Global AI law: 8 common threads

About this documentUpdated 31 October 2026ShowHide

Sean McDermott, Co-Founder and CEO, UnGovr

Written by Sean McDermott (with AI assistance) using the LexLint law library, which supplied every legal instrument, status and date on these pages.

Every law named here links to its summary page on lexlint.io, translated to English (if needed) and restructured to a standard format for human and code use. Every case links to the court's or the regulator's own record where one could be reached.

© 2026 UnGovr, publishing as LexLint. The text and the figures are licensed under Creative Commons Attribution-ShareAlike 4.0: share and adapt them, including commercially, with credit to LexLint (UnGovr) and under the same license. Please contact LexLint at hello@ungovr.org to discuss other terms. Logos and wordmarks belong to their owners.

Law library as of 6 November 2026.

Legal information, not legal advice. This document describes the law as written and dated; it does not apply it to any system. The notice in the footer says what that means.

What the AI laws in force around the world have in common, the unusual provisions that trip an agent, the older privacy, security and scraping law that already binds one, where the new law restates the old, and why a system built to the EU rule still has twenty-seven national layers to read.

1Why this paper, and who it is for

Three readers are in mind. A governance working group mapping regulatory alignment across jurisdictions, which needs a baseline of binding law to map against. Anyone who has to decide what "compliant" should mean for an AGENT, and who might reasonably assume it boils down to the EU AI Act and a handful of other acts, when the LexLint law library holds 567 AI instruments in force or enacted across 150 jurisdictions, and far more law that binds an AGENT without naming AI at all. And the engineer writing agentic software today, who wants to know which of the things the AGENT does are legal events, and where.

The paper is a summary, not an analysis of any system. It states the law as the law library held it on 6 November 2026, and it analyses only law in force or enacted with a start date; a proposal is named, if at all, as something coming. The larger the reach of an instrument, the more room it gets, so the EU and the United States lead most sections and a city ordinance appears once. The vocabulary is the one in Introduction: The 6 parties in AI law: the parties around a piece of software, each with a location, and an AGENT in the middle acting on most of them at once. This paper attaches the statutes to that picture.

A word on the source. LexLint is a law library first, indexed by jurisdiction and dated on every row, and it is also a tool: a lint that takes a description of what a piece of software does and where it operates and returns the obligations the law library associates with it, cited and dated, so the library can be used as background when a system is examined for legal risk. For a project that provides deep infrastructure to an application, an AGENT proxy or a runtime, that examination is harder, because the project cannot know what its USERS will do with it. What such a project can do is support the legal questions of its USERS, by giving its logs and its controls some awareness of the facts the law turns on. The fourth document in this section is about that.

2The map: what "AI law" is, by shape and by jurisdiction

AI law is not one shape. Read across the law library, the instruments in force that name AI as their subject fall into six kinds, and an AGENT meets each kind differently.

Not every AI act binds a business. Japan's AI Promotion Act (since 4 Jun 2025) sets up a strategy headquarters and a national plan, and asks a business only to endeavor to use AI and to cooperate with the government's measures. The one AI-specific duty the law library holds for Japan is an election rule: a 2026 amendment to its election law requires an AI-made image or video in online campaign material to be labeled as such, from 1 March 2027.

By jurisdiction, the law library holds AI instruments in the regions below. The count is of instruments it holds in force or enacted, which is a measure of law rather than of any one country's attention; the largest single share is the American states' own statute books, and the largest single instrument is the EU's.

Every AI instrument the law library holds in force or enacted is listed in the appendix at the end of this page, by region, each linked to its summary page.

The zero on the United States' federal row is a finding rather than a gap. Congress has enacted no horizontal AI act, and the two federal AI instruments the law library holds are both proposals, so neither is counted here. It does not mean no federal law reaches generated content: the TAKE IT DOWN Act criminalizes publishing intimate images a system generated, and people have been prosecuted under it. The law library files that statute under content moderation rather than AI, which is why it is absent from this table and present in Does legal action really happen?. Read the row as "no federal AI statute", never as "no federal law".

3What the laws have in common

Eight threads run through most of the AI law in force. An engineer who builds for the threads rather than for any one statute will find that most statutes are then a matter of parameters.

Tell the person they are dealing with a machine

The most widely shared duty, and the oldest of the new ones. AI Act Article 50 requires it of any system that interacts with people unless it is obvious from context; Korea's Article 31 requires prior notice that a service runs on generative AI; Texas, Utah and California's 2019 bot-disclosure act each say it in their own terms, and California's companion chatbot act adds a duty to repeat the reminder to a minor. The differences are in the trigger (always, on request, at first use, on a schedule) and in who owes it (provider, deployer, OPERATOR).

Mark what the machine made

A second duty attaches to the output rather than the interaction: machine-readable marking of synthetic audio, image, video and text. It is in Article 50(2), in India's rules, which require permanent metadata with a unique identifier, in Vietnam's transparency article, and in California's AI Transparency Act. For an AGENT the consequence is architectural: the mark has to be applied where the output is produced and preserved by every layer that carries it.

Tier by risk, with a prohibited top

The horizontal acts share a shape: a list of prohibited practices, a class of high-risk or high-impact uses with the heaviest duties, and a lighter regime for the rest. Vietnam and Peru both open with prohibitions; Texas's TRAIGA is almost entirely a list of them, binding any person. Prohibition is how the law tiers: the AI instruments in the law library carry more prohibition lines than any other class.

Keep a person able to intervene, and give affected people a way to one

Human oversight appears in two forms: a duty on the OPERATOR to keep a person able to stop or override the system, and a right for the person affected by a decision to reach a human and contest it. The second form is older than AI law and arrives mostly through privacy statutes (section 5). The first is the AI Act's Article 14, Vietnam's rule that oversight mechanisms must not be disabled, and Peru's bar on autonomous lethal capability without supervision.

Keep records, and be able to explain

Record-keeping comes in three registers: automatic event logs for high-risk systems (the AI Act's Article 12, with a six-month retention floor on deployers in Article 26), an explanation to the person affected by a decision (Peru, California's regulations), and documentation kept for a regulator (Article 53, California's frontier act). The logging and record-keeping questions a governance framework asks are these three duties, seen from the OPERATOR'S side.

Assign duties by role along a chain

The AI Act names a provider, a deployer, an importer, a DISTRIBUTOR, an authorized representative and a product manufacturer for one system, a seventh role for general-purpose model providers, and a rule in Article 25 under which a deployer, DISTRIBUTOR or importer becomes the provider by putting its name on a high-risk system, substantially modifying it, or changing a system's purpose so that it becomes high-risk. Korea's act keys on the "AI business operator"; the United States state acts on the "deployer" and the "developer". One company usually holds three of these roles at once, and the role, not the code, decides the duty.

Reach by market and by output, not by where the server is

The AI Act reaches a provider anywhere that places a system on the EU market and a provider or deployer anywhere whose output is used in the Union. State acts reach a company that does business in the state when the consumer is a resident. Korea's act reaches acts abroad that affect its market. The server's location is the one fact none of them turns on.

Commence in stages, and change while in flight

The AI Act binds in dated stages, the first on 2 February 2025 and the last on 2 August 2028, and the omnibus regulation of July 2026 moved the high-risk stages back by more than a year while leaving the transparency duties on their August 2026 date. Colorado enacted an AI act in 2024, delayed it in 2025, and repealed and re-enacted it in 2026 before any line of it was in force, as an automated-decision act (from 1 Jan 2027, in 2 months). A map of AI law is a dated artifact, and a system that reads the map once is out of date the month after. More is coming: Brazil's framework bill has passed its Senate, and several EU member states have implementing acts in draft (section 7).

4Provisions that are unusual, and awkward for an AGENT

The common threads are what a framework captures. The provisions below are the ones a framework does not, because each is one jurisdiction's own idea, and each lands on something an AGENT does routinely. The EU comes first, then the United States by state, then the rest of the world by name.

5The law that was already there

Most attention is on the AI statutes, and above all on the EU AI Act. But the law library holds far more law that binds an AGENT without naming AI at all. Privacy law is the largest topic in it, scraping and access law the second, and both are older than any AI act. The table under each heading gives the kind of duty, an instrument in the law library, and what the duty asks of an AGENT in particular.

5.1 Privacy law: the AGENT as a processor of people

1,939 instruments in force or enacted, across 254 jurisdictions. Every one of them keys on a person whose data is in the payload, which for an AGENT is nearly every payload.

5.2 Cybersecurity law: the AGENT as a product and as an incident

5.3 Scraping, access and content law: the AGENT as a visitor on other people's machines

583 instruments in force or enacted, across 258 jurisdictions. This is the body of law an AGENT meets every time it fetches a page, calls an interface it was not invited to, or reuses what it found.

5.4 Consumer, contract and outreach law: the AGENT as a contracting party's instrument and as a caller

5.5 Sector and people-specific law

6Where the AI laws restate what was already required

Read against section 5, a large share of the new AI law is a restatement or a refinement of a duty the same jurisdiction already had, aimed at a new class of system. That is good news for an engineering team, because a control built for the old duty is usually most of the new one. The table pairs them.

7The EU: "AI Act compliant" is not "compliant in the EU"

The AI Act is a regulation, directly applicable in every member state, and that has led to a habit of treating it as the whole of EU AI law. It is not, for two reasons the law library makes visible.

First, the Act leaves to each member state the designation of its market surveillance and notifying authorities, the procedure they follow, the penalties within the Act's ranges, and the treatment of public bodies. Those choices are national statutes, and they differ: which authority a provider answers to, what powers it has, whether a public body can be fined and by how much, and how the prohibitions in Article 5 are enforced. A system that is compliant with the Act has to be compliant with it in front of a named authority under a named procedure, and there are twenty-seven of those.

Implementing acts are in draft in Germany, France, Luxembourg, Netherlands, Sweden, Slovakia; they are not analyzed here.

Second, member states keep their own law on what AI systems produce and how they are used at work, and that law is not displaced by the Act. Italy's Law 132 of 2025 requires parental consent for under-fourteens, sets sector rules for oversight and disclosure, and creates a criminal offense for disseminating harmful generated content. France, Ireland, the Netherlands and most other member states have extended their intimate-image and child-abuse offenses to generated material. Spain gives works councils a right to the parameters of algorithms that affect working conditions. None of this is in the AI Act, all of it binds an AGENT operating in that country, and the omnibus regulation of July 2026 changed none of it.

The practical reading: EU compliance for an AGENT is the Act, plus the implementing act of every member state whose market it is placed on or whose residents' output it produces, plus that state's own criminal, labor and consumer law on synthetic content and automated management. The law library documents the national layer on each member state's page rather than restating the Act there; the Act is one instrument, held once.

8How the law reaches the AGENT

Put the statutes onto the second figure of the parties document, and each line out of the AGENT'S box collects a family of law. The table is the whole paper in one place.

One AGENT, six instruments

Take an AGENT operated by a company whose main establishment is in the United States, offered to consumers in Ireland and Virginia, built on a general-purpose model its provider placed on the EU market, that answers questions by fetching pages from a German publisher and stores USER prompts that sometimes include the USER'S location. Six instruments reach it, each through a different party.

Swap the Irish USER for one in Seoul and the AI rows change to Korea's Article 31; swap Virginia for Texas and the privacy row becomes Texas's sensitive-data consent. Nothing about the OPERATOR changed. One field in the request did, which is why the applicability question is answered per transaction from facts the AGENT either recorded or lost.

What a control on the request path can do about it

Of the requirement lines in force that an independent classification has reached (2,289 on 6 November 2026), 39% can be prevented by a control on the request path (refuse a destination, require a claim, transform a payload), 16% can be detected there but are discharged in the application's interface or process, 11% are performed elsewhere with the control's record as the evidence, and 34% never cross the request path at all: lawful basis, conformity assessment, registration, contracts. By topic the pattern is sharp: scraping law is overwhelmingly enforceable at the edge, AI law is mostly detectable, since its disclosure and marking duties close in the interface, and the out-of-path share of privacy law is what has to be staffed rather than engineered. A control that sits in the enforceable tier is a technical measure, not a finding that the duty is met.

9What it costs

The enforcement examples this paper would otherwise carry are in their own document, Does legal action really happen?, each starting from an ordinary product feature and ending in a figure with its primary source. The law library also records the enforcement climate of a regime where a regulator or a tracker publishes one; the figures below, read on the date shown, say the powers are used.

