LexLint.ioBeta

Know the law your code answers to.

The requirement register

About this documentUpdated ShowHide

Sean McDermott, Co-Founder and CEO, UnGovr

Written by Sean McDermott (with AI assistance) using the LexLint law library, which supplied every legal instrument, status and date on these pages.

Every law named here links to its summary page on lexlint.io, translated to English (if needed) and restructured to a standard format for human and code use. Every case links to the court's or the regulator's own record where one could be reached.

© 2026 UnGovr, publishing as LexLint. The text and the figures are licensed under Creative Commons Attribution-ShareAlike 4.0: share and adapt them, including commercially, with credit to LexLint (UnGovr) and under the same license. Please contact LexLint at hello@ungovr.org to discuss other terms. Logos and wordmarks belong to their owners.

Law library as of .

Legal information, not legal advice. This document describes the law as written and dated; it does not apply it to any system. The notice in the footer says what that means.

Every requirement line the LexLint law library carries for AI, privacy, scraping and cybersecurity law, typed and dated, with the class of duty it belongs to, the party it binds, the territory it reaches through and what a runtime control can do about it. Tabulated by obligation class, with a sample offered as a file.

1What this is

The LexLint law library records each instrument, a provision-level record of a statute or regulation with its citation, source, status and date, together with the requirement lines it imposes: short, atomic statements of what the provision asks, kept in the modal language the text uses. On the law library held 15,417 such lines across the four topics that carry them, AI (2,453), privacy (6,808), scraping (1,418), cybersecurity (4,738), of which 13,724 belong to an instrument in force on that date. This document is the register of those lines: what each one asks, in which class of duty, of which party, reaching through which territory, and what a control on the request path can do about it. It is a reference, read by class; section 6 offers a sample of it as a file.

Every line carries the same facts. Its type and the modal language it uses. The party it is addressed to, read off its wording. The obligation classes of its instrument, from a closed list of twenty, which is the axis this register is sorted on. The party whose position triggers scope, restated as one of The 6 parties, and the territorial hook the duty reaches through, which is what Where the parties are builds on. The runtime tier, which says whether a control on the request path can prevent the conduct, detect it, evidence it, or never sees it, and which Legal constraints at the gateway and What you must constrain read by layer. And the jurisdiction, the instrument, its source, its lifecycle band and the date it was read.

The same lines sorted under the sixteen extraction themes of the Agentic AI Foundation's governance working group, with the crosswalk from these classes to those themes, are a separate page outside this handbook: the sixteen themes and the law. This register is keyed on the law library's classes because a class is recorded on the instrument by the research, while a theme is a rule applied to the wording afterwards.

2Method

Source. 15,417 requirement lines drawn from the law library on . Of those, 13,724 belong to an instrument in force on that date; the rest are enacted and not yet in force, or proposed, and are kept in the register with their lifecycle band so a reader can see what is coming.

Obligation class. Recorded on the instrument by the research, one or more per instrument from a closed list of twenty; a line takes its instrument's classes, so a line can sit in more than one class where its instrument does. 12,822 of the 15,417 lines belong to an instrument with at least one class. The 2,595 that do not are counted on their own row at the end of section 3 rather than folded into a class, and the file leaves their class cell empty.

Type. Derived from the line's wording and, where one exists, from an independent hand classification of the same line (obligation, prohibition, scope condition, remedy note, permission): a mandatory obligation, a conditional one, a prohibition, a definition, a consequence (a penalty or remedy stated as a requirement line), a permission or exemption, or guidance. The modal language column preserves the verbs the line uses.

Applicable entity. Read off the line's own wording where it names a role (provider, deployer, controller, processor, platform, employer, manufacturer). Where it names none, the entity is the OPERATOR, the party running the application, which is whom the law in the law library binds by default.

Territorial hook. Derived from the instrument's topic and law family under a stated rule: a privacy duty reaches through the data subject's residence and the OPERATOR'S establishment, a transfer duty through the destination, a scraping duty through the COUNTERPARTY'S location, an AI transparency duty through where the output is used and the market it was placed on, a security duty through the OPERATOR'S establishment or the placing on the market. The column is a rule applied to every line, and it is the first thing a reviewer should correct. Where the parties are prints the rule in full.

Party whose position triggers scope, and runtime tier. Both come from a separate hand classification of 3,503 of the 15,417 lines, made for a study of what an AGENT gateway can enforce. The party is the one of six (OPERATOR, principal, provider, COUNTERPARTY, affected person, data subject) whose location or status the duty turns on; the tier says whether a control on the request path can prevent the conduct, detect it, evidence it, or never sees it. Only a line that states a duty, an obligation or a prohibition, has a party and a tier. A line that states a scope condition, a consequence or a permission was read and carries neither, and both columns say not a duty (1,126 lines). A line the classification has not reached says not yet classified (10,739), and a line reworded since it was read says so (1,175). The file carries the same words in a column of its own, so the three can be filtered apart. The column after the party names that party's group, one of The 6 parties, by the mapping in section 6.

Line identifier. Every line carries an identifier of the form topic:instrument-code:position, which is the topic it was researched under, the instrument's code on lexlint.io, and the line's position in that instrument's requirement list. Rewording the text at a position leaves the identifier in place; the classification above goes stale and is marked reworded instead of moving under a new one. What it does not survive is an insertion or a reorder inside the same instrument's requirement list, which shifts every later position onto a different sentence with no signal that it happened. Cite an identifier together with the requirement text it names, never alone, and note the date in this page's byline: that pairing holds even where the identifier by itself would not.

3The register by class

One row per obligation class, largest first. "Lines" is every requirement line whose instrument records the class, in force or not; "in force" is the subset whose instrument binds today; "instruments" and "jurisdictions" count the distinct sources those lines come from. The last column says which of the four topics the lines were researched under, largest first, which is a fair proxy for which body of law a class really lives in.

ClassLinesIn forceInstrumentsJurisdictionsWhere the lines come from
Secure the system and the data in it 5,136 4,826 965 254 cybersecurity 3,664 · privacy 1,361 · AI 75 · scraping 36
Govern the system: policies, roles, assessments 4,309 3,739 845 227 cybersecurity 1,747 · privacy 1,639 · AI 920 · scraping 3
Report to a regulator 3,078 2,754 658 224 cybersecurity 1,858 · privacy 905 · AI 313 · scraping 2
Disclose the use of AI 2,825 2,413 540 187 privacy 2,022 · AI 641 · cybersecurity 155 · scraping 7
Get consent first 2,386 2,188 465 173 privacy 2,220 · AI 156 · scraping 10
Do not do the named thing 2,327 2,048 636 209 privacy 1,346 · AI 794 · scraping 158 · cybersecurity 29
Honor the person's rights over their data 1,776 1,572 374 165 privacy 1,715 · AI 56 · cybersecurity 5
Keep records for a set time 1,232 1,125 209 118 privacy 1,020 · AI 137 · cybersecurity 73 · scraping 2
Do not get in without authorization 831 797 239 144 scraping 442 · privacy 384 · AI 5
Tell somebody when there is a breach 657 596 153 120 privacy 628 · AI 24 · cybersecurity 5
Hold a license or registration 610 525 120 73 privacy 392 · cybersecurity 89 · AI 77 · scraping 52
Assess the impact on personal data first 510 401 90 59 privacy 331 · AI 164 · cybersecurity 15
Conditions on sending data abroad 414 376 135 106 privacy 401 · cybersecurity 9 · scraping 4
Limits on biometric use 390 338 97 80 privacy 335 · AI 47 · scraping 8
Label generated content 236 151 69 48 AI 236
Put the terms in the contract 205 198 49 33 privacy 93 · scraping 89 · AI 23
Check the user's age 128 115 31 31 privacy 128
Respect text and data mining opt-outs 68 66 30 28 scraping 58 · AI 10
Meet a design code 64 25 12 11 AI 38 · privacy 26
Credit or license the publisher's content 35 35 15 14 scraping 32 · AI 3
No class recorded on the instrument 2,595 2,264 1,145 199 privacy 1,369 · scraping 665 · AI 425 · cybersecurity 136

The last row is a gap in the law library, not a class: the research records an instrument's obligation classes as one attribute among several, and on the date above it had not reached every instrument. A line on that row still carries every other column, and the file lists it with an empty class cell so it can be found.

4What the distribution says

Four classes carry most of the register: secure the system and the data in it (5,136 lines), govern the system: policies, roles, assessments (4,309 lines), report to a regulator (3,078 lines) and disclose the use of AI (2,825 lines). That is the center of gravity of software law as the law library holds it: an operator is told to secure what it holds, to govern the system with named roles and assessments, to tell people what it is doing, and to have consent before it does it. The smallest classes are the newest or the narrowest duties, a design code for children's services or a credit to a publisher, and their size says how few statutes yet impose them, not how little they matter to a system that falls under one.

The second table reads the classes against what a control on the request path can do about them. The four tier columns carry the tiers' short names, enforceable for enforceable at a runtime control, detectable for detectable at a runtime control, evidenced for evidenced by the runtime's record and out of path for outside any runtime path; what each tier means is Legal constraints at the gateway. Only a classified duty has a tier, so the columns after the four count the lines that were read and state no duty, the lines the classification has not reached, and the lines reworded since it read them. A zero is set light, so the cells that hold lines stand out.

ClassEnforceableDetectableEvidencedOut of pathNot a dutyNot yet classifiedReworded
Secure the system and the data in it 627105320 230 3,864 548
Govern the system: policies, roles, assessments 31168192 89 3,470 503
Report to a regulator 11711659 72 2,669 144
Disclose the use of AI 517913112 59 2,295 216
Get consent first 6118269 20 1,834 382
Do not do the named thing 68192148 186 1,799 33
Honor the person's rights over their data 329467 14 1,622 28
Keep records for a set time 203169 29 858 252
Do not get in without authorization 22612019 96 442 36
Tell somebody when there is a breach 402910 17 567 30
Hold a license or registration 400127 27 371 144
Assess the impact on personal data first 63134 6 313 147
Conditions on sending data abroad 141221 2 362 12
Limits on biometric use 173315 13 325 14
Label generated content 17128 43 54 57
Put the terms in the contract 1103 1 166 33
Check the user's age 1001 0 125 1
Respect text and data mining opt-outs 18004 28 11 7
Meet a design code 2512 0 34 20
Credit or license the publisher's content 11003 11 6 4

A class whose lines sit mostly outside any runtime path is met by a decision or a record rather than a control: a license held, an assessment made, a retention period kept. A class whose lines are enforceable at a control is one a gateway can refuse on behalf of the OPERATOR. What you must constrain reads the same tiers by the layer a control sits on, and What you must be able to show by the record that meets the duty instead.

5The twenty classes

Each class below gives its counts and holds a sample of up to fourteen lines in force, drawn to span jurisdictions rather than to rank them, folded away until opened. The requirement is stated first, as the law library records it; under it, the facts the columns hold, then the jurisdiction, the instrument and its date, and the line identifier. Every line in every class is on the summary page of its instrument, and section 6 offers a sample of the register as a file.

Secure the system and the data in it

5,136 lines 4,826 in force 965 provisions 254 jurisdictions by type: mandatory obligation 2,988, conditional obligation 1,485, prohibition 298, definition 224, recommendation/guidance 63, consequence (penalty or remedy) 61, permission or exemption 17

Sample requirement lines Show 13 of the 4,826 lines in forceHide the sample

What follows is a sample of 13 requirement lines from the law library, chosen to span jurisdictions.

European Union

This Directive is addressed to the Member States (Article 97), which had to adopt and publish the measures necessary to comply with it by and apply them from (Article 93(1), as amended by Directive (EU) 2016/1034, Article 1, point (7)), so an investment firm meets Article 17 through each Member State's national law; Delegated Regulation (EU) 2017/589 is binding in its entirety and directly applicable in all Member States and applies from (Article 29).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), Directive 2014/65/EU, Article 17, supplemented by Commission Delegated Regulation (EU) 2017/589 Source as of ai:eu-2014-65-eu-17-supplemented-by-commission-dele:0

California

If you operate a site, service or application that you know is used primarily for K-12 school purposes and was designed and marketed for them, do not knowingly engage in targeted advertising on it, and do not target advertising elsewhere using information you acquired through its use (section 22584(b)(1)).
Type Conditional Obligation Modal do not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
K-12 Pupil Online Personal Information Protection Act (KOPIPA), Cal. Bus. and Prof. Code sections 22584 and 22585 Source as of privacy:us-ca-cal-bus-prof-sections-22584-22585:0

Colorado

Treat an opt-out request received through a Universal Opt-Out Mechanism as a valid request to opt out of targeted advertising, the sale of personal data, or both, and be capable of recognizing each mechanism on the Department of Law's public list once you have had at least six months' notice of it (Rule 5.08).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject; establishment of the operator Runtime not yet classified
Colorado Privacy Act Rules (Attorney General), 4 CCR 904-3 Source as of privacy:us-co-4-ccr-904-3:0

Texas

If you require an individual to disclose a social security number to obtain goods or services from you or to enter into a business transaction with you, first adopt a privacy policy, make it available to the individual and maintain under it the confidentiality and security of the number disclosed (Tex. Bus. & Com. Code sec. 501.052(a)).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the user the service collects from Runtime not yet classified
Texas privacy policy required before requiring disclosure of a Social Security number, Tex. Bus. & Com. Code secs. 501.052, 501.053 Source as of privacy:us-tx-tex-bus-com-secs-501-052-501-053:0

South Korea

You may process pseudonymized information of people in Korea without their consent for statistics, scientific research, archiving in the public interest and similar purposes, and when you give it to a third party for those purposes you must not include any information that could be used to identify a specific individual (Article 28-2).
Type Conditional Obligation Modal may, must not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject; establishment of the operator Runtime not yet classified
Personal Information Protection Act, pseudonymized information, Act No. 10465 (as amended by Act No. 21445, 2026), Arts. 28-2 to 28-5 and 28-7; Arts. 64-2 and 71 (penalties) Source as of privacy:kr-no-10465-as-amended-by-no-21445-2026-28-2-28:0

United Kingdom

It reaches you if you are a firm to which the common platform requirements apply, which is every firm apart from an insurer, a UK ISPV, a managing agent and the Society unless a specific rule provides otherwise (SYSC 1 Annex 1 2.1R): have robust governance arrangements, which include a clear organizational structure with well defined, transparent and consistent lines of responsibility, effective processes to identify, manage, monitor and report the risks you are or might be exposed to, and internal control mechanisms, including sound administrative and accounting procedures and effective control and safeguard arrangements for information processing systems (SYSC 4.1.1R(1)).
Type Conditional Obligation Modal unless Binds, by its wording Platform or intermediary Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
General organizational requirements: governance arrangements, internal controls, information security and business continuity, FCA Handbook, SYSC 4.1 Source as of ai:gb-fca-handbook-sysc-4-1:0

Brazil

Establish a lawful basis under article 7 before processing personal data, including data the person has made public.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
Lei Geral de Proteção de Dados Pessoais (LGPD), Lei nº 13.709, de 14 de agosto de 2018 (LGPD), arts. 1º-10, 15-16, 23-32, 37-41, 46-47, 49-51 (general regime, principles, lawful basis, public-sector processing, agents and governance) Source as of privacy:br-lei-n-13-709-de-14-de-agosto-de-2018-lgpd:0

India

This binds a service provider, intermediary, data centre, body corporate, or Government organisation, the Information Technology Act's own general terms for essentially any commercial or professional actor operating a computer resource in India, not a licensed or sector-specific status; a company distributing software or operating a mobile app in India falls within this reach without needing a specific regulatory registration.
Type Definition Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not a duty Hook Placing on the market; establishment of the manufacturer Runtime not a duty
CERT-In Cyber Security Directions, Incident Reporting, Logging and Time Synchronisation, Directions under section 70B(6) of the Information Technology Act, 2000, No. 20(3)/2022-CERT-In (Indian Computer Emergency Response Team, Ministry of Electronics and Information Technology, ) Source as of security:in-directions-under-70b-6-information-technology:0

Vietnam

This binds a credit institution, a branch of a foreign bank, an intermediary payment service provider, a credit information company, the National Payment Corporation of Vietnam, the Vietnam Asset Management Company, the National Banknote Printing Plant and Deposit Insurance of Vietnam that has established and uses an information system (reached by declaring that you provide financial services) (article 1(2)).
Type Mandatory Obligation Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not yet classified Hook Establishment of the operator (entity in scope) Runtime not yet classified
Circular on Information System Security in Banking Operations, Classification and Security Assessment, Circular No. 09/2020/TT-NHNN (security of information systems in banking operations), arts. 3 and 42 Source as of security:vn-circular-no-09-2020-tt-nhnn-security-inform-2:0

Germany

If you are a trader supplying a digital product, meaning digital content or a digital service such as software or an app, to a consumer under a contract, Section 327f binds you.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Placing on the market Runtime not yet classified
Bürgerliches Gesetzbuch (BGB), Section 327f Updates, Including Security Updates, for Digital Products, BGB § 327f, Aktualisierungen Source as of security:de-bgb-327f-aktualisierungen:0

Ireland

Establish and document a lawful basis under GDPR Article 6 before processing any personal data of a person in Ireland.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
Data Protection Act 2018, Data Protection Act 2018 (No. 7 of 2018) Source as of privacy:ie-data-protection-2018-no-7-2018:0

Italy

Adopt the technical safety measures provided for the design, training, production and placing on the market of high-risk AI systems, suited to prevent malfunctions or alterations of how the systems work, and adopt human-oversight measures, where omitting them would endanger life or public or individual safety, or the security of the State (Codice Penale art. 437-bis, first paragraph).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Codice Penale, art. 437-bis, inserted by D.Lgs. 9 settembre 2026, n. 160, art. 12 Source as of ai:it-codice-penale-437-bis-inserted-by-d-lgs-9-set:0

Spain

If you carry out biomedical research in Spain, keep the personal data and biological samples it produces confidential, disclose personal data to third parties outside the care or research activity only with the person's express written consent, and do not use health data for purposes other than those consented to (Ley 14/2007, Article 5(1) to (3)).
Type Conditional Obligation Modal do not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Ley 14/2007, Confidentiality, Consent and Secrecy Rules for Personal Health Data in Biomedical Research in Spain, Ley 14/2007, art. 5 Source as of privacy:es-ley-14-2007-5:0

4,813 more lines in force in this class, and 5,136 lines in all, are in the law library, each on the summary page of its instrument.

Govern the system: policies, roles, assessments

4,309 lines 3,739 in force 845 provisions 227 jurisdictions by type: mandatory obligation 2,497, conditional obligation 1,386, prohibition 204, definition 115, recommendation/guidance 63, consequence (penalty or remedy) 29, permission or exemption 15

Sample requirement lines Show 13 of the 3,739 lines in forceHide the sample

What follows is a sample of 13 requirement lines from the law library, chosen to span jurisdictions.

