Ustawa z dnia 4 września 2026 r. o zmianie ustawy o świadczeniu usług drogą elektroniczną oraz niektórych innych ustaw (Dz.U. 2026 poz. 1296)
Article 1 inserts a chapter 3a into the Act on the Provision of Services by Electronic Means that makes the President of the Office of Electronic Communications (Prezes UKE) the digital services coordinator. The competent authorities under Article 49(1) of Regulation (EU) 2022/2065 are the President of the Office of Competition and Consumer Protection (UOKiK) for online platform providers' duties in Section 4 of Chapter III and for other breaches that harm consumer interests, the Chair of the National Broadcasting Council (KRRiT) for video-sharing platforms except for the Section 4 matters, and the President of UKE for all other matters. A recipient of the service, or another entity named in Article 53 of the Regulation, may lodge a written complaint in electronic form with the coordinator against a provider of intermediary services for an alleged breach of the Regulation. The competent authority may inspect the entity against which a proceeding on a breach of the Regulation has been opened. A decision finding a breach orders the provider to stop it. Where no other effective measure exists, the decision orders the provider to take the measures the Act lists, which are placing a clear warning for recipients who enter its online interface and preventing access to the content that infringes the Regulation. Administrative fines for breach of the Regulation's provisions that the Act lists may not exceed 6 percent of the provider's worldwide turnover in the financial year before the fine is imposed. A fine of up to 1 percent of annual income or worldwide turnover may be imposed on a provider or related person that does not supply information the authority requested, supplies incorrect, incomplete or misleading information, does not correct it, or does not submit to an inspection. Periodic penalty payments of up to 5 percent of average daily turnover or income per day may be imposed for delay in carrying out a decision, delay in meeting a request for an action plan, or obstruction of an inspection. Where the provider achieved no turnover in the three financial years before the year of the fine, the fine may not exceed the equivalent of 6,000 euro. The Act grants no cause of action of its own: it leaves a recipient's claim under Article 54 of the Regulation to the Civil Code, to the extent the Regulation does not regulate it. Claims of that kind go to the regional court (sąd okręgowy). The competent authority or a trusted flagger may bring such an action on the recipient's behalf with the recipient's consent. Chapters 4a to 4c set the coordinator's procedures for certifying out-of-court dispute settlement bodies, awarding trusted flagger status and awarding vetted researcher status. Point 5 of Article 1 repeals chapter 3 of the 2002 Act. Chapter 3, headed exclusion of the service provider's liability for providing services by electronic means, holds articles 12 to 15 of that Act. The Act also amends the Code of Civil Procedure, the Broadcasting Act, the Copyright Act, the Industrial Property Law, the Competition and Consumer Protection Act and the Electronic Communications Law.
Arts. 1, 3, 10 e 23 do Decreto nº 13.135, de 9 de outubro de 2026
Article 10 makes accessibility mandatory, in a broad manner, on the customer service (SAC) channels kept by the suppliers the Decree covers, for use by persons with disabilities, guaranteeing full access for the handling of their demands. It leaves the regulation of the accessibility of SAC channels to the competent regulatory agency or body. Article 1 brings within the Decree the suppliers of products and services regulated by the federal executive that meet the criteria set by the competent agency or regulator. It also brings within it the suppliers that offer or provide financial, payment, credit or other financial services to consumers through platforms or other digital means and are subject to the regulation or supervision of the Central Bank of Brazil. Article 3 treats the SAC as the service provided through telephone channels or electronic communication channels, including chats on websites or applications and instant messaging services. Article 3, paragraph 4, provides that service intended for the offer and contracting of products or services is not SAC. Article 23 charges the National Consumer Secretariat of the Ministry of Justice and Public Security with inspecting and sanctioning suppliers that do not comply, without prejudice to the bodies of the National Consumer Defense System and the regulatory agencies. The Decree enters into force twenty days after its publication and revokes Decree No. 11,034 of 2022, whose Article 6 carried the same accessibility duty.
Law on Regulation of Internet Publications, Game Platforms' Age Rating and Parental Controls
Law No. 5651, Ek Madde 5, added by Law No. 7578 ()
Additional Article 5 of the Law on Regulation of Internet Publications, added by Article 23 of Law 7578 (), bars a game platform from offering games that have not been rated properly, though it may offer an unrated game if it rates the game at the highest age criterion. A game platform based abroad with more than 100,000 daily accesses from Turkey must appoint a natural or legal person as its representative in Turkey and notify the Authority of the representative's details. A game platform must provide clear, understandable and easy-to-use parental control tools, including mechanisms for controlling account settings and for making purchases, rentals and paid memberships subject to a parent's permission or approval. The Authority may ask a game platform for explanations about its corporate structure, information systems and data processing mechanisms, and the platform must give the Authority the information and documents it requests immediately and within a period of no more than fifteen days that the Authority sets. If a platform fails to fulfil a duty within thirty days of the Authority's notice, the Head of the Authority may fine it from 1,000,000 to 10,000,000 Turkish lira. If the platform still has not fulfilled the duty thirty days after that fine is served, the Head may impose a second fine of 10,000,000 to 30,000,000 Turkish lira. If the duty is still unfulfilled thirty days after the second fine is served, the Head may apply to a criminal judgeship of peace to narrow the platform's internet bandwidth by thirty percent. Article 27(1)(a) of Law 7578 has Articles 22 and 23 take effect six months after the Law's publication on , and Additional Article 5 has bound since .
Regulation on Differentiated Services for Children and Age Verification by Social Network Providers
Social Network Provider Age Verification Regulation (Yönetmelik), Resmî Gazete No. 33396, , implementing Law No. 5651, Ek Madde 4(7), (20) and (25)
The Regulation on the Provision of Differentiated Services Specific to Children and on Age Verification by Social Network Providers, issued by the Cybersecurity Presidency (Siber Güvenlik Başkanlığı) and published in Resmî Gazete No. 33396 of , implements paragraphs 7, 20 and 25 of Additional Article 4 of Law No. 5651. It covers social network providers accessible from Turkey, whether based in Turkey or abroad, and sets no daily-access threshold for them, so it does not narrow the providers that paragraph 7 of Additional Article 4 reaches. A provider may not provide its service to a child who has not completed fifteen years of age, and must verify a user's age at account creation with an age verification token. The token is generated through the e-Devlet Kapısı at the user's request and states only whether the user has completed fifteen and, if so, eighteen years of age. A user who is not resident in Turkey and is only temporarily present is exempt from the age verification controls. For users verified as having completed fifteen years of age, the provider must offer a differentiated service with high privacy settings by default, private accounts by default, no live broadcasting, no interface that serves visual content in automatic or swipe-driven sequence, and no profiling or personalized commercial advertising, and must publish the measures taken on its own website. The provider must also supply parental control tools and a free, accessible appeal mechanism in Turkish that includes human review. Breach of the Regulation's duties is sanctioned under the provisions of Additional Article 4 of Law No. 5651, after the provider is notified and given a reasonable period to remedy the breach. By , a provider must verify with a token, at least once, each account opened before the Regulation's start date that was not verified with one, close with notice an account found to belong to a child under fifteen, and place the account of a child found to have completed fifteen under the differentiated service.
Article 2 of Aviso n.º 6/GBM/2026 applies the Aviso to credit institutions and financial companies. Article 4 requires the institutions to have primary and secondary data centers and requires the primary ones to be located in national territory. Article 6 requires the institutions to tell the Banco de Moçambique immediately of any circumstance that restricts or prevents the equivalence of the primary and secondary data centers, and at least 30 days ahead of any foreseeable structural change to their technology infrastructure, information systems or data centers. Article 9 requires the information of banks, microbanks and electronic money institutions to be handled exclusively in private clouds. Article 10 requires the institutions to ensure throughout the contract that the provider guarantees confidentiality, integrity, availability and recovery of the data, and security measures for data in transit and at rest, including encryption, multi-factor authentication, identification and correction of vulnerabilities and access controls. Article 11 requires the service contracts to provide at least for the security measures adopted for the transmission, storage and segregation of data and for a right of audit by the Banco de Moçambique. Article 12 gives institutions already operating a maximum of 12 months from the Aviso's entry into force to bring their data centers and service contracts fully into line. Article 14 provides that non-compliance with the Aviso is a contravention punishable under the Lei das Instituições de Crédito e Sociedades Financeiras. The Aviso was published in the Boletim da República I Série n.º 166 of . Article 17 of the Aviso has it enter into force 60 days after the date of its publication.
Decreto Legislativo 179/2026 Art. 41, Employer Decisions Assisted by AI Systems (Final Decisions Reserved to a Person)
D.Lgs. 7 ottobre 2026, n. 179, art. 41
Article 41 requires an employer that uses AI systems in decisions about the employment relationship to ensure that the final decisions on creating, changing or ending it, including disciplinary measures and performance evaluations, are not taken solely on the basis of automated processing. The definitive decision is in every case reserved to a natural person who exercises effective and autonomous power. The worker's consent is not an exception to that prohibition. The search for and selection of applications is not a final decision on creating the employment relationship, even where it leads to an applicant not being admitted to later stages of the selection. Before the processing starts, the employer must meet the information duties in Article 1-bis of Decreto Legislativo 152/1997. On request, and through the intervention of a natural person, the worker has the right to an intelligible reason for the decision, including how far AI systems affected the decision process and the main parameters considered. A dismissal given in breach of the prohibition is null, and so are the other decisions the employer takes in breach of it. The decree was published in Gazzetta Ufficiale issue 234 of .
Decreto Legislativo 179/2026 Arts. 4 to 6 and 21 to 23, National AI Act Authorities and Administrative Fines
D.Lgs. 7 ottobre 2026, n. 179, artt. 4-6 e 21-23
The Agenzia per l'Italia digitale (AgID) is the national notifying authority, responsible for preparing and carrying out the procedures to assess, designate, notify and monitor conformity assessment bodies. The Agenzia per la cybersicurezza nazionale (ACN) is the national market surveillance authority for AI systems under Article 70 of the EU AI Act. The Bank of Italy, CONSOB and IVASS are the competent authorities for high-risk AI systems used in banking and credit, financial intermediation and insurance respectively. The ACN acts as the single point of contact under Article 70 of the EU AI Act. Non-compliance with the prohibition of the practices in Article 5 of the EU AI Act is subject to an administrative fine of up to EUR 35,000,000 or, if higher, up to 7 percent of total worldwide annual turnover of the preceding year. Failure to comply with the obligations in Articles 16, 22 to 26, 31, 33 (paragraphs 1, 3 and 4), 34, 50, 73 and 80 of the EU AI Act is subject to a fine of up to EUR 15,000,000 or, if higher, up to 3 percent of total worldwide annual turnover of the preceding year. Giving incorrect, incomplete or misleading information to notified bodies or national competent authorities in response to a request is subject to a fine of up to EUR 7,500,000 or, if higher, up to 1 percent of total worldwide annual turnover of the preceding year. Failure to comply with the obligations in Articles 27 and 86 of the EU AI Act is subject to a fine of up to EUR 1,000,000 or, if higher, up to 0.5 percent of total worldwide annual turnover of the preceding year. For infringements of low offensiveness or danger, the authorities may, as an alternative to the fine, order the infringement to be eliminated and not repeated. The decree was published in Gazzetta Ufficiale issue 234 of .
Decree on Safe Digital Environments for Children and Adolescents
Decreto de entornos digitales seguros para niñas, niños y adolescentes, Diario Oficial de la Federación, 14 de octubre de 2026
The President signed the decree in Mexico City on . The Diario Oficial de la Federación published the decree on , in its evening edition. The decree takes effect on the day of its publication in the Diario Oficial de la Federación. Under the fourth transitory provision, digital platforms must document and report the actions they have implemented to comply within a maximum of thirty calendar days from the decree's entry into force. Article 2 defines a digital platform as a digital service provided by intermediaries over the Internet that lets users interact, communicate and create, share or distribute content, including social networks, video games and app stores. Article 3 prohibits a digital platform from allowing a child or adolescent access to, exposure to or a recommendation of content in seven listed categories, including harassment and cyberbullying, sexual abuse and exploitation, hate speech and violent extremism, pornography and other explicit sexual material, and suicide, self-harm and eating disorders. Article 4, item I, requires each digital platform to implement reliable and secure mechanisms to identify the age of its users, which must not be limited to the user's self-declaration of age. Article 4, items II to V, require a digital platform to publish its criteria for identifying and removing accounts or content that promote an Article 3 prohibition and its criteria for age classification and content moderation, to remove such accounts and content immediately, and to provide accessible, visible and permanently available reporting mechanisms. Article 4, items VI to VIII, require a digital platform to provide parental supervision of minors' accounts, to guarantee safety and protection by design, and to keep the strictest available privacy and safety settings active by default when a new account is created. Article 4, item IX, requires a digital platform to carry out periodic assessments of the risks that its design, features, recommender systems and user interaction pose to children and adolescents, to adopt reasonable measures to prevent or mitigate them, and to share statistical reports on the Article 3 content patterns it detects with the competent authorities. Article 5 requires a digital platform to designate a direct, specialized contact point for justice authorities that is available 24 hours a day, every day of the year. When an account or content is removed, a digital platform must preserve any digital evidence for at least 90 business days. A digital platform must also immediately inform and alert the competent national authorities of accounts or content that threaten the life, dignity, safety, integrity or privacy of children and adolescents. Article 6 directs the Secretaría de Salud to design and implement mental-health strategies and programs for children and adolescents.
Decree on Safe Digital Environments for Children and Adolescents, removal, reporting and cooperation duties of digital platforms
DOF 14 de octubre de 2026, Decreto de entornos digitales seguros para niñas, niños y adolescentes, arts. 4 (fracciones IV y V) y 5
Article 2 defines a digital platform as a digital service provided by intermediaries over the Internet that lets users interact, communicate and create, share or distribute content, including social networks, video games and app stores. Article 3 prohibits a digital platform from allowing a child or adolescent access to, exposure to or a recommendation of content, especially images and videos, that generates or promotes harassment and cyberbullying, sexual abuse, exploitation or violence, hate speech and violent extremism, user-to-user content that incites hatred or violence, unlawful conduct or apology for crime, pornography and explicit sexual material, and suicide, self-harm and eating disorders. Article 4, item IV, requires a digital platform to identify and remove immediately any account or content that generates or promotes a prohibition in Article 3. Article 4, item V, requires a digital platform to provide accessible, visible and permanently available mechanisms for users to report such accounts or content promptly. Article 5, item I, requires a digital platform to designate a direct, specialized contact point for the authorities that investigate and administer justice, available 24 hours a day, every day of the year, with immediate technical capacity to act on user-generated content. Article 5, item II, requires a digital platform, when it removes an account or content, to preserve any digital evidence for at least 90 business days, to guarantee its integrity and availability for delivery to the requesting authorities. Article 5, item III, requires a digital platform to inform and alert the competent national authorities immediately of accounts or content that threaten the life, dignity, safety, integrity or privacy of children and adolescents. The decree takes effect on the day of its publication in the Diario Oficial de la Federación. Its fourth transitory provision requires a digital platform to document and report the actions it has implemented to comply with the decree within a maximum of 30 calendar days from its entry into force.
Disability Standards for Accessible Public Transport 2002 (Cth), s. 25.2 and Parts 27 and 28
The Disability Standards for Accessible Public Transport 2002 are disability standards under the Disability Discrimination Act 1992, and the Disability Standards for Accessible Public Transport Amendment 2026, made under subsection 31(1) of that Act, rewrote their fare system, information and booked-service provisions. The Standards apply to all operators and the conveyances they use to provide public transport services, and to providers and supporting premises and infrastructure. An operator is a person or organization that provides a public transport service to the public or to sections of the public, and a provider is a person or organization responsible for the supply or maintenance of conveyances, premises or infrastructure. A public transport service is an enterprise that conveys members of the public by land, water or air, including foreign aircraft and vessels that carry passengers to, from, or in Australia, and does not include adventure travel except to the extent that it moves the public from one location to another distant location. Information about public transport services that an operator or provider provides in an online format, such as a website or mobile web system, must at least meet Level AA conformance under WCAG 2.1 (section 27.7). Section 27.7 applies to new, or substantially refurbished or altered, digital services provided on or after the commencement day. Any information and communication technology that an operator or provider intends for public use must be accessible to persons with disabilities, and this applies to procurements made on or after the commencement day (section 27.10). A fare system must not require actions from a person with disabilities that exceed what is required of a person without a disability, and hardware and software of a fare system to be used by members of the public must comply with sections 8 and 11 of AS EN 301 549 (2020) (section 25.2). A person whose disability affects that person’s use of the standard fare system must be provided with another way of paying the fare that does not cost more and facilitates independent access. Section 25.2 applies to new conveyances, premises and infrastructure and to fare system elements installed on or after the commencement day. General information about transport services must be accessible to all passengers, and if information cannot be supplied in a passenger’s preferred format, equivalent access must be given by direct assistance (sections 27.1 and 27.2). On request, an operator or provider must reproduce a document about transport services in large print, in at least 18 point sans serif type weighted semi-bold or bold (section 27.3). After the end of a 5-year transitional period beginning on the commencement day, general information about transport services, which includes timetables, routes, fares, payment methods, next stop information and next service information, cannot be provided solely in an online format. After the same period, infrequently requested formats must be provided in a timely manner if not immediately available, information requested in braille must be provided, information about a planned disruption must be available in a variety of formats, and operators and providers must publish information about the accessibility features of their conveyances, premises and infrastructure (sections 27.2, 27.5, 27.8, 27.9 and 35.23). Operators of booked services may request advance notice of a requirement for accessible travel, and any notice required must not exceed the period of notice specified for other passengers (sections 28.1 and 28.2). After the 5-year transitional period, passengers with disabilities must be able to book seats in parts of the conveyance appropriate for their traveling needs, in each class of travel a service provides (section 28.4). It is not unlawful to fail to comply with a requirement of the Standards if, and to the extent that, compliance would impose unjustifiable hardship, but compliance is required to the maximum extent not involving unjustifiable hardship (section 33.7). Compliance may be achieved by equivalent access, using alternative means of access with equivalence of amenity, availability, comfort, convenience, dignity, price and safety, but not separate or parallel services (section 33.3). The Commission may grant an exemption from compliance with some or all of the Standards for a period of no more than 5 years (section 33A.1). The Standards were made on , and the compilation that includes the Disability Standards for Accessible Public Transport Amendment 2026 is dated . It is unlawful for a person to contravene a disability standard (section 32 of the Disability Discrimination Act 1992).
Motor Vehicle Dealer Data Collection Act, 2026 PA 113, ss. 5 to 17
The Motor Vehicle Dealer Data Collection Act regulates data collection by motor vehicle dealers, manufacturers and third parties, prescribes requirements for the collection, sharing and use of protected dealer data, and regulates dealer data vendors and authorized integrators (2026 PA 113, title). Protected dealer data includes personal, financial or other data relating to a consumer that a consumer provides to a dealer or that a dealer otherwise obtains and that is stored in the dealer's dealer data system, together with motor vehicle diagnostic data and data about the dealer's business operations stored in that system (section 3(l)). Protected dealer data does not include data that is otherwise publicly available or that a manufacturer or third party obtains through another source (section 3(m)). A third party is a service provider, vendor, dealer data vendor, authorized integrator or any person other than a dealer, a government entity acting under federal, state or local law, an entity acting in accordance with a valid court order, a manufacturer, or an affiliate thereof (section 3(q)). A manufacturer or a third party may not require a dealer to grant the manufacturer or the third party, or a person acting on behalf of either, direct or indirect access to the dealer's dealer data system (section 5(1)). A third party may not access, share, sell, copy, use or transmit protected dealer data without the dealer's prior express written consent (section 7(1)(a)). A third party may not engage in an act of cyber ransom (section 7(1)(b)). A third party may not take an action by contract, technical means or any other means to prohibit or limit a dealer's ability to protect, store, copy, share or use protected dealer data (section 7(1)(c)). A dealer may unilaterally revoke or amend its prior express written consent without cause on 60 days' notice, or immediately for cause (section 9(1)). Prior express written consent must not be a condition of or a factor for consideration or eligibility for any manufacturer program, standard or policy, including one that offers a bonus, incentive, rebate or other payment or benefit to a dealer (section 9(2)). A manufacturer may not access, share, sell, copy, use or transmit protected dealer data, or require a dealer to share or provide access to it, beyond the required manufacturer data without prior express written consent (section 11(1)). A manufacturer and a third party may not engage in an act of cyber ransom or take an action by contract, technical means or any other means to prohibit or limit a dealer's ability to protect, store, copy, share or use protected dealer data (section 11(3)). A manufacturer, authorized integrator or other third party must indemnify a dealer for claims or damages that directly result from its violation, from a violation by its vendor or contractor acting as its agent, or from a violation by a vendor or service provider it required the dealer to use, where the violation concerns accessing, providing access to, using or disclosing protected dealer data (section 13(1)). A dealer bringing a cause of action against a manufacturer, authorized integrator or other third party for a violation has the burden of proof (section 13(2)). A dealer data vendor must adopt and make available a standardized framework for the exchange, integration and sharing of protected dealer data with an authorized integrator and for the retrieval of that data by an authorized integrator using star standards or a compatible standard (section 15(1)). A dealer data vendor must provide access to open application programming interfaces to an authorized integrator (section 15(2)). A dealer data vendor or an authorized integrator may access, use, store or share protected dealer data or any other data from a dealer data system only to the extent allowed in a written agreement with the dealer (section 17(1)). An agreement on access to, sharing, selling, copying, using or transmitting protected dealer data must be terminable not more than 90 days after the dealer data vendor or authorized integrator receives notice from the dealer (section 17(2)). On notice of the dealer's intent to terminate, a dealer data vendor or an authorized integrator must give a successor access to or an electronic copy of all protected dealer data in a commercially reasonable time and format, and must delete or return all protected dealer data to the dealer before the agreement ends, in accordance with the dealer's written directions (section 17(3)). On a dealer's request, a dealer data vendor or an authorized integrator must give the dealer a list of any entity it is sharing protected dealer data with or has allowed to access protected dealer data (section 17(4)). A dealer data vendor or an authorized integrator must allow a dealer to audit its access to and use of any protected dealer data (section 17(5)). The Act does not govern, restrict or apply to data that exists outside a dealer data system, including data generated by a motor vehicle or by a device that a consumer connects to a motor vehicle (section 21(a)). The Act took effect on , the day the Governor approved it.
N.Y.C. Council Int. No. 1118 of 2026 (proposed Admin. Code tit. 20, ch. 4, subch. 17, §§ 20-699.31 to 20-699.40)
The Council formally introduced the pre-considered item at its Stated Meeting and numbered it Int. No. 1118 of 2026; the record shows it in the Committee of the Whole.
Establishing a Private Cause of Action for Certain Harms Arising from Third-Party Misuse of Artificial Intelligence Models
N.Y.C. Council Int. No. 1116 of 2026 (proposed Admin. Code tit. 10, new ch. 12, §§ 10-1201 and 10-1202)
The Council formally introduced the pre-considered item at its Stated Meeting and numbered it Int. No. 1116 of 2026; the record shows it in the Committee of the Whole.
Third-Party Validation and Shut-Down Capability of Artificial Intelligence Models
N.Y.C. Council Int. No. 1100 of 2026 (proposed Admin. Code tit. 20, ch. 5, subch. 27, §§ 20-883 to 20-888)
The Council formally introduced the pre-considered item at its Stated Meeting and numbered it Int. No. 1100 of 2026; the record shows it in the Committee of the Whole.
Requiring Certain Disclosures and Prohibiting Deceptive Representations in the Promotion of Artificial Intelligence Models
N.Y.C. Council Int. No. 1130 of 2026 (proposed Admin. Code tit. 20, ch. 5, subch. 28, §§ 20-890 to 20-894)
The Council formally introduced the pre-considered item at its Stated Meeting and numbered it Int. No. 1130 of 2026; the record shows it in the Committee of the Whole.
Real Decreto 723/2026, de 9 de septiembre, art. 3.2.k) (BOE-A-2026-19200)
Real Decreto 723/2026 is the decree that transposes Directive (EU) 2019/1152 on transparent and predictable working conditions in the European Union. Article 3(2)(k) requires the company to inform each worker in writing of the existence of algorithmic or automated decision-making systems. Where those systems are used to decide matters such as working hours, task allocation, pay, career progression, place of work or termination of the contract, the information must include their guidelines, criteria and operating rules. The information on the elements in Article 3 must be given before the employment relationship begins. For an employment relationship already in force when the decree entered into force, the company must provide the Article 3 information on the worker's request within thirty working days of receiving it, unless the worker already holds it. The decree applies to all companies and workers covered by Article 1 of the Estatuto de los Trabajadores. Chapter II, which holds the information duty, applies only to employment relationships lasting more than four weeks. The decree entered into force on . The decree's own text sets its entry into force twenty days after its publication in the Boletin Oficial del Estado.
Commonwealth of Pennsylvania Digital Accessibility Policy: accessibility duties of a service organization or supplier of digital content and services to an agency
Pa. Digital Accessibility Policy (ITP), sec. 5.5.4
The Digital Accessibility Policy provides that third-party vendors, licensors, contractors or suppliers shall meet its requirements, and section 5.5.4 sets the duties of a service organization providing digital content and services to an agency under the Governor's jurisdiction. A service organization must make all existing digital content and services accessible to the current Section 508 Standards (Revised) and at a minimum WCAG 2.1 Level AA, and must submit an Accessibility Conformance Report for proposed or provided digital content and services in response to solicitations and under any resulting contract. Suppliers must use the most current version of the Voluntary Product Accessibility Template and explain any use of an older version, and the template should be filled out in its entirety, including testing methodology, conformance level and remarks for any partially supported or unsupported level. For any known accessibility issue or WCAG success criterion the product only partially meets or does not meet, the supplier must provide a product roadmap setting the timeframe and release cycle that will resolve it, or detail how it will support the agency in providing equally effective alternate access. A service organization must also submit other artifacts, such as a Policy Driven Adoption for Accessibility assessment, accessibility testing plans, issue reports and product roadmaps, when requested and as the contract requires, and promptly fix accessibility noncompliance issues reported to it.
Commonwealth of Pennsylvania Digital Accessibility Policy: accessibility of agencies' digital content and services
Pa. Digital Accessibility Policy (ITP), secs. 5.1 to 5.3, 5.5.1
The Digital Accessibility Policy, an Information Technology Policy of the Office of Administration issued under Executive Order 2016-06, applies to all offices, departments, boards, commissions and councils under the Governor's jurisdiction and any other entity connecting to the Commonwealth Network. Agencies must ensure that digital content and services, whether developed internally or provided through contractual, licensed or other arrangements, comply with the current Section 508 Standards (Revised) and the Web Content Accessibility Guidelines, and conform at a minimum to WCAG 2.1 Level AA. Archived digital content must be made available in an accessible format to any individual eligible for and requiring access to it. Exempt from WCAG conformance are archived web content, preexisting conventional electronic documents, content posted by a third party unless it posts on behalf of the Commonwealth or on a Commonwealth platform, individualized password-protected or otherwise secured conventional electronic documents about a specific individual, their property or their account, and Commonwealth social media posts posted before . Each agency is accountable for its digital content and services meeting the applicable standards, supports all costs of accessibility testing and remediation, and must ensure its procurement contracts mandate third-party vendors to deliver products that conform to WCAG 2.1 Levels A and AA. An agency may seek an exception from the policy through the IT Policy Governance Process. The policy names no school district or other local public body, so it reaches one only as an entity connecting to the Commonwealth Network. This version took effect on and replaces in its entirety the version dated .
Art. 11 ustawy z dnia 5 lipca 2018 r. o krajowym systemie cyberbezpieczeństwa (Dz.U. 2026 poz. 20), w brzmieniu nadanym ustawą z dnia 23 stycznia 2026 r. (Dz.U. 2026 poz. 252)
Article 11 requires an essential entity or an important entity to notify the competent CSIRT of a significant incident on a graduated clock, transposing NIS2 Article 23. It requires an early warning without delay and no later than 24 hours after detection. It requires a fuller notification within 72 hours of detection, and a periodic report on the CSIRT's request. It requires a final report no later than one month after the 72-hour notification.
New Article 11(2a) requires the entity to inform affected users of a serious cyber threat and of the preventive measures they can take, and new Article 11(2b) requires informing users of a significant incident that adversely affects the service. Until the competent authority announces that the sectoral CSIRT has reached operational capability, the report goes to CSIRT MON, CSIRT NASK or CSIRT GOV; that transitional rule does not apply to a sector whose sectoral team was set up before 2025 (Article 44 of the amending Act).
The Act entered into force on , but Article 33(1) of the amending Act gives an entity that already meets the essential-entity or important-entity criteria on that date twelve months, until , to carry out this duty; Article 33(4) accelerates that clock to six months, until , for an entity already regulated as an operator usługi kluczowej (essential service operator) under the pre-amendment Act.
Article 8i(1) disapplies the Act's provisions on the information security management system and on reporting serious incidents to an essential or important entity of the banking and financial-market-infrastructure sector, apart from the provisions it lists, which keep Article 11(1)(5) and (6) but not this Article's reporting clock. The CSIRTs handle, for that sector, the serious ICT-related incidents its essential and important entities report, which the Act defines by Article 3(10) of Regulation (EU) 2022/2554 (DORA).
NISV 2026, BGBl. II Nr. 290/2026, §§ 2 bis 5 und 7
The Netz- und Informationssystemsicherheits-Verordnung (NISV 2026), BGBl. II Nr. 290/2026, is the ordinance the Cybersicherheitsbehörde issued under Section 32(5) and Section 35(3) of the NISG 2026 and published on . Section 2 applies the technical and methodological risk-management requirements of Article 2 and the Annex of Implementing Regulation (EU) 2024/2690 to every type of essential and important entity listed in Annexes 1 and 2 of the NISG 2026, including those the Implementing Regulation does not itself cover. Section 3 requires a risk analysis to draw on at least four risk categories: technological, human, ICT supply-chain and location-related risks. Section 4 requires compensating measures where an entity cannot meet a Section 2 requirement temporarily or because of its size, documented with reasons and reviewed at least once a year. Section 5(1) treats a cybersecurity incident as significant under Section 35(1) of the NISG 2026 when it meets any of nine criteria, among them a direct financial loss above EUR 500,000 or 5 percent of annual turnover, whichever is lower, and an outage or restriction for more than 100,000 users or 10 percent of users, whichever is lower, for more than 24 hours. Section 7 counts incidents that are not significant on their own as one significant incident when they occurred at least twice within six months with the same apparent cause and effect and together meet the financial-loss criterion. The ordinance enters into force at the end of the day of its promulgation, so its first day is . The NISG 2026, which this ordinance implements, gives the relevant provisions of Regulation (EU) 2022/2554 (DORA) precedence for an entity within DORA's scope (NISG 2026 Section 24(7)).
Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures
NISG 2026, BGBl. I Nr. 94/2025, §§ 24, 25, 28 und 32
Section 32 requires a wesentliche Einrichtung (essential entity) or wichtige Einrichtung (important entity), as Section 24 defines them against the Annex 1 and Annex 2 sector lists and the medium- or large-enterprise thresholds Section 25 sets, to implement appropriate and proportionate technical, operational and organisational risk-management measures to reduce the risks to the security of the network and information systems it uses for its operations or to provide its services, and to prevent or minimise the impact of cybersecurity incidents on the users of its services and on other services. The measures must follow an all-hazards approach and cover at least ten categories: risk analysis and information-system security concepts; cybersecurity-incident handling; business continuity, including backup management, disaster recovery and crisis management; supply-chain security, including the security practices of direct suppliers and service providers; security in the acquisition, development and maintenance of network and information systems, including vulnerability management and disclosure; policies and procedures to assess the effectiveness of risk-management measures; basic cyber-hygiene practices and cybersecurity training; policies on the use of cryptography and, where appropriate, encryption; personnel security, access-control concepts and asset management; and multi-factor or continuous authentication, secure voice, video and text communication and, where appropriate, secure emergency communication systems, transposing NIS2 Article 21. Section 28, the territoriality provision, names an online marketplace, an online search engine and a platform for social-networking services expressly among the digital providers it reaches, alongside cloud-computing, data-centre, content-delivery-network, managed-service and managed-security-service providers. Section 31 places implementation and oversight of these measures on the entity's management body (Leitungsorgan), which must attend cybersecurity training designed for it and ensure staff receive regular training. Section 24(7) gives the relevant provisions of Regulation (EU) 2022/2554 (DORA), and of the national provisions implementing it, precedence over this Act for an entity within DORA's scope. Section 27(1) disapplies only the Section 32 and Section 34 requirements to an entity that sector-specific Union law binds with an at least equivalent level of cybersecurity, so the Section 29 registration this row names still binds such an entity.
Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations
NISG 2026, BGBl. I Nr. 94/2025, §§ 34 und 35
Section 34 requires a wesentliche Einrichtung (essential entity) or wichtige Einrichtung (important entity) to notify its competent sector-specific CSIRT, or, absent one, the national CSIRT, of every significant cybersecurity incident (defined by Section 35) without delay: an early warning within 24 hours of becoming aware of the incident, stating whether it is suspected to result from unlawful and culpable acts or to have cross-border effects, followed by a fuller notification within 72 hours updating that assessment with an initial evaluation of the incident's severity and impact and any indicators of compromise. It also requires an interim report on the CSIRT's or the Cybersicherheitsbehörde's request, and a final report no later than one month after the 72-hour notification, or, if the incident is still ongoing at that point, a progress report followed by a final report once it is resolved, transposing NIS2 Article 23. Section 35 treats a cybersecurity incident as significant where it has caused or can cause severe operational disruption or severe financial loss to the entity, or has affected or can affect another natural or legal person through considerable material or non-material damage, judged against criteria including the dependency of other Annex 1 or Annex 2 sectors on the affected service, the entity's market share, and the incident's possible geographic and cross-border reach. Section 24(7) gives the relevant provisions of Regulation (EU) 2022/2554 (DORA), and of the national provisions implementing it, precedence over this Act for an entity within DORA's scope.
Telekommunikationsgesetz 2021 (TKG 2021), Section 44 Cybersecurity Measures of Operators and Providers
TKG 2021, BGBl. I Nr. 190/2021, § 44 idF BGBl. I Nr. 94/2025
Section 44(1) of the Telekommunikationsgesetz 2021 (TKG 2021), as rewritten by Article 2 of the Act BGBl. I Nr. 94/2025 that also enacts the NISG 2026, requires operators and providers to take cybersecurity measures as other legal provisions require. Where those provisions do not suffice to keep networks and services secure, the regulatory authority (Regulierungsbehörde) may, in agreement with the Federal Chancellor, the federal minister responsible for media and the Cybersicherheitsbehörde, set closer technical and organisational security measures by ordinance. Section 44(2) lets that ordinance also require an operator of public communications networks or services, or a manufacturer of network components or provider of services for such networks, that has no seat or residence in the European Union to name a domestic address for service of process. The rewritten Section 44 takes effect nine months after promulgation on the next first of a month, which is .
In a defamation action, the court may order the defendant to make every reasonable effort to make the publication unavailable to others, including by having it removed from any platform operated by an internet intermediary and de-indexed from any internet search engine. The court may also order any internet intermediary or other person or organization to make every reasonable effort to remove or de-index all publications that include the defamatory words. For the purposes of section 12, an internet intermediary is an internet intermediary as defined in The Protection From Human Trafficking Act. That Act defines an internet intermediary as a person or organization that hosts or indexes third party content through an online platform. The Act was assented to on . The Act comes into force by order of the Lieutenant Governor in Council. Order in Council 375/2026 brought The Defamation Act into force on .
Act on the Prevention of Damage from Wrongful Acts against Important Computers (重要電子計算機に対する不正な行為による被害の防止に関する法律, Act 42 of 2025)
Report of Specified Infringement Events
Act on the Prevention of Damage from Wrongful Acts against Important Computers (重要電子計算機に対する不正な行為による被害の防止に関する法律, Act 42 of 2025), Art. 5
Article 5 of the Act requires a specified social infrastructure business operator that becomes aware of a specified infringement event on a specified important computer, or of an event the ministerial order names as a possible cause of one, to report it to the minister in charge of its business and to the Prime Minister. The ministerial order requires the operator to file a first report promptly after becoming aware of the event and a full report within 30 days of becoming aware of it. A specified social infrastructure business operator is a designated social infrastructure business operator that uses a specified important computer. Article 6 of the Act lets the minister in charge order an operator that violates Article 5 to make the report or correct its content by a set deadline. Violating an order under Article 6 is punishable by a fine of up to 2,000,000 yen. The ministerial order, and so the Act it implements, applies from .
Act on the Prevention of Damage from Wrongful Acts against Important Computers (重要電子計算機に対する不正な行為による被害の防止に関する法律, Act 42 of 2025), Arts. 4 and 6
Article 4(1) of the Act requires a specified social infrastructure business operator that introduces a specified important computer to notify the minister in charge of its business of the computer, with its product name and manufacturer name and the other matters a ministerial order sets. The ministerial order requires that notice to be filed on the prescribed form within four months of the day the specified important computer was introduced. A specified social infrastructure business operator is a designated social infrastructure business operator that uses a specified important computer. An operator already using a specified important computer when the Act takes effect must give the Article 4(1) notice within six months of that day. Article 6 of the Act lets the minister in charge order an operator that violates Article 4(1) or (3) to file the notice by a set deadline. Violating an order under Article 6 is punishable by a fine of up to 2,000,000 yen. The ministerial order, and so the Act it implements, applies from .
A health benefit plan provider that uses artificial intelligence to determine medical necessity for a request for prior authorization must base the determination on the enrollee's own medical history, the clinical circumstances the treating health care provider presents, and other clinical information in the enrollee's medical record. The provider must certify annually to the Alabama Department of Insurance that the artificial intelligence does not rely on a group dataset, is applied fairly and equitably consistent with applicable federal guidance, and does not discriminate against any subscriber group or enrollee. A determination to deny, delay, or modify a prior-authorization request based on medical necessity must always be made by a licensed physician or other health care professional competent to evaluate the artificial intelligence's recommendation in light of the enrollee's own clinical circumstances. The provider must make prominent written disclosure of its use of artificial intelligence in utilization review in its policies and procedures, periodically review the outcomes for accuracy, and keep patient data used in that review within its intended purpose under HIPAA. The Department of Insurance may investigate an alleged violation and order corrective changes to the provider's procedures, and for a violation occurring with the frequency of a general business pattern or practice, may impose an administrative fine of up to $5,000 or suspend or revoke the provider's certificate of authority.
Subscription-Based Generative AI Provider Disclosure Duty
2026 Conn. Pub. Acts 26-100, Sec. 46 (Sub. H.B. 5222, 2026 Gen. Assemb., Reg. Sess.)
A subscription-based provider, a person doing business in Connecticut who creates a generative artificial intelligence system that has more than one million users a month and is publicly accessible to consumers for personal use, and who provides it to consumers by subscription, may not enter into or renew a consumer subscription, or collect a fee for one, unless the provider first gives the consumer written notice of the key terms and conditions and the consumer accepts them in writing. Government agencies are excluded. The initial-subscription notice must give material information sufficient to enable a reasonable consumer to decide whether to purchase or maintain the subscription, including any quantitative or qualitative limitations the provider may impose, such as limits on tokens, images generated or modified or transcription services, and including limitations imposed in response to the consumer's own conduct, and whether the provider has discretion to limit or eliminate the consumer's access to, or reduce the quantity or quality of, any functionality of the system. A renewal notice must disclose any such limitation or discretion that is new for the renewal term or has been modified since the prior term. A violation is an unfair or deceptive trade practice enforced solely by the Attorney General, and the section creates no private right of action. Section 46 of Public Act 26-100 carries the duty that Section 1 of Public Act 26-15 first enacted for any subscription-based artificial intelligence technology; Section 67 of Public Act 26-100 repealed that Section 1, effective from passage, before it took effect.
Generative AI Content Provenance Duty for Large Providers
2026 Conn. Pub. Acts 26-15, Sec. 15
A covered provider, defined as anyone who creates a generative artificial intelligence system that has more than one million users a month and is publicly accessible to consumers, must, to the extent commercially and technically reasonable, embed provenance data in audio, image, or video content its system creates or materially alters, letting a consumer assess whether the content came from that system, and must use commercially and technically reasonable methods, including the Coalition for Content Provenance and Authenticity standard, to make that data hard to remove or tamper with. The duty does not require identifying an individual depicted in the content or disclosing a trade secret.
A frontier developer, defined as anyone who trains or intends to train a foundation model using more than ten to the twenty-sixth power of computing operations, may not retaliate against a covered employee for reporting a reasonable belief that the developer's activity poses a specific and substantial danger to public health or safety through a catastrophic risk, defined to include contributing to more than fifty deaths or serious injuries or more than one billion dollars of property damage or loss from a single incident. A large frontier developer, one with annual gross revenues over five hundred million dollars, must by establish an internal process for a covered employee to anonymously report such concerns, share reports with officers and directors at least quarterly, and give employees notice of their rights under the section. A frontier developer that violates the notice or anti-retaliation provisions is liable to the state for a civil penalty of up to one thousand dollars per violation, recoverable by the Attorney General in Superior Court for the judicial district of Hartford.
Employer AI-Related Layoff Disclosure to the Labor Department
2026 Conn. Pub. Acts 26-15, Sec. 26
An employer that serves a mass-layoff notice on the Connecticut Labor Department under the federal WARN Act, 29 U.S.C. Sec. 2102(a), must also disclose to the department, in a form the Labor Commissioner prescribes, whether the layoffs relate to the employer's use of artificial intelligence or another technological change.
State Agency Use of Artificial Intelligence Technology: Compliance with State Policy and Standards and Impact Assessments
2026 Conn. Pub. Acts 26-15, Sec. 38
A state agency, or an entity acting on behalf of a state agency, may not use any artificial intelligence technology in a function related to the delivery of a public assistance benefit, or in a function that will have a material impact on the rights, civil liberties, safety or welfare of individuals in the state, unless the use complies with policies and standards of the Office of Policy and Management and the Department of Administrative Services. A state agency may not authorize any procurement, purchase or acquisition of artificial intelligence technology, except where its use complies with policies and standards of the Office of Policy and Management and the Department of Administrative Services. A state agency authorized to procure, purchase or acquire an artificial intelligence technology must complete an artificial intelligence impact assessment in compliance with policies and standards of the Office of Policy and Management and the Department of Administrative Services. The impact assessment must be submitted to the Commissioner of Administrative Services, in a form and manner the commissioner prescribes, and posted on the agency's Internet web site not later than sixty days before deployment of the technology. An agency may redact personally identifiable information of any individual from the impact assessment. Artificial intelligence technology under the section excludes any cybersecurity tool, and any data analytics tool or system where artificial intelligence is incidental and not determinative. Section 38 of Public Act 26-15 takes effect on .
Signed and taking effect . An individual harmed by the unlawful dissemination of a synthetically created intimate image, defined the same way as in Conn. Gen. Stat. Sec. 53a-189d, may bring a civil action for an injunction and for economic, emotional-distress, and punitive damages against a person who knowingly disseminated the image intending to cause harm, within two years of discovering the dissemination, with costs and attorneys' fees available to the prevailing party. Separately, a covered platform under 47 U.S.C. Sec. 223a must set up a notice-and-removal process for a harmed individual or the Attorney General to report such an image, post a clear and conspicuous notice describing that process, and, within forty-eight hours of a valid request, remove the image and make reasonable efforts to remove copies, with good-faith removal shielded from liability. A platform that violates the removal duty is subject to a civil penalty of up to twenty-five thousand dollars per day, sought by the Attorney General in Superior Court, in addition to the harmed individual's own private right of action.
Data security incidents: initial notification to the Department of Banking within three business days by banks, credit unions and licensees
Conn. Gen. Stat. § 36a-44a(c)
Each licensee under title 36a of the Connecticut General Statutes, each Connecticut bank and each Connecticut credit union must file an initial notification with the Department of Banking, in a form and manner the Banking Commissioner prescribes, not later than three business days after it knows, or has reason to know, of the occurrence of a data security incident of the kind the subsection describes. The incidents that call for the notification are those that may materially impact the entity's ability to operate in a safe and sound manner or comply with applicable laws and regulations, cause significant disruption in customer services, or involve unauthorized access to the personal information of any individual. A data security incident is any unauthorized access to or unauthorized acquisition, destruction or corruption of electronic files, media, databases or computerized data containing personal information of an individual, or supervisory, financial, operational or business information of a licensee under title 36a, a Connecticut bank or a Connecticut credit union. Personal information has the meaning given in section 36a-701b of the general statutes. The Banking Commissioner may request additional information about an occurrence after the initial notification is filed. Section 1 of Public Act 26-51, which rewrites section 36a-44a, takes effect on . Public Act 26-51 was approved on .