10What this paper does not claim

It does not say which of these instruments binds any particular system; that is decided per deployment from the roles the system's OPERATOR holds and where its parties are. It analyses law in force or enacted on the date the law library was read, and a law that moved after it may have moved the answer. The appendix is a list of what the law library holds, not a census of the world's law. Nothing here is legal advice.

Appendix: every AI instrument in force or enacted, by region

Read from the law library on 6 November 2026. Each name links to the summary page carrying its citation, status, start date and source.

European Union: 71 provisions in 1 jurisdictions

Jurisdiction	Instrument	When	Asks of an app
European Union	AI Act, Article 10 (data and data governance)	from 2 Dec 2027, in 13 months	govern the system: policies, roles, assessments
European Union	AI Act, Article 11 (technical documentation)	from 2 Dec 2027, in 13 months	govern the system: policies, roles, assessments
European Union	AI Act, Article 111(2) (2030 compliance deadline for public-authority-intended systems)	from 2 Aug 2030, in 3.7 years	govern the system: policies, roles, assessments
European Union	AI Act, Article 12 (record-keeping)	from 2 Dec 2027, in 13 months	govern the system: policies, roles, assessments
European Union	AI Act, Article 13 (transparency and provision of information to deployers)	from 2 Dec 2027, in 13 months	disclose the use of AI
European Union	AI Act, Article 14 (human oversight)	from 2 Dec 2027, in 13 months	govern the system: policies, roles, assessments; limits on biometric use
European Union	AI Act, Article 15 (accuracy, robustness and cybersecurity)	from 2 Dec 2027, in 13 months	secure the system and the data in it; govern the system: policies, roles, assessments
European Union	AI Act, Article 16 (obligations of providers of high-risk AI systems)	from 2 Dec 2027, in 13 months	govern the system: policies, roles, assessments; disclose the use of AI; assess the impact on personal data first; hold a license or registration
European Union	AI Act, Article 17 (quality management system)	from 2 Dec 2027, in 13 months	govern the system: policies, roles, assessments
European Union	AI Act, Article 18 (documentation keeping)	from 2 Dec 2027, in 13 months	govern the system: policies, roles, assessments; keep records for a set time
European Union	AI Act, Article 19 (automatically generated logs)	from 2 Dec 2027, in 13 months	govern the system: policies, roles, assessments; keep records for a set time
European Union	AI Act, Article 20 (corrective actions and duty of information)	from 2 Dec 2027, in 13 months	report to a regulator; disclose the use of AI
European Union	AI Act, Article 21(1) and (3) (provider's information and documentation to a competent authority on a reasoned request, and confidentiality)	from 2 Dec 2027, in 13 months	govern the system: policies, roles, assessments
European Union	AI Act, Article 21(2) (competent authority access to automatically generated logs)	from 2 Dec 2027, in 13 months	govern the system: policies, roles, assessments
European Union	AI Act, Article 22 (authorised representative of a provider established in a third country: appointment, mandate, tasks and termination)	from 2 Dec 2027, in 13 months	govern the system: policies, roles, assessments; report to a regulator
European Union	AI Act, Article 22(3), points (b) and (c) (authorised representative: documents held for 10 years and access to logs)	from 2 Dec 2027, in 13 months	govern the system: policies, roles, assessments; keep records for a set time
European Union	AI Act, Article 23 (obligations of importers of high-risk AI systems)	from 2 Dec 2027, in 13 months	govern the system: policies, roles, assessments; keep records for a set time; report to a regulator
European Union	AI Act, Article 24 (obligations of distributors of high-risk AI systems)	from 2 Dec 2027, in 13 months	govern the system: policies, roles, assessments; report to a regulator
European Union	AI Act, Article 25 (responsibilities along the AI value chain)	from 2 Dec 2027, in 13 months	govern the system: policies, roles, assessments; put the terms in the contract
European Union	AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring)	from 2 Dec 2027, in 13 months	govern the system: policies, roles, assessments; report to a regulator
European Union	AI Act, Article 26(10) (post-remote biometric identification authorisation)	from 2 Dec 2027, in 13 months	limits on biometric use; govern the system: policies, roles, assessments; report to a regulator
European Union	AI Act, Article 26(11) (informing individuals subject to an Annex III decision)	from 2 Dec 2027, in 13 months	disclose the use of AI
European Union	AI Act, Article 26(6) (deployer log-keeping)	from 2 Dec 2027, in 13 months	govern the system: policies, roles, assessments; keep records for a set time
European Union	AI Act, Article 26(7) (informing workers before workplace use)	from 2 Dec 2027, in 13 months	disclose the use of AI
European Union	AI Act, Article 26(8) (public-authority deployer registration)	from 2 Dec 2027, in 13 months	hold a license or registration
European Union	AI Act, Article 26(9) (using Article 13 information for a data protection impact assessment)	from 2 Dec 2027, in 13 months	assess the impact on personal data first
European Union	AI Act, Article 27 (fundamental rights impact assessment)	from 2 Dec 2027, in 13 months	assess the impact on personal data first
European Union	AI Act, Article 4 (AI literacy)	since 2 Feb 2025	govern the system: policies, roles, assessments
European Union	AI Act, Article 43 (conformity assessment procedures)	from 2 Dec 2027, in 13 months	assess the impact on personal data first
European Union	AI Act, Article 4a (processing of special categories of personal data for bias detection and correction)	since 27 Jul 2026	govern the system: policies, roles, assessments; secure the system and the data in it
European Union	AI Act, Article 5 (prohibited AI practices)	since 2 Feb 2025	do not do the named thing
European Union	AI Act, Article 5(1)(ba) and (bb) (AI-generated non-consensual intimate imagery and child sexual abuse material)	from 2 Dec 2026, in 4 weeks	do not do the named thing
European Union	AI Act, Article 50 (transparency obligations for AI systems and synthetic content)	since 2 Aug 2026	label generated content; disclose the use of AI
European Union	AI Act, Article 53 (obligations for providers of general-purpose AI models)	since 2 Aug 2025	disclose the use of AI; govern the system: policies, roles, assessments; respect text and data mining opt-outs
European Union	AI Act, Article 54 (authorised representatives of providers of general-purpose AI models)	since 2 Aug 2025	govern the system: policies, roles, assessments; keep records for a set time
European Union	AI Act, Article 55 (obligations for providers of general-purpose AI models with systemic risk)	since 2 Aug 2025
European Union	AI Act, Article 56 (codes of practice for general-purpose AI models)	since 2 Aug 2025	govern the system: policies, roles, assessments
European Union	AI Act, Article 57 (national AI regulatory sandboxes)	from 2 Aug 2027, in 9 months	govern the system: policies, roles, assessments
European Union	AI Act, Article 59 (further processing of personal data for developing certain AI systems in the public interest in an AI regulatory sandbox)	since 2 Aug 2026	govern the system: policies, roles, assessments; secure the system and the data in it
European Union	AI Act, Article 6(1) and Annex I (high-risk classification of a safety component or product under Annex I harmonisation legislation: provider duties)	from 2 Aug 2028, in 1.7 years	govern the system: policies, roles, assessments; assess the impact on personal data first
European Union	AI Act, Article 6(2) and Annex III, point 5(b) (creditworthiness and credit-scoring systems: provider duties)	from 2 Dec 2027, in 13 months	govern the system: policies, roles, assessments; assess the impact on personal data first
European Union	AI Act, Article 6(3) and (4) (narrow-task derogation from Annex III high-risk classification)	from 2 Dec 2027, in 13 months	govern the system: policies, roles, assessments; assess the impact on personal data first
European Union	AI Act, Article 60a (real-world testing frameworks for products under the Annex I, Section B legislation)	since 2 Aug 2026	govern the system: policies, roles, assessments
European Union	AI Act, Article 72 (post-market monitoring by providers and post-market monitoring plan)	from 2 Dec 2027, in 13 months	govern the system: policies, roles, assessments
European Union	AI Act, Article 73 (reporting of serious incidents)	from 2 Dec 2027, in 13 months
European Union	AI Act, Article 75 and Articles 75a to 75d (AI Office supervision, investigation, commitments, fines and periodic penalty payments)	since 2 Aug 2026	report to a regulator; govern the system: policies, roles, assessments
European Union	AI Act, Article 85 (right to lodge a complaint with a market surveillance authority)	since 2 Aug 2026	honor the person's rights over their data
European Union	AI Act, Article 86 (right to explanation of individual decision-making)	from 2 Dec 2027, in 13 months	honor the person's rights over their data
European Union	AI Act, Article 9 (risk management system)	from 2 Dec 2027, in 13 months	govern the system: policies, roles, assessments
European Union	AI Act, Articles 51 and 52 (classification of general-purpose AI models with systemic risk and the notification procedure)	since 2 Aug 2025	report to a regulator
European Union	AI Act, Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent)	since 2 Aug 2026	govern the system: policies, roles, assessments; get consent first; report to a regulator
European Union	AI Act, Articles 74(12) and (13) and 77 (market surveillance access to documentation, data sets and source code, and the access of authorities protecting fundamental rights)	from 2 Dec 2027, in 13 months	govern the system: policies, roles, assessments
European Union	AI Act, Articles 79 and 81 (AI systems presenting a risk: national procedure and Union safeguard procedure)	since 2 Aug 2026	govern the system: policies, roles, assessments
European Union	AI Act, Articles 80, 82 and 83 (misclassified systems, compliant systems presenting a risk, formal non-compliance)	from 2 Dec 2027, in 13 months	govern the system: policies, roles, assessments
European Union	AI Act, Articles 88 to 94 (enforcement of the obligations of providers of general-purpose AI models)	since 2 Aug 2026	report to a regulator; govern the system: policies, roles, assessments
European Union	Anti-Money-Laundering Regulation, Human Oversight of AI-Generated Information Shared in Partnerships for Information Sharing (Article 75(4), Point (g))	from 10 Jul 2027, in 8 months
European Union	Anti-Money-Laundering Regulation: Reporting of Suspicions to the Financial Intelligence Unit and Prohibition of Disclosure (Articles 69 and 73)	from 10 Jul 2027, in 8 months	report to a regulator; do not do the named thing
European Union	Capital Requirements Directive, Robust Governance Arrangements of Institutions (Article 74(1))	since 31 Dec 2013	govern the system: policies, roles, assessments
European Union	Consumer Credit Directive, Duty to Assess the Consumer's Creditworthiness Before Lending (Article 18)	from 20 Nov 2026, in 2 weeks	govern the system: policies, roles, assessments; disclose the use of AI
European Union	Consumer Rights Directive, Adequate Explanations and Human Intervention in Online Tools for Distance Financial Services Contracts (Article 16d)	since 19 Jun 2026
European Union	Digital Services Act, Article 35(1)(k) (systemic risk mitigation, synthetic media marking)	since 25 Aug 2023	label generated content; govern the system: policies, roles, assessments; assess the impact on personal data first
European Union	Digital Services Act, Article 37 (independent audit of very large online platforms and search engines)	since 25 Aug 2023	govern the system: policies, roles, assessments; report to a regulator
European Union	European Health Data Space Regulation, High-Risk AI Systems Claiming Interoperability with EHR Systems (Article 27(2))	from 26 Mar 2029, in 2.4 years
European Union	Fourth Anti-Money-Laundering Directive: Reporting of Suspicious Transactions to the Financial Intelligence Unit and Prohibition of Disclosure (Articles 33 and 39)	since 26 Jun 2017	report to a regulator; do not do the named thing
European Union	Machinery Regulation, Conformity Assessment of Machine-Learning Safety Components and Embedded Systems (Annex I, Part A, Points 5 and 6)	from 14 Jan 2027, in 2 months
European Union	Medical Device Regulation, Annex VIII Rule 11 (classification of software) with Article 52 (conformity assessment by class)	since 26 May 2021	assess the impact on personal data first
European Union	MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6)	since 3 Jan 2018	govern the system: policies, roles, assessments; report to a regulator; secure the system and the data in it
European Union	MiFID II Product Governance for Manufacturers and Distributors of Financial Instruments (Articles 16(3) and 24(2) and Delegated Directive 2017/593 Articles 9 and 10)	since 3 Jan 2018	govern the system: policies, roles, assessments
European Union	MiFID II Suitability Assessment for Investment Advice and Portfolio Management, Including Automated and Semi-Automated Systems (Article 25(2) and Delegated Regulation 2017/565 Article 54)	since 3 Jan 2018	disclose the use of AI; govern the system: policies, roles, assessments
European Union	MiFID II and MiFIR Records of Services, Activities, Orders and Transactions (Article 16(6) and MiFIR Article 25)	since 3 Jan 2018	keep records for a set time; govern the system: policies, roles, assessments
European Union	Toy Safety Regulation, Safety Assessment of Toys Within the Scope of the AI Act (Article 25(2), Point (c))	from 1 Aug 2030, in 3.7 years