European Union

This Directive is addressed to the Member States (Article 165), which had to adopt and publish the measures necessary to comply with it by and apply them from (Article 162(1)), so an institution meets these rules through each Member State's national law; Article 74(1) in the wording that Directive (EU) 2024/1619 gave it applies from (Article 2(1) of that Directive).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Capital Requirements Directive, Robust Governance Arrangements of Institutions (Article 74(1)), Directive 2013/36/EU, Article 74(1) Source as of ai:eu-2013-36-eu-74-1:0

California

If you are a large frontier developer (a frontier developer whose group had annual gross revenues over $500,000,000 in the prior calendar year), write, implement and publish on your website a frontier AI framework describing how you define and assess catastrophic-risk thresholds for your frontier models and apply mitigations, and review that framework at least once a year
Type Conditional Obligation Modal imperative Binds, by its wording Developer, distributor or importer Scope turns on Provider Hook Establishment of the operator; placing on the market; where the output is used Runtime Outside any runtime path
Transparency in Frontier Artificial Intelligence Act (SB 53), Cal. Bus. and Prof. Code Sections 22757.10 to 22757.16 Source as of ai:us-ca-cal-bus-prof-sections-22757-10-22757-16:0

Colorado

Establish a documented, risk-based governance and risk management framework, including a cross-functional governance group drawing on legal, compliance, risk management, product development, underwriting, actuarial, data science, marketing, and customer service, designed to determine through quantitative testing whether your use of an external consumer data and information source, or an algorithm or predictive model that uses one, results in unfair discrimination with respect to race, and to remediate any discrimination detected.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, 3 CCR 702-10, Regulation 10-1-1 Source as of ai:us-co-3-ccr-702-10-10-1-1:0

Texas

If the Attorney General notifies you in writing of a violation, cure it within 60 days of the notice and give the Attorney General a written statement that you have cured the violation, supporting documentation showing the manner in which you cured it, and a statement that you have made any necessary changes to internal policies to reasonably prevent further violation (s. 552.104(b)).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
TRAIGA (H.B. 149, 2025), Attorney General enforcement, civil investigative demand, cure period, penalties and defenses, Tex. Bus. & Com. Code §§ 552.101-552.106 Source as of ai:us-tx-tex-bus-com-552-101-552-106:0

South Korea

If your AI system was trained using cumulative compute of 10^26 floating-point operations or more, applies the most advanced AI technology currently in use, and could broadly and seriously affect people's life, physical safety or fundamental rights, identify, assess and mitigate risk across the system's full life cycle.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
AI Framework Act, Article 32 (safety-assurance duty for high-compute AI systems), Act No. 20676, Article 32 Source as of ai:kr-no-20676-32:0

United Kingdom

It reaches you if you are a firm that makes a personal recommendation to a retail client in relation to a designated investment, manages investments of a retail client of the firm, or manages the assets of an occupational pension scheme, stakeholder pension scheme or personal pension scheme, other than in relation to your MiFID, equivalent third country or optional exemption business or an insurance-based investment product, for which COBS 9A sets the suitability rules (COBS 9.1.1R and COBS 9.1.1AG), and not in relation to a targeted support service within the scope of COBS 9B (COBS 9.1.1BG): take reasonable steps to ensure that a personal recommendation, or a decision to trade, is suitable for your client, and ensure that any life policy proposed is consistent with the client's insurance demands and needs (COBS 9.2.1R(1)).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Suitability for business that is not MiFID business: personal recommendations to retail clients and decisions to trade for them (COBS 9.1 and 9.2), FCA Handbook, COBS 9 Source as of ai:gb-fca-handbook-cobs-9:0

Brazil

Establish a lawful basis under article 7 before processing personal data, including data the person has made public.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
Lei Geral de Proteção de Dados Pessoais (LGPD), Lei nº 13.709, de 14 de agosto de 2018 (LGPD), arts. 1º-10, 15-16, 23-32, 37-41, 46-47, 49-51 (general regime, principles, lawful basis, public-sector processing, agents and governance) Source as of privacy:br-lei-n-13-709-de-14-de-agosto-de-2018-lgpd:0

India

This binds a commercial bank, meaning a banking company other than a small finance bank, payments bank or local area bank, a corresponding new bank or the State Bank of India (reached by declaring that you are a bank). A foreign bank operating through branches is bound on a comply-or-explain basis for the chapters and paragraphs paragraph 4 of the Directions lists.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator (entity in scope) Runtime not yet classified
RBI Commercial Banks Cybersecurity Directions, Cybersecurity Policy, Testing and Security Operations Centre, Reserve Bank of India (Commercial Banks - Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026, paras. 15, 149 to 153 and 212 to 216 Source as of security:in-reserve-bank-india-commercial-banks-cybersecu:0

Vietnam

Classify your AI system's risk level (high, medium or low) before putting it into use, and answer for the accuracy of the result.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Decree implementing the AI Law, risk classification, notification, conformity assessment and risk management, Decree No. 142/2026/ND-CP, arts. 6, 9, 11-15 Source as of ai:vn-decree-no-142-2026-nd-cp-6-9-11-15:0

Germany

Provide the information or documentation, and give the access, that Article 21 requires of a provider of a high-risk AI system when a competent authority asks; carry out and update the fundamental rights impact assessment Article 27 requires and send the notification it requires; if you are a notified body, inform the notifying authority as Article 45 requires; and, if you operate a high-risk AI system under point 1, 3, 4 or 5 of Annex III, give an affected person the explanation Article 86 requires (Section 15).
Type Conditional Obligation Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on reworded since it was classified Hook Establishment of the operator; placing on the market; where the output is used Runtime reworded since it was classified
Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-Marktüberwachungs-und-Innovationsförderungs-Gesetz, KI-MIG), §§ 2, 6, 8, 13, 15, 16, 20 Source as of ai:de-gesetz-zur-markt-berwachung-und-innovationsf:0

Ireland

If you process personal data for health research in Ireland, take the safeguards listed in Regulation 3(1) of the Health Research Regulations 2018, including ethical approval of the research by a research ethics committee and controls to log who consulted, altered, disclosed or erased the personal data.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018, Safeguards and Explicit Consent for Health Research in Ireland, Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018 (S.I. No. 314 of 2018), regs. 3, 3A and 5, as amended by S.I. No. 18 of 2021 Source as of privacy:ie-data-protection-2018-36-2-health-research-reg:0

Italy

Adopt the technical safety measures provided for the design, training, production and placing on the market of high-risk AI systems, suited to prevent malfunctions or alterations of how the systems work, and adopt human-oversight measures, where omitting them would endanger life or public or individual safety, or the security of the State (Codice Penale art. 437-bis, first paragraph).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them, Codice Penale, art. 437-bis, inserted by D.Lgs. 9 settembre 2026, n. 160, art. 12 Source as of ai:it-codice-penale-437-bis-inserted-by-d-lgs-9-set:0

Spain

Compensate any person in Spain who suffered material or non-material damage from your infringement, as controller or processor, under GDPR Article 82.
Type Mandatory Obligation Modal imperative Binds, by its wording Controller (the party that decides why and how personal data is processed) Scope turns on reworded since it was classified Hook Establishment of the operator Runtime reworded since it was classified
AEPD Enforcement, GDPR Article 82 and LOPDGDD Título IX, Regulation (EU) 2016/679, Arts. 82-83; LOPDGDD, Art. 47, Arts. 70-78 Source as of privacy:es-eu-2016-679-82-83-lopdgdd-47-70-78:0

3,726 more lines in force in this class, and 4,309 lines in all, are in the law library, each on the summary page of its instrument.

Report to a regulator

3,078 lines 2,754 in force 658 provisions 224 jurisdictions by type: mandatory obligation 1,719, conditional obligation 1,106, prohibition 95, definition 92, recommendation/guidance 50, consequence (penalty or remedy) 13, permission or exemption 3

Sample requirement lines Show 13 of the 2,754 lines in forceHide the sample

What follows is a sample of 13 requirement lines from the law library, chosen to span jurisdictions.

European Union

This Directive is addressed to the Member States (Article 97), which had to adopt and publish the measures necessary to comply with it by and apply them from (Article 93(1), as amended by Directive (EU) 2016/1034, Article 1, point (7)), so an investment firm meets Article 17 through each Member State's national law; Delegated Regulation (EU) 2017/589 is binding in its entirety and directly applicable in all Member States and applies from (Article 29).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), Directive 2014/65/EU, Article 17, supplemented by Commission Delegated Regulation (EU) 2017/589 Source as of ai:eu-2014-65-eu-17-supplemented-by-commission-dele:0

California

If a reasonable person interacting with your companion chatbot could be misled into believing they are talking to a human, issue a clear and conspicuous notification that the chatbot is artificially generated and not human
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Where the output is used; placing on the market Runtime Detectable at a runtime control
Companion Chatbot Safety and Accountability Act (SB 243), Cal. Bus. and Prof. Code Sections 22601 to 22606 Source as of ai:us-ca-cal-bus-prof-sections-22601-22606:0

Colorado

Establish a documented, risk-based governance and risk management framework, including a cross-functional governance group drawing on legal, compliance, risk management, product development, underwriting, actuarial, data science, marketing, and customer service, designed to determine through quantitative testing whether your use of an external consumer data and information source, or an algorithm or predictive model that uses one, results in unfair discrimination with respect to race, and to remediate any discrimination detected.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, 3 CCR 702-10, Regulation 10-1-1 Source as of ai:us-co-3-ccr-702-10-10-1-1:0

Texas

If you are a medical facility, research facility, company or nonprofit organization that conducts research on or testing of genome sequencing or the human genome in Texas, do not use a genome sequencer or software produced by or on behalf of a foreign adversary, a state-owned enterprise of a foreign adversary, an organization domiciled in a country that is a foreign adversary, or an owned or controlled subsidiary or affiliate of such an organization (Tex. Health & Safety Code secs. 174.003, 174.005).
Type Conditional Obligation Modal do not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Texas Genomic Act: ban on genome sequencers and software produced by or for a foreign adversary, Tex. Health & Safety Code secs. 174.003, 174.005 Source as of privacy:us-tx-tex-health-safety-secs-174-003-174-005:0

South Korea

If your AI system was trained using cumulative compute of 10^26 floating-point operations or more, applies the most advanced AI technology currently in use, and could broadly and seriously affect people's life, physical safety or fundamental rights, identify, assess and mitigate risk across the system's full life cycle.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
AI Framework Act, Article 32 (safety-assurance duty for high-compute AI systems), Act No. 20676, Article 32 Source as of ai:kr-no-20676-32:0

United Kingdom

Pay the annual data protection charge to the Information Commission within the first 21 days of each 12-month charge period, unless all of the personal data processing you do is exempt processing, under regulation 2(2) of the Data Protection (Charges and Information) Regulations 2018.
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject; establishment of the operator Runtime not yet classified
Data Protection (Charges and Information) Regulations 2018, Annual Charge and Information Duty for Data Controllers, Data Protection (Charges and Information) Regulations 2018 (S.I. 2018/480), regs. 2-3; Data Protection Act 2018, ss. 137, 158 Source as of privacy:gb-data-protection-charges-information-regulatio:0

Brazil

Expect administrative sanctions, including a simple fine of up to 2% of the private legal entity's, group's, or conglomerate's revenue in Brazil in its last fiscal year, excluding taxes, capped in total at R$50,000,000.00 per infraction, for violations the ANPD investigates through due administrative process.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator Runtime not yet classified
LGPD, civil liability, administrative sanctions and the ANPD, Lei nº 13.709, de 2018 (LGPD), arts. 42-45, 52-54, 55-A a 58-B (civil liability, administrative sanctions and the ANPD) Source as of privacy:br-lei-n-13-709-de-2018-lgpd-42-45-52-54-55-58-b:0

India

This binds a service provider, intermediary, data centre, body corporate, or Government organisation, the Information Technology Act's own general terms for essentially any commercial or professional actor operating a computer resource in India, not a licensed or sector-specific status; a company distributing software or operating a mobile app in India falls within this reach without needing a specific regulatory registration.
Type Definition Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not a duty Hook Placing on the market; establishment of the manufacturer Runtime not a duty
CERT-In Cyber Security Directions, Incident Reporting, Logging and Time Synchronisation, Directions under section 70B(6) of the Information Technology Act, 2000, No. 20(3)/2022-CERT-In (Indian Computer Emergency Response Team, Ministry of Electronics and Information Technology, ) Source as of security:in-directions-under-70b-6-information-technology:0

Vietnam

Classify your AI system's risk level (high, medium or low) before putting it into use, and answer for the accuracy of the result.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Decree implementing the AI Law, risk classification, notification, conformity assessment and risk management, Decree No. 142/2026/ND-CP, arts. 6, 9, 11-15 Source as of ai:vn-decree-no-142-2026-nd-cp-6-9-11-15:0

Germany

Provide the information or documentation, and give the access, that Article 21 requires of a provider of a high-risk AI system when a competent authority asks; carry out and update the fundamental rights impact assessment Article 27 requires and send the notification it requires; if you are a notified body, inform the notifying authority as Article 45 requires; and, if you operate a high-risk AI system under point 1, 3, 4 or 5 of Annex III, give an affected person the explanation Article 86 requires (Section 15).
Type Conditional Obligation Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on reworded since it was classified Hook Establishment of the operator; placing on the market; where the output is used Runtime reworded since it was classified
Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-Marktüberwachungs-und-Innovationsförderungs-Gesetz, KI-MIG), §§ 2, 6, 8, 13, 15, 16, 20 Source as of ai:de-gesetz-zur-markt-berwachung-und-innovationsf:0

Ireland

If you are a health services provider in Ireland, record each patient's personal public service number and associate it with any record you make about the health service you provide to that patient, and do not refuse a service solely because the patient has no number or cannot provide it (Health Information Act 2026 Section 12).
Type Conditional Obligation Modal do not Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Health Information Act 2026 Sections 10, 12 and 19 to 22, Electronic Health Record, Personal Public Service Number and Data Requests by the Health Service Executive, Health Information Act 2026 (No. 10 of 2026), ss. 10, 12, 19-22 Source as of privacy:ie-health-information-2026-no-10-2026-ss-10-12-1:0

Italy

If you process data for research and experimentation in building AI systems for health purposes within Article 8 of Law 132/2025, communicate the processing to the Garante with the information required by GDPR Articles 24, 25, 32 and 35 and any processor named under Article 28, and start only thirty days after the communication unless the Garante has blocked it (Article 8, paragraph 5).
Type Conditional Obligation Modal unless Binds, by its wording Processor (the party that processes personal data for a controller) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Law 132/2025 Article 8, Health Data Processing for Research and Experimentation in Building AI Systems, Legge 23 settembre 2025, n. 132, art. 8 Source as of privacy:it-legge-23-settembre-2025-n-132-8:0

Spain

This binds an operator of essential services and a digital service provider within the scope described on this jurisdiction's companion security-obligations row; a digital service provider's notification duty applies only when it has access to the information needed to assess the incident's impact.
Type Definition Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not a duty Hook Placing on the market; establishment of the manufacturer Runtime not a duty
Real Decreto-ley 12/2018, Incident Notification Obligation, Real Decreto-ley 12/2018, de 7 de septiembre, de seguridad de las redes y sistemas de informacion, arts. 19, 21 y 22, developed by Real Decreto 43/2021, de 26 de enero Source as of security:es-rdl-12-2018-art19-notificacion:0

2,741 more lines in force in this class, and 3,078 lines in all, are in the law library, each on the summary page of its instrument.

Disclose the use of AI

2,825 lines 2,413 in force 540 provisions 187 jurisdictions by type: mandatory obligation 1,190, conditional obligation 1,062, prohibition 418, definition 91, recommendation/guidance 26, permission or exemption 21, consequence (penalty or remedy) 17

Sample requirement lines Show 14 of the 2,413 lines in forceHide the sample

What follows is a sample of 14 requirement lines from the law library, chosen to span jurisdictions.

European Union

This Directive is addressed to the Member States (Article 97), which had to adopt and publish the measures necessary to comply with it by and apply them from (Article 93(1), as amended by Directive (EU) 2016/1034, Article 1, point (7)), so an investment firm meets Article 25(2) through each Member State's national law; Delegated Regulation (EU) 2017/565 is binding in its entirety and directly applicable in all Member States and applies from the date that appears first in the second subparagraph of Article 93(1) of the Directive, which is (Article 91), and Delegated Regulation (EU) 2021/1253 changed its Article 54 with effect from (Article 2).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
MiFID II Suitability Assessment for Investment Advice and Portfolio Management, Including Automated and Semi-Automated Systems (Article 25(2) and Delegated Regulation 2017/565 Article 54), Directive 2014/65/EU, Article 25(2), supplemented by Commission Delegated Regulation (EU) 2017/565, Article 54 Source as of ai:eu-2014-65-eu-25-2-supplemented-by-commission-de:0

California

If you use automated decisionmaking technology (ADMT) to make a significant decision about a consumer (granting or denying financial or lending services, housing, education enrollment or opportunities, employment or independent-contracting opportunities or compensation, or healthcare services), give the consumer a Pre-use Notice describing that use and the consumer's rights to opt out of and access information about it
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Detectable at a runtime control
CCPA Automated Decisionmaking Technology Regulations, Cal. Code Regs. tit. 11, Sections 7200 to 7222 Source as of ai:us-ca-11-cal-regs-sections-7200-7222:0

Colorado

Do not allow an AI system to interact with a client in any form of therapeutic communication unless the regulated professional, the AI system and the client interact synchronously in real time, and do not let it generate therapeutic recommendations or treatment plans without the professional's review and approval
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
HB 26-1195 (2026), Psychotherapy Artificial Intelligence Restrictions, Colo. HB 26-1195, 2026 Colo. Sess. Laws ch. 358 Source as of ai:us-co-colo-hb-26-1195-2026-colo-sess-laws-ch-358:0

Texas

If you are a governmental agency making an AI system available to interact with consumers, disclose before or at the time of interaction that the consumer is interacting with an AI system, even if that would already be obvious to a reasonable consumer.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Where the output is used; placing on the market Runtime Detectable at a runtime control
TRAIGA (H.B. 149, 2025), consumer AI-interaction disclosure duty, Tex. Bus. & Com. Code § 552.051 Source as of ai:us-tx-tex-bus-com-552-051:0

South Korea

Before you provide an AI system, or a product or service that uses one, review whether it is high-impact, meaning it may seriously affect a person's life, physical safety or fundamental rights and is used in energy supply, drinking water production, healthcare provision, medical and digital medical devices, nuclear material and facility safety, biometric identification for criminal investigation or arrest, hiring and loan decisions, transportation systems, public-service eligibility and fee decisions, and student assessment in early childhood, elementary and secondary education. You may ask the Ministry of Science and ICT to confirm your answer.
Type Mandatory Obligation Modal may Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
AI Framework Act, Article 34 (business-operator duties for high-impact AI), Act No. 20676, Article 34 Source as of ai:kr-no-20676-34:0

United Kingdom

It reaches you if you operate as a creditor under a prospective regulated agreement, meaning the person providing credit under a consumer credit agreement, including the prospective creditor, where the agreement is a regulated agreement and is not an excluded agreement (a consumer hire agreement or an agreement secured on land): when you decide not to proceed with it on the basis of information you obtained from a credit reference agency, inform the debtor, when telling the debtor of the decision, that the decision was reached on the basis of information from a credit reference agency, and provide the debtor with the particulars of the agency, including its name, address and telephone number (Consumer Credit Act 1974, section 157(A1), (4); section 189).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Consumer Credit Act 1974, duty to tell a refused applicant that a credit reference agency was used and to give its name and address, Consumer Credit Act 1974, c. 39, s. 157 Source as of ai:gb-consumer-credit-1974-c-39-s-157:0

Brazil

Let a data subject confirm that processing exists, access their data, correct it, or have it anonymized, blocked, deleted, or ported to another provider, on request.
Type Mandatory Obligation Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
LGPD, rights of the data subject, Lei nº 13.709, de 2018 (LGPD), arts. 17-19, 21-22 (rights of the data subject) Source as of privacy:br-lei-n-13-709-de-2018-lgpd-17-22-rights-data-s:0

Vietnam

Give information on your AI system's purpose of use, scope, conditions of use and limits, keep the information and documents needed for inspection and supervision, and explain yourself when the competent state agency asks in writing.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Where the output is used; placing on the market Runtime not yet classified
Decree implementing the AI Law, transparency, technical marking and labeling of AI-generated content, Decree No. 142/2026/ND-CP, arts. 16-18 Source as of ai:vn-decree-no-142-2026-nd-cp-16-18:0

Germany

If you operate a health care facility that further processes health data it stores lawfully under GDPR Article 9(2)(h) or (i) for quality assurance, patient safety, research or statistics, pseudonymize the data, anonymize it as soon as the purpose allows, and delete it no later than 30 years after the further processing began (GDNG Section 6, paragraph 1).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Health Data Use Act (GDNG) Sections 1 and 6 to 9, Secondary Use and Protection of Health Data, Gesundheitsdatennutzungsgesetz (GDNG), §§ 1, 6-9 Source as of privacy:de-gesundheitsdatennutzungsgesetz-gdng-1-6-9:0

