026-07-15","title":"Protect minors and intervene in safety crises (Anthropomorphic Interactive Services Measures Arts. 13–15)","jurisdiction":"CN","regime":"cn","instrument":"cn-anthro","obligations":["AGC-CN-ANTHRO-13-15"],"kind":"applies","source":"https://www.cac.gov.cn/2026-04/10/c_1777558395078289.htm"},{"date":"2026-07-20","title":"Give AI-specific notices for large-scale GenAI training data (PDPC Generative AI Guidelines Guidelines §§ 4.2-4.8, 5.1 and 7.1)","jurisdiction":"SG","regime":"sg","instrument":"sg-pdpc-genai","obligations":["AGC-SG-PDPCGENAI-4-4"],"kind":"applies","source":"https://www.pdpc.gov.sg/assets/143cb9d4-532e-4cca-9a77-bcc0415ca294"},{"date":"2026-07-20","title":"PDPC Generative AI Guidelines: PDPC issued the final Generative AI personal-data guidelines","jurisdiction":"SG","regime":"sg","instrument":"sg-pdpc-genai","obligations":[],"kind":"milestone","source":"https://www.pdpc.gov.sg/assets/143cb9d4-532e-4cca-9a77-bcc0415ca294"},{"date":"2026-07-21","title":"AI Basic Act Enforcement Decree: Partial amendment, Presidential Decree No. 36506, takes effect; it implements provisions including the vulnerable-group assessment criteria","jurisdiction":"KR","regime":"kr","instrument":"kr-aibad","obligations":[],"kind":"milestone","source":"https://www.law.go.kr/LSW/lsInfoP.do?lsiSeq=288145&efYd=20260721"},{"date":"2026-07-21","title":"Reflect AI-vulnerable groups in impact assessments (AI Basic Act Art. 35(1) second sentence; Enforcement Decree Art. 28(1)(1))","jurisdiction":"KR","regime":"kr","instrument":"kr-aiba","obligations":["AGC-KR-AIBA-35-1-VG"],"kind":"applies","source":"https://www.law.go.kr/lsLinkCommonInfo.do?chrClsCd=010202&lsJoLnkSeq=1031810855"},{"date":"2026-07-27","title":"EU AI Act: Digital Omnibus on AI (Reg. (EU) 2026/1744) enters into force; Arts. 102 to 110 apply","jurisdiction":"EU","regime":"eu","instrument":"eu-aia","obligations":[],"kind":"milestone","source":"https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force"},{"date":"2026-08-02","title":"Inform people exposed to emotion recognition or biometric categorisation (EU AI Act Art. 50(3))","jurisdiction":"EU","regime":"eu","instrument":"eu-aia","obligations":["AGC-EU-AIA-50-3"],"kind":"applies","source":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50"},{"date":"2026-08-02","title":"Label deepfakes and AI-written public-interest text (EU AI Act Art. 50(4))","jurisdiction":"EU","regime":"eu","instrument":"eu-aia","obligations":["AGC-EU-AIA-50-4"],"kind":"applies","source":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50"},{"date":"2026-08-02","title":"Mark AI-generated content in a machine-readable way (EU AI Act Art. 50(2) and Art. 111(4))","jurisdiction":"EU","regime":"eu","instrument":"eu-aia","obligations":["AGC-EU-AIA-50-2"],"kind":"applies","source":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50"},{"date":"2026-08-02","title":"Tell people they are interacting with an AI system (EU AI Act Art. 50(1))","jurisdiction":"EU","regime":"eu","instrument":"eu-aia","obligations":["AGC-EU-AIA-50-1"],"kind":"applies","source":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50"},{"date":"2026-08-02","title":"California AI Transparency Act: CATA's provider tool and latent-disclosure requirements became operative","jurisdiction":"US-CA","regime":"us-ca","instrument":"us-ca-cata","obligations":[],"kind":"milestone","source":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB853"},{"date":"2026-08-02","title":"Embed latent provenance disclosures in generated or altered media (California AI Transparency Act BPC § 22757.3)","jurisdiction":"US-CA","regime":"us-ca","instrument":"us-ca-cata","obligations":["AGC-US-CA-CATA-22757-3"],"kind":"applies","source":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB1000"},{"date":"2026-08-02","title":"Provide