Under Public Act 26-64, a direct-to-consumer genetic testing company is any person doing business in Connecticut who in the ordinary course of business offers genetic testing directly to a consumer, or collects, uses or analyzes genetic data a consumer has provided to that person. Under Public Act 26-64, the definition does not include an individual who is licensed by the state to provide health care services and, within the scope of that practice, orders genetic testing for a medical purpose. Under Public Act 26-64, a consumer has a property right in, and keeps the right to exercise exclusive control over, any biological sample provided to or used by such a company and the results of genetic testing it conducts on the consumer's DNA. Under Public Act 26-64, before collecting, using or disclosing a consumer's genetic data, the company must obtain the consumer's express consent after disclosing its policies on use of the data, the identity of each person who may access the results, and the manner in which it may disclose the data. Under Public Act 26-64, the company must separately obtain express consent before transferring genetic data to anyone other than its vendor or service provider, before using it for another purpose, and before retaining the biological sample after testing. Under Public Act 26-64, the company must obtain informed consent under the federal policy for the protection of human subjects, 45 CFR 46, before disclosing or transferring a consumer's genetic data to a third party for research, or for research it controls for publication or generalizable knowledge. Under Public Act 26-64, the company may not disclose a consumer's genetic data to the consumer's employer, to a person who offers health, life or long-term care insurance coverage, or to a third party it knows or should know intends to use the data for marketing. Under Public Act 26-64, the company must implement reasonable security measures to protect a consumer's biological sample or genetic data from unauthorized access, destruction, use, modification or disclosure. Under Public Act 26-64, a violation is an unfair or deceptive trade practice under section 42-110b(a) of the Connecticut General Statutes and is enforced solely by the Attorney General. Under Public Act 26-64, in an action under section 42-110m the Attorney General may recover a civil penalty of not more than $5,000 for each wilful violation of section 42-110b. Sections 17 to 19 take effect on .
Data brokers: registration application and no sale in violation of the act or the Connecticut Data Privacy Act
Public Act 26-64, sections 2(b), 2(c) and 3 (data broker application and sale limits)
Under section 1 of Public Act 26-64, a data broker is any business, or portion of a business, that sells or licenses brokered personal data to another person. Under section 2(b) of Public Act 26-64, a data broker applies for registration with an initial fee of $2,500, the registration expires on December 31 of the year issued, and it may be renewed for successive one-year terms with a renewal fee of $2,500. Under section 3 of Public Act 26-64, no data broker may sell or license personal data in violation of the act or sections 42-515 to 42-526 of the general statutes, and each registered data broker must establish a privacy policy with measures to ensure it does not. Section 3 of Public Act 26-64 takes effect on . Section 2 of Public Act 26-64 takes effect on . Under section 4 of Public Act 26-64, the Commissioner of Consumer Protection must maintain a web page on the Department of Consumer Protection's web site that discloses, for each registered data broker, the information required under section 2(c) that was in its most recently approved application. Under section 7(a) of Public Act 26-64, as amended by section 42 of Public Act 26-100 (effective ), the data broker provisions do not apply to personal data collected, processed, sold or disclosed in compliance with the Driver's Privacy Protection Act of 1994, protected health information or a HIPAA covered entity or business associate, a consumer reporting agency, furnisher or user of a consumer report to the extent it is subject to the Fair Credit Reporting Act, a financial institution to the extent it is subject to Title V of the Gramm-Leach-Bliley Act, a business that collects information about a consumer who is or was in a contractual, investor, donor or similar relationship with it, a business acting for such a business or a governmental entity, a business collecting data for the regulation of listed chemicals, or a candidate, national, party or political committee. Under section 10 of Public Act 26-64, as amended by section 43 of Public Act 26-100 (effective ), the Commissioner of Consumer Protection may, after notice and a hearing, impose a civil penalty of not more than $200 per day per consumer for each violation of sections 2 to 8 of Public Act 26-64. Public Act 26-64 was approved on .
HB 895 / Ch. 154 (2026), Surveillance Pricing and Algorithmic Price Disclosure (Protection from Predatory Pricing Act)
Md. Code Ann., Com. Law §§13-321, 13-322
Enacted as Chapter 154 and taking effect , this law bars a food retailer (a business establishment of at least 15,000 square feet that sells food exempt from the state sales and use tax) and a third-party food delivery service provider from engaging in dynamic pricing, offering a price personalized to a consumer based on the consumer's personal data, including through artificial intelligence or models that retrain or recalibrate in near real time, or from using surveillance personal data to set a higher price for that food for a specific consumer or group of consumers. Separately, any other merchant that sets the price of a consumer good or service using dynamic pricing or personal data and then advertises, labels, or otherwise communicates that price must include a clear and conspicuous disclosure stating that the price was set by an algorithm or by using the consumer's personal data; this broader disclosure duty exempts conduct regulated under the Insurance Article, a financial institution subject to the Gramm-Leach-Bliley Act, a food retailer already covered by the dynamic-pricing ban, and a lower price offered to a merchant's own employee. Neither provision creates a private right of action. Before bringing an enforcement action, the Division of Consumer Protection must give 45 days' written notice and an opportunity to cure. A violation is subject to a civil fine of up to $10,000 per violation, rising to $25,000 for a repeat violation.
SB 8 / Ch. 445 (2026), AI and Deepfake Identity Fraud
Md. Code Ann., Crim. Law §8-301(f)(2)
Enacted as Chapter 445 and taking effect , this law extends Maryland's identity-fraud statute to bar knowingly, willfully, and with fraudulent intent using artificial intelligence or a deepfake representation to impersonate, falsely depict, or claim to represent another person with intent to defraud, mislead, or cause harm. A victim of that conduct may bring a civil action and seek an injunction and other appropriate relief. A first-tier violation involving one victim is a felony, and a violation involving two or more victims carries a higher penalty tier.
Maryland State government personal records: collection limits, retention and deletion, collection notice and posted privacy notice (Chapter 435 of 2026)
Chapter 435 of the Acts of 2026 (House Bill 264), Gen. Prov. § 4-501
Chapter 435 of the Acts of 2026 (House Bill 264), the Maryland Data Privacy and Protection Act of 2026, amended section 4-501 of the General Provisions Article on personal records. A personal record is a public record that names or, with reasonable certainty, otherwise identifies an individual by an identifying factor such as an address, a description, a fingerprint or voice print, a number or a picture. Personal information collected for personal records must be limited to the minimum amount of personal information necessary to accomplish the legitimate government purpose for which it was collected. Personal information collected for personal records must not be retained for longer than is reasonably necessary to fulfill the legitimate government purpose for which it was collected. Personal information collected for personal records must be securely deleted or de-identified, in accordance with the unit's retention schedule or as allowed by law, when no longer needed to fulfill the legitimate government purpose for which it was collected. Subsection (c) of section 4-501 applies only to units of the State. An official custodian who requests personal information for personal records must tell each person in interest the legitimate government purpose for which it is collected, any specific consequences of refusing to provide it, the person's right to inspect, amend or correct the records, whether it is generally available for public inspection and whether it is made available to, transferred to or shared with any entity other than the official custodian. Each unit of the State must post a privacy notice and its privacy policies on the collection of personal information on its Internet website. The posted privacy notice and privacy policies must be consistent with the guidelines, standards and policies issued by the Department of Information Technology under section 3.5-319 of the State Finance and Procurement Article. Personal records on the enforcement of criminal laws or the administration of the penal system are exempt from the requirements of subsection (c). Chapter 435 took effect on . The Governor approved Chapter 435 on .
Maryland State government privacy governance: Privacy Officers, Department of Information Technology guidance and contract privacy requirements (Chapter 435 of 2026)
Chapter 435 of the Acts of 2026 (House Bill 264), State Fin. & Proc. §§ 3.5-319 and 13-115
Chapter 435 of the Acts of 2026 (House Bill 264) added section 3.5-319 to the State Finance and Procurement Article. Chapter 435 also amended section 13-115 of the State Finance and Procurement Article. Each unit of State government must designate a Privacy Officer to oversee compliance with the subtitle and coordinate with the Department and the Office of the Attorney General. The Department must adopt regulations, guidance and model templates to support compliance with the subtitle, including standard Public Information Act formats and data protection protocols. The Department of Information Technology must require basic security, data collection and privacy requirements to be included in a contract under which a third-party contractor will collect, store or process personal information as defined in section 10-1301 of the State Government Article. The privacy requirements developed for those contracts must be consistent with widely recognized privacy standards, including those of the National Institute of Standards and Technology. Chapter 435 took effect on . The Governor approved Chapter 435 on .
Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them
Codice Penale, art. 437-bis, inserted by D.Lgs. 9 settembre 2026, n. 160, art. 12
Article 12 of Decreto Legislativo 160/2026 inserts Article 437-bis into the Codice Penale (Penal Code), headed omitted adoption of safety measures in AI systems and unlawful alteration of the systems. Whoever omits the technical safety measures provided for the design, training, production and placing on the market of high-risk AI systems, suited to prevent malfunctions or alterations of how the systems work, or omits human-oversight measures, is punished with imprisonment from one to five years where danger to life or to public or individual safety results. Where danger to the security of the State results from the omission, the penalty is imprisonment from two to eight years. Unless the act is a more serious offence, whoever alters a high-risk AI system outside those cases is punished with imprisonment from two to six years where danger to life or to public or individual safety results. Where danger to the security of the State results from the alteration, the penalty is imprisonment from three to ten years. If a first-paragraph omission is committed through gross negligence, the penalty is reduced from one third to one sixth. A professional user of a high-risk AI system who deliberately omits human-oversight measures is punished with the penalties of the first paragraph, first and second sentences, according to whether danger to life or to public or individual safety, or danger to the security of the State, results.
Decreto Legislativo 231/2001 Art. 25-vicies, Entity Liability for Offences Committed with the Use of AI Systems
D.Lgs. 8 giugno 2001, n. 231, art. 25-vicies, inserted by D.Lgs. 9 settembre 2026, n. 160, art. 15
Article 15 of Decreto Legislativo 160/2026 inserts Article 25-vicies into Decreto Legislativo 231/2001, headed offences committed with the use of AI systems. For the offence in Article 437-bis of the Codice Penale (Penal Code), a financial sanction of 600 to 1,000 quote applies to the entity. For the offence in Article 612-quater of the Codice Penale, a financial sanction of 200 to 700 quote applies to the entity. In both cases the disqualification sanctions provided by Article 9, paragraph 2, letters b to e of Decreto Legislativo 231/2001 apply to the entity.
Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10)
D.Lgs. 9 settembre 2026, n. 160, art. 10
Article 10 lets video-surveillance systems, wherever a law permits their installation, be integrated with AI components, and the facial-recognition components may be activated only in the cases, on the conditions and in the manner set by commi 2 and 3, after the images are acquired. To run facial recognition after the fact on a person sought as a suspect, the public prosecutor must ask the judge for preliminary investigations for authorisation without delay and within forty-eight hours of the system's start, and the judge decides by reasoned decree within the following forty-eight hours. If the time limits are not observed or authorisation is refused, use stops immediately and all personal data, results and outputs are deleted unless they are the body of the offence. No authorisation is required where the technology is used only after the commission of an offence, solely for the initial identification of a potential suspect, on objective and verifiable elements directly connected to the offence. At places or events with particular public-order and security needs, the systems automatically process images of the faces of persons entering without processing biometric data. After an offence has been committed, activating the facial-recognition technology processes the biometric data of the images in the local database to compare them with the biometric data extracted from images of the suspect's face. The controller of the processing is the Ministry of the Interior, Department of Public Security. The controller must carry out the data-protection impact assessment beforehand and consult the Garante. Personal data processed through the integrated systems is kept in the reference database for seven days from collection and deleted automatically afterwards. Accesses and processing operations are performed only by authorised persons and recorded automatically in non-modifiable log files, which are kept for five years. No decision producing adverse legal effects on the person concerned may be based solely on the results of facial recognition. The systems may in no case be used with facial recognition in an untargeted way, without any link to an offence or criminal proceeding, or for generalised or indiscriminate biometric control and identification of persons. Operators of the places concerned, organisers or promoters of the events concerned, and persons who have the use of the venues may, in agreement with the owners of those places or structures, install and maintain the AI components and biometric technologies at no new or greater cost to public finances. Those systems are then lent free of charge to the questura, which obtains their complete and exclusive use.
Decreto Legislativo 160/2026 Art. 14, Preventive Seizure of AI-Generated Online Content (Implementing Norms of the Codice di Procedura Penale, Art. 104, Letter e-bis)
D.Lgs. 9 settembre 2026, n. 160, art. 14, amending D.Lgs. 28 luglio 1989, n. 271, art. 104, comma 1, lett. e-bis
Article 14 replaces the words del profilo personale (of the personal profile) in Article 104, comma 1, letter e-bis of the implementing norms of the Codice di Procedura Penale (Code of Criminal Procedure) with the words generati anche con sistemi di intelligenza artificiale (generated also with artificial intelligence systems). As amended, that letter covers a preventive seizure of online content generated also with AI systems, and of the related data, by order to hosting service providers, online platforms or search engines, or intermediary service providers of the information society. The order is to remove the content and the data or to disable access to the profile, while ensuring where technically possible access to content unrelated to the unlawful conduct.
Decreto Legislativo 160/2026, Civil Damages Actions for Harm Caused by AI Systems (Artt. 16-20)
D.Lgs. 9 settembre 2026, n. 160, artt. 16-20
Article 17 applies to actions for damages, in contract or in tort, for harm caused in the use of an AI system. Articles 18 and 19 apply to those actions when the harm results from breach of one or more obligations of Regulation (EU) 2024/1689. Article 17 requires the court, on the application of the party alleging harm, to order the other party or a third party holding it to produce the evidence specifically relevant to how the AI system works, where the applicant presents facts and elements that make the claim plausible. That evidence includes the logs under Article 12, the risk-management documentation under Article 9, the relevant technical documentation under Article 11 and the information on human-oversight parameters under Article 14 of the Regulation. The order is limited to what is necessary and proportionate, and the court takes into account the interests of all parties, particularly the protection of trade secrets and confidential information. A party that fails without good reason to comply with the order, even in part, exposes itself to the court drawing inferences from the evidence under Article 116 of the Codice di Procedura Civile (Code of Civil Procedure), and where the failure concerns the Article 12, 9, 11 or 14 material the court, after weighing all other evidence, treats the facts alleged by the applicant as admitted. A third party that fails without good reason to comply with the order, even in part, is sentenced by the court to a fine of EUR 1,500 to EUR 10,000. Article 18 presumes the causal link between the breach and the harm, unless the contrary is proved, where the harm results from breach of one or more obligations of the Regulation. Without prejudice to the national law transposing Directive (EU) 2024/2853, Article 19 provides that conformity of the AI system with the obligations of the Regulation, even if certified under Chapter III, Section 5, does not of itself exclude the defendant's liability. A person who intends to sue may ask in advance the person to whom the harm is attributed whether liability insurance covers it. The person asked must answer within thirty days of receipt with the existence of the contract, its particulars and the name of the insurer. The injured person has a direct action for damages against the insurer providing the defendant's liability cover, within the sums for which the insurance contract is made. Article 82 of the GDPR and the national law transposing Directive (EU) 2024/2853 on defective products remain unaffected. Where the injured person is a natural person acting for purposes outside any business, commercial, craft or professional activity, the court of the injured person's place of residence or domicile is also competent.
Decreto Legislativo 160/2026, Police Use of AI Systems: Human Review, Oversight, Collaborations, Sandbox Basis and Training (Artt. 3-6, 21)
D.Lgs. 9 settembre 2026, n. 160, artt. 3-6 e 21
Title I of Decreto Legislativo 160/2026 sets rules for the use of AI systems by the Italian police forces, consistently with Regulation (EU) 2024/1689 and Legge 132/2025. Article 1, comma 3 provides that Title I creates no new obligations beyond those the Regulation sets for AI systems and models used for police activities and purposes. Article 3, comma 4 requires the use of AI systems and models in police activity to provide for qualified human review of the results of automatic processing before they are used in acts and measures affecting the legal position of the persons concerned. The review is carried out by staff identified under each police force's internal procedures and is documented so that it can be traced. Article 3, comma 5 requires the police forces to ensure that human oversight of a high-risk AI system is effective and meets Article 14 of the Regulation, by staff with the necessary competence and training. Article 4, comma 2 provides that data processing in collaborations with universities, research bodies and public or private parties includes clauses excluding the sharing of sensitive operational data and any acquisition or use by those parties, even indirect, of AI systems, their hardware and software, or AI-integrated devices trained for police activity, except where synthetic data or masked or pseudonymised real data is used. Article 4, comma 3 requires the collaboration agreements to state who owns the intellectual property in the research results, the derived models, the training data and the software. The police forces in every case own the models trained on sensitive operational data. Article 5 is the legal basis, under Article 59(2) of the Regulation and Decreto Legislativo 51/2018, for processing of personal data by the police forces within AI regulatory sandboxes where necessary for police purposes. Article 6 requires the police forces to run courses on AI applied to police activity in their training institutes. Article 21, comma 1 requires AI systems that are under contract, in development, in testing or already in use for police purposes on the decree's entry into force to be made compatible with Chapter II of Title I within one year. Article 21, comma 2 applies the Regulation's own dates for entry into force and full implementation to the provisions of Title I whose application is provided for by, or depends on, the Regulation.
Chapter III of Title I covers AI systems used in police activity for labelling, filtering and categorising biometric data, for real-time remote biometric identification and for after-the-fact facial recognition. Article 7 permits the police forces to label, filter or categorise lawfully acquired biometric datasets on four conditions, among them that the result is not the sole basis of a decision producing legal effects on natural persons. Article 8 permits real-time remote biometric identification in public or publicly accessible places for the preventive purposes in Article 5(1), first paragraph, point (h)(ii) of the Regulation, and to search for a missing person or for specific victims of kidnapping, human trafficking or sexual exploitation. Use is permitted only to confirm the identity of the specifically targeted persons or for a targeted search for them. Article 8, comma 3 bans the use of biometric databases fed, in whole or in part, by untargeted scraping, or built in breach of data-protection law. Article 2 defines untargeted scraping as the automated, indiscriminate, large-scale extraction and collection, using an AI system, of facial images from the internet or from closed-circuit camera footage, in order to create or expand facial-recognition databases. Use requires the prosecutor's authorisation, granted for a specific event or the strictly necessary time and never for more than fifteen days, extendable by reasoned decree for further periods of fifteen days. In urgent cases the request for authorisation must reach the prosecutor without delay and within twenty-four hours of the start of operations, and the prosecutor decides within the following twenty-four hours. If the conditions and time limits are not met, or authorisation is refused, use stops immediately and the personal data, results and outputs are deleted, except elements lawfully acquired on another legal basis under Decreto Legislativo 51/2018, and results obtained in breach of the article cannot be used. Article 9, comma 1 requires the controller to complete a fundamental-rights impact assessment under Article 27 of the Regulation, and the data-protection impact assessment under Decreto Legislativo 51/2018, before using such a system. Each use is recorded automatically in non-modifiable log files, which are kept for five years and made accessible only to the competent authorities for checking lawfulness, for internal control and in criminal proceedings. After use, the controller notifies the Garante, with the prior clearance of the competent judicial authority, which may defer the notification for up to three months, renewable once, where secrecy requires. Article 13 inserts Article 359-ter into the Codice di Procedura Penale (Code of Criminal Procedure), on identification and localisation through AI systems for real-time remote biometric identification. Under Article 359-ter, in a criminal proceeding the public prosecutor asks the judge for preliminary investigations to authorise the use of such a system. That authorisation names the geographic area and the persons sought, lasts no more than fifteen days, and is extendable by the judge, on the prosecutor's request, for further periods of fifteen days.
The Governor approved SB 690 on , and it was chaptered the same day as Chapter 976 of the Statutes of 2026. An action against a private actor for a website- or app-based violation of Penal Code section 638.51 may be brought under section 637.2 only by the Attorney General, and the change reaches a pending claim in an action commenced within two years before the operative date of the legislation.
Chapter 48, Oregon Laws 2026 (House Bill 4079), takes effect on . Section 1 requires each school district board to adopt a policy for providing notice when a federal immigration authority is confirmed to have entered school property for immigration enforcement. The school district policy must require reasonable efforts to notify a student, or the student's parent or guardian, when the school district has provided information related to the student to a federal immigration authority. The notice that a federal immigration authority is on school property may not disclose personally identifiable information. Section 2 requires the governing board of an institution of higher education to adopt a policy that requires reasonable efforts to notify a student when the institution has provided information related to the student to a federal immigration authority.
Article 80 of Lei n.º 13/2026 provides that the Law enters into force 90 days after its publication. It was published in the Boletim da República I Série No. 123 on , so it entered into force on .
General Security Requirements for the Public Administration and the Private Sector
Rule 3349-9-18 of the Ohio Administrative Code establishes the framework of Northeast Ohio Medical University for the classification, governance, access, protection and lifecycle management of university data. All university data must be assigned to a classification level. Permission to access, use, disclose or generate university data is granted to authorized data users only for legitimate university purposes, based on their roles and compliance with university, contractual and legal requirements. The rule sets four classification levels, from least to most restrictive: public, internal, restricted and highly restricted. The rule took effect . Section 3345.011 of the Revised Code defines a state university as a public institution of higher education that is a body politic and corporate, and recognizes Northeast Ohio Medical University as a state university.
notification of significant events and high-risk Incidents
Operational Risk Management Regulation (C 1/2026), Articles 9.4.4 and 15
The Operational Risk Management Regulation applies to all Licensed Financial Institutions that are juridical persons. Article 15.2 requires a Licensed Financial Institution to notify the Central Bank of any Operational Risk events that significantly impact or may significantly impact the continuity or integrity of Critical Operations. Article 15.2.1 requires the notice of such an event to the Central Bank within 4 hours, including what Critical Operations are affected. Article 15.2.2 requires a summary report to the Central Bank within 24 hours of the nature of the event, the actions being taken, the likely impact and the timeframe for returning to normal operations. Article 15.3 requires a Licensed Financial Institution to notify the Central Bank within 72 hours of any high-risk Incident. The Regulation defines an Incident as an event that has or could potentially have an adverse effect on Critical Operations, or on Critical Information Assets. Article 9.1 states that the Incidents a Licensed Financial Institution's response and recovery plans must cover include ICT and cybersecurity Incidents. Article 9.4.4 requires incident management to include communication plans to report incidents to internal and external stakeholders, including to the Central Bank and other authorities where required. Article 17.1 of the Regulation provides that a violation of any provision of the Regulation may be subject to supervisory action and administrative and financial sanctions as the Central Bank deems appropriate. Article 168(1)(m) of the Federal Decree-Law on the Central Bank, Regulation of Financial Institutions and Activities, and Insurance Business lets the Central Bank impose a fine not exceeding one billion Dirhams on a violating Licensed Financial Institution. The Central Bank rulebook lists the Regulation as C 1/2026, effective from , with status In-Force.
Operational Risk Management Regulation (C 1/2026), Articles 8 and 9
The Operational Risk Management Regulation applies to all Licensed Financial Institutions that are juridical persons. The Regulation defines a Licensed Financial Institution as Banks, (Re)Insurance Companies, and Other Financial Institutions licensed under the Central Bank Law. Article 8.1 of the Regulation requires a Licensed Financial Institution to implement a robust ICT and cybersecurity risk framework within its Operational Risk management framework and Operational Resilience approach. Article 8.6 requires the ICT and cybersecurity policy to address, at a minimum, governance and oversight controls, risk ownership, accountability and compliance, and ICT security measures such as access controls, identity management, network security and vulnerability testing. Article 8.8 requires a Licensed Financial Institution to proactively manage its ICT and cybersecurity systems, including those operated or made available by Third-Party Service Providers. Article 8.9 requires a Licensed Financial Institution's Master System of Record to be continuously maintained and stored within the UAE, including in the case of Outsourcing. Article 17.1 of the Regulation provides that a violation of any provision of the Regulation may be subject to supervisory action and administrative and financial sanctions as the Central Bank deems appropriate. Article 168(1)(m) of the Federal Decree-Law on the Central Bank, Regulation of Financial Institutions and Activities, and Insurance Business lets the Central Bank impose a fine not exceeding one billion Dirhams on a violating Licensed Financial Institution. The Central Bank rulebook lists the Regulation as C 1/2026, effective from , with status In-Force.
Article 14's duties to report an actively exploited vulnerability or a severe incident to the coordinating CSIRT and ENISA began to apply, under Article 71(2), which applies the rest of the Regulation from but Article 14 from this date. Article 69(3) carries the duty to products already on the market.
S.L. 591.6, Cyber Resilience Regulations, made under Chapter 591 (Malta Digital Innovation Authority Act)
The Minister responsible for the Malta Digital Innovation Authority, acting on the Authority's advice, made the Cyber Resilience Regulations, 2026 under article 58 of the Malta Digital Innovation Authority Act, and Legal Notice 238 of 2026 was published in the supplement to the Malta Government Gazette No. 21,717 of . Regulation 1(3) brings regulations 3 to 7 and regulations 9 to 12 into force on .
S.L. 591.6, Cyber Resilience Regulations, made under Chapter 591 (Malta Digital Innovation Authority Act)
Legal Notice 238 of 2026, the Cyber Resilience Regulations, 2026, was published in the supplement to the Malta Government Gazette No. 21,717 of . The Regulations implement the requirements of Regulation (EU) 2024/2847 (the Cyber Resilience Act). Regulation 8 designates the Malta Digital Innovation Authority as the Notifying Authority for the purpose of Regulation (EU) 2024/2847. Regulation 9 designates the Malta Digital Innovation Authority as the Market Surveillance Authority for the purpose of Regulation (EU) 2024/2847. Regulation 10 designates the national CSIRT, as defined in article 8 of the Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, as the CSIRT designated as coordinator for the purpose of Regulation (EU) 2024/2847. That national CSIRT is the one article 8(1) of the Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order establishes within the Malta Information Technology Agency. Regulation 1(3) brings regulations 3 to 7 and regulations 9 to 12 into force on , so the Market Surveillance Authority and CSIRT coordinator designations, and the penalty provisions of regulation 11, apply from that date. Regulation 8 is not among the regulations that regulation 1(3) dates, and the Legal Notice states no other commencement date for it. The Cyber Resilience Act's own essential requirements and market-placement duties for a manufacturer, applicable from , and its vulnerability and incident reporting duties, applicable since , are the Regulation's own and are documented at the European Union jurisdiction level rather than restated here.
AB 1709 (2026), minimum age for addictive social media features
2026 Cal. Stats. ch. 183 (AB 1709), adding Bus. & Prof. Code ch. 22.9 (§ 22682 et seq.) and Gov. Code ch. 5.4 (§ 11530 et seq.)
AB 1709 was approved by the Governor and chaptered as Chapter 183, Statutes of 2026, on , after being enrolled and presented to the Governor on . The Act takes effect .
AB 1856 was approved by the Governor and chaptered as Chapter 184, Statutes of 2026, on , after being enrolled and presented to the Governor on . The Act amends Civil Code Sections 1798.500 to 1798.504 and takes effect .
Cal. Gov. Code Sections 11549.80 to 11549.86 (AB 1405, Ch. 178, Stats. 2026)
The Governor approved AB 1405 and it was filed with the Secretary of State on , adding Chapter 5.9.5 to the Government Code as Chapter 178, Statutes of 2026. Its registration requirement and the bar on unregistered covered AI audits do not commence until .
Code pénal, Livre II, arts. 524-533 (accès non autorisé et sabotage dans un système informatique), inséré par la loi du 29 février 2024 introduisant le livre II du Code pénal; peines fixées au Livre Ier, art. 36 et 38
The new Penal Code, which carries the Book II offense of Articles 524 to 533 introduced by the Law of , entered into force on . Its commencement, originally set for , was postponed to allow the preparations for its implementation to be completed.
Section 55^2(1) requires a trader to give the consumer, free of charge and before a financial services contract is concluded by means of distance communication, explanations so that the consumer can assess whether the contract and any additional services suit the consumer's needs and financial situation. Where the trader uses only online means to communicate with the consumer, the consumer has the right to demand that a human intervene. The trader ensures human intervention before the financial services contract is concluded by means of distance communication and, in justified cases, after it, in the same language that was used for the pre-contractual information. The trader must prove that it has given adequate explanations, including ensuring human intervention.
Iowa Department of Management Digital Accessibility Policy ADMN.303.02.E: accessibility of digital content and services of the Department and its supported entities
Iowa Digital Accessibility Policy ADMN.303.02.E, secs. 2, 3.1, 3.3 and 3.4
The Digital Accessibility Policy of the Iowa Department of Management, adopted under Iowa Code sections 8.77 and 8.85, requires the Department and all supported entities to make their digital content and services accessible to people with disabilities. Under section 8.77 of the Iowa Code the chief information officer prescribes information technology policies that are binding on all supported entities. A supported entity is a unit of state government and does not include a political subdivision of the state. The policy applies to employees, contractors and vendors working for the Department or a supported entity. All digital content and services within scope must conform to the Web Content Accessibility Guidelines 2.1 at Level AA, and the Department and supported entities must meet that target no later than . Each public-facing website and web application must publish an accessibility statement that affirms the commitment to the conformance target and provides at least one method to report accessibility barriers. Not following the policy may lead to disciplinary action under human resources policy and contractual authority. The policy took effect on and carries an expiration date of .
Iowa Department of Management Digital Accessibility Policy ADMN.303.02.E: accessibility conformance reports for procured, licensed and third-party products and digital services
Iowa DOM Digital Accessibility Policy sec. 3.2 (vendor reports)
The Digital Accessibility Policy of the Iowa Department of Management applies to vendors working for the Department or a supported entity. Section 8.85(1) of the Iowa Code provides that policies the Department establishes, unless waived by it, apply to all information technology procurements for supported entities. Before deployment, any procured, licensed or third-party product or digital service must be accompanied by a current Accessibility Conformance Report for that product, the vendor's completed report based on the Voluntary Product Accessibility Template format, documenting how the product conforms to WCAG 2.1 Level AA and, where applicable, the Revised Section 508 Standards. The policy states that an Accessibility Conformance Report is evidence about a specific product supplied by the vendor, and that vendor self-assessments carry less weight than reports produced through independent, third-party evaluation. Not following the policy may lead to disciplinary action under human resources policy and contractual authority. The policy took effect on and carries an expiration date of .
HB 1839 (HCS HBs 1839, 2921 and 3015), Age Verification on Adult Websites
Section 407.3405, RSMo, as created by 2026 Mo. Laws, HCS HBs 1839, 2921 & 3015
The Missouri Revisor of Statutes lists section 407.3405, RSMo, as effective (L. 2026 H.B. 1839, et al.). It requires a commercial entity that knowingly and intentionally publishes or distributes material on an internet website, more than one-third of which is sexual material harmful to minors, to use a third party to perform reasonable age verification that a person seeking access is eighteen or older.
Missouri school bus safety cameras: school board approval, permanent deletion within 180 days of images not used for enforcement, and no use for automated traffic enforcement
Mo. Rev. Stat. Sec. 160.3300
A school district may install and operate school bus safety cameras on school buses to detect violations of section 304.050, provided the school district board of directors approves the use by a vote. Any image or video recorded by a school bus safety camera that is not used to enforce violations of section 304.050 must be permanently deleted no later than one hundred eighty days from the date of capture. A school bus safety camera is a device affixed to a school bus that records photographs, microphotographs or electronic images of the front or rear of a vehicle at the time the vehicle is detected for an infraction identified in section 304.050. No political subdivision may use an image or video captured by a school bus safety camera for violation detection or enforcement as part of any automated camera system designed to detect traffic violations and issue citations, and a prosecutor may still introduce such an image or video as evidence in a judicial proceeding. Section 160.3300 was enacted by Senate Bill 1421 of 2026. Section 160.3300 has been in effect since .
No list, registry or database of students based on their religious or political views at Missouri public postsecondary institutions
Mo. Rev. Stat. Sec. 173.002
No educational institution may create a list, registry, or database of students based on their religious or political views, opinions, or expressions that are protected under the First Amendment to the Constitution of the United States or the Constitution of Missouri (section 173.002.7(6)). An educational institution is a public postsecondary educational institution governed or supervised by a board erected under chapter 172, 174, 175 or 178, by the board of trustees of a community college, or by a state board for any other technical school (section 173.001.2(2)). Section 173.002 has been in effect since .
A person commits disclosure of an intimate digital depiction by disclosing, or threatening to disclose, a realistic depiction of an identifiable individual created or altered through digital manipulation that shows uncovered genitals or similar intimate anatomy, the transfer of bodily sexual fluids, or the individual engaging in sexually explicit conduct, where the person intends to harass, threaten, or harm the depicted individual, or knows or recklessly disregards that the disclosure will cause them harm. Disclosure is a class D felony and a threat to disclose is a class E felony, each rising to a class C felony on a second or subsequent violation, or where the depiction could reasonably be expected to affect a government or election proceeding or facilitate violence. A disclaimer stating the depiction is unauthorized or fabricated is not a defense. An interactive computer service provider is not liable under this section for good-faith efforts to restrict access to such depictions or for giving others the technical means to do so.
Child sexual abuse material offenses, computer-generated and AI-indistinguishable images included
Mo. Rev. Stat. Secs. 573.010, 573.023 to 573.037
Missouri's definition of child sexual abuse material, amended in 2026, includes a digital image, computer image, or computer-generated image that is, or is indistinguishable from, that of a minor engaging in sexually explicit conduct, where an ordinary person viewing it would conclude it depicts an actual minor, regardless of whether the minor was actually engaged in that conduct. Promoting such material in the first degree, meaning possessing it with intent to promote or promoting it, where the depicted or apparent child is under fourteen, is a class B felony, rising to a class A felony if knowingly promoted to a minor, with three years of parole and probation ineligibility. Promoting the same material where the depicted or apparent child is under eighteen is the lesser offense of promoting in the second degree, a class D felony rising to a class B felony if knowingly promoted to a minor. Possessing such material is a class D felony for a single still image, rising to a class B felony for more than twenty images, for one video, or on a repeat offense, with separate punishment for each item possessed. The statute does not require a provider of electronic communication or remote computing services to monitor users or their communications.
News Media Bargaining Charge Act 2026 (Cth), Act 78 of 2026, assented to
The News Media Bargaining Charge Act 2026 imposes a news media bargaining charge at a rate of 2.75%. Under the News Media Bargaining (Administration) Act 2026, the parent entity of a service group that provides a significant social media or search service for a financial year is liable to the charge where the group's relevant Australian digital advertising revenue for the service exceeds A$250 million. A social media service is significant where its average monthly active Australian users exceed the higher of 5 million or a number prescribed by the rules, and a search service where they exceed the higher of 10 million or a prescribed number. The charge is calculated on the group's revenue for the second-most-recent financial year before the year of liability. A charge offset is available only where the service group has new eligible expenditure for the financial year in relation to at least 8 different news business corporate groups. Expenditure on a news business corporate group made up only of small or medium business entities counts at 200%, and expenditure on other groups counts at 150%. The offset cannot exceed the charge, and no single group's adjusted total can supply more than one-quarter of that amount. The Charge Act received Royal Assent on . It commenced on , at the same time as the Administration Act.
Moldova Law No. 195/2024, rights of the data subject
Legea Nr. 195 din 25 iulie 2024, articolele 12-21, 23 (drepturile subiectului de date)
Articles 13 and 14 fix the information a controller gives when it collects personal data from the data subject and where the data came from elsewhere. Article 15 gives a right of access, article 16 a right to rectification, article 17 a right to erasure, article 18 a right to restriction of processing, article 19 the duty to notify recipients of a rectification, erasure or restriction, article 20 a right to data portability and article 21 a right to object, including to direct marketing. Article 23 sets the restrictions on those rights. Article 89(1) enters the Law into force on the expiry of 24 months from the date of its publication in the Official Gazette of the Republic of Moldova. The Law's front matter dates that publication , so these provisions bind from .
Moldova Law No. 195/2024, personal data breach notification
Legea Nr. 195 din 25 iulie 2024, articolele 33-34 (notificarea incalcarii securitatii datelor)
Article 33(1) requires the controller, in the case of a personal data breach, to notify it to the National Centre for Personal Data Protection without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons, and to accompany a later notification with reasons for the delay. Article 33(2) requires the processor to notify the controller without undue delay after becoming aware of a breach. Article 33(3) fixes what the notification must contain: the nature of the breach including, where possible, the categories and approximate number of data subjects and of personal data records concerned, the name and contact details of the data protection officer or other contact point, the likely consequences, and the measures taken or proposed to address it and mitigate its adverse effects. Article 34(1) requires the controller to communicate the breach to the data subject without undue delay where it is likely to result in a high risk to the rights and freedoms of natural persons, in clear and plain language, and article 34(3) excuses that communication only where protective measures such as encryption render the affected data unintelligible, where subsequent measures make the high risk no longer likely, or where it would involve a disproportionate effort and a public communication of equal effect is made instead. Article 89(1) enters the Law into force on the expiry of 24 months from the date of its publication in the Official Gazette of the Republic of Moldova. The Law's front matter dates that publication , so these provisions bind from .
Moldova Law No. 195/2024, transfers of personal data abroad
Legea Nr. 195 din 25 iulie 2024, articolele 44-50 (transferuri catre tari terte)
Article 44 permits a transfer of personal data to a foreign country or an international organisation only on the conditions this chapter lays down, including for onward transfers. Article 45 governs transfer on the basis of an adequacy decision, article 46 transfer subject to appropriate safeguards including a standard transfer agreement the National Centre for Personal Data Protection approves, and article 47 binding corporate rules and what they must specify. Article 49 sets the narrow derogations that permit a transfer in the absence of an adequacy decision or appropriate safeguards, including the data subject's explicit consent after being informed of the risks, contractual necessity, important reasons of public interest, legal claims, vital interests and a transfer from a public register. Article 89(1) enters the Law into force on the expiry of 24 months from the date of its publication in the Official Gazette of the Republic of Moldova. The Law's front matter dates that publication , so these provisions bind from .
Moldova Law No. 195/2024, the Centre, complaints, compensation and sanctions
Legea Nr. 195 din 25 iulie 2024, articolele 55-86 (Centrul National, plangeri, despagubiri si sanctiuni)
Articles 55 to 71 establish the National Centre for Personal Data Protection, fix its status, funding, mission, tasks and powers, its leadership and the appointment of its Director and Deputy Directors, and the appointment and liability of data protection inspectors. Article 72 gives a data subject the right to lodge a complaint with the Centre, and article 73 the right to challenge the Centre's actions or inactions. Article 76 entitles any person who has suffered material or non-material damage from an infringement of the law to compensation from the controller or processor, a claim that runs in court separately from a complaint to the Centre. Article 77 opens the Centre's examination procedure, and the articles that follow govern how it is conducted and the sanctions that close it. Article 89(1) enters the Law into force on the expiry of 24 months from the date of its publication in the Official Gazette of the Republic of Moldova. The Law's front matter dates that publication , so these provisions bind from .
Moldova Law No. 195/2024, special categories, a child's consent and conviction data
Legea Nr. 195 din 25 iulie 2024, articolele 8-10 (categorii speciale de date si consimtamantul copilului)
Article 8 fixes the conditions on which a child's consent to an information society service offered directly to a child is lawful, and requires the controller to make reasonable efforts to verify that the holder of parental responsibility gave or authorised it, taking available technology into account. Article 9(1) prohibits processing personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, and the processing of genetic data, of biometric data for the purpose of uniquely identifying a natural person, and of data concerning health or a natural person's sex life or sexual orientation; the law names facial images as a qualifying example of biometric data, so biometric material derived from an ordinary recording is not carved out of the prohibition. Article 9(2) lifts that prohibition only in the cases it lists, beginning with the data subject's explicit consent to one or more specified purposes and running through employment and social security law, vital interests, the legitimate activities of a not-for-profit body confined to its members, data manifestly made public by the data subject, legal claims, substantial public interest, occupational medicine and health or social care provided under a duty of secrecy, public health, and archiving, research or statistics. Article 10 governs the processing of personal data relating to criminal convictions and offences. Article 89(1) enters the Law into force on the expiry of 24 months from the date of its publication in the Official Gazette of the Republic of Moldova. The Law's front matter dates that publication , so these provisions bind from .
Legea Nr. 195 din 25 iulie 2024, articolul 22 (automated individual decisions)
Article 22(1) gives the data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them. Paragraph 2 lists exceptions, including where the decision is necessary for a contract with the data subject. Where a carve-out applies, the controller must implement suitable measures to safeguard the data subject's rights, freedoms and legitimate interests, including at least the right to obtain human intervention, express a point of view, and contest the decision.
Legea Nr. 195 din 25 iulie 2024, articolele 1-7, 11 si 24-43 (principii, temeiuri legale si obligatiile operatorului)
Article 89(1) brings Law No. 195/2024 into force 24 months after its publication in the Official Gazette on , and Article 90(3)(b) repeals Law No. 133/2011 on the same day. The National Center for Personal Data Protection announced the entry into force on .
Personal Data Protection Law, Reach Over Scraped Public Personal Data
Legea nr. 195/2024 privind protectia datelor cu caracter personal, art. 6, art. 9(2)(e)
Article 6(1) requires a lawful basis, such as consent, a contract, a legal obligation, or a legitimate interest, before processing personal data at all, with no exception for personal data that happens to be publicly accessible; article 6(1)(f)'s legitimate-interest ground is the one most likely to be invoked to justify scraping ordinary personal data from a public page, but it still requires weighing the data subject's rights and interests rather than acting as a blanket carve-out. Article 9(1) separately prohibits processing special-category data, including biometric data, without a ground listed in article 9(2); the only publicly-available-adjacent ground there is article 9(2)(e), which reaches special-category data the data subject manifestly made public themselves, and does not extend to ordinary personal data, or to special-category data another party (rather than the data subject) posted or that became public through a third party's disclosure. A scraper collecting the personal data of a person in Moldova from a public, unauthenticated page must therefore still establish an article 6 lawful basis for the collection and any later use, including for training a model, and must treat any biometric or other special-category data derived from public photographs, video, or audio as subject to article 9's narrower regime.
Loi n° 2023-380 du 19 mai 2023, art. 10, expérimentation du traitement algorithmique d'images de vidéoprotection, prolongée par la loi visant à offrir des réponses immédiates aux phénomènes troublant l'ordre public, la sécurité et la tranquillité de nos concitoyens
Article 10 of Law 2023-380 of allows, as an experiment, the images collected by video-protection systems or aircraft-mounted cameras to undergo algorithmic processing in order to detect and signal certain events. The use of the processing must be authorised by the State's representative in the département or, in Paris, by the prefect of police, for a period of no more than one month that can be renewed. An earlier law renewed the experiment until , as the Constitutional Council recorded in decision 2026-902 DC. The provisions reviewed in decision 2026-915 DC move the end of the experiment to . They also allow the processing where the images are captured in certain buildings or places open to the public. The processing may only detect predetermined events likely to present or reveal risks of acts of terrorism or serious harm to the safety of persons. The processing uses no facial recognition technique, no biometric identification system and no biometric data. It cannot involve any matching, interconnection or automated linking with other processing of personal data. The authorisation decision must be reasoned and state the controller, the building or place, the reasons for the processing, the geographic perimeter and the duration of the authorisation. The Constitutional Council held that, for buildings and places exposed to a permanent risk, the duration of an authorisation may not exceed three months, renewable on the same terms. The Constitutional Council ruled on , and its decision was published in the Journal officiel of . Law 2026-798 of , which carries the provisions reviewed in decision 2026-915 DC, was published in the Journal officiel of . Under Article 1 of the Code civil a law takes effect on the day it fixes or, failing that, on the day after its publication.