EU member states (the national layer): 78 provisions in 25 jurisdictions

Jurisdiction	Instrument	When	Asks of an app
Austria	KommAustria-Gesetz and Telekommunikationsgesetz 2021, Servicestelle für Künstliche Intelligenz at the RTR-GmbH	since 1 Jan 2024
Austria	StGB Section 207a(4)(4), Computer-Generated and Altered Child Sexual Abuse Material	since 1 May 2004	do not do the named thing
Austria	Verbraucherkreditgesetz 2026 (VKrG 2026), Personalized Offers and Automated Creditworthiness Assessment (Sections 13 and 17(5))	from 20 Nov 2026, in 2 weeks
Bulgaria	Решение № 398 на Министерския съвет (Council of Ministers Decision No. 398), Fundamental-Rights Authorities under Article 77 of the AI Act	from a date not yet set
Cyprus	Intellectual Property and Related Rights Law, Articles 49-50 (Non-Consensual Deepfake Imitation Ban)	since 23 Mar 2026	do not do the named thing; get consent first
Cyprus	Law 91(I)/2014 as Amended by Law 59(I)/2025, Child Sexual Abuse Material Including Realistic Images (Articles 2 and 8)	since 25 Apr 2025	do not do the named thing
Czech Republic	Criminal Code Section 181(2), Realistic Fake Depiction of a Person Made to Cause Serious Harm to Rights	since 1 Jan 2026	do not do the named thing
Czech Republic	Criminal Code Section 191a, Non-Consensual Identity-Based Pornographic Depiction	since 1 Jan 2026	do not do the named thing
Czech Republic	Criminal Code Section 192, Child Pornography Including a Depiction of a Person Who Appears to Be a Child	since 1 Dec 2011	do not do the named thing
Germany	Betriebsverfassungsgesetz (BetrVG) Sections 80(3), 90(1) No. 3 and 95(2a), Works Council Rights on the Use of Artificial Intelligence	since 18 Jun 2021
Germany	Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act	since 29 Jul 2026	govern the system: policies, roles, assessments; report to a regulator
Germany	Medienstaatsvertrag (MStV) Section 18(3), Labelling of Automatically Created Content in Social Networks	since 7 Nov 2020
Denmark	Lov nr. 1322 af 20. november 2025, Credit Agreements Act Section 7 c(9) to (11), Human Intervention in Automated Creditworthiness Assessment	from 20 Nov 2026, in 2 weeks
Denmark	Lov nr. 467 af 14. maj 2025, National Competent Authorities and Article 5 Enforcement	since 2 Aug 2025	do not do the named thing; govern the system: policies, roles, assessments
Estonia	Kutseõppeasutuse seadus Section 32^1, Artificial Intelligence Applications in Vocational Teaching and Pupils' Personal Data	since 30 Jun 2026
Estonia	Põhikooli- ja gümnaasiumiseadus Section 20^1, Artificial Intelligence Applications in Teaching and Pupils' Personal Data	since 8 Jan 2026
Estonia	Väärtpaberituru seadus Sections 82^15 and 82^16, Algorithmic Trading and Direct Electronic Access Controls	since 3 Jan 2018
Estonia	Võlaõigusseadus Section 55^2, Explanations to Consumers and Human Intervention in Online Financial Services	since 1 Sep 2026
Spain	Estatuto de los Trabajadores Article 64.4.d), Algorithmic Management Works Council Information Right	since 30 Sep 2021
Spain	Ley 10/2025 Final Provisions 1 and 3, Disclosure of Automated Personalisation of Offers and Prices to Consumers	since 28 Dec 2025
Spain	Ley 10/2025, Customer Service Rules for Automated Channels (Article 8 and Transitional Provision)	from 28 Dec 2026, in 7 weeks
Spain	Ley 15/2022 Article 23, Artificial Intelligence and Automated Decision-Making Mechanisms in Public Administrations	since 14 Jul 2022
Spain	Real Decreto 723/2026 Article 3(2)(k), Written Notice to Workers of Algorithmic and Automated Decision-Making Systems	since 5 Oct 2026
Spain	Real Decreto 729/2023, Statute of the Agencia Española de Supervisión de Inteligencia Artificial (AESIA), Article 4	since 3 Sep 2023
Finland	Laki eräiden tekoälyjärjestelmien valvonnasta, Act on the Supervision of Certain Artificial Intelligence Systems	since 1 Jan 2026	govern the system: policies, roles, assessments
Finland	Rikoslaki Chapter 20, Distribution and Possession of an Image Depicting a Child Sexually, Including Realistic Depictions	since 1 Jan 2023	do not do the named thing
France	Code Pénal Article 226-8 as Amended, Existing Offense Extended to Algorithmically Generated Content	since 23 May 2024	do not do the named thing
France	Code Pénal Article 226-8-1, Non-Consensual Sexual Montage and Algorithmically Generated Sexual Content	since 23 May 2024	do not do the named thing
France	Law 2023-380, Article 10, Experimental Algorithmic Processing of Video-Protection Images, Extended to 31 December 2030	since 20 Aug 2026	do not do the named thing; govern the system: policies, roles, assessments
France	Law 2023-451, Article 5, Labelling of Retouched and AI-Generated Images by Commercial Influencers	in force	label generated content
Greece	Law 5321/2026, National AI Act Implementation Law	since 20 Jul 2026	label generated content
Croatia	Act Implementing the European Media Freedom Act, Article 23, Labelling of AI-Generated Content	since 26 Mar 2026	label generated content
Croatia	Consumer Credit Act, Articles 24 and 30, Personalised Offers and Creditworthiness Assessment by Automated Processing	from 20 Nov 2026, in 2 weeks	disclose the use of AI; honor the person's rights over their data
Croatia	Kazneni zakon Article 215a, Endangering Life and Property by an Artificial Intelligence System	since 13 Nov 2025	do not do the named thing
Croatia	Labour Act, Articles 221.g to 221.i, Algorithmic Management of Work Through Digital Labour Platforms	since 1 Jan 2024	disclose the use of AI; govern the system: policies, roles, assessments
Hungary	Act LXXV of 2025 on the Domestic Implementation of the EU AI Regulation	since 1 Dec 2025	govern the system: policies, roles, assessments
Hungary	Act XLVII of 1997 on Health Data, Section 35/A(4) to (8), Conditions for AI Development on Electronic Health Service Space Data	since 1 Jan 2026	govern the system: policies, roles, assessments; assess the impact on personal data first
Hungary	Büntető Törvénykönyv (Criminal Code), Section 204(8), Realistic Depiction of a Non-Existent Person as Child Pornography	since 8 Jul 2021	do not do the named thing
Hungary	Government Decree 344/2025 Implementing the Hungarian AI Act: Designated Authorities, Notified-Body Reports and Fine Ceilings	since 1 Dec 2025	report to a regulator; govern the system: policies, roles, assessments
Ireland	European Union (Artificial Intelligence) (Designation) Regulations 2025	since 25 Jul 2025
Ireland	Harassment, Harmful Communications and Related Offences Act 2020, Intimate Image Offences	since 10 Feb 2021	do not do the named thing; get consent first
Ireland	Regulation of Artificial Intelligence Act 2026	since 31 Jul 2026
Italy	Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them	since 30 Sep 2026	govern the system: policies, roles, assessments; secure the system and the data in it
Italy	Codice Penale Art. 612-quater, Illicit Dissemination of AI-Generated or AI-Altered Content	since 10 Oct 2025	do not do the named thing; get consent first
Italy	Decreto Legislativo 160/2026 Art. 14, Preventive Seizure of AI-Generated Online Content (Implementing Norms of the Codice di Procedura Penale, Art. 104, Letter e-bis)	since 30 Sep 2026
Italy	Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10)	since 30 Sep 2026	limits on biometric use; govern the system: policies, roles, assessments; assess the impact on personal data first; keep records for a set time
Italy	Decreto Legislativo 160/2026, Civil Damages Actions for Harm Caused by AI Systems (Artt. 16-20)	since 30 Sep 2026	disclose the use of AI
Italy	Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13)	since 30 Sep 2026	limits on biometric use; govern the system: policies, roles, assessments; assess the impact on personal data first
Italy	Decreto Legislativo 160/2026, Police Use of AI Systems: Human Review, Oversight, Collaborations, Sandbox Basis and Training (Artt. 3-6, 21)	since 30 Sep 2026	govern the system: policies, roles, assessments
Italy	Decreto Legislativo 179/2026 Art. 41, Employer Decisions Assisted by AI Systems (Final Decisions Reserved to a Person)	since 23 Oct 2026
Italy	Decreto Legislativo 179/2026 Arts. 4 to 6 and 21 to 23, National AI Act Authorities and Administrative Fines	since 23 Oct 2026
Italy	Decreto Legislativo 231/2001 Art. 25-vicies, Entity Liability for Offences Committed with the Use of AI Systems	since 30 Sep 2026
Italy	Legge 132/2025 Art. 20, National AI Authorities (AgID and ACN)	since 10 Oct 2025
Italy	Legge 132/2025, Sector Human-Oversight and Disclosure Duties (Artt. 4, 11, 13)	since 10 Oct 2025
Italy	Legislative Decree 216/2003, equal treatment in employment and working conditions	since 28 Aug 2003	do not do the named thing
Lithuania	Criminal Code Art. 309(2), Dealing in Child Sexual Abuse Material Including Simulated Depictions	since 25 Mar 2014	do not do the named thing
Lithuania	Lithuanian Law Amendments Designating National Competent Authorities under the AI Act	since 1 Apr 2025
Latvia	Consumer Rights Protection Centre Statute, Points 4.3.1 11 and 4.22.5, AI Act Market Surveillance and Single Point of Contact Tasks	since 15 Aug 2025	govern the system: policies, roles, assessments
Latvia	Krimināllikums Sections 90.1 and 90.2, Criminalization of Deepfake Election and State-Appointment Disinformation	since 22 May 2024	do not do the named thing
Latvia	Law on Digital Operational Resilience of the Financial Market and the Use of Artificial Intelligence, Articles 7, 8(5)-(7), 10(3)-(4) and 11(2)	since 1 Oct 2025	do not do the named thing; disclose the use of AI; govern the system: policies, roles, assessments
Latvia	Ombudsman Law (Tiesībsarga likums), Article 13, Points 15 and 16, Access to AI System Documentation and Testing Requests	since 11 Feb 2026	govern the system: policies, roles, assessments
Latvia	Pre-Election Campaigning Law, Articles 3.1 and 31.1, Indicating AI-Generated Campaign Content and the Ban on Further Distribution	since 7 Nov 2024	label generated content
Malta	Artificial Intelligence (Designation of the Information and Data Protection Commissioner for the purposes of Regulation (EU) 2024/1689) Regulations, 2025 (L.N. 227 of 2025)	since 10 Oct 2025	limits on biometric use; govern the system: policies, roles, assessments
Malta	Artificial Intelligence Regulations, 2025 (L.N. 226 of 2025)	since 10 Oct 2025	govern the system: policies, roles, assessments
Malta	Criminal Code, Article 208A, Indecent Material Involving Persons Under Age Including Digitally Created and Non-Existent Minors	in force	do not do the named thing
Malta	Malta Digital Innovation Authority Act, Article 6A, Market Surveillance Enforcement Powers of the Authority	in force	govern the system: policies, roles, assessments
Netherlands	Wetboek van Strafrecht, art. 252, Sexual Imagery of an Apparent Minor (Virtual Child Sexual Abuse Material)	since 1 Jul 2024	do not do the named thing
Poland	Kodeks karny art. 202 § 4b-4c, Fabricated Child Sexual Abuse Material	in force	do not do the named thing
Poland	Ustawa o systemach sztucznej inteligencji, Act on Artificial Intelligence Systems	since 11 Aug 2026	govern the system: policies, roles, assessments
Portugal	Labour Code as Amended by Law 13/2023, Algorithms and Artificial Intelligence in Employment: Articles 106(3)(s), 24(3) and 3(3)(o)	since 1 May 2023	disclose the use of AI
Portugal	Portuguese Charter of Human Rights in the Digital Era, Article 9, Use of Artificial Intelligence and Robots	since 16 Jul 2021	govern the system: policies, roles, assessments; disclose the use of AI
Romania	Cod penal, Art. 374, Pornografia infantilă (Child Pornography, Including Simulated or Computer-Generated Depictions of Minors)	since 1 Feb 2014	do not do the named thing
Sweden	Brottsbalken 16 kap. 10 a-10 b §§, Child Pornography Offence (Barnpornografibrott)	since 1 May 2020	do not do the named thing
Sweden	Consumer Credit Act (2026:1011), Chapter 2 Section 7 and Chapter 3 Section 15, Personalised Offers and Credit Assessment by Automated Processing	from 20 Nov 2026, in 2 weeks	disclose the use of AI; honor the person's rights over their data
Slovenia	Kazenski zakonik (KZ-1, Criminal Code), Art. 176(3), Pornographic Material Involving a Minor's Realistic Likeness	since 1 Nov 2008	do not do the named thing
Slovenia	Media Act (ZMed-1), Articles 66 and 67, Labelling of AI-Generated Media Content and Publisher Responsibility	since 27 Sep 2025	label generated content; disclose the use of AI
Slovenia	Zakon o izvajanju uredbe (EU) o določitvi harmoniziranih pravil o umetni inteligenci (ZIUDHPUI), Designation of AI Act Market Surveillance Authorities	since 21 Nov 2025	govern the system: policies, roles, assessments
Slovakia	Trestný zákon, Child Pornography Including Simulated Depictions	since 1 Jan 2006