Ireland

Establish and document a lawful basis under GDPR Article 6 before processing any personal data of a person in Ireland.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
Data Protection Act 2018, Data Protection Act 2018 (No. 7 of 2018) Source as of privacy:ie-data-protection-2018-no-7-2018:0

Italy

If you are sued for damage caused in the use of an AI system, and the claimant presents facts and elements that make the claim plausible, produce on the court's order the evidence specifically relevant to how the system works, including the logs under Article 12, the risk-management documentation under Article 9, the relevant technical documentation under Article 11 and the human-oversight information under Article 14 of Regulation (EU) 2024/1689; the order is limited to what is necessary and proportionate, and the court protects trade secrets and confidential information (art. 17, commi 1 to 4).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Decreto Legislativo 160/2026, Civil Damages Actions for Harm Caused by AI Systems (Artt. 16-20), D.Lgs. 9 settembre 2026, n. 160, artt. 16-20 Source as of ai:it-d-lgs-9-settembre-2026-n-160-artt-16-20:0

France

Do not knowingly interfere, for purposes other than research, with an effective technical measure as defined in Article L. 331-5 in order to alter the protection of a work by decoding, decrypting or any other personal intervention meant to circumvent, neutralize or remove a protection or control mechanism (Article L. 335-3-1, I).
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook The counterparty's establishment (rightsholder); where the copy is made Runtime not yet classified
CPI Technical Protection Measures, Protection of Effective Technical Measures and the Offences of Circumventing Them, Code de la propriété intellectuelle, arts. L331-5 to L331-10 and L335-3-1 Source as of scraping:fr-de-la-propriete-intellectuelle-l331-5-l331-10:0

Australia

Do not, in trade or commerce, engage in conduct that is misleading or deceptive or is likely to mislead or deceive (section 18(1)).
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator Runtime not yet classified
Australian Consumer Law ss. 18, 29 and 34, Misleading Conduct and Representations as Applied to Data Practices and Rankings, Competition and Consumer Act 2010 (Cth), Schedule 2 (Australian Consumer Law), ss 18, 29 and 34 Source as of privacy:au-competition-consumer-2010-cth-schedule-2-aust:0

Canada

It reaches you if you are a Dealer Member of the Canadian Investment Regulatory Organization (CIRO), which Canada's provincial and territorial securities regulators recognize as a self-regulatory organization, or an Approved Person of one, because a hearing panel that finds a Dealer Member or an Approved Person has contravened a CIRO requirement may impose sanctions on it (Rules 8209 and 8210), and the Rules exclude a Mutual Fund Dealer Member from the term Dealer Member: take reasonable steps to identify existing material conflicts of interest, and material conflicts of interest that are reasonably foreseeable, between you and the client and between each Approved Person acting on your behalf and the client (Rule 3110(1)).
Type Conditional Obligation Modal may Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
CIRO Rule 3100, Part B, conflicts of interest, CIRO IDPC Rule 3100, ss. 3110-3114 Source as of ai:ca-ciro-idpc-rule-3100-ss-3110-3114:0

2,399 more lines in force in this class, and 2,825 lines in all, are in the law library, each on the summary page of its instrument.

Do not do the named thing

2,327 lines 2,048 in force 636 provisions 209 jurisdictions by type: prohibition 977, conditional obligation 609, mandatory obligation 522, definition 82, consequence (penalty or remedy) 71, permission or exemption 61, recommendation/guidance 5

Sample requirement lines Show 13 of the 2,048 lines in forceHide the sample

What follows is a sample of 13 requirement lines from the law library, chosen to span jurisdictions.

European Union

This Directive is addressed to the Member States (Article 69), which had to bring into force the laws, regulations and administrative provisions necessary to comply with it by (Article 67(1), as replaced by Directive (EU) 2018/843, Article 1, point (42)), so an obliged entity meets these rules through each Member State's national law; Article 77 of Directive (EU) 2024/1640 repeals this Directive with effect from , and Annex VI to Regulation (EU) 2024/1624 correlates Article 33(1) with Article 69(1) and Article 39 with Article 73 of that Regulation.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Fourth Anti-Money-Laundering Directive: Reporting of Suspicious Transactions to the Financial Intelligence Unit and Prohibition of Disclosure (Articles 33 and 39), Directive (EU) 2015/849, Articles 33 and 39 Source as of ai:eu-2015-849-articles-33-39:0

California

Do not use a term, letter or phrase in the advertising or functionality of your AI or generative AI system, program, device or similar technology that indicates or implies that the care, advice, reports or assessments it offers are provided by a natural person who holds the appropriate license or certificate to practice as a health care professional (Section 4999.9(c)).
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Health Care Professional Title Protection for Artificial Intelligence Act (AB 489), Cal. Bus. and Prof. Code Sections 4999.8 and 4999.9 Source as of ai:us-ca-cal-bus-prof-sections-4999-8-4999-9:0

Colorado

Do not allow an AI system to interact with a client in any form of therapeutic communication unless the regulated professional, the AI system and the client interact synchronously in real time, and do not let it generate therapeutic recommendations or treatment plans without the professional's review and approval
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
HB 26-1195 (2026), Psychotherapy Artificial Intelligence Restrictions, Colo. HB 26-1195, 2026 Colo. Sess. Laws ch. 358 Source as of ai:us-co-colo-hb-26-1195-2026-colo-sess-laws-ch-358:0

Texas

Do not develop or deploy an AI system that intentionally aims to incite or encourage physical self-harm, harm to another person, or criminal activity.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Detectable at a runtime control
TRAIGA (H.B. 149, 2025), prohibited AI practices binding any person, Tex. Bus. & Com. Code §§ 552.052, 552.055-552.057 Source as of ai:us-tx-tex-bus-com-552-052-552-055-552-057:0

South Korea

You may process pseudonymized information of people in Korea without their consent for statistics, scientific research, archiving in the public interest and similar purposes, and when you give it to a third party for those purposes you must not include any information that could be used to identify a specific individual (Article 28-2).
Type Conditional Obligation Modal may, must not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject; establishment of the operator Runtime not yet classified
Personal Information Protection Act, pseudonymized information, Act No. 10465 (as amended by Act No. 21445, 2026), Arts. 28-2 to 28-5 and 28-7; Arts. 64-2 and 71 (penalties) Source as of privacy:kr-no-10465-as-amended-by-no-21445-2026-28-2-28:0

United Kingdom

Do not make or adapt a thing, or supply or offer to supply a thing, for use as a generator of purported intimate images, meaning a thing for creating, or facilitating the creation of, purported intimate images of a person.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Making or Supplying a Generator of Purported Intimate Images, Crime and Policing Act 2026, c. 20, s. 99, inserting ss. 66I-66L into the Sexual Offences Act 2003 Source as of ai:gb-crime-policing-2026-c-20-s-99-inserting-ss-66:0

Brazil

Do not use fabricated or manipulated content in electoral advertising to spread notoriously untrue or gravely decontextualized facts capable of harming the balance of the election or the integrity of the electoral process.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Detectable at a runtime control
TSE Resolution, Prohibition on Electoral Deepfakes, Resolução TSE nº 23.610/2019, art. 9º-C (redação dada pela Resolução TSE nº 23.732, de 27 de fevereiro de 2024) Source as of ai:br-resolu-o-tse-n-23-610-2019-9-c-reda-o-dada-pe:0

Germany

If you are a physician, or a laboratory a physician commissions, and you carry out a genetic examination or analysis, obtain the person's express written consent before the examination or the taking of the sample, after you have explained its nature, significance and scope and allowed reasonable time to decide (GenDG Sections 8 and 9).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Genetic Diagnostics Act (GenDG), Genetic Examinations, Genetic Samples and Data, and Genetic Discrimination in Insurance and Employment, Gendiagnostikgesetz (GenDG) vom 31. Juli 2009 (BGBl. I S. 2529, 3672), as amended Source as of privacy:de-gendiagnostikgesetz-gendg-vom-31-juli-2009-bg:0

Ireland

Do not distribute, publish or threaten to distribute or publish an intimate image of another person without that person's consent, with intent to cause harm or being reckless as to whether harm is caused, including an image that only purports to be that person's intimate depiction, such as an AI-generated or digitally altered synthetic image (s. 2).
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Detectable at a runtime control
Harassment, Harmful Communications and Related Offences Act 2020, Intimate Image Offences, Harassment, Harmful Communications and Related Offences Act 2020 (No. 32 of 2020), ss. 1-3 Source as of ai:ie-harassment-harmful-communications-2020-ss-2-3:0

Italy

Do not transfer, publish, or otherwise disseminate a falsified or altered image, video, or voice recording generated using an AI system, capable of misleading others as to its genuineness, without the depicted or recorded person's consent.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Detectable at a runtime control
Codice Penale Art. 612-quater, Illicit Dissemination of AI-Generated or AI-Altered Content, Codice Penale, art. 612-quater, inserted by Legge 23 settembre 2025, n. 132, art. 26, comma 1, lettera c) Source as of ai:it-cp-612quater-ai-deepfake-dissemination:0

Spain

Do not obtain a trade secret without the consent of its holder by unauthorized access to, appropriation of or copying of documents, objects, materials, substances, electronic files or other media that contain the secret or from which it can be deduced, or by any other conduct considered contrary to fair commercial practices (art. 3.1).
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Where the counterparty competes Runtime not yet classified
Ley de Secretos Empresariales, Articles 1 to 3 and 9 (Trade Secret Definition, Lawful and Unlawful Acts and Civil Actions), Ley 1/2019, de 20 de febrero, de Secretos Empresariales, arts. 1 to 3 and 9 Source as of scraping:es-ley-1-2019-de-20-de-febrero-de-secretos-empre:0

France

This experiment lets State services run algorithmic processing of video-protection images under a prefect's authorisation and sets conditions on that processing; it is a framework for public-sector video analysis, not a general rule for private operators.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Law 2023-380, Article 10, Experimental Algorithmic Processing of Video-Protection Images, Extended to 31 December 2030, Loi n° 2023-380 du 19 mai 2023, art. 10, expérimentation du traitement algorithmique d'images de vidéoprotection, prolongée par la loi visant à offrir des réponses immédiates aux phénomènes troublant l'ordre public, la sécurité et la tranquillité de nos concitoyens Source as of ai:fr-loi-n-2023-380-du-19-mai-2023-10-experimentat:0

Netherlands

Do not produce, distribute, offer, publicly display, import, export, acquire, or possess a sexual image of a person who apparently has not yet reached the age of eighteen, whether or not that person is real; a computer-generated or synthetic depiction is reached on the same terms as a real one.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Detectable at a runtime control
Wetboek van Strafrecht, art. 252, Sexual Imagery of an Apparent Minor (Virtual Child Sexual Abuse Material), Wetboek van Strafrecht, art. 252 (until : art. 240b) (BWBR0001854) Source as of ai:nl-wetboek-van-strafrecht-252-voorheen-240b:0

2,035 more lines in force in this class, and 2,327 lines in all, are in the law library, each on the summary page of its instrument.

Honor the person's rights over their data

1,776 lines 1,572 in force 374 provisions 165 jurisdictions by type: mandatory obligation 749, conditional obligation 666, prohibition 290, definition 50, recommendation/guidance 12, consequence (penalty or remedy) 7, permission or exemption 2

Sample requirement lines Show 14 of the 1,572 lines in forceHide the sample

What follows is a sample of 14 requirement lines from the law library, chosen to span jurisdictions.

European Union

This right applies from , the Regulation's general application date: Article 113, as amended by Regulation (EU) 2026/1744, gives Chapter IX, which holds Article 85, no date of its own.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
AI Act, Article 85 (right to lodge a complaint with a market surveillance authority), Regulation (EU) 2024/1689, Article 85 Source as of ai:eu-2024-1689-85:0

California

If you use automated decisionmaking technology (ADMT) to make a significant decision about a consumer (granting or denying financial or lending services, housing, education enrollment or opportunities, employment or independent-contracting opportunities or compensation, or healthcare services), give the consumer a Pre-use Notice describing that use and the consumer's rights to opt out of and access information about it
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Detectable at a runtime control
CCPA Automated Decisionmaking Technology Regulations, Cal. Code Regs. tit. 11, Sections 7200 to 7222 Source as of ai:us-ca-11-cal-regs-sections-7200-7222:0

Colorado

If you are an insurance licensee, give each customer a clear and conspicuous notice that accurately reflects your privacy policies and practices not later than when you establish the customer relationship, and not less than annually during the relationship (Regulation 6-4-1 Sections 5 and 6).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Privacy of Consumer Financial and Health Information: insurance licensees' notice, opt-out and authorization duties, 3 CCR 702-6, Regulation 6-4-1 Source as of privacy:us-co-3-ccr-702-6-6-4-1:0

Texas

If you are a covered entity under the Texas Department of Insurance's insurance consumer financial information privacy rule, give individuals notice of your privacy policies and practices (28 Texas Administrative Code Section 22.1(a)(1)).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Insurer privacy rule: notice and opt-out for nonpublic personal financial information about individuals, 28 Tex. Admin. Code secs. 22.1 and 22.2 Source as of privacy:us-tx-28-tex-admin-secs-22-1-22-2:0

United Kingdom

Where you take a significant decision about a person, one with a legal effect or a similarly significant effect, based solely on automated processing of their personal data, have safeguards in place that give the person information about the decision, let them make representations, let them obtain human intervention from you and let them contest the decision.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Automated Decision-Making: Significant Decisions Based Solely on Automated Processing (UK GDPR Articles 22A to 22D), Data (Use and Access) Act 2025, c. 18, s. 80, substituting Articles 22A to 22D into the UK GDPR Source as of ai:gb-data-use-access-2025-c-18-s-80-substituting-a:0

Brazil

Let a data subject confirm that processing exists, access their data, correct it, or have it anonymized, blocked, deleted, or ported to another provider, on request.
Type Mandatory Obligation Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
LGPD, rights of the data subject, Lei nº 13.709, de 2018 (LGPD), arts. 17-19, 21-22 (rights of the data subject) Source as of privacy:br-lei-n-13-709-de-2018-lgpd-17-22-rights-data-s:0

Vietnam

An app processing the personal data of an individual in Vietnam must be prepared to answer to the agency in charge of personal data protection, facing a fine of up to 5 percent of prior-year revenue for a cross-border transfer violation, and an individual harmed by the app's processing may file a complaint, initiate a lawsuit, and request compensation for damage.
Type Consequence (penalty or remedy) Modal must, may Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook Establishment of the operator Runtime not a duty
Law on Personal Data Protection, enforcement and data subject rights, Law No. 91/2025/QH15, enforcement and data subject rights provisions Source as of privacy:vn-no-91-2025-qh15-enforcement-data-subject-righ:0

Germany

If you are a statutory health insurance fund, from provide every insured person who has not objected within six weeks of being informed under Section 343 with an electronic patient record approved by the Gesellschaft für Telematik (SGB V Section 342, paragraph 1).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Social Code Book V Section 342, Electronic Patient Record with Opt-Out, Fünftes Buch Sozialgesetzbuch (SGB V), § 342 Abs. 1 und 2 Source as of privacy:de-funftes-buch-sozialgesetzbuch-sgb-v-342-abs-1:0

Ireland

Establish and document a lawful basis under GDPR Article 6 before processing any personal data of a person in Ireland.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
Data Protection Act 2018, Data Protection Act 2018 (No. 7 of 2018) Source as of privacy:ie-data-protection-2018-no-7-2018:0

Spain

If you run a public or private health centre or service in Spain, let a patient (or a duly accredited representative) access the clinical record and obtain a copy of the data in it, through a procedure you regulate, while protecting third persons' confidential data and professionals' subjective notes (Ley 41/2002, Article 18(1) to (3)).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Ley 41/2002, Patient Right of Access to the Clinical Record and Active Custody of It in Spain, Ley 41/2002, de 14 de noviembre, arts. 18 and 19 Source as of privacy:es-ley-41-2002-de-14-de-noviembre-18-19:0

Utah

This part binds a governmental entity, a term Utah Code 63A-19-101 takes from section 63G-2-103, and section 63A-19-401.4 extends the same requirements to a contractor of a governmental entity.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Government Data Privacy Act, correction requests and data privacy complaints, Utah Code 63A-19-403 and 63A-19-502 Source as of privacy:us-ut-utah-63a-19-403-63a-19-502:0

Peru

Tell a person, in detailed, simple, express and unequivocal terms before collecting their personal data, the purpose of the processing, who its recipients are, the data bank's existence and its owner's identity and address, whether their answers are mandatory or optional, any transfer, how long you will keep the data, and how to exercise their rights; an easily accessible and identifiable privacy policy satisfies this for data collected online.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Ley 29733, rights of the data subject, Ley No. 29733, arts. 18-22 and 24-27 (rights of the data subject) Source as of privacy:pe-ley-no-29733-18-27-rights-data-subject:0

South Africa

Do not base a decision that has legal or substantially similar consequences for a person solely on automated processing of their personal information, unless the person can make representations about the decision and you have explained the underlying logic of the processing to them.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
POPIA, automated decisions, POPIA, s. 71 (automated individual decisions) Source as of privacy:za-popia-s-71-automated-individual-decisions:0

Nigeria

Give a data subject the right not to be subject to a decision based solely on automated processes or algorithms.
Type Conditional Obligation Modal subject to Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Nigeria Data Protection Act, 2023 and GAID 2025, automated decisions, GAID 2025, art. 43(2)(a), under the Nigeria Data Protection Act, 2023 (automated decisions) Source as of privacy:ng-gaid-2025-43-2-under-nigeria-data-protection:0

1,558 more lines in force in this class, and 1,776 lines in all, are in the law library, each on the summary page of its instrument.

Keep records for a set time

1,232 lines 1,125 in force 209 provisions 118 jurisdictions by type: mandatory obligation 546, conditional obligation 433, prohibition 184, definition 50, consequence (penalty or remedy) 11, recommendation/guidance 6, permission or exemption 2

Sample requirement lines Show 14 of the 1,125 lines in forceHide the sample

What follows is a sample of 14 requirement lines from the law library, chosen to span jurisdictions.