Data Protection Act 2025, ss. 1-11, 14, 18, 21-22, 32-33 (lawful basis, purpose limitation, controller and processor duties, security measures, data protection impact assessments)
Section 5 applies the Act to processing personal data within Kiribati and, outside Kiribati, to processing that offers goods or services to, or monitors the behaviour of, data subjects in Kiribati. Section 5(3) states that the Act binds the Republic. Section 6 exempts personal, household or recreational processing and excludes processing by legally authorised authorities for criminal law enforcement, public health emergencies or national security, processing necessary to a legal claim, and processing for journalistic, educational, artistic or literary expression. Section 6(2) defers the Act for two years after commencement for a person who is not a controller of major importance. Section 10 requires a controller to process personal data only for an explicit purpose compatible with the purpose of collection, to limit processing to what that purpose requires, to keep the data accurate and current, and not to retain it longer than necessary unless retention is authorised by law, needed for a legitimate business purpose, or consented to. Section 11 lists twelve lawful bases for processing, including consent, voluntary provision, contractual necessity, a legal obligation, a public authority's lawful function, a medical or public health emergency, legitimate interests that do not override the data subject's fundamental rights, archiving or research, and data the data subject has intentionally made public. Section 14 requires a controller to take reasonable measures, including a written agreement, to bind any person processing personal data on its behalf to the Act, and to pass the same written-agreement duty down to further processors. Section 18 requires appropriate technical and organisational security measures against accidental or unlawful destruction, loss, misuse, alteration, or unauthorised disclosure or access. Section 21 requires a controller of major importance to carry out a data protection impact assessment and submit it to the Digital Transformation Office before processing likely to expose 10,000 or more data subjects to a high risk of significant harm. Section 21(4) applies that section only from the second anniversary of commencement. Sections 32 and 33 give the Minister power to make regulations and state that the Act does not limit any other obligation or right under Kiribati law. Section 2 leaves commencement to a notice the Minister may appoint. By a notice under section 2, the Minister appointed as the day the Act came into force.
Data Protection Act 2025, s. 12 (consent for children and individuals lacking capacity)
Section 12(1) requires that wherever the Act would otherwise rely on a data subject's consent, including the retention consent under section 10(e)(iii), the automated-decision consent under section 17(c), the lawful-basis consent under section 11(2)(a), or the cross-border-transfer consent under section 24(a), that consent be obtained instead from a parent, legal guardian, or other appropriate legal representative where the data subject is under eighteen or otherwise lacks legal capacity. Section 12(1)(b) applies the same substitution to the voluntary provision of personal data that section 11(2)(b) or section 24(b) treats as a lawful basis. Section 12(1)(c) requires a parent, guardian, or other appropriate legal representative to exercise a data subject's Part IV rights or lodge a complaint under section 26 on that data subject's behalf. Section 12(2) disapplies the parental consent requirement for processing carried out for education, medical, or social care by a professional owing a duty of confidentiality, or necessary for court proceedings concerning the individual. Section 12(2)(c) also disapplies it where the processing concerns a child of thirteen years or older requesting information or a service by electronic means at the child's own specific request. The Act defines no separate category of sensitive personal data, so section 12's heightened consent rule for children and individuals lacking capacity is the only special-category protection this Act states. By a notice under section 2, the Minister appointed as the day the Act came into force.
Data Protection Act 2025, s. 17 (right not to be subject to a decision based solely on automated processing)
Section 2 leaves commencement to a ministerial notice. By a notice under section 2, the Minister appointed as the day the Act came into force. Section 17 gives a data subject the right not to be subject to a decision based solely on automated processing of personal data that produces a legal or similarly significant effect on them, except where the decision is necessary to a contract with them, authorised by a written law with suitable safeguards, or authorised by their consent.
Data Protection Act 2025, ss. 13, 15-16 (information notice and rights of data subjects)
Section 13 requires a controller to tell a data subject, before collecting personal data from them, the controller's identity and contact details, the purpose of the processing, how to exercise the Part IV rights, and how to lodge a complaint with the Office under section 26, and to give that information as soon as possible afterward if it could not be given at collection. Section 15 gives a data subject the right to obtain from a controller, at no expense and without unreasonable delay, confirmation of whether the controller is processing their personal data, a copy of it in a commonly used electronic format, correction of data that is inaccurate, out of date, incomplete or misleading, and deletion of data the controller is not entitled to retain. Section 15(2) lets a controller charge a reasonable fee or refuse a request that is manifestly unfounded or excessive, particularly because of its repetitive character, and section 15(4) lets a controller charge a fee for a copy of personal data only to the extent another applicable law otherwise permits. Section 16 gives a data subject the right to withdraw consent previously given, or to object where no lawful basis applies, requires a controller to make exercising that right as easy as giving consent, and requires the controller to promptly stop processing that relies solely on the withdrawn consent. By a notice under section 2, the Minister appointed as the day the Act came into force.
Data Protection Act 2025, ss. 19-20 (personal data breaches)
Section 19(1) requires a person processing personal data on another person's behalf to inform that other person as soon as practicable after becoming aware of any personal data breach, whether or not it meets the harm threshold in section 20, and section 19(3) requires every person to keep a record of any personal data breach, including its facts, effects and remedial action, whether or not that threshold is met. Section 19(4) requires a controller to determine whether a breach meets the section 20(1) threshold, keep a written record of that analysis, and make it available to the Office on request. Section 20 applies to a personal data breach that has resulted in, or is likely to result in, significant harm to affected data subjects, assessed against factors including encryption or other security measures, the nature of the likely harm, mitigating action taken, and whether lost or altered data has been recovered. When a harmful personal data breach has occurred, section 20(2) requires the relevant controller, as soon as practicable after becoming aware of the breach, to notify the Office and each affected data subject, or to notify data subjects by public notification through widely used media where direct notification would involve disproportionate effort or expense or is otherwise not feasible. Section 20(5) requires the notification to set out the nature of the breach including, where possible, the categories and approximate numbers of data subjects and records concerned, a point of contact, the likely consequences, and the measures taken or expected to address the breach, supplying the information in phases without undue further delay where it cannot all be given at once. By a notice under section 2, the Minister appointed as the day the Act came into force.
Data Protection Act 2025, ss. 23-25 (processing and transfers outside Kiribati)
Section 23(1) requires a person that processes personal data outside Kiribati or transfers it to a person outside Kiribati to take reasonable steps to verify or ensure that there is adequate protection with respect to the personal data. Section 23(2) defines adequate protection as restrictions and obligations substantially similar to Parts III and V, rights substantially similar to Part IV, and enforceability of those restrictions, obligations and rights, and section 23(3) lets that protection rest on the destination jurisdiction's laws, on binding corporate rules, contractual clauses, a code of conduct or a certification mechanism, or on an international organisation's own policies and measures. Section 23(4) lets the Office issue guidelines on assessing adequate protection and designate a jurisdiction, organisation, law, or measure as affording or not affording it, and section 23(6) lets the Office prohibit a transfer to a specified jurisdiction, organisation or under specified measures for want of adequate protection or for reasons of national security. Section 24 lets a person process or transfer personal data outside Kiribati without adequate protection where the data subject has given informed consent to the transfer, the transfer is necessary to a contract with the data subject or to a medical emergency, the transfer is for the data subject's benefit and consent is impracticable but would likely be given, or the transfer follows a court or administrative order under an international agreement such as a mutual legal assistance treaty. Section 25 requires a person processing or transferring personal data outside Kiribati to keep a written record of the reasonable steps taken under section 23(1) or the basis relied on under section 24, and to make that record available to the Office on request. By a notice under section 2, the Minister appointed as the day the Act came into force.
Data Protection Act 2025, ss. 26-31 (complaints, investigations, notices, offences and civil remedies)
Section 26 lets a data subject aggrieved by a violation of the Act lodge a complaint with the Office, which the Office admits where the complainant has an interest in the matter and the complaint is not frivolous or vexatious. Section 27 lets the Office investigate on the basis of an admitted complaint or of its own accord where it has reason to believe a person has violated or is likely to violate the Act, with power to require attendance, documents, or a sworn statement, and, on a warrant from the appropriate court, to search premises or computer systems and seize items related to a suspected violation. Section 28 lets the Office, after completing an investigation, issue a notice requiring a person within a specified period to stop or refrain from the violating act, compel a downstream processor to do the same, remedy the violation including compensating an affected data subject, or pay an administrative penalty not exceeding $100,000, proportionate to the violation's gravity and repetitive nature, the person's efforts to comply, any profits made, and the harm caused. Section 29(1) makes it an offence, punishable by a fine not exceeding $100,000 and imprisonment not exceeding ten years or both, to fail to comply with a notice issued under section 27 or 28 that is not the subject of a duly made and ongoing appeal. Section 30 lets an affected data subject, the subject of a section 28 notice, or another interested person apply to the appropriate court for judicial review of the notice within thirty days, and section 31 lets a data subject or a consumer organisation acting on their behalf recover damages in civil proceedings for injury, loss or harm caused by a violation, without duplicating compensation already ordered under a section 28 notice. By a notice under section 2, the Minister appointed as the day the Act came into force.
Decree No. 330/2026/ND-CP of , personal data protection sanctions (Chapter II, Section 6, Articles 39 to 71)
Decree No. 330/2026/ND-CP of the Government sets administrative sanctions for violations in the fields of cybersecurity and personal data protection. Article 80 states that the Decree takes effect from . Article 2(1) covers Vietnamese and foreign individuals and organizations that commit an administrative violation in cybersecurity and personal data protection within Vietnam's territory. Under Article 7(4)(c), the maximum fine for personal data protection violations other than buying or selling data and cross-border transfer is VND 3 billion. Under Article 7(4)(d), those maxima apply to organizations, and an individual who commits the same act faces half the organizational maximum. Article 53(1) fines unlawful buying or selling of personal data from two times up to ten times the amount received. Under Article 56(3)(a), a cross-border transfer that exposes or loses the personal data of 10,000 to under 100,000 Vietnamese citizens is fined 1 to 2 percent of the organization's total revenue in the Vietnamese market in the preceding financial year. Under Article 56(3)(b), the fine is 2 to 3 percent of that revenue where the exposure or loss reaches 100,000 to under 1,000,000 Vietnamese citizens. Under Article 56(3)(c), the fine is 3 to 5 percent of that revenue where the exposure or loss reaches 1,000,000 Vietnamese citizens or more. Where the organization had no revenue in the Vietnamese market in the preceding financial year, or the percentage fine falls below VND 3,000,000,000, Article 56(4) sets fixed fines in its place, up to VND 3,000,000,000. Article 56(5)(b) adds a suspension of cross-border transfer of personal data for 6 to 12 months for the Article 56(3) violations. Article 55(1) fines VND 20,000,000 to 30,000,000 an organization that begins processing personal data without preparing and keeping a processing impact assessment dossier. Article 54(3) fines VND 40,000,000 to 60,000,000 a controller, controller-processor or third party that notifies the specialized personal data protection agency later than 72 hours after discovering a harmful violation. Article 72(1) lets a People's Public Security soldier on duty fine up to 10 percent of the maximum fine in the field of personal data protection.
Health Information Act 2026 Sections 10, 12 and 19 to 22, Electronic Health Record, Personal Public Service Number and Data Requests by the Health Service Executive
Health Information Act 2026 (No. 10 of 2026), ss. 10, 12, 19-22
The Health Service Executive may create and assign to every patient a national Electronic Health Record, to support the sharing of personal health data for patient care and treatment. Before it creates and assigns Electronic Health Records, the Executive must carry out a data protection impact assessment, having regard to the views of patients and patient representative groups. A patient may not be refused a health service solely because the patient has not been assigned an Electronic Health Record. A health services provider must record the personal public service number of each of its patients and associate it with any record it makes about providing a health service to that patient. A health services provider may not refuse a health service to a patient solely because the patient has no personal public service number or cannot provide it. The Executive may request a health services provider to provide the classes of personal health data that it specifies for the Electronic Health Record. A health services provider must comply with such a request. If a provider does not comply, the Executive may issue a notice that allows at least one month to comply, and then apply to the Circuit Court. The Executive may also request a relevant person to provide the classes of health information that it specifies.
Health Information Act 2026 Sections 22 and 24, Anonymised Data First and Ban on Re-Identifying Patients in Health Information Obtained by the Health Service Executive
Health Information Act 2026 (No. 10 of 2026), ss. 22(4) and 24(2)
The Health Information Act 2026 bars the Health Service Executive from re-identifying, or seeking to re-identify, patients to whom the health information it obtained on a request under section 22 relates. The Executive may not request health information that relates to personal data unless it has decided that anonymised or other data that is not personal data could not meet the purpose of the request. Sections 22 to 24 of the Act came into operation on .
Cyberbeveiligingsbesluit, Security Measures and Incident Notification Details
Cyberbeveiligingsbesluit (Besluit van 8 juli 2026), Artt. 2, 4-13 en 24-25
The Cyberbeveiligingsbesluit (Decree of , Staatsblad 2026) implements the Cyberbeveiligingswet and, by Article 35, took effect together with the Act on . Article 5 requires an essential or important entity to take at least the measures of Articles 6 to 18 in implementing Article 21 of the Act. Article 4 sets Articles 6 to 18 aside for DNS service providers, top-level domain name registries, cloud-computing, data-centre, content-delivery-network, managed-service and managed-security-service providers, online marketplaces, online search engines, social-networking platforms and trust service providers, which answer to Commission Implementing Regulation (EU) 2024/2690 instead. Article 7 requires a written, demonstrably applied risk-management policy that covers at least a risk-management method and risk-acceptance criteria. Articles 6, 8 and 9 require the same written policy for the security of network and information systems, for incident handling and for business continuity and crisis management. Article 10 requires a written supply-chain security policy and a periodic check that direct suppliers and service providers meet the entity's security requirements. Article 11 requires a policy for the risks of acquiring software, hardware or services, secure-development processes across all development phases where they apply, and maintenance processes covering at least configuration management and change management. Article 12 requires staff to be aware of the risks to the entity's network and information systems, to apply cyber-hygiene practices and, where their role needs security expertise, to receive regular training. Article 13 requires a written cryptography policy that settles in which cases cryptography is used and who is responsible for implementing it and for key management. Article 24 requires the early warning of a significant incident to include, as well as the data the Act lists, the presumed start time of the incident and, where possible, a description of its nature and visible effects, an estimate of the recovery time and the measures planned or taken. Article 25 requires the notification of a significant incident to be made at a reporting point that the Minister sets up. Article 2 designates the Minister of Justice and Security as the CSIRT for essential and important entities and as coordinator for coordinated vulnerability disclosure under Article 17 of the Act.
Cyberbeveiligingswet, Cybersecurity Risk-Management Measures and Governance
Cyberbeveiligingswet, Artt. 21 en 24
The Cyberbeveiligingswet, signed and published as Staatsblad 2026, 187, entered into force on under Article 35 of the Cyberbeveiligingsbesluit (Staatsblad 2026, 189), which fixed that date as Article 107 of the Act allows, repealing the Wet beveiliging netwerk- en informatiesystemen on the same date.
The Cyberbeveiligingswet, signed and published as Staatsblad 2026, 187, entered into force on under Article 35 of the Cyberbeveiligingsbesluit (Staatsblad 2026, 189), which fixed that date as Article 107 of the Act allows, repealing the Wet beveiliging netwerk- en informatiesystemen on the same date.
Conseil constitutionnel, décision n° 2026-911 DC du 14 août 2026, art. 1er (l'article 1er de la loi visant à protéger les mineurs des risques auxquels les expose l'utilisation des réseaux sociaux est contraire à la Constitution); loi promulguée sans cet article sous le n° 2026-813 du 24 août 2026, JO du 25 août 2026 (ex proposition de loi n° 2107, 17e législature)
By Décision n° 2026-911 DC du 14 août 2026 (Decision no. 2026-911 DC of 14 August 2026 (law to protect minors from the risks posed by social media use)), Conseil constitutionnel (Constitutional Council of France)
The Conseil constitutionnel, seized on by more than sixty deputies, held in decision n° 2026-911 DC of that article 1 of the law to protect minors from the risks posed by social media use is contrary to the Constitution, as a disproportionate infringement of the freedom of expression and for failing to set the conditions and limits of the age proof it would have required of every user. The rest of the law was promulgated as Loi n° 2026-813 du 24 août 2026 without that article.
licence terms for software, applications and databases
Royal Decree No. M/169 (14/8/1447H), Art. 12 and Implementing Regulation Art. 29, Copyright Law (published )
Article 61 makes the Law effective 180 days after its publication in the Official Gazette. The Law is dated in the Gazette, and counting 180 days from that date, without counting the publication day, gives .
copying to develop artificial intelligence products and algorithms
Royal Decree No. M/169 (14/8/1447H), Art. 26(4) and Implementing Regulation Art. 30, Copyright Law (published )
Article 61 makes the Law effective 180 days after its publication in the Official Gazette. The Law is dated in the Gazette, and counting 180 days from that date, without counting the publication day, gives .
Royal Decree No. M/169 (14/8/1447H), Art. 27(1) quotation and journalistic-summary exception, Copyright Law (published )
Article 27(1) permits quoting or copying short passages from a protected, lawfully published work into another work, without the author's permission and without compensation, where the purpose is legitimate, the quotation goes no further than that purpose needs, it is consistent with custom, and the source and the author's name are stated. Article 27(1) applies this also to a journalistic summary taken from newspapers and periodicals. Article 37(1) requires every use under Articles 26 to 36 not to conflict with the normal exploitation of the work or unjustifiably prejudice the legitimate interests of rights holders. Article 59 replaces the Copyright Protection Law issued by Royal Decree No. M/41. Article 61 applies the Law 180 days after its publication in the Official Gazette.
computer programs and the author's exclusive rights
Royal Decree No. M/169 (14/8/1447H), Arts. 3(11) and 9 computer programs and exclusive rights, Copyright Law (published )
Article 3 protects works of every kind, whatever the way they are expressed or the purpose of authorship, and lists its examples without limiting them. Article 3(11) lists computer programs and their applications among those works. Article 9(1) gives the author the exclusive right to do or authorize the acts it lists, according to the nature of the work. Those acts include copying the work in any way or form. They also include translating the work into other languages and modifying, converting or adapting it into another form. The author also holds the right to distribute the work, and that right is exhausted at the first distribution. The author holds the right to rent a computer program for commercial purposes, and that right does not apply where the program itself is not the essential object of the rental. The author holds the right to authorize communicating the work to the public by any means of wired or wireless transmission, including making it available so that the public can access it at any time and place. Article 47 punishes the offences it lists, which include exploiting a right under the Law for commercial purposes without the rights holders' permission, with imprisonment of up to one year, a fine of up to one million riyals, or both. Article 51 lets a rights holder who suffers direct harm from an infringement sue in the competent court for seizure of the infringing works, an order to stop, and compensation including the infringer's profits. Article 61 applies the Law 180 days after its publication in the Official Gazette.
Royal Decree No. M/169 (14/8/1447H), Art. 3(12), Copyright Law (published )
Article 61 makes the Law effective 180 days after its publication in the Official Gazette. The Law is dated in the Gazette, and counting 180 days from that date, without counting the publication day, gives .
copies of a computer program made by the owner of a lawful copy
Royal Decree No. M/169 (14/8/1447H), Art. 33 copies of a computer program by the owner of a lawful copy, Copyright Law (published )
Article 33 allows the owner of a lawful copy of a computer program to make a new copy without the author's permission and without compensation for the purposes it lists, to the extent the purpose needs, and requires the new copy to be destroyed once the purpose ends or the ownership of the lawful copy ends. The first purpose is a backup copy, limited to making one copy. The second purpose is maintaining the authorized copy, or providing maintenance to a person who owns a lawful copy, where the maintenance is necessary to use the software. The third purpose is correcting technical errors, or studying, analyzing and monitoring the performance or function of the software to identify the ideas and theories on which the program rests. The fourth purpose is copying and obtaining the information needed for interoperability with a different computer system or program, where it is done by the licensed person. The fifth purpose is testing data security and fixing security vulnerabilities. Article 37(1) requires every use under Articles 26 to 36 not to conflict with the normal exploitation of the work or unjustifiably prejudice the legitimate interests of rights holders. Article 61 applies the Law 180 days after its publication in the Official Gazette.
exclusion of bare facts and daily news from protection
Royal Decree No. M/169 (14/8/1447H), Art. 4(1) and (3) exclusion of bare facts and daily news, Copyright Law (published )
Article 4(1) excludes ideas, procedures, working methods, mathematical concepts, principles and bare facts from the protection the Law gives. Article 4(3) excludes the daily news, or incidents of a news character, that newspapers, magazines, international bulletins and broadcasting organizations publish. The Law's protection applies to all of those categories where their compilation is distinguished by originality in arrangement, presentation or classification, without protecting the content presented. Article 37(1) requires every use under Articles 26 to 36 not to conflict with the normal exploitation of the work or unjustifiably prejudice the legitimate interests of rights holders. Article 61 applies the Law 180 days after its publication in the Official Gazette.
Royal Decree No. M/169 (14/8/1447H), Art. 47(5), Copyright Law (published )
Article 61 makes the Law effective 180 days after its publication in the Official Gazette. The Law is dated in the Gazette, and counting 180 days from that date, without counting the publication day, gives .
HB 26-1263 (2026), Conversational AI Service Operator Requirements
C.R.S. 6-1-1708
An operator that develops and makes publicly available, or offers to a consumer, a conversational artificial intelligence service must use commercially reasonable or generally accepted methods to estimate a user's age, and must not willfully disregard clear and convincing information that an account holder or user is a minor. The act's effective date is . The age-estimation duties carry no start date later than that effective date. Starting , if an operator knows an account holder or user is a minor, the operator must disclose that the service is artificial intelligence, withhold unpredictable-interval engagement rewards from the minor, prevent the service from producing explicit sexual content, intimate digital depictions, or statements simulating romantic companionship or emotional dependence with the minor, and give the minor and a parent or guardian tools to manage privacy and account settings. Starting , an operator must also disclose to every user, not only minors, that the service is artificial intelligence, run a suicide and self-harm response protocol that refers a user to a crisis service provider rather than law enforcement, and not represent the service's output as coming from a licensed health-care, legal, or mental-health professional or a qualified dietitian; starting , it must report annually to the Attorney General on crisis referrals and self-harm safeguards without including user-identifying information. Signed as Chapter 208 and added to Part 17 of Title 6 alongside SB 24-205 and SB 26-189, a violation of this duty is a deceptive trade practice under the Colorado Consumer Protection Act enforced by the Colorado Attorney General, subject to a 60-day right to cure before an enforcement action, and creates no new private right of action.
Also known as Psychotherapy Artificial Intelligence Restrictions
Colo. HB 26-1195, 2026 Colo. Sess. Laws ch. 358
HB 26-1195 took effect on as Chapter 358 of the 2026 Colorado session laws. The Governor signed it on . It prohibits a regulated psychotherapy professional from allowing an AI system to interact with clients in any form of therapeutic communication without synchronous, real-time interaction between the professional, the AI system, and the client, or from letting the system generate therapeutic recommendations or treatment plans without the professional's review and approval. A professional must inform clients of these prohibitions at initial client contact. If a session will be recorded or transcribed through an AI system, the professional must disclose that use in advance and obtain written, informed consent. The act also makes it an unfair or deceptive trade practice under the Colorado Consumer Protection Act for any person to use a term in the use of an AI system that implies its outputs are provided or endorsed by a regulated professional, that represents that the system provides psychotherapy services, or that suggests therapist-client confidentiality. A regulated professional who violates the act may be disciplined by the appropriate licensing board.
Code de la consommation, arts. L. 221-16, L. 223-1 and L. 223-2 (as rewritten by loi n° 2025-594 du 30 juin 2025, art. 13)
Article L. 223-1 prohibits canvassing a consumer by telephone, directly or through a third party acting on the professional's behalf, where the consumer has not first consented to commercial canvassing by that means. Consent means any free, specific, informed, unambiguous and revocable expression of will by which a person accepts, by a clear positive act, that personal data about them be used for commercial canvassing by telephone. The professional must prove that the consumer's consent was obtained on those terms. The prohibition does not apply where the call is made in the performance of a current contract and relates to the subject of that contract, including an offer of related or complementary products or services or of ones that improve its performance or quality. A professional may call a consumer outside the days and hours set by decree if the consumer explicitly consents to be called at a precisely specified date and time and the professional can show that consent. When a professional collects a consumer's telephone data, Article L. 223-2 requires it to inform the consumer that any commercial telephone solicitation needs the consumer's prior consent, unless it is made in the performance of a current contract. Where the data is collected on concluding a contract, the contract must state, clearly and understandably, that canvassing a consumer by telephone without prior consent is prohibited. Article L. 221-16 requires a professional to end the call without delay and not to contact the consumer again if the consumer objects to the communication continuing. The law repeals Articles L. 223-3 and L. 223-4.
Ustawa z dnia 3 lipca 2026 r. o systemach sztucznej inteligencji (Dz.U. 2026 poz. 1003)
Under Article 127 the Act's general provisions, including the Committee's creation, entered into force on , once 14 days had passed after its promulgation; a narrow staffing provision took effect a day after promulgation, and Articles 8 to 18 and Chapters 3 to 5, 8 and 9, the fines chapter among them, follow on , three months after promulgation.
Article 50 (transparency obligations for AI systems and synthetic content)
Regulation (EU) 2024/1689, Article 50
Article 113 sets as the AI Act's general application date, and Article 50 falls under it rather than under one of the earlier or later carve-outs. From this date the duties to disclose AI interaction, to mark synthetic output, and to label deepfakes bind the providers and deployers the Article covers.
Article 59 (further processing of personal data for developing certain AI systems in the public interest in an AI regulatory sandbox)
Regulation (EU) 2024/1689, Article 59
Personal data lawfully collected for other purposes may be processed in an AI regulatory sandbox solely for the purpose of developing, training and testing certain AI systems in the sandbox when all of the listed conditions are met. The AI systems must be developed for safeguarding substantial public interest, by a public authority or another natural or legal person, in one or more of these areas: public safety and public health, a high level of protection and improvement of the quality of the environment, energy sustainability, safety and resilience of transport systems and mobility, critical infrastructure and networks, and efficiency and quality of public administration and public services. The data processed must be necessary for complying with one or more of the requirements referred to in Chapter III, Section 2, where those requirements cannot effectively be fulfilled by processing anonymised, synthetic or other non-personal data. There must be effective monitoring mechanisms to identify whether any high risks to the rights and freedoms of the data subjects may arise during the sandbox experimentation, as well as response mechanisms to promptly mitigate those risks and, where necessary, stop the processing. Any personal data to be processed must be in a functionally separate, isolated and protected data processing environment under the control of the prospective provider with access limited to authorised persons, the provider may share the originally collected data further only in accordance with Union data protection law, and personal data created in the sandbox cannot be shared outside the sandbox. The processing of personal data in the sandbox must neither lead to measures or decisions affecting the data subjects nor affect the application of their rights laid down in Union law on the protection of personal data. Personal data processed in the sandbox must be protected by appropriate technical and organisational measures and deleted once participation in the sandbox has terminated or the data has reached the end of its retention period, and the logs of the processing must be kept for the duration of the participation unless Union or national law provides otherwise. A complete and detailed description of the process and rationale behind the training, testing and validation of the AI system must be kept together with the testing results as part of the technical documentation referred to in Annex IV. A short summary of the AI project developed in the sandbox, its objectives and expected results must be published on the website of the competent authorities, but that obligation does not cover sensitive operational data in relation to the activities of law enforcement, border control, immigration or asylum authorities. For the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including safeguarding against and preventing threats to public security, under the control and responsibility of law enforcement authorities, the processing of personal data in an AI regulatory sandbox must be based on a specific Union or national law and subject to the same cumulative conditions as in paragraph 1. Article 59(1) is without prejudice to Union or national law which excludes processing of personal data for other purposes than those explicitly mentioned in that law, and to Union or national law laying down the basis for the processing of personal data necessary for developing, testing or training innovative AI systems or any other legal basis, in compliance with Union law on the protection of personal data. Article 2(7), as replaced by Regulation (EU) 2026/1744, provides that, without prejudice to Articles 4a and 59, the Regulation does not affect Regulation (EU) 2016/679 or (EU) 2018/1725, or Directive 2002/58/EC or (EU) 2016/680. Article 59 sits in Chapter VI, to which Article 113 gives no date of its own, so it applies from the Regulation's general application date of . Regulation (EU) 2026/1744 replaced points (a) and (c) of Article 113's third paragraph and added point (d), and none of them names Chapter VI. Under Article 2(2), as replaced by Regulation (EU) 2026/1744, Articles 57, 58 and 59 apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I only in so far as the requirements for high-risk AI systems under the Regulation have been integrated in that Union harmonisation legislation.
Article 60a (real-world testing frameworks for products under the Annex I, Section B legislation)
Regulation (EU) 2024/1689, Article 60a
Member States may allow, in accordance with Article 60a, the testing of high-risk AI systems in real world conditions outside AI regulatory sandboxes by providers or prospective providers of AI enabled products covered by the Union harmonisation legislation listed in Section B of Annex I, with a view to assessing and verifying the conformity of those systems with the requirements laid down in Articles 8 to 15. Member States that choose to allow that testing must, individually or jointly, adopt frameworks for real-world testing, and each Member State must notify the Commission of any real-world testing framework it adopts before implementing it. Member States that have adopted real-world testing frameworks must ensure that the relevant national competent authorities, relevant authorities and public authorities responsible for the management and operation of infrastructure and products covered by the Section B legislation cooperate closely with each other in good faith and remove any practical obstacles. The frameworks must lay down the requirements under which testing in real-world conditions occurs, including a mandatory real-world testing plan agreed between the provider or prospective provider and the national competent authority or relevant authority, compliance with the requirements laid down in Article 60(2), (3), (4)(d) to (j) and (5) to (9), effective governance and accountability arrangements, and a high level of protection of health, safety and fundamental rights. The real-world testing must comply with the applicable provisions laid down in the Union harmonisation legislation listed in Section B of Annex I, and any requirements in those provisions do not affect the application of Article 60a to the extent necessary to enable the testing. For a high-risk AI system classified under Article 6(1) and related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under the Regulation have been integrated in that legislation. Where testing in real world conditions is based on Article 60a, a reference in Article 76 to a market surveillance authority is read as a reference to the national competent authority or appropriate authority under the Section B legislation, and references to Article 60 are read as references to Article 60a, as appropriate. Article 113 provides that the Regulation applies from , with exceptions for Chapters I and II, Chapter III Section 4, Chapter V, Chapter VII, Chapter XII, Article 78 and Article 6(1), none of which is Chapter VI, in which Article 60a sits between Articles 60 and 61. Regulation (EU) 2026/1744 entered into force on the third day following that of its publication in the Official Journal, .
Article 75 and Articles 75a to 75d (AI Office supervision, investigation, commitments, fines and periodic penalty payments)
Regulation (EU) 2024/1689, Article 75 and Articles 75a to 75d
The AI Office is exclusively competent for the supervision and enforcement of the obligations under the Regulation in relation to AI systems based on general-purpose AI models where the model and the system are developed by the same provider, or by providers forming part of the same undertaking as that provider, with four exceptions. The four exceptions to the AI Office's competence over AI systems based on general-purpose AI models are AI systems related to products covered by the Union harmonisation legislation listed in Annex I, AI systems referred to in point 2 of Annex III, AI systems provided by law enforcement authorities, border management authorities and financial institutions insofar as they fall under Article 74(6), and AI systems referred to in point 8 of Annex III as regards the administration of justice. The AI Office is also exclusively competent in relation to AI systems that constitute or are integrated into a very large online platform or very large online search engine designated in accordance with Regulation (EU) 2022/2065. The AI Office's exclusive competence applies to the providers of the AI systems it covers, and to their deployers only when they are also the provider or form part of the same undertaking as the provider. By way of derogation from Article 73, providers of high-risk AI systems subject to the competence of the AI Office must report any serious incidents to the AI Office, and Article 73(2) to (9) applies mutatis mutandis. The AI Office is responsible for conformity assessments and tests of the AI systems within its competence that are classified as high-risk and subject to a third-party conformity assessment, and the Commission entrusts their performance to notified bodies. The fees for testing and assessment activities are levied on the provider of a high-risk AI system who has applied for a third-party conformity assessment to the Commission, and the provider pays the costs of the services entrusted to the notified bodies directly to the notified body. A market surveillance authority with well-founded and sufficient reasons to suspect an infringement by a provider or deployer of an AI system within the AI Office's competence may request, through its single point of contact, that the AI Office assess the matter. The AI Office informs a market surveillance authority's single point of contact, without undue delay and in any event no later than four months following receipt of its request for an assessment, of its intention to exercise its powers or of its reasons for not exercising them. When it supervises and enforces the AI systems within its competence, the AI Office has all the powers of a market surveillance authority provided for in the Section of the Regulation that holds Article 75a and in Article 14(4) and Article 16(3) of Regulation (EU) 2019/1020. The AI Office is authorised to fully reclaim from the relevant operator the totality of the costs of its supervision and enforcement activities with respect to instances of non-compliance, including costs for human and technical resources. Where the AI Office has reasonable grounds to suspect non-compliance by a provider or a deployer of an AI system referred to in Article 75(1), it may adopt a decision to start an investigation, and upon starting the investigation it notifies the operator of the AI system concerned. The AI Office may exercise the powers listed in Article 14(4), points (a), (b) and (c) of Regulation (EU) 2019/1020 and Article 74(12) and (13) of the Regulation by simple request or by decision. When requesting information, the AI Office states the legal basis and the purpose of the request, specifies what information is required and sets the period within which the information is to be provided. A simple request for information from the AI Office must additionally indicate that, although there is no obligation to provide the information requested, in the case of a voluntary reply the information must be correct and not misleading, and must indicate the potential fines provided for in Article 99(5). A request for information made by decision must additionally indicate the fines provided for in Article 99(5) for supplying incorrect, incomplete or misleading information and the right to have the decision reviewed by the Court of Justice of the European Union. The AI Office may conduct all necessary remote or on-site inspections pursuant to the powers laid down in Article 14(4), points (d) and (e) of Regulation (EU) 2019/1020 and Article 74(5) of the Regulation. During an inspection, the officials of the AI Office are empowered to enter any of the business premises, land or property located in the Union of the operator concerned, to examine and copy books, data and other material relevant to their tasks, to ask for oral or written explanations and to seal business premises and books or records for the duration of, and to the extent necessary for, the inspection. The AI Office may also order operators to provide access to, and explanations relating to, their AI systems, and may impose an obligation on an operator to retain all data and documents deemed to be necessary to assess the implementation of and compliance with the obligations under the Regulation. If, during proceedings under Article 75a(2), the operator concerned offers commitments to ensure compliance, the AI Office may, by decision, make those commitments binding on the operator and declare that there are no further grounds for action. The AI Office may reopen proceedings in which it made commitments binding where there has been a material change in the facts on which the decision was based, the operator acts contrary to its commitments, or the decision was based on incomplete, incorrect or misleading information provided by the operator. Where the AI Office finds that an operator falling within the scope of Article 75(1) does not comply with the relevant provisions of the Regulation or with commitments made binding under Article 75b, it adopts a decision establishing such non-compliance. Before adopting a decision establishing non-compliance, the AI Office communicates its preliminary findings to the operator concerned and explains the measures that it is considering taking, or that it considers the operator should take, to address them. In a decision establishing non-compliance the AI Office orders, where relevant, the operator to take the necessary measures to ensure compliance within a reasonable period specified in the decision and to provide information on the measures it intends to take, and the operator then provides the AI Office with a description of the measures it has taken upon their implementation. A decision establishing non-compliance may be accompanied by the imposition of penalties in accordance with Article 99(3) to (7), which apply mutatis mutandis to the AI Office in the execution of its supervision and enforcement tasks. Infringement of any applicable provision of the Regulation, failure to comply with decisions or measures adopted under the powers in Article 14(4) or Article 16(3) of Regulation (EU) 2019/1020 and Article 75a, and failure to comply with a commitment made binding under Article 75b are subject to administrative fines as referred to in Article 99(4). The supply of incorrect, incomplete or misleading information to the AI Office in reply to a request is subject to administrative fines as referred to in Article 99(5). Article 99(4) sets administrative fines of up to EUR 15,000,000 or, if the offender is an undertaking, up to 3% of its total worldwide annual turnover for the preceding financial year, whichever is higher. Article 99(5) sets administrative fines of up to EUR 7,500,000 or, if the offender is an undertaking, up to 1% of its total worldwide annual turnover for the preceding financial year, whichever is higher, for the supply of incorrect, incomplete or misleading information. In the case of SMEs, including start-ups, Article 99(6) limits each fine to the percentage or amount referred to in paragraphs 3, 4 and 5, whichever is lower. The AI Office may adopt a decision imposing periodic penalty payments to compel operators to submit to an investigation, to comply with an information request or an inspection ordered by decision, to provide correct or complete answers in an inspection, to comply with corrective actions, to comply with commitments made legally binding, or to comply with a decision establishing non-compliance. Periodic penalty payments imposed by the AI Office are effective and proportionate and, where applicable, do not exceed 5% of the average daily income or worldwide annual turnover in the preceding financial year per day, calculated from the date appointed by the decision. The Court of Justice of the European Union has unlimited jurisdiction to review decisions of the AI Office fixing a fine or periodic penalty payment, and may cancel, reduce or increase the fine or periodic penalty payment imposed. The AI Office's powers under Article 75c are subject to a limitation period of five years, which begins to run on the day the infringement is committed or, for continuing or repeated infringements, the day the infringement ceases. The rights of defence and of access to the file of operators falling within the scope of Article 75(1) must be fully respected in proceedings, and those operators are entitled to have access to the AI Office file under the terms of a negotiated disclosure, subject to the legitimate interest in the protection of business secrets. The AI Office publishes the decisions it adopts under Articles 75b and 75c, stating the names of the parties and the main content of the decision, including any penalties imposed. Where market surveillance authorities have sufficient reason to consider general-purpose AI systems that can be used directly by deployers for at least one purpose classified as high-risk to be non-compliant, they cooperate with the AI Office to carry out compliance evaluations and inform the Board and other market surveillance authorities accordingly. Where a market surveillance authority is unable to conclude its investigation of a high-risk AI system because it cannot access certain information related to the general-purpose AI model despite all appropriate efforts, it may submit a reasoned request to the AI Office, which supplies the information it considers relevant without delay and in any event within 30 days.
Article 85 (right to lodge a complaint with a market surveillance authority)
Regulation (EU) 2024/1689, Article 85
Any natural or legal person having grounds to consider that there has been an infringement of the provisions of the Regulation may submit complaints to the relevant market surveillance authority, without prejudice to other administrative or judicial remedies. Complaints submitted under Article 85 are taken into account for the purpose of conducting market surveillance activities and are handled in line with the dedicated procedures the market surveillance authorities have established for them, in accordance with Regulation (EU) 2019/1020. Article 85 sits in Chapter IX, to which Article 113 gives no date of its own, so it applies from the Regulation's general application date of . Regulation (EU) 2026/1744 replaced points (a) and (c) of Article 113's third paragraph and added point (d), and none of them names Chapter IX.
Articles 60 and 61 (testing in real world conditions outside AI regulatory sandboxes, with informed consent)
Regulation (EU) 2024/1689, Articles 60 and 61
Providers or prospective providers of high-risk AI systems listed in Annex III or covered by the Union harmonisation legislation listed in Section A of Annex I may test them in real world conditions outside AI regulatory sandboxes, in accordance with Article 60 and the real-world testing plan, without prejudice to the prohibitions under Article 5. They may conduct that testing at any time before the placing on the market or the putting into service of the system, on their own or in partnership with one or more deployers or prospective deployers. A provider is a natural or legal person, public authority, agency or other body that develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge. Article 2(8) excludes research, testing and development activity regarding AI systems prior to their being placed on the market or put into service, but testing in real world conditions is not covered by that exclusion. The testing is without prejudice to any ethical review that is required by Union or national law. Providers or prospective providers may conduct the testing in real world conditions only where all of the conditions in Article 60(4) are met, the first being that they have drawn up a real-world testing plan and submitted it to the market surveillance authority in the Member State where the testing is to be conducted. The market surveillance authority in that Member State must have approved the testing and the plan, and where it has not answered within 30 days they are understood to have been approved, although where national law does not provide for a tacit approval the testing remains subject to an authorisation. The provider or prospective provider must have registered the testing in accordance with Article 71(4) with a Union-wide unique single identification number and the information specified in Annex IX, subject to separate registration routes for Annex III point 1, 6 and 7 systems in the areas of law enforcement, migration, asylum and border control management and for point 2 systems. The provider or prospective provider must be established in the Union or have appointed a legal representative established in the Union, may transfer data collected for the testing to third countries only with appropriate and applicable safeguards under Union law, and may not test for longer than necessary and in any case not longer than six months, extendable by six months on prior notification with an explanation. Subjects who belong to vulnerable groups due to their age or disability must be appropriately protected, and where deployers or prospective deployers take part they must be informed of all aspects of the testing relevant to their decision to participate, given the instructions for use referred to in Article 13, and bound by an agreement specifying roles and responsibilities. The subjects of the testing must have given informed consent in accordance with Article 61. In the case of law enforcement, where the seeking of informed consent would prevent the AI system from being tested, the testing itself and its outcome must not have any negative effect on the subjects and their personal data must be deleted after the test is performed. The testing must be effectively overseen by the provider or prospective provider, and by deployers or prospective deployers, through suitably qualified persons with the necessary capacity, training and authority, and the predictions, recommendations or decisions of the AI system must be capable of being effectively reversed and disregarded. Under Article 61(1), freely-given informed consent must be obtained from the subjects of testing prior to their participation, after they have been duly informed of the nature and objectives of the testing, its conditions and expected duration, their rights, the arrangements for requesting the reversal or the disregarding of the system's predictions, recommendations or decisions, and the Union-wide unique single identification number of the testing and the contact details of the provider or its legal representative. The informed consent must be dated and documented and a copy given to the subjects of testing or their legal representative. Subjects, or their legally designated representative, may without any resulting detriment and without having to provide any justification withdraw from the testing at any time by revoking their informed consent and may request the immediate and permanent deletion of their personal data, and the withdrawal does not affect the activities already carried out. A serious incident is an incident or malfunctioning of an AI system that directly or indirectly leads to the death of a person or serious harm to a person's health, a serious and irreversible disruption of the management or operation of critical infrastructure, the infringement of obligations under Union law intended to protect fundamental rights, or serious harm to property or the environment. Article 60(7) requires any serious incident identified in the course of the testing in real world conditions to be reported to the national market surveillance authority in accordance with Article 73. The provider or prospective provider must adopt immediate mitigation measures or, failing that, suspend the testing until such mitigation takes place, or otherwise terminate it. The provider or prospective provider must also establish a procedure for the prompt recall of the AI system upon such termination of the testing. Article 73 requires the report immediately after a causal link, or the reasonable likelihood of one, is established and in any event not later than 15 days after becoming aware of the serious incident, not later than two days in the event of a widespread infringement or a serious and irreversible disruption of critical infrastructure, and not later than 10 days after becoming aware of the serious incident in the event of the death of a person. Providers or prospective providers must notify the national market surveillance authority in the Member State where the testing is to be conducted of the suspension or termination of the testing and of the final outcomes. The provider or prospective provider is liable under applicable Union and national liability law for any damage caused in the course of their testing in real world conditions. Member States must confer on their market surveillance authorities the powers of requiring providers and prospective providers to provide information, of carrying out unannounced remote or on-site inspections, and of performing checks on the conduct of the testing and the related high-risk AI systems. Member States lay down the rules on penalties and other enforcement measures, which may also include administrative fines, warnings and non-monetary measures, applicable to any infringement of the Regulation by operators. Article 113 provides that the Regulation applies from , with exceptions for Chapters I and II, Chapter III Section 4, Chapter V, Chapter VII, Chapter XII, Article 78 and Article 6(1), none of which is Chapter VI, which holds Articles 60 and 61. Regulation (EU) 2026/1744 replaced point (c) of Article 113, third paragraph, which now dates Chapter III, Sections 1, 2 and 3, and added a point (d) dating Articles 102 to 110 from . Regulation (EU) 2026/1744 entered into force on the third day following that of its publication in the Official Journal, .