United Kingdom: 25 provisions in 1 jurisdictions

Jurisdiction	Instrument	When	Asks of an app
United Kingdom	Authorized Technology Testing Defense for Obscenity and Child Abuse Image Offenses (Regulation-Making Power)	since 29 Jun 2026
United Kingdom	Automated Decision-Making: Significant Decisions Based Solely on Automated Processing (UK GDPR Articles 22A to 22D)	since 5 Feb 2026	honor the person's rights over their data; disclose the use of AI
United Kingdom	CMA Publisher Conduct Requirement on Google's general search services	from 3 Dec 2026, in 4 weeks
United Kingdom	Compliance function of a common platform firm: compliance-risk policies and procedures, and a permanent and effective compliance function that operates independently	since 23 Oct 2025	govern the system: policies, roles, assessments
United Kingdom	Compliance: adequate policies and procedures, and a director or senior manager's oversight of compliance	since 3 Jan 2018	govern the system: policies, roles, assessments
United Kingdom	Consumer Credit Act 1974, duty to tell a refused applicant that a credit reference agency was used and to give its name and address	since 1 Feb 2011	disclose the use of AI
United Kingdom	Copies for Text and Data Analysis for Non-Commercial Research (Copyright, Designs and Patents Act 1988, s. 29A)	since 1 Jun 2014	respect text and data mining opt-outs; credit or license the publisher's content
United Kingdom	Creating, or Requesting the Creation of, Purported Intimate Image of Adult	since 6 Feb 2026	do not do the named thing; get consent first
United Kingdom	Equality Act 2010, discrimination by a service-provider, with indirect discrimination and the exceptions for financial services and insurance	since 1 Oct 2010	do not do the named thing
United Kingdom	Equality Act 2010, duty on a service-provider to make reasonable adjustments for disabled persons	since 1 Oct 2010	do not do the named thing
United Kingdom	FCA Handbook, CONC 5.2A, assessing the creditworthiness of a customer before consumer credit is granted or significantly increased	since 1 Nov 2018	govern the system: policies, roles, assessments
United Kingdom	Fundamental Rule 5: effective risk strategies and risk management systems	since 19 Jun 2014	govern the system: policies, roles, assessments
United Kingdom	General organizational requirements: governance arrangements, internal controls, information security and business continuity	since 3 Jan 2018	govern the system: policies, roles, assessments; secure the system and the data in it
United Kingdom	General outsourcing requirements for a common platform firm: relying on a third party to perform operational functions, including critical or important functions	since 3 Jan 2018	govern the system: policies, roles, assessments
United Kingdom	Making or Supplying a Generator of Purported Intimate Images	since 29 Jun 2026	do not do the named thing
United Kingdom	Making, Adapting, Possessing or Supplying a Child Sexual Abuse Image-Generator, England and Wales	from a date not yet set	do not do the named thing
United Kingdom	Making, Adapting, Possessing or Supplying a Child Sexual Abuse Image-Generator, Northern Ireland	from a date not yet set	do not do the named thing
United Kingdom	Making, Adapting, Possessing or Supplying a Child Sexual Abuse Image-Generator, Scotland	from a date not yet set	do not do the named thing
United Kingdom	Outsourcing by a firm other than a common platform firm: remaining fully responsible for outsourced critical or important operational functions	since 23 Oct 2025	govern the system: policies, roles, assessments
United Kingdom	Possession of Advice or Guidance About Abusing Children Sexually or Creating CSA Images, England and Wales and Northern Ireland	from a date not yet set	do not do the named thing
United Kingdom	Possession of Advice or Guidance About Abusing Children Sexually or Creating CSA Images, Scotland	from a date not yet set	do not do the named thing
United Kingdom	Power to Amend the Online Safety Act 2023 for Illegal AI-Generated Content (New Section 216A), with Progress Report Duty	since 29 Apr 2026
United Kingdom	Suitability for MiFID business: personal recommendations and decisions to trade, including advice given through an automated or semi-automated system	since 3 Jan 2018	govern the system: policies, roles, assessments; disclose the use of AI
United Kingdom	Suitability for business that is not MiFID business: personal recommendations to retail clients and decisions to trade for them (COBS 9.1 and 9.2)	since 1 Oct 2018	govern the system: policies, roles, assessments
United Kingdom	The Consumer Duty: Principle 12 and the cross-cutting rules and outcome rules for retail customers	since 31 Jul 2023	govern the system: policies, roles, assessments

United States, federal: 22 provisions in 1 jurisdictions

Jurisdiction	Instrument	When	Asks of an app
United States	Bank Secrecy Act and 31 CFR 1020.320, bank reports of suspicious transactions and their confidentiality	since 28 Oct 1992	report to a regulator; keep records for a set time; do not do the named thing
United States	Equal Credit Opportunity Act and Regulation B, notice of action taken and statement of specific reasons for adverse action	since 23 Mar 1977	disclose the use of AI
United States	Exchange Act Rule 17a-4, records to be preserved by certain exchange members, brokers and dealers	since 3 Jan 2023	keep records for a set time; govern the system: policies, roles, assessments
United States	Executive Order 13960, Promoting the Use of Trustworthy Artificial Intelligence in the Federal Government	since 3 Dec 2020	govern the system: policies, roles, assessments; disclose the use of AI
United States	Executive Order 14319, Preventing Woke AI in the Federal Government	since 23 Jul 2025	put the terms in the contract; govern the system: policies, roles, assessments; disclose the use of AI
United States	FD&C Act section 520(o), software functions excluded from the device definition, with section 201(h)	since 13 Dec 2016	hold a license or registration; report to a regulator
United States	FINRA Rule 2210, communications with the public	since 4 Feb 2013	disclose the use of AI; govern the system: policies, roles, assessments; keep records for a set time
United States	FINRA Rule 3110, supervision	since 1 Dec 2014	govern the system: policies, roles, assessments; keep records for a set time
United States	FINRA Rule 4511, general requirements for books and records	since 5 Dec 2011	keep records for a set time
United States	FTC Rule on Impersonation of Government and Businesses	since 1 Apr 2024	do not do the named thing
United States	Garcia v. Character Technologies, Inc.	since 21 May 2025
United States	Investment Advisers Act of 1940 section 206, prohibited transactions by investment advisers	in force	do not do the named thing; disclose the use of AI
United States	OMB Memorandum M-25-21, Accelerating Federal Use of Artificial Intelligence through Innovation, Governance, and Public Trust	since 3 Apr 2025	govern the system: policies, roles, assessments; report to a regulator; disclose the use of AI; assess the impact on personal data first
United States	OMB Memorandum M-25-22, Driving Efficient Acquisition of Artificial Intelligence in Government	since 3 Apr 2025	govern the system: policies, roles, assessments; disclose the use of AI
United States	ONC certification criterion for decision support interventions, 45 CFR 170.315(b)(11), as amended by the HTI-5 final rule	from 28 Dec 2026, in 7 weeks	govern the system: policies, roles, assessments
United States	Obscene visual representations of the sexual abuse of children, and the definition of child pornography, as they reach computer-generated images	since 30 Apr 2003	do not do the named thing
United States	Regulation B, 2026 amendments on evaluation of applications, discouragement and special purpose credit programs	since 21 Jul 2026	do not do the named thing
United States	Regulation Best Interest, standard of conduct for broker-dealers	since 30 Jun 2020	disclose the use of AI; govern the system: policies, roles, assessments
United States	Safety and soundness standards for insured depository institutions: internal controls, information systems and internal audit systems	since 9 Aug 1995	govern the system: policies, roles, assessments
United States	Section 1557 final rule, nondiscrimination in the use of patient care decision support tools	since 5 Jul 2024	do not do the named thing; assess the impact on personal data first
United States	TAKE IT DOWN Act, section 2: criminal prohibition on publishing intimate digital forgeries	since 19 May 2025	do not do the named thing
United States	Title VII of the Civil Rights Act of 1964 and the Age Discrimination in Employment Act, unlawful employment practices	since 2 Jul 1965	do not do the named thing