European Union

This Directive is addressed to the Member States (Article 97), which had to adopt and publish the measures necessary to comply with it by and apply them from (Article 93(1), as amended by Directive (EU) 2016/1034, Article 1, point (7)), so an investment firm meets Article 16(6) through each Member State's national law; Regulation (EU) No 600/2014 is binding in its entirety and directly applicable in all Member States and applies from (Article 55, as amended by Regulation (EU) 2016/1033, Article 1, point (14)).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
MiFID II and MiFIR Records of Services, Activities, Orders and Transactions (Article 16(6) and MiFIR Article 25), Directive 2014/65/EU, Article 16(6), with Regulation (EU) No 600/2014, Article 25(1) Source as of ai:eu-2014-65-eu-16-6-with-eu-no-600-2014-25-1:0

California

If you operate a site, service or application that you know is used primarily for K-12 school purposes and was designed and marketed for them, do not knowingly engage in targeted advertising on it, and do not target advertising elsewhere using information you acquired through its use (section 22584(b)(1)).
Type Conditional Obligation Modal do not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
K-12 Pupil Online Personal Information Protection Act (KOPIPA), Cal. Bus. and Prof. Code sections 22584 and 22585 Source as of privacy:us-ca-cal-bus-prof-sections-22584-22585:0

Colorado

Treat an opt-out request received through a Universal Opt-Out Mechanism as a valid request to opt out of targeted advertising, the sale of personal data, or both, and be capable of recognizing each mechanism on the Department of Law's public list once you have had at least six months' notice of it (Rule 5.08).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject; establishment of the operator Runtime not yet classified
Colorado Privacy Act Rules (Attorney General), 4 CCR 904-3 Source as of privacy:us-co-4-ccr-904-3:0

Texas

If you operate a website, online service, online application or mobile application that you know is used primarily for a school purpose and was designed and marketed for one, do not knowingly engage in targeted advertising on any service based on information you acquired through that school use (Tex. Educ. Code sec. 32.152(a)(1)).
Type Conditional Obligation Modal do not Binds, by its wording Platform or intermediary Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Texas student information: duties of operators of websites and applications used for a school purpose, Tex. Educ. Code secs. 32.151 to 32.157 Source as of privacy:us-tx-tex-educ-secs-32-151-32-157:0

South Korea

Before you provide an AI system, or a product or service that uses one, review whether it is high-impact, meaning it may seriously affect a person's life, physical safety or fundamental rights and is used in energy supply, drinking water production, healthcare provision, medical and digital medical devices, nuclear material and facility safety, biometric identification for criminal investigation or arrest, hiring and loan decisions, transportation systems, public-service eligibility and fee decisions, and student assessment in early childhood, elementary and secondary education. You may ask the Ministry of Science and ICT to confirm your answer.
Type Mandatory Obligation Modal may Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
AI Framework Act, Article 34 (business-operator duties for high-impact AI), Act No. 20676, Article 34 Source as of ai:kr-no-20676-34:0

Brazil

Establish a lawful basis under article 7 before processing personal data, including data the person has made public.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
Lei Geral de Proteção de Dados Pessoais (LGPD), Lei nº 13.709, de 14 de agosto de 2018 (LGPD), arts. 1º-10, 15-16, 23-32, 37-41, 46-47, 49-51 (general regime, principles, lawful basis, public-sector processing, agents and governance) Source as of privacy:br-lei-n-13-709-de-14-de-agosto-de-2018-lgpd:0

Germany

If you are a physician, or a laboratory a physician commissions, and you carry out a genetic examination or analysis, obtain the person's express written consent before the examination or the taking of the sample, after you have explained its nature, significance and scope and allowed reasonable time to decide (GenDG Sections 8 and 9).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Genetic Diagnostics Act (GenDG), Genetic Examinations, Genetic Samples and Data, and Genetic Discrimination in Insurance and Employment, Gendiagnostikgesetz (GenDG) vom 31. Juli 2009 (BGBl. I S. 2529, 3672), as amended Source as of privacy:de-gendiagnostikgesetz-gendg-vom-31-juli-2009-bg:0

Italy

This article binds the police forces and the Ministry of the Interior as controller, and lets the operators of places and the organisers of events install and maintain the systems at no cost to public finances (art. 10).
Type Mandatory Obligation Modal imperative Binds, by its wording Controller (the party that decides why and how personal data is processed) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), D.Lgs. 9 settembre 2026, n. 160, art. 10 Source as of ai:it-d-lgs-9-settembre-2026-n-160-10:0

Spain

If you run a public or private health centre or service in Spain, adopt measures that keep patients' health data confidential and allow access to it only with prior authorization backed by law (Ley 41/2002, Article 7).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Ley 41/2002, Confidentiality of Patients' Health Data and Security of Clinical Records in Spain, Ley 41/2002, arts. 7, 16 and 17 Source as of privacy:es-ley-41-2002-7-16-17:0

Canada

It reaches you if you are a Dealer Member of the Canadian Investment Regulatory Organization (CIRO), which Canada's provincial and territorial securities regulators recognize as a self-regulatory organization, or an Approved Person of one, because a hearing panel that finds a Dealer Member or an Approved Person has contravened a CIRO requirement may impose sanctions on it (Rules 8209 and 8210), and the Rules exclude a Mutual Fund Dealer Member from the term Dealer Member: retain copies of all records required under Corporation requirements, in durable and accessible form, for a minimum of seven years from the date the record is created, unless Corporation requirements or securities laws relating to the specific type of record require a different retention period (Rule 3803(1)).
Type Conditional Obligation Modal may, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
CIRO Rule 3800, records and client reporting, CIRO IDPC Rule 3800 Source as of ai:ca-ciro-idpc-rule-3800:0

New York

If you operate a website, online service, application or connected device that you actually know is used by a minor under 18, or that is primarily directed to minors, do not process that user's personal data, or let a processor or third-party operator process or collect it, unless the user is 12 or younger and the processing is permitted under 15 U.S.C. § 6502, or the user is 13 or older and the processing is strictly necessary for a purpose the article lists or you have the user's informed consent (Section 899-ff(1) and (2)).
Type Conditional Obligation Modal do not, unless Binds, by its wording Processor (the party that processes personal data for a controller) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
New York Child Data Protection Act, N.Y. Gen. Bus. Law art. 39-FF, §§ 899-ee to 899-mm (2024 N.Y. Laws ch. 121) Source as of privacy:us-ny-n-y-gen-bus-39-ff-899-ee-899-mm-2024-n-y-l:0

Illinois

Before asking an applicant to submit a video interview, notify them that artificial intelligence may be used to analyze it and consider their fitness for the position.
Type Recommendation/Guidance Modal may Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Where the output is used; placing on the market Runtime Detectable at a runtime control
Artificial Intelligence Video Interview Act, 820 ILCS 42/1 et seq. (P.A. 101-260, eff. ) Source as of ai:us-il-820-ilcs-42-1-et-seq-p-101-260-eff-jan-1-2:0

Utah

If you are an insurer offering health care insurance, do not, in connection with the offer or renewal of an insurance product or in the determination of premiums, coverage, renewal, cancellation, or any other underwriting decision that pertains directly to the individual or to a group the individual belongs to that purchases insurance jointly, access or otherwise take into consideration private genetic information about an asymptomatic individual (Utah Code 13-60-205(1)(a)).
Type Conditional Obligation Modal do not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Genetic Testing and Procedure Privacy Act: restrictions on health insurers, Utah Code 13-60-205 Source as of privacy:us-ut-utah-13-60-205:0

Peru

Obtain a person's prior, informed, express, and unequivocal consent before processing their personal data, unless a law authorizes the processing without it, and let them revoke that consent at any time under the same requirements that applied when they gave it.
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the data subject; establishment of the operator Runtime reworded since it was classified
Ley 29733, Ley de Protección de Datos Personales, Ley No. 29733, Ley de Protección de Datos Personales (2011), as amended by Decreto Legislativo 1353 (2017), arts. 1-10, 12-14, 16-17, 28-31 (object, definitions, scope, principles, lawful processing, security, confidentiality, and personal-data-bank obligations) Source as of privacy:pe-ley-no-29733-ley-de-proteccion-de-datos-perso:0

1,111 more lines in force in this class, and 1,232 lines in all, are in the law library, each on the summary page of its instrument.

Do not get in without authorization

831 lines 797 in force 239 provisions 144 jurisdictions by type: prohibition 376, mandatory obligation 199, conditional obligation 154, permission or exemption 39, consequence (penalty or remedy) 36, definition 27

Sample requirement lines Show 14 of the 797 lines in forceHide the sample

What follows is a sample of 14 requirement lines from the law library, chosen to span jurisdictions.

European Union

Do not circumvent an effective technological measure, as Article 6(3) defines the term, where you know, or have reasonable grounds to know, that circumventing it is what you are doing (Art. 6(1)).
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook The counterparty's establishment (rightsholder); where the copy is made Runtime not yet classified
Information Society Directive, Protection of Technological Measures and Rights-Management Information, Directive 2001/29/EC, Arts. 6-7 Source as of scraping:eu-2001-29-ec-6-7:0

California

Keep automated or bulk access from interfering with the intended functioning of the target's computer system: the California Supreme Court described the decisions upholding trespass claims as resting on use that actually did, or threatened to, interfere with the intended functioning of the system, as by significantly reducing its available memory and processing power.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Location of the counterparty's machine Runtime not yet classified
Intel Corp. v. Hamidi, 30 Cal.4th 1342 (2003) Source as of scraping:us-ca-30-cal-4th-1342-2003:0

South Korea

Do not, without proper authority and intentionally or negligently, remove, alter or bypass a technological protection measure that the right holder, or a person with the right holder's consent, has applied to effectively prevent or deter access to a work protected by the Copyright Act, unless one of the exceptions in Article 104-2, paragraph 1 applies.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook The counterparty's establishment (rightsholder); where the copy is made Runtime not yet classified
Copyright Act, Prohibition of Neutralizing Technological Protection Measures (Articles 2(28), 104-2, 104-8 and 136(3)), Copyright Act of the Republic of Korea, Arts. 2(28) and 104-2 Source as of scraping:kr-copyright-republic-korea-2-28-104-2:0

United Kingdom

Do not do anything that circumvents an effective technological measure, such as encryption, scrambling or another access control or protection process, or a copy control mechanism, applied to a copyright work other than a computer program, if you know or have reasonable grounds to know that you are circumventing it.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook The counterparty's establishment (rightsholder); where the copy is made Runtime not yet classified
Copyright, Designs and Patents Act 1988, circumvention of technological measures, Copyright, Designs and Patents Act 1988, c. 48, ss. 296ZA to 296ZF Source as of scraping:gb-copyright-designs-patents-1988-c-48-ss-296za:0

Brazil

Let a data subject confirm that processing exists, access their data, correct it, or have it anonymized, blocked, deleted, or ported to another provider, on request.
Type Mandatory Obligation Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
LGPD, rights of the data subject, Lei nº 13.709, de 2018 (LGPD), arts. 17-19, 21-22 (rights of the data subject) Source as of privacy:br-lei-n-13-709-de-2018-lgpd-17-22-rights-data-s:0

India

Do not access, or secure access to, a computer, computer system or computer network, or download, copy or extract data from it, without the permission of its owner or the person in charge of it.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook Location of the counterparty's machine Runtime Enforceable at a runtime control
Information Technology Act, Unauthorized Access and Computer-Related Offences, Information Technology Act, 2000 (No. 21 of 2000), as amended by the Information Technology (Amendment) Act, 2008 (No. 10 of 2009), ss. 43, 66 Source as of scraping:in-information-technology-2000-no-21-2000-as-ame:0

Germany

Do not circumvent an effective technical measure protecting a work or other protected subject matter without the rightholder's consent, where you know or ought to know that the circumvention is meant to give access to it or to enable its use.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook The counterparty's establishment (rightsholder); where the copy is made Runtime not yet classified
Schutz technischer Massnahmen und Durchsetzung von Schrankenbestimmungen (Protection of Technological Measures), Urheberrechtsgesetz (UrhG), §§ 95a, 95b Source as of scraping:de-urheberrechtsgesetz-urhg-95a-95b:0

France

Do not knowingly interfere, for purposes other than research, with an effective technical measure as defined in Article L. 331-5 in order to alter the protection of a work by decoding, decrypting or any other personal intervention meant to circumvent, neutralize or remove a protection or control mechanism (Article L. 335-3-1, I).
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook The counterparty's establishment (rightsholder); where the copy is made Runtime not yet classified
CPI Technical Protection Measures, Protection of Effective Technical Measures and the Offences of Circumventing Them, Code de la propriété intellectuelle, arts. L331-5 to L331-10 and L335-3-1 Source as of scraping:fr-de-la-propriete-intellectuelle-l331-5-l331-10:0

Japan

Do not circumvent a technological restriction measure, an electromagnetic means that restricts the viewing of a work or the running of a computer program and is used with the will of the right holder, by interfering with its effect so as to make viewing possible, other than within a scope justified for research or technology development relating to the measure or where the right holder's interests are not unreasonably harmed; the act is deemed an infringement of the right.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook The counterparty's establishment (rightsholder); where the copy is made Runtime not yet classified
Copyright Act, Circumvention of Technological Protection and Restriction Measures (Articles 2(1)(xx)-(xxi), 30(1)(ii), 113(6)-(7) and 120-2), with the Unfair Competition Prevention Act circumvention-tool provisions, Copyright Act, Act No. 48 of 1970, Arts. 113(6)-(7) and 120-2; Unfair Competition Prevention Act, Act No. 47 of 1993, Arts. 2(1)(xvii)-(xviii) and 21(3)(iv) Source as of scraping:jp-copyright-no-48-1970-113-6-7-120-2-unfair-com:0

Australia

Do not do an act that results in the circumvention of an access control technological protection measure protecting a work or other subject-matter, meaning a device, product, technology or component that in the normal course of its operation controls access to it, if you know, or ought reasonably to know, that the act would have that result, unless you have the permission of the copyright owner or exclusive licensee.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook The counterparty's establishment (rightsholder); where the copy is made Runtime not yet classified
Copyright Act 1968 (Cth), Circumvention of Access Control Technological Protection Measures (sections 10(1), 116AN to 116AQ and 132APC), Copyright Act 1968 (Cth), No. 63, 1968, ss. 116AN to 116AQ Source as of scraping:au-copyright-1968-cth-no-63-1968-ss-116an-116aq:0

Canada

Do not circumvent a technological protection measure that controls access to a work, a performer's performance fixed in a sound recording or a sound recording and whose use is authorized by the copyright owner, by descrambling or decrypting the work or otherwise avoiding, bypassing, removing, deactivating or impairing the measure, unless you have the authority of the copyright owner or a statutory exception applies.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook The counterparty's establishment (rightsholder); where the copy is made Runtime not yet classified
Copyright Act, Circumvention of Technological Protection Measures (sections 41 to 41.21 and 42(3.1)), R.S.C., 1985, c. C-42, ss. 41 to 41.21 Source as of scraping:ca-r-s-c-1985-c-c-42-ss-41-41-21:0

Peru

Tell a person, in detailed, simple, express and unequivocal terms before collecting their personal data, the purpose of the processing, who its recipients are, the data bank's existence and its owner's identity and address, whether their answers are mandatory or optional, any transfer, how long you will keep the data, and how to exercise their rights; an easily accessible and identifiable privacy policy satisfies this for data collected online.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Ley 29733, rights of the data subject, Ley No. 29733, arts. 18-22 and 24-27 (rights of the data subject) Source as of privacy:pe-ley-no-29733-18-27-rights-data-subject:0

Nigeria

It reaches you if you are a financial institution, a designated non-financial business or profession or any other entity in Nigeria: the freezing duty falls on all natural and legal persons in Nigeria (section 54(1) and section 61(1)). On publication of the UN Consolidated List of persons and entities designated under UNSCR 1267(1999) and its successor resolutions, and of the Nigeria Sanctions List, immediately identify and freeze, without prior notice, all funds, assets and any other economic resources belonging to the designated person or entity in your possession, and report the freeze to the Sanctions Committee (section 54(1)(a)). "Immediately" means not later than 24 hours (section 54(5)).
Type Definition Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Terrorism (Prevention and Prohibition) Act 2022, immediate freezing of the funds of designated persons and monitoring of accounts against the sanctions lists, Terrorism (Prevention and Prohibition) Act, 2022, ss. 54 and 61 Source as of ai:ng-terrorism-prevention-prohibition-2022-ss-54-6:0

United States

Do not intentionally access without authorization a facility through which an electronic communication service is provided, or intentionally exceed an authorization to access that facility, and thereby obtain, alter or prevent authorized access to a wire or electronic communication while it is in electronic storage in that system (18 U.S.C. § 2701(a)).
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Location of the counterparty's machine Runtime not yet classified
Stored Communications Act (unlawful access to stored communications), 18 U.S.C. § 2701 Source as of scraping:us-18-u-s-c-2701:0

783 more lines in force in this class, and 831 lines in all, are in the law library, each on the summary page of its instrument.

Tell somebody when there is a breach

657 lines 596 in force 153 provisions 120 jurisdictions by type: conditional obligation 334, mandatory obligation 269, prohibition 24, definition 14, consequence (penalty or remedy) 10, recommendation/guidance 6

Sample requirement lines Show 14 of the 596 lines in forceHide the sample

What follows is a sample of 14 requirement lines from the law library, chosen to span jurisdictions.

European Union

This Directive is addressed to the Member States (Article 21), which had to adopt and publish the measures necessary to comply with Directive 2009/136/EC, the amending Directive that added the breach notification paragraphs to Article 4, by (Article 4(1) of that Directive), so a provider meets these rules through each Member State's national law.
Type Mandatory Obligation Modal may Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not yet classified Hook Residence of the affected person Runtime not yet classified
ePrivacy Directive, Article 4(3) to (5), Personal Data Breach Notification, Directive 2002/58/EC, Art. 4(3)-(5) Source as of privacy:eu-2002-58-ec-4-3-5:0

California

Notify affected California residents of a breach of their unencrypted personal information within 30 calendar days of discovery or notification.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the affected person Runtime Evidenced by the runtime's record
California Data Breach Notification Law, as amended by SB 446, Cal. Civ. Code section 1798.82, as amended by SB 446 (2025, Ch. 319) Source as of privacy:us-ca-cal-civ-1798-82-as-amended-by-sb-446-2025:0

United Kingdom

Establish and document a lawful basis under UK GDPR Article 6 before processing any personal data of a person in the United Kingdom, including the new closed-list recognised legitimate interests basis where it applies.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
UK GDPR and Data Protection Act 2018, as Amended by the Data (Use and Access) Act 2025, Data Protection Act 2018 (c. 12); UK GDPR, as amended by the Data (Use and Access) Act 2025, c. 18 Source as of privacy:gb-data-protection-2018-c-12-uk-gdpr-as-amended:0

Brazil

Notify the ANPD and the affected data subjects of a security incident that may create relevant risk or harm to data subjects, within the reasonable period the ANPD sets by regulation, and state the reasons for the delay when the notice is not immediate.
Type Conditional Obligation Modal may Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the affected person Runtime not yet classified
LGPD, security incident notification, Lei nº 13.709, de 2018 (LGPD), art. 48 (security incident notification) Source as of privacy:br-lei-n-13-709-de-2018-lgpd-48-security-inciden:0

Vietnam

As a deployer or user, record a serious incident promptly, take the measures needed to limit its consequences and notify the provider; as a provider, apply the technical measures needed to prevent, limit and remedy it.
Type Mandatory Obligation Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Decree implementing the AI Law, serious incident reporting and handling, Decree No. 142/2026/ND-CP, art. 19 Source as of ai:vn-decree-no-142-2026-nd-cp-19:0

Ireland

Notify the Data Protection Commission without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Ireland, unless the breach is unlikely to risk their rights and freedoms.
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the affected person Runtime Evidenced by the runtime's record
GDPR Articles 33-34, Breach Notification in Ireland, Regulation (EU) 2016/679, Arts. 33-34 Source as of privacy:ie-eu-2016-679-33-34:0

Netherlands

If you provide a public electronic communications service, notify the Autoriteit persoonsgegevens without delay of a security breach that adversely affects personal data processed in connection with the service in the European Union (Telecommunicatiewet Article 11.3a, paragraph 1).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the affected person Runtime not yet classified
Telecommunicatiewet Article 11.3a, Personal Data Breach Notification by Electronic Communications Providers, Telecommunicatiewet, Art. 11.3a Source as of privacy:nl-telecommunicatiewet-11-3a:0

Illinois

Notify affected Illinois residents of a data breach in the most expedient time possible and without unreasonable delay after discovering unauthorized acquisition of their computerized personal information, which includes unique biometric data used to authenticate an individual.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the affected person Runtime Evidenced by the runtime's record
Personal Information Protection Act, data breach notification, 815 ILCS 530/1 et seq. (P.A. 94-36, eff. ) Source as of privacy:us-il-815-ilcs-530-1-et-seq-p-94-36-eff-2006-01:0

Utah

This section binds a governmental entity and its contractor; the notice to the Utah Cyber Center and the Attorney General under section 63A-19-405 is a separate duty.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the affected person Runtime not yet classified
Government Data Privacy Act, data breach notice to affected individuals, Utah Code 63A-19-406 Source as of privacy:us-ut-utah-63a-19-406:0

Peru

Notify the Autoridad Nacional de Protección de Datos Personales within 48 hours of learning of a personal-data security incident that exposes large volumes of data, may affect a large number of people, involves sensitive data or clearly harms other rights of the data subject, and give the reasons and supporting evidence where the notice comes later than 48 hours.
Type Conditional Obligation Modal may Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the affected person Runtime not yet classified
Reglamento de la Ley 29733 (Decreto Supremo 016-2024-JUS), security incidents and access records, Decreto Supremo No. 016-2024-JUS, Reglamento de la Ley No. 29733, Ley de Protección de Datos Personales, arts. 34-36 and 46 (security-incident notice and documentation; records of interactions with personal data) Source as of privacy:pe-decreto-supremo-no-016-2024-jus-reglamento-de:0

South Africa

Notify the Information Regulator of a security compromise as soon as reasonably possible after discovering that personal information has been accessed or acquired by an unauthorised person; the Act sets no fixed hour or day limit, only this standard.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the affected person Runtime not yet classified
Protection of Personal Information Act, notification of security compromises, POPIA, s. 22 (notification of security compromises) Source as of privacy:za-popia-s-22-notification-security-compromises:0

Nigeria

This binds an Internet Access Service Provider, meaning any entity licensed by the Nigerian Communications Commission that is engaged in the provision of an Internet Access Service in Nigeria (reached by declaring that you provide telecom services).
Type Mandatory Obligation Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not yet classified Hook Residence of the affected person Runtime not yet classified
Internet Code of Practice 2026, data breach notification, Internet Code of Practice 2026, data breach notification (s. 3.4) Source as of privacy:ng-internet-practice-2026-data-breach-notificati:0

United States

If you are a vendor of personal health records (an entity that offers or maintains an electronic record of health information that can draw information from multiple sources and is managed, shared and controlled by or primarily for the individual) or a PHR related entity, notify each affected individual who is a citizen or resident of the United States, in plain language and without unreasonable delay, no later than 60 calendar days after you discover a breach of security of unsecured PHR identifiable health information.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the affected person Runtime not yet classified
FTC Health Breach Notification Rule, 16 CFR Part 318 Source as of privacy:us-16-cfr-part-318:0

Andorra

Notify the Andorran Data Protection Agency of a personal data breach without undue delay and, where possible, within seventy-two hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the affected person Runtime not yet classified
LQPD, personal data breach notification, Llei 29/2021, arts. 36-37 (personal data breach notification) Source as of privacy:ad-llei-29-2021-36-37-personal-data-breach-notif:0

582 more lines in force in this class, and 657 lines in all, are in the law library, each on the summary page of its instrument.