Articles 79 and 81 (AI systems presenting a risk: national procedure and Union safeguard procedure)
Regulation (EU) 2024/1689, Articles 79 and 81
An AI system presenting a risk is understood as a product presenting a risk as defined in Article 3, point 19 of Regulation (EU) 2019/1020, in so far as it presents risks to the health or safety, or to fundamental rights, of persons. Where the market surveillance authority of a Member State has sufficient reason to consider an AI system to present a risk, it must carry out an evaluation of the system's compliance with all the requirements and obligations laid down in the Regulation. The relevant operators must cooperate as necessary with the market surveillance authority and with the other national public authorities or bodies referred to in Article 77(1). Where the evaluation finds that the AI system does not comply with the requirements and obligations of the Regulation, the market surveillance authority must without undue delay require the relevant operator to take all appropriate corrective actions to bring the system into compliance, to withdraw it from the market or to recall it, within the period the authority prescribes and in any event within the shorter of 15 working days or the period in the relevant Union harmonisation legislation. The operator must ensure that all appropriate corrective action is taken in respect of all the AI systems concerned that it has made available on the Union market. Where the operator does not take adequate corrective action within the period set under Article 79(2), the market surveillance authority must take all appropriate provisional measures to prohibit or restrict the AI system's being made available on its national market or put into service, to withdraw the product or the standalone AI system from that market or to recall it. Where a market surveillance authority raises objections to a measure taken by another such authority within three months of the notification under Article 79(5), or within 30 days for non-compliance with the prohibition of the AI practices referred to in Article 5, or where the Commission considers the measure contrary to Union law, the Commission must consult the market surveillance authority and the operator or operators, evaluate the measure and decide within six months, or within 60 days for non-compliance with Article 5, whether the national measure is justified. The procedures in Articles 79 to 83 do not apply to AI systems related to products covered by the Union harmonisation legislation listed in Section A of Annex I where such legal acts already provide for procedures ensuring an equivalent level of protection and having the same objective, and the relevant sectoral procedures apply instead. Articles 79 and 81 sit in Chapter IX, to which Article 113 gives no date of its own, so they apply from the Regulation's general application date of . Regulation (EU) 2026/1744 replaced points (a) and (c) of Article 113's third paragraph and added point (d), and none of them names Chapter IX.
Articles 88 to 94 (enforcement of the obligations of providers of general-purpose AI models)
Regulation (EU) 2024/1689, Articles 88 to 94
The Commission has exclusive powers to supervise and enforce Chapter V, taking into account the procedural guarantees under Article 94, and entrusts the implementation of these tasks to the AI Office. Without prejudice to Article 75(3), market surveillance authorities may request the Commission to exercise the powers laid down in the Section on supervision of providers of general-purpose AI models, where that is necessary and proportionate to assist with the fulfilment of their tasks under the Regulation. The AI Office may take the necessary actions to monitor the effective implementation of and compliance with the Regulation by providers of general-purpose AI models, including their adherence to approved codes of practice. Downstream providers have the right to lodge a complaint alleging an infringement of the Regulation, and the complaint must be duly reasoned and indicate at least the point of contact of the provider of the model concerned, a description of the relevant facts and provisions, and any other information the downstream provider considers relevant. The scientific panel may provide a qualified alert to the AI Office where it has reason to suspect that a general-purpose AI model poses concrete identifiable risk at Union level or meets the conditions referred to in Article 51. Upon a qualified alert from the scientific panel, the Commission, through the AI Office and after having informed the Board, may exercise the powers laid down in that Section for the purpose of assessing the matter. The Commission may request the provider of the general-purpose AI model concerned to provide the documentation drawn up by the provider in accordance with Articles 53 and 55, or any additional information that is necessary for the purpose of assessing compliance of the provider with the Regulation. Before sending a request for information, the AI Office may initiate a structured dialogue with the provider of the general-purpose AI model. Upon a duly substantiated request from the scientific panel, the Commission may issue a request for information to a provider of a general-purpose AI model, where access to the information is necessary and proportionate for the fulfilment of the tasks of the scientific panel under Article 68(2). A Commission request for information to a provider of a general-purpose AI model must state the legal basis and the purpose of the request, specify what information is required, set a period within which the information is to be provided, and indicate the fines provided for in Article 101 for supplying incorrect, incomplete or misleading information. The provider of a general-purpose AI model, or its representative, must supply the information the Commission requests under Article 91, and lawyers duly authorised to act may supply information on behalf of their clients, who remain fully responsible if the information supplied is incomplete, incorrect or misleading. The AI Office, after consulting the Board, may conduct evaluations of the general-purpose AI model concerned to assess the provider's compliance with obligations under the Regulation where the information gathered under Article 91 is insufficient, or to investigate systemic risks at Union level of models with systemic risk, in particular following a qualified alert from the scientific panel. The Commission may decide to appoint independent experts to carry out evaluations on its behalf, including from the scientific panel established pursuant to Article 68. For the purposes of an evaluation, the Commission may request access to the general-purpose AI model concerned through APIs or further appropriate technical means and tools, including source code. A Commission request for access to a general-purpose AI model must state the legal basis, the purpose and reasons of the request and set the period within which the access is to be provided, and must indicate the fines provided for in Article 101 for failure to provide access. A provider of a general-purpose AI model, or its representative, must supply the access the Commission requests for an evaluation under Article 92, and where the provider is a legal person the persons authorised to represent it by law or by its statutes provide the access on its behalf. The Commission adopts implementing acts setting out the detailed arrangements and the conditions for the evaluations, including the arrangements for involving independent experts and the procedure for selecting them. Prior to requesting access to a general-purpose AI model, the AI Office may initiate a structured dialogue with the provider to gather more information on the internal testing of the model, internal safeguards for preventing systemic risks, and other internal procedures and measures the provider has taken to mitigate such risks. Where necessary and appropriate, the Commission may request providers to take appropriate measures to comply with the obligations set out in Articles 53 and 54, to implement mitigation measures where an evaluation has given rise to serious and substantiated concern of a systemic risk at Union level, or to restrict the making available on the market, withdraw or recall the model. Before the Commission requests a measure from a provider of a general-purpose AI model, the AI Office may initiate a structured dialogue with the provider. If, during the structured dialogue before a measure is requested, the provider of a model with systemic risk offers commitments to implement mitigation measures to address a systemic risk at Union level, the Commission may, by decision, make those commitments binding and declare that there are no further grounds for action. Article 18 of Regulation (EU) 2019/1020 applies mutatis mutandis to the providers of the general-purpose AI model, without prejudice to more specific procedural rights provided for in the Regulation. The Commission may fine a provider of a general-purpose AI model up to 3% of its annual total worldwide turnover in the preceding financial year or EUR 15,000,000, whichever is higher, where it finds that the provider intentionally or negligently infringed the relevant provisions of the Regulation. Article 101(1), points (b) to (d), applies the same ceiling of 3% of annual total worldwide turnover or EUR 15,000,000, whichever is higher, where the Commission finds that the provider intentionally or negligently failed to comply with a request for a document or for information under Article 91, or supplied incorrect, incomplete or misleading information, failed to comply with a measure requested under Article 93, or failed to make available access to the model for an evaluation under Article 92. Before fining a provider of a general-purpose AI model under Article 101, the Commission communicates its preliminary findings to the provider of the general-purpose AI model and gives it an opportunity to be heard. The Court of Justice of the European Union has unlimited jurisdiction to review decisions of the Commission fixing a fine under Article 101, and may cancel, reduce or increase the fine imposed. Article 101 applies from , the date from which the Regulation applies, because Article 113 excepts it from the earlier date given to Chapter V.
Cal. Bus. and Prof. Code Sections 22757 to 22757.6
A covered provider must make a disclosure verification tool available at no cost to the user, one that lets a user assess whether image, video, or audio content was created or altered, other than by a minor modification, by the provider's generative AI system and that outputs any system provenance data detected in the content. To the extent it is technically feasible, a covered provider must also include in that content a latent disclosure that names the provider, the system and its version, the time and date of creation or alteration, a unique identifier, and whether the system created or altered the content, and that is permanent or extraordinarily difficult to remove or tamper with. A covered provider is a person that creates, codes, or otherwise produces a generative AI system that is publicly accessible within California. SB 1000 was chaptered on as Chapter 861 of the Statutes of 2026. It is an urgency statute and went into immediate effect. SB 1000 deleted the user threshold from the definition of covered provider, replaced the term AI detection tool with disclosure verification tool, and deleted the requirement that a covered provider offer the user the option to include a manifest disclosure in content. A violator of the chapter is liable for a civil penalty of $5,000 per violation, collected in a civil action filed by the Attorney General, a city attorney, or a county counsel, and each day of violation is a discrete violation. SB 1000 added Section 22757.4.1, which sets a civil penalty of $50,000 per violation, collected in a civil action filed by the Attorney General, a city attorney, or a county counsel, for a violation of Section 22757.3(d), and which is repealed on . A covered provider shall not falsely represent that a generative AI system is designed to primarily function as assistive technology. Before , the chapter does not apply to a generative AI system that is designed to primarily function as assistive technology. Until the definition of covered provider carried a user-count threshold that the chapter no longer contains. AB 853 (2025) moved the chapter's operative date from to . AB 853 also added duties for large online platforms and GenAI hosting platforms from and for capture device manufacturers from . AB 2713 was chaptered on as Chapter 856 of the Statutes of 2026. AB 2713 revised the duties and prohibitions applicable to a large online platform in Section 22757.3.1, which is operative on . Under AB 2713 a large online platform must detect whether any provenance data is embedded into, attached to, or otherwise associated with content distributed on the platform. It must provide a user interface that reliably indicates whether any system provenance data or digital signature associated with content identifies the content as generated or substantially altered by a GenAI system or captured by a capture device. It must allow a user to inspect any system provenance data associated with the content in an easily accessible manner. The section does not require a large online platform to take any action with respect to provenance data, system provenance data, or digital signatures that are not compliant or interoperable with widely adopted specifications issued by an established standards-setting body. The version of the section that AB 853 enacted required a large online platform to detect only provenance data compliant with widely adopted specifications adopted by an established standards-setting body. The chapter is Chapter 25 (commencing with Section 22757) of Division 8 of the Business and Professions Code. A Section 22756 to 22756.6 range sometimes cited for the chapter does not exist. Section 22757.1 defines a large online platform as a public-facing social media platform, file-sharing platform, mass messaging platform or stand-alone search engine that distributes content to users who did not create or collaborate in creating the content and that exceeded 2,000,000 unique monthly users during the preceding 12 months. Section 22757.3.3, added by AB 853, requires a capture device manufacturer, for any capture device it first produced for sale in California on or after , to provide a user the option to include a latent disclosure in captured content naming the manufacturer, the device name and version, and the time and date of creation or alteration, and to embed latent disclosures in captured content by default, only to the extent technically feasible and compliant with widely adopted specifications.
Section 9 c of chapter 4 of the Criminal Code makes it an offence for a person to unlawfully gain access to information intended for automated processing, or to unlawfully alter, delete, block, or enter such information into a register, or to unlawfully and seriously disturb or hinder the use of such information by another similar means. The ordinary offence carries a fine or imprisonment of up to two years; a gross offence carries imprisonment of one to eight years, with gravity assessed by whether the act caused serious damage, concerned a large volume of information, or was otherwise of a particularly dangerous nature. The provision's trigger is unlawful access, not the circumvention of a security measure, so it reaches a broader range of conduct than a statute conditioned on defeating an access control, and its reach to a scraper reading a public, unauthenticated page has not been tested by a reported Swedish decision. Section 9 c's current wording took effect on under Lag (2026:1318), the most recent of several amendments since the offence was first added to the Criminal Code.
Art. 18/12, Ticari Reklam ve Haksız Ticari Uygulamalar Yönetmeliği (RG No. 33297, 1 Temmuz 2026)
The same Ministry of Trade regulation amendment took effect, prohibiting an advertisement that falsely presents an AI-generated digital copy of a real person as having experienced, used, or recommended a good or service.
Art. 18/8, Ticari Reklam ve Haksız Ticari Uygulamalar Yönetmeliği (RG No. 33297, 1 Temmuz 2026)
A Ministry of Trade regulation amendment published in the Official Gazette on took effect, requiring advertisers to disclose a material use of artificial intelligence or an AI-generated digital character that could be mistaken for a real person.
Delete Act: processing deletion requests from the accessible deletion mechanism (DROP)
Also known as Delete Act
Cal. Civ. Code sections 1798.99.86 and 1798.99.82(d)
The California Privacy Protection Agency runs an accessible deletion mechanism through which a consumer, in a single verifiable request, can ask every data broker that holds their personal information to delete it. The Agency calls the mechanism the Delete Request and Opt-Out Platform (DROP). Beginning , a data broker must access the mechanism at least once every 45 days and, within 45 days of receiving a deletion request, delete all personal information related to the consumer and direct its service providers and contractors to delete it too. A data broker need not delete information it is reasonably necessary to keep for a purpose listed in section 1798.105(d), or whose deletion section 1798.145 or 1798.146 does not require, and may use what it keeps only for that purpose. A request the data broker cannot verify is processed as an opt-out of the sale or sharing of the consumer's personal information. After deleting a consumer's data, the data broker must delete that consumer's personal information again at least once every 45 days and may not sell or share new personal information about them, unless the consumer requests otherwise or an exemption applies. A data broker that fails to delete as required is liable in an administrative action by the Agency for a fine of $200 for each deletion request for each day, plus the Agency's expenses.
Data Broker DROP Regulations: processing and reporting deletion requests (article 3)
Also known as DROP
Cal. Code Regs. tit. 11, sections 7610 to 7616
Article 3 of the Data Broker Registration and Accessible Deletion Mechanism Regulations concerns the Delete Request and Opt-out Platform requirements, beginning with account creation in section 7610. Section 7612(a) of the Data Broker Registration and Accessible Deletion Mechanism Regulations requires a data broker to access the DROP to download its selected consumer deletion lists at least once every 45 calendar days. Under section 7613(a)(2) of the Regulations, a data broker must delete all personal information associated with the matched identifier for every match between a consumer deletion list and its own records. For deletion requests that match nothing in its records, a data broker must save and maintain the consumer deletion list for the sole purpose of complying with section 1798.99.86(d) of the Civil Code by comparing newly collected records with deletion lists. Section 7614(a) of the Regulations requires a data broker to report the status of every deletion request, using a response code, at each subsequent access session. Section 7616(a) of the Regulations lets a data broker use consumer personal information provided by the Agency only to comply with section 1798.99.86 of the Civil Code, and bars selling or sharing it. Section 7616(c) of the Regulations bars a data broker from contacting a consumer to verify a deletion request submitted through the DROP. Section 7611(a)(2) of the Regulations requires a business that begins operating as a data broker after the registration period to begin accessing the DROP within 45 calendar days of commencing operation. The Agency's page on the accessible deletion mechanism carries an effective date of .
A new impact-assessment requirement, added to section 42-522 by Public Act 25-113 (S.B. 1295), applies to processing activities created or generated on or after this date and is not retroactive.
Act 892 (SB 42), AI-generated child sexual abuse materials
La. R.S. 14:81.1(B)(3), (9), as amended by 2026 La. Acts, Act No. 892 (SB 42)
Senate Bill 42 of the 2026 Regular Session, signed as Act No. 892, amends the definitions in Revised Statutes 14:81.1, the child sexual abuse materials offense, to prohibit the use of artificial intelligence to create child sexual abuse materials. The offense makes it unlawful for a person to produce, promote, advertise, distribute, possess, or possess with the intent to distribute child sexual abuse materials. Child sexual abuse materials include any photograph, film, video, picture, digital image or picture, computer image or picture, or computer-generated image or picture, whether made or produced by electronic, mechanical, or other means, of any sexual performance involving a child under the age of seventeen. For that definition, a child includes both a natural person under the age of seventeen years and an image or other visual representation of a child under the age of seventeen years that is created or generated by electronic or digital means, including artificial intelligence, and that, to a reasonable person, is a virtually indistinguishable depiction of a child under the age of seventeen years. To produce child sexual abuse materials means to photograph, videotape, film, cause to be digitally generated, including by artificial intelligence, or otherwise reproduce them, or to solicit, promote, or coerce any child for the purpose of child sexual abuse materials. Whoever intentionally possesses child sexual abuse materials shall be fined not more than fifty thousand dollars and imprisoned at hard labor for not less than five years or more than twenty years, without benefit of parole, probation, or suspension of sentence. Whoever distributes or possesses with the intent to distribute child sexual abuse materials shall be fined not more than fifty thousand dollars and imprisoned at hard labor for not less than five years or more than twenty years, without benefit of parole, probation, or suspension of sentence. Whoever engages in the promotion, advertisement, or production of child sexual abuse materials shall be fined not more than fifty thousand dollars and imprisoned at hard labor for not less than ten years nor more than twenty years, without benefit of probation, parole, or suspension of sentence. The Governor signed Senate Bill 42 on , and it became Act No. 892. The act's effective date is .
Act 496 (SB 346), deepfake material used against K-12 students
La. R.S. 17:416.14.1
No student, faculty member, member of the administrative staff, or other employee at an elementary or secondary school may use deepfake material against a student enrolled in kindergarten through grade twelve with the intent to coerce, harass, intimidate, or maliciously disseminate or sell the material. Deepfake means audio or visual media in an electronic format that is created, altered, or digitally manipulated so that it would falsely appear to a reasonable observer to be an authentic record of an individual's actual speech or conduct, or that replaces an individual's likeness with another individual's. The State Board of Elementary and Secondary Education, in collaboration with the state Department of Education, adopts the implementing rules. Senate Bill 346 was signed as Act 496 on . The act sets an effective date of .
Minn. Stat. § 609.527, subd. 1(e), (f) and subd. 2
A person who transfers, possesses, or uses an identity that is not the person's own, with the intent to commit, aid, or abet any unlawful activity, is guilty of identity theft. The definition of identity in the identity theft statute includes a forged digital likeness. A forged digital likeness is a video recording, motion-picture film, sound recording, electronic image, or photograph, or a technological representation of speech or conduct substantially derivative of one, that was created, adapted, altered, or modified in a manner substantially dependent upon technical means, misrepresents the appearance, speech, or conduct of the individual, and is so realistic that a reasonable person would believe it depicts the image or speech of an actual individual. The sentence is graded by the number of direct victims and the total combined loss to the direct and indirect victims, by reference to the theft sentencing tiers of section 609.52, subdivision 3. The court must order a person convicted of identity theft to pay restitution of not less than $1,000 to each direct victim of the offense. The 2026 omnibus public safety law that added forged digital likeness to the identity theft statute is effective , unless otherwise noted.
Section 16-21-43(d) of the Rhode Island General Laws bars a school official, employee or agent of the school from searching the contents of a personal electronic device that the school retains during school hours and that is not in the student's possession in a locked pouch or container. Section 16-21-43(b) of the Rhode Island General Laws defines a personal electronic device as a smartphone, mobile phone, tablet, computer, smartwatch, or other electronic device not owned or provided to a student by a public school that is capable of communication through the internet or a wireless network. Section 16-21-43(a)(1) of the Rhode Island General Laws requires each public school to have a policy regarding the use of personal electronic devices on school grounds and during school-sponsored activities, to notify the parents or guardians of all students attending the school of the policy, and to include in it a prohibition on physical access to a personal electronic device by students during the school day. Section 16-21-43(f) of the Rhode Island General Laws requires each school district and charter school to file its school personal electronic device use policy with the department of elementary and secondary education. Section 16-21-43 of the Rhode Island General Laws takes effect on under Public Law 2025, chapters 109 and 110. Public Law 2025, chapter 109 (H 5598 Substitute A), which added section 16-21-43, was enacted on . Section 16-21-43(a)(2) and (3) of the Rhode Island General Laws require the district to make exceptions for student personal device use that provide access to assistive technology necessary to comply with individualized student 504 plans or individualized education plans, for medical needs such as glucose monitoring, and for a plan to support emergent multilingual learners, to write the allowable exceptions into the student's plan, not to segregate students provided an exception, and to make exceptions in the event of an emergency.
Regulation (EU) 2026/1881 lays down temporary and strictly limited rules derogating from certain obligations laid down in Directive 2002/58/EC, with the sole objective of enabling providers of certain number-independent interpersonal communications services to use specific technologies to detect online child sexual abuse on their services and report it and to remove online child sexual abuse material from their services. Article 2, point (1), defines a number-independent interpersonal communications service by reference to Article 2, point (7), of Directive (EU) 2018/1972. Article 3(1) provides that Article 5(1) and Article 6(1) of Directive 2002/58/EC do not apply to the confidentiality of communications involving the processing by providers of personal and other data in connection with the provision of number-independent interpersonal communications services, provided that the conditions it lists are met. Among those conditions, the processing must be strictly necessary for the use of specific technology for the sole purpose of detecting and removing online child sexual abuse material and reporting it to law enforcement authorities and to organizations acting in the public interest against child sexual abuse, and of detecting solicitation of children and reporting it, and must not be applied to interpersonal communications to which end-to-end encryption is, has been or will be applied. Article 1(2) provides that the Regulation does not apply to the scanning of audio communications. Article 1(3) provides that the Regulation does not apply to interpersonal communications to which end-to-end encryption is, has been or will be applied. Article 3(1), point (c), requires a prior data protection impact assessment and a prior consultation procedure for any specific technology used for those purposes. Until , the condition in Article 3(1), point (c), does not apply to a provider that was using a specific technology before without having completed a prior consultation procedure, starts a prior consultation procedure before and duly cooperates with the competent supervisory authority. Article 3(1), point (g)(v), requires providers to inform users in a clear, prominent and comprehensible way that they have invoked the derogation, of the logic behind the measures they have taken and of the impact on the confidentiality of users' communications. Article 3(1), point (g)(vii), requires providers to publish and submit to the competent supervisory authority and to the Commission, by and by 31 January every year thereafter, a report on the processing of personal data under the Regulation. Article 3(1), point (i), requires the data to be stored no longer than strictly necessary for the relevant purposes and, in any event, no longer than 12 months from the date of the identification of the suspected online child sexual abuse. Article 7(1) requires providers to communicate to the Commission, by , a list of the names of organizations acting in the public interest against child sexual abuse to which they report online child sexual abuse under the Regulation. Article 5 gives users the right to an effective judicial remedy where they consider that their rights have been infringed as a result of the processing of personal and other data for those purposes. Article 6 provides that the supervisory authorities designated pursuant to Chapter VI, Section 1, of Regulation (EU) 2016/679 monitor processing falling within the scope of the Regulation. Article 11 provides that the Regulation enters into force on the third day following that of its publication in the Official Journal of the European Union and applies until . Recital 12 records that Regulation (EU) 2021/1232 has expired because the co-legislators were not able to reach an agreement by on the Commission's proposal to extend it.
Regulation of Artificial Intelligence Act 2026 (No. 31 of 2026)
The Regulation of Artificial Intelligence Act 2026 (Commencement) Order 2026 appointed as the day the Act came into operation, other than two definitional paragraphs in section 78.
Reserve Bank of India (Commercial Banks - Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026
Cyber Incident Reporting
Reserve Bank of India (Commercial Banks - Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026, paras. 181 to 183
Paragraph 182 requires a commercial bank to report cyber incidents within six hours of detection on the DAKSH platform, the Reserve Bank's Advanced Supervisory Monitoring System, and to notify CERT-In proactively about cyber incidents. Paragraph 183 requires a commercial bank to have clear communication plans for escalation and reporting of incidents to the Board and Senior Management and to customers, as required. Paragraph 181 requires a commercial bank to analyse cyber incidents for their severity, impact and root cause, and to take corrective and preventive measures. Paragraph 3 applies the Directions to commercial banks. The Reserve Bank of India issues the Directions in exercise of the powers conferred by Section 27 and Section 35-A of the Banking Regulation Act, 1949. Paragraph 233 makes the interpretation of any provision of the Directions by the Reserve Bank final and binding on all concerned entities. Paragraph 2 brings the Directions into effect immediately upon issuance.
Cybersecurity Policy, Testing and Security Operations Centre
Reserve Bank of India (Commercial Banks - Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026, paras. 15, 149 to 153 and 212 to 216
Paragraph 15 requires a commercial bank to put in place a Cybersecurity Policy, approved by its Board and distinct from its broader IT and information security policy. Paragraph 151 requires vulnerability assessment of critical information systems and systems in the demilitarised zone with a customer interface at least once in every six months, and penetration testing at least once in 12 months. Paragraph 153 requires a commercial bank to fix identified vulnerabilities and associated risks in a time-bound manner. Paragraph 212 requires a commercial bank to put in place a framework for establishment and operation of a Cyber Security Operations Centre. Paragraph 215 requires the systems for monitoring security operations to enable collection of logs, their correlation through SIEM tools and the generation of alerts. Paragraph 3 applies the Directions to commercial banks. The Reserve Bank of India issues the Directions in exercise of the powers conferred by Section 27 and Section 35-A of the Banking Regulation Act, 1949. Paragraph 233 makes the interpretation of any provision of the Directions by the Reserve Bank final and binding on all concerned entities. Paragraph 230 repeals the existing directions on Cybersecurity Framework and IT Governance as applicable to commercial banks. Paragraph 2 brings the Directions into effect immediately upon issuance.
Illinois Public Act 104-0664 (2026), enrolled as HB 5511, 104th General Assembly
HB 5511 was sent to the Governor on and signed on as Public Act 104-0664, enrolled under the short title 'Children's Online Social Media Safety Act.' The Act takes effect .
Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-Marktüberwachungs-und-Innovationsförderungs-Gesetz, KI-MIG), §§ 2, 6, 8, 13, 15, 16, 20
The Federal Ministry for Digital Affairs and State Modernization announced that KI-MIG had entered into force that day, making the Bundesnetzagentur Germany's market surveillance authority, point of contact, and complaints office for the EU AI Act.
Use of artificial intelligence in therapy or psychotherapy services
10 M.R.S. § 1500-EE
A person may not provide, advertise, or otherwise offer therapy or psychotherapy services to the public, including through Internet-based artificial intelligence, unless those services are provided by a professional licensed in Maine to practice psychotherapy or behavioral health therapy; a violation is a violation of the Maine Unfair Trade Practices Act. The same act enacts parallel provisions across seven licensing-board chapters of Title 32 (including 32 M.R.S. §§ 2113, 2600-G, 3300-J, 3820-A, 6207-D, 7009, and 13870) that let a Maine-licensed therapy professional use AI for administrative support such as scheduling or billing and, with the client's written disclosure and consent, for supplementary support such as session notes, but forbid letting AI make an independent therapeutic decision, interact directly with a client in therapeutic communication, or generate a treatment recommendation without the licensee's review and approval; a violation of a board-chapter provision is enforced through board discipline under 10 M.R.S. § 8003(5) rather than through the Unfair Trade Practices Act. Each provision excepts an AI-based intervention used solely within an institutional-review-board-approved research project. Enacted as LD 2082 (P.L. 2025, ch. 687) and signed by the Governor on . The Act took effect on , the date the Maine Legislature gives for non-emergency legislation enacted in the Second Regular Session of the 132nd Legislature.
Limits on public schools' consent to immigration enforcement access to education records
20-A M.R.S. sec. 14
A person acting on behalf of a public school or a state postsecondary educational institution may not give voluntary consent for a law enforcement officer to access education records for immigration enforcement purposes. That limit does not prevent disclosing education records in response to a law enforcement officer's request to the extent a court order or state or federal law requires the disclosure. An education record has the meaning the federal Family Educational Rights and Privacy Act gives it, and a law enforcement officer includes a federal officer. A state postsecondary educational institution is a university within the University of Maine System, a college within the Maine Community College System or the Maine Maritime Academy. The same person may not give voluntary consent for a law enforcement officer to enter a nonpublic area of the school or institution for immigration enforcement purposes. Where federal law requires a public school or institution to let a law enforcement officer inspect specific records or conduct interviews on noncitizens' eligibility to work or attend school in the United States, the school or institution must designate a nonpublic area for those inspections and interviews. Each public school and state postsecondary educational institution must adopt the Attorney General's model policies and guidance or establish equivalent policies and guidance. Until a school or institution adopts, or is required to adopt, those policies, a person acting on its behalf who gives such consent in good faith does not violate the section. A private preschool, school or postsecondary educational institution that is not subject to the policy requirement may adopt the model policies and guidance but is not required to. Public Law 2025, chapter 770 enacted the section at the Second Regular Session of the 132nd Legislature, and the Laws of Maine give as the general effective date of that session's nonemergency laws.
Synthetic media disclosure in campaign advertising
21-A M.R.S. § 1014, sub-§ 5-C
Whenever a political public communication that already requires a disclosure under Maine campaign-finance law contains synthetic media of a candidate, the communication must also carry the words THIS COMMUNICATION CONTAINS AUDIO, VIDEO AND/OR IMAGES THAT HAVE BEEN MANIPULATED OR ALTERED. Synthetic media is defined as an image, audio recording, or video recording of a candidate that, in a manner likely to deceive a reasonable person, depicts the candidate saying or doing something the candidate did not say or do, or that has been manipulated to give a materially different impression of the candidate's appearance, action, or speech than the unaltered original; satire, parody, and technical clarity edits that do not change the impression given are excluded. A violation of this subsection carries a civil penalty of up to 500% of the expenditure on the offending communication, compared with 100% for other disclosure violations under the same section, and a broadcaster or newspaper is liable only if it publishes or broadcasts with actual knowledge that the communication contains synthetic media. Enacted as LD 517 (P.L. 2025, ch. 593) and signed by the Governor on . The Act took effect on , the general effective date the Laws of Maine gives for nonemergency laws of the Second Regular Session of the 132nd Legislature.
Ley 599 de 2000, art. 296 (as amended by Ley 2502 de 2025)
Article 296 of the Codigo Penal punishes with a fine whoever, to obtain a benefit for themselves or another or to cause harm, substitutes or impersonates a person or attributes to themselves a name, age, marital status, or capacity with legal effects, provided the conduct does not constitute another offense; the article carries no term of imprisonment. Ley 2502 de 2025 added a second paragraph providing that when the personal falsehood is committed using artificial intelligence, the fine is increased by up to one third, and article 2 defines a deepfake as the creation, modification, or use of a false audiovisual record, including photographs, videos, images or sound recordings, made through artificial intelligence so that it appears to be a real person's authentic speech or conduct. Article 6 of Ley 2502 de 2025 delayed this amendment's commencement to one year after the law's sanction and promulgation on , so the deepfake aggravation itself entered into force on , while the law's other provisions, including its definitions and its public-policy directives to the National Government, the Fiscalia and the Policia Nacional, took effect immediately on sanction.
Article 10 sits in Chapter III, Section 2, which was due to apply from , the Regulation's general date, until Regulation (EU) 2026/1744 replaced point (c) of Article 113's third paragraph. It now applies from to a high-risk AI system classified under Article 6(2) and Annex III, and from to one classified under Article 6(1) and Annex I, other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.
Article 12 sits in Chapter III, Section 2, which was due to apply from , the Regulation's general date, until Regulation (EU) 2026/1744 replaced point (c) of Article 113's third paragraph. It now applies from to a high-risk AI system classified under Article 6(2) and Annex III, and from to one classified under Article 6(1) and Annex I, other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.
Article 14 sits in Chapter III, Section 2, which was due to apply from , the Regulation's general date, until Regulation (EU) 2026/1744 replaced point (c) of Article 113's third paragraph. It now applies from to a high-risk AI system classified under Article 6(2) and Annex III, and from to one classified under Article 6(1) and Annex I, other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation. Regulation (EU) 2026/1744 also rewrote Article 111(2), so the Regulation reaches a high-risk AI system placed on the market or put into service before the date Chapter III applies to it only if its design changes significantly from then; the providers and deployers of a system intended to be used by public authorities must take the necessary steps to comply by .
Article 15 (accuracy, robustness and cybersecurity)
Regulation (EU) 2024/1689, Article 15
Article 15 sits in Chapter III, Section 2, which was due to apply from , the Regulation's general date, until Regulation (EU) 2026/1744 replaced point (c) of Article 113's third paragraph. It now applies from to a high-risk AI system classified under Article 6(2) and Annex III, and from to one classified under Article 6(1) and Annex I, other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.
Article 19 sits in Chapter III, Section 3, which was due to apply from , the Regulation's general date, until Regulation (EU) 2026/1744 replaced point (c) of Article 113's third paragraph. It now applies from to a high-risk AI system classified under Article 6(2) and Annex III, and from to one classified under Article 6(1) and Annex I, other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation. Regulation (EU) 2026/1744 also rewrote Article 111(2), so the Regulation reaches a high-risk AI system placed on the market or put into service before the date Chapter III applies to it only if its design changes significantly from then; the providers and deployers of a system intended to be used by public authorities must take the necessary steps to comply by .
Article 21(2) (competent authority access to automatically generated logs)
Regulation (EU) 2024/1689, Article 21(2)
Article 21(2) sits in Chapter III, Section 3, which was due to apply from , the Regulation's general date, until Regulation (EU) 2026/1744 replaced point (c) of Article 113's third paragraph. It now applies from to a high-risk AI system classified under Article 6(2) and Annex III, and from to one classified under Article 6(1) and Annex I, other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.
Article 26(6) sits in Chapter III, Section 3, which was due to apply from , the Regulation's general date, until Regulation (EU) 2026/1744 replaced point (c) of Article 113's third paragraph. It now applies from to a high-risk AI system classified under Article 6(2) and Annex III, and from to one classified under Article 6(1) and Annex I, other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation. Regulation (EU) 2026/1744 also rewrote Article 111(2), so the Regulation reaches a high-risk AI system placed on the market or put into service before the date Chapter III applies to it only if its design changes significantly from then; the providers and deployers of a system intended to be used by public authorities must take the necessary steps to comply by .
Article 50 (transparency obligations for AI systems and synthetic content)
Regulation (EU) 2024/1689, Article 50
Regulation (EU) 2026/1744 inserted Article 111(4): a provider of a system generating synthetic audio, image, video or text that was placed on the market before has until to comply with the Article 50(2) marking duty. The rest of Article 50, and the marking duty for a system placed on the market from , apply from as before.
Article 73 keeps the Regulation's general application date, , but it binds providers of high-risk AI systems, and Regulation (EU) 2026/1744 moved Chapter III, Sections 1 to 3, which hold the Article 6 classification rules, to for a system classified under Article 6(2) and Annex III and to for one classified under Article 6(1) and Annex I. It also rewrote Article 111(2), so the Regulation reaches a high-risk system placed on the market or put into service before that date only if its design changes significantly from then.
Article 86 (right to explanation of individual decision-making)
Regulation (EU) 2024/1689, Article 86
Article 86 keeps the Regulation's general application date, , but it reaches only a decision based on a high-risk AI system listed in Annex III, and Regulation (EU) 2026/1744 moved Chapter III, Sections 1 to 3, which hold the Article 6(2) rule that classifies an Annex III system as high-risk, to . It also rewrote Article 111(2), so the Regulation reaches a high-risk system placed on the market or put into service before that date only if its design changes significantly from then.
Article 9 sits in Chapter III, Section 2, which was due to apply from , the Regulation's general date, until Regulation (EU) 2026/1744 replaced point (c) of Article 113's third paragraph. It now applies from to a high-risk AI system classified under Article 6(2) and Annex III, and from to one classified under Article 6(1) and Annex I, other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation. Regulation (EU) 2026/1744 also rewrote Article 111(2), so the Regulation reaches a high-risk AI system placed on the market or put into service before the date Chapter III applies to it only if its design changes significantly from then; the providers and deployers of a system intended to be used by public authorities must take the necessary steps to comply by .
Article 113, third paragraph, point (a), as amended, applies Chapters I and II from and names no exception for Article 4a, which the same Regulation inserts into Chapter I, so the permission applies from the Omnibus's own entry into force on . Recitals 9 and 40 point to instead; a recital does not set an application date.
President Putin signed Federal Law No. 243-FZ 'On Supporting the Development of Artificial Intelligence Technologies in the Russian Federation' on , after passage by the State Duma on and approval by the Federation Council on .
Article 8, Duties of Sovereign and National Foundation Model Developers
čl. 3-5, Uredba o provedbi Akta o kibernetičkoj solidarnosti (NN 78/2026)
The Government decree names the competent authorities for the Cyber Solidarity Act (Regulation (EU) 2025/38) as the Security and Intelligence Agency, through its National Cybersecurity Centre, and the Croatian Academic and Research Network (CARNet), through the National CERT (Article 3). The National Cybersecurity Centre acts as the national cyber hub and as the body responsible for coordinated preparedness testing of entities, and the National CERT acts as the CSIRT responsible for that testing (Articles 4 and 5). The decree takes effect on the eighth day after its publication in Narodne novine of (Article 7).
By Computer & Communications Industry Association v. Paxton, United States Court of Appeals for the Fifth Circuit
Only § 509.053, § 509.056(1). The rest of the law still binds.
On the Attorney General's appeal from the order of , the Fifth Circuit affirmed the district court's order as to the Computer & Communications Industry Association and NetChoice. It held that the monitoring and filtering requirement is preempted by Section 230 of the Communications Decency Act, and did not reach the constitutional issues. One judge concurred in the judgment in part and dissented in part, and would have vacated the injunction in its entirety.
Virtual Asset Service Providers Regulations, 2026 (Legal Notice No. 134 of 2026)
Cybersecurity Systems, Controls and Continuity Plans
Virtual Asset Service Providers Regulations, 2026 (Legal Notice No. 134 of 2026), regs. 18, 21, 96, 97 and 100
Regulation 96(1) requires a licensee, pursuant to section 28(1) of the Act, to have in place cybersecurity measures for the establishment and maintenance of appropriate systems and controls for managing cybersecurity and operational risks. Regulation 96(3) requires a licensee to ensure that there is a chief information security officer or the equivalent with oversight over its cybersecurity systems. Regulation 96(4) requires a licensee to review its cybersecurity strategy and policy regularly, and at least annually. Regulation 97(4) requires a licensee's systems and controls to include vulnerability assessment, risk assessment and penetration testing on a bi-annual basis during the first year of licensing and at least once a year for subsequent years. Regulation 97(5) requires a licensee, subject to the approval of the relevant regulatory authority, to appoint a qualified independent party to audit its systems and control as and when the authority requires. Regulation 21 requires a licensee to develop and maintain formalised business continuity and incident response plans approved by its board of directors. Regulation 21(3) requires a licensee to annually review and test its business continuity and incident response plans. Regulation 100 requires a cybersecurity audit report to be prepared by a fit and proper person responsible for cyber security audit. The Regulations were published in the Kenya Gazette and commenced on .
Virtual Asset Service Providers Regulations, 2026 (Legal Notice No. 134 of 2026), regs. 26 and 99
Regulation 99(1) requires a licensee that discovers a cybersecurity incident as a result of a cybersecurity event to notify the relevant regulatory authority within twenty-four hours of such discovery. Regulation 99(2) requires the licensee to provide a detailed report within five working days on whether the cybersecurity incident affects services or systems supporting critical or important functions, affects services it is authorised to provide, or constitutes malicious and unauthorized access to its network and information systems. Regulation 99(4) requires a licensee to report any material cybersecurity incident, loss of keys, or unauthorised transaction within twenty-four hours. Regulation 26(2) requires a licensee to submit to the relevant regulatory authority, monthly and by the tenth day of the following calendar month, a report that includes material service interruptions and major security breaches. The Regulations define a cybersecurity incident as an occurrence that jeopardizes without lawful authority the integrity, confidentiality, or availability of information or an information system, or that constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use of policies. The Regulations were published in the Kenya Gazette and commenced on .
President Taye Atske Selassie signed the Critical Infrastructure Cybersecurity Proclamation at Addis Ababa, and it was published the same day in the Federal Negarit Gazette, Year 32, No. 41. Under the Proclamation's own Article 28, it enters into force one year after that publication date.
Regulation of Artificial Intelligence Act 2026 (No. 31 of 2026)
The Regulation of Artificial Intelligence Bill 2026 (Bill No. 69 of 2026) completed all stages in Dail Eireann and Seanad Eireann and was signed into law by the President on as Act No. 31 of 2026.
12 CFR §§ 1002.4(b), 1002.6(a) and 1002.8(b)(3) and (4), as amended by 91 FR 21620 ()
The Consumer Financial Protection Bureau's final rule published on amended Regulation B on disparate impact, discouragement of applicants or prospective applicants, and special purpose credit programs. The rule is effective . Section 1002.6(a) now provides that a creditor may consider any information obtained, so long as the information is not used to discriminate against an applicant on a prohibited basis, and that the Act does not provide that the effects test applies for determining whether there is discrimination in violation of the Act. The official interpretation of section 1002.6(a) says that the Act does not provide for the prohibition of practices that are facially neutral as to prohibited bases, except to the extent that facially neutral criteria function as proxies for protected characteristics designed or applied with the intention of advantaging or disadvantaging individuals based on protected characteristics. Section 1002.4(b) bars a creditor from making any oral or written statement, in advertising or otherwise, directed at applicants or prospective applicants that the creditor knows or should know would cause a reasonable person to believe that the creditor would deny, or would grant on less favorable terms, a credit application because of a prohibited basis characteristic, and counts spoken or written words and visual images such as symbols, photographs, or videos as statements. The official interpretation of section 1002.4(b) says that encouraging statements directed at one group of consumers cannot discourage other consumers who were not the intended recipients of the statements. Section 1002.8(b)(3) provides that a special purpose credit program described in paragraph (a)(3) shall not use the race, color, national origin, or sex, or any combination thereof, of the applicant as a common characteristic or factor in determining eligibility for the program. Section 1002.8(b)(4) allows such a program to require participants to share a characteristic that would otherwise be a prohibited basis only if the for-profit organization provides evidence for each participant who receives credit through the program that in the absence of the program the participant would not receive such credit as a result of those specific characteristics.
Law 5321/2026, arts. 3-5, 16, 23 (FEK A' 114/20.07.2026)
Article 58 of Law 5321/2026 provides that the law takes effect from its publication in the Government Gazette unless a specific provision states otherwise, and Part A's AI Act implementation measures carry no other date; the law was published as FEK A' 114/20.07.2026.
P.L. 2026, c. 43 (A3497), supplementing the New Jersey Antitrust Act, N.J. Stat. § 56:9-1 et seq.
The Assembly Committee Substitute for A3497, establishing the Forbidding the Algorithmic Inflation of Rent Act, was signed into law as P.L. 2026, c. 43; the Act's consumer-facing prohibition does not take effect until .
Protecting Victims Act, S.C. 2026, c. 19, s. 15, amending Criminal Code, R.S.C. 1985, c. C-46, s. 162.1 (formerly Bill C-16)
The Protecting Victims Act received royal assent on . Section 15 of the Act redefines intimate image in section 162.1 of the Criminal Code to include a visual representation made by any electronic or mechanical means, including by means of artificial intelligence software. The depiction must show an identifiable person as nude, nearly nude, exposing their sexual organs or engaged in explicit sexual activity, and be likely to be mistaken for a visual recording of that person. Section 15 also creates an offence of knowingly threatening, with the intent to intimidate or to be taken seriously, to publish, distribute, transmit, sell, make available or advertise an intimate image of a person who would not consent, or where the accused is reckless as to consent. The threat offence is punishable by up to 10 years' imprisonment on indictment, or on summary conviction. The Act's provisions, other than those it lists, came into force on the 30th day after royal assent.
Agricultural Data Privacy Act: sale-prohibition term in new contracts from January 1, 2027, and reasonable data security practices
Agricultural Data Privacy Act, Neb. Rev. Stat. §§ 87-1406 and 87-1407 (LB525, sections 6 and 7)
Beginning on , every new contract or agreement involving the collection or processing of agricultural data in this state must contain a specific provision stating that the controller or processor is prohibited from engaging in the sale of the agricultural data without the express written consent of the agricultural producer. A contract provision that waives or limits the requirements of the Agricultural Data Privacy Act is contrary to public policy and is void and unenforceable. A controller or processor in custody or possession of agricultural data must establish, implement and maintain reasonable administrative, technical and physical data security practices to protect the confidentiality, integrity and accessibility of the data. The security practices must be appropriate for the volume and nature of the agricultural data and protect against unauthorized access, use, disclosure, modification or loss. The Agricultural Data Privacy Act does not impair, supersede or otherwise affect the terms of any private contract that is in existence prior to the operative date of the section. The Agricultural Data Privacy Act has an operative date of .