a free generative-AI disclosure verification tool (California AI Transparency Act BPC § 22757.2)","jurisdiction":"US-CA","regime":"us-ca","instrument":"us-ca-cata","obligations":["AGC-US-CA-CATA-22757-2"],"kind":"applies","source":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB1000"},{"date":"2026-08-11","title":"Colorado ADMT Act: Department of Law filed proposed ADMT and chatbot rules","jurisdiction":"US-CO","regime":"us-co","instrument":"co-sb26-189","obligations":[],"kind":"milestone","source":"https://coag.gov/ai/"},{"date":"2026-08-12","title":"Colorado Chatbot Safety Act: HB 26-1263 took effect as an Act","jurisdiction":"US-CO","regime":"us-co","instrument":"co-hb26-1263","obligations":[],"kind":"milestone","source":"https://leg.colorado.gov/laws/session-laws/HB26-1263/208/download"},{"date":"2026-08-15","title":"High-Risk AI List: High-risk list and criteria take effect","jurisdiction":"VN","regime":"vn","instrument":"vn-high-risk-list-33","obligations":[],"kind":"milestone","source":"https://congbaocdn.chinhphu.vn/180507251028987904/2026/7/14/469951-1784024086_v1_1784024564_signed.pdf"},{"date":"2026-08-20","title":"AI Basic Act Enforcement Decree: Current consolidated version also reflects Presidential Decree No. 36580, a consequential amendment","jurisdiction":"KR","regime":"kr","instrument":"kr-aibad","obligations":[],"kind":"milestone","source":"https://www.law.go.kr/LSW/lsInfoP.do?lsiSeq=288781"},{"date":"2026-09-01","title":"Attorney General's deadline to post the consumer complaint mechanism","jurisdiction":"US-TX","regime":"us-tx","instrument":"us-tx-traiga","obligations":[],"kind":"deadline","source":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.HTM"},{"date":"2026-09-10","title":"OSRAA: MDDI confirmed inauthentic material abuse would be progressively implemented and no commencement date had been announced","jurisdiction":"SG","regime":"sg","instrument":"sg-osraa","obligations":[],"kind":"milestone","source":"https://www.mddi.gov.sg/newsroom/mddi-response-to-pq-on-protecting-against-unauthorised-ai-generated-likeness-in-advertisements-and-operationalising-online-safety-commission-mandate-over-inauthentic-material-abuse/"},{"date":"2026-09-29","title":"EO 14434: Executive order signed; directs terminology changes in non-statutory executive-branch communications and documents","jurisdiction":"US","regime":"us","instrument":"us-eo14434","obligations":[],"kind":"milestone","source":"https://www.whitehouse.gov/presidential-actions/2026/09/inaugurating-the-era-of-super-intelligence/"},{"date":"2026-09-29","title":"Use the prescribed term in future federal AI communications (EO 14434 §2(a)-(b))","jurisdiction":"US","regime":"us","instrument":"us-eo14434","obligations":["AGC-US-EO14434-2A"],"kind":"applies","source":"https://www.whitehouse.gov/presidential-actions/2026/09/inaugurating-the-era-of-super-intelligence/"},{"date":"2026-09-30","title":"California AI Transparency Act: SB 1000 immediately amended CATA","jurisdiction":"US-CA","regime":"us-ca","instrument":"us-ca-cata","obligations":[],"kind":"milestone","source":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB1000"},{"date":"2026-10-06","title":"Colorado ADMT Act: Interim draft rules were released","jurisdiction":"US-CO","regime":"us-co","instrument":"co-sb26-189","obligations":[],"kind":"milestone","source":"https://coag.gov/ai/"},{"date":"2026-10-26","title":"Colorado ADMT Act: Formal rulemaking hearing on proposed 4 CCR 904-6 rules","jurisdiction":"US-CO","regime":"us-co","instrument":"co-sb26-189","obligations":[],"kind":"milestone","source":"https://coag.gov/app/uploads/2026/08/2026.08.11-Notice-of-Hearing.docx"},{"date":"2026-10-28","title":"OFCOM