Hold a license or registration

610 lines 525 in force 120 provisions 73 jurisdictions by type: mandatory obligation 291, conditional obligation 204, prohibition 73, definition 27, permission or exemption 7, consequence (penalty or remedy) 4, recommendation/guidance 4

Sample requirement lines Show 14 of the 525 lines in forceHide the sample

What follows is a sample of 14 requirement lines from the law library, chosen to span jurisdictions.

California

Register with the California Privacy Protection Agency on or before January 31 following each year in which you are a data broker (you knowingly collect and sell to third parties the personal information of consumers you have no direct relationship with), and pay the registration fee the Agency sets.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Data broker registration and request metrics (Delete Act), Cal. Civ. Code sections 1798.99.80 to 1798.99.85 Source as of privacy:us-ca-cal-civ-sections-1798-99-80-1798-99-85:0

Texas

If you are a business entity that collects, processes or transfers personal data you did not collect directly from the individual it is linked to, and in a 12-month period you derive more than 50 percent of your revenue directly from processing or transferring such data or derive revenue directly from the personal data of more than 50,000 individuals not collected from them, register with the Texas secretary of state and pay the $300 fee to conduct business in Texas.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Texas data broker registration, website notice and civil penalty, Tex. Bus. & Com. Code secs. 510.001-510.006, 510.008 Source as of privacy:us-tx-tex-bus-com-secs-510-001-510-006-510-008:0

United Kingdom

Pay the annual data protection charge to the Information Commission within the first 21 days of each 12-month charge period, unless all of the personal data processing you do is exempt processing, under regulation 2(2) of the Data Protection (Charges and Information) Regulations 2018.
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject; establishment of the operator Runtime not yet classified
Data Protection (Charges and Information) Regulations 2018, Annual Charge and Information Duty for Data Controllers, Data Protection (Charges and Information) Regulations 2018 (S.I. 2018/480), regs. 2-3; Data Protection Act 2018, ss. 137, 158 Source as of privacy:gb-data-protection-charges-information-regulatio:0

Brazil

Do not reproduce, translate, adapt, reorganize, distribute, or communicate to the public a database whose selection, organization, or arrangement of content is an intellectual creation, without the rightsholder's authorization.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder) Runtime Enforceable at a runtime control
Copyright Law, Database Compilation Right, Lei nº 9.610/1998, arts. 7º, XIII, e 87 Source as of scraping:br-lei-n-9-610-1998-7-xiii-e-87:0

South Africa

Before transferring personal information outside South Africa, confirm the recipient country, its binding rules, or an agreement provides an adequate level of protection substantially similar to the Act's conditions, or that another listed transfer ground, such as the data subject's consent, applies.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Destination of a transfer Runtime not yet classified
Protection of Personal Information Act, cross-border transfer, POPIA, s. 72 (transfer of personal information outside the Republic) Source as of privacy:za-popia-s-72-transfer-personal-information-outs:0

Nigeria

It reaches you if you carry on insurtech business in Nigeria, whether as a standalone insurtech that offers insurance products or services directly to consumers or as a partnering insurtech that collaborates with insurance institutions, or if you are an insurance institution that partners with an insurtech (paragraphs 1.2, 2.1 and 13.3). Do not commence or carry on any class of insurtech business without being registered or authorized by the Commission (paragraph 1.2).
Type Conditional Obligation Modal do not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
National Insurance Commission Guidelines for Insurtech Operations in Nigeria, licensing, technology security, lead management and limits on automated claims rejection, Guidelines for Insurtech Operations in Nigeria, August 2025 Source as of ai:ng-guidelines-insurtech-operations-in-nigeria-au:0

United States

This provision sets no duty of its own: it removes five kinds of software function from the definition of device in section 201(h), and a software function that meets the definition and falls outside those exclusions is a device under the Federal Food, Drug, and Cosmetic Act.
Type Definition Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
FD&C Act section 520(o), software functions excluded from the device definition, with section 201(h), 21 U.S.C. § 360j(o), read with 21 U.S.C. § 321(h) Source as of ai:us-21-u-s-c-360j-o-read-with-21-u-s-c-321-h:0

Angola

Obtain the data subject's unequivocal, express consent before processing their personal data, or notify the Agência de Protecção de Dados, unless a contract-performance, legal-obligation, vital-interest, public-interest, or legitimate-interest ground applies.
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Enforceable at a runtime control
Law on the Protection of Personal Data, Lei n.º 22/11, de 17 de Junho de 2011 (Protecção de Dados Pessoais), arts. 1-12, 16, 18-24, 30-32, 35-43 and 63-67 Source as of privacy:ao-lei-n-22-11-de-17-de-junho-de-2011-protec-o-d:0

Azerbaijan

An app processing the personal data of a person in Azerbaijan must be prepared to answer to the relevant executive authority's compliance checks; Art. 19's own liability provision is a bare reference to other Azerbaijani law with no fine amounts stated in this Act, and an aggrieved person may separately sue in court for moral and material damage under Art. 7.4, but only on proof of the damage suffered.
Type Consequence (penalty or remedy) Modal must, may Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook Establishment of the operator Runtime not a duty
Law on Personal Data, enforcement and liability, Law of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ, Arts. 7.4, 17, 19 Source as of privacy:az-republic-azerbaijan-personal-data-no-998-ii-6:0

Bosnia and Herzegovina

Do not reproduce, distribute, make available to the public, or otherwise communicate the whole or a substantial part of a database whose making required a qualitatively or quantitatively substantial investment, without the producer's authorization.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder) Runtime Enforceable at a runtime control
Law on Copyright and Related Rights, Rights of Database Producers, Law on Copyright and Related Rights, arts. 141-146 (Rights of Database Producers), Official Gazette of BiH No. 63/10, 86/10 Source as of scraping:ba-copyright-related-rights-141-146-rights-datab:0

Burkina Faso

Before transferring personal data to a foreign country or an international organization, confirm that it assures a level of protection adequate to the protection Burkina Faso itself assures for privacy, fundamental freedoms and rights.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Destination of a transfer Runtime not yet classified
Personal Data Protection Law, cross-border transfer of personal data, Loi n°001-2021/AN, arts. 31, 42-44 (transfert de données hors du Burkina Faso) Source as of privacy:bf-loi-n-001-2021-31-42-44-transfert-de-donn-es:0

Benin

Obtain a lawful basis, ordinarily the data subject's consent, before collecting, processing, transmitting, storing, or using their personal data, unless a specific legal exception applies.
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Enforceable at a runtime control
Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Loi n°2017-20 du 20 avril 2018, Livre V, Protection des Données à Caractère Personnelle, portant Code du Numérique en République du Bénin, arts. 379-390, 393, 405-414, 424-426 et 428-436 (principes généraux, licité et obligations des responsables de traitement) Source as of privacy:bj-loi-n-2017-20-du-20-avril-2018-livre-v-protec:0

Bermuda

Do not extract or re-utilise all or a substantial part of the contents of a database that reflects substantial investment in obtaining, verifying or presenting its contents, without the database right owner's authorisation, unless a statutory exception applies.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder) Runtime Enforceable at a runtime control
Copyright and Designs Act 2004, database right, Copyright and Designs Act 2004 (Bermuda), 2004:5, Part V (database right) Source as of scraping:bm-copyright-designs-2004-bermuda-2004-5-databa:0

Botswana

Treat a database compiled through the selection, coordination, or arrangement of its contents as a protected literary work: do not reproduce the whole or a substantial part of it without the rights holder's authorisation, even though the underlying facts and data are not themselves protected.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder) Runtime Enforceable at a runtime control
Copyright and Neighbouring Rights Act, 2000 (Cap. 68:02), Database Protection, Copyright and Neighbouring Rights Act 2000, Database Protection Source as of scraping:bw-copyright-neighbouring-rights-2000-database-p:0

511 more lines in force in this class, and 610 lines in all, are in the law library, each on the summary page of its instrument.

Assess the impact on personal data first

510 lines 401 in force 90 provisions 59 jurisdictions by type: mandatory obligation 279, conditional obligation 192, prohibition 18, definition 16, permission or exemption 3, recommendation/guidance 2

Sample requirement lines Show 14 of the 401 lines in forceHide the sample

What follows is a sample of 14 requirement lines from the law library, chosen to span jurisdictions.

European Union

Classify software intended to provide information which is used to take decisions with diagnosis or therapeutic purposes as class IIa under Rule 11 (Annex VIII, point 6.3), as class III if such decisions have an impact that may cause death or an irreversible deterioration of a person's state of health, and as class IIb if they may cause a serious deterioration of a person's state of health or a surgical intervention.
Type Conditional Obligation Modal may Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Medical Device Regulation, Annex VIII Rule 11 (classification of software) with Article 52 (conformity assessment by class), Regulation (EU) 2017/745, Annex VIII, Chapter III, Rule 11 Source as of ai:eu-2017-745-annex-viii-chapter-iii-rule-11:0

California

If you use automated decisionmaking technology (ADMT) to make a significant decision about a consumer (granting or denying financial or lending services, housing, education enrollment or opportunities, employment or independent-contracting opportunities or compensation, or healthcare services), give the consumer a Pre-use Notice describing that use and the consumer's rights to opt out of and access information about it
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Detectable at a runtime control
CCPA Automated Decisionmaking Technology Regulations, Cal. Code Regs. tit. 11, Sections 7200 to 7222 Source as of ai:us-ca-11-cal-regs-sections-7200-7222:0

Colorado

Establish a documented, risk-based governance and risk management framework, including a cross-functional governance group drawing on legal, compliance, risk management, product development, underwriting, actuarial, data science, marketing, and customer service, designed to determine through quantitative testing whether your use of an external consumer data and information source, or an algorithm or predictive model that uses one, results in unfair discrimination with respect to race, and to remediate any discrimination detected.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, 3 CCR 702-10, Regulation 10-1-1 Source as of ai:us-co-3-ccr-702-10-10-1-1:0

United Kingdom

Establish and document a lawful basis under UK GDPR Article 6 before processing any personal data of a person in the United Kingdom, including the new closed-list recognised legitimate interests basis where it applies.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
UK GDPR and Data Protection Act 2018, as Amended by the Data (Use and Access) Act 2025, Data Protection Act 2018 (c. 12); UK GDPR, as amended by the Data (Use and Access) Act 2025, c. 18 Source as of privacy:gb-data-protection-2018-c-12-uk-gdpr-as-amended:0

Brazil

Establish a lawful basis under article 7 before processing personal data, including data the person has made public.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
Lei Geral de Proteção de Dados Pessoais (LGPD), Lei nº 13.709, de 14 de agosto de 2018 (LGPD), arts. 1º-10, 15-16, 23-32, 37-41, 46-47, 49-51 (general regime, principles, lawful basis, public-sector processing, agents and governance) Source as of privacy:br-lei-n-13-709-de-14-de-agosto-de-2018-lgpd:0

Vietnam

Classify your AI system's risk level (high, medium, or low) before putting it into service, based on its potential impact on rights, safety, security, and public interest, and the scale and context of its use.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Operator Hook Establishment of the operator; placing on the market; where the output is used Runtime Outside any runtime path
Law on Artificial Intelligence, risk classification and conformity assessment, Law No. 134/2025/QH15, arts. 9-10, 13-14 Source as of ai:vn-no-134-2025-qh15-9-10-13-14:0

Ireland

If you process personal data for health research in Ireland, take the safeguards listed in Regulation 3(1) of the Health Research Regulations 2018, including ethical approval of the research by a research ethics committee and controls to log who consulted, altered, disclosed or erased the personal data.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018, Safeguards and Explicit Consent for Health Research in Ireland, Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018 (S.I. No. 314 of 2018), regs. 3, 3A and 5, as amended by S.I. No. 18 of 2021 Source as of privacy:ie-data-protection-2018-36-2-health-research-reg:0

Italy

This article binds the police forces and the Ministry of the Interior as controller, and lets the operators of places and the organisers of events install and maintain the systems at no cost to public finances (art. 10).
Type Mandatory Obligation Modal imperative Binds, by its wording Controller (the party that decides why and how personal data is processed) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), D.Lgs. 9 settembre 2026, n. 160, art. 10 Source as of ai:it-d-lgs-9-settembre-2026-n-160-10:0

Nigeria

It reaches you if you are a financial institution as section 30 of the Act defines the term, or a designated non-financial business or profession. Identify each customer, whether permanent or occasional, natural or legal person or any other form of legal arrangement, using the identification documents prescribed in any relevant regulation, and verify the customer's identity using reliable, independent source documents, data or information (section 4(1)(a) and (b)).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Money Laundering (Prevention and Prohibition) Act 2022, customer due diligence, record retention and risk assessment of new technologies, Money Laundering (Prevention and Prohibition) Act, 2022, ss. 4, 8 and 13 Source as of ai:ng-money-laundering-prevention-prohibition-202-2:0

United States

This rule binds the covered entity that uses a patient care decision support tool (a recipient of Federal financial assistance, the Department of Health and Human Services, or an entity established under title I of the Affordable Care Act), not the developer that supplies the tool; a developer's own duties for predictive decision support interventions sit in a separate rule of the Office of the National Coordinator for Health Information Technology.
Type Mandatory Obligation Modal imperative Binds, by its wording Developer, distributor or importer Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Section 1557 final rule, nondiscrimination in the use of patient care decision support tools, 45 CFR § 92.210 Source as of ai:us-45-cfr-92-210:0

Andorra

Establish a lawful basis under Article 6 before processing personal data of a person in Andorra, and apply the Article 5 principles of lawfulness, purpose limitation, data minimisation, accuracy, storage limitation and security throughout.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the data subject; establishment of the operator Runtime reworded since it was classified
LQPD, Llei 29/2021 del 28 d'octubre, LQPD, Llei 29/2021 del 28 d'octubre, arts. 1-2, 4-7, 11-14, 27-35, 38-41 (general provisions, lawful basis, controller and processor obligations, DPIA, the Data Protection Officer, and other general processing rules) Source as of privacy:ad-llei-qualificada-de-proteccio-de-dades-person:0

Albania

Establish one of the lawful bases Article 7 lists, such as the data subject's consent, contractual necessity, a legal obligation, vital interests, a public task, or a legitimate interest that does not override the data subject's rights, before processing personal data of a person in Albania.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the data subject; establishment of the operator Runtime reworded since it was classified
Law No. 124/2024 On the Protection of Personal Data, Law No. 124/2024 (Ligj Nr. 124/2024) On the Protection of Personal Data, Arts. 1-8, 11, 22-38, 43-46 (general provisions, lawful basis, consent, controller and processor obligations, and specific-purpose exceptions), in force Source as of privacy:al-no-124-2024-ligj-nr-124-2024-protection-perso:0

Bosnia and Herzegovina

Establish a lawful basis under Article 8 before processing personal data of a person in Bosnia and Herzegovina, and appoint a Data Protection Officer under Articles 39 to 41 wherever the processing meets the threshold the Act sets, such as processing carried out by a public authority or large-scale monitoring or special-category processing.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the data subject; establishment of the operator Runtime reworded since it was classified
Law on the Protection of Personal Data of Bosnia and Herzegovina, Law on the Protection of Personal Data, Official Gazette of Bosnia and Herzegovina No. 12/25, applicable , arts. 1-9, 13, 26-34, 37-45, 52-65 (excluding 57a-57b), 75-85, 88-90 (general provisions, lawful basis, controller and processor duties, security, DPIA, DPO) Source as of privacy:ba-protection-personal-data-official-gazette-bos:0

Barbados

Before processing personal data, establish a lawful basis and confine processing to the stated purpose.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
Data Protection Act, 2019, Data Protection Act, 2019 (Act 2019-29), ss. 1-7, 29-62, 65-69 and 96-100 Source as of privacy:bb-2019-29-data-protection-2019:0

387 more lines in force in this class, and 510 lines in all, are in the law library, each on the summary page of its instrument.

Conditions on sending data abroad

414 lines 376 in force 135 provisions 106 jurisdictions by type: mandatory obligation 228, conditional obligation 134, prohibition 45, recommendation/guidance 4, permission or exemption 1, definition 1, consequence (penalty or remedy) 1

Sample requirement lines Show 14 of the 376 lines in forceHide the sample

What follows is a sample of 14 requirement lines from the law library, chosen to span jurisdictions.