Agricultural Data Privacy Act: Attorney General enforcement, $1,000 civil penalty per violation, and forty-five day cure for contract and security violations
Agricultural Data Privacy Act, Neb. Rev. Stat. §§ 87-1408 and 87-1409 (LB525, sections 8 and 9)
The Attorney General may bring an action in the district court of Lancaster County against any controller or processor that violates the Agricultural Data Privacy Act to seek injunctive relief or to recover a civil penalty of $1,000 for each separate violation. A civil penalty that is recovered is remitted to the State Treasurer for distribution in accordance with Article VII, section 5, of the Constitution of Nebraska. The Agricultural Data Privacy Act creates no new private cause of action, and the Attorney General's enforcement authority is the exclusive remedy for violations of it. Before bringing an action to recover a civil penalty for a violation of section 6 or 7 of the act, the Attorney General must give the controller or processor written notice that identifies the specific provision allegedly violated. No such action for a civil penalty may be initiated if, within forty-five days after receiving the written notice, the controller or processor cures each alleged violation and gives the Attorney General a written statement that each has been cured and that it will refrain from further violations. The notice and cure provision does not apply to any violation of section 5 of the act. The Agricultural Data Privacy Act has an operative date of .
Agricultural Data Privacy Act: producer ownership of agricultural data and no sale without express written consent
Agricultural Data Privacy Act, Neb. Rev. Stat. §§ 87-1404 and 87-1405 (LB525, sections 4 and 5)
Agricultural data is any agronomic, climate and weather, land, livestock, management or sustainability data that is collected, produced or generated in Nebraska and linked or reasonably linked to an identified or reasonably identifiable agricultural producer. Agricultural data does not include aggregated data, derived data, or data that an agency makes available to the general public. An agricultural producer is the owner, and has control, of the agricultural data that originates from the producer's farm, land, device or equipment. A controller or processor that collects, stores or uses agricultural data is deemed to have a nonexclusive right of control over it solely for the purpose of providing services, maintaining equipment, or performing data processing the producer authorizes. The nonexclusive right of control that a controller or processor holds does not include the power to engage in the sale of the agricultural data. A controller or processor may not engage in the sale of agricultural data without the express written consent of the agricultural producer. Written consent for the sale of agricultural data must be obtained through a clear and conspicuous disclosure that is separate from the primary terms of service or data use agreement. A sale of agricultural data is the exchange of agricultural data for monetary or other valuable consideration by a controller or processor to a third party. A sale does not include a disclosure or transfer to a processor, a processor's authorized use, a disclosure, transfer or use to provide a service to the producer, a transfer to an affiliate, a disclosure the producer directs or authorizes in writing, a disclosure that law requires, a disclosure required for safety, emissions or environmental compliance, a disclosure the producer intentionally made public through mass media, a transfer as an asset in a merger, acquisition, bankruptcy or other transaction, or a use reasonably necessary to detect, prevent or respond to fraud, abuse, cybersecurity threats, illegal conduct, data integrity issues or equipment misuse. The Agricultural Data Privacy Act has an operative date of .
LB 838 (2026), amendments to the Age-Appropriate Online Design Code Act
Neb. Rev. Stat. §§ 87-1301 to 87-1311, as amended
The Nebraska Legislature's statute page for section 87-1302 lists Laws 2026, LB838, section 32 as a source of the section and gives its operative date as . One element of the amended definition of a covered online service is that the entity generates a majority of its annual revenue from online services.
Public Offices Election Act, AI-Generated Content Labelling Duty (2026 Amendment)
Act No. 100 of 1950, as amended by Act No. 58 of 2026, Art. 142-5
The Ministry of Internal Affairs and Communications confirms the Act Partially Amending the Public Offices Election Act and the Act on Countermeasures for Rights Infringement Arising from Distribution of Information via Specified Electronic Communications was enacted and promulgated on as Act No. 58 of Reiwa 8, inserting the new Article 142-5 labelling duty and taking effect on .
Act on the Protection of Personal Information, administrative surcharge order
Act No. 57 of 2003, as amended by Act No. 56 of 2026, Arts. 148-3 to 148-17
The Personal Information Protection Commission confirms the Bill to Partially Amend the Act on the Protection of Personal Information, etc. was approved by the Cabinet on , passed by both houses of the Diet on , and promulgated on as Act No. 56 of Reiwa 8.
Act on the Protection of Personal Information, Specific Biometric Personal Information
Act No. 57 of 2003, as amended by Act No. 56 of 2026, Arts. 16(5), 21-2, 27(2), 35(7)-(8)
The Personal Information Protection Commission confirms the Bill to Partially Amend the Act on the Protection of Personal Information, etc. was approved by the Cabinet on , passed by both houses of the Diet on , and promulgated on as Act No. 56 of Reiwa 8.
Act on the Protection of Personal Information, statistics-creation consent exemption
Act No. 57 of 2003, as amended by Act No. 56 of 2026, Arts. 30-2, 31-3
The Personal Information Protection Commission confirms the Bill to Partially Amend the Act on the Protection of Personal Information, etc. was approved by the Cabinet on , passed by both houses of the Diet on , and promulgated on as Act No. 56 of Reiwa 8.
Interim Measures for the Administration of Anthropomorphic Interactive Services of Artificial Intelligence (人工智能拟人化互动服务管理暂行办法), 2026
Article 14 (minors)
Interim Measures for the Administration of Anthropomorphic Interactive Services of Artificial Intelligence (人工智能拟人化互动服务管理暂行办法), 2026, Art. 14
Article 14 bars a provider of anthropomorphic interactive services from offering minors services of virtual intimate relationships such as virtual relatives or virtual partners. Article 14 requires a provider to obtain the consent of a minor's parents or other guardians before offering its other anthropomorphic interactive services to a minor under fourteen. Article 14 requires a provider to establish a minors mode with personalized safety settings such as mode switching, periodic reality reminders and usage-time limits, and to let guardians receive safety-risk reminders, see an overview of the minor's use, block specific characters and limit spending. Article 14 requires a provider, while protecting user privacy and personal information, to take effective measures to identify minor users, to switch an identified minor's service to the minors mode or take other measures under national rules, and to provide a channel for appeal.
Interim Measures for the Administration of Anthropomorphic Interactive Services of Artificial Intelligence (人工智能拟人化互动服务管理暂行办法), 2026, Art. 18
Providers of anthropomorphic AI interactive services, products that simulate a human personality and engage in emotionally-styled conversation, must take effective measures to remind users that they are interacting with an AI service rather than a natural person, at first use and at re-login, and must dynamically re-notify users through a prominent method such as a pop-up when the system detects signs of over-reliance or addiction, or when continuous use exceeds two hours. This is narrower than a general bot-disclosure duty: it reaches only anthropomorphic, companion-style AI interaction services, not every chatbot or AI-assisted tool. Issued jointly by the Cyberspace Administration of China, the National Development and Reform Commission, the Ministry of Industry and Information Technology, the Ministry of Public Security, and the State Administration for Market Regulation on , finalized from a public-comment draft.
Lag (2026:1235) om avlägsnande av rekryteringsinnehåll online
The Act sets out the conditions for removing content that aims to recruit people to commit crime. Section 2 defines recruitment content as content that can reasonably be assumed to form part of punishable preparation or conspiracy to commit a crime carrying imprisonment of two years or more, or of involving a minor in crime under Chapter 16, section 5 a of the Criminal Code. Section 3 applies the Act only to recruitment content directed at Swedish citizens or persons resident in Sweden, made available by someone who is in Sweden, or concerning crimes to be committed in Sweden or against a Swedish citizen or resident. Section 4 excludes content covered by Regulation (EU) 2021/784 on terrorist content online. Section 5 lets the competent authority order a hosting service provider covered by the Digital Services Act to remove recruitment content or make it inaccessible online. An order under section 5 takes effect immediately. Section 7 requires a hosting service provider that receives an order to remove the content or make it inaccessible online as soon as possible and within one hour of receiving the order. Section 8 requires a hosting service provider to preserve the content and its related data for six months from the time they were removed or made inaccessible because of an order. If the order has been appealed, the material is always to be preserved until the case has been decided by a final decision. Section 9 lets the competent authority charge a sanction fee to a hosting service provider that breaches its obligations under sections 7 and 8. Section 10 sets the sanction fee at a minimum of SEK 5,000 and a maximum of SEK 5,000,000 or, for systematic or continuing failure to meet the obligation in section 7, up to an amount corresponding to 4 percent of the provider's global turnover in the preceding financial year. Section 11 allows the fee to be reduced in whole or in part if the infringement is minor or excusable, or if charging it would be unreasonable in the circumstances. Section 15 allows an appeal of the competent authority's decisions to the general administrative court, and leave to appeal is required for the administrative court of appeal. Under Förordning (2026:1237), section 3, the Police Authority (Polismyndigheten) is the competent authority. The Act took effect on .
Possession or viewing of matter portraying a computer-generated image of a minor (HB 366)
2026 Ky. Acts ch. 109 (HB 366); KRS 531.335
House Bill 366, Kentucky Acts chapter 109 of 2026, amends KRS 531.335 so that a person is guilty of possession or viewing of matter portraying a sexual performance by a minor when, having knowledge of its content and character, the person knowingly possesses or controls, or intentionally views, matter that visually depicts a sexual performance by a minor person or a computer-generated image of a minor person. The viewing limb applies only to the deliberate, purposeful, and voluntary viewing of such matter and not to its accidental or inadvertent viewing. The viewing limb does not apply to a person viewing the matter in the course of a law enforcement investigation or criminal or civil litigation involving the matter. Possession or viewing is a Class D felony if the person knows that the minor or computer-generated image of a minor portrayed is less than eighteen years old at the time of the sexual performance. Possession or viewing is a Class C felony if the person knows that the minor or computer-generated image of a minor portrayed is less than twelve years old at the time of the sexual performance. A person convicted under the section shall not be released on probation or parole until the person has served at least eighty-five percent of the sentence imposed. KRS 531.010 defines a computer-generated image as any visual depiction, including any photograph, film, video, or picture, that a computer has created, adapted, or modified to appear to be an identifiable person. The Governor signed House Bill 366 on . Legislation of the 2026 Regular Session took effect on .
My Kentucky Future Act: student directory information and junior-class data shared with public postsecondary institutions and the Kentucky Center for Statistics
KRS 164.099 and 151B.136
Each public school district must annually invite each student enrolled in a public high school to participate in the proactive postsecondary admissions program and to select a preferred communication method. No later than July 1 each year the district must notify the Department of Education of each high school student that has agreed to participate and his or her preferred communication method. On or before September 1 each year the Department of Education must give each public postsecondary education institution the name, address, enrolled school district, grade level, phone number and email address of each public or certified nonpublic high school student who has not opted out of sharing directory information under federal regulations. For each student who agreed to participate in the program, the information must also include the student's cumulative unweighted grade point average, highest college readiness examination score, any Governor's program graduate status and preferred communication method. On or before September 1 each year the department must also submit to the Kentucky Center for Statistics a list of all high school students who most recently completed their junior year, including each student's name, date of birth, address, enrolled school district, school identification number and the last four digits of his or her Social Security number. The Kentucky Center for Statistics may not include any personally identifiable information for individuals in the cohort in the outcome data it publishes. KRS 164.099 was created by chapter 35 of the 2026 Kentucky Acts, effective . Chapter 35 of the 2026 Kentucky Acts may be cited as the My Kentucky Future Act.
Haw. Rev. Stat. ch. 481B, part I (new section) (2026 Haw. Sess. Laws Act 248)
Governor Josh Green signed S.B. 3001 CD1 into law as Act 248 (Gov. Msg. No. 1350), adding a new AI-companion disclosure and safety section to Hawaii Revised Statutes chapter 481B.
Haw. Rev. Stat. ch. 481B, part I (new section) (2026 Haw. Sess. Laws Act 248)
Section 7 of Act 248 provides that the Act takes effect upon its approval, so the AI-companion disclosure and safety duties commenced the same day the Governor signed it, apart from the annual crisis-intervention reporting duty that begins .
Artificial Intelligence; Digital Imitation; Personal Likeness; Protections (2026 Haw. Sess. Laws Act 247, H.B. 2137 CD1)
Haw. Rev. Stat. new chapter, sections -1 to -5 (2026 Haw. Sess. Laws Act 247)
House Bill 2137 of 2026 adds a new chapter to the Hawaii Revised Statutes on artificial intelligence, digital imitation, and personal likeness. It is unlawful for any person to knowingly publish a realistic digital imitation of an identifiable individual without that individual's consent if the imitation is used in connection with an advertisement, causes harm, or is used to commit fraud, defamation, harassment, or other criminal acts. A digital imitation is any highly realistic AI-generated depiction, audio, or video that is derived from or based upon identifying characteristics of an actual, particular individual and portrays that individual's voice, face, or likeness in a sound recording or audiovisual work in which the individual did not actually perform or appear. Consent means express, written permission from a depicted individual or the depicted individual's authorized representative. The chapter does not apply to content generated or altered by artificial intelligence that is a form of parody, satire, commentary, criticism, scholarship, or political or educational expression. The chapter does not apply to news reporting where the content generated or altered by artificial intelligence is used to illustrate a story. The chapter does not apply to any medium used for the publication or dissemination of third-party content, but only as to the medium's role in publishing or disseminating that content. The individual, or the individual's estate for up to ten years after the death of the individual, may bring a civil action for injunctive relief and for monetary damages of up to $25,000 per advertisement or recovery of actual damages. The attorney general may bring a cause of action for injunctive or other equitable relief in instances in which the distribution of realistic digital imitations involves broad public interest or widespread harm. The Governor signed House Bill 2137 as Act 247 on . The act takes effect upon its approval.
Education Code section 69870(b) and (c) define a participating institution as a federal Workforce Pell Grant-eligible postsecondary educational institution that offers a short-term program, and a postsecondary educational institution as a campus of the University of California, the California State University or the California Community Colleges, a private postsecondary educational institution or an independent institution of higher education. Section 69872(d)(1)(B) lists the student-level data a participating institution collects to show that a short-term program meets Workforce Pell Grant program requirements, including student identifiers, names, dates of birth and financial aid information. Section 69872(d)(1)(C) requires a participating institution, to protect student privacy, to provide the Student Aid Commission only program-level data and calculations performed using student-level data, and permits individual student-level data and any confidential data to be shared with the commission only if the institution has deidentified it and it is critical to demonstrating initial or continued eligibility. Under section 69872(d)(1)(A)(vi), a list of employed completers that would make individual students readily identifiable is treated in the same way as student-level and confidential data. Section 69875(b)(1) requires a participating institution to ensure that any confidential student information or student-level data collected for the article is disclosed to the Office of Cradle-to-Career Data consistent with federal and state law on access to and confidentiality of student record information, including the federal Family Educational Rights and Privacy Act and the Information Practices Act of 1977. Sections 69872 and 69875 were added by Statutes 2026, chapter 79 (SB 135), effective .
WAC 478-140-015 defines directory information as a student's name, address, email address, telephone numbers, major and minor fields of study, class, enrollment status, participation in officially recognized activities and sports, dates of attendance, degrees, honors and awards received, and the most recent previous educational agency or institution attended, with weight and height added for a member of an intercollegiate athletic team. WAC 478-140-015 defines a school official as including faculty instructors, staff, student employees, volunteers, third-party contractors, and any individual the university has determined to have legitimate educational interests in accessing education records. A student's request to inspect and review education records must receive a response within a reasonable period of time and in no case more than 45 days after the request has been made. If the party receiving a request to amend an education record denies it, the party must within a reasonable period of time inform the student of the decision and of the right to a hearing before the university student records committee. If the committee denies the student's appeal, the student may place in the education record a statement commenting on the information or giving reasons for disagreeing with the decision, and the university must keep the statement with the contested part of the record and disclose it whenever it discloses that part. WAC 478-140-010 states the university policy under the federal Family Educational Rights and Privacy Act, which provides for the right of a student to inspect their education records and for guidelines concerning the release of those records to third parties. The annual notice of the university's FERPA policy is presented to a student each time the student registers online, and is available on the university's FERPA website. The rewritten chapter 478-140 WAC took effect on .
Article 97 defines cybersecurity as the state of protection of a digital object, a category Article 20 defines to include software, digital systems, digital platforms and objects of digital infrastructure, against a breach of its confidentiality, integrity or availability, and assigns the duty to protect a digital object to its owner or holder. Article 98 requires that protection through a combination of technical, organizational and legal measures aimed at preventing, detecting and eliminating cyber threats, naming cryptographic protection as one of the technical means. Article 97(3) directs the specific content of these measures to the Law of the Republic of Kazakhstan "On Cybersecurity" and to unified digitalization and cybersecurity requirements adopted under it, neither of which is further described here.
rights to deletion, anonymization and restriction of personal data
Digital Code No. 255-VIII (), Arts. 37(4)-(6), 41
Article 41(1) of the Digital Code lets a person whose personal data is placed or processed in the digital environment require its deletion, anonymization or restriction of processing, whatever the basis on which it was obtained, except in cases the laws of Kazakhstan provide. Article 41(2) obliges the owner of a digital object, or another person who processes personal data, to meet that demand in the manner the personal data legislation sets. Article 37(4) adds that a data subject has the right to access, control, delete and restrict the processing of the digital data and to receive information on the purposes, legal bases and methods of processing. Article 41(4) lists the grounds on which a demand need not be met, among them protection of the life, health, rights and legitimate interests of third persons. The Code entered into force on , six months after its first official publication on (Art. 106).
Article 43 defines an algorithmic system as a digital system that makes, or influences the making of, a decision based on automated data processing, including an AI system, and states that decisions made using an algorithmic system must not result in discrimination on grounds Kazakhstani law sets out. Where a decision is made entirely without human involvement in assessing the circumstances or approving the outcome, in cases provided for by law or agreement, the subject of that decision has the right, in cases and in the manner the legislation sets, to learn that an algorithmic system was used, to obtain an explanation of the key factors and criteria that influenced the decision without disclosure of the algorithm, source code, or legally protected secrets, and to demand review of the decision by an authorised specialist where the decision carries legal consequences or is capable of affecting the person's rights and legitimate interests.
Section 407.3405, RSMo, as created by 2026 Mo. Laws, HCS HBs 1839, 2921 & 3015
The Missouri House's bill record for HB 1839, whose bill string is HCS HBs 1839, 2921 & 3015, lists the Governor's action as approved on . The same record gives the effective date as .
The final act was signed at Strasbourg on , published in the Official Journal on (OJ L, 2026/1744), and entered into force on , the third day after publication.
Article 4a (processing of special categories of personal data for bias detection and correction)
Ley Núm. 85-2018, Art. 2.27, Oficial Principal de Informática (3 L.P.R.A. § 9802x)
The Department of Education's Chief Information Officer directs its Office of Information Systems and is responsible for the Department's information management under the public policy of Ley 75-2019. The officer administers the Department's digital infrastructure, networks, and student and administrative information systems in conformity with the norms, policies and directives of the Puerto Rico Innovation and Technology Service (PRITS). In coordination with PRITS, the officer implements cybersecurity and data protection policies, which PRITS develops, implements and oversees in every agency and instrumentality of the Government of Puerto Rico. No project to create, implement, modify, migrate or update the Department's databases, systems, platforms, networks, digital infrastructure or technology solutions may start, be awarded or be implemented without the prior review and comments of PRITS. No acquisition, contract, contract amendment, renewal or disbursement for information and communication technologies, including equipment, licenses, managed services, cloud, telecommunications and cybersecurity, may be granted without the PRITS review, evaluation and coordination processes of Ley 75-2019. Ley 125-2026 added Article 2.27 to the Act. Ley 125-2026 was approved on .
P.A. 104-0538 (SB 315, 104th Gen. Assembly), enacting a new Act and amending 5 ILCS 140/7.5 and 740 ILCS 174/15
The Governor approved SB 315 on , creating the Artificial Intelligence Safety Measures Act as Public Act 104-0538. The Act does not take effect until .
C.C.S.M. c. B120, ss. 1-3, 7 and 33, as amended by S.M. 2026, c. 41
The Business Practices Act applies to a supplier, which for certainty includes an online retailer and an online distributor. Personalized algorithmic pricing is pricing based on the use of an algorithm or automated processing to set, recommend or vary a price offered to a specific consumer as a result of data about the consumer. For an online retailer or online distributor, the use of personalized algorithmic pricing to increase the price of the goods demanded from the consumer is a deemed unfair business practice. Where the price of a part of a consumer transaction is displayed by an electronic shelf labelling system, demanding a higher price at the point of sale due to personalized algorithmic pricing in respect of that consumer is a deemed unfair business practice. The use of personalized algorithmic pricing as part of a consumer transaction is deemed to be a material fact. For an online retailer or online distributor, a consumer is deemed to give express consent to a higher price only if the supplier prominently discloses the reason for the higher price in clear and understandable language and the consumer takes clear overt action to consent. It is also a deemed unfair business practice for such a supplier to take advantage of a consumer by demanding a price higher than the price offered to other consumers because of personalized algorithmic pricing in respect of that consumer. An unfair business practice may occur through the use of algorithms, data analytics, machine learning or artificial intelligence by the supplier or a third party. The Director of Business Practices may order a supplier committing an unfair business practice to cease it. A consumer may commence a court action against a supplier for relief from an unfair business practice. A person who contravenes the Act is guilty of an offense and liable on summary conviction to a fine of up to $100,000 or 12 months in prison, or both, for an individual's first offense, and to a fine of up to $300,000 for a corporation's first offense. The personalized algorithmic pricing amendments came into force on .
report of a critical cyber security incident by prescribed public sector entities
O. Reg. 51/26, s. 7; S.O. 2024, c. 24, Sched. 1, s. 2 (1) (c)
A critical cyber security incident is, with respect to a prescribed public sector entity, an incident that has impacted the security, continuity, confidentiality, integrity or availability of digital information the entity collects, uses, retains or discloses, or the infrastructure housing or transmitting that information, and that satisfies at least one of the criteria in the Regulation. The criteria are a significant adverse impact to the delivery of public services by the entity, a risk to public safety, significant efforts to recover digital information or related infrastructure or activation of cyber security incident response plans, and a significant risk of harm to the reputation of and public confidence in the entity. The entity shall report a critical cyber security incident to the Chief Information Security Officer of the Ministry as soon as reasonably practical but no later than 72 hours after the entity has confirmed that it occurred. A report shall include, but is not limited to, the names of the primary point of contact and alternate, the name of the entity, the name of the ministry responsible for overseeing it, the date and time the incident occurred, the date and time of confirmation and a general description of the incident. Nothing in the reporting section affects other legal obligations the entity may have in respect of a critical cyber security incident, including any obligations under the Freedom of Information and Protection of Privacy Act. The Lieutenant Governor in Council may make regulations governing cyber security at prescribed public sector entities, including regulations requiring them to submit reports to the Minister or a specified individual in respect of incidents relating to cyber security. Ontario Regulation 51/26 comes into force on .
cyber security programs of prescribed public sector entities
S.O. 2024, c. 24, Sched. 1, ss. 2-4; O. Reg. 51/26, ss. 2-6
The Enhancing Digital Security and Trust Act, 2024 was enacted by an Act that was assented to on . The Lieutenant Governor in Council may make regulations governing cyber security at public sector entities as may be prescribed, including regulations requiring them to develop and implement programs for ensuring cyber security. The Minister may issue directives to public sector entities respecting cyber security. A public sector entity to whom a directive is issued shall comply with the directive. A public sector entity is an institution within the meaning of the Freedom of Information and Protection of Privacy Act other than the Assembly, an institution within the meaning of the Municipal Freedom of Information and Protection of Privacy Act, a children's aid society or a school board. The Minister is the Minister of Public and Business Service Delivery and Procurement or another member of the Executive Council designated to administer the Act. Failure to comply with the Act or with a regulation made or directive issued under it does not affect the validity of any policy, Act, regulation, directive, instrument or decision. Nothing in the Act or in a regulation made or directive issued under it establishes a private law duty of care owing to any person. Ontario Regulation 51/26 prescribes as public sector entities an educational institution as defined in the Freedom of Information and Protection of Privacy Act, a public hospital graded as a Group A, B or C hospital under the Public Hospitals Act, the University of Ottawa Heart Institute, a children's aid society and a school board. Every prescribed public sector entity shall develop and implement a program for ensuring cyber security that satisfies, at a minimum, the requirements set out in the Regulation. Each prescribed public sector entity shall designate one of its employees as its primary point of contact for ensuring cyber security and another employee as an alternate. A designated primary point of contact or alternate must hold a senior management position and have decision-making authority with respect to cyber security at the entity. The entity shall give the Chief Information Security Officer of the Ministry the contact details of its primary point of contact and alternate and notice of any change as soon as reasonably practical but no later than 10 business days following the change. An entity shall, subject to an election under subsection 5 (2), complete an initial cyber security maturity assessment no later than one year after the day the Regulation first applies to it, and a further assessment at least once within every subsequent two-year period, and an entity that completed an assessment within one year before that day may elect to consider it the initial assessment. No later than 30 business days after the completion of a cyber security maturity assessment, the entity shall submit a summary of the assessment to the Chief Information Security Officer of the Ministry. Ontario Regulation 51/26 comes into force on .
Ν. 4961/2022 (ΦΕΚ Α' 146/27.07.2022), Chapter Γ' of Part B, Arts. 32-42
Article 30(1) applies Chapter Γ' of Part B to Internet of Things devices used by operators of essential services, digital service providers and local government organizations, and excludes devices used by the National Intelligence Service and the Ministry of National Defence and its supervised bodies. Article 32(1) requires Internet of Things devices to be designed and developed to reach an appropriate level of cybersecurity throughout their life cycle and to prevent unauthorized third parties from altering their use or performance. Article 32(2) requires devices to incorporate, as use and risk make appropriate, measures such as secure passwords, timely software updates from trusted sources, encryption of critical security data in transit, a public contact point for reporting security incidents, and a policy or procedure for disclosing vulnerabilities or security incidents. Article 33(1) requires a device intended for supply to Internet of Things operators to be accompanied by the manufacturer's declaration that it complies with the technical security specifications set by ministerial decision under Article 113, paragraph 12α. Article 33(2) requires the declaration to come with instructions for use and security information in terms that end users can easily understand. Article 33(5) requires a manufacturer that learns a device does not comply with those specifications to inform the importer, the National Cybersecurity Authority and the competent response team immediately. Article 34(1) requires an importer, before supplying a device to Internet of Things operators, to verify that it comes with the declaration of conformity and to make the declaration available to the authority or response team on request. Article 34(2) requires an importer that learns a device does not comply to stop supplying it until it does, and to inform the manufacturer and, if the device has already been supplied, the authority, the response team and the distributor or operators using it. Article 34(4) applies those importer duties to distributors that supply devices to Internet of Things operators. Article 35(1) requires Internet of Things operators to use their devices in accordance with the technical security specifications set by that ministerial decision. Article 35(2) requires each operator to appoint an Internet of Things Security Officer to monitor the proper execution of the technical and organizational measures that a further ministerial decision under Article 113, paragraph 12β sets. Article 35(4) requires an operator whose Security Officer suspects a device presents a risk to inform the authority, the response team, the manufacturer, the importer and the distributor without undue delay and to suspend use of the device to the extent it considers necessary. Article 38(1) requires each operator to keep a register of the devices it uses, update it annually and whenever it commissions a new device, and make it available to the authority or response team on request. Article 39 requires a manufacturer to have, for each device, a procedure for handling an incident or a vulnerability that a user finds, with documentation of its nature, detailed instructions for dealing with it and mitigation measures. Article 41(2) requires each operator to carry out a data protection impact assessment of the planned processing of personal data related to the operation of the device, in accordance with Article 35(1) of the General Data Protection Regulation. Article 42 lets the competent organ of the Ministry of Digital Governance, on a reasoned recommendation of the National Cybersecurity Authority, impose on an operator that fails its duties escalating sanctions: a recommendation, a reprimand, a fine of up to EUR 15,000 and, on repetition, a fine of up to EUR 100,000. Article 113, paragraph 12α, leaves the technical security specifications for devices intended for Internet of Things operators, including the Article 32 measures, to a decision of the Minister of Digital Governance on the recommendation of the National Cybersecurity Authority. Article 116(3), as replaced by Article 28(1) of Law 5256/2025 (Government Gazette A' 223 of ), provides that Chapter Γ' of Part B takes effect on .
Vyhláška Ministerstva dopravy Slovenskej republiky č. 111/2026 Z. z. o sektorových bezpečnostných opatreniach (25. mája 2026)
Decree 111/2026 of the Ministry of Transport (Vyhláška Ministerstva dopravy Slovenskej republiky) sets the sector security measures in the Ministry's remit, was approved on , promulgated on and took effect on . Section 1 sets the sector cyber security measures for rail transport in Annex 1 and for road transport in Annex 2. The Ministry issues the decree in cooperation with the National Security Authority under Section 32(2) of Act 69/2018.
Act 952 of 2025 (HB1717), Arkansas Children and Teens' Online Privacy Protection Act
Act 952 of 2025 (HB1717), adding a subchapter to Ark. Code Ann. Title 4, Chapter 88
A child is an individual twelve years of age or younger in Arkansas. A teen is an individual located in Arkansas who is thirteen years of age or older and younger than seventeen.
The duties below apply to an operator of a website, online service, online application or mobile application that has actual knowledge that it is collecting personal information from children or teens. The operator must obtain consent for the collection, use or disclosure of a teen's personal information from the teen or the teen's parent, except for purposes the Act lists. The operator must provide clear and conspicuous notice of what information it collects from children or teens, the purpose of processing it, and its disclosure practices.
The operator must give the parent of a child the opportunity to request deletion of the child's account, content or information and to refuse further collection of the child's personal information, and to challenge and correct inaccurate information. The operator must give a teen the opportunity at any time to delete personal information collected from the teen, and to challenge the accuracy of that information and have inaccurate information corrected. The operator must establish, implement and maintain reasonable security practices to protect the confidentiality, integrity and accessibility of the personal information of children and teens.
It is also unlawful for an operator directed at children or teens, or one with actual knowledge that it collects their personal information, to collect that information for targeted advertising to children or teens, to collect it outside the context of a service or the child's or teen's relationship with the operator unless law requires or authorizes it, or to retain it longer than is reasonably necessary to fulfill a transaction or provide a requested service, except as required for the safety or integrity of the service or specifically authorized by law. The Act does not require an operator to affirmatively collect age information it is not already collecting in the normal course of business, or to implement age-gating or age verification functionality.
The Attorney General has exclusive authority to enforce the Act, and the Act creates no private right of action. A violation of the teen consent duty or of the duties owed to the parent of a child is treated as an unfair or deceptive act or practice under the Deceptive Trade Practices Act.
The Act was approved on . The Act is effective on and after .
Arkansas Children and Teens' Online Privacy Protection Act (Act 952 of 2025), consent, notice, deletion and security duties for children's and teens' personal information
Ark. Code Ann. secs. 4-88-1501 to 4-88-1505 (Act 952 of 2025)
Act 952 of 2025 adds Subchapter 15 to Chapter 88 of Title 4 of the Arkansas Code and names it the Arkansas Children and Teens' Online Privacy Protection Act. It takes effect on . It binds an operator of a website, online service, online application or mobile application that is directed at children or teens, or that has actual knowledge it is collecting personal information from children or teens. A child is an individual twelve years of age or younger. A teen is an individual located in Arkansas who is thirteen years of age or older and younger than seventeen. The operator must obtain consent for the collection, use or disclosure of a teen's personal information from the teen or the teen's parent, except for purposes the Act lists. The operator must give clear and conspicuous notice of what information it collects from children or teens, the purpose of processing it, and its disclosure practices. The parent of a child must be able to request deletion of the child's account, content or information and to refuse further collection of the child's personal information. A teen must be able at any time to delete personal information collected from the teen and to challenge its accuracy and have inaccurate information corrected. The operator may not collect a child's or teen's personal information for targeted advertising to children or teens, or let another person do so. It may collect a child's or teen's personal information only where the collection is consistent with the context of a particular service or its relationship with the child or teen, or is required or specifically authorized by law. It may not retain that information for longer than is reasonably necessary to fulfill a transaction or provide a service the child or teen requested, except as required for the safety or integrity of the service or specifically authorized by law. The operator must establish, implement and maintain reasonable security practices to protect the personal information of children and teens. The Act does not require an operator to collect age information it is not already collecting or to implement age verification. The Attorney General has exclusive authority to enforce the Act, and it creates no private right of action.
Section 3 of Laws 2025, chapter 165 (HB 2175) makes the act effective from and after , so the medical-director individualized-review duty became binding on Arizona health care insurers on .
Connecticut Data Privacy Act (CTDPA), general applicability and controller/processor duties
Conn. Gen. Stat. §§ 42-515, 42-524
Substantial amendments to CTDPA, enacted as Public Act 25-113 and approved , took effect. The act lowers the applicability threshold, per section 6 of the act.
Connected device provider's duty to protect recorded personal information with reasonable security measures
Public Act No. 25-44, Sec. 2(c) (2025)
Public Act 25-44 (Substitute Senate Bill No. 3), An Act Concerning Consumer Protection and Safety, added this section as new law effective , including the subsection (c) duty to secure personally identifying information collected through a connected device's camera or microphone.
Student instructional technology standards: technology adoption checklist for a one-to-one digital device program, including whether student data is collected, stored or shared
Iowa Code § 279.89(4)
Section 279.89 of the Iowa Code, added by Division VIII of House File 2676, requires the board of directors of a school district, before it adopts or renews a one-to-one digital device program for any grade level, to complete a technology adoption checklist. The checklist documents the district's consideration of whether student data is collected, stored, or shared, and the nature of those data practices, along with the instructional purpose of the device, age appropriateness, and content-filtering limitations. The board retains the checklist and makes it available to the department of education on request for audit or compliance purposes. The section defines a one-to-one digital device program as a program through which a school district provides or assigns a digital device to each student for instructional use. Sections 16 and 17 of House File 2676 amend Iowa Code sections 256E.7 and 256F.4 so that the schools those sections govern comply with section 279.89 in the same manner as a school district. The Department of Education states that public schools and charter schools are included in the requirements of Division VIII. Section 279.89 does not apply to students enrolled in an online learning program operating under section 256.43. Senate File 2220 of the same session also enacts a new section numbered 279.89, on an advanced mathematics pathway. The Department of Education states that House File 2676 was signed into law on . Section 3.7(1) of the Iowa Code provides that an act of a public nature passed at a regular session of the general assembly takes effect on the first day of July following its passage, unless the act provides some other time. The Iowa Legislature's bill history records the Senate's final passage of House File 2676 on . The same bill history lists as the effective date of House File 2676.
House File 2635, 2026 Iowa Acts chapter 1087, was signed by the Governor on and adds subsection 2A to Iowa Code section 514F.8, in the division on health insurance trade practices. A utilization review organization may use an artificial intelligence-based algorithm or system to provide an initial review of a request for prior authorization. For a prior authorization request for a health care service based on medical necessity, the organization may not use such an algorithm or system as the sole basis for its decision to deny, delay, or downgrade the request. To downgrade means to change an expedited or urgent request for prior authorization to a standard determination, or otherwise to modify the health care service that is the subject of the request to a lower-level service. The bill history states an effective date of .
HF 864, age verification for websites and apps pornographic for minors
Iowa Code ch. 554J (2026 Iowa Acts, HF 864)
Operators of internet sites, apps, or segments of apps containing a substantial portion (one third or more) of material pornographic for minors must perform reasonable age verification of Iowa users before granting access, and may not retain, sell, or disseminate identifying information. Signed .
Generative Artificial Intelligence in Education Act, school district and charter school policy duty
Idaho Code section 33-7004
Idaho Code section 33-7004, part of the Generative Artificial Intelligence in Education Act (Idaho Code sections 33-7001 to 33-7008), requires each local school district and public charter school to adopt a policy governing the use of generative artificial intelligence by students and employees in school buildings, on school grounds, during school activities, and on school-issued devices. The policy must align with the statewide generative artificial intelligence in education framework approved by the State Board of Education and must define appropriate and prohibited uses of generative AI for instructional, administrative, and communication purposes. The policy must include safeguards for student privacy, data security, accessibility, and academic integrity. The policy must comply with all applicable state and federal laws, including Idaho student data privacy requirements, the Idaho parental rights act, the Family Educational Rights and Privacy Act, the Children’s Internet Protection Act, and the Children’s Online Privacy Protection Act. The State Department of Education develops the statewide framework, subject to State Board of Education approval, for use in K-12 Idaho public schools. Senate Bill 1227 was signed by the Governor on , as Session Law Chapter 71, and took effect .
Generative Artificial Intelligence in Education Act, vendor disclosure duty
Idaho Code section 33-7007
Senate Bill 1227 passed the Senate 26-8-1 and the House 62-6-2, was delivered to the Governor, and was signed on , as Session Law Chapter 71, codified at Idaho Code sections 33-7001 to 33-7008; the Act took effect .
Requires large social media platforms, those with at least $1 billion in worldwide advertising revenue, to use reasonable age estimation for Idaho account holders and obtain verifiable parental consent before a child, defined as an Idaho resident 16 years of age or younger, may hold an account, and bars addictive interface features and certain advertising directed at children. A platform may treat an account holder as an adult only with at least 80 percent confidence the user is older than 16. Creates a private right of action. Signed , as 2026 Idaho Session Laws chapter 268.
Each school district, charter school, and non-public, non-sectarian elementary or secondary school must create, maintain, and implement a policy on bullying and file it with the State Board of Education. Every 2 years it must review and re-evaluate the policy and file the updated policy by September 30 of the subject year. Beginning with the 2026-2027 school year, the definition of cyber-bullying also includes the posting or distribution of an unauthorized digital replica by electronic means if the posting or distribution creates any of the effects enumerated in the definition of bullying. An unauthorized digital replica is the use of a digital replica of an individual without the consent of the depicted individual. Digital replica has the meaning given to that term in the Digital Voice and Likeness Protection Act. The policy on bullying must include procedures for informing parents or guardians of all students involved in the alleged incident within 24 hours after the school's administration is made aware of the students' involvement. The policy must also contain procedures for promptly investigating and addressing reports of bullying, making all reasonable efforts to complete the investigation within 10 school days after the report was received. The Act took effect .
House Enrolled Act 1360 took effect, adding a statutory definition of data scraping and authorizing government agencies to build CAPTCHA-gated public-records portals.
Downcoding of Health Benefits Claims, automated and AI decision-making (House Enrolled Act 1271, 2026)
Ind. Code § 27-1-52
A new Indiana Code chapter on downcoding of health benefits claims bars a health insurer, HMO, or dental preferred-provider plan from using an automated process, system, or tool, including artificial intelligence, as the sole basis to downcode a claim based on medical necessity, without a covered individual's medical record first being reviewed by an insurer employee or contractor; it likewise bars a provider from submitting a claim through such an automated tool without human review. The insurer must disclose, in an easily accessible and readable manner, whenever artificial intelligence is used to make an adverse determination on a prior authorization request or to downcode a claim. The chapter does not apply to the Medicaid program or a Medicaid managed care organization. Enacted as House Enrolled Act 1271, it took effect under the act's own effective-date clause.
K.S.A. 21-5510(a)(2)(B) separately criminalizes possessing an artificially generated visual depiction, defined as an obscene image produced through computer software, digital manipulation, or other means that appears to depict a child under 18 engaging in sexually explicit conduct, including one indistinguishable from a real child, morphed from a real child's image, or generated without any actual child's involvement, with intent to arouse or gratify sexual desire; this is a severity level 5 person felony. K.S.A. 21-5611's definition of visual depiction for the unlawful-transmission-of-a-child's-image offense was extended to include any item that has been created, in whole or in part, altered or modified by artificial intelligence or any digital means to appear to depict or purport to depict an identifiable child, regardless of whether such identifiable child was involved in the creation of the original image. K.S.A. 21-6101(a)(8), the breach-of-privacy offense for non-consensual dissemination of an intimate image, was extended on the same terms to reach any videotape, photograph, film or image that has been created, in whole or in part, altered or modified by artificial intelligence or any digital means to appear to depict or purport to depict such identifiable person, regardless of whether such identifiable person was involved in the creation of the original image. This amendment, 2025 Kan. Sess. Laws ch. 120 (HB 2183), became effective .
Data Security for Money Transmitters Act, notice of a notification event to the Commissioner
Data Security for Money Transmitters Act, section 5, House Bill 1596 (2026)
A notification event is the acquisition of unencrypted customer information without the affected individual's authorization; information is unencrypted if its encryption key was accessed by an unauthorized person, and unauthorized access is presumed to be acquisition unless the licensee has reliable evidence otherwise.
Upon discovery of a notification event involving the information of any consumers in Mississippi, the licensee shall notify the commissioner as soon as possible, but in no event later than seventy-two hours after discovery. The notice shall be made in a format specified by the commissioner and include six listed items of information, beginning with the name and contact information of the reporting licensee.
A law enforcement official may request an initial delay of up to thirty days following the date when notice was provided to the commissioner, extendable by up to sixty days on written request and further only if the commissioner finds that disclosure continues to impede a criminal investigation or cause damage to national security. A licensee that becomes aware of a notification event in a system maintained by a service provider shall treat the event as it would under the notice subsection.
Data Security for Money Transmitters Act, licensee information security program
Data Security for Money Transmitters Act, sections 2 to 4 and 6, House Bill 1596 (2026)
The Data Security for Money Transmitters Act defines a licensee as a money transmitter or virtual currency kiosk licensed under the Money Transmission Modernization Act. A licensee shall develop, implement and maintain a comprehensive information security program. A licensee shall designate a qualified individual to be responsible for implementing, overseeing and enforcing its information security program. A licensee shall protect by encryption all customer information held or transmitted by the licensee, both in transit over external networks and at rest. A licensee shall implement multi-factor authentication for an individual accessing an information system, unless its qualified individual has approved in writing the use of reasonably equivalent or more secure access controls. A licensee shall develop procedures for the secure disposal of customer information in any format no later than two years after the last date the information was used in connection with the provision of a financial product or service to the customer, subject to three listed exceptions. Absent effective continuous monitoring, a licensee shall conduct annual penetration testing of its information systems. A licensee shall establish a written incident response plan designed to promptly respond to, and recover from, any security event materially affecting the confidentiality, integrity or availability of customer information in its control. The qualified individual shall report in writing, at least annually, to the licensee's board of directors or equivalent governing body. A licensee that maintains customer information concerning fewer than five thousand consumers is exempt from several of the program duties. The Act takes effect .
Prohibits a covered interactive computer service from knowingly making false or misleading statements or representations to a minor, or to a minor's parent or guardian, about the service, such as falsely denying that it is addictive or safe to minors or failing to disclose or warn of its harmful effects. A service with design features that make it addictive to minors is treated as a defective product for state product liability purposes. A minor's parent or guardian may bring a private action where a knowing and willful violation proximately causes the minor's repeated exposure to material harmful to minors. Signed .
Artificial intelligence policies for public school units (G.S. 115C-102.13, added by Session Law 2026-41, section 7.39)
N.C. Gen. Stat. § 115C-102.13 (added by S.L. 2026-41, s. 7.39(e)-(k))
Section 7.39 of Session Law 2026-41 (Senate Bill 257, the Current Operations Appropriations Act of 2026) adds section 115C-102.13 to the General Statutes, which requires the Department of Public Instruction to develop a model artificial intelligence policy to serve as guidance to public school units when they develop their AI policies. The model policy must include a definition of AI, generative AI, and AI tools, guidance on developing the AI literacy of students and school staff (which must include education about nonconsensual intimate imagery), data privacy and security measures to protect students and staff, and standards of ethical and acceptable use of AI and AI chatbots in an educational setting. Local boards of education must adopt a policy on the use of artificial intelligence by students and staff for educational purposes after review of the model policy, under a new subdivision (73) of section 115C-47. The board of trustees acting under section 115C-150.12C must adopt a policy on the use of artificial intelligence by students and staff for educational purposes after review of the model policy. A charter school must adopt a policy on the use of artificial intelligence by students and staff for educational purposes after review of the model policy, under a new subsection (c) of section 115C-218.33. The board of directors acting under section 115C-229.35 must adopt a policy on the use of artificial intelligence by students and staff for educational purposes after review of the model policy. The chancellor acting under section 116-239.8 must adopt a policy regarding the use of artificial intelligence by students and staff for educational purposes after review of the model policy. The Department of Public Instruction must develop the model policy by , the Superintendent must ensure that all public school units have access to it by , and the governing bodies of public school units must adopt their policies by . Session Law 2026-41 became effective on under section 45.8 of the act, which provides that, except as otherwise provided, the act becomes effective on that day. The Governor approved Session Law 2026-41 on .