United States, states: 226 provisions in 48 jurisdictions

Jurisdiction	Instrument	When	Asks of an app
Alabama	Alabama Child Protection Act of 2024, AI-Generated Child Sexual Abuse Material	since 1 Oct 2024	do not do the named thing
Alabama	Distribution of Materially Deceptive Media to Influence an Upcoming Election	since 1 Oct 2024	label generated content; disclose the use of AI
Alabama	SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization	since 1 Oct 2026	govern the system: policies, roles, assessments; disclose the use of AI; report to a regulator
Arkansas	Act 159 of 2025 (HB 1071), AI-Generated Replicas Amendment to Publicity Rights Act	since 5 Aug 2025	do not do the named thing
Arkansas	Act 827 of 2025 (HB 1529), Unlawful Creation or Distribution of Deepfake Visual Material	since 5 Aug 2025	do not do the named thing
Arkansas	Act 927 of 2025 (HB 1876), Generative AI Ownership of Model Training and Content	since 5 Aug 2025
Arkansas	Act 977 of 2025 (HB 1877), AI-Generated Child Sexual Abuse Material Amendments	since 5 Aug 2025	do not do the named thing
Arizona	AI-generated and indistinguishable depictions included in child-exploitation definitions (HB 2678)	since 26 Sep 2025	do not do the named thing
Arizona	Deepfakes; candidate disclosure requirement and civil penalty	since 14 Sep 2024	do not do the named thing; disclose the use of AI
Arizona	Denial of claims; individualized review requirement	since 1 Jul 2026
Arizona	Digital impersonation of a candidate or other person (civil action)	since 21 May 2024	disclose the use of AI
Arizona	Unlawful disclosure extended to AI-generated 'realistic pictorial representation' intimate images (SB 1462)	since 26 Sep 2025	do not do the named thing
California	AB 730, as extended by AB 972, election deepfake disclosure law	since 1 Jan 2020	label generated content; do not do the named thing
California	AI Agents and Public Participation Law (SB 1159)	from 1 Jan 2027, in 2 months	do not do the named thing
California	AI Auditor Registry Act (AB 1405)	from 1 Jan 2029, in 2.2 years	hold a license or registration; keep records for a set time; disclose the use of AI
California	AI-Generated and Digitally Altered Child Sexual Exploitation Matter (SB 1276)	from 1 Jan 2027, in 2 months	do not do the named thing
California	Artificial Intelligence in Health Care Utilization Review (SB 1120)	since 1 Jan 2025	govern the system: policies, roles, assessments; do not do the named thing
California	Attorney, Court Filing and Arbitrator Generative AI Duties (SB 574)	from 1 Jan 2027, in 2 months	do not do the named thing; disclose the use of AI
California	Bolstering Online Transparency Act (SB 1001)	since 1 Jul 2019
California	CCPA Automated Decisionmaking Technology Regulations	since 1 Jan 2026	honor the person's rights over their data; assess the impact on personal data first; disclose the use of AI
California	California AI Transparency Act (SB 942, as amended by AB 853, SB 1000 and AB 2713)	since 2 Aug 2026	label generated content; disclose the use of AI
California	California Executive Order N-5-26 (vendor certifications, supply chain review and contractor responsibility in state AI procurement)	since 30 Mar 2026	put the terms in the contract; govern the system: policies, roles, assessments; disclose the use of AI
California	Civil Rights Council Employment Regulations on Automated-Decision Systems	since 1 Oct 2025	govern the system: policies, roles, assessments; do not do the named thing
California	Clinical Decision Support Systems Bias Mitigation Act (SB 503)	from 1 Jan 2027, in 2 months	assess the impact on personal data first; disclose the use of AI; govern the system: policies, roles, assessments
California	Companion Chatbot Safety and Accountability Act (SB 243)	since 1 Jan 2026	disclose the use of AI; report to a regulator
California	Customer Service Chatbots Law (AB 1609)	from 1 Jan 2027, in 2 months	label generated content; disclose the use of AI
California	Deceased Personality Digital Replica Liability Law (AB 1836)	since 1 Jan 2025	do not do the named thing; get consent first
California	Deepfake Pornography Civil Liability Law (AB 621)	since 1 Jan 2026	do not do the named thing; get consent first
California	Digital Replica Contract Terms Law (AB 2602)	since 1 Jan 2025	put the terms in the contract
California	Digital Replica Likeness and Impersonation Law (SB 1111)	from 1 Jan 2027, in 2 months	do not do the named thing; get consent first
California	Employment Automated Decision Systems Act (SB 947)	from 1 Jul 2027, in 8 months	govern the system: policies, roles, assessments; disclose the use of AI; honor the person's rights over their data
California	Employment Technological Displacement Notice (SB 951)	from 1 Jan 2027, in 2 months	report to a regulator; disclose the use of AI
California	Generative AI Training Data Transparency Act (AB 2013)	since 1 Jan 2026	disclose the use of AI
California	Health Care Professional Title Protection for Artificial Intelligence Act (AB 489)	since 1 Jan 2026	do not do the named thing
California	Health Care Services Artificial Intelligence Act (AB 1979)	from 1 Jan 2027, in 2 months	govern the system: policies, roles, assessments; do not do the named thing
California	Healthcare AI Patient-Communication Disclosure Act (AB 3030)	since 1 Jan 2025	disclose the use of AI
California	Independent Verification Organizations Act (SB 813)	from 1 Jan 2027, in 2 months	govern the system: policies, roles, assessments; report to a regulator; hold a license or registration; disclose the use of AI
California	Synthetic Performer Advertising Disclosure Act (SB 1050)	from 1 Jan 2027, in 2 months	label generated content; disclose the use of AI
California	Toys with Companion Chatbots Ban (SB 867)	from 1 Jan 2027, in 2 months	do not do the named thing
California	Transparency in Frontier Artificial Intelligence Act (SB 53)	since 1 Jan 2026	disclose the use of AI; govern the system: policies, roles, assessments; report to a regulator
California	Workplace Surveillance Tools: AI Emotion Recognition and Neural Data Prohibition (AB 1883)	from 1 Jan 2027, in 2 months	do not do the named thing
Colorado	Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models	since 15 Oct 2025	govern the system: policies, roles, assessments; assess the impact on personal data first; report to a regulator
Colorado	HB 24-1147, Candidate Election Deepfake Disclosures	since 1 Jul 2024	label generated content; do not do the named thing
Colorado	HB 26-1139 (2026), Use of Artificial Intelligence in Health Care	from 1 Jan 2027, in 2 months	govern the system: policies, roles, assessments; report to a regulator; disclose the use of AI; do not do the named thing
Colorado	HB 26-1195 (2026), Psychotherapy Artificial Intelligence Restrictions	since 12 Aug 2026	do not do the named thing; disclose the use of AI; get consent first
Colorado	HB 26-1263 (2026), Conversational AI Service Operator Requirements	since 12 Aug 2026	label generated content; meet a design code; report to a regulator
Colorado	SB 21-169 (2021), Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models	since 7 Sep 2021
Colorado	SB 26-189 (2026), Automated Decision-Making Technology Act	from 1 Jan 2027, in 2 months
Colorado	SB 26-189 (2026), Automated Decision-Making Technology Act, deployer record keeping	from 1 Jan 2027, in 2 months
Colorado	SB 26-189 (2026), Automated Decision-Making Technology Act, developer documentation and records	from 1 Jan 2027, in 2 months
Connecticut	AI Companion Chatbot Disclosure and Minor Safety Duties	from 1 Jan 2027, in 2 months
Connecticut	Automated Employment-Related Decision Technology Act	from 1 Oct 2027, in 11 months
Connecticut	Civil Action and Platform Takedown Duty for Synthetically Created Intimate Images	since 1 Oct 2026	do not do the named thing
Connecticut	Computer-Generated Child Sexual Abuse Material	since 1 Oct 2024	do not do the named thing
Connecticut	Employer AI-Related Layoff Disclosure to the Labor Department	since 1 Oct 2026
Connecticut	Frontier Developer Catastrophic-Risk Whistleblower Protections	since 1 Oct 2026
Connecticut	Generative AI Content Provenance Duty for Large Providers	since 1 Oct 2026	label generated content
Connecticut	Subscription-Based Generative AI Provider Disclosure Duty	since 1 Oct 2026
Connecticut	Unlawful Dissemination of an Intimate Synthetically Created Image	since 1 Oct 2025	do not do the named thing
Delaware	Child sexual abuse material offenses, computer-generated depictions	since 26 Jul 2000	do not do the named thing
Delaware	House Bill 191 (2026), medical professional title protection against nonhuman and AI entities	since 23 Apr 2026	do not do the named thing
Delaware	House Bill 316 (2024), use of deep fake technology to influence an election	since 9 Oct 2024	do not do the named thing; label generated content
Delaware	House Bill 353 (2024), deep fake intimate images (The Amelia Kramer Act)	since 9 Oct 2024	do not do the named thing
Florida	AI Use in Political Advertising Disclosure Requirement (HB 919, 2024)	since 1 Jul 2024	label generated content; disclose the use of AI
Florida	Child Sexual Abuse Material Including AI-Altered Images of a Minor	since 1 Oct 2022	do not do the named thing
Florida	Promotion of an Altered Sexual Depiction; Brooke's Law platform takedown duty	since 1 Oct 2022	do not do the named thing; honor the person's rights over their data
Georgia	AI Companion Chatbot Safety Act (SB 540)	from 1 Jul 2027, in 8 months
Georgia	Private Review Agent Artificial Intelligence Coverage Determinations Act (SB 444)	from 1 Jan 2027, in 2 months	govern the system: policies, roles, assessments
Georgia	Walters v. OpenAI, L.L.C.	since 19 May 2025
Hawaii	Artificial Intelligence Disclosure and Safety Act (2026 Haw. Sess. Laws Act 248, S.B. 3001 CD1)	since 14 Jul 2026
Hawaii	Artificial Intelligence; Digital Imitation; Personal Likeness; Protections (2026 Haw. Sess. Laws Act 247, H.B. 2137 CD1)	since 14 Jul 2026	do not do the named thing
Hawaii	Promoting Child Abuse, computer-generated child pornography	since 25 Jun 2002	do not do the named thing
Hawaii	Violation of Privacy in the First Degree, deepfake and composite intimate images	since 23 Jun 2021	do not do the named thing
Iowa	Conversational AI Services Act (Senate File 2417)	from 1 Jul 2027, in 8 months	label generated content; meet a design code
Iowa	Harassment, nonconsensual and synthetic intimate images	since 1 Jul 2024	do not do the named thing
Iowa	Sexual exploitation of a minor, AI-generated and manipulated depictions	since 1 Jul 2024	do not do the named thing
Iowa	Utilization Review Artificial Intelligence Limits (House File 2635)	since 1 Jul 2026	govern the system: policies, roles, assessments
Idaho	Conversational AI Safety Act	from 1 Jul 2027, in 8 months	label generated content; meet a design code
Idaho	Disclosing explicit synthetic media	since 1 Jul 2024	do not do the named thing
Idaho	FAIR Elections Act, disclosure duty for synthetic media in electioneering communications	since 25 Mar 2024	label generated content
Idaho	Generative Artificial Intelligence in Education Act, vendor disclosure duty	since 1 Jul 2026	disclose the use of AI
Illinois	Artificial Intelligence Safety Measures Act	from 1 Jan 2027, in 2 months	govern the system: policies, roles, assessments; report to a regulator; disclose the use of AI
Illinois	Artificial Intelligence Video Interview Act	since 1 Jan 2020	disclose the use of AI; get consent first; keep records for a set time; report to a regulator
Illinois	Child sexual abuse material, computer-generated and digitally altered depictions	since 1 Jan 2026	do not do the named thing
Illinois	Civil Remedies for Nonconsensual Dissemination of Private Sexual Images Act, digitally altered images	since 1 Jan 2024	do not do the named thing
Illinois	HB 3851 / P.A. 104-0338 (2025), Bullying prevention: cyber-bullying by unauthorized digital replica	since 1 Jul 2026	govern the system: policies, roles, assessments; disclose the use of AI
Illinois	HB 4762 / P.A. 103-0830 (2024), Digital Voice and Likeness Protection Act: unenforceable digital replica provisions in service agreements	since 9 Aug 2024	get consent first
Illinois	Illinois Human Rights Act, use of artificial intelligence in employment decisions	since 1 Jan 2026	do not do the named thing; disclose the use of AI
Illinois	Right of Publicity Act, unauthorized AI digital replica prohibition	since 1 Jan 2025	do not do the named thing; get consent first
Illinois	SB 2909 / P.A. 104-0565 (2026), Teacher evaluation: limits on artificial intelligence tools	from 1 Jan 2027, in 2 months	do not do the named thing; disclose the use of AI
Illinois	Wellness and Oversight for Psychological Resources Act	since 1 Aug 2025	do not do the named thing; disclose the use of AI; get consent first
Indiana	Child Exploitation and Possession of Child Pornography, obscene simulated or computer-generated images	since 1 Jul 2022	do not do the named thing
Indiana	Distribution of an Intimate Image and Civil Action for Nonconsensual Pornography, extended to AI-generated images (House Enrolled Act 1047, 2024)	since 1 Jul 2024	do not do the named thing; get consent first
Indiana	Downcoding of Health Benefits Claims, automated and AI decision-making (House Enrolled Act 1271, 2026)	since 1 Jul 2026	disclose the use of AI; govern the system: policies, roles, assessments
Indiana	Use of Digitally Altered Media in Elections (House Enrolled Act 1133, 2024)	since 12 Mar 2024	label generated content; disclose the use of AI
Kansas	AI-generated and AI-altered images in child exploitation and non-consensual dissemination offenses	since 1 Jul 2026	do not do the named thing
Kentucky	Computer-generated images of a minor in sexual performance offenses (HB 207)	since 15 Jul 2024	do not do the named thing
Kentucky	Possession or viewing of matter portraying a computer-generated image of a minor (HB 366)	since 15 Jul 2026	do not do the named thing
Kentucky	Synthetic Media Disclosure in Electioneering Communications	since 24 Mar 2025	label generated content; disclose the use of AI
Louisiana	Act 250 (HB 178), attorney duty to verify and disclose AI-generated evidence	since 1 Aug 2025	disclose the use of AI
Louisiana	Act 496 (SB 346), deepfake material used against K-12 students	since 1 Aug 2026	do not do the named thing
Louisiana	Act 559 (HB 639), AI-generated voice telephone campaign communication disclosure	since 1 Aug 2026	label generated content
Louisiana	Act 806 (HB 459), AI-manipulated electioneering communication disclosure	since 1 Aug 2026	label generated content
Louisiana	Act 892 (SB 42), AI-generated child sexual abuse materials	since 1 Aug 2026	do not do the named thing
Maryland	Computer-Generated Child Sexual Abuse Material	since 1 Oct 2019	do not do the named thing
Maryland	HB 820 / Ch. 747 (2025), Artificial Intelligence in Health Insurance Utilization Review	since 1 Oct 2025
Maryland	HB 895 / Ch. 154 (2026), Surveillance Pricing and Algorithmic Price Disclosure (Protection from Predatory Pricing Act)	since 1 Oct 2026
Maryland	SB 141 / Ch. 444 (2026), Election Deepfake Prohibition	since 1 Jun 2026	do not do the named thing
Maryland	SB 360 / Ch. 219 (2025), AI-Generated Deepfakes in Nonconsensual Intimate Imagery	since 1 Jul 2025	do not do the named thing