European Union

Establish and document a lawful basis under Article 6 before processing any personal data of a person in the EU.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
General Data Protection Regulation (GDPR), Comprehensive Regime, Regulation (EU) 2016/679 Source as of privacy:eu-2016-679:0

Texas

If you are a covered entity under Health and Safety Code chapter 181 or a health care practitioner, ensure that electronic health records under your control that contain patient information are physically maintained in the United States or a territory of the United States, including records held by a third-party or subcontracted computing facility or cloud computing service (Tex. Health & Safety Code sec. 183.002(a)).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Destination of a transfer Runtime not yet classified
Texas electronic health records: storage in the United States, access limits and safeguards, Tex. Health & Safety Code sec. 183.002 Source as of privacy:us-tx-tex-health-safety-sec-183-002:0

United Kingdom

Establish and document a lawful basis under UK GDPR Article 6 before processing any personal data of a person in the United Kingdom, including the new closed-list recognised legitimate interests basis where it applies.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
UK GDPR and Data Protection Act 2018, as Amended by the Data (Use and Access) Act 2025, Data Protection Act 2018 (c. 12); UK GDPR, as amended by the Data (Use and Access) Act 2025, c. 18 Source as of privacy:gb-data-protection-2018-c-12-uk-gdpr-as-amended:0

Brazil

Transfer personal data outside Brazil only to a country or organization with an adequate level of protection, or under contractual clauses, corporate rules, or another article 33 safeguard.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Destination of a transfer Runtime not yet classified
LGPD, international transfer of data, Lei nº 13.709, de 2018 (LGPD), arts. 33-36 (international transfer of data) Source as of privacy:br-lei-n-13-709-de-2018-lgpd-33-36-international:0

Vietnam

Prepare and keep a personal data processing impact assessment dossier at the enterprise's premises before processing personal data, and send one original to the Department of Cybersecurity and High-Tech Crime Prevention of the Ministry of Public Security within 60 days of the first day of processing.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator Runtime not yet classified
Decree on administrative sanctions for personal data protection violations, Decree No. 330/2026/ND-CP of , personal data protection sanctions (Chapter II, Section 6, Articles 39 to 71) Source as of privacy:vn-decree-no-330-2026-nd-cp-19-august-2026-perso:0

Ireland

Rely on a European Commission adequacy decision, Standard Contractual Clauses with a transfer impact assessment, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Ireland outside the European Economic Area.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Destination of a transfer Runtime Enforceable at a runtime control
GDPR Chapter V, Cross-Border Transfer of Personal Data from Ireland, Regulation (EU) 2016/679, Arts. 44-49 Source as of privacy:ie-eu-2016-679-44-49:0

France

If you are a State administration, a State operator listed in the annex to the finance bill, or a public-interest grouping that includes them, and you use a cloud computing service supplied by a private provider to run IT systems or applications, observe Article 31 of Law 2024-449.
Type Conditional Obligation Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not yet classified Hook Establishment of the operator (entity in scope) Runtime not yet classified
Loi n° 2024-449 (SREN), Security Criteria for State Use of Private Cloud Services Holding Sensitive Data, Article 31, Loi n° 2024-449 du 21 mai 2024 visant à sécuriser et à réguler l'espace numérique Source as of security:fr-31-loi-n-2024-449-du-21-mai-2024-visant-secur:0

Peru

Before a cross-border transfer of personal data, confirm the destination country maintains an adequate level of protection under the Law, or, where it does not, guarantee as the sender that the processing will comply with the Law.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Destination of a transfer Runtime not yet classified
Ley 29733, cross-border transfer of personal data, Ley No. 29733, arts. 11, 15 (cross-border transfer) Source as of privacy:pe-ley-no-29733-11-15-cross-border-transfer:0

South Africa

Before transferring personal information outside South Africa, confirm the recipient country, its binding rules, or an agreement provides an adequate level of protection substantially similar to the Act's conditions, or that another listed transfer ground, such as the data subject's consent, applies.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Destination of a transfer Runtime not yet classified
Protection of Personal Information Act, cross-border transfer, POPIA, s. 72 (transfer of personal information outside the Republic) Source as of privacy:za-popia-s-72-transfer-personal-information-outs:0

Nigeria

Capture BVN data properly, including data captured by your agents, and validate it before you link it to a customer's account or wallet, except Tier 1; link every operated account or wallet, except Tier 1, to the signatories' BVNs within 24 hours of NIBSS making the BVN available, and link the BVNs of all signatories, Directors and beneficial owners to non-individual accounts or wallets (clause 1.5.3(i), (ii) and (iv)).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Central Bank of Nigeria Regulatory Framework for Bank Verification Number (BVN) Operations and Watch-list for the Nigerian Banking Industry (revised October 2021), Central Bank of Nigeria, Revised Regulatory Framework for Bank Verification Number (BVN) Operations and Watch-list for the Nigerian Banking Industry (October 2021) Source as of privacy:ng-central-bank-nigeria-revised-regulatory-frame:0

United States

Do not engage in a prohibited bulk data-brokerage transaction involving bulk U.S. sensitive personal data, including biometric identifiers such as facial images or voice prints, or government-related data, with a country of concern or covered person.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Destination of a transfer Runtime Enforceable at a runtime control
DOJ Data Security Program (Bulk Sensitive Personal Data Rule), 28 CFR Part 202 Source as of privacy:us-28-cfr-part-202:0

Andorra

Before transferring personal data to a country or international organisation outside Andorra, confirm the destination offers an adequate level of protection under Article 43, or put appropriate safeguards in place under Article 44, such as standard data-protection clauses or binding corporate rules.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Destination of a transfer Runtime not yet classified
LQPD, transfers of personal data to third countries or international organisations, Llei 29/2021, arts. 42-45 (transfers of personal data to third countries or international organisations) Source as of privacy:ad-llei-29-2021-42-45-transfers-personal-data-th:0

Albania

Transfer personal data outside Albania only where the destination country, territory, sector or international organization has been found by the Commissioner to ensure an adequate level of protection, or where you provide an appropriate safeguard such as binding company rules, standard contractual clauses, or a Commissioner approved code of conduct or certification mechanism.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Destination of a transfer Runtime not yet classified
Law No. 124/2024, international data transfer, Law No. 124/2024, Arts. 39-42 (international data transfer) Source as of privacy:al-no-124-2024-39-42-international-data-transfer:0

Angola

Notify the Agência de Protecção de Dados before transferring personal data to a country that ensures a level of protection at least equal to this law's, and expect the APD to assess adequacy by the nature, purpose and duration of the processing, the destination country and the legal, professional and security rules in force there.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Destination of a transfer Runtime not yet classified
Law on the Protection of Personal Data, cross border transfer, Lei n.º 22/11, de 17 de Junho de 2011, arts. 33-34 (transferência internacional de dados) Source as of privacy:ao-lei-n-22-11-de-17-de-junho-de-2011-33-34-tran:0

362 more lines in force in this class, and 414 lines in all, are in the law library, each on the summary page of its instrument.

Limits on biometric use

390 lines 338 in force 97 provisions 80 jurisdictions by type: mandatory obligation 175, conditional obligation 108, prohibition 90, definition 9, consequence (penalty or remedy) 4, permission or exemption 3, recommendation/guidance 1

Sample requirement lines Show 14 of the 338 lines in forceHide the sample

What follows is a sample of 14 requirement lines from the law library, chosen to span jurisdictions.

European Union

Obtain explicit consent, or establish another Article 9(2) basis, before capturing or storing a faceprint, voiceprint, or other biometric identifier derived from a photo, video, or audio recording, whether or not the source recording itself was publicly available.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject Runtime Enforceable at a runtime control
GDPR Article 9, Special Categories of Personal Data, Regulation (EU) 2016/679, Art. 9 Source as of privacy:eu-2016-679-9:0

California

Treat any faceprint or voiceprint your app captures, stores, or derives from a California consumer, including one extracted from a photo, video, or audio recording, as CCPA sensitive personal information.
Type Definition Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook Residence of the data subject Runtime not a duty
CCPA/CPRA sensitive personal information categories and biometric information definition, Cal. Civ. Code section 1798.140(c), (ae); section 1798.121 Source as of privacy:us-ca-cal-civ-1798-140-c-ae-1798-121:0

Colorado

Treat an opt-out request received through a Universal Opt-Out Mechanism as a valid request to opt out of targeted advertising, the sale of personal data, or both, and be capable of recognizing each mechanism on the Department of Law's public list once you have had at least six months' notice of it (Rule 5.08).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject; establishment of the operator Runtime not yet classified
Colorado Privacy Act Rules (Attorney General), 4 CCR 904-3 Source as of privacy:us-co-4-ccr-904-3:0

United Kingdom

Obtain explicit consent, or establish another UK GDPR Article 9(2) or Data Protection Act 2018 Schedule 1 basis, before capturing or storing a faceprint, voiceprint, or other biometric identifier derived from a photo, video, or audio recording, whether or not the source recording itself was publicly available.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject Runtime Enforceable at a runtime control
UK GDPR Article 9, Special Categories of Personal Data Including Biometric Data, UK GDPR, Art. 9; Data Protection Act 2018, Sch. 1 Source as of privacy:gb-uk-gdpr-9-data-protection-2018-sch-1:0

Brazil

Obtain specific, highlighted consent, or another article 11 legal basis, before processing sensitive personal data such as health, genetic, or biometric data.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
LGPD, sensitive personal data and children's data, Lei nº 13.709, de 2018 (LGPD), arts. 5º, II, 11-14 (sensitive personal data and children's data) Source as of privacy:br-lei-n-13-709-de-2018-lgpd-5-ii-11-14-sensitiv:0

Ireland

Where you process special category data, including biometric data, about an employee in Ireland on the ground that employment or social welfare law gives you or the employee a right or obligation, take suitable and specific measures to safeguard the employee's fundamental rights and freedoms, under Data Protection Act 2018 Section 46.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the data subject Runtime reworded since it was classified
GDPR Article 9 and Data Protection Act 2018 Section 46, Special Categories of Personal Data in Employment and Social Welfare Law in Ireland, Regulation (EU) 2016/679, Art. 9; Data Protection Act 2018 §46 Source as of privacy:ie-eu-2016-679-9-data-protection-2018-46:0

Italy

This article binds the police forces and the Ministry of the Interior as controller, and lets the operators of places and the organisers of events install and maintain the systems at no cost to public finances (art. 10).
Type Mandatory Obligation Modal imperative Binds, by its wording Controller (the party that decides why and how personal data is processed) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10), D.Lgs. 9 settembre 2026, n. 160, art. 10 Source as of ai:it-d-lgs-9-settembre-2026-n-160-10:0

Illinois

Obtain a written release, including informed consent or an accepted electronic signature, before collecting or capturing any retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, after disclosing in writing the specific purpose and length of time the data will be collected, stored, and used.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject Runtime Enforceable at a runtime control
Biometric Information Privacy Act (BIPA), 740 ILCS 14/1, 14/5, 14/10, 14/15, 14/25 (P.A. 95-994, eff. , as amended by P.A. 103-0769, eff. ) Source as of privacy:us-il-740-ilcs-14-1-14-5-14-10-14-15-14-25:0

Utah

This chapter binds a Utah government entity, a term that includes an individual acting as an agent of, or on behalf of, a government entity.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Government Use of Facial Recognition Technology, Utah Code 77-23e-101 et seq. Source as of privacy:us-ut-utah-77-23e-101-et-seq:0

Peru

Do not use an AI-based system to influence a person's decision-making in a deceptive or manipulative way, including through subliminal techniques or by exploiting cognitive, emotional, or socioeconomic vulnerabilities to substantially alter their behavior.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Detectable at a runtime control
Reglamento de la Ley 31814, prohibited AI uses, Decreto Supremo 115-2025-PCM, arts. 22-23 (Reglamento de la Ley 31814, Clasificación de Riesgos: Uso Indebido) Source as of ai:pe-decreto-supremo-115-2025-pcm-22-23-reglamento:0

South Africa

Do not process special personal information, including a person's biometric information, health, race, or political persuasion, unless a listed ground under sections 27 to 33 applies.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Protection of Personal Information Act, special personal information and children, POPIA, ss. 26-35 (special personal information and children) Source as of privacy:za-popia-ss-26-35-special-personal-information-c:0

Nigeria

Capture BVN data properly, including data captured by your agents, and validate it before you link it to a customer's account or wallet, except Tier 1; link every operated account or wallet, except Tier 1, to the signatories' BVNs within 24 hours of NIBSS making the BVN available, and link the BVNs of all signatories, Directors and beneficial owners to non-individual accounts or wallets (clause 1.5.3(i), (ii) and (iv)).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Central Bank of Nigeria Regulatory Framework for Bank Verification Number (BVN) Operations and Watch-list for the Nigerian Banking Industry (revised October 2021), Central Bank of Nigeria, Revised Regulatory Framework for Bank Verification Number (BVN) Operations and Watch-list for the Nigerian Banking Industry (October 2021) Source as of privacy:ng-central-bank-nigeria-revised-regulatory-frame:0

Andorra

Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union affiliation, or process genetic data, biometric data used to uniquely identify a person, health data, or data about sex life or sexual orientation, unless a listed Article 9(2) exception applies, most commonly the data subject's explicit consent.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
LQPD, special categories, children and criminal-offence data, Llei 29/2021, arts. 8-10 (special categories, children and criminal-offence data) Source as of privacy:ad-llei-29-2021-8-10-special-categories-children:0

Albania

Do not process sensitive data, meaning racial or ethnic origin, political opinions, religious or philosophical belief, trade union membership, genetic data, biometric data, health records, or sexual orientation, unless a listed exception applies, such as the data subject's explicit consent to a specified purpose.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Law No. 124/2024, special categories of personal data, criminal records and children's data, Law No. 124/2024, Arts. 8(6), 9, 10 (special categories, criminal records and children's data) Source as of privacy:al-no-124-2024-8-6-9-10-special-categories-crimi:0

324 more lines in force in this class, and 390 lines in all, are in the law library, each on the summary page of its instrument.

Label generated content

236 lines 151 in force 69 provisions 48 jurisdictions by type: mandatory obligation 82, conditional obligation 78, prohibition 32, permission or exemption 18, definition 16, consequence (penalty or remedy) 10

Sample requirement lines Show 13 of the 151 lines in forceHide the sample

What follows is a sample of 13 requirement lines from the law library, chosen to span jurisdictions.

European Union

This is one listed risk-mitigation measure for a Commission-designated very large online platform or search engine, not a freestanding labeling mandate on every provider
Type Definition Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not a duty Hook Where the output is used; placing on the market Runtime not a duty
Digital Services Act, Article 35(1)(k) (systemic risk mitigation, synthetic media marking), Regulation (EU) 2022/2065, Article 35(1)(k) Source as of ai:eu-2022-2065-35-1-k:0

California

Make available, at no cost to the user, a disclosure verification tool that lets a user assess whether image, video, or audio content was created or altered, other than by a minor modification, by your generative AI system and that outputs any system provenance data detected in the content
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Where the output is used; placing on the market Runtime reworded since it was classified
California AI Transparency Act (SB 942, as amended by AB 853, SB 1000 and AB 2713), Cal. Bus. and Prof. Code Sections 22757 to 22757.6 Source as of ai:us-ca-cal-bus-prof-sections-22757-22757-6:0

Colorado

Carry a clear and conspicuous disclosure that the communication has been edited and falsely appears authentic, when you distribute, publish, broadcast, or display a communication about a candidate that includes a deepfake
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Where the output is used; placing on the market Runtime Detectable at a runtime control
HB 24-1147, Candidate Election Deepfake Disclosures, C.R.S. 1-46-103 Source as of ai:us-co-c-r-s-1-46-103:0

Brazil

Disclose, explicitly, prominently, and accessibly, when electoral advertising uses synthetic content generated by AI or equivalent technology to create, replace, omit, merge, alter the speed of, or overlay images or sounds, and name the technology used.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Where the output is used; placing on the market Runtime reworded since it was classified
TSE Resolution, AI-Generated Content Disclosure Duty, Resolução TSE nº 23.610/2019, art. 9º-B (redação dada pela Resolução TSE nº 23.732, de 27 de fevereiro de 2024) Source as of ai:br-resolu-o-tse-n-23-610-2019-9-b-reda-o-dada-pe:0

Vietnam

Give information on your AI system's purpose of use, scope, conditions of use and limits, keep the information and documents needed for inspection and supervision, and explain yourself when the competent state agency asks in writing.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Where the output is used; placing on the market Runtime not yet classified
Decree implementing the AI Law, transparency, technical marking and labeling of AI-generated content, Decree No. 142/2026/ND-CP, arts. 16-18 Source as of ai:vn-decree-no-142-2026-nd-cp-16-18:0

France

If you are a commercial influencer within Article 1, label content that includes images produced by an artificial intelligence process meant to depict a face or a silhouette with the words “Images virtuelles” (Article 5(I), point 2).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Where the output is used; placing on the market Runtime not yet classified
Law 2023-451, Article 5, Labelling of Retouched and AI-Generated Images by Commercial Influencers, Loi n° 2023-451 du 9 juin 2023 visant à encadrer l'influence commerciale et à lutter contre les dérives des influenceurs sur les réseaux sociaux, art. 5 Source as of ai:fr-loi-n-2023-451-du-9-juin-2023-visant-encadrer:0

New York

Disclose, in the format this section specifies, when you distribute or publish a political communication produced by or including materially deceptive AI-generated or AI-altered media and you have actual knowledge that it is materially deceptive.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Where the output is used; placing on the market Runtime Detectable at a runtime control
Disclosure of materially deceptive AI-generated media in political communications, N.Y. Election Law § 14-106(5) Source as of ai:us-ny-n-y-election-14-106-5:0

Gabon

Do not circulate a realistic deepfake depicting an identifiable person in a sexual situation without their express consent.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Detectable at a runtime control
Ordonnance n°0011/PR/2026, contenus interdits générés par intelligence artificielle, Ordonnance n°0011/PR/2026, art. 32-33 (contenus IA interdits), du 26 février 2026 portant réglementation de l'usage des réseaux sociaux Source as of ai:ga-ordonnance-n-0011-pr-2026-32-33-contenus-ia-i:0

Greece

Do not remove or interfere with the machine-readable marking your AI system embeds in synthetic audio, image, video, or text output under EU AI Act Article 50(2).
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Where the output is used; placing on the market Runtime reworded since it was classified
Law 5321/2026, National AI Act Implementation Law, Law 5321/2026, arts. 3-5, 16, 23 (FEK A' 114/20.07.2026) Source as of ai:gr-5321-2026-3-5-16-23-fek-114-20-07-2026:0

Croatia

If you are a media service provider, a provider of an electronic publication or a video-sharing platform, label content you publish that has been generated in any way by artificial intelligence (Article 23).
Type Conditional Obligation Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not yet classified Hook Where the output is used; placing on the market Runtime not yet classified
Act Implementing the European Media Freedom Act, Article 23, Labelling of AI-Generated Content, Zakon o provedbi Uredbe (EU) 2024/1083 o uspostavi zajedničkog okvira za medijske usluge na unutarnjem tržištu i izmjeni Direktive 2010/13/EU (Europski akt o slobodi medija), čl. 23 Source as of ai:hr-zakon-o-provedbi-uredbe-eu-2024-1083-o-uspost:0

Israel

If you publish election propaganda for the Twenty-Sixth Knesset election that appears deeply real, meaning content created by digital means, artificial intelligence included, or edited by them so as to change it materially, attach a disclosure stating clearly and prominently that its content was not originally recorded.
Type Definition Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Where the output is used; placing on the market Runtime not yet classified
Elections for the 26th Knesset Law, disclosure on deep fake election propaganda, Elections for the Twenty-Sixth Knesset (Special Provisions and Legislative Amendments) Law, 5786-2026, section 12 (temporary section 2A2 of the Elections (Propaganda Methods) Law, 5719-1959) Source as of ai:il-elections-twenty-sixth-knesset-special-provis:0

Kyrgyzstan

An app that lets a natural person interact with an AI system must tell that person they are dealing with an AI system, unless the interaction is obviously with one.
Type Conditional Obligation Modal must, unless Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Where the output is used; placing on the market Runtime Detectable at a runtime control
Digital Code, Chapter 23: AI interaction and deepfake disclosure duties, Digital Code, Law No. 178 (), in force , Chapter 23, Art. 197 Source as of ai:kg-digital-no-178-197:0

Kazakhstan

Give users full information about an AI system's operational characteristics and limitations, and inform a user subject to an AI-assisted decision of the automated processing, its consequences, and how to object.
Type Conditional Obligation Modal subject to Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Where the output is used; placing on the market Runtime Detectable at a runtime control
Law on Artificial Intelligence, transparency and disclosure duties, Law No. 230-VIII (), Arts. 7, 21 Source as of ai:kz-no-230-viii-17-november-2025-7-21:0

138 more lines in force in this class, and 236 lines in all, are in the law library, each on the summary page of its instrument.

Put the terms in the contract

205 lines 198 in force 49 provisions 33 jurisdictions by type: conditional obligation 87, mandatory obligation 81, prohibition 31, definition 5, recommendation/guidance 1

Sample requirement lines Show 14 of the 198 lines in forceHide the sample

What follows is a sample of 14 requirement lines from the law library, chosen to span jurisdictions.