Department of Public Instruction evaluation framework for artificial intelligence tools (G.S. 115C-102.14, added by Session Law 2026-41, section 7.39)
N.C. Gen. Stat. § 115C-102.14 (added by S.L. 2026-41, s. 7.39(l))
Section 7.39 of Session Law 2026-41 adds section 115C-102.14 to the General Statutes, which requires the Department of Public Instruction to implement and maintain an evaluation framework, developed by the Office of Learning Research at the University of North Carolina at Chapel Hill and the Friday Institute for Educational Innovation at North Carolina State University, that provides criteria and guiding considerations for evaluating generative artificial intelligence-powered educational tools. The Department must review and update the framework annually with recommendations from the Office of Learning Research and the Friday Institute, and the framework must address student data privacy, security, and transparency, alignment with the standard course of study, and accessibility for all students. The Department must maintain a publicly available list of AI tools that have been reviewed under the framework. The Department must establish procurement guidance, qualified vendor lists, and other mechanisms to support and incentivize the adoption of AI tools that have been reviewed under the framework. The Department must also maintain a publicly available list of all AI tools being used in public school units. Session Law 2026-41 became effective on under section 45.8 of the act, which provides that, except as otherwise provided, the act becomes effective on that day.
Artificial intelligence literacy standards for grades kindergarten through 12 (G.S. 115C-81.90(a1), added by Session Law 2026-41, section 7.39)
N.C. Gen. Stat. § 115C-81.90(a1) (added by S.L. 2026-41, s. 7.39(a))
Section 7.39 of Session Law 2026-41 adds subsection (a1) to section 115C-81.90 of the General Statutes, which requires the State Board of Education to adopt age-appropriate standards for instruction on artificial intelligence literacy for grades kindergarten through 12. Every course offered under section 115C-81.90 must include instruction on artificial intelligence literacy aligned with the standards the State Board adopts. The State Board must review and update the standards annually to keep up with advancements in artificial intelligence. The standards must include at least responsible and ethical use of AI, limitations of AI tools, evaluation and verification of outputs provided by AI tools, data and privacy concerns related to AI tools, and best practices and safety when interacting with AI or AI chatbots. The State Board must revise the standard course of study for computer science for grades kindergarten through 12 to include artificial intelligence literacy and adopt the revised standards for implementation beginning with the 2028-2029 school year. Session Law 2026-41 became effective on under section 45.8 of the act, which provides that, except as otherwise provided, the act becomes effective on that day.
Instructional materials contracts: license for local boards of education to produce braille, large print, audio, and other accessible copies
N.C. Gen. Stat. 115C-98(a)
Section 115C-98(a) of the General Statutes, as rewritten by section 7.4(b) of Session Law 2026-41, requires every contract a local board of education makes for the procurement of instructional materials to include a clause granting the local board the license to produce braille, large print, audiocassette tape, and other accessible copies of the instructional materials for use in the local school administrative unit. Instructional materials are systematically organized materials comprehensive enough to cover the primary objectives of the standard course of study for a grade or course, and their formats may be print or nonprint, including digital resources that require the use of electronic equipment in order to be used in the learning process. Section 7.4(a) of the same act repealed sections 115C-86 through 115C-95 and 115C-97, among them section 115C-90, which had required a license clause for Braille, large print, and audio-cassette tape copies in the State Board of Education's textbook contracts. Section 7.4 took effect , and applies beginning with the 2026-2027 school year. The Governor approved Session Law 2026-41 on .
Artificial intelligence professional development for public school teachers (Session Law 2026-41, section 7.39(m)-(q))
N.C. Sess. Law 2026-41, s. 7.39(m)-(q)
Section 7.39 of Session Law 2026-41 requires the Friday Institute for Educational Innovation at North Carolina State University to design, produce, and support implementation of a suite of tool-agnostic online training modules and related training resources on artificial intelligence for educators. The modules and resources must address at least AI fundamentals for educators, responsible instructional use of AI, verification and quality control, academic integrity and assessment redesign, data privacy and security, bias in AI systems, accessible usage with special populations, and ethical use and professional responsibility for educators. The Friday Institute must produce at least a suite of self-paced modules requiring a minimum of 10 hours of seat time, a facilitator guide for administrators in each public school unit, model classroom resources for teachers, and a train-the-trainer package for public school unit professional learning staff. All resources developed under subsection (n) of section 7.39 must be made available to the Department of Public Instruction for distribution to public school units by . All teachers employed by local school administrative units, charter schools, or laboratory schools must complete the professional development provided under subsections (m) through (o) of section 7.39 by . The Department of Public Instruction must report to the Joint Legislative Education Oversight Committee by , on the number of modules delivered and implemented, educator participation in the modules, recommended updates to the professional learning, and any additional supports needed for continuing implementation. Session Law 2026-41 became effective on under section 45.8 of the act, which provides that, except as otherwise provided, the act becomes effective on that day.
The board of a school district must adopt a policy regarding the protection of student data. The policy must require the board's permission before student data is shared with an individual who is not a school district employee or with any other entity. The permission requirement has an exception for sharing data with a student's parent. A school district may share student data with the state entity managing a student information system under a data sharing agreement that is subject to federal and state privacy laws. The data sharing agreement must include a clause designating the department as an authorized representative of the school district under the Family Educational Rights and Privacy Act of 1974 for purposes of the statewide longitudinal data system. The policy must require the school district superintendent to compile a list of the individuals and entities with whom student data is shared and a list, by title, of the school district personnel who have access to student data. A school district must make copies of the policy available upon request. Each school district must use the state student information system as its principal student information system and enter a data sharing agreement with the department of public instruction that is subject to federal and state privacy laws and section 15.1-07-25.3. House Bill 1357 of 2025 amended sections 15.1-07-25.3 and 15.1-07-33 of the North Dakota Century Code. The amendments take effect on .
Would require social media companies to verify the age of prospective account holders using a reasonable age verification method and to obtain a parent's express, verified consent before a minor may hold an account, with parental tools to view messages, control privacy settings, and limit time on the platform.
Distance learning and computer-based course materials must be usable by students with disabilities
Distance Learning Act, distance learning and computer-based courses, NMSA 1978, Sec. 22-30-7 (Laws 2026, ch. 8, Sec. 11)
A school district or charter school that has a full-time distance learning program or offers distance learning courses or other computer-based courses of study must provide accompanying instructional materials or other materials in an electronic format usable by a person with a disability or compatible with the person's assistive technology. Section 11 of House Bill 253 of the 2026 session amends section 22-30-7 of the New Mexico Statutes Annotated 1978, first enacted by Laws 2003, chapter 162, to carry this duty. The governor signed House Bill 253 as Chapter 8 on . The amended section took effect on .
Full-time distance learning programs must follow student privacy and record confidentiality law
Distance Learning Act, full-time distance learning program duties, NMSA 1978, Sec. 22-30-5(A)(2) (Laws 2026, ch. 8)
A school district or charter school that offers a full-time distance learning program must administer the program in compliance with state and federal law regarding student privacy, student record confidentiality and secure student record storage. A full-time distance learning program is a public school instructional program in which students receive virtual instruction and are not required to attend school at a school building. Section 9 of House Bill 253 of the 2026 session amends section 22-30-5 of the New Mexico Statutes Annotated 1978 to carry this duty. The governor signed House Bill 253 as Chapter 8 on . The provisions of sections 1 through 12 and 14 of the act took effect on .
A public school must not include any data or information concerning a pupil within a directory of pupils maintained by the school other than the name, grade level and school photograph of a pupil. Except as NRS 388.281 to 388.296 otherwise provide, or as necessary to provide instructional programming and services or wrap-around services to a pupil, a school district or public school must not disclose the phone number or address of any pupil or parent or legal guardian of a pupil to a third party unless required by federal law or a subpoena, warrant or order issued by a court of competent jurisdiction. A third party may request information concerning a pupil contained in a directory by submitting a written request to the public school stating the date and purpose of the request and either an affirmation that the information is for a journalistic purpose with documentation that the requester is a reporter or editorial employee, or an affirmation that the information will be used only for the stated purpose and will not be sold, transferred or distributed to any other party. Sections 36.3 and 36.4 of Assembly Bill 6 of the 36th Special Session of 2025 added the directory and contact information provisions to chapter 388 of NRS. Assembly Bill 6 of the 36th Special Session became effective on .
Oklahoma Responsible Technology in Schools Act, Enrolled Senate Bill 1734 (2026), section 1, to be codified as Okla. Stat. tit. 70, Sec. 11-120
The Oklahoma Responsible Technology in Schools Act sets principles and guardrails for the use of artificial intelligence in Oklahoma public school districts, and among its stated purposes is protecting student data, privacy and educational integrity. If artificial intelligence is used in a public school district, the artificial intelligence tools must comply with applicable federal and state student data privacy and security laws, including the Family Educational Rights and Privacy Act, and must meet recognized industry standards or otherwise stringent private audit and security standards. School districts must take reasonable steps to minimize the amount of student data shared with artificial intelligence tools. Each school district must give the parents or legal guardians of its students, at least once a year, a written disclosure identifying all artificial intelligence tools in use in the district, the vendors providing them, the categories of student data collected, the extent to which student data is shared and the educational purpose of each tool. Before the 2027-2028 school year begins, each school district board of education must adopt and maintain a policy governing the use of artificial intelligence and emerging technologies that, among other things, addresses student data protection and data minimization practices and complies with the Act's conditions on artificial intelligence use. The Act does not require a public school district to use artificial intelligence in any school, and the State Board of Education may promulgate rules to implement it. The Governor approved the Act on ; it states that it becomes effective , and declares an emergency.
Chapter 25, Oregon Laws 2026 (Senate Bill 1538), amended ORS 336.187 with effect from . ORS 336.187 requires a public school or school district to disclose personally identifiable information or other information the federal Family Educational Rights and Privacy Act allows from a student's education record to law enforcement, child protective services and health care professionals in connection with a health or safety emergency, if knowledge of the information is necessary to protect the health and safety of the student or other individuals. The section also requires disclosure to courts and to state and local juvenile justice agencies, and a court or juvenile justice agency that receives it must certify in writing that it will not pass the information to a third party other than another court or juvenile justice agency or a person or organization providing direct services to the student on behalf of a juvenile justice agency. As amended, ORS 336.187 provides that law enforcement does not include a federal immigration authority. A person who receives information under ORS 336.187 is not liable civilly or criminally for failing to disclose the information.
The Attorney General may petition a court to impose a civil penalty of up to $5,000 per violation of SDCL secs. 37-24-60 to 37-24-62. This standalone enforcement provision does not cross-reference SDCL sec. 37-24-6, the general deceptive-act provision that the breach statute's own enforcement section deems a violation into, so the general Deceptive Trade Practices and Consumer Protection chapter's private right of action, SDCL sec. 37-24-31, which is keyed specifically to a sec. 37-24-6 violation, does not reach a Genetic Data Privacy Act violation. No damages-preservation clause exists either. This Act creates no private right of action. Chapter 164 of the 2026 Session Laws prescribes no effective date, and under SDCL sec. 2-14-16 an act of a regular session that prescribes none takes effect on the first day of July after its passage, here .
SB 49 (SL 2026, ch. 164), signed by the Governor on , created opt-in consent, security, and consumer-rights duties for direct-to-consumer genetic testing companies.
Student Data Protection: collection limits, student data collection notice and written consent for optional student data
Utah Code 53E-9-305(1) to (5) and (9)
An education entity may not collect a student's social security number or, except as required in section 80-6-103, the student's criminal record. An education entity that collects student data must prepare and distribute to parents and students a student data collection notice statement that is a prominent, stand-alone document and is annually updated and published on its website. An education entity may collect the necessary student data of a student if it provides a student data collection notice to the adult student or to the student's parent. An education entity may collect optional student data only if it gives a notice that describes the optional student data and how it will use that data, and obtains written consent. Optional student data is student data that is not necessary student data and not data the education entity may not collect, and it includes biometric information. An education entity may collect and share threat assessment information without written consent if the collection and sharing is necessary to protect the safety of a student, school personnel, or school property, the information is shared only with authorized personnel, and the education entity complies with all procedural requirements in section 53G-8-807.
Student Data Protection: separate notice and written consent before an education entity collects a student's biometric identifier or biometric information
Utah Code 53E-9-305(6)
An education entity may collect a student's biometric identifier or biometric information only if it provides the adult student or the student's parent a biometric information collection notice that is separate from the student data collection notice and obtains written consent to the collection. The biometric information collection notice must state the biometric identifier or biometric information to be collected, the purpose of collecting it, and how the education entity will use and store it. A biometric identifier is a retina or iris scan, a fingerprint, a human biological sample used for valid scientific testing or screening, or a scan of hand or face geometry, and it does not include a voiceprint or a photograph. Biometric information is information, regardless of how it is collected, converted, stored, or shared, that is based on an individual's biometric identifier and used to identify the individual.
Student Data Protection: no sharing of personally identifiable student data without written consent, with the authorized exceptions and the student data manager's role
Utah Code 53E-9-308
An education entity, including a student data manager, may not share personally identifiable student data without written consent or share student data with a federal agency, except as the section provides. An education entity may share personally identifiable student data in accordance with the Family Education Rights and Privacy Act, as required by federal law, and as the section's other subsections describe. A student data manager must authorize and manage the sharing, outside of its education entity, of personally identifiable student data for the entity, and must act as the primary local point of contact for the state student data officer. A student data manager may share student data for research or evaluation only if the manager verifies that the request meets the requirements of 34 CFR 99.31(a)(6), submits it to the education entity's research review process, and fulfills the instructions that result from that process. A person who receives personally identifiable student data in response to a court subpoena may not use it outside of the use described in the subpoena.
Student Data Protection: contract terms an education entity must require of a third-party contractor, and its duty to give notice and terminate after a privacy violation
Utah Code 53E-9-309(2)
When contracting with a third-party contractor, an education entity, or a government agency contracting on behalf of an education entity, must require the provisions that section 53E-9-309(2)(a)(i) lists in the contract. The required provisions are the requirements and restrictions on the contractor's collection, use, storage, or sharing of student data that the education entity needs to ensure compliance, a description of the persons with whom the contractor may share student data, deletion provisions at the education entity's request, a bar on secondary use of personally identifiable student data if the education entity requires it, an agreement that the education entity may audit the contractor, and a description of the entity's statutory duty to terminate the contract after a privacy violation without any fee or financial liability for the termination. Within 30 days after it discovers a third-party contractor's unauthorized usage of student data in violation of state or federal privacy laws, the education entity or government agency must give the contractor notice of the violation and of the duty to terminate the contract. No sooner than 30 days after that notice, the education entity or government agency must terminate the contract if the contractor does not remedy the privacy violation to the greatest extent practicable and establish processes and procedures to prevent the failure of compliance from re-occurring. On a credible report of a suspected violation, the state board student data privacy team must initiate a compliance audit or investigation of the relevant third-party contractor. A third-party contractor is a person who is not an education entity and who, under a contract with an education entity, collects or receives student data to provide a product or service, if the product or service is not related to school photography, yearbooks, graduation announcements, or a similar product or service.
HB 55 (2026), Privacy Compliance for Education Technology Vendors
Utah Code 53E-9-309, as amended by Laws of Utah 2026, ch. 18 (HB 55)
A third-party contractor must use personally identifiable student data received under a contract with an education entity strictly to provide the contracted product or service within the negotiated contract terms. The contractor may not sell student data, may not collect, use, or share it inconsistently with the contract, and may not use it for targeted advertising. Since , a contract with a third-party contractor must describe the education entity's statutory duty to terminate the contract after a privacy violation and prohibit any fee or financial liability for the termination. Within 30 days after discovering a contractor's unauthorized use of student data in violation of state or federal privacy law, the education entity or government agency must give the contractor notice of the violation and of the duty to terminate. No sooner than 30 days after that notice, the entity must terminate the contract if the contractor does not remedy the violation and establish processes to prevent it from recurring. A contractor may not impose a fee, seek damages, or assert any financial liability against an entity that terminates the contract on that ground. The Governor signed HB 55 on . It amended the section as chapter 18 of the 2026 General Session. The amended section is effective . At the completion of a contract with an education entity, if the contract has not been renewed, a third-party contractor must return or delete all personally identifiable student data under the control of the education entity unless the student's parent gives written consent to the contractor's maintenance of the data.
Student Data Protection: student access to educational data, informed consent to its disclosure to third parties, and a private right of action against a noncompliant third party
Utah Code 53E-9-311
A student who is currently enrolled in or was previously enrolled in an education entity, or a parent if the student is under 18 years old, has the right to access the student's educational data and to authorize access to it. Educational data means a student's transcript data, enrollment information, course history, and academic credentials. Except as the Family Educational Rights and Privacy Act provides, an education entity may disclose a student's educational data to a third party only with the student's informed consent, according to the terms of the consent document, and subject to the third party's agreement to use the data only as the document provides and not to redisclose it. Beginning , an education entity must offer a secure digital or electronic mechanism as the primary method for obtaining informed consent. When it obtains consent through a digital mechanism, an education entity must allow the student to review all consent information before authorization and may not bundle unrelated terms or conditions with the consent request. A third party that receives the educational data of more than 10 students is subject to the data privacy requirements of the Student Data Protection part and to the policies and administrative rules the state board adopts to protect student data. A student whose educational data is shared as a result of a third party's failure to comply with the section has a private right of action against the third party and has none against the education entity. An education entity must allow informed consent in written form if a digital or electronic mechanism is not reasonably available to the student. An education entity may not deny, delay, or restrict a student's ability to grant informed consent that complies with the section, or require a student to waive unrelated rights or agree to unrelated terms as a condition of granting informed consent. If a student is under 18 years old and the disclosure is to a party other than the student, an education entity must obtain the parent's consent in accordance with the section.
Model artificial intelligence use policy: local education agency policy, training, review and certification, and the state board's default policy
Utah Code 53G-7-1402
Utah Code 53G-7-1402, which governs the model artificial intelligence use policy for public schools, took effect on . A local education agency must produce and adopt an artificial intelligence use policy based on the model policy the state board publishes. After adopting the policy, a local education agency must submit it to the state board, train educators and staff on it, ensure compliance at each school, review it at least once every two years, and update it as needed. The state board's model policy must require educators to use only the student facing AI tools a local education agency approves. The state board's model policy must prohibit educators from using generative artificial intelligence to independently grade student work or issue high-stakes determinations. A high-stakes determination means a decision regarding a student's placement, discipline, academic progression, or eligibility for a program or service. The state board's model policy must prohibit a student from using generative artificial intelligence to complete academic work unless an educator authorizes the use for a specific instructional purpose. The state board's model policy must require a school or educator that uses generative artificial intelligence for instruction, assessment, or classroom activities to notify the student's parent in writing. The state board's model policy must prohibit the use of AI tools for any practice that threatens student safety or wellbeing, including biometric surveillance or psychological profiling. The state board must declare the model policy the default policy for a local education agency that fails to adopt a policy. A local education agency must certify to the state board that it has adopted and is implementing an artificial intelligence use policy consistent with the model policy. The certification is a condition of receiving state funds for digital literacy, computer science, or educational technology programs. The state board may withhold or delay the distribution of those funds to a local education agency that fails to meet the requirements of the section until the agency demonstrates compliance.
Classroom Technology Amendments (HB 273, 2026): local education agency vetting of instructional technology for student privacy compliance, and a balanced technology policy
Utah Code 53G-7-228
Before a local education agency allows a public school to use an instructional technology in the classroom, the agency must ensure that the technology meets the conditions the section lists, including that it is compliant with state standards and law such as Title 53E, Chapter 9, Student Privacy and Data Protection. Instructional technology means technology a local education agency issues to a student in connection with the student's public education, including an electronic device, a digital tool, or a digital application. A local education agency must select, deploy, and monitor instructional technology in accordance with those requirements. Before , a local education agency must adopt the state board's model policy on balanced technology use in the classroom, or an amended version that includes, among other elements, a balanced instructional technology use policy compliant with Title 53E, Chapter 9, Student Privacy and Data Protection. The state board's model policy must prohibit instructional technology practices that undermine student safety, privacy, or wellbeing. A local education agency must adopt internal monitoring and accountability policies to ensure compliance with the section.
Artificial intelligence system use and safety in instructional settings: Department guidance, school board policies and the AIS Innovation in Education Pilot Program
Va. Code Ann. § 22.1-20.2:1 (2026 Acts, chs. 937 and 943)
Chapter 937 of the 2026 Acts of Assembly, enacted as House Bill 1186, added section 22.1-20.2:1 to the Code of Virginia. Senate Bill 394, which is identical to House Bill 1186, was also approved by the Governor as Chapter 943 of the 2026 Acts of Assembly, effective . Chapter 937 took effect on . The Department of Education, in consultation with local school divisions and other relevant stakeholders, must compile information on current uses of artificial intelligence systems for student instruction in public schools in the Commonwealth. The Department must post on its website guidance for the safe, ethical, and equitable use of an AIS in instructional settings in public elementary and secondary schools. The guidance must address student data privacy and security, including compliance with the federal Family Educational Rights and Privacy Act and the Children's Online Privacy Protection Act. The guidance must address data privacy agreements with the applicable school division that prohibit the use of any division-level or student data for training or improving any external AIS models. The guidance must include suggestions for functional guardrails that prioritize the use of division-managed AIS platforms operated within division-managed environments. The guidance must ensure that any approved use of an AIS in instruction provides teachers with access to transcripts of student interactions with an AIS and allows teachers and administrators to monitor use through dashboards, automated alerts, and audit logs. Each school board must establish, implement, and enforce policies consistent with the guidance developed by the Department. With such funds as are appropriated for such purpose, the Department must establish and oversee the AIS Innovation in Education Pilot Program. The Department must require each school division selected for the Pilot Program to include professional development for educators on AIS literacy and responsible use and to develop and submit evaluation plans. The Department must submit to the chairs of the House Committee on Education and the Senate Committee on Education and Health by December 1 of each year a report on the Pilot Program. The Pilot Program provisions of subsection D expire on .
Contracts with publishers: the NIMAS electronic files a publisher of Board-approved textbooks and other high-quality instructional materials must furnish for students with print disabilities
Va. Code Ann. § 22.1-241(B)
Contracts and purchase orders between a local school board and a publisher of Board-approved textbooks and other high-quality instructional materials must require the publisher to furnish electronic files of the materials in the National Instructional Materials Accessibility Standards (NIMAS) format. The NIMAS files are deposited in the National Instructional Materials Access Center, from which accessible versions of the materials may be produced for students with print disabilities as defined in 20 U.S.C. 1474. Publishers must deliver the NIMAS files on or before the date they deliver the regular text versions. Contracts and purchase orders for Board-approved materials used in grades 6-12 must allow the purchase of printed materials, printed materials with electronic files, or electronic materials separate from printed versions. The first through fifth enactments of Chapter 680 of the 2025 Acts of Assembly became effective on .
Student-athletes: an institution's disclosure of biometric data
Va. Code Ann. § 23.1-408.2(B)
Biometric data is an individual's physiological, biological or behavioral characteristics that are used or intended to be used, alone or in combination with other identifying data, to establish the individual's identity, and it includes information pertaining to DNA, imagery of the iris, retina, fingerprint, face, hand, palm and vein patterns, voice recordings from which an identifier template such as a faceprint or voiceprint can be extracted, keystroke and gait patterns or rhythms, and sleep, health or exercise data that contain identifying information. An institution here is a private institution of higher education, an associate-degree-granting public institution of higher education, or a baccalaureate public institution of higher education, and a student-athlete is an individual enrolled at an institution who participates in intercollegiate athletics. No institution may disclose an enrolled student-athlete's biometric data to any individual or entity outside the institution without the student-athlete's prior written consent. Chapter 247 of the 2026 Acts of Assembly (House Bill 971) added the section and took effect on .
Student-athletes: biometric data as a condition of a name, image and likeness contract
Va. Code Ann. § 23.1-408.2(C)
Biometric data is an individual's physiological, biological or behavioral characteristics that are used or intended to be used, alone or in combination with other identifying data, to establish the individual's identity, and it includes information pertaining to DNA, imagery of the iris, retina, fingerprint, face, hand, palm and vein patterns, voice recordings from which an identifier template such as a faceprint or voiceprint can be extracted, keystroke and gait patterns or rhythms, and sleep, health or exercise data that contain identifying information. No individual or entity may make the possession, use or ownership of, or the rights to, a student-athlete's biometric data a condition of any contract with the student-athlete for the use of the student-athlete's name, image or likeness without the student-athlete's prior written consent in a writing that is separate and apart from the contract. Chapter 247 of the 2026 Acts of Assembly (House Bill 971) added the section and took effect on .
Virginia Consumer Data Protection Act (VCDPA), general applicability and controller/processor duties
Va. Code Ann. §§ 59.1-575, 59.1-576, 59.1-578, 59.1-579
Senate Bill 338 (Chapter 820 of the 2026 Acts of Assembly) bars a controller of personal data from selling or offering for sale precise geolocation data concerning a consumer.
A direct-to-consumer genetic testing company is an entity that sells, markets, interprets or otherwise offers consumer-initiated genetic testing products or services directly to consumers, analyzes genetic data obtained from a consumer other than through a person licensed in the healing arts for diagnosis or treatment of a medical condition, or collects, uses, maintains or discloses genetic data collected or derived from such a product or service. A direct-to-consumer genetic testing company must obtain a consumer's express consent for the collection, use and disclosure of the consumer's genetic data, with separate and express consent for each of the uses section 2421b(a)(2) lists. A direct-to-consumer genetic testing company must make available a plain-language summary of its privacy practices and a prominent and easily accessible privacy notice covering its data collection, consent, use, access, disclosure, maintenance, transfer, security, and retention and deletion practices. A direct-to-consumer genetic testing company must honor a consumer's revocation of consent as soon as practicable and not later than 30 days after the revocation, and must destroy the consumer's biological sample not later than 30 days after receiving a revocation related to its storage or use. A direct-to-consumer genetic testing company must implement and maintain reasonable security procedures and practices to protect a consumer's genetic data against unauthorized access, destruction, use, modification or disclosure. A direct-to-consumer genetic testing company must develop procedures and practices that let a consumer easily access the consumer's genetic data, delete the consumer's account and genetic data, and have the consumer's biological sample destroyed. Genetic data and biological samples of consumers may not be stored in a country sanctioned by the Office of Foreign Assets Control or designated a foreign adversary, and may be transferred or stored outside the United States only with the consumer's express consent. A direct-to-consumer genetic testing company must obtain separate and express consent for each use of genetic data or the biological sample beyond the primary purpose of the genetic testing or service. Section 2421b(f) bars a person or public entity from discriminating against a consumer because the consumer exercised any of the consumer's rights under the subchapter. A direct-to-consumer genetic testing company may not disclose a consumer's genetic data to an entity responsible for administering or making decisions about health, life, long-term care or disability insurance or employment, or to an entity that advises one. A direct-to-consumer genetic testing company or service provider that violates the subchapter commits an unfair and deceptive act in commerce in violation of section 2453 of title 9. Before a consumer initiates a civil action under section 2421c, the consumer must send the company or service provider a written notice that includes as many details as possible of the alleged violation. The pre-suit notice and cure period in section 1a of Act 135 of 2026 is repealed on . The Genetic Information Privacy Act does not apply to protected health information collected, maintained, used or disclosed by a covered entity or business associate governed by the federal health privacy, security and breach notification rules.
Wyo. Stat. Ann. §§ 6-4-307, 6-4-308, 6-4-701, 6-1-206; see also §§ 1-1-143, 6-4-303(b)(v)-(vi) (2026 Wyo. Sess. Laws, House Enrolled Act No. 32)
House Bill 102 of the 2026 Budget Session, enacted as House Enrolled Act No. 32, created Wyoming's new Article 7 (Artificial Intelligence Offenses) along with companion sections banning AI-generated nonconsensual synthetic sexual material, AI-CSAM-generation tools, and AI self-harm-promotion tools, and amended the existing sexual-exploitation-of-a-child statute to reach AI-generated child pornography.
Cybersecurity Law, Information Systems Critical to National Security, Appraisal, Inspection and Incident Duties
Law No. 116/2025/QH15 (Law on Cybersecurity), arts. 9 and 11
Article 9(1) of the Law on Cybersecurity defines information systems critical to national security as those with a strategic and especially important role whose incidents or violations of the law on cybersecurity may cause damage to national security or serious damage to social order and safety, that are on the list issued by the Prime Minister. Article 9(2)(g) includes national information systems in the energy, finance, banking, telecommunications, transport, agriculture, natural resources and environment, chemicals, healthcare and culture sectors among them. Article 9(3) requires these systems to undergo cybersecurity appraisal and be certified as meeting cybersecurity conditions before being put into operation, to be regularly inspected and monitored during operation, and to respond to and remedy cybersecurity incidents promptly. Article 11(1)(b) requires the manager of such a system to conduct a cybersecurity inspection before putting a new or upgraded system into operation and to notify the results of its annual cybersecurity self-inspection in writing to the competent specialised cybersecurity protection forces before October every year. Article 11(1)(d) requires the manager to develop plans for responding to and remedying cybersecurity incidents, to implement them when incidents occur, and to report promptly to the competent specialised cybersecurity protection forces, with no fixed number of hours stated. Article 11(2) gives the Ministry of Public Security the tasks of appraising, certifying and inspecting these systems, other than military and cryptographic information systems. The Law takes effect on .
Article 39(2) of the Press Law requires every agency, organization and individual that uses a press agency's press works to have an agreement with that press agency, in accordance with the law on intellectual property. Article 50(1) of the Press Law brings the Law into force on .
Section 32^1 of the Kutseõppeasutuse seadus (Vocational Educational Institutions Act) gives a school the right to process a pupil's personal data in order to use an artificial intelligence application in teaching. The school processes the pupil's general data, the personal data, including special categories, that the pupil enters into the application to complete the curriculum, and other personal data, including special categories, that the pupil enters while using it. The school keeps the personal data for up to three months after the pupil leaves the school. The application must let the pupil delete the other personal data that the pupil entered while using it, which point 3 of subsection 2 describes, and where the two kinds of data cannot be told apart, must let the pupil delete all the data the pupil entered. The application must not allow a school representative access to those other data, or, where the two kinds of data cannot be told apart, to any of the data the pupil entered. The minister responsible for the field may by regulation set further safeguards for the use of an artificial intelligence application in teaching.
Data broker and data collector registry: annual registration and fee, required disclosures, and a $2,500 daily penalty for failing to register
Data broker and data collector registry, N.J. Stat. §§ 56:8-166.20 and 56:8-166.21 (P.L.2026, c.25, sections 2 and 4)
A data broker is a person or legal entity, including a controller, that knowingly collects or purchases the personal data of a consumer with whom the person or legal entity does not have a direct relationship and sells or licenses that data to a third party. A data collector is a business, or units of a business, that knowingly collects the personal data of a consumer with whom the data collector has a direct relationship and sells or licenses that personal data to a data broker. A government entity, including a federal agency, a State agency and a political subdivision, is neither a data broker nor a data collector. Each data broker and data collector engaged in selling or licensing personal data of New Jersey consumers must register annually with the Division of Consumer Affairs and pay a registration fee. The registration fee runs by tier from $5,000 for a data broker that sells or licenses the personal data of 100,000 consumers or fewer in the State to $1,500,000 for one that sells or licenses the personal data of more than 4.5 million consumers in the State. Each data broker and each data collector must submit prescribed information to the Division at the time of registration and update it at least annually, or at such other frequency as the Division may require. A person is not a data broker or data collector if its sale or licensing of the data is incidental to developing or maintaining a third-party e-commerce or application platform, to 411 directory assistance for a telecommunications carrier, to providing publicly available information on an individual's business or profession or for financial or real estate services, to real-time health or safety alert services using publicly available information, or to title and settlement services regulated by the Department of Banking and Insurance, or if it is a nonprofit organization established to provide enrollment data reporting services for postsecondary educational institutions. Section 2 does not apply to HIPAA protected health information, a financial institution or affiliate subject to Title V of the Gramm-Leach-Bliley Act, a secondary market institution, an insurance institution subject to P.L.1985, c.179, the sale of personal data by the New Jersey Motor Vehicle Commission that the Driver's Privacy Protection Act permits, a consumer reporting agency acting as the Fair Credit Reporting Act authorizes, a State agency or political subdivision, human subjects research, an insurance-support organization, or a registered national securities association. A data broker or data collector that fails to register with the Division or to submit the annual registration fee is liable for the registration fees for each year it failed to register and a civil penalty of $2,500 for each day it fails to register or submit the required fee. A data broker or data collector that fails to submit or update the information required under section 2(d) is liable for a civil penalty of $2,500 for each day it fails to submit or update the information. The Division collects and enforces a civil penalty under section 4 in a summary proceeding before a court of competent jurisdiction under the Penalty Enforcement Law of 1999. The Division of Consumer Affairs must maintain a public registry of data brokers and data collectors engaged in selling or licensing personal data of New Jersey consumers. The Director of the Division of Consumer Affairs must adopt the rules and regulations necessary for the implementation of the act. Subsection b. of section 2, under which the Division establishes the public registry, remains inoperative for 270 days following the date of enactment. The act takes effect immediately and was approved on .
Data brokers and data collectors: no sale or licensing of sensitive data, with a civil penalty of $50,000 for each record
Data broker sensitive data ban, N.J. Stat. §§ 56:8-166.22 and 56:8-166.23 (P.L.2026, c.25, sections 3 and 5)
A data broker or data collector may not sell or license sensitive data to any other individual or entity. Sensitive data is personal data revealing racial or ethnic origin, religious beliefs, mental or physical health condition, treatment or diagnosis, financial information, which includes an account number, account log-in or card number in combination with the code or password that permits access to the account, sex life or sexual orientation, citizenship or immigration status, status as transgender or non-binary, genetic or biometric data that may be processed to uniquely identify an individual, personal data collected from a known child, or precise geolocation data. Precise geolocation data is information derived from technology that directly identifies the specific location of an individual with precision and accuracy within a radius of 1,750 feet. The sensitive data ban does not apply to HIPAA protected health information, a financial institution or affiliate subject to Title V of the Gramm-Leach-Bliley Act, a secondary market institution, an insurance institution subject to P.L.1985, c.179, the sale of sensitive data by the New Jersey Motor Vehicle Commission that the Driver's Privacy Protection Act permits, a consumer reporting agency acting as the Fair Credit Reporting Act authorizes, a State agency or political subdivision, human subjects research, an insurance-support organization, or a registered national securities association. A data broker, including a controller, or a data collector that sells, offers for sale or licenses sensitive data in violation of section 3 of the act or of paragraph (6) of subsection a. of section 9 of P.L.2023, c.266 is liable for a civil penalty of $50,000 for each record sold, offered for sale or licensed. The provisions of the act apply in addition to, and not in lieu of, the provisions of P.L.2023, c.266. The act takes effect immediately and was approved on .
Making or Supplying a Generator of Purported Intimate Images
Crime and Policing Act 2026, c. 20, s. 99, inserting ss. 66I-66L into the Sexual Offences Act 2003
Section 99 of the Crime and Policing Act 2026 inserts sections 66I to 66L into the Sexual Offences Act 2003 and came into force on . A person commits an offense by making or adapting a thing, or supplying or offering to supply a thing, for use as a generator of purported intimate images. A generator of purported intimate images is a thing for creating, or facilitating the creation of, purported intimate images of a person. A person makes, adapts, supplies or offers to supply a thing for that use if a reasonable person, having regard to all the circumstances, would consider that they do so. A 'thing' includes a program, information in electronic form and a service, and 'purported intimate image' has the same meaning as in section 66E. It is a defense for the person to prove that they took all reasonable steps to prevent the thing being used for creating, or facilitating the creation of, purported intimate images of a person without the person's consent. Section 66J adds defenses for acts done for the prevention, detection or investigation of crime or for criminal proceedings anywhere in the world, for members of the Security Service, the Secret Intelligence Service or GCHQ acting for the purposes of a function of that body, and for members, staff and assistants of Ofcom acting for the purposes of its online safety functions. An internet service provider does not commit the offense by providing access to a communication network, or by transmitting information provided by a user, if it does not initiate the transmission, select the recipient or select or modify the information. A provider that stores information provided by a user who is not acting under its authority or control is protected if, when the information was provided, it did not know that it was or contained a generator of purported intimate images, and it promptly removed the information or disabled access once it knew. Where a body commits the offense with the consent or connivance of a relevant person, such as a director, manager or secretary, that person also commits it. On summary conviction the penalty is imprisonment for a term not exceeding the general limit in a magistrates' court or a fine, or both, and on conviction on indictment it is imprisonment for a term not exceeding 3 years or a fine, or both.
Authorized Technology Testing Defense for Obscenity and Child Abuse Image Offenses (Regulation-Making Power)
Crime and Policing Act 2026, c. 20, ss. 111-112 (obscenity etc offences: technology testing defence)
Sections 111 and 112 of the Crime and Policing Act 2026 give the Secretary of State a power to provide, by regulations, defenses to listed offenses for persons authorized to test technology. Section 111 came into force on . Section 112 came into force on . Under section 255(3)(c), sections 108 to 112 come into force at the end of the period of two months beginning with the day on which the Act is passed. Section 111(1) provides that the Secretary of State may by regulations provide defenses to relevant offenses for persons who are authorized by the Secretary of State to carry out technology testing activities. The section therefore creates no defense by itself, and a defense exists only to the extent that regulations provide one. Technology testing activities are activities carried out in the course of, or in connection with, testing technology to investigate whether it may have been made or adapted for use for creating, or facilitating the creation of, prohibited material, or to test whether it may be used to create, or facilitate the creation of, prohibited material. Prohibited material is anything in relation to which a relevant offense may be committed. The regulations may make provision about authorizations, including conditions, variation, suspension and withdrawal, enforcement of breaches of conditions (which may include criminal offenses punishable with a fine) and fees payable to the Secretary of State to recover costs. The Secretary of State must consult the Scottish Ministers, and the Department of Justice in Northern Ireland, before making regulations containing provision within the legislative competence of the Scottish Parliament or the Northern Ireland Assembly respectively, subject to the limits stated in the section. Section 112(2) lists as relevant offenses, among others, offenses under section 2 of the Obscene Publications Act 1959 and section 1(1)(a), (b) or (c) of the Protection of Children Act 1978, and in the Sexual Offences Act 2003 the offenses in section 46A, section 66B(1), section 66E(1) and section 66F(1) or (2). Section 112(3) lists the offense in section 52D of the Civic Government (Scotland) Act 1982 among the relevant offenses for Scotland. Section 112(4) lists the offense in Article 42A of the Sexual Offences (Northern Ireland) Order 2008 among the relevant offenses for Northern Ireland. The Secretary of State may by regulations amend section 112 so as to change the meaning of 'relevant offense'. A Government supplementary delegated powers memorandum of , written when the clause was a proposed amendment to the Bill, describes the power as a 'Power to authorise technology such as AI models to be tested for prohibited material, without offences being committed in the course of the testing'.
Online Safety Act 2023, 48-hour take-down of intimate image content
Online Safety Act 2023, c. 50, ss. 10(3A)-(3B) and 20A, inserted by the Crime and Policing Act 2026, c. 20, s. 100
Since the provider of a regulated user-to-user service must let users and affected persons easily make an intimate image content report, and must operate proportionate systems and processes to take down the reported content, and any other content it identifies as the same or substantially the same, as soon as reasonably practicable and no later than 48 hours after receiving the report. An intimate image content report declares that the content is intimate image content and that the report is made by the subject of the content or a person acting on their behalf, in good faith and true to the best of the reporter's knowledge and belief, and it identifies the content and gives the reporter's contact details. The 48-hour duty does not apply where the provider considers that the content is not intimate image content or that the reporter is neither the subject nor acting on the subject's behalf. Intimate image content is content amounting to the offence of sharing an intimate photograph or film without consent, and a photograph or film includes an image made or altered by computer graphics or in any other way that appears to be one, so an AI-generated intimate image reported by the person it depicts is within the duty. The provider's terms of service must address the duty. The Crime and Policing Act 2026 inserted these provisions into section 10 and section 20A, so Ofcom enforces them as part of the illegal content safety duties, with the same penalty of up to the greater of 18 million pounds and 10 percent of qualifying worldwide revenue.
By NetChoice, LLC v. Hilgers, United States District Court for the District of Nebraska
Only LB 383 § 28(1)(a), LB 383 § 28(2). The rest of the law still binds.
On NetChoice's motion, the District of Nebraska preliminarily enjoined the Attorney General from enforcing section 28(1)(a) of LB 383, which requires a social media platform to use a reasonable age verification method, and section 28(2), which requires express parental consent for a minor to become an account holder. The court found that NetChoice has shown those provisions regulate expressive activity, are content-based and subject to strict scrutiny, and cannot survive that scrutiny. The remaining provisions of LB 383, including sections 28(4)(a) and (b), which require a platform to let parents view a minor's posts, responses and messages, may be enforced by the Attorney General.
National Identity Management Commission (Establishment) Act, 2026 (Act No. 3 of 2026), ss. 24-27
Section 2 applies the Act to the registration of registrable persons within and outside Nigeria and to the management and operation of the National Identity Database. Section 24(1) requires the National Identity Management Commission to comply with the Nigeria Data Protection Act and best practices in data protection and privacy in its operation and management of the National Identity Database. Section 24(2) bars a person from access to the data or information in the National Identity Database for a registered person except where the registered person has given and not withdrawn consent to the disclosure, or where disclosure is necessary for one of the purposes paragraph (b) lists, the first being compliance with a legal obligation to which the requesting person or body corporate is subject. Section 24(2)(b)(ii) to (iv) adds the performance of a task carried out in the public interest or in the exercise of official authority vested in the requesting person or body corporate, the prevention, detection, investigation, prosecution or punishment of an offence, and the preparation or conduct of proceedings before a court. Section 24(6) bars a person who is provided with registered information in connection with a particular purpose from using it for any other purpose unless one of the exceptions the subsection lists applies, the first being that the registered person consents to the use for that other purpose. Section 24(7) requires a person who uses or discloses registered information to implement appropriate technical and organisational measures to ensure that the use or disclosure does not harm the rights and freedom of the relevant registered person. Section 24(9) requires each request for access to registered information to state the purpose for which the information is required, the period of retention of the information, the recipient of the information, and the security and confidential modalities for the disposal of the information once it is no longer required. Section 25(1) lets the Commission license agents to carry out authentication and verification on its behalf, provided those agents store any registered information securely and only perform the services under the Act and any directions the Commission provides. Section 25(3) bars the Commission from collecting, keeping or maintaining any information about the purpose of authentication, whether by itself, through an entity under its control or through its agents. Section 26(1) requires the National Identification Number to be presented for verifying the identity of the registered person for listed transactions, among them financial transactions and the opening of bank accounts. Section 26(1) also lists the purchase of insurance policies and registration for telecommunications services among those transactions. Section 26(4) requires a person facilitating any of the listed transactions or providing the service to verify the identity of the parties involved in the transaction, using the National Identity Number provided. Section 27(1) makes it an offence for a person, without lawful authorisation by the Commission, intentionally to access or secure access to the Database or to download, copy or extract data from it. Section 32 lets the Commission investigate any complaint referred to it, and conduct investigations on its own motion where it has reasonable cause to believe that there might have been instances of non-compliance with the Act.
To the extent federal law permits, a constituent institution of The University of North Carolina may not prevent law enforcement officials or agencies from gathering information regarding the immigration status of any individual, or prevent communication of that information to federal law enforcement agencies. Session Law 2026-19 added the section, and it took effect when it became law notwithstanding the objections of the Governor on .
Use of Artificial Intelligence by Healthcare Providers Notification Act
R.I. Gen. Laws §§ 23-108-1 to 23-108-3 (H 7538, Substitute A, 2026 Regular Session)
This act requires any healthcare provider or healthcare facility that employs AI to document an in-person or telehealth visit to notify patients that AI was used for that purpose, and to review the AI-generated documentation for accuracy after the visit. "Healthcare facility" carries the meaning given at section 23-17-2, which reaches a facility whether public or private, so the duty binds a government-run facility as well as a private one. The act was enacted on as Public Law 2026, chapter 199. Its own text provides that it takes effect upon passage.