AI Code of Conduct guide: OFCOM AI Code of Conduct guide reported as a toolkit for voluntary guidelines","jurisdiction":"CH","regime":"ch","instrument":"ch-aicg","obligations":[],"kind":"milestone","source":"https://www.bakom.admin.ch/en/newnsb/s2TQiUUjrA5D"},{"date":"2026-10-28","title":"Proposed Swiss AI legislation: Federal Council update says consultation is scheduled for spring 2027; proposed rules are to address transparency, data protection, non-discrimination, supervision and risk assessment","jurisdiction":"CH","regime":"ch","instrument":"ch-ai-proposal","obligations":[],"kind":"milestone","source":"https://www.bakom.admin.ch/en/newnsb/s2TQiUUjrA5D"},{"date":"2026-10-28","title":"Use OFCOM's voluntary AI Code of Conduct toolkit if adopting self-regulation (OFCOM Guide on an AI Code of Conduct, voluntary toolkit)","jurisdiction":"CH","regime":"ch","instrument":"ch-aicg","obligations":["AGC-CH-AICG-VOL"],"kind":"applies","source":"https://www.bakom.admin.ch/en/newnsb/s2TQiUUjrA5D"},{"date":"2026-10-28","title":"Council of Europe AI Framework Convention: Treaty Office reports Bosnia and Herzegovina's ratification; this is the second ratification recorded","jurisdiction":"COE","regime":"coe","instrument":"coe-ai-convention","obligations":[],"kind":"milestone","source":"https://www.coe.int/en/web/conventions/"},{"date":"2026-10-28","title":"Unsafe AI Companion Features for Minors: Signed as Chapter 368 of the Laws of 2026","jurisdiction":"US-NY","regime":"us-ny","instrument":"ny-companion-minors","obligations":[],"kind":"milestone","source":"https://www.nysenate.gov/legislation/bills/2025/S9051/amendment/B"},{"date":"2026-10-31","title":"State agencies submit data at least 60 days before the December 30 AI-inventory publication","jurisdiction":"US-NY","regime":"us-ny","instrument":"ny-loading","obligations":["AGC-US-NY-LOAD-103E"],"kind":"deadline","source":"https://www.nysenate.gov/legislation/laws/STT/103-E"},{"date":"2026-11-13","title":"DPDP Consent Manager phase begins (Act sections 6(9), 27(1)(d) and Rule 4)","jurisdiction":"IN","regime":"in","instrument":"in-dpdp-rules","obligations":[],"kind":"deadline","source":"https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf"},{"date":"2026-12-02","title":"Bans on AI-generated non-consensual intimate content and CSAM apply","jurisdiction":"EU","regime":"eu","instrument":"eu-aia","obligations":["AGC-EU-AIA-5-1-BA"],"kind":"deadline","source":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-113"},{"date":"2026-12-02","title":"Mark outputs of generative systems placed on the market before 2 Aug 2026","jurisdiction":"EU","regime":"eu","instrument":"eu-aia","obligations":["AGC-EU-AIA-50-2"],"kind":"deadline","source":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-111"},{"date":"2026-12-30","title":"Annual State AI inventory and State-agency AEDT list publication","jurisdiction":"US-NY","regime":"us-ny","instrument":"ny-loading","obligations":["AGC-US-NY-LOAD-103E","AGC-US-NY-LOAD-402"],"kind":"deadline","source":"https://www.nysenate.gov/legislation/laws/STT/103-E"},{"date":"2026-12-31","title":"Federal bodies assess whether logging is needed for eligible legacy automated processing under DPO Art. 46(1)","jurisdiction":"CH","regime":"ch","instrument":"ch-dpo","obligations":["AGC-CH-DPO-46-1"],"kind":"deadline","source":"https://www.fedlex.admin.ch/eli/cc/2022/568/en"},{"date":"2026-12-31","title":"Secretary of State progress report on regulations under Online Safety Act section 216A, unless a draft instrument is laid