California

This order directs California state agencies and creates no right or duty enforceable against any person; it reaches you if you seek to do business with the State, through the certifications and contract provisions it asks state departments to recommend and develop (Paragraphs 1 to 4).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
California Executive Order N-5-26 (vendor certifications, supply chain review and contractor responsibility in state AI procurement), Cal. Exec. Order N-5-26 () Source as of ai:us-ca-cal-exec-order-n-5-26-mar-30-2026:0

Germany

Treat a provision in standard terms as ineffective where it unreasonably disadvantages the other party to the user of the terms contrary to the requirements of good faith, including where the provision is not clear and understandable (§ 307 Abs. 1).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook The counterparty's terms, where the site is operated Runtime not yet classified
Inhaltskontrolle Allgemeiner Geschäftsbedingungen (Content Control of Standard Terms), Bürgerliches Gesetzbuch (BGB), § 307 Source as of scraping:de-burgerliches-gesetzbuch-bgb-307:0

Ireland

Expect an unfair term of a consumer contract, such as a term in a website's terms of use, to be not binding on the consumer, while the rest of the contract continues to bind the parties where it can continue without the term (s. 129(1) and (3)).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook The counterparty's terms, where the site is operated Runtime not yet classified
Consumer Rights Act 2022: Unfair Terms in Consumer Contracts, Consumer Rights Act 2022 (No. 37 of 2022), Part 6, ss. 127, 129, 130, 137 and 140 Source as of scraping:ie-consumer-rights-2022-no-37-2022-part-6-ss-127:0

Spain

Obtain the adherent's acceptance of the incorporation of standard terms and the signature of all the contracting parties, and make the contract refer to the standard terms incorporated (art. 5.1).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook The counterparty's terms, where the site is operated Runtime not yet classified
Ley 7/1998 sobre condiciones generales de la contratación, Articles 5, 7 and 8 (Incorporation and Nullity of Standard Terms), Ley 7/1998, de 13 de abril, sobre condiciones generales de la contratación, arts. 5, 7 and 8 Source as of scraping:es-ley-7-1998-de-13-de-abril-sobre-condiciones-g:0

Netherlands

When you use standard terms in contracts, give the counterparty a reasonable opportunity to take notice of them, for example by handing them over before or when the contract is concluded (arts. 233 onder b and 234, eerste lid).
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook The counterparty's terms, where the site is operated Runtime not yet classified
Burgerlijk Wetboek Boek 6, arts. 231-234, 236, 237, Algemene voorwaarden (Standard Terms), Burgerlijk Wetboek Boek 6, arts. 231 to 234, 236 and 237 (BWBR0005289) Source as of scraping:nl-burgerlijk-wetboek-boek-6-231-234-236-237-bwb:0

Utah

If you are a contractor that processes or has access to personal data under a contract with a Utah governmental entity, including through your employees, agents or subcontractors, comply with the Government Data Privacy Act for that personal data to the same extent as the governmental entity.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject; establishment of the operator Runtime not yet classified
Government Data Privacy Act, requirements for contractors of governmental entities, Utah Code 63A-19-401.4 Source as of privacy:us-ut-utah-63a-19-401-4:0

United States

This order binds executive agencies, not vendors; it reaches you if you sell a large language model, or a product that integrates one, to an agency, through the contract terms and solicitation requests the agency must use under OMB Memorandum M-26-04, and national security systems are outside that memorandum (Sections 3 and 4(b)).
Type Conditional Obligation Modal must Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Executive Order 14319, Preventing Woke AI in the Federal Government, Exec. Order No. 14319, 90 Fed. Reg. 35389 () Source as of ai:us-exec-order-no-14319-90-fed-reg-35389-july-28:0

Argentina

Delete personal data that has lost currency for the purposes for which it was collected, without waiting for the data subject to ask.
Type Conditional Obligation Modal subject to Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject; establishment of the operator Runtime not yet classified
Decreto 1558/2001, regulation of Ley 25.326: private databases, deletion of stale data, informed consent and processors, Decreto 1558/2001, arts. 1, 4, 5 and 25 (reglamentación de la Ley 25.326: private reporting databases, stale data, informed consent, processing on behalf) Source as of privacy:ar-decreto-1558-2001-1-4-5-25-reglamentacion-de:0

Belarus

Establish a lawful basis, generally the personal data subject's consent unless another basis in this Law applies, before processing personal data of a person in Belarus, and limit processing to explicit, pre declared, legitimate purposes, under Article 4.
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the data subject; establishment of the operator Runtime reworded since it was classified
Law of the Republic of Belarus On Personal Data Protection, Zakon Respubliki Belarus No. 99-Z ot 7 maia 2021 g. O zashchite personalnykh dannykh, v sile s 15 noiabria 2021 (Law No. 99-Z of ), arts. 1-7, 17 and 20-21 (general processing and security) Source as of privacy:by-zakon-respubliki-belarus-no-99-z-ot-7-maia-20:0

Alberta

Treat an offer, an acceptance or any other matter material to the formation or operation of a contract as capable of being expressed by information or a record in electronic form, or by an act intended to result in electronic communication such as touching or clicking on an appropriate icon or other place on a computer screen, unless the parties otherwise agree (s. 27).
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook The counterparty's terms, where the site is operated Runtime not yet classified
Electronic Transactions Act, electronic contracts, S.A. 2001, c. E-5.5, ss. 27-29 Source as of scraping:ca-ab-s-2001-c-e-5-5-ss-27-29:0

British Columbia

Treat terms you accept by touching or clicking on an appropriately designated icon or place on a computer screen, or by otherwise communicating electronically in a manner intended to express acceptance, as capable of forming a contract, unless the parties agree otherwise (s. 15 (1)).
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook The counterparty's terms, where the site is operated Runtime not yet classified
Electronic Transactions Act, electronic contracts, S.B.C. 2001, c. 10, ss. 15-17 Source as of scraping:ca-bc-s-b-c-2001-c-10-ss-15-17:0

Manitoba

Treat an offer, an acceptance or any other matter material to forming or operating a contract as capable of being expressed by an electronic document, or by an act such as touching or clicking on a computer screen or speaking that is intended to communicate it electronically, unless the parties agree otherwise (s. 19(1)).
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook The counterparty's terms, where the site is operated Runtime not yet classified
Electronic Commerce and Information Act, electronic contracts and electronic agents, C.C.S.M. c. E55, ss. 19-20 Source as of scraping:ca-mb-c-c-s-m-c-e55-ss-19-20:0

New Brunswick

These duties bind a custodian, which is any person who holds, maintains, processes, receives or stores a digital asset of an account holder; the Act does not apply to a digital asset of an employer that an employee uses in the ordinary course of the employer's business (ss. 1, 2 (2)).
Type Mandatory Obligation Modal imperative Binds, by its wording Employer Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Fiduciaries Access to Digital Assets Act, a fiduciary's right of access against a custodian of digital assets, S.N.B. 2022, c. 59, ss. 1, 4, 6-8 Source as of privacy:ca-nb-s-n-b-2022-c-59-ss-1-4-6-8:0

Newfoundland and Labrador

Treat an offer, an acceptance or another matter material to the formation or operation of a contract that is expressed electronically, including by touching or clicking an appropriately designated icon or place on a computer screen, as capable of forming a contract, unless the parties agree otherwise (s. 20(1)).
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook The counterparty's terms, where the site is operated Runtime not yet classified
Electronic Commerce Act, electronic contracts and electronic agents, S.N.L. 2001, c. E-5.2, ss. 20-22 Source as of scraping:ca-nl-s-n-l-2001-c-e-5-2-ss-20-22:0

184 more lines in force in this class, and 205 lines in all, are in the law library, each on the summary page of its instrument.

Check the user's age

128 lines 115 in force 31 provisions 31 jurisdictions by type: mandatory obligation 59, conditional obligation 38, prohibition 31

Sample requirement lines Show 14 of the 115 lines in forceHide the sample

What follows is a sample of 14 requirement lines from the law library, chosen to span jurisdictions.

Brazil

Obtain specific, highlighted consent, or another article 11 legal basis, before processing sensitive personal data such as health, genetic, or biometric data.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
LGPD, sensitive personal data and children's data, Lei nº 13.709, de 2018 (LGPD), arts. 5º, II, 11-14 (sensitive personal data and children's data) Source as of privacy:br-lei-n-13-709-de-2018-lgpd-5-ii-11-14-sensitiv:0

Peru

For sensitive data (biometric data that by itself identifies a person, racial or ethnic origin, income, political, religious, philosophical or moral opinions, union affiliation, or health or sex-life information), obtain the titleholder's consent in writing, in addition to the general consent requirements, and do not process it without that written consent unless a law authorizes processing without it on important public-interest grounds.
Type Conditional Obligation Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Ley 29733, sensitive personal data and minors, Ley No. 29733, arts. 2.5, 13.3, 13.6, 14.6 (sensitive data and children) Source as of privacy:pe-ley-no-29733-2-5-13-3-13-6-14-6-sensitive-dat:0

Nigeria

Obtain a data subject's consent before processing sensitive personal data, and before processing the personal data of a child.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Nigeria Data Protection Act, 2023, sensitive personal data and a child's data, Nigeria Data Protection Act, 2023, sensitive personal data and a child's data (GAID 2025, arts. 18 and 43) Source as of privacy:ng-nigeria-data-protection-2023-sensitive-person:0

United States

Obtain verifiable parental consent before collecting, using, or disclosing a child's personal information, including biometric identifiers such as voiceprints or facial templates.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject Runtime Enforceable at a runtime control
Children's Online Privacy Protection Rule (COPPA), including 2025 biometric identifier amendments, 16 CFR Part 312, as amended effective Source as of privacy:us-16-cfr-part-312-as-amended-effective-june-23:0

Andorra

Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union affiliation, or process genetic data, biometric data used to uniquely identify a person, health data, or data about sex life or sexual orientation, unless a listed Article 9(2) exception applies, most commonly the data subject's explicit consent.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
LQPD, special categories, children and criminal-offence data, Llei 29/2021, arts. 8-10 (special categories, children and criminal-offence data) Source as of privacy:ad-llei-29-2021-8-10-special-categories-children:0

Albania

Do not process sensitive data, meaning racial or ethnic origin, political opinions, religious or philosophical belief, trade union membership, genetic data, biometric data, health records, or sexual orientation, unless a listed exception applies, such as the data subject's explicit consent to a specified purpose.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Law No. 124/2024, special categories of personal data, criminal records and children's data, Law No. 124/2024, Arts. 8(6), 9, 10 (special categories, criminal records and children's data) Source as of privacy:al-no-124-2024-8-6-9-10-special-categories-crimi:0

Bosnia and Herzegovina

Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union affiliation, genetic data, biometric data for unique identification, health data, or data about a person's sex life or sexual orientation, unless a listed exception in Article 11 applies, such as the person's explicit consent.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Law on the Protection of Personal Data of Bosnia and Herzegovina, special categories, criminal-conviction data and children's consent, Law on the Protection of Personal Data, arts. 10-12 (special categories, criminal-conviction data and children's consent) Source as of privacy:ba-protection-personal-data-10-12-special-catego:0

Barbados

Do not process sensitive personal data, including biometric data, unless the data subject consents or a specific statutory ground applies.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Data Protection Act, 2019, a child's consent and sensitive personal data, Data Protection Act, 2019, ss. 8-9 (child's consent and sensitive personal data) Source as of privacy:bb-data-protection-2019-ss-8-9-child-s-consent-s:0

Benin

Do not process sensitive personal data, including racial or ethnic origin, political opinions, religion or beliefs, trade union membership, genetic data, biometric data used to uniquely identify a person, health data, or data about a person's sex life or sexual orientation, unless a listed exception applies, such as the data subject's explicit consent or data the person has manifestly made public.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, données sensibles et mineurs, Loi n°2017-20 du 20 avril 2018, Livre V, arts. 394-404, 407 et 446 (données sensibles et mineurs) Source as of privacy:bj-loi-n-2017-20-du-20-avril-2018-livre-v-394-40:0

Democratic Republic of the Congo

Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, refugee or stateless status, trade union membership, sex life, or health, unless a statutory exception applies.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Digital Code, Title III, sensitive personal data and minors, Code du numérique, Titre III, arts. 195 à 199, 206 et 247 (catégories sensibles et mineurs) Source as of privacy:cd-du-num-rique-titre-iii-195-199-206-et-247-cat:0

Colombia

Before processing sensitive personal data, including data revealing racial or ethnic origin, political opinion, religious or philosophical belief, union or human rights organization membership, health, sexual life, or biometric data, obtain the data subject's explicit authorization; processing sensitive personal data is otherwise prohibited.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Ley 1581 de 2012, Sensitive Categories and Children's Data, Ley 1581 de 2012, arts. 5-7 (Datos Sensibles y Menores) Source as of privacy:co-ley-1581-de-2012-5-7-datos-sensibles-y-menore:0

Djibouti

Do not process sensitive personal data (racial or ethnic origin, political or philosophical opinions, religious opinions or beliefs, trade-union membership, genetic data, biometric data used to uniquely identify a person, or health data) without the data subject's express consent or another statutory ground.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Digital Code, Book I: sensitive categories of personal data and the minor's consent, Code Numérique, Livre Premier, Arts. 59 et 62 (consentement du mineur et données sensibles) Source as of privacy:dj-num-rique-livre-premier-59-et-62-consentement:0

Ecuador

Do not process personal data without a lawful basis under the Act, and obtain explicit consent before processing a sensitive category of data unless another enumerated ground applies.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
LOPDP, categorías especiales de datos personales, LOPDP, arts. 25-32 (categorias especiales de datos personales) Source as of privacy:ec-lopdp-25-32-categorias-especiales-de-datos-pe:0

Egypt

Obtain a Personal Data Protection Center license before collecting, storing, transferring, or processing any Sensitive Personal Data, including a biometric, health, genetic, financial, religious, political, or criminal-record identifier, or any data relating to a child.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Egypt Personal Data Protection Law, Sensitive Personal Data and a child's data, Law No. 151 of 2020, Article 12 (Sensitive Personal Data and a child's data) Source as of privacy:eg-no-151-2020-12-sensitive-personal-data-child:0

101 more lines in force in this class, and 128 lines in all, are in the law library, each on the summary page of its instrument.

Respect text and data mining opt-outs

68 lines 66 in force 30 provisions 28 jurisdictions by type: permission or exemption 16, prohibition 15, conditional obligation 13, mandatory obligation 12, definition 11, consequence (penalty or remedy) 1

Sample requirement lines Show 14 of the 66 lines in forceHide the sample

What follows is a sample of 14 requirement lines from the law library, chosen to span jurisdictions.

European Union

Publish a training-content summary if you provide a general-purpose model
Type Conditional Obligation Modal imperative Binds, by its wording Provider of a general-purpose model Scope turns on Provider Hook Establishment of the operator; placing on the market; where the output is used Runtime Outside any runtime path
AI Act, Article 53 (obligations for providers of general-purpose AI models), Regulation (EU) 2024/1689, Article 53 Source as of ai:eu-2024-1689-53:0

United Kingdom

Rely on the text and data analysis exception only where you have lawful access to the work and the copy is made so that a person with lawful access can carry out a computational analysis of what the work records for the sole purpose of research for a non-commercial purpose.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Copies for Text and Data Analysis for Non-Commercial Research (Copyright, Designs and Patents Act 1988, s. 29A), Copyright, Designs and Patents Act 1988, c. 48, s. 29A Source as of ai:gb-copyright-designs-patents-1988-c-48-s-29a:0

Germany

Do not circumvent an effective technical measure protecting a work or other protected subject matter without the rightholder's consent, where you know or ought to know that the circumvention is meant to give access to it or to enable its use.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook The counterparty's establishment (rightsholder); where the copy is made Runtime not yet classified
Schutz technischer Massnahmen und Durchsetzung von Schrankenbestimmungen (Protection of Technological Measures), Urheberrechtsgesetz (UrhG), §§ 95a, 95b Source as of scraping:de-urheberrechtsgesetz-urhg-95a-95b:0

Italy

You may reproduce and extract text and data from lawfully accessible works, databases, or other materials for text-and-data-mining purposes, including through AI models and systems, whether for scientific research (art. 70-ter) or general and commercial use (art. 70-quater/70-septies).
Type Permission or exemption Modal may Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook The counterparty's establishment (rightsholder); where the copy is made Runtime not a duty
Legge sul Diritto d'Autore Artt. 70-ter and 70-quater, Text-and-Data-Mining Exceptions, Legge 22 aprile 1941, n. 633, artt. 70-ter, 70-quater, inserted by Decreto Legislativo 8 novembre 2021, n. 177; art. 70-septies inserted by Legge 23 settembre 2025, n. 132, art. 25 Source as of scraping:it-lda-70ter-70quater-tdm-exceptions:0

Australia

A use of a literary, dramatic, musical or artistic work is not infringing if it is a fair dealing for research or study, criticism or review, parody or satire, or reporting news; training an AI model on copyrighted text does not fit any of these purposes as such, and no separate text-and-data-mining exception is available.
Type Permission or exemption Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook The counterparty's establishment (rightsholder); where the copy is made Runtime not a duty
Copyright Act 1968 (Cth), Fair Dealing Exceptions and No Text-and-Data-Mining Exception, Copyright Act 1968 (Cth), No. 63, 1968, ss. 10, 40, 41, 41A, 42 Source as of scraping:au-copyright-1968-cth-no-63-1968-ss-10-40-41-41a:0

Peru

A quotation from a lawfully disclosed work may be made without the author's consent or payment if the author's name and the source are stated and the quotation follows proper practice and does not exceed what its purpose justifies.
Type Permission or exemption Modal may Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook The counterparty's establishment (rightsholder); where the copy is made Runtime not a duty
Decreto Legislativo 822, quotation exception, Decreto Legislativo 822, art. 44 (quotation exception), Ley sobre el Derecho de Autor, as consolidated to Decreto Legislativo 1724 (2026) Source as of scraping:pe-decreto-legislativo-822-44-quotation-exceptio:0

Azerbaijan

Reproducing a database, or a substantial part of one, for personal use is not exempted from the author's or database owner's consent the way reproducing an ordinary published work is.
Type Definition Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook The counterparty's establishment (rightsholder); where the copy is made Runtime not a duty
Copyright and Related Rights Law, database exclusion and enforcement remedies, Law of the Republic of Azerbaijan On Copyright and Related Rights, Law No. 115-IQ (, as amended through Law No. 817-VIQD of ), Arts. 17, 19, 24, 44-47 Source as of scraping:az-republic-azerbaijan-copyright-related-rights:0

Bosnia and Herzegovina

Do not reproduce, distribute, make available, or otherwise exploit a copyrighted work, including for training a model on it, without a transfer of the relevant right or a license, because the Law recognizes no general text-and-data-mining or fair-use exception beyond its closed list of specific limitations.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder); where the copy is made Runtime Enforceable at a runtime control
Law on Copyright and Related Rights, Content Limitations (No Text-and-Data-Mining Exception), Law on Copyright and Related Rights, arts. 8, 40-54 (Content Limitations of Copyright), Official Gazette of BiH No. 63/10, 86/10 Source as of scraping:ba-copyright-related-rights-40-54-content-limita:0

Belgium

Do not reproduce a work made accessible in a lawful manner for text-and-data-mining purposes if the rightsholder has expressly reserved that use in an appropriate manner.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder); where the copy is made Runtime Enforceable at a runtime control
Code de droit économique, article XI.190, 20°, exception de fouille de textes et de données, Code de droit économique, art. XI.190, 20°, inséré par la loi du 19 juin 2022 transposant partiellement la directive (UE) 2019/790 (Moniteur belge, 1 août 2022) Source as of scraping:be-de-droit-economique-xi-190-20-insere-par-la-l:0

Bulgaria

Honor an express, machine-readable rights reservation before relying on the general text-and-data-mining exception to reproduce or extract a lawfully accessed work, per ZAPSP Article 26e(4).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder); where the copy is made Runtime Enforceable at a runtime control
Copyright and Neighbouring Rights Act (ZAPSP), Arts. 26e, 26zh and 26k, Text-and-Data-Mining Exception for Crawling and Training, ZAPSP crawling-training TDM exception (Закон за авторското право и сродните му права, Zakon za avtorskoto pravo i srodnite mu prava), chl. 26e, 26zh i 26k, izm. i dop. DV br. 100 ot 1 dekemvri 2023 g. Source as of scraping:bg-zapsp-crawling-training-tdm-exception-zakon-z:0

Belize

Reproducing copyrighted Belizean text for research, private study, or reporting current events may fall within fair dealing, but training a model on it or crawling it at scale has not been tested against the fair-dealing factors in a reported case.
Type Permission or exemption Modal may Binds, by its wording Operator of a crawler or bot Scope turns on not a duty Hook The counterparty's establishment (rightsholder); where the copy is made Runtime not a duty
Copyright Act, fair dealing exceptions, Copyright Act, Cap. 252 (Act No. 12 of 2000, Revised Edition 2020), ss. 56-58 Source as of scraping:bz-copyright-cap-252-ss-56-58-fair-dealing:0

Cook Islands

Do not copy, reproduce, or communicate to the public a substantial part of a copyrighted work without the owner's authorisation, unless a section 14 to 25 exception applies, such as the section 22 exception for a single copy or adaptation of a computer program made to use it for the purpose it was obtained, for archival purposes, or to replace a lost or destroyed copy.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder); where the copy is made Runtime Enforceable at a runtime control
Copyright Act 2013, economic rights, computer program copying, and technological protection measures, Copyright Act 2013, No. 8 (Cook Islands), ss. 8, 9, 22, 44 (economic rights, computer program copying, and technological protection measures) Source as of scraping:ck-copyright-2013-no-8-cook-islands-ss-8-9-22-44:0

Czech Republic

Honor a rightholder's express, suitably given reservation, including a machine-readable reservation on a work made available online, before relying on the general text-and-data-mining exception to mine that work in the Czech Republic.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder); where the copy is made Runtime Enforceable at a runtime control
Autorský zákon Sections 39c-39d, Text and Data Mining Exception for Automated Analysis, Zakon c. 121/2000 Sb., o pravu autorskem (autorsky zakon), Sec. 39c and Sec. 39d, as inserted by Zakon c. 429/2022 Sb. Source as of scraping:cz-autorsk-z-kon-121-2000-sb-39c-39d-tdm-obecne:0

Micronesia

A general fair use exception permits reproducing a copyrighted work, including for criticism, comment, news reporting, teaching, scholarship, or research, weighed against the purpose, nature, amount used, and market effect of the use.
Type Permission or exemption Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook The counterparty's establishment (rightsholder); where the copy is made Runtime not a duty
FSM Copyright Act, exclusive rights, fair use, and compilation protection, FSM Code Title 35, Ch. 1 (Copyrights), secs. 101-109 Source as of scraping:fm-fsm-title-35-ch-1-copyrights-secs-101-109:0

52 more lines in force in this class, and 68 lines in all, are in the law library, each on the summary page of its instrument.