Oversight of Artificial Intelligence Technology in Mental Health Care Act
R.I. Gen. Laws §§ 40.1-5.5-1 to 40.1-5.5-6 (H 7349, Substitute A, 2026 Regular Session)
This act bars any individual, corporation, or entity from offering therapy or psychotherapy services in Rhode Island, including through internet-based AI, unless the services are conducted by a state-licensed professional or provider. A licensed provider may use AI only for administrative or supplementary support (scheduling, billing, records, drafting logistics communications, tracking client progress subject to professional review), and never to make independent therapeutic decisions, conduct therapeutic communication directly with a client without an established provider relationship, or determine treatment plans. Where a client's session is recorded or transcribed and an AI system simulating emotional attachment or bonding assists with supplementary support or therapeutic communication, the patient or their representative must be informed in writing and consent. The act was enacted on as Public Law 2026, chapter 373. Its own text provides that it takes effect upon passage.
Also known as Sosyal Açıdan Desteklenmesi Gereken Kesimlere Yönelik Tedbirlere İlişkin Usul ve Esaslar (Procedures and Principles on Measures Aimed at Segments of Society That Need Social Support)
Sosyal Açıdan Desteklenmesi Gereken Kesimlere Yönelik Tedbirlere İlişkin Usul ve Esaslar (Bilgi Teknolojileri ve İletişim Kurulu, 21.06.2018 tarihli ve 2018/DK-THD/190 sayılı Karar), m. 10(1), 2026/DK-THD/138 sayılı Kurul Kararı ile değişik
The Information and Communication Technologies Authority's Board approved the Procedures and Principles on Measures Aimed at Segments of Society That Need Social Support on (Decision 2018/DK-THD/190), and its Decision 2026/DK-THD/138 of amends them. As amended, Article 10(1) provides that the operator bases the design of its websites and mobile applications on the Accessibility Checklist Level A and on the Web Content Accessibility Guidelines (WCAG-2.2). The amendment to Article 10(1) entered into force on , and the decision's other amendments entered into force on . The quarterly reporting table of the Procedures, which each obligated operator completes, covers the accessibility of the operator's internet pages (Article 10) and its smart-device applications (Article 11).
Η περί Καθορισμού των Δικαιούχων των Ειδικών Τιμολογιακών Πακέτων Ρυθμιστική Απόφαση του 2026 (Κ.Δ.Π. 271/2026), άρθρα 3 έως 6, 8 και 9
Regulatory Decision 271/2026 on the beneficiaries of the special tariff packages is made under Articles 4(3)(β), 4(3)(ζ), 25(4) and 45 of Law 24(I)/2022. Regulatory Decision 271/2026 was published in the Official Gazette on . Article 10 puts Regulatory Decision 271/2026 in force from the date of its publication in the Official Gazette. Article 3 states the purpose of the Decision as defining the beneficiaries of the special tariff packages for the services within the universal service, so that consumers with low income or special social needs have access at affordable prices. Annex III to Regulatory Decision 297/2022 requires the obligated organisation to make available to users who request fixed-location voice communications or broadband internet services one or more tariff packages, so that subscribers with low income or special social needs are not excluded from access to or use of the service, each complying with the Commissioner's regulatory decision under Article 25(4) of the Law. Article 4(2) makes persons with special social needs beneficiaries, being persons with a permanent severe or total physical disability, a permanent severe or total sight disability, a permanent severe or total hearing disability, a permanent moderate, severe or total intellectual disability, or a permanent severe or total psychiatric disability. Article 4(4) makes the parents or guardians of minors who belong to those categories the beneficiaries, provided they live together in the same premises and present the required certificates. Article 4(3) makes persons with low income beneficiaries, being natural persons who receive public assistance from the Social Welfare Services or the Guaranteed Minimum Income from the Welfare Benefits Administration Service. Article 5 requires the applicant for a special tariff package to produce the certificates it lists for the person's class, so as to prevent abuse. Article 6(1) requires the universal service provider to give the beneficiaries the pricing that the table in that paragraph sets out. Article 6(1) sets out the pricing by service for persons with low income and persons with special social needs, covering the connection, monthly rental and calls of fixed-location voice communications, and the connection fee and monthly rental of broadband internet access. Article 6(2) and (3) limit the fixed voice connection and the broadband internet access service for beneficiaries who are natural persons to one premises with a distinct address. Article 6(4) requires the universal service provider to accept that beneficiary minors live in the same premises as their parents or guardians on the signed declaration of the parent or guardian. Article 6(5) and (6) limit the special tariff package to beneficiaries who are natural persons and who have their permanent residence in Cyprus. Article 8 lets the Commissioner impose an administrative fine, under Article 43 of the Law and the Order on the Collection of Information and Imposition of Administrative Fines, on any obligated organisation that breaches an obligation in the Decision. Article 7 lets the Commissioner amend or replace the Decision by regulatory decision. Article 43(2) of Law 24(I)/2022 caps the Commissioner's administrative fine at EUR 200,000 and, for a repeated infringement, at EUR 400,000. Article 43(2) also lets the Commissioner add a fine of not more than EUR 1,000 for each day an infringement continues, or the provider does not comply after notice of the initial fine. Article 46(10) of Law 24(I)/2022 makes it an offence, punishable by imprisonment of up to six months, a fine of up to EUR 850, or both, for a person without reasonable cause to fail to comply with the terms of a regulatory decision of the Commissioner. Article 43(1) of Law 24(I)/2022 also lets the Commissioner impose other administrative sanctions or revoke licences where it finds a breach. Article 46(1) of Law 24(I)/2022 makes it an offence, punishable by imprisonment of up to six months, a fine of up to EUR 5,000, or both, for a person to provide an electronic communications network or service otherwise than as the Law, a general authorisation under it or the Commissioner's regulatory decisions lay down. Section 2 of the Interpretation Law reads a person to include a company, cooperative, association, society, foundation or body of persons, with or without legal personality. Regulatory Decision 271/2026 repeals and replaces the Order on the Special Tariff Packages for Persons with Low Income or Special Social Needs. The marginal note to Article 9 identifies the repealed Order as Regulatory Administrative Act 56/2018, published in issue 5070 of the Official Gazette of , and also cites Regulatory Administrative Act 153/2020. Article 85(2) of Directive (EU) 2018/1972 requires Member States, where retail prices are not affordable because consumers with a low income or special social needs are prevented from accessing the services, to take measures to ensure affordability for those consumers, and allows them to require providers to offer those consumers tariff options or packages different from those provided under normal commercial conditions.
Officially Consumer Rights Directive, Identification in Distance Financial Services Calls
Directive 2011/83/EU, Art. 16a(3), first sentence, as inserted by Directive (EU) 2023/2673
Article 16a(3), first sentence, inserted into Directive 2011/83/EU by Article 1, point (4), of Directive (EU) 2023/2673, requires that, in the case of voice telephony communications, the identity of the trader and the commercial purpose of the call initiated by the trader are made explicitly clear at the beginning of any call with the consumer. Article 3(1b), inserted by the same Directive, applies Articles 16a to 16e of Directive 2011/83/EU to distance contracts concluded between a trader and a consumer for the supply of financial services. Article 2, point (2), of Directive 2011/83/EU defines a trader as any natural or legal person, irrespective of whether privately or publicly owned, who is acting for purposes relating to a trade, business, craft or profession. Member States apply the measures transposing Directive (EU) 2023/2673 from . Article 24(6), inserted by Directive (EU) 2023/2673, requires Member States to ensure that penalties imposed in accordance with Article 21 of Regulation (EU) 2017/2394 for infringements of the measures adopted under Article 3(1b) include the possibility of fines through administrative procedures or legal proceedings. Article 10 of Directive 2002/65/EC required the consumer's prior consent to a supplier's use of automated calling systems without human intervention (automatic calling machines) and fax machines. Article 3 of Directive (EU) 2023/2673 repeals Directive 2002/65/EC with effect from . The correlation table in the Annex to Directive (EU) 2023/2673 shows no provision of Directive 2011/83/EU, as amended, corresponding to Article 10 of Directive 2002/65/EC.
Officially Consumer Rights Directive, Notice of Call Recording in Distance Financial Services Calls
Directive 2011/83/EU, Art. 16a(3), second sentence, as inserted by Directive (EU) 2023/2673
Article 16a(3), second sentence, inserted into Directive 2011/83/EU by Article 1, point (4), of Directive (EU) 2023/2673, requires the trader, when a call is being recorded or might be recorded, also to notify the consumer that this is the case. Unlike the first sentence of Article 16a(3), which names the call initiated by the trader, the second sentence names a call that is being recorded or might be recorded without saying who initiated it. Article 3(1b), inserted by the same Directive, applies Articles 16a to 16e of Directive 2011/83/EU to distance contracts concluded between a trader and a consumer for the supply of financial services. Article 2, point (2), of Directive 2011/83/EU defines a trader as any natural or legal person, irrespective of whether privately or publicly owned, who is acting for purposes relating to a trade, business, craft or profession. Member States apply the measures transposing Directive (EU) 2023/2673 from . Article 24(6), inserted by Directive (EU) 2023/2673, requires Member States to ensure that penalties imposed in accordance with Article 21 of Regulation (EU) 2017/2394 for infringements of the measures adopted under Article 3(1b) include the possibility of fines through administrative procedures or legal proceedings.
Consumer Rights Directive, Adequate Explanations and Human Intervention in Online Tools for Distance Financial Services Contracts (Article 16d)
Directive (EU) 2023/2673, inserting Article 16d(1), (3) and (4) into Directive 2011/83/EU
Article 16d(1) of Directive 2011/83/EU, as inserted, requires Member States to ensure that traders provide the consumer, free of charge and before the contract is concluded, with adequate explanations of the proposed financial services contract that make it possible to assess whether the contract and ancillary services are adapted to the consumer's needs and financial situation. Article 16d(3) requires Member States to ensure that, where the trader uses online tools, the consumer has a right to request and obtain human intervention at the pre-contractual stage and, in justified cases, after the distance contract has been concluded, in the same language as the pre-contractual information. Under Article 16d(4), the burden of proof of compliance with the adequate explanation requirements is on the trader. Article 2(1) of Directive (EU) 2023/2673 requires Member States to adopt and publish the necessary measures by and to apply them from .
Cybercrimes (Protection of Critical Information Infrastructure) Order, 2026 (GN No. 147 of 2026)
designation, registration and owner duties
Cybercrimes (Protection of Critical Information Infrastructure) Order, 2026 (GN No. 147 of 2026), regs. 3, 4 and 6 to 12
The Cybercrimes (Protection of Critical Information Infrastructure) Order, 2026 was published in Government Notice 147 on under section 28 of the Act. The Order designates twenty-five categories of computer system as critical information infrastructure, among them the national broadband backbone, submarine cable landing stations, national internet exchange points, data centres, and national banking and financial payment systems. The Ministry responsible for information and communication technology keeps a register of critical information infrastructure. An owner of designated critical information infrastructure must register it with the Ministry, on the form in the First Schedule, within six months from the commencement of the Order. An owner must carry out a risk assessment analysis every quarter and submit business continuity plans to the Ministry. An owner must take necessary steps for ensuring secure access, control and transfer of data related to critical information infrastructure. An owner must host all data related to critical information infrastructure within Tanzania, and must seek the approval of the Minister before hosting primary or secondary data outside Tanzania. An owner must ensure the integrity and authenticity of data or information contained in critical information infrastructure. An owner or operator must ensure storage and archiving of data or information relating to the infrastructure in accordance with the Act and the relevant written laws. An owner must ensure the availability of functional disaster recovery sites, a risk management policy, backup procedures and restoration procedures. An operator is in charge of operating and securing its infrastructure by carrying out risk assessment. An owner must, within every six months from the date of registration, conduct an audit and inspection as part of its internal operation and submit a report to the Ministry. The Ministry audits and inspects critical information infrastructure annually or at a higher frequency in a particular case. The Order defines the contact person as the designated officer responsible for regulatory liaison, incident reporting, compliance coordination and day to day communication with the Ministry.
self-assessment by government institutions and private entities
Cybercrimes (Protection of Critical Information Infrastructure) Order, 2026 (GN No. 147 of 2026), reg. 5
The Cybercrimes (Protection of Critical Information Infrastructure) Order, 2026 was published in Government Notice 147 on under section 28 of the Act. Every government institution and private entity must, within six months from the commencement of the Order, conduct a self-assessment of its information systems with the checklist in the Second Schedule to determine whether they are critical information infrastructure. After the self-assessment, the government institution or private entity must submit a self-assessment report to the Ministry. The Ministry evaluates the report and determines whether the system may be designated as critical information infrastructure.
Officially Genetic Information Privacy Act: direct-to-consumer genetic testing companies
P.L. 2026, ch. 223 (Genetic Information Privacy Act), R.I. Gen. Laws secs. 6-63-1 to 6-63-7
Public Law 2026, chapter 223 (H 7639), the Genetic Information Privacy Act, was enacted on . Chapter 63 of title 6 of the General Laws, added by section 2 of the act, may be cited as the Genetic Information Privacy Act. The Genetic Information Privacy Act took effect upon passage. Section 6-63-2(5) of the Genetic Information Privacy Act defines a direct-to-consumer genetic testing company as an entity that sells, markets, interprets or otherwise offers consumer-initiated genetic testing products or services directly to consumers, analyzes genetic data obtained from a consumer, or collects, uses, maintains or discloses genetic data from such a product or service or provided directly by a consumer. Section 6-63-3(a)(1) of the Genetic Information Privacy Act requires a direct-to-consumer genetic testing company to make available to a consumer a plain-language summary of its privacy practices, a prominent and easily accessible privacy notice, and a notice that the consumer's deidentified genetic or phenotypic information may be shared with third parties for research. Section 6-63-3(a)(2) of the Genetic Information Privacy Act requires a direct-to-consumer genetic testing company to obtain a consumer's express consent for the collection, use and disclosure of genetic data, with separate and express consent for the use of the data collected, for storing the biological sample after the initial testing, for each use beyond the primary purpose, for each transfer to a third party other than a service provider, and for marketing based on the data. Section 6-63-3(a) and (b) of the Genetic Information Privacy Act require a company to give a consumer effective mechanisms to revoke consent, at least one through the primary medium through which the company communicates with consumers, to honor a revocation as soon as practicable and not later than thirty days after it, and to destroy the consumer's biological sample within thirty days of receipt of a revocation of consent to store it. Section 6-63-3(c) of the Genetic Information Privacy Act requires a direct-to-consumer genetic testing company to implement and maintain reasonable security procedures and practices, and to develop procedures that let a consumer access the genetic data, delete the account and genetic data, and have the biological sample destroyed. Section 6-63-3(d) of the Genetic Information Privacy Act bars a person or public entity from discriminating against a consumer because the consumer exercised a right under the chapter, including by denying goods, services or benefits, charging different prices or rates, or treating the exercise of rights as a basis for suspicion of criminal wrongdoing. Section 6-63-3(e)(1) of the Genetic Information Privacy Act bars a direct-to-consumer genetic testing company from disclosing a consumer's genetic data to an entity responsible for administering or making decisions about health insurance, life insurance, long-term care insurance, disability insurance or employment, or to an entity that advises such an entity, except as subsection (e)(2) provides. Section 6-63-6(a)(1) of the Genetic Information Privacy Act excludes medical information governed by chapter 37.3 of title 5 and protected health information held by a covered entity or business associate under the federal health privacy rules. Section 6-63-4(a) and (b) of the Genetic Information Privacy Act assess a civil penalty of up to $1,000 plus court costs on a person who negligently violates the chapter and of $1,000 to $10,000 plus court costs on a person who willfully violates it. Section 6-63-4(c) of the Genetic Information Privacy Act provides that actions for relief under the chapter are prosecuted exclusively in a court of competent jurisdiction by the attorney general. Section 6-63-4(f) of the Genetic Information Privacy Act makes each violation of the chapter a separate and actionable violation.
Act No. 156 of 2026 (H.816) adds 18 V.S.A. § 7115, which provides that a corporation or entity shall not provide, advertise, or otherwise offer mental health services, including through the use of artificial intelligence, to the public unless the mental health services meet one of two conditions. The first condition is that a mental health professional provides the mental health services. The second condition is that the mental health services are part of an approved institutional review board or privacy board study. Mental health services are services provided to diagnose, treat, or address an individual's mental health or behavioral health through therapeutic communications and therapeutic decisions. Artificial intelligence means an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments. A violation of the section by a corporation or entity is deemed a violation of the Consumer Protection Act, 9 V.S.A. chapter 63. The Attorney General has the same authority, and private parties have the same rights and remedies, as provided under 9 V.S.A. chapter 63, subchapter 1. A mental health professional operating within the professional's scope of practice may use artificial intelligence tools that comply with the Health Insurance Portability and Accountability Act of 1996, provided that the professional reviews and approves any mental health services. Engaging in the prohibited use of artificial intelligence under 18 V.S.A. § 7115 is unprofessional conduct for any mental health professional under 3 V.S.A. § 129a. The act states its purpose as safeguarding individuals seeking mental health services in Vermont from psychological harm, including death by suicide, by ensuring that mental health professionals deliver these services and not artificial intelligence systems independently. The Governor signed the act on . The act takes effect on passage.
Order No. 284-mh of the Minister of Digital Technologies of the Republic of Uzbekistan of , registered with the Ministry of Justice on under No. 3787 (Ethics Rules for creating, deploying and using solutions based on artificial intelligence)
Point 1 of the order approves ethics rules for creating, deploying and using solutions based on artificial intelligence. The Ministry of Justice registered the order on under number 3787. The rules define AI participants as the natural persons and legal persons in Uzbekistan that develop, deploy or use artificial intelligence technologies and systems. Those participants must strictly comply with the rules. Participants must not accept a decision taken by an artificial intelligence technology or system as the final decision. Developers and deployers must keep their technologies and systems under human oversight and review and make sure that a person takes the final decision. Developers and deployers must make the algorithms of their technologies and systems transparent and understandable. Developers and deployers must prevent possible bias in their technologies and systems. Developers and deployers must give open information on the capabilities, limits and possible risks of their technologies and systems. Developers and deployers must tell users the rules of use, what the system may and may not be used for, and that AI-based solutions or decisions are not always correct and their results may be used as advice or information only. Developers and deployers must write and publish a user guide for their technologies and systems. Participants must not rely only on the conclusions of information resources created with artificial intelligence or of AI-based information systems when taking decisions that bear on a person's rights, freedoms and legitimate interests or decisions in health care. The order takes effect three months after its official publication. The national legislation database published the order on . The lex.uz record gives as the date the order took effect.
Dienstequalitätsverordnung (DQV), §§ 2, 3, 10 bis 13, 14, 15 und 18, BGBl. II Nr. 138/2026
The Rundfunk und Telekom Regulierungs-GmbH made the Dienstequalitätsverordnung (DQV) on the basis of section 46(4) of the TKG 2021, and Part II of the Federal Law Gazette for 2026 issued it as number 138 on . Section 2 of the DQV applies it, except section 11, to all providers of internet access services and of publicly available interpersonal communications services that control at least some network components directly or through a service level agreement. Section 11(1) of the DQV applies to providers of publicly available number-based interpersonal communications services and to network operators, unless they are microenterprises within the meaning of section 3, item 19 of the Barrierefreiheitsgesetz. Section 11(1) of the DQV requires them to offer real time text for emergency calls in addition to voice communication services, and total conversation services in addition to voice where video is provided. Annex I Section IV(a) of Directive (EU) 2019/882 is the source of that duty. Section 3 of the DQV defines real time text as a form of text-based communication in which the text is sent so that the user perceives it as continuous, character by character. Section 10 of the DQV requires every provider it covers to state by which measures it provides text-based emergency calls. Section 12 of the DQV requires every provider it covers to state the share of its end-customers to which it provides the sound transmission limit that section sets for voice telephony. Section 13(1) of the DQV requires every provider it covers to collect the data on the parameters of sections 4 to 10 and 12 each year by 31 March, to publish it by 30 April and to send it to the regulator. Section 14 of the DQV lets the regulator verify the data of a provider, or have it verified by third parties, where the transmission is late, incomplete or implausible or the data are suspected of not matching the quality actually offered. Section 14(2) makes the provider bear the costs of the check, and section 14(3) requires the regulator to publish its results. Section 15 of the DQV sets as the first reference date under section 13. Section 11(2) of the DQV requires the emergency call answering points to be technically equipped, from at the latest, to receive real time text and total conversation services. Section 2 of the DQV applies section 11(2) to providers of emergency services within the meaning of section 4, item 32 of the TKG 2021. Section 4, item 32 of the TKG 2021 defines an emergency service as a service recognised as such by the State that gives immediate and rapid assistance under national law in situations of direct risk to life or limb, health, safety, property or the environment. Section 18 of the DQV provides that it takes effect on the day after its promulgation. The consolidated text of the DQV has been in force since . Item 2 of section 188(6) of the TKG 2021 lists a contravention of a Verordnung of the Rundfunk und Telekom Regulierungs-GmbH made under the Act. Section 4, item 36 of the TKG 2021 defines a provider (Anbieter) as an enterprise that offers a communications service to the public. The Rundfunk und Telekom Regulierungs-GmbH performs the tasks that the Act and the Verordnungen under it assign to the regulator. Fines that the Fernmeldebüro imposes under the Act fall to the federal government. Section 188(7) of the TKG 2021 requires the authority, in setting a fine, to consider whether the offence was committed commercially or repeatedly, and to weigh the unlawful advantage gained by a commercial offence. Section 188(9) of the TKG 2021 excludes an administrative offence under section 188 where the act is a criminal offence within the jurisdiction of the courts or carries a stricter penalty under other administrative penal provisions. Section 189 of the TKG 2021 lets the penalty decision for an offence under section 188(5) or (6) order its publication in one or more periodicals at the offender's cost, where the offender has already been punished twice for offences based on the same harmful tendency and further offences under the Act are to be feared. Under section 9(1) of the Verwaltungsstrafgesetz 1991 (VStG), the person called to represent a legal person externally answers for its compliance with administrative provisions, unless a responsible officer has been appointed. Section 9(7) of the VStG makes the legal person jointly and severally liable for the fines imposed on that person or on a responsible officer, and for the costs of the proceedings. Under section 184(1) of the TKG 2021, a regulator that has indications that an undertaking breaches the Act or a Verordnung made under it informs the undertaking and gives it the opportunity to comment or to remedy the defects within a reasonable time. If the defects have not been remedied when that time runs out, section 184(2) requires the regulator to establish them by decision and to order the appropriate measures that secure compliance, with a time limit. Where those measures fail, section 184(3) lets the regulator suspend the right of an undertaking that has seriously or repeatedly breached its obligations to provide communications networks or services until the defects are remedied, or prohibit it from continuing to provide them. Item 17 of section 198 of the TKG 2021 assigns the decision under section 184(3) to the Telekom-Control-Kommission. Section 190(1) of the TKG 2021 lets the regulator apply to the Cartel Court to fix and skim off the economic advantage that an undertaking gained by an unlawful act against the Act or a Verordnung adopted on the basis of it. The Cartel Court may set the amount at as much as 10% of the undertaking's previous-year turnover. Item 18 of section 198 of the TKG 2021 assigns the finding and the application provided for in section 190 to the Telekom-Control-Kommission. Section 5(1) of the Verwaltungsvollstreckungsgesetz 1991 (VVG) enforces a duty to tolerate, to refrain or to act that a third party cannot carry out by coercive fines that hold the obligated party to its duty. Section 5(3) of the VVG caps each coercive fine at EUR 726. Section 5(4) of the VVG allows coercive fines against legal persons, other than public-law bodies, and against registered partnerships.
Oregon DAS Statewide Policy 107-004-190, Responsible Artificial Intelligence Usage
The Responsible Artificial Intelligence Usage policy, number 107-004-190, is a statewide policy issued by Enterprise Information Services (State CIO) with an effective date of . The policy applies to state agencies as defined in ORS 174.112, which includes any board, commission, department, office or other entity within the Oregon executive department, and excludes the Secretary of State and the State Treasurer. The policy applies to generative and agentic AI systems used to conduct the business of the state, including both standalone systems and components embedded in other software. Systems that are explicitly architected and use only data analytics, statistical modeling or machine learning fall outside the policy. Any use of AI meeting the applicability standards must comply with the AI Risk Management Framework that Enterprise Information Services establishes to give state agencies detailed standards, requirements and guidance for using generative or agentic AI. The framework is to align with the NIST AI Risk Management Framework and to define the use cases considered higher-risk. Enterprise Information Services specifies standards for generative AI model and system card disclosure, use of data for model training, user disclosure, user feedback, human in the loop documentation, baseline testing and monitoring, and additional requirements for higher-risk uses. Each agency is to create and keep updated an AI Adoption Plan for its agency. The State CIO or the State CIO's designee oversees the creation and maintenance of a statewide registry of all AI-using applications in use or development by state agencies, including details on their uses. Agencies are accountable for AI usage by employees for work-related purposes, and work usage by state employees of unapproved AI systems is prohibited. All AI development, training and hosting is limited to approved, secure environments, including Enterprise Information Services Data Center Services facilities or other platforms with approved certifications. An agency developing a custom AI-powered software system, including in Azure Foundry and Copilot Studio, must do so in a sandbox or development environment approved by Enterprise Information Services. A customer of Data Center Services is prohibited from installing, deploying or operating AI models within Enterprise Information Services Data Center Services facilities without prior written approval from Enterprise Information Services. Enterprise Information Services publishes an annual report on AI use in state government based on the State AI Registry. Enterprise Information Services also maintains a publicly accessible website that gives access to those annual reports and to Oregon AI transparency disclosure information for all higher-risk systems. The policy states that disclosure of AI usage and an opportunity to provide user feedback on AI-generated results are required. Enterprise Information Services is established in the Oregon Department of Administrative Services and managed by the State Chief Information Officer. The State Chief Information Officer adopts rules, policies and standards for budgeting, planning, acquiring, installing, operating and overseeing telecommunications and information technology for the executive department, under ORS 276A.203 (4)(a)(C). State agencies shall cooperate with the State Chief Information Officer in preparing and complying with rules, policies and standards that the State Chief Information Officer adopts, under ORS 276A.206 (2)(a). The State Chief Information Officer assesses state agencies each biennium to evaluate compliance with the State Chief Information Officer's rules, policies and standards, under ORS 276A.203 (4)(a)(G).
Texas Department of Information Resources rules on accessibility information from a vendor of electronic and information resources (as amended effective June 16, 2026)
1 Tex. Admin. Code secs. 213.18 and 213.38
For the procurement of electronic and information resources made directly by an institution of higher education or through the department's information technology commodity procurement contracts, the institution must require a vendor to provide accessibility information for the purchased products or services, where applicable. A vendor can meet that requirement with URLs to the manufacturer's VPATs or ACRs for applicable commercial off-the-shelf products or services, or with other documents that provide credible evidence of the vendor's capability or ability to produce accessible electronic and information resources, such as an internal accessibility policy, contractual warranties for accessibility, accessibility testing documents, and examples of prior work. If credible accessibility documentation cannot be provided, the electronic and information resources are considered noncompliant. The subchapter applies to electronic and information resources developed, procured, or materially changed by an institution of higher education, or developed, procured, or materially changed by a contractor under a contract with an institution, which requires the use of such product to a significant extent in the performance of a service or the furnishing of a product. All such products developed, procured or materially changed through a procured services contract, and all electronic and information resource services provided through hosted or managed services contracts, must comply with chapter 206 and chapter 213 of title 1 of the Texas Administrative Code, as applicable, unless an exception or exemption is approved. A Voluntary Product Accessibility Template (VPAT) is a vendor-supplied industry template form used to document compliance with technical accessibility standards and success criteria. An Accessibility Conformance Report (ACR) is a report based on a completed VPAT demonstrating how a product or service conforms to WCAG standards and success criteria. Nothing in the subchapter for institutions of higher education is intended to prevent the use of designs or technologies as alternatives to those it prescribes, provided they result in substantially equivalent or greater access to and use of a product for people with disabilities. Section 213.18 states the same requirement for the procurement of electronic and information resources made directly by an agency or through the department's information technology commodity procurement contracts. For a state agency, section 213.18 also requires accessibility testing by a third-party testing resource or a knowledgeable state agency staff member, to validate compliance with 1 TAC section 206.50 and chapter 213, for any electronic and information resources development project whose costs exceed $500,000 and that requires one year or longer to reach operations status, involves more than one state agency or institution of higher education, or substantially alters work methods of agency personnel or the delivery of services to clients, and it carries the same proviso for alternative designs or technologies that give substantially equivalent or greater access. The Department of Information Resources adopted section 213.18 without changes to the proposal published in the edition of the Texas Register.
Texas Department of Information Resources accessibility standards for institutions of higher education (subchapter C of chapter 213, as amended effective June 16, 2026)
1 Tex. Admin. Code secs. 213.31, 213.33, 213.37 and 213.39 to 213.42
The Department of Information Resources adopted sections 213.33, 213.37 and 213.39 to 213.42 of subchapter C of chapter 213 of title 1 of the Texas Administrative Code, the accessibility standards for institutions of higher education, without changes to the text it proposed on . An institution of higher education must make all electronic and information resources hardware that it develops, procures or changes comply with the standards referenced in US Section 508 Appendix C Chapter 4, which begin with section 401 General and section 402 Closed Functionality. An institution's accessibility policy must include standards and processes for handling exception requests for all electronic and information resources. The president or chancellor of an institution of higher education must approve exceptions in writing. Each exception must be approved before the procurement, completion, use or deployment, or at the point the barrier is identified if the vendor is unable to immediately remedy the failure to comply. Institutions of higher education must maintain records of approved exceptions in accordance with the institution's records retention schedule. Each institution of higher education must consider including accessibility criteria in job descriptions where the position is responsible for electronic and information resources. Each institution of higher education must complete the accessibility survey that the department distributes under Texas Government Code section 2054.464. Each institution of higher education must publish to its website a current accessibility policy. The policy must include an institution-approved plan to bring its electronic and information resources into and keep them in compliance, with a process for corrective actions to remediate non-compliant items. Section 213.41 retitles the institution's accessibility coordinator as the Digital Accessibility Officer. An institution of higher education must inform the Department of Information Resources of its designation of a Digital Accessibility Officer, including the individual's name, contact information and other information in the format the department prescribes. Institutions of higher education must comply with the minimum expected standards the chapter establishes and with federal law, and where discrete federal standards differ they must adopt the higher of the two. Section 213.31, adopted on the same terms, requires an institution of higher education, when purchasing telecommunication equipment or services, to contractually require the manufacturer of the equipment or the provider of the services to ensure that they comply with 47 U.S.C. section 255 and 36 C.F.R. section 1194.2, Appendix B, when such products are readily available or compliance is achievable. The president or chancellor of each institution of higher education must ensure that appropriate staff receive the training necessary to comply with chapters 206 and 213.
Act 145 vests exclusive enforcement in the Attorney General as a Consumer Protection Act violation, with a mandatory 60-day cure notice running from through , and creates no private right of action, a choice the Act's own uncodified text calls deliberate.
Telecommunications Act (S.C. 1993, c. 38), ss. 15.1, 15.2, 72.131 and 73(3.1)
Section 15.1(1) of the Telecommunications Act allows the Governor in Council, by order, to prohibit a telecommunications service provider from using all products and services provided by a specified person in its telecommunications network or facilities or to direct it to remove all products provided by a specified person. Section 15.2(1) of the Act allows the Minister, by order, to prohibit a telecommunications service provider from providing any service to a specified person and to direct it to suspend providing a service to a specified person for a specified period. Section 15.2(2) of the Act allows the Minister, by order, to prohibit a telecommunications service provider from using any specified product or service in its network or facilities and to direct it to remove any specified product. Section 15.8(1)(a) of the Act allows the Governor in Council to make regulations containing any provision that may be contained in an order made under section 15.2.
Section 72.131 of the Act makes every contravention of a provision of an order made under section 15.1 or 15.2, or of a regulation made under section 15.8(1)(a), a violation carrying an administrative monetary penalty of up to $10,000,000, or $15,000,000 for a subsequent contravention, for a person other than an individual. Section 73(3.1) of the Act makes it an offence punishable on summary conviction to contravene an order made under section 15.1 or 15.2 or a regulation made under section 15.8(1)(a). The consolidation of the Act is current to and was last amended on .
Requires a commercial entity that knowingly and intentionally publishes or distributes sexual material harmful to minors, to verify that a user is 18 or older using digital identification or a commercial or governmental age verification system. Exempts news gathering organizations, internet service providers, search engines, and cloud service providers.
RCW 63.60, as amended by SSB 5886, ch. 69, Laws of 2026
SSB 5886 (2026 c 69) added a 'forged digital likeness' to the rights and remedies of the Personality Rights Law, chapter 63.60 RCW. The Legislature's bill history records an effective date of .
The Assembleia da República approved Lei n.º 13/2026 on , and the President of the Republic promulgated it on . It was published in the Boletim da República I Série No. 123 on and, under its own Article 80, enters into force 90 days after publication, on .
General Security Requirements for the Public Administration and the Private Sector
Ley Núm. 105 de 10 de junio de 2026 (P. del S. 101), enmendando los Artículos 7.007 y 7.009 de la Ley 222-2011 (Ley para la Fiscalización de las Campañas Políticas) y el Artículo 12.7 de la Ley 58-2020 (Código Electoral de Puerto Rico de 2020)
Governor Jenniffer González Colón signed Senate Bill 101 into law on as Ley Núm. 105, adding an AI-disclosure duty to Puerto Rico's Political Campaign Oversight Act and Electoral Code.
Ley Núm. 105 de 10 de junio de 2026 (P. del S. 101), enmendando los Artículos 7.007 y 7.009 de la Ley 222-2011 (Ley para la Fiscalización de las Campañas Políticas) y el Artículo 12.7 de la Ley 58-2020 (Código Electoral de Puerto Rico de 2020)
Ley 105-2026 amends Puerto Rico's Political Campaign Oversight Act (Ley 222-2011) and Electoral Code (Ley 58-2020) to define "Inteligencia Artificial", including generative AI capable of producing text, image, audio, or video, and to require that any political advertisement or electoral communication created or modified, in whole or in part, using AI carry a clear, visible disclosure that it was produced or altered with AI; a radio or other audiovisual communication must also make the disclosure as a spoken statement. It further makes it a misdemeanor, on a second or later occasion, for any person to maliciously submit AI-generated or AI-altered false data, documents, or images to an electronic system operated by the Comisión Estatal de Elecciones without a clear, legible notice. Approved on and effective immediately on approval, with no separate vacatio legis period.
Article 5 (Chapter Two, Encroachment on Data or Electronic Information and Information Systems) punishes whoever intentionally, without right, enters a website, an information system, or an information-technology means, or exceeds authorized access to it, or continues access once aware it is unauthorized, with imprisonment of one to six months and a fine of 100 to 1,000 Omani Rial, or either penalty. Where that access results in the deletion, alteration, addition, modification, distortion, damage, copying, destruction, blocking, encryption, disclosure, or republication of data or electronic information, or in destroying the website, harming its users, or occupying its domain name or address, the penalty rises to imprisonment of six months to one year and a fine of 1,000 to 3,000 Omani Rial, or either penalty. Where the data or electronic information reached under that second paragraph is personal data, the penalty rises again to imprisonment of one to three years and a fine of 2,000 to 5,000 Omani Rial, or either penalty. A guardian, custodian, curator, or caregiver who acted to protect the interest of a person lacking or having diminished legal capacity is exempted from punishment. The Decree's own text states it takes effect the day after its Official Gazette publication and was issued on 15 Dhul Hijjah 1447H (), repealing the prior cybercrime law issued by Royal Decree No. 12/2011. It was published in Official Gazette issue 1651 of , so it took effect on .
Act 120, Session Laws of Hawaii 2026 (H.B. 2158, C.D. 1), new section of Haw. Rev. Stat. ch. 304A, subsec. (f)
Act 120 of 2026 adds a new section to chapter 304A of the Hawaii Revised Statutes that requires the University of Hawaii to develop, implement and maintain a publicly accessible, systemwide online dashboard of academic program data for students and their families. Subsection (f) of the new section requires all data reported under it to be presented in a manner that protects student privacy and complies with applicable state and federal laws. The governor signed Act 120 on . Act 120 takes effect upon its approval and is repealed on .
School districts and schools may not collect or request information regarding the citizenship or immigration status of a student or of a family member of the student, except as required by State or federal law or as required to administer a State- or federally supported educational program. School districts and schools may not disclose a student's immigration status, citizenship, place of birth, nationality or national origin in any database that the school maintains or as directory information under the Family Educational Rights and Privacy Act. School districts and schools may not voluntarily share student information, including immigration status, citizenship, place of birth, nationality, national origin, sexual orientation, status as a survivor of domestic violence or sexual assault, status as a recipient of public assistance or school discipline records, with a third party unless State or federal law requires it. Absent a judicial warrant, no school or individual working at a school may reveal any information about a student or school staff member in response to an immigration-related request from a law enforcement officer unless otherwise required by law. For the section, a school is a public school or an independent school approved under section 166 of title 16. Section 1486(f) provides that nothing in the section is intended to prohibit or impede any public agency from complying with the lawful requirements of sections 1373 and 1644 of title 8 of the United States Code. Beginning with the 2027-2028 school year, each school board must develop, adopt, enforce and make available an immigration protocol policy at least as stringent as the model policy the Agency of Education develops to reflect subsections (c) and (d). Section 1486 was added by Act 125 of 2026 with effect from .
Public Sector Artificial Intelligence and Cybersecurity Governance Act, cybersecurity requirements for public sector entities
S.M. 2026, c. 43, ss. 1, 3, 7-9 and 10(2)
Chapter 43 of the Statutes of Manitoba, 2026 was assented to on , and section 12 provides that it comes into force on a day to be fixed by proclamation.
Public Sector Artificial Intelligence and Cybersecurity Governance Act, governance of public sector use of artificial intelligence systems
S.M. 2026, c. 43, ss. 1-6 and 10(1)
Chapter 43 of the Statutes of Manitoba, 2026 was assented to on , and section 12 provides that it comes into force on a day to be fixed by proclamation.
Non-Consensual Distribution of Intimate Images Act, C.C.S.M. c. N93
court orders to remove or de-index an intimate image
Non-Consensual Distribution of Intimate Images Act, C.C.S.M. c. N93, ss. 1(1), 14(1)(b.1) and (b.2), as added by S.M. 2026, c. 2, s. 8
In an action for the non-consensual distribution of an intimate image, the court may order the defendant to make every reasonable effort to make the intimate image unavailable to others, including by having it removed from any online platform operated by an Internet intermediary and de-indexed from any search engine. The court may also order an Internet intermediary or other person to make every reasonable effort to remove and, where applicable, de-index the intimate image within a time period specified in the order. An Internet intermediary is a person or organization that hosts or indexes third-party content through an online platform. An intimate image is a personal intimate image of a person or a fake intimate image of a person. A fake intimate image includes a visual recording created through the use of software, machine learning, artificial intelligence or other means. Section 8 of the amending Act added clauses (b.1) and (b.2) to subsection 14(1). The amending Act was assented to on . The amending Act comes into force on the day it receives royal assent.
Non-Consensual Distribution of Intimate Images Act, C.C.S.M. c. N93, s. 15.1, as added by S.M. 2026, c. 2, s. 11
An Internet intermediary is not liable in an action under the Act if it has taken reasonable steps to address unlawful distribution of intimate images in the use of its services. Nothing in section 15.1 limits the court's authority under section 14 to make an order against an Internet intermediary. Section 11 of the amending Act added section 15.1. The amending Act was assented to on . The amending Act comes into force on the day it receives royal assent.
Laki sähköisen viestinnän palveluista, Domain Name Registration Data of Registries and Registrars
172 a-172 d §, Laki sähköisen viestinnän palveluista (917/2014)
Chapter 21 a applies to domain names other than those ending in the Finnish or Åland country-code domains, and to a top-level domain registry operator and a domain name registrar whose main establishment or designated EU representative is in Finland (section 172 a). A registrar must notify the Finnish Transport and Communications Agency of its name, contact details, EU establishments, IP address ranges and the Member States where it offers services, and report changes within two weeks, or within three months for establishment details (section 172 b). A registry operator and a registrar must collect and maintain domain registration data, including the data NIS 2 Directive Article 28(2) lists, keep policies and procedures that ensure the database is accurate and correct, and make those policies public (section 172 c). They must publish the registration data that is not personal data without undue delay after registration, give access to the other data on a lawful and duly reasoned request within 72 hours of receiving it, and publish their disclosure policies (section 172 d). The chapter was added by Act 442/2026, in force from , with three months from that date to make the section 172 b notification and to publish the section 172 c and 172 d policies.
Kyberkestävyyslaki, National Enforcement and Market Surveillance for the Cyber Resilience Act
Laki eräiden tuotteiden kyberkestävyydestä sekä kyberturvallisuussertifioinnista (439/2026), 1, 7-9, 15-16 ja 31-38 §
The Laki eräiden tuotteiden kyberkestävyydestä sekä kyberturvallisuussertifioinnista (439/2026) was enacted , published , and entered into force the same day, naming Traficom as Finland's Cyber Resilience Act market surveillance authority and setting Finland's own administrative-penalty amounts ahead of the Regulation's Article 14 reporting duty, which applies from .
Cybersecurity and Cybercrime (Critical Information Infrastructure Designation) Regulations 2026 (Government Notice No. 113 of 2026), regs. 3 to 9
Regulation 4(1) lets the National Cybersecurity Committee, in consultation with the regulatory body, designate a system as a critical information infrastructure in accordance with the criteria in section 33(2) of the Cybersecurity and Cybercrime Act 2021. The Committee must give public notice of a designation by notice published in the Gazette. Regulation 5 requires every owner of a designated critical information infrastructure to comply with the directions of the regulatory body under section 34 of the Act. Regulation 6 bars anyone other than a person authorised in writing by the regulatory authority from access to information about a critical information infrastructure, including its architecture, vulnerability and security aspects. The Committee must review each designation every 3 years and may then maintain or revoke it. An owner who fails to comply with the regulations commits an offence liable on conviction to a fine not exceeding 100,000 rupees and imprisonment not exceeding 5 years. Regulation 9 gives every owner of a critical information infrastructure 12 months from the coming into operation of the regulations to comply. The regulations were published in Government Gazette of Mauritius No. 45 of . They come into operation on .
The Commission's Child Protection Code, specifying the age-verification measures required under section 18, took effect, requiring a licensed social media service likely to be accessed by children to verify that a registering or feature-accessing user is sixteen or older.
The Commission's Child Protection Code, specifying the safe-design-and-operation measures required under section 18(3), took effect for any qualifying applications or content applications service.
Chapter 634 of 2026 (Senate Bill 720, the Artificial Intelligence Ready Schools Act) took effect on . In the subtitle, artificial intelligence has the meaning stated in section 3.5-801 of the State Finance and Procurement Article. Each local school system must have an artificial intelligence policy aligned with the State Department of Education's guidance within 120 days after the Department releases the guidance. The artificial intelligence coordinator that each local school system designates must be employed at the central office administration level as noninstructional staff. Each local school system must use the rubric and other evaluative tools developed by the State Department of Education in reviewing and selecting artificial intelligence tools. Local school systems must procure artificial intelligence tools consistent with Title 3.5, Subtitle 8 of the State Finance and Procurement Article. The State Department of Education must provide guidance on artificial intelligence to local school systems, educators, parents, and students through an online platform. The State Department of Education must develop and publish a rubric and other evaluative tools to assist local school systems in evaluating the artificial intelligence tools they select for use. On or before , the State Department of Education must ensure that artificial intelligence literacy is a component of workforce preparation standards and computer science standards for kindergarten through grade 12. The State Department of Education must provide professional development in artificial intelligence to educators and school leaders. The professional development the State Department of Education provides must be offered either during the employee's regular workday as part of time designated for professional development or as a course eligible for credit toward licensure renewal. The provisions that establish the Maryland AI Education Collaborative on Artificial Intelligence in K-12 Education end on . By , and each December 1 after that, the Maryland AI Education Collaborative on Artificial Intelligence in K-12 Education must report its findings and recommendations to the State Board of Education, the Accountability and Implementation Board, and the General Assembly.