earlier","jurisdiction":"GB","regime":"gb","instrument":"gb-osa","obligations":[],"kind":"deadline","source":"https://www.legislation.gov.uk/ukpga/2026/20/section/249"},{"date":"2026-12-31","title":"Annual AIVIA demographic report due for the 12-month period ending November 30","jurisdiction":"US-IL","regime":"us-il","instrument":"il-aivia","obligations":["AGC-US-IL-AIVIA-42-20"],"kind":"deadline","source":"https://www.ilga.gov/Legislation/ILCS/Articles?ActID=4015&ChapterID=68&Print=True"},{"date":"2027-01-01","title":"DoD must designate functional leads for AI applications under NDAA §1533","jurisdiction":"US","regime":"us","instrument":"us-ndaa26","obligations":["AGC-US-NDAA11960-1533"],"kind":"deadline","source":"https://www.govinfo.gov/content/pkg/PLAW-119publ60/html/PLAW-119publ60.htm"},{"date":"2027-01-01","title":"CATA large-online-platform and GenAI-hosting duties begin","jurisdiction":"US-CA","regime":"us-ca","instrument":"us-ca-cata","obligations":["AGC-US-CA-CATA-22757-3-1-3-2"],"kind":"deadline","source":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB853"},{"date":"2027-01-01","title":"CCPA covered ADMT notice","jurisdiction":"US-CA","regime":"us-ca","instrument":"us-ca-cppa-admt","obligations":["AGC-US-CA-CCPA-7200-7222"],"kind":"deadline","source":"https://cppa.ca.gov/announcements/2025/20250923.html"},{"date":"2027-01-01","title":"SB 1119 age-assurance requirements begin and SB 243 § 22602(c) minor-specific requirements are repealed","jurisdiction":"US-CA","regime":"us-ca","instrument":"us-ca-sb1119","obligations":["AGC-US-CA-SB1119-21811-13","AGC-US-CA-SB243-22602"],"kind":"deadline","source":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB1119"},{"date":"2027-01-01","title":"Main chatbot operator duties begin","jurisdiction":"US-CO","regime":"us-co","instrument":"co-hb26-1263","obligations":["AGC-US-CO-HB261263-1708-2","AGC-US-CO-HB261263-1708-3","AGC-US-CO-HB261263-1708-4-6","AGC-US-CO-HB261263-1708-5"],"kind":"deadline","source":"https://leg.colorado.gov/laws/session-laws/HB26-1263/208/download"},{"date":"2027-01-01","title":"SB 26-189 successor duties apply and Attorney General rules on disclosures and consumer rights are due","jurisdiction":"US-CO","regime":"us-co","instrument":"co-sb26-189","obligations":["AGC-US-CO-SB26189-1702","AGC-US-CO-SB26189-1702-RECORDS","AGC-US-CO-SB26189-1704-1","AGC-US-CO-SB26189-1704-3","AGC-US-CO-SB26189-1705"],"kind":"deadline","source":"https://leg.colorado.gov/laws/session-laws/SB26-189/131/download"},{"date":"2027-01-01","title":"Artificial Intelligence Safety Measures Act takes effect","jurisdiction":"US-IL","regime":"us-il","instrument":"il-frontier-ai","obligations":["AGC-US-IL-AIMSA-10-C","AGC-US-IL-AIMSA-10-E","AGC-US-IL-AIMSA-15-C","AGC-US-IL-AIMSA-18","AGC-US-IL-AIMSA-20"],"kind":"deadline","source":"https://www.ilga.gov/ftp/Public%20Acts/104/104-0538.htm"},{"date":"2027-01-01","title":"Amended RAISE Act and Article 48 scheduled effective date under available statutory text","jurisdiction":"US-NY","regime":"us-ny","instrument":"ny-raise","obligations":["AGC-US-NY-RAISE-1421-1","AGC-US-NY-RAISE-1421-3","AGC-US-NY-RAISE-1422-2","AGC-US-NY-RAISE-1422-3","AGC-US-NY-RAISE-1428","AGC-US-NY-GBL48-1801","AGC-US-NY-GBL48-1804"],"kind":"deadline","source":"https://legislation.nysenate.gov/pdf/bills/2025/S8828"},{"date":"2027-01-22","title":"Earliest date implied by MSIT's minimum one-year enforcement grace; no fixed end date announced as of 2026-11-04","jurisdiction":"KR","regime":"kr","instrument":"kr-aiba","obligations":["AGC-KR-AIBA-31-1","AGC-KR-AIBA-31-2","AGC-KR-AIBA-31-3","AGC-KR-AIBA-32","AGC-KR-AIBA-34","AGC-KR-AIBAD-27-1-2","AGC-KR-AIBA-36-1"],"kind":"deadline","source":"https://www.msit.go.kr/eng/bbs/view.do?sCode=eng&mPid=2&mId=4&bbsSeqNo=42&nttSeqNo=1214"},{"date":"2027-03-01","title":"Complete