Maryland	SB 8 / Ch. 445 (2026), AI and Deepfake Identity Fraud	since 1 Oct 2026	do not do the named thing
Maine	Maine Chatbot Disclosure Act	since 24 Sep 2025
Maine	Synthetic media disclosure in campaign advertising	since 29 Jul 2026	label generated content
Maine	Technology-facilitated sexual abuse of minors, AI-generated and modified child sexual abuse material (LD 524)	since 16 Apr 2026	do not do the named thing
Maine	Unauthorized dissemination of certain private images (AI-generated image amendment)	since 24 Sep 2025	do not do the named thing
Maine	Use of artificial intelligence in therapy or psychotherapy services	since 29 Jul 2026	do not do the named thing; get consent first; govern the system: policies, roles, assessments
Michigan	AI-Generated Political Advertisement and Robocall Disclosure (Public Act 263 of 2023)	since 13 Feb 2024	label generated content; disclose the use of AI
Michigan	Distribution of Materially Deceptive Election Media (Public Act 265 of 2023)	since 13 Feb 2024	label generated content; do not do the named thing
Michigan	Elliott-Larsen Civil Rights Act, public accommodations, public service and real estate financing (Act 453 of 1976)	since 31 Mar 1977	do not do the named thing
Michigan	Insurance Code of 1956, rate-making standards, rates not unfairly discriminatory (Act 218 of 1956)	since 1 Jan 1957	do not do the named thing
Michigan	Protection from Intimate Deep Fakes Act (Public Act 11 of 2025)	since 26 Aug 2025	do not do the named thing
Minnesota	AI-Generated Child Sexual Abuse Material	since 1 Aug 2025	do not do the named thing
Minnesota	Election Deepfake Prohibition and Candidate Forfeiture	since 1 Aug 2023	do not do the named thing
Minnesota	Nonconsensual Deepfake Sexual Imagery, Civil and Criminal Liability	since 1 Aug 2023	do not do the named thing
Minnesota	Nudification Technology Prohibition	since 1 Aug 2026	do not do the named thing
Minnesota	Utilization Review, AI-Only Adverse Determination Prohibition	from 1 Jan 2027, in 2 months	govern the system: policies, roles, assessments
Missouri	Child sexual abuse material offenses, computer-generated and AI-indistinguishable images included	since 28 Aug 2026	do not do the named thing
Missouri	Disclosure of an intimate digital depiction	since 28 Aug 2026
Mississippi	HB 1308 (2025), Morphed-Image Child Exploitation Amendments	since 1 Jul 2025	do not do the named thing
Mississippi	SB 2577 (2024), Wrongful Dissemination of Digitizations (Election Deepfakes)	since 1 Jul 2024	do not do the named thing; label generated content
Montana	Deepfake Regulation Act (SB 25, 2025), election deepfake disclosure	since 1 Oct 2025	do not do the named thing; disclose the use of AI
Montana	Digital Likeness and Voice Rights Act (HB 513, 2025), unauthorized AI depiction liability	since 1 Jan 2026	do not do the named thing
Montana	Privacy in communications, digitally fabricated intimate images	in force	do not do the named thing
Montana	Right to Compute Act (SB 212, 2025), critical AI infrastructure risk management duty	since 16 Apr 2025	govern the system: policies, roles, assessments
Montana	Sexual abuse of children, computer-generated child pornography	since 1 Jul 2025	do not do the named thing
North Carolina	AI-Generated Intimate Images and Child Sexual Abuse Material (Session Law 2024-37, HB 591)	since 1 Dec 2024	do not do the named thing
North Dakota	House Bill 1167 (2025), AI-generated political content disclosure	since 1 Aug 2025	disclose the use of AI; label generated content
North Dakota	House Bill 1351 (2025), sexually expressive images including AI-generated or altered deepfakes	since 1 Aug 2025	do not do the named thing
North Dakota	House Bill 1429 (2025), harassment and stalking with a robot	since 1 Aug 2025	do not do the named thing
Nebraska	Child Sexual Abuse Material Prevention Act, computer-generated and artificial-intelligence depictions	in force	do not do the named thing
Nebraska	Conversational Artificial Intelligence Safety Act (LB 525, §§ 12-18)	from 1 Jul 2027, in 8 months	disclose the use of AI; label generated content
Nebraska	Ensuring Transparency in Prior Authorization Act, artificial-intelligence utilization review restriction	since 1 Jan 2026	do not do the named thing; disclose the use of AI
New Hampshire	AI Chatbot Solicitation of Children	since 1 Jan 2026
New Hampshire	Creation of Child Intimate Visual Representations	since 1 Jan 2026	do not do the named thing
New Hampshire	Fraudulent Use of Deepfakes	since 1 Jan 2025	do not do the named thing
New Hampshire	Synthetic Media and Deceptive and Fraudulent Deepfakes in Elections	since 1 Aug 2024	disclose the use of AI
New Jersey	Deceptive Audio or Visual Media (Deepfake) Criminalization Act	since 2 Apr 2025	do not do the named thing
New Jersey	Forbidding the Algorithmic Inflation of Rent (FAIR) Act	from 1 Jul 2027, in 8 months
New Jersey	New Jersey Disparate Impact Discrimination Rules, Automated Employment Decision Tools	since 15 Dec 2025
New Jersey	Online Bot Disclosure Law (A4563)	since 19 Jul 2020
New Mexico	HB 182 (2024), AI-generated and manipulated media disclosure and disclaimer requirements in campaign advertising	since 15 May 2024	label generated content; disclose the use of AI; do not do the named thing
New Mexico	Sexual Exploitation of Children Act, morphed and computer-generated image provisions	in force	do not do the named thing
Nevada	AB 325 (2025), human decision-making required for AI in emergency response and utility shutoff	since 1 Oct 2025	do not do the named thing; govern the system: policies, roles, assessments
Nevada	AB 406 (2025), AI mental and behavioral health care provider and marketing prohibitions	since 1 Jul 2025	do not do the named thing
Nevada	AB 406 (2025), licensed provider restriction on direct clinical use of AI	since 1 Jul 2025	do not do the named thing; govern the system: policies, roles, assessments
Nevada	AB 73 (2025), AI-manipulated media disclosure in paid political communications	since 1 Jan 2026	disclose the use of AI; label generated content
Nevada	SB 213 (2025), AI-generated and digitally altered intimate images	since 1 Oct 2025	do not do the named thing
Nevada	SB 263 (2025), AI-generated and computer-generated child sexual abuse material	since 1 Oct 2025	do not do the named thing
New York	Artificial Intelligence Companion Models safeguards	since 5 Nov 2025
New York	Disclosure of materially deceptive AI-generated media in political communications	since 3 May 2024	disclose the use of AI; label generated content
New York	Private right of action for unlawful dissemination or publication of a sexually explicit depiction (digital replica)	since 3 May 2024	get consent first; do not do the named thing
New York	Prohibition on Unsafe AI Companion Features for Minors	from 1 Jan 2027, in 2 months
New York	Responsible AI Safety and Education Act (RAISE Act)	from 1 Jan 2027, in 2 months
New York	Right of privacy, use of a living person's name, portrait, picture, likeness, or voice for advertising or trade	in force	get consent first; do not do the named thing
New York	Right of publicity, digital replica of a deceased performer	since 19 Dec 2025	do not do the named thing
New York	S3008C Part X / Ch. 58 (2025), Algorithmic Pricing Disclosure Act	since 8 Jul 2025	disclose the use of AI
New York	Synthetic Performer Advertising Disclosure Law	since 9 Jun 2026	disclose the use of AI; label generated content
New York	Unlawful dissemination or publication of an intimate image (digitization amendment)	since 1 Dec 2023	do not do the named thing
Oklahoma	Computer-generated child sexual abuse material prohibition (SB 53, 2025 amendment)	since 1 Nov 2025	do not do the named thing
Oklahoma	HB 1364 (2025), nonconsensual dissemination of artificially generated sexual depictions	since 1 Nov 2025	do not do the named thing
Oregon	AI Companion Chatbot Safety Act (SB 1546)	from 1 Jan 2027, in 2 months	disclose the use of AI; label generated content; meet a design code; report to a regulator
Oregon	Campaign communication disclosure of synthetic media (SB 1571)	since 27 Mar 2024	disclose the use of AI; label generated content
Oregon	Unlawful dissemination of an intimate image extended to AI-generated depictions (HB 2299)	since 1 Jan 2026	do not do the named thing
Oregon	Use of nursing titles by a nonhuman entity (HB 2748)	since 1 Jan 2026	do not do the named thing
Pennsylvania	Act 125 of 2024, artificially generated child sexual abuse material	since 28 Dec 2024	do not do the named thing
Pennsylvania	Act 125 of 2024, artificially generated sexual depictions in the unlawful dissemination of intimate image offense	since 28 Dec 2024	do not do the named thing
Pennsylvania	Act 35 of 2025, digital forgery	since 5 Sep 2025	do not do the named thing
Pennsylvania	S.B. 806, Artificial Intelligence Deceptive Advertising Act	from 21 Dec 2026, in 6 weeks	label generated content; disclose the use of AI
Puerto Rico	AI disclosure in political advertising and electoral communications	since 10 Jun 2026	label generated content; disclose the use of AI
Rhode Island	Artificial Intelligence Companion Models Act	from 1 Jan 2027, in 2 months
Rhode Island	Child pornography prohibited, computer-generated and digitally altered depictions	since 31 Jul 2004	do not do the named thing
Rhode Island	Deceptive and Fraudulent Synthetic Media in Election Communications	since 2 Jul 2025	disclose the use of AI; do not do the named thing
Rhode Island	Oversight of Artificial Intelligence Technology in Mental Health Care Act	since 22 Jun 2026
Rhode Island	Unauthorized dissemination of indecent material, digitally created or altered images	since 2 Jul 2025	do not do the named thing
Rhode Island	Use of Artificial Intelligence by Healthcare Providers Notification Act	since 22 Jun 2026
South Carolina	AI-Generated and Morphed Images of an Identifiable Minor (2025 Act No. 58, S.29)	since 22 May 2025	do not do the named thing
South Dakota	Computer-generated child pornography ban (SB 79, 2024)	since 1 Jul 2024	do not do the named thing
South Dakota	Election Deepfake Disclosure Law (SB 164, 2025)	since 1 Jul 2025	do not do the named thing; disclose the use of AI
South Dakota	Nonconsensual Digitally Fabricated Intimate Image Law (SB 41, 2026)	in force	do not do the named thing
Tennessee	AI-generated child sexual abuse material, tool possession and distribution offense	since 1 Jul 2025	do not do the named thing
Tennessee	Ensuring Likeness, Voice, and Image Security (ELVIS) Act	since 1 Jul 2024	do not do the named thing
Tennessee	Health Care AI Act, AI mental health professional representation prohibition	since 1 Jul 2026	do not do the named thing
Tennessee	Preventing Deepfake Images Act	since 1 Jul 2025	do not do the named thing
Texas	H.B. 3133 (2025), social media platform complaint system for explicit deep fake material	since 1 Sep 2025	govern the system: policies, roles, assessments
Texas	Political deep fake video ban (originally S.B. 751, 2019)	since 1 Sep 2019	do not do the named thing
Texas	S.B. 1188 (2025), AI diagnostic disclosure duty in electronic health records	since 1 Sep 2025	disclose the use of AI
Texas	S.B. 20 (2025), possession, promotion, or production of AI-generated or apparent child pornography	since 1 Sep 2025	do not do the named thing
Texas	S.B. 441 (2025), civil liability for artificial intimate visual material and nudification applications	since 1 Sep 2025	do not do the named thing
Texas	S.B. 441 (2025), unlawful production or distribution of AI deep fake sexually explicit media	since 1 Sep 2025	do not do the named thing
Texas	S.B. 815 (2025), utilization review agent ban on automated decision systems for adverse determinations	since 1 Jan 2026	do not do the named thing
Texas	TRAIGA (H.B. 149, 2025), Attorney General enforcement, civil investigative demand, cure period, penalties and defenses	since 1 Jan 2026	govern the system: policies, roles, assessments
Texas	TRAIGA (H.B. 149, 2025), consumer AI-interaction disclosure duty	since 1 Jan 2026	disclose the use of AI
Texas	TRAIGA (H.B. 149, 2025), prohibited AI practices binding any person	since 1 Jan 2026	do not do the named thing
Utah	Digital Content Provenance Standards Act (HB 276, 2026 General Session), Utah Code Title 13 Chapter 72c	from 1 Jan 2027, in 2 months	label generated content; disclose the use of AI
Utah	Digital Voyeurism Prevention Act (HB 276, 2026 General Session), Utah Code Title 13 Chapter 72b	from 1 Jan 2027, in 2 months	do not do the named thing; get consent first
Utah	HB 452 (2025), mental health chatbot disclosure	since 7 May 2025
Utah	Health Insurance Preauthorization AI Disclosure (SB 319, 2026 General Session)	from 1 Jan 2027, in 2 months	disclose the use of AI; govern the system: policies, roles, assessments
Utah	Identity Protection Modifications, AI Defamation and Identity Replication (SB 256, 2026 General Session)	since 6 May 2026	get consent first; do not do the named thing
Utah	SB 226 (2025), required disclosures for generative AI in consumer transactions	since 7 May 2025
Virginia	Computer-Generated Child Sexual Abuse Material	in force	do not do the named thing
Virginia	HB 2678 (2019), Deepfakes in Nonconsensual Image Dissemination	since 1 Jul 2019	do not do the named thing
Vermont	Act 156 (H.816), artificial intelligence in the provision of mental health services	since 17 Jun 2026	do not do the named thing
Vermont	Disclosure of sexually explicit images without consent, digitized and computer-generated images	since 6 Jun 2024	do not do the named thing
Vermont	Vermont Synthetic Media in Elections Act	since 5 Mar 2026	disclose the use of AI; do not do the named thing
Washington	AI companion chatbot disclosure and safety act	from 1 Jan 2027, in 2 months	label generated content; disclose the use of AI; govern the system: policies, roles, assessments
Washington	AI content provenance and disclosure act	from 1 Feb 2027, in 3 months	label generated content; disclose the use of AI
Washington	Disclosing fabricated intimate images	since 6 Jun 2024	do not do the named thing
Washington	Fabricated depictions of minors (sexual exploitation of children)	since 6 Jun 2024	do not do the named thing
Washington	Forged digital likeness act (Personality Rights Law amendment)	since 11 Jun 2026	do not do the named thing; get consent first
Washington	Synthetic media in electioneering communications	since 23 Jul 2023	disclose the use of AI; label generated content
Wisconsin	2023 Wisconsin Act 123, AI-Generated Content Disclosure in Political Communications	since 23 Mar 2024	label generated content
Wisconsin	2023 Wisconsin Act 224, Possession of Virtual Child Pornography	since 29 Mar 2024	do not do the named thing
Wisconsin	2025 Wisconsin Act 34, Synthetic Intimate Representation Ban	since 4 Oct 2025	do not do the named thing
Wisconsin	2025 Wisconsin Act 69, Disclosure of Technology-Altered Real Estate Advertising	from 1 Jan 2027, in 2 months	label generated content
West Virginia	SB 198 (2025), computer-generated child pornography prohibition	since 9 Jul 2025	do not do the named thing
West Virginia	SB 198 (2025), fabricated intimate image disclosure prohibition	since 9 Jul 2025	do not do the named thing
Wyoming	Artificial Intelligence Offenses (2026 Wyoming House Bill 102, Enrolled Act No. 32)	since 1 Jul 2026	do not do the named thing