Meet a design code

64 lines 25 in force 12 provisions 11 jurisdictions by type: mandatory obligation 30, conditional obligation 17, prohibition 17

Sample requirement lines Show 14 of the 25 lines in forceHide the sample

What follows is a sample of 14 requirement lines from the law library, chosen to span jurisdictions.

Colorado

Starting , use commercially reasonable or generally accepted methods to estimate the age of your account holders and other users, and do not willfully disregard clear and convincing information that one of them is a minor
Type Mandatory Obligation Modal do not Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Where the output is used; placing on the market Runtime reworded since it was classified
HB 26-1263 (2026), Conversational AI Service Operator Requirements, C.R.S. 6-1-1708 Source as of ai:us-co-c-r-s-6-1-1708:0

Brazil

Configure any product or service directed at children and adolescents, or likely to be accessed by them, by default to the most protective privacy and data-protection setting available, and do not process their personal data in a way that causes, facilitates or contributes to a violation of their privacy.
Type Mandatory Obligation Modal do not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
ECA Digital (Lei nº 15.211/2025), children's personal data and profiling, Lei nº 15.211, de 17 de setembro de 2025 (Estatuto Digital da Criança e do Adolescente), arts. 7º, 16, 22 and 26 Source as of privacy:br-lei-no-15-211-de-17-de-setembro-de-2025-estat:0

Democratic Republic of the Congo

Obtain the data subject's consent before processing their personal data, unless the processing is necessary to perform a legal obligation.
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Enforceable at a runtime control
Digital Code, Title III: Personal Data Protection, Code du numérique, Titre III, Des données personnelles, Ordonnance-loi n° 23/010 du 13 mars 2023 (arts. 183 à 194, 204, 205, 219, 221 à 233, 243, 245, 246 et 254) Source as of privacy:cd-du-num-rique-titre-iii-des-donn-es-personnell:0

Florida

If you operate a social media platform, online game or online gaming platform that provides a service, product, game or feature likely to be predominantly accessed by children under 18, do not process a child's personal information if you have actual knowledge of, or willfully disregard, that the processing may result in substantial harm or privacy risk to children.
Type Conditional Obligation Modal do not, may Binds, by its wording Platform or intermediary Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Protection of children in online spaces: online platforms likely to be predominantly accessed by children, Fla. Stat. § 501.1735 Source as of privacy:us-fl-fla-stat-501-1735:0

Colorado

Starting , if you know an account holder or user is a minor, clearly and conspicuously disclose that they are interacting with artificial intelligence, in response to their prompts asking whether the service is artificially generated and not human, and through a persistent visible disclaimer on a product with a screen interface, an intermittent audio disclaimer on a product without one, or a disclosure at the beginning of each interaction that recurs at least once every three hours of a continuous interaction
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Where the output is used; placing on the market Runtime reworded since it was classified
HB 26-1263 (2026), Conversational AI Service Operator Requirements, C.R.S. 6-1-1708 Source as of ai:us-co-c-r-s-6-1-1708:1

Brazil

When you process the data of children and adolescents, above all for purposes not strictly necessary to run the product or service, map the risks, make efforts to mitigate them and prepare a data-protection impact, monitoring and evaluation report to share when the authority requests it.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
ECA Digital (Lei nº 15.211/2025), children's personal data and profiling, Lei nº 15.211, de 17 de setembro de 2025 (Estatuto Digital da Criança e do Adolescente), arts. 7º, 16, 22 and 26 Source as of privacy:br-lei-no-15-211-de-17-de-setembro-de-2025-estat:1

Democratic Republic of the Congo

File a prior declaration with the Data Protection Authority before processing personal data, or obtain its prior authorization before processing genetic, medical, biometric, offense or conviction, national-identification, or cross-border-transfer data.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Operator Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
Digital Code, Title III: Personal Data Protection, Code du numérique, Titre III, Des données personnelles, Ordonnance-loi n° 23/010 du 13 mars 2023 (arts. 183 à 194, 204, 205, 219, 221 à 233, 243, 245, 246 et 254) Source as of privacy:cd-du-num-rique-titre-iii-des-donn-es-personnell:1

Florida

Do not profile a child unless you can demonstrate appropriate safeguards and either that profiling is necessary for the feature the child is actively and knowingly using or that you have a compelling reason it poses no substantial harm or privacy risk.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Protection of children in online spaces: online platforms likely to be predominantly accessed by children, Fla. Stat. § 501.1735 Source as of privacy:us-fl-fla-stat-501-1735:1

Colorado

Starting , if you know an account holder or user is a minor, do not give them points or similar rewards at unpredictable intervals meant to increase engagement
Type Conditional Obligation Modal do not Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Where the output is used; placing on the market Runtime reworded since it was classified
HB 26-1263 (2026), Conversational AI Service Operator Requirements, C.R.S. 6-1-1708 Source as of ai:us-co-c-r-s-6-1-1708:2

Brazil

Do not use profiling techniques to direct commercial advertising at children and adolescents.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
ECA Digital (Lei nº 15.211/2025), children's personal data and profiling, Lei nº 15.211, de 17 de setembro de 2025 (Estatuto Digital da Criança e do Adolescente), arts. 7º, 16, 22 and 26 Source as of privacy:br-lei-no-15-211-de-17-de-setembro-de-2025-estat:2

Democratic Republic of the Congo

Keep personal data reliable, adequate, relevant, accurate and not excessive, and correct or erase it once it becomes inaccurate or incomplete.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the data subject; establishment of the operator Runtime reworded since it was classified
Digital Code, Title III: Personal Data Protection, Code du numérique, Titre III, Des données personnelles, Ordonnance-loi n° 23/010 du 13 mars 2023 (arts. 183 à 194, 204, 205, 219, 221 à 233, 243, 245, 246 et 254) Source as of privacy:cd-du-num-rique-titre-iii-des-donn-es-personnell:2

Florida

Do not collect, sell, share or retain personal information that is not necessary to provide the feature the child is actively and knowingly engaged with, and do not use it for any other reason than the one it was collected for, unless you can demonstrate a compelling reason that doing so poses no substantial harm or privacy risk to children.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Protection of children in online spaces: online platforms likely to be predominantly accessed by children, Fla. Stat. § 501.1735 Source as of privacy:us-fl-fla-stat-501-1735:2

Colorado

Starting , if you know an account holder or user is a minor, institute technically feasible measures preventing the service from producing explicit sexual content or intimate digital depictions involving a minor, or from engaging in or encouraging explicit sexual conduct with a minor, and reasonable measures preventing it from claiming to be human or sentient, simulating a romantic companionship, or role-playing an adult-minor romantic relationship
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Where the output is used; placing on the market Runtime reworded since it was classified
HB 26-1263 (2026), Conversational AI Service Operator Requirements, C.R.S. 6-1-1708 Source as of ai:us-co-c-r-s-6-1-1708:3

Brazil

Do not build behavioral profiles of child and adolescent users from their personal data, including data obtained in age verification, to direct commercial advertising.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
ECA Digital (Lei nº 15.211/2025), children's personal data and profiling, Lei nº 15.211, de 17 de setembro de 2025 (Estatuto Digital da Criança e do Adolescente), arts. 7º, 16, 22 and 26 Source as of privacy:br-lei-no-15-211-de-17-de-setembro-de-2025-estat:3

11 more lines in force in this class, and 64 lines in all, are in the law library, each on the summary page of its instrument.

Credit or license the publisher's content

35 lines 35 in force 15 provisions 14 jurisdictions by type: prohibition 18, permission or exemption 8, conditional obligation 5, definition 2, mandatory obligation 1, consequence (penalty or remedy) 1

Sample requirement lines Show 14 of the 35 lines in forceHide the sample

What follows is a sample of 14 requirement lines from the law library, chosen to span jurisdictions.

United Kingdom

Rely on the text and data analysis exception only where you have lawful access to the work and the copy is made so that a person with lawful access can carry out a computational analysis of what the work records for the sole purpose of research for a non-commercial purpose.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Copies for Text and Data Analysis for Non-Commercial Research (Copyright, Designs and Patents Act 1988, s. 29A), Copyright, Designs and Patents Act 1988, c. 48, s. 29A Source as of ai:gb-copyright-designs-patents-1988-c-48-s-29a:0

United States

Do not intentionally remove or alter copyright management information, meaning the title, the names of the author and copyright owner, the copyright notice and the terms and conditions for use, on works you copy, unless the copyright owner or the law authorizes it.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook The counterparty's establishment (rightsholder); where the copy is made Runtime not yet classified
Digital Millennium Copyright Act, integrity of copyright management information, 17 U.S.C. § 1202 Source as of scraping:us-17-u-s-c-1202:0

Burkina Faso

Treat a database compiled through the selection or arrangement of its contents as a protected work: do not reproduce all or a substantial part of it without the rights holder's authorization, even for otherwise-permitted private use.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder) Runtime Outside any runtime path
Loi n°048-2019/AN du 12 novembre 2019 portant protection de la propriété littéraire et artistique, database and news exceptions, Loi n°048-2019/AN, Database and News-Facts Exclusions (Arts. 10 et 22), portant protection de la propriété littéraire et artistique, 12 novembre 2019 Source as of scraping:bf-loi-n-048-2019-database-news-facts-exclusions:0

Burundi

Treat a database compiled through the selection or arrangement of its contents as a protected work: do not reproduce all or a substantial part of it without the rights holder's authorization, even for otherwise-permitted private use.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder) Runtime Enforceable at a runtime control
Law No. 1/021 of December 30, 2005 on the Protection of Copyright and Related Rights, database and facts exclusions, Loi n° 1/021, Database and Facts Exclusion (Arts. 7 et 26.1), portant protection du droit d'auteur et des droits voisins, 30 décembre 2005 Source as of scraping:bi-loi-n-1-021-database-facts-exclusion-7-et-26:0

Bahamas

Do not reproduce or commercially deal in a substantial part of a database or compilation that is original by reason of the selection, co-ordination or arrangement of its contents, without the compiler's authorisation.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder) Runtime Enforceable at a runtime control
Copyright Act 1998, compilation and database protection, Copyright Act, Ch. 323, Laws of The Bahamas, s. 2 (definition of compilation), s. 5 (category of works of authorship) Source as of scraping:bs-copyright-ch-323-laws-bahamas-s-6-works-autho:0

Gabon

Do not reproduce a collection or database whose choice or arrangement of contents is an original intellectual creation without the rightsholder's authorization; Gabon has no sui generis database right, so an unoriginal, purely factual collection is not itself protected.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder) Runtime Enforceable at a runtime control
Loi n°1/87, protection des recueils et compilations, Loi n°1/87, art. 5 (recueils et compilations), du 29 juillet 1987 instituant la protection du droit d'auteur et des droits voisins Source as of scraping:ga-loi-n-1-87-5-recueils-et-compilations-du-29-j:0

Cayman Islands

Do not reproduce or commercially deal in a substantial part of a database or compilation protected as a literary work under the extended Copyright, Designs and Patents Act 1988 without the compiler's authorisation.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder) Runtime Enforceable at a runtime control
Copyright (Cayman Islands) Order 2015, database and compilation copyright, Copyright (Cayman Islands) Order 2015, s. 3(1) databases Source as of scraping:ky-copyright-cayman-islands-order-2015-s-3-1-dat:0

Maldives

Do not reproduce more than a short part of a published work as a quotation unless the reproduction is compatible with fair practice and does not exceed what the purpose justifies, and, where the work shows the author's name, state the author's name, the source and the manner of publication.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook The counterparty's establishment (rightsholder); where the copy is made Runtime reworded since it was classified
Copyright and Related Rights Act, quotation and informational-purpose exceptions, Copyright and Related Rights Act (Law No. 23/2010), ss. 10, 12(b)(3), 14, 17 Source as of scraping:mv-copyright-related-rights-no-23-2010-ss-10-12:0

Nicaragua

Do not reproduce the whole, or an important part, of a protected compilation or database in digital form without the rights holder's authorization; the personal-use privilege does not cover it.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder) Runtime Enforceable at a runtime control
Ley No. 312, protection of compilations and databases, Ley No. 312 (1999, as amended), arts. 14, 31.3 Source as of scraping:ni-ley-no-312-1999-as-amended-14-31-3:0

Nepal

Citing a small portion of a published work, or reproducing portions of a newspaper or journal to disseminate current information, does not require the author's authorisation so long as the source and author are named and the use is not prejudicial to the author's economic right.
Type Permission or exemption Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook The counterparty's establishment (rightsholder); where the copy is made Runtime not a duty
Copyright Act, 2059, citation and current-information reproduction exceptions, Copyright Act, 2059 (2002), ss. 17, 20 Source as of scraping:np-copyright-2059-2002-ss-17-20:0

Papua New Guinea

Do not reproduce, adapt, or otherwise use a substantial part of a protected literary or artistic work, including text from a published article, beyond what the private-use, quotation, teaching, reprographic, or informatory-purposes exceptions in this Act allow, without the author's or copyright owner's authorization.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder); where the copy is made Runtime Enforceable at a runtime control
Copyright and Neighbouring Rights Act 2000, Exceptions to Copyright and Enforcement, Copyright and Neighbouring Rights Act 2000 (PNG), No. 21 of 2000, ss. 5, 8, 10, 14, 27-28 Source as of scraping:pg-copyright-neighbouring-rights-2000-exceptions:0

Sao Tome and Principe

Do not reproduce a compilation, anthology, or systematic collection whose choice or arrangement of contents is itself an intellectual creation, without the rightsholder's authorization; Sao Tome and Principe has no sui generis database right, so an unoriginal, purely factual collection of data is not itself protected against reproduction.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook The counterparty's establishment (rightsholder) Runtime reworded since it was classified
Decreto-Lei n.º 02/2017, protecção de compilações e exclusão das notícias do dia, Decreto-Lei n.º 02/2017, arts. 3 e 7, de 19 de Abril de 2017, Código do Direito de Autor e dos Direitos Conexos Source as of scraping:st-decreto-lei-n-02-2017-3-e-7-compila-es-e-excl:0

Uruguay

Do not reproduce, distribute, communicate, or make a copyrighted work available to the public without the author's consent, unless a free-use exception applies.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder); where the copy is made Runtime Enforceable at a runtime control
Ley N° 9.739 arts. 44-45, illicit-reproduction rule and free-use exceptions for quotation and news, Ley N° 9.739, de 17 de diciembre de 1937, arts. 44 y 45 Source as of scraping:uy-ley-n-9-739-de-17-de-diciembre-de-1937-44-y-4:0

Vatican City

Treat a work protected under the copyright and related-rights legislation in force in Italy as protected in Vatican City State too, including a future amendment Italy makes to that legislation, unless this law states an exception.
Type Definition Modal unless Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook The counterparty's establishment (rightsholder); where the copy is made Runtime not a duty
Copyright and related rights by reference to Italian law (Legge N. CXCVII), Legge N. CXCVII, Legge sulla protezione del diritto di autore sulle opere dell'ingegno e dei diritti connessi, 1 settembre 2017 Source as of scraping:va-legge-n-cxcvii-legge-sulla-protezione-del-dir:0

21 more lines in force in this class, and 35 lines in all, are in the law library, each on the summary page of its instrument.

6A sample of the register as a file

requirement-register.csv is a sample of the register: the lines of European Union law, one row per line, with the columns above and the topic, instrument, citation, summary page, source, lifecycle band and as-of date. The counts on this page cover every line in the register; the file covers the European Union's own instruments, enough to show every column on real rows. Every other line is on the summary page of its instrument. To discuss the whole register as a file, contact LexLint at hello@ungovr.org.

The obligation classes are given as the law library keys them, semicolon-separated, so a row can be joined to the class it is filed under here; the words for each key are the headings of section 5. It is generated from the law library on the date in this page's byline and it will be regenerated when the law library moves; a copy taken today is a snapshot with that date on it.

Two links per row. Instrument page is LexLint's own summary of the instrument. Source URL, after it, is the link LexLint researched the instrument from: for most rows the law's own text at its publisher (a gazette, a legislature, a regulator) or in a repository of legal texts such as WIPO Lex or an archived copy, and for a few rows the secondary source the research read, which is why the column is named for the source rather than for the law.

Classification. A Classification column after the runtime tier says which of four states the line is in: classified, not a duty, not yet classified, or reworded since it was classified. The party, party group and tier columns print the same words in place of a value for every line in the other three states, so a blank never has to be guessed at.

Party group. Party group (LexLint six parties), after the party column, restates the party whose position triggers scope as one of The 6 parties, so a row can be read against that document. Five of the classification's six values name one party inside a group; Counterparty already names a group, not one of its four members, so the group is the level every value can be stated at without adding detail the classification did not record. A line with no party has no group. The applicable-entity column is not restated this way: it is read off the line's wording, and one of its values, a developer, distributor or importer, spans two groups.

Party whose position triggers scopeParty group
OperatorOPERATOR
PrincipalUSER
ProviderMAKER
CounterpartyCOUNTERPARTY
Affected personUSER
Data subjectUSER

The same lines in the Agentic AI Foundation working group's sixteen-theme column contract, with the theme identifiers first, are the file offered from the sixteen themes, filled from binding law. The file here is licensed separately from the documents around it, under Creative Commons Attribution 4.0 rather than the section's ShareAlike terms: use it for any purpose, including commercially, with credit to LexLint (UnGovr).

7What this register does not claim

It does not say that any line binds any particular organization. That is the applicability question, and it is answered per deployment from the roles a system holds and where its parties are, which is what The 6 parties and Where the parties are are about. The addressee and the hook are rules applied to text, reviewed in samples, not findings made line by line; the class is the research's record on the instrument, and where the research has not recorded one the register says so rather than guessing. Every entry, on this page and in the file, links to the source the law library researched it from, so that a reader can check the rule against the law.