transition compliance for pre-existing AI systems outside healthcare, education and finance, and qualifying legacy systems under Decision 33","jurisdiction":"VN","regime":"vn","instrument":"vn-ai-law","obligations":["AGC-VN-AILAW-9-10","AGC-VN-AILAW-13","AGC-VN-AILAW-14","AGC-VN-AILAW-14-6"],"kind":"deadline","source":"https://en.baochinhphu.vn/viet-nams-law-on-artificial-intelligence-111260715113551787.htm"},{"date":"2027-05-13","title":"Most substantive DPDP Act and Rules duties apply","jurisdiction":"IN","regime":"in","instrument":"in-dpdp-rules","obligations":["AGC-IN-DPDPA-4-6","AGC-IN-DPDPA-8","AGC-IN-DPR-13"],"kind":"deadline","source":"https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf"},{"date":"2027-06-01","title":"DoD must complete the AI assessment framework and governance structure under NDAA §1533","jurisdiction":"US","regime":"us","instrument":"us-ndaa26","obligations":["AGC-US-NDAA11960-1533"],"kind":"deadline","source":"https://www.govinfo.gov/content/pkg/PLAW-119publ60/html/PLAW-119publ60.htm"},{"date":"2027-07-01","title":"First SB 243 annual companion-chatbot safety report is due","jurisdiction":"US-CA","regime":"us-ca","instrument":"us-ca-sb243","obligations":["AGC-US-CA-SB243-22603"],"kind":"deadline","source":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB243"},{"date":"2027-07-01","title":"SB 1119 child-safety risk assessment and mitigation requirements begin","jurisdiction":"US-CA","regime":"us-ca","instrument":"us-ca-sb1119","obligations":["AGC-US-CA-SB1119-21811-13"],"kind":"deadline","source":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB1119"},{"date":"2027-07-01","title":"SB 947 workplace ADS duties become operative","jurisdiction":"US-CA","regime":"us-ca","instrument":"us-ca-sb947","obligations":["AGC-US-CA-SB947-1522-1524"],"kind":"deadline","source":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB947"},{"date":"2027-07-01","title":"First annual chatbot safety report to the Attorney General","jurisdiction":"US-CO","regime":"us-co","instrument":"co-hb26-1263","obligations":["AGC-US-CO-HB261263-1708-4-6"],"kind":"deadline","source":"https://leg.colorado.gov/laws/session-laws/HB26-1263/208/download"},{"date":"2027-08-02","title":"Legacy GPAI models (placed before 2 Aug 2025) must comply","jurisdiction":"EU","regime":"eu","instrument":"eu-aia","obligations":["AGC-EU-AIA-53","AGC-EU-AIA-55"],"kind":"deadline","source":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-111"},{"date":"2027-09-01","title":"Complete transition compliance for pre-existing AI systems in healthcare, education and finance","jurisdiction":"VN","regime":"vn","instrument":"vn-ai-law","obligations":["AGC-VN-AILAW-9-10","AGC-VN-AILAW-13","AGC-VN-AILAW-14","AGC-VN-AILAW-14-6"],"kind":"deadline","source":"https://en.baochinhphu.vn/viet-nams-law-on-artificial-intelligence-111260715113551787.htm"},{"date":"2027-12-02","title":"Annex III high-risk rules apply","jurisdiction":"EU","regime":"eu","instrument":"eu-aia","obligations":["AGC-EU-AIA-6","AGC-EU-AIA-9","AGC-EU-AIA-17","AGC-EU-AIA-49","AGC-EU-AIA-72","AGC-EU-AIA-26","AGC-EU-AIA-27","AGC-EU-AIA-86"],"kind":"deadline","source":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-113"},{"date":"2027-12-11","title":"OMB M-26-04: M-26-04 sunsets unless OMB extends it","jurisdiction":"US","regime":"us","instrument":"us-omb-m2604","obligations":[],"kind":"milestone","source":"https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles.pdf"},{"date":"2027-12-30","title":"First annual AEDT disclosure publication for covered public entities added by Chapter 