United States, cities: 12 provisions in 12 jurisdictions

Jurisdiction	Instrument	When	Asks of an app
Berkeley	Prohibition on the Sale or Use of Coordinated Pricing Algorithms	since 1 Mar 2026	do not do the named thing
San Diego	Prohibition of Anti-Competitive Automated Rent Price-Fixing Ordinance (Ord. O-21955 N.S.)	since 21 Jun 2025	do not do the named thing
City and County of San Francisco	Use and Sale of Algorithmic Devices Prohibited (Rent Ordinance Sec. 37.10C), as amended by Ord. No. 169-25	since 14 Oct 2024	do not do the named thing
Santa Monica	Algorithmic Rental Price Fixing (Ord. No. 2817 (CCS))	since 24 Jul 2025	do not do the named thing
Rockville	Price Coordination and Algorithmic Devices	from 1 Jan 2027, in 2 months	do not do the named thing
Minneapolis	Prohibition on Use of Rent-Setting Algorithms (Ord. No. 2025-010)	since 1 Mar 2026	do not do the named thing
Hoboken	Ord. No. B-781, Algorithmic Rent Fixing in Rental Housing Market Prohibited	since 29 Jul 2025	do not do the named thing
Jersey City	Ordinance 25-057, Preventing Algorithmic Rent-Fixing in the Rental Housing Market	since 11 Jun 2025	do not do the named thing
New York City	Automated Employment Decision Tools Bias Audit and Notice Law	since 1 Jan 2023
City of Philadelphia	Bill No. 240823, Anti-Competitive Rental Practices	since 11 Feb 2025	do not do the named thing
Providence	Prohibition of Algorithmic Rent Setting Devices	since 15 May 2025	do not do the named thing
Seattle	Ordinance 127241 (Council Bill 121000), Algorithmic Rent Fixing	since 31 Jul 2025	do not do the named thing

Asia and the Pacific: 47 provisions in 15 jurisdictions

Jurisdiction	Instrument	When	Asks of an app
Australia	Australian Consumer Law ss. 18, 29 and 34, Misleading Conduct and Representations about an AI Product's Capabilities	since 1 Jan 2011	do not do the named thing
Australia	Using a Carriage Service to Transmit Sexual Material Without Consent (Deepfake Offences)	since 3 Sep 2024	do not do the named thing
Bangladesh	Cyber Security Act, 2026, AI-generated sexual content and CSAM ban	since 21 May 2025	do not do the named thing
China	Civil Code, portrait right and protection of the voice	since 1 Jan 2021	get consent first; do not do the named thing
China	Cybersecurity Law, Article 20 (state support for artificial intelligence)	since 1 Jan 2026
China	Interim Measures for the Administration of Anthropomorphic Interactive Services of Artificial Intelligence, Article 14 (minors)	since 15 Jul 2026
China	Interim Measures for the Administration of Anthropomorphic Interactive Services of Artificial Intelligence, Article 18	since 15 Jul 2026
China	Interim Measures for the Management of Generative AI Services, Article 11 (user input and usage records)	since 15 Aug 2023
China	Interim Measures for the Management of Generative AI Services, Article 12	since 15 Aug 2023
China	Interim Measures for the Management of Generative AI Services, Article 14	since 15 Aug 2023
China	Interim Measures for the Management of Generative AI Services, Articles 7 and 8 (training data)	since 15 Aug 2023
China	Measures for Labeling AI-Generated Synthetic Content	since 1 Sep 2025	label generated content
China	Measures for Labeling AI-Generated Synthetic Content, Article 6 (content dissemination platforms)	since 1 Sep 2025
China	Provisions on the Administration of Deep Synthesis Internet Information Services, Article 10	since 10 Jan 2023
China	Provisions on the Administration of Deep Synthesis Internet Information Services, Articles 16 and 17	since 10 Jan 2023
Indonesia	Electronic Information and Transactions Law, electronic agent liability	since 21 Apr 2008	govern the system: policies, roles, assessments
India	Synthetically Generated Information Labelling Duty for Intermediaries	since 20 Feb 2026
Japan	Act on Promotion of Research and Development, and Utilization of Artificial Intelligence-related Technology (AI Promotion Act)	since 4 Jun 2025
Japan	Public Offices Election Act, AI-Generated Content Labelling Duty (2026 Amendment)	from 1 Mar 2027, in 4 months	label generated content; disclose the use of AI
Kyrgyzstan	Digital Code, Article 126: AI systems used in digital well-being services are systems of increased danger	since 6 Feb 2026	govern the system: policies, roles, assessments
Kyrgyzstan	Digital Code, Chapter 23: AI interaction and deepfake disclosure duties	since 6 Feb 2026	disclose the use of AI; label generated content
Kyrgyzstan	Digital Code, Chapter 23: AI system design and risk-management obligations	since 6 Feb 2026	assess the impact on personal data first; govern the system: policies, roles, assessments
South Korea	AI Framework Act, Article 31 (transparency obligations for AI outputs)	since 22 Jan 2026
South Korea	AI Framework Act, Article 32 (safety-assurance duty for high-compute AI systems)	since 22 Jan 2026	govern the system: policies, roles, assessments; report to a regulator
South Korea	AI Framework Act, Article 34 (business-operator duties for high-impact AI)	since 22 Jan 2026	govern the system: policies, roles, assessments; disclose the use of AI; keep records for a set time
Kazakhstan	Code of Administrative Offences, artificial intelligence violations	since 18 Jan 2026
Kazakhstan	Digital Code, algorithmic decision-making rights	since 10 Jul 2026
Kazakhstan	Law on Artificial Intelligence, copyright and training data	since 18 Jan 2026
Kazakhstan	Law on Artificial Intelligence, prohibited practices	since 18 Jan 2026
Kazakhstan	Law on Artificial Intelligence, transparency and disclosure duties	since 18 Jan 2026	label generated content; disclose the use of AI
Philippines	Anti-OSAEC and Anti-CSAEM Act, Computer-Generated Child Sexual Abuse or Exploitation Materials	in force	do not do the named thing
Pakistan	Prevention of Electronic Crimes Act 2016, child pornography offence	since 18 Aug 2016	do not do the named thing
Singapore	Parliamentary Elections Act 1954, Ban on Manipulated Online Election Advertising Containing a Realistic but False Representation of a Candidate	since 22 Jan 2025	do not do the named thing
Singapore	Penal Code, Distributing or Threatening to Distribute Intimate Image or Recording	since 1 Jan 2020	do not do the named thing
Singapore	Quoine Pte Ltd v B2C2 Ltd	since 24 Feb 2020
Taiwan	Artificial Intelligence Basic Act (人工智慧基本法)	in force	govern the system: policies, roles, assessments
Uzbekistan	Ethics Rules for creating, deploying and using AI-based solutions	since 17 Jun 2026
Uzbekistan	Law on Informatization, use of artificial intelligence in information resources and systems	since 21 Jan 2026
Vietnam	Decree implementing the AI Law, risk classification, notification, conformity assessment and risk management	since 1 May 2026	govern the system: policies, roles, assessments; report to a regulator
Vietnam	Decree implementing the AI Law, serious incident reporting and handling	since 1 May 2026	tell somebody when there is a breach
Vietnam	Decree implementing the AI Law, transparency, technical marking and labeling of AI-generated content	since 1 May 2026	disclose the use of AI; label generated content
Vietnam	Law on Artificial Intelligence, incident management and reporting obligation	since 1 Mar 2026	tell somebody when there is a breach; govern the system: policies, roles, assessments
Vietnam	Law on Artificial Intelligence, inspection and examination	since 1 Mar 2026
Vietnam	Law on Artificial Intelligence, prohibited practices	since 1 Mar 2026
Vietnam	Law on Artificial Intelligence, risk classification and conformity assessment	since 1 Mar 2026	govern the system: policies, roles, assessments; assess the impact on personal data first; report to a regulator
Vietnam	Law on Artificial Intelligence, transparency obligation	since 1 Mar 2026	label generated content; disclose the use of AI
Vietnam	National Artificial Intelligence Ethics Framework (Circular No. 05/2026/TT-BKHCN)	since 10 Mar 2026