86","jurisdiction":"US-NY","regime":"us-ny","instrument":"ny-loading","obligations":["AGC-US-NY-LOAD-402A"],"kind":"deadline","source":"https://www.nysenate.gov/legislation/laws/STT/402-A"},{"date":"2027-12-31","title":"CPPA ADMT and risk assessments: Last date to complete risk assessments for certain covered processing already underway before 2026 and continuing thereafter","jurisdiction":"US-CA","regime":"us-ca","instrument":"us-ca-cppa-admt","obligations":[],"kind":"milestone","source":"https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf"},{"date":"2028-01-01","title":"DoD must complete assessments of major AI systems under NDAA §1533","jurisdiction":"US","regime":"us","instrument":"us-ndaa26","obligations":["AGC-US-NDAA11960-1533"],"kind":"deadline","source":"https://www.govinfo.gov/content/pkg/PLAW-119publ60/html/PLAW-119publ60.htm"},{"date":"2028-01-01","title":"CATA capture-device provenance duties begin","jurisdiction":"US-CA","regime":"us-ca","instrument":"us-ca-cata","obligations":["AGC-US-CA-CATA-22757-3-3"],"kind":"deadline","source":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB853"},{"date":"2028-01-01","title":"Large-frontier-developer framework and annual independent-audit phase-in begins","jurisdiction":"US-IL","regime":"us-il","instrument":"il-frontier-ai","obligations":["AGC-US-IL-AIMSA-10-AB-D"],"kind":"deadline","source":"https://www.ilga.gov/ftp/Public%20Acts/104/104-0538.htm"},{"date":"2028-01-01","title":"RAISE Act: First annual public frontier-safety report by the Office is due; this is an agency duty","jurisdiction":"US-NY","regime":"us-ny","instrument":"ny-raise","obligations":[],"kind":"milestone","source":"https://legislation.nysenate.gov/pdf/bills/2025/S8828"},{"date":"2028-04-01","title":"First CPPA submission and attestation for 2026–2027 risk assessments","jurisdiction":"US-CA","regime":"us-ca","instrument":"us-ca-cppa-admt","obligations":["AGC-US-CA-CCPA-7150"],"kind":"deadline","source":"https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf"},{"date":"2028-07-01","title":"LOADinG Act: Chapter 86 framework expires and is deemed repealed","jurisdiction":"US-NY","regime":"us-ny","instrument":"ny-loading","obligations":[],"kind":"milestone","source":"https://www.nysenate.gov/legislation/bills/2025/S8831"},{"date":"2028-08-02","title":"Annex I (product) high-risk rules apply","jurisdiction":"EU","regime":"eu","instrument":"eu-aia","obligations":["AGC-EU-AIA-6","AGC-EU-AIA-9","AGC-EU-AIA-17"],"kind":"deadline","source":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-113"},{"date":"2029-01-01","title":"Initial child-safety audit deadline for covered operators","jurisdiction":"US-CA","regime":"us-ca","instrument":"us-ca-sb1119","obligations":["AGC-US-CA-SB1119-21811-13"],"kind":"deadline","source":"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB1119"},{"date":"2029-12-31","title":"Federal bodies implement logging for eligible legacy processing if the Art. 46(1) assessment finds it necessary","jurisdiction":"CH","regime":"ch","instrument":"ch-dpo","obligations":["AGC-CH-DPO-46-1"],"kind":"deadline","source":"https://www.fedlex.admin.ch/eli/cc/2022/568/en"},{"date":"2030-01-01","title":"Colorado ADMT Act: SB 26-189's 60-day cure provision is repealed effective this date","jurisdiction":"US-CO","regime":"us-co","instrument":"co-sb26-189","obligations":[],"kind":"milestone","source":"https://leg.colorado.gov/laws/session-laws/SB26-189/131/download"},{"date":"2030-08-02","title":"EU AI Act: Providers and deployers of high-risk systems used by public authorities and already on the market must comply","jurisdiction":"EU","regime":"eu","instrument":"eu-aia","obligations":[],"kind":"milestone","source":"https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-111"}]}