The Americas outside the United States: 38 provisions in 15 jurisdictions

Jurisdiction	Instrument	When	Asks of an app
Brazil	TSE Resolution, AI-Generated Content Disclosure Duty	since 4 Mar 2024	label generated content
Brazil	TSE Resolution, Prohibition on Electoral Deepfakes	since 4 Mar 2024	do not do the named thing
Goiás	Complementary Law 205 of 2025, State Policy to Foster Innovation in Artificial Intelligence	since 19 May 2025
Bahamas	Sexual Offences Act, child pornography offence	in force	do not do the named thing
Belize	Practice Direction No. 18 of 2025, ethical use of generative AI in court proceedings	since 12 Aug 2025	disclose the use of AI; do not do the named thing
Canada	Bank Act: investment and lending policies, standards and procedures	in force	govern the system: policies, roles, assessments
Canada	CIRO Rule 3100, Part B, conflicts of interest	since 30 Jun 2021	govern the system: policies, roles, assessments; disclose the use of AI
Canada	CIRO Rule 3400, suitability determination	since 31 Dec 2021	govern the system: policies, roles, assessments
Canada	CIRO Rule 3600, communications with the public	since 1 Jan 2023	do not do the named thing; govern the system: policies, roles, assessments
Canada	CIRO Rule 3800, records and client reporting	since 1 Jan 2023	govern the system: policies, roles, assessments; keep records for a set time; disclose the use of AI
Canada	CIRO Rule 3900, supervision	since 1 Jan 2023	govern the system: policies, roles, assessments
Canada	CIRO Rules 3200 and 3300, know your client and know your product	since 31 Dec 2021	govern the system: policies, roles, assessments
Canada	Canadian Human Rights Act, discriminatory practices in services, accommodation and employment, with the defences and the Tribunal's remedies	since 1 Mar 1978	do not do the named thing
Canada	National Instrument 31-103, compliance system and general records	since 28 Sep 2009	govern the system: policies, roles, assessments
Canada	National Instrument 31-103, know your client and know your product	since 31 Dec 2021	govern the system: policies, roles, assessments
Canada	National Instrument 31-103, material conflicts of interest	since 30 Jun 2021	govern the system: policies, roles, assessments; disclose the use of AI
Canada	National Instrument 31-103, relationship disclosure information	since 31 Dec 2021	disclose the use of AI
Canada	National Instrument 31-103, suitability determination	since 31 Dec 2021	govern the system: policies, roles, assessments
Canada	Protecting Victims Act, intimate images made by artificial intelligence software and threats to publish them	since 18 Jul 2026	do not do the named thing
Alberta	Election Finances and Contributions Disclosure Act, Part 6.21, political deepfakes	since 16 Apr 2026	do not do the named thing
Alberta	Protection of Privacy Act, automated-system notice and decision accuracy duties of public bodies	since 11 Jun 2025	disclose the use of AI; govern the system: policies, roles, assessments; keep records for a set time
British Columbia	Moffatt v. Air Canada	since 14 Feb 2024
Manitoba	Business Practices Act, personalized algorithmic pricing	since 1 Jul 2026	do not do the named thing; disclose the use of AI; get consent first
Manitoba	Non-Consensual Distribution of Intimate Images Act, civil action for fake intimate images created with artificial intelligence	since 4 Jun 2024	do not do the named thing
Manitoba	Public Sector Artificial Intelligence and Cybersecurity Governance Act, governance of public sector use of artificial intelligence systems	from a date not yet set	disclose the use of AI; govern the system: policies, roles, assessments; do not do the named thing
Nova Scotia	Intimate Images and Cyber-protection Act, fake intimate images	in force	do not do the named thing; disclose the use of AI
Ontario	Employment Standards Act, 2000, use of artificial intelligence in job postings	since 1 Jan 2026	disclose the use of AI
Ontario	Enhancing Digital Security and Trust Act, 2024, use of artificial intelligence systems by public sector entities	since 29 Jan 2025	disclose the use of AI; govern the system: policies, roles, assessments
Colombia	Código Penal, Falsedad Personal, AI Deepfake Aggravation	since 28 Jul 2026	do not do the named thing
Jamaica	Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings	since 17 Sep 2025	disclose the use of AI; govern the system: policies, roles, assessments
Mexico	Código Penal Federal, Violación a la Intimidad Sexual (Arts. 199 Octies a 199 Decies), including manipulated or non-corresponding depictions	since 2 Jun 2021	do not do the named thing
Mexico	Reform to the Federal Labor Law and the Federal Copyright Law, AI Voice and Image Consent Regime for Performing Artists	since 15 May 2026	get consent first; put the terms in the contract; do not do the named thing
Peru	Reglamento de la Ley 31814, high-risk AI system duties	since 22 Jan 2026	disclose the use of AI; govern the system: policies, roles, assessments
Peru	Reglamento de la Ley 31814, prohibited AI uses	since 22 Jan 2026	do not do the named thing; limits on biometric use
El Salvador	Ley de Fomento a la Inteligencia Artificial y Tecnologías, decisiones de la IA o impulsadas por IA	in force
El Salvador	Ley de Fomento a la Inteligencia Artificial y Tecnologías, marco institucional, registro y evaluación de riesgos	in force	govern the system: policies, roles, assessments; hold a license or registration; assess the impact on personal data first
El Salvador	Resolución ANIA 0001/2025, derecho a notificación ante decisiones automatizadas	in force
El Salvador	Resolución ANIA 0001/2025, registro obligatorio para decisiones consecuenciales	in force	govern the system: policies, roles, assessments; limits on biometric use; assess the impact on personal data first

Africa: 20 provisions in 11 jurisdictions

Jurisdiction	Instrument	When	Asks of an app
Angola	Penal Code, Child Pornography Including a Virtual or Simulated Minor	in force	do not do the named thing
Benin	Digital Code of the Republic of Benin, Livre VI, Article 576 (Unauthorised Image or Voice Montage / Synthetic-Media Prohibition)	in force	do not do the named thing; get consent first
Central African Republic	Code Pénal Centrafricain, article 111 (pornographie impliquant des enfants)	in force
Cabo Verde	Cybercrime Law, Child Pornography Including Simulated Representations	in force	do not do the named thing
Djibouti	Digital Code, Book VI: Computer-Generated Child Pornography Ban	in force	do not do the named thing
Gabon	Ordonnance n°0011/PR/2026, contenus interdits générés par intelligence artificielle	since 8 Apr 2026	do not do the named thing; label generated content
Gabon	Ordonnance n°0011/PR/2026, marquage des contenus générés par intelligence artificielle	since 8 Apr 2026	label generated content; report to a regulator
Comoros	Penal Code, pornographic and manipulated image or representation offenses via an information system	since 16 Feb 2021	do not do the named thing
Mauritius	Financial Services (Robotic and Artificial Intelligence Enabled Advisory Services) Rules 2021	since 12 Jun 2021	hold a license or registration; govern the system: policies, roles, assessments; disclose the use of AI; report to a regulator
Mozambique	National Commission for Artificial Intelligence (CNIA), Establishment Decree (Decreto n.º 14/2026)	since 17 Apr 2026
Nigeria	Central Bank of Nigeria (Customer Due Diligence) Regulations 2023, monitoring of internet-based business and computerized monitoring systems	since 31 May 2023	govern the system: policies, roles, assessments
Nigeria	Money Laundering (Prevention and Prohibition) Act 2022, customer due diligence, record retention and risk assessment of new technologies	since 12 May 2022	govern the system: policies, roles, assessments; keep records for a set time; assess the impact on personal data first
Nigeria	Money Laundering (Prevention and Prohibition) Act 2022, reports of single transactions above N5,000,000 for an individual and N10,000,000 for a body corporate	since 12 May 2022	report to a regulator
Nigeria	Money Laundering (Prevention and Prohibition) Act 2022, reports of suspicious transactions and the prohibition on tipping off	since 12 May 2022	report to a regulator; do not do the named thing
Nigeria	National Insurance Commission Guidelines for Insurtech Operations in Nigeria, licensing, technology security, lead management and limits on automated claims rejection	since 1 Aug 2025	hold a license or registration; secure the system and the data in it; govern the system: policies, roles, assessments; disclose the use of AI; get consent first
Nigeria	Securities and Exchange Commission Rule on Robo-Advisory Services, governance, testing, audit and disclosure duties for firms that give automated investment advice	in force	hold a license or registration; govern the system: policies, roles, assessments; assess the impact on personal data first; disclose the use of AI; report to a regulator
Nigeria	Terrorism (Prevention and Prohibition) Act 2022, counter-financing of terrorism programmes and 24-hour reports of suspicious transactions to the Nigerian Financial Intelligence Unit	since 12 May 2022	report to a regulator; govern the system: policies, roles, assessments
Nigeria	Terrorism (Prevention and Prohibition) Act 2022, immediate freezing of the funds of designated persons and monitoring of accounts against the sanctions lists	since 12 May 2022	do not do the named thing; report to a regulator; do not get in without authorization
Tanzania	Cybercrimes Act, 2015, child sexual abuse material including computer-generated content	since 2 Oct 2024	do not do the named thing
Tanzania	Online Content Regulations, prohibited content including AI-generated content	since 28 Jan 2025	do not do the named thing

The Middle East: 6 provisions in 5 jurisdictions

Jurisdiction	Instrument	When	Asks of an app
United Arab Emirates	Consumer Protection Standards: reasons for rejecting an application or reducing credit, and complaint decisions	in force	disclose the use of AI
United Arab Emirates	Model Management Standards: governance, validation and monitoring of the models a bank uses to decide, including artificial intelligence models	in force	govern the system: policies, roles, assessments
Israel	Elections for the 26th Knesset Law, disclosure on deep fake election propaganda	since 23 Jul 2026	label generated content; disclose the use of AI
Jordan	Cybercrime Law, Ban on Real, Virtual, and Simulated Depictions of a Minor	in force	do not do the named thing
Qatar	Qatar Central Bank Artificial Intelligence Guideline	in force
Saudi Arabia	Counter-Fraud Framework: fraud detection systems, machine learning and artificial intelligence	in force	govern the system: policies, roles, assessments

Elsewhere: 22 provisions in 16 jurisdictions

Jurisdiction	Instrument	When	Asks of an app
Azerbaijan	Code of Administrative Offences, distributing AI-made photo, video or audio without a label	from a date not yet set	label generated content
Azerbaijan	Criminal Code, making or distributing AI-made material that uses a person's image or voice without consent	from a date not yet set	do not do the named thing; get consent first
Azerbaijan	Criminal Code, making or distributing AI-made pornographic or sexual material that uses a person's image or voice without consent	from a date not yet set	do not do the named thing; get consent first
Azerbaijan	Law on Information, Informatization and Protection of Information, label on publicly shown AI-made photo, video or audio	from a date not yet set	label generated content
Bermuda	Criminal Code Act 1907, making and distributing child abusive material or child pornography	since 7 May 2008	do not do the named thing
Bhutan	Information, Communications and Media Act of Bhutan 2018, obscene communications depicting children	since 8 Jan 2018	do not do the named thing
Switzerland	Swiss Criminal Code, Pornographic Depictions of Non-Genuine Sexual Acts with Minors	since 1 Jul 2014
Iceland	Almenn hegningarlög nr. 19/1940, Art. 210.a, Simulated and Non-Real Child Sexual Abuse Material	since 22 Jun 2022	do not do the named thing
Saint Kitts and Nevis	Electronic Crimes Act, child pornography, including computer-generated depictions	since 26 Nov 2009	do not do the named thing
Cayman Islands	Penal Code 2019 Revision, indecent photographs and pseudo-photographs of children	since 20 Sep 2012	do not do the named thing
Monaco	Code Pénal Arts. 294-3 to 294-4, Child Sexual Abuse Material Including Realistic and AI-Generated Depictions	since 28 Dec 2007	do not do the named thing; report to a regulator
North Macedonia	Criminal Code, Production and Distribution of Child Pornography	in force	do not do the named thing
Russia	Federal Law No. 243-FZ, Article 8, Duties of Sovereign and National Foundation Model Developers	from 1 Mar 2027, in 4 months	govern the system: policies, roles, assessments
Russia	Federal Law No. 243-FZ, Article 9, AI-Generated Content Notice	from 1 Mar 2027, in 4 months	label generated content
Timor-Leste	Penal Code, Article 176 (Child Pornography)	since 7 Jun 2009	do not do the named thing
Turkey	Commercial Advertising Regulation, AI Deepfake Endorsement Ban	since 1 Aug 2026	do not do the named thing
Turkey	Commercial Advertising Regulation, AI Disclosure Duty	since 1 Aug 2026	disclose the use of AI; label generated content
Vatican City	Child sexual abuse material offences (Legge N. VIII, arts. 4, 10-11)	since 1 Sep 2013	do not do the named thing
Vatican City	Guidelines on Artificial Intelligence of Vatican City State (Decree No. DCCII)	since 1 Jan 2025	do not do the named thing; label generated content; govern the system: policies, roles, assessments
Vanuatu	Digital Transformation Act 2025, ICT service permit for AI and AI-related data services	since 17 Dec 2025	hold a license or registration; govern the system: policies, roles, assessments
Samoa	Crimes Act 2013, child pornography offence reaching synthetic and represented depictions	since 1 May 2013	do not do the named thing
Kosovo	Criminal Code of the Republic of Kosovo, Articles 225 and 232 (Child Pornography, Including Computer-Generated and Non-Existent-Child Images)	since 14 Apr 2019	do not do the named thing