Each covered entity must notify the Director of the Department of Public Service’s Office of Resilience, Utility Security, Nuclear Affairs and Emergency Preparedness as promptly as possible but in no event later than 72 hours after it reasonably believes that a cybersecurity incident affecting its information technology, or that of an affiliate or a third party provider, has occurred or is occurring. A cybersecurity incident is a cybersecurity event that falls within one of six listed categories, which include a reasonable likelihood of harming any part of normal operations, a demand for payment of a ransom, and any event that triggers a notice requirement to a government body by law, order or regulation. Each covered entity must keep a log of all cybersecurity events and cybersecurity incidents, whether or not they are subject to the notice requirement, for no fewer than three calendar years. Each covered entity must submit a yearly written statement covering the prior calendar year, by June 30, certifying that it complies with Part 1200. The first Certification of Compliance is due . There is no transitional period to comply with the requirements of section 1200.21.
Part 1200 of Title 16 NYCRR binds a covered entity, which means any public utility company as defined in subdivision 23 of section 2 of the Public Service Law other than the small, municipal, telephone and telegraph operators it lists. Each covered entity must maintain a cybersecurity program designed to protect the confidentiality, integrity and availability of the covered entity’s information technology. Each covered entity must implement and maintain a written cybersecurity policy approved by a senior officer, its board of directors or an equivalent governing body. Each covered entity must designate a qualified individual responsible for overseeing and implementing its cybersecurity program and enforcing its cybersecurity policy. Absent effective continuous monitoring, a covered entity must conduct penetration testing at least every 12 months and vulnerability assessments at least every six months. Multi-factor authentication must be utilized for any authorized user accessing the covered entity’s internal networks from an external network, unless the chief information security officer has approved reasonably equivalent or more secure access controls in writing. Each covered entity must test its cybersecurity incident response plan at least yearly through a tabletop or other exercise simulating a network breach and compromise of nonpublic information. On a yearly basis, covered entities must cause to be conducted a third-party audit of the cybersecurity of their information technology and nonpublic information. The information technology that Part 1200 covers does not include operational technology. Covered entities have 180 days from the effective date of Part 1200 to comply with its requirements, except as otherwise specified. Part 1200 is effective .
Rregullore për Sistemet e Informacionit dhe Menaxhimin e Rrezikut Kibernetik, Neni 31
The Regulation on Information Systems and Cyber Risk Management applies to all financial institutions licensed or supervised by the Central Bank of the Republic of Kosovo. A financial institution must notify and report an incident to the Central Bank no later than four hours after discovering it. The initial report or notification must give information on the significant threat and the affected systems. An interim report must be submitted within 72 hours and the final report within 30 days. Cyber incidents and technological failures must be reported to the relevant regulatory authorities under the incident management article. A financial institution must report immediately incidents involving malfunctions, breaches or adverse results of artificial intelligence. Annex 1 requires the report to be preceded by an immediate telephone conversation with BQK officials. Any breach of the Regulation is subject to corrective measures, administrative penalties and monetary penalties. The Regulation entered into force on and requires financial institutions to comply from .
Rregullore për Sistemet e Informacionit dhe Menaxhimin e Rrezikut Kibernetik
The Regulation on Information Systems and Cyber Risk Management applies to all financial institutions licensed or supervised by the Central Bank of the Republic of Kosovo. The Regulation does not apply to non-bank financial institutions that carry out only foreign exchange activities, or to insurance intermediaries. A financial institution's board of directors must approve all policies on information systems, including ICT, information security and cyber policies, and assess and review them every year. A financial institution must appoint a chief information and technology officer and a chief information security officer, and inform the Central Bank 30 days in advance. A financial institution must establish a framework for managing ICT and cyber risks. A financial institution must set up a process for regular vulnerability scanning. A bank must carry out penetration tests of its external digital services at least once a year, and every other financial institution at least every two years. Business continuity and disaster recovery plans must be reviewed, updated and tested at least once a year. The internal audit function must audit IT, cybersecurity controls, governance, compliance and outsourcing processes. Any breach of the Regulation is subject to corrective measures, administrative penalties and monetary penalties. The Regulation entered into force on and requires financial institutions to comply from . The Board of the Central Bank of the Republic of Kosovo adopted the Regulation at its meeting of .
Public Procurement Act: accessibility in the technical requirements and award criteria of public contracts
§ 42 ods. 1 písm. a) a § 44 ods. 4 zákona č. 343/2015 Z. z. o verejnom obstarávaní a o zmene a doplnení niektorých zákonov
Act 88/2026 rewrote section 42(1)(a) of the Public Procurement Act (343/2015) so that the technical requirements take account of the accessibility requirements for products and services. Before , section 42(1)(a) already required the technical requirements to take account of the requirements of accessibility for persons with disabilities and of design-for-all solutions, except in duly justified cases. Section 42(1)(a) requires the technical requirements to take account of the accessibility requirements for products and services under special regulations and of design-for-all solutions except in duly justified cases, and to refer to the binding EU acts where those lay down mandatory accessibility requirements. Footnote 50b names Act 351/2022, Government Regulation 89/2026 and Government Regulation 283/2023 as examples of those special regulations. Article 24(1) of Directive (EU) 2019/882 makes its Annex I requirements mandatory accessibility requirements within Article 42(1) of Directive 2014/24/EU and Article 60(1) of Directive 2014/25/EU. Section 44(4) lets the contracting authority and contracting entity weigh accessibility among the quality criteria when it awards on the best price-quality ratio. Section 35 requires a contracting authority or contracting entity that asks for a certificate of a quality management system, including accessibility for persons with disabilities, to refer to quality management systems certified by an accredited person. Annex 3 counts accessibility for persons with disabilities among the technical requirements for goods and services, as for works. Section 109(9) lets the contracting authority apply sections 42 and 44 in the simplified procedure for commonly available goods and services. Section 102(7) lets the characteristics of a concession include solutions suitable for all users including accessibility for persons with disabilities. Article VIII of Act 88/2026 sets as its commencement day. Act 88/2026 inserted section 10a into Act 351/2022, under which the supervision and fines of sections 8 and 10 of that Act do not apply to the supervision of public procurement of a service under section 167 of the Public Procurement Act. Act 88/2026 likewise added section 30(3) to Act 56/2018, under which sections 26 to 28 of that Act do not apply to the supervision of public procurement of a designated product. Article 30(5) of Directive (EU) 2019/882 excludes from its penalty rules procurement procedures subject to Directive 2014/24/EU or Directive 2014/25/EU. Section 167(1) has the Public Procurement Office (the Office, úrad) supervise the contracting authority's and contracting entity's compliance with the duties that the Act and other rules on public procurement set.
Government Regulation setting technical accessibility requirements for products (consumer computers and operating systems, self-service terminals, consumer terminal equipment for electronic communications and audiovisual media, e-readers)
Nariadenie vlády Slovenskej republiky č. 89/2026 Z. z., ktorým sa ustanovujú technické požiadavky na prístupnosť výrobkov
Government Regulation 89/2026 applies to the designated products it lists, namely general-purpose consumer computer hardware systems and their operating systems, self-service terminals (payment terminals, ATMs, ticketing machines, check-in machines and interactive self-service information terminals), consumer terminal equipment with interactive computing capability used for electronic communications services or for access to audiovisual media services, and e-readers. Article 2(1) of the Directive lists the same groups of products when they are placed on the market after . Section 3 allows an economic operator to place on the market or put into service only a designated product that meets the accessibility requirements of Annex 1, Section I, and for computers and operating systems, terminal equipment and e-readers also Section II. Government Regulation 282/2023 set the technical accessibility requirements for products from until . Section 18 of Government Regulation 89/2026 repeals Government Regulation 282/2023. Section 19 of Government Regulation 89/2026 sets as its commencement day. Section 5(1) obliges the manufacturer to draw up the technical documentation, ensure the conformity assessment, issue the EU declaration of conformity and affix the CE marking before placing the product on the market or putting it into service, in addition to the duties of Act 56/2018. Footnote 16 names the manufacturer duties of Act 56/2018 that apply as well, namely section 5(1)(a) to (e), (g) and (i) to (o). Section 5(2) obliges the manufacturer to keep the declaration of conformity and the technical documentation for at least five years and make them available on request, to keep a register of complaints and of non-conforming products, and to keep for five years the identity of the operators that supplied it and that it supplied. Section 6 lets the manufacturer mandate an authorised representative, who keeps the declaration of conformity and the technical documentation for five years, makes them available to the authority and keeps for five years the identity of the operators supplied and supplying. Footnote 20 adds to the authorised representative the duties of section 6(2)(b) and (c) of Act 56/2018, to give the authority on a reasoned request the information and technical documentation needed to show conformity and to cooperate on any action to eliminate a risk. Section 7 forbids an importer to place a designated product on the market or put it into service where the manufacturer has not done the conformity assessment or where the importer believes the product does not conform, and obliges the importer to inform the manufacturer and the authorities, keep a copy of the declaration of conformity for five years, make the technical documentation available on request, keep a complaints register and keep trader identity data for five years. Footnote 23 adds to the importer the duties of section 7(1) and (2)(a) to (c), (f), (g) and (i) of Act 56/2018. Section 7(2) of Act 56/2018 obliges the importer to put its business name or trademark and its address on the product before placing it on the market, to ensure instructions and safety information in the state language, to keep storage and transport from affecting conformity, to take corrective action and withdraw or recall a non-conforming product, to inform the manufacturer and the authorities of a risk, and to give the authority information and documentation on a reasoned request. Section 8 forbids a distributor to make a designated product available where the manufacturer has not affixed the CE marking or where the distributor believes the product does not conform, and obliges the distributor to inform the manufacturer or importer and the authorities, keep a copy of the declaration of conformity for five years, make the technical documentation available on request, keep a complaints register and keep trader identity data for five years. Footnote 25 adds to the distributor the duties of section 8(1) and (2)(a) to (d) of Act 56/2018. Section 8(1) of Act 56/2018 forbids the distributor to make available a product that does not meet the essential requirements, whose manufacturer did not issue the declaration of conformity, mark it or give its identification, name, address and instructions, whose importer did not put its name and address on it, or that lacks its accompanying documentation. Section 8(2) of Act 56/2018 obliges the distributor to keep storage and transport from affecting conformity, to take corrective action and withdraw or recall a non-conforming product, to inform the manufacturer or importer and the authorities of a risk, and to give the authority information and documentation on a reasoned request. Section 9 extends the manufacturer's duties to an importer or distributor that places a product on the market under its own name or trademark or modifies it in a way that may affect conformity. Section 10 presumes that a product, or a feature, element or function of it, that meets a harmonised technical standard or a technical specification meets the accessibility requirements that the standard or specification covers. Section 11 prescribes the internal production control procedure of Annex 3 for assessing the conformity of a designated product. Section 12(3) requires the EU declaration of conformity to state to which accessibility requirements section 14 was applied. Section 12(2) provides that the requirements on technical documentation must not impose a disproportionate burden on microenterprises and small and medium-sized enterprises. Section 14(1) applies the requirements only to the extent that compliance does not need a significant change that alters the basic nature of the product and does not impose a disproportionate burden under Annex 4 on the economic operator. Section 1(1)(b) names the manufacturer, the authorised representative, the importer and the distributor as the economic operators whose rights and duties the Regulation sets. Section 14(2) obliges the economic operator to assess whether the defence applies and to keep the result and its documentation for five years from the last making available on the market or putting into service, and to give the authority a copy on request. Section 14(3) relieves an economic operator that is a microenterprise of documenting the assessment, though it must give the authority on request the information needed to assess the conditions. Section 14(4) denies the disproportionate-burden defence to an economic operator that took funds from sources other than its own for improving the accessibility of the product. Section 14(5) obliges an economic operator that does not apply a requirement on that ground to notify the authority, or the authority of the Member State where the product is placed on the market, in writing, and exempts microenterprises from that notice. Section 2(h) defines a microenterprise by headcount and by annual turnover or annual balance sheet total. Section 16 lets a service provider keep using a self-service terminal that does not meet the requirements and that it used before for similar services until the end of its life, but not longer than 20 years from the start of its use. Article 32(2) of the Directive lets Member States allow that use for the economically useful life of the terminal, but no longer than 20 years after its entry into use. Section 15(1) applies a special regulation to the supervision of designated products under the Regulation and of the economic operator's duties. That special regulation is sections 26(a), 27 and 28 of Act 56/2018. Section 26(a) of Act 56/2018 makes the Slovak Trade Inspection a market surveillance authority for designated products to the extent set by special regulations. Footnote 46 names section 9 of Act 351/2022 among the provisions that set the extent of the Trade Inspection's supervision. Section 27(1) of Act 56/2018 lets the authority carry out the activities of the special regulation, require the economic operator to take corrective action, require identification data, documentation and information, take samples, temporarily ban making a product available, ban or restrict it and order its withdrawal or recall, order the economic operator to warn of risks, check corrective action and fine. Footnote 64 names Articles 11, 14 to 20, 25, 26 and 28 of Regulation (EU) 2019/1020 as the activities that section 27(1)(a) lets the authority carry out. Article 14(4) of Regulation (EU) 2019/1020 gives a market surveillance authority at least the powers to require documents, technical specifications and data including access to embedded software, to require supply-chain information and information on the ownership of websites, to carry out unannounced on-site inspections, to enter premises, land and means of transport, to start investigations of its own motion, to require and to take corrective action including prohibiting, restricting, withdrawing or recalling a product, to impose penalties, to acquire samples under a cover identity and reverse-engineer them, and, where no other effective means are available against a serious risk, to require the removal of content from an online interface or the display of a warning on it, or the restriction of access to it. Section 27(4) of Act 56/2018 lets an economic operator lodge written objections against a measure of section 27(1)(d) to (j) within three days, without suspensive effect, and has the authority decide them within five days with no further remedy. Section 27a of Act 56/2018 lets the Slovak Trade Inspection order the provider of an online marketplace that offers a non-conforming designated product to remove the illegal content, disable access to it or display a warning to consumers. Section 27(3) obliges the Trade Inspection, where an economic operator applies the provisions on fundamental alteration and disproportionate burden, to check that the criteria and the essential requirements of special regulations were applied correctly. Footnotes 66b and 66c name section 14 and Annex 4 of Government Regulation 89/2026 as the special regulations checked. Section 27(6) obliges the economic operator to allow the supervision, give access to products and documents, give copies and information on origin, take corrective action, pay the cost of samples and tests where non-conformity is shown, and allow a product to be unpacked. Section 28(2) requires the authority to fine from 200 to 200,000 euro an operator that makes a designated product available without a conformity assessment, cannot show one, makes available a product whose assessment does not meet the requirements, or fails to comply with a measure under section 27(1)(d) to (j). Section 28(3) requires a fine from 100 to 10,000 euro for breach of any other duty of an economic operator. Section 28(7) requires a fine from 100 to 5,000 euro, repeatable, on a person who obstructs or hinders a check or supervision. Section 28(11) raises the fines to up to twice the amounts if the duty is breached again within one year of the final decision imposing a fine. Section 28(8) allows a fine to be imposed within five years of the day of the breach. Section 79(1) and (3) of the Administrative Procedure Code (Act 71/1967) enforces a decision that imposes a non-monetary duty, where substitute performance is not possible or practical, by successive fines, each of at most 1,659 euro. Act 88/2026 added section 30(3) to Act 56/2018, under which sections 26 to 28 do not apply to the supervision of public procurement of a designated product of the Regulation that section 167 of the Public Procurement Act governs. Section 29(8) of Act 56/2018, also added by Act 88/2026, has the Slovak Trade Inspection give a consumer on request, in an accessible form and at no extra cost, the information of section 14(2), second sentence, and section 14(5) of the Regulation, unless that would breach or endanger a trade secret. Section 31b of Act 56/2018 completes supervision and sanctions begun and not finally concluded by according to the text in force to . Article 30(1) of the Directive requires each State to lay down rules on penalties for infringements of the national provisions adopted pursuant to the Directive.
Loi n. 78-17 du 6 janvier 1978, Arts. 65, 66, 73 and 76, as amended by the loi du 26 mai 2026 de simplification de la vie économique, Art. 54 (JORFTEXT000054131304)
Article 66 II of Loi 78-17, as rewritten by Article 54 of the Loi de simplification de la vie économique of (the simplification law), provides that référentiels adopted by the CNIL set out how processing is to be carried out, balancing data protection against the public-interest purposes of Article 66 I, notably the development of research in the field of health. Under Article 66 III, processing must conform to one of those référentiels, and before the processing starts its controller sends the CNIL a declaration attesting that conformity. One declaration of conformity is enough where a controller runs several processing operations under the same référentiel. Under Article 66 IV, processing that does not conform to a référentiel may still be carried out, as an exception to Article 66 III, after the CNIL's authorization. Article 66 VI, which Article 54 adds, provides that where a controller has a CNIL authorization or has committed to conform to a référentiel, the controller holding the data in question must make them available within three months, renewable once, except data whose communication would harm national defense interests. Article 66 VI takes effect 18 months after the promulgation of the simplification law. Article 66 VI does not apply to research using health data of the Ministry of Defense where making them available could harm the fundamental interests of the Nation. Article 73 now provides that, for the référentiels of Article 66 II, the CNIL adopts reference methodologies. In the first paragraph of Article 65, the simplification law inserts the words "in the field of health" after "processing". Article 76 now lets authorization requests for studies, evaluations and research not involving the human person that have a favorable opinion from a local scientific and ethical committee be exempted from the prior opinion of the national ethics and scientific committee for health research, studies and evaluations, on conditions set by a decree of the Conseil d'État. Article 54 is not among the provisions of the simplification law that the Conseil constitutionnel declared contrary to the Constitution in decision 2026-903 DC of . The simplification law was promulgated on and published in the Journal officiel of . Article 54 sets a start date only for Article 66 VI. Under Article 1 of the Code civil a law takes effect on the date it sets or, failing that, the day after its publication, and a provision whose execution needs implementing measures takes effect when those measures do.
Law No. 023/2026 of 25/05/2026 regulating virtual asset business
Technology and Information Security
Law No. 023/2026 of 25/05/2026 regulating virtual asset business, Article 28
Article 28(1) of the Law requires a virtual asset service provider to implement effective systems, processes, controls, policies and procedures to handle risks, including cyber security-related risks to its business and virtual asset activities, and the safety of virtual assets and customer information. Article 28(2) requires the provider's technology risk management framework to address the risks associated with the generation of cryptographic keys or virtual asset wallets, the signing and approval of transactions, and the storage of cryptographic keys and seed phrases. Article 28(3) requires the provider to establish and maintain sound operational standards, including robust cybersecurity measures. Article 28(4) requires the provider to keep its operations running without interruption by maintaining backup infrastructure and a disaster recovery and business continuity plan and by periodically testing them. Article 28(5) requires the provider's technology and information security framework to be periodically audited and verified by an independent and qualified auditor. The Regulatory Authority is the Capital Market Authority of Rwanda. The Law comes into force on the date of its publication in the Official Gazette. That publication is the Special issue of .
Law No. 023/2026 of 25/05/2026 regulating virtual asset business, Article 21(1)(b)
Article 21(1) of the Law requires a virtual asset service provider to notify the Regulatory Authority immediately, in writing, where it suspects or has reason to believe that a cyber-attack, including attempted events, that may affect operations and customers is likely to occur or has occurred. The same paragraph also requires immediate notice of the provider's involvement in criminal proceedings and of its opening or ceasing virtual asset business outside Rwanda. The Regulatory Authority is the Capital Market Authority of Rwanda. The Law comes into force on the date of its publication in the Official Gazette. That publication is the Special issue of .
The human-clinician-review requirement reached the statute book as article 3, section 6 of House File 4188, an omnibus commerce policy bill, after a conference committee's delete-everything substitute carried it forward once House File 2500 and Senate File 1856, two stand-alone bills on the same subject, had stalled in committee. The House repassed the conference committee report 121-13 on and the Senate 49-15 on ; the governor approved the act on , filed the same day as 2026 Minnesota Session Law chapter 124.
Article 6 (verification of registration numbers and orders to remove listings)
Regulation (EU) 2024/1028, Article 6
Article 2(1) applies the Regulation to providers of online short-term rental platforms that offer services to hosts providing short-term accommodation rental services in the Union, irrespective of their place of establishment, and to hosts providing short-term accommodation rental services. Article 3, point (5), defines an online short-term rental platform as an online platform within the meaning of Article 3, point (i), of Regulation (EU) 2022/2065 that allows guests to conclude distance contracts with hosts for the provision of short-term accommodation rental services. Article 6(1) and (2) let competent authorities verify, at any time after a registration number has been issued, the declaration and supporting documentation a host submitted, and give them the power to ask the host to rectify incomplete or incorrect information within a reasonable period they specify. Article 6(3) gives a competent authority, where a host fails to rectify the requested information or documentation, the power to suspend the validity of the affected registration number or numbers and to issue an order requesting online short-term rental platforms to remove, or to disable access to, any listing relating to the unit or units in question without undue delay. Article 6(4) gives a competent authority, where it finds manifest and serious doubts about the authenticity and validity of the information or documentation a host submitted, the power to suspend the validity of the affected registration number or numbers and to issue an order requesting online short-term rental platforms to provide further information to enable verification, or to remove, or to disable access to, any listing relating to the unit or units in question without undue delay. Article 6(5) requires a competent authority that intends to suspend or withdraw a registration number to notify the host in writing stating the reasons for that intention and to give the host the opportunity to be heard and, where appropriate, to rectify the information or documentation within a reasonable period. Article 6(6) gives a competent authority, where a host has failed through wilful misconduct or gross negligence to rectify the information requested, or has provided unauthentic or invalid information, the power to withdraw the registration number or numbers and to issue an order requesting online short-term rental platforms to remove, or to disable access to, any listing relating to the unit or units in question without undue delay. Article 6(7) requires an order under Article 6(3), (4), (6) and (11) to contain a statement of reasons, clear information enabling the provider of the platform to identify and locate the listing or listings concerned, such as one or more exact URLs and the identity of the competent authority, and, where available, the identity of the host and the registration number of the unit. Article 6(11) requires Member States, where a registration procedure applies, to ensure that national law enables competent authorities to order providers of online short-term rental platforms to provide the requested information and to remove listings concerning units offered without a registration number or with an invalid registration number, or in cases involving the misuse of a registration number. Article 15(2) makes the authorities designated by the Member State of the relevant single digital entry point competent to enforce Article 6, and Article 15(3) requires Member States to lay down rules on penalties, which must be effective, proportionate and dissuasive, applicable to infringements of Article 6 by online short-term rental platforms and, where appropriate, by hosts. Article 19 applies the Regulation from .
Articles 7 and 8 (compliance by design: registration numbers and random checks)
Regulation (EU) 2024/1028, Arts. 7-8
Article 7(1), point (a), requires an online short-term rental platform to design and organize its online interface in a way that requires hosts to self-declare whether the unit offered for short-term accommodation rental services is located in an area where a registration procedure has been established or applies. Article 7(1), point (b), requires it to design and organize the interface so that, when a host declares that the unit is in such an area, users can identify the unit through a registration number, to ensure that the host has provided a registration number before allowing the offering of the services for that unit, and to ensure that the host displays that number clearly as part of the listing. Article 7(1), point (c), requires it to make reasonable efforts to check at random, on a regular basis, the hosts' declarations about whether a registration procedure exists and, where one does, the validity of the registration number provided, through the functionalities of the single digital entry points, after allowing the offering of the services by the host. Article 7(2) requires it to inform the competent authorities and the hosts, without undue delay, of the results of the random checks concerning incorrect declarations of hosts, the misuse of a registration number or invalid registration numbers. Article 7(3) requires it to inform hosts adequately of the applicability in a given area of registration procedures, taking into consideration the lists Member States make available under Article 13 and the information in Annex I to Regulation (EU) 2018/1724. Article 8 requires it, upon receiving the self-declaration referred to in Article 7(1), point (a), and before allowing the host to use its services, to make best efforts, using the lists Member States make available under Article 13(1), point (a), to assess whether the self-declaration is complete, provided the assessment can be carried out in a proportionate manner by automated tools, and provides that this gives rise to no general monitoring obligation. Article 15(1) applies Chapter IV of Regulation (EU) 2022/2065 to the enforcement of Article 7(1) and Article 8, reads references in that Chapter to compliance with the relevant provisions of that Regulation as including Article 7(1) and Article 8, and extends the Commission's powers under that Chapter to their application. Article 15(2) and (3) make the authorities designated by the Member State of the relevant single digital entry point competent to enforce Article 7(2) and (3), and require Member States to lay down effective, proportionate and dissuasive penalty rules for infringements of Article 7(2) and (3) by online short-term rental platforms. Article 19 applies the Regulation from .
Covered platforms' 48-hour notice-and-removal obligation becomes enforceable, and the FTC begins sending compliance and warning letters to major platforms.
Proper Conduct of Banking Business Directive 364 (Management of IT, Information Security, and Cyber Protection Risks), sections 10, 28, 106 and 171
Section 10.1 of Directive 364 applies it to a banking corporation, to the corporations stated in sections 11(a)(3a), 11(a)(3b) and 11(b) of the Banking (Licensing) Law, and to a payment services provider with prudential importance. Section 28 of Directive 364 requires a banking corporation to appoint a senior employee as the Chief Cyber Defense and Information Security Officer, who is responsible for monitoring and ensuring that the banking corporation complies with the information security management framework. Section 106 of Directive 364 requires a banking corporation to refer in its information security and cyber defense policy to identity management controls and logical access management controls and to monitoring and managing information security incidents, among other issues. Section 116.1 of Directive 364 requires a banking corporation to establish identity management and logical access management controls. Section 171.1 of Directive 364 requires a banking corporation to report technological failure incidents and information security incidents to the Supervisor of Banks pursuant to Directive 366. The Banking Supervision Department published Directive 364 on . Circular C-06-2847 states that Directive 364 entered into force on and repealed, among others, Directive 357 on Information Technology Management and Directive 361 on Cyber Defense Management. Section 5(c1) of the Banking Ordinance lets the Supervisor promulgate proper conduct of banking business directives pertaining to the operating and management methods of a banking corporation. Section 14h(a)(1) of the Banking Ordinance lets the Supervisor impose a financial sanction of one million NIS on a banking corporation that contravened a proper conduct of banking business directive. The English publication of Directive 364 states that only the Hebrew text is binding.
Decreto por el que se reforman y adicionan diversas disposiciones de la Ley Federal del Trabajo y de la Ley Federal del Derecho de Autor, en materia de derechos de las personas trabajadoras artistas intérpretes o ejecutantes, Diario Oficial de la Federación, 14 de mayo de 2026 (arts. 305 Bis LFT; 87, 102, 118 fracción VII, 121 LFDA)
The decree amending the Ley Federal del Trabajo and the Ley Federal del Derecho de Autor was published in the Diario Oficial de la Federación on ; its first transitory article sets the decree's own commencement the day after publication.
Senate Bill 26-189, signed , repeals and reenacts part 17 of title 6 of the Colorado Revised Statutes, replacing the original Colorado AI Act's risk management and impact assessment duties with a notice and disclosure regime for automated decision-making technology. The new duties become operative .
SB 8 was approved by the Governor on as Chapter 445, amending Crim. Law §8-301 to reach fraudulent use of artificial intelligence or a deepfake representation to impersonate or falsely depict a person. The Act takes effect .
Loi du 5 mai 2026 concernant des mesures destinées à assurer un niveau élevé de cybersécurité
The Loi du 5 mai 2026 concernant des mesures destinées à assurer un niveau élevé de cybersécurité, transposing Directive (EU) 2022/2555 (NIS2), was signed on , published in the Journal officiel du Grand-Duché de Luxembourg (Mémorial A, No. 225) on , and entered into force on under Legilux's own record for the act. Its Article 30 repeals Luxembourg's prior NIS1 transposition, the loi du 28 mai 2019.
Incident Notification
Loi du 5 mai 2026 concernant des mesures destinées à assurer un niveau élevé de cybersécurité, Art. 14
H.F. No. 1606 passed the House 132-1 and the Senate 65-0, was presented to Governor Walz on , and received the governor's approval on , filed by the Secretary of State the same day as 2026 Minnesota Session Law chapter 72.
Arts. 24-25 of the Implementation Rules of Internal Audit and Internal Control System of Financial Holding Companies and Banking Industries (金融控股公司及銀行業內部控制及稽核制度實施辦法), full-text revision promulgated (Financial Supervisory Commission Order Jin-Guan-Yin-Guo-Zi No. 11502710961), effective on promulgation for the articles cited here
Article 24 of the Financial Supervisory Commission's internal-control regulation for financial holding companies and the banking business requires each to 'establish a dedicated information security unit subordinate to the general manager, which shall not concurrently handle information technology operations or other operations that present a conflict of interest with its duties,' headed by 'a person ranked vice general manager or above, or a person with equivalent responsibilities' serving as Chief Information Security Officer.
That officer 'shall report the overall implementation of information security from the preceding year to the board of directors each year'.
The full-text revision issued on took effect on the date of issuance, except for Articles 44 to 47. Article 25 requires the dedicated unit to take charge of 'the planning, management, and execution of the information security system to manage information security risks' and to build 'mechanisms related to cyber security protection, assessment and response to cyber security intelligence, and reporting of and response to cyber security incidents.'
Safe Drinking Water Act, emergency response plan with cybersecurity measures for a community water system
Utah Code 19-4-117(2)
A supplier of a community water system serving a population of 3,300 or greater must complete an emergency response plan by , and by July 1 annually thereafter. A supplier of a community water system serving a population less than 3,300 must complete an emergency response plan by , and annually thereafter. The plan must include a requirement to support and regularly update software used in a control system. The plan must include a requirement to provide annual cybersecurity training to an employee who has regular access to an operational technology or control system. The plan must include a requirement to complete an internal assessment of the system's security vulnerabilities and implement corrective controls. A supplier must report to the division on or before July 1 of each year whether it has completed an emergency response plan.
Safe Drinking Water Act, report of a security breach at a community water system
Utah Code 19-4-117(3)
A supplier of a community water system must report a security breach to the Utah Cyber Center no later than two hours after the supplier discovers it. A security breach is an incident that threatens the security of a community water system with the potential to impact the quality or quantity of delivered water. A security breach includes a breach of an operational technology or control system and an unauthorized attempt to delete, disable, destroy or override data, an application, a device or a computer network. The Utah Cyber Center must notify the division of a reported security breach not later than one day after receiving the report from the supplier. The section was enacted by Chapter 16 of the 2026 General Session.
Identity Protection Modifications, AI Defamation and Identity Replication (SB 256, 2026 General Session)
Utah Code 45-2-3.5, 45-2-14, 45-3-2 to 45-3-7, as amended
SB 256 (2026 General Session), effective , enacts Utah Code 45-2-3.5 to provide that it is not a defense to a libel or slander claim that the communication was created through generative artificial intelligence, computer animation, digital manipulation, or another technological means, or that it uses simulated content rather than an actual recording. A new Section 45-2-14 requires written notice to the publisher before filing such an action and limits recovery to actual damages if the publisher removes the content within 10 days of notice. The bill also amends Title 45 Chapter 3, the Abuse of Personal Identity Act, so that every individual's exclusive right to consent to use of their personal identity includes a replication right reaching an AI-generated, computer-animated, or digitally manipulated simulation of their likeness or voice; a person whose identity is abused, including through unauthorized distribution of or trafficking in identity-replication tools, may sue for injunctive relief, damages, exemplary damages, and attorney fees. The chapter does not impose liability on an interactive computer service for content provided by another person.
Utah Consumer Sales Practices Act, deceptive act or practice by a supplier
Utah Code Ann. § 13-11-4
Section 13-11-4 provides that a supplier that engages in a deceptive act or practice in connection with a consumer transaction violates the Utah Consumer Sales Practices Act, whether the deceptive act or practice occurs before, during, or after the transaction.
Utah Health Data Authority, direct identifiers and minimum necessary use
Utah Health Data Authority, Utah Code 26B-8-501(2) and (4) and 26B-8-501.1(9)
Utah Code 26B-8-501.1(9)(a)(i) requires the department, for identifiable health data, to use the minimum necessary data to accomplish its duties under the Utah Health Data Authority part. Utah Code 26B-8-501.1(9)(a)(ii) allows the department to use direct identifiers only for quality assurance, referential integrity, complying with breach notification requirements, calculating the distance between addresses or linking external geographically-based data, and identity resolution. Utah Code 26B-8-501.1(9)(b) bars the department from sharing any part of an individual's social security number received with data obtained under the Utah Health Data Authority part. Utah Code 26B-8-501(2) defines a control number as a number or other identifier that the department assigns to identifiable health data, that is consistent with the best practices of data privacy, and that is used to ensure health data is not able to be readily associated with an individual when it is provided for research or statistical analysis.
Utah Health Data Authority, identifiable health data and re-identification
Utah Health Data Authority, Utah Code 26B-8-507 to 26B-8-509
Utah Code 26B-8-507(1)(c) bars a person from attempting to identify or re-identify an individual using data obtained under the Utah Health Data Authority part, including through data linking or correlation, except as sections 26B-8-506 and 26B-8-508 allow. Utah Code 26B-8-508(5) bars a person who accesses identifiable health data under the Utah Health Data Authority part from further disclosing it without the department's prior approval and unless it is disclosed or identified by control number only, and requires that person to delete it at the earlier of the end of the specified period or the day the person's need for it ceases. Utah Code 26B-8-509(1) makes any use, release, or publication of health care data contrary to sections 26B-8-507 and 26B-8-508 a class A misdemeanor.
Governor Reynolds signed Senate File 2417, establishing Iowa Code chapter 554J and requiring conversational AI operators to disclose AI status, protect minor users, and adopt crisis referral protocols. Every duty in the chapter is deferred to by the Act's own applicability section.
Officially Politische-Werbung-Gesetz (PolWG), Political Advertising Transparency and Targeting
PolWG, BGBl. I Nr. 21/2026, §§ 1-11
The Politische-Werbung-Gesetz regulates the implementation in Austria of the obligations that arise from Regulation (EU) 2024/900 on the transparency and targeting of political advertising. Section 2(1) designates KommAustria as the competent authority, the penalty authority for section 6 and the national contact point under Article 22(9) of the Regulation. Section 6(1) fines a provider of political advertising services with up to 20,000 euro for negligence and up to 50,000 euro for intent for the breaches it lists. Section 6(2) fines a sponsor with up to 50,000 euro for negligence and up to 100,000 euro for intent for the breaches it lists. Section 6(3) fines a publisher of political advertising with up to 20,000 euro for negligence and up to 50,000 euro for intent for the breaches it lists, which include the provision of a political advertisement with the information Article 11 requires, the transparency notice under Article 12, archiving and access under Article 13 and the notification procedure under Article 15. Section 6(4) fines a controller that fails to take appropriate measures to transmit information free of charge under Article 20 of the Regulation, with up to 20,000 euro for negligence and up to 50,000 euro for intent. Section 6(5) fines a provider of political advertising services with up to 100,000 euro for providing its services contrary to Article 5(2) of the Regulation or for designing its contracts contrary to Article 7(2). Section 6(6) fines a publisher of political advertising with up to 100,000 euro for continuing to provide a political advertisement after finding or being told that its transparency notice is incomplete or incorrect, and with up to 500,000 euro where a very large online platform or very large online search engine fails to archive political advertisements as Article 13(2) provides, lacks the notification procedure Article 15(1) to (4) requires or fails to meet the obligations under Article 15(5). Sections 1 to 5 and 7 to 10(1) have applied since , and section 6 since to facts occurring after .
transparency, technical marking and labeling of AI-generated content
Decree No. 142/2026/ND-CP, arts. 16-18
A provider and a deployer must give information on the system's purpose of use, scope, conditions of use and limits. They must keep the information and documents needed for inspection and supervision. They must explain themselves when the competent state agency asks in writing. A provider must apply a technical solution so that audio, image or video output is marked in a machine-readable format. A provider need not apply machine-readable marking to text output unless another law requires it. The provider must keep the marking function working while content is created, exported and supplied within the functions the system controls. A provider of an open-source or free system meets the marking duty by building in the marking function or by publishing the tools, standard configuration, interface or technical documents that let a deployer set it up. A deployer that uses such a system to supply content to the public must apply a technical solution to mark the output. A deployer must give clear notice when it makes available to the public AI-generated or AI-edited content that could confuse people about the authenticity of an event or a person or about the origin of the content. A deployer must attach an easily recognizable label to AI-made or AI-edited audio, images or video that simulate a real person's appearance or voice or recreate a real event, to tell them apart from real content. The notice or label must be given before or at the time the recipient reaches the content. It must not be designed to hide or weaken recognition of the content's nature. A deployer need not label content that is used only inside the organization and is not made available to the public. The Decree takes effect on .
A serious incident includes an event in the operation of an AI system that causes loss of life or serious harm to a person's health. A deployer and a user must promptly record a serious incident, take the measures needed to limit its consequences and notify the provider. A provider must apply the technical measures needed to prevent, limit and remedy the consequences of the incident. A provider or deployer must file a preliminary report through the one-stop AI portal within 72 hours of confirming an urgent serious incident, meaning one under points a and d of Article 19(1) or an uncontrollable one under point c. For any other serious incident the preliminary report is due within five working days of confirmation. The time of confirmation runs from when the reporting person has enough initial information to establish that the incident really happened and probably stems from a fault of the AI system, without waiting for a full investigation of the technical cause. A deployer that cannot reach the provider must make the report itself. A provider and a deployer must keep the system logs, data and information on the incident for verification, assessment and remedy. They must send the competent state agency a formal report on the remedy within 15 days of the preliminary report. The Decree takes effect on .
risk classification, notification, conformity assessment and risk management
Decree No. 142/2026/ND-CP, arts. 6, 9, 11-15
A provider must classify its AI system itself before putting it into use, and answers before the law for the accuracy and truthfulness of the result. A system that is not classified as high risk but falls within Article 9 of the Decree is classified as medium risk. Article 9 reaches a system that can confuse, influence or manipulate users because they cannot tell that they are dealing with an AI system or with content it made. A deployer must work with the provider to re-classify a system when its own modification, integration or change of function or purpose creates a new or higher risk. When re-classification finds a higher risk level, the provider or deployer must notify the competent state agency within 15 working days of finishing the review and apply the matching risk-management measures at once. A provider must prepare a risk classification dossier for a high-risk or medium-risk system before putting it into use. A provider or deployer must keep the classification dossier for as long as the system operates. A provider of a medium-risk or high-risk system must notify the classification result to the Ministry of Science and Technology through the one-stop AI portal before putting the system into use. A provider of a high-risk system must complete a conformity assessment before putting it into use. The provider must repeat the assessment when a significant change affects the original result. A system on the list of high-risk systems that need certification before use must be assessed through a conformity assessment organization. A provider that assesses a high-risk system itself must prepare a technical dossier and answers before the law for the result. A provider must publish the conformity assessment result on the one-stop AI portal before putting the system into use and when a re-assessment updates it. A provider of a high-risk system must set up and maintain a risk-management system suited to the system's purpose, scope and risk level. The provider must design and maintain a mechanism for human oversight and intervention suited to the system's risk level. A provider must give the deployer the information it needs on the system's purpose, safe operating conditions, identified risks and matching risk measures. A deployer of a high-risk system must operate it within the purpose, conditions and limits of use that the provider sets. A deployer that finds a system at risk of serious harm must promptly limit the risk within its control and notify the provider and the competent state agency. The Decree takes effect on .
Rule 3362-5-12 of the Ohio Administrative Code makes university offices responsible for ensuring that their web pages within the campus web content management system, and those outside it but officially connected to shawnee.edu, meet standards of accessibility conforming to section 504 of the Rehabilitation Act of 1973. The current version of the rule took effect .
Statement on Progress Towards Regulations Restricting Children's Access to Internet Services
Children's Wellbeing and Schools Act 2026, c. 21, s. 71
Section 71 requires the Secretary of State, before the end of the period of three months beginning with the day the Act is passed, to lay before Parliament a statement setting out what progress has been made towards making the first regulations under section 214A(1) of the Online Safety Act 2023 and a timeline for making them. The timeline must provide for the first regulations to be laid before Parliament before the end of the period of 12 months beginning with the day the statement is laid. If the first regulations have not been laid by then, the Secretary of State must lay a statement explaining why and must lay the first regulations before Parliament within six months of that statement. The Act was passed on , and section 71 came into force on the day it was passed.
Power to Amend the Online Safety Act 2023 for Illegal AI-Generated Content (New Section 216A), with Progress Report Duty
Crime and Policing Act 2026, c. 20, ss. 248-249, inserting s. 216A into the Online Safety Act 2023
Section 248 of the Crime and Policing Act 2026 inserts section 216A into the Online Safety Act 2023, and the section came into force at Royal Assent. Section 249, which requires a progress report on regulations under section 216A, also came into force at Royal Assent. Royal Assent was given on . Section 216A(1) lets the Secretary of State by regulations amend any provision of the Online Safety Act for or in connection with minimizing or mitigating the risks of harm to individuals in the United Kingdom presented by illegal AI-generated content and by the use of AI services for the commission or facilitation of priority offenses. In section 216A, 'AI' is short for artificial intelligence. An 'AI service' is an internet service that is capable, or part of which is capable, of generating AI-generated content, no matter what proportion of the content on the service is AI-generated. The regulations may impose on providers of AI services the duties that sections 9 and 10 of the Online Safety Act impose on providers of regulated user-to-user services, and those that sections 26 and 27 impose on providers of regulated search services, or duties corresponding or similar to them. The regulations may also impose on providers of AI services the fraudulent advertising duties of sections 38 and 39 and the requirement in section 66 to report child sexual exploitation and abuse content, or corresponding or similar requirements. The regulations may confer on Ofcom, in relation to AI services, functions corresponding to its fees, information and enforcement functions, including powers to impose monetary penalties. The regulations may make provision having the effect that AI services provided from outside the United Kingdom are regulated by the Act. The regulations may not amend section 234 of the Online Safety Act ('harm' etc). Section 249 requires the Secretary of State to lay before Parliament, no later than , a report about the progress made towards making regulations under section 216A, unless a draft of a statutory instrument containing regulations under that section is laid before Parliament before that date.
HB 895 (2026 Regular Session) was approved by the Governor on as Chapter 154, adding §13-321 and §13-322 to the Commercial Law Article. The Act takes effect .
OSP Memorandum 26-04, ADA Web Accessibility Compliance Requirements for Procurement Documents
Office of State Procurement Memorandum 26-04 requires every document that a state agency submits to the Office of State Procurement for posting as an attachment to a solicitation to comply with WCAG 2.1, Level AA, from . The requirement covers attachments to solicitations posted to the Louisiana Procurement and Contract Network, Louisiana eProcurement Solutions by Ariba and other platforms the Office of State Procurement manages. The Office of State Procurement does not post or link a document to any of its web applications unless the submitting agency has submitted it as an Adobe PDF, Microsoft Word or Microsoft Excel file, run the built-in Accessibility Checker and resolved all identified issues, used the attached ADA Web Accessibility Document Checklist, and provided an affirmative statement of compliance in the Approval Notes and Attachment Utility section of LaGov. A failure to comply may delay the requested procurement action until all submitted documents meet the accessibility requirements. The memorandum is addressed to the agency heads, undersecretaries, business managers and contract officers of all state departments and agencies, colleges and universities, boards and commissions. The memorandum is dated .
Information Technology Access Act: accessibility of information and communications technology used by state agencies, public school divisions, public institutions of higher education and political subdivisions
Va. Code Ann. §§ 2.2-3500 to 2.2-3502, 2.2-3504 and 2.2-3505
The Information Technology Access Act, chapter 35 of Title 2.2 of the Code of Virginia, applies to every covered entity, which means all state agencies, public school divisions, public institutions of higher education, and political subdivisions of the Commonwealth. The head of each covered entity or the head's designee must ensure that the accessibility of the information and communications technology used by employees, program participants, students, or members of the general public who have a disability is equivalent to that provided to individuals who do not have a disability, is designed to present information in formats accessible or adaptable to both persons with and without disabilities, and conforms with the accessibility requirements of 28 CFR 35.200, whether developed in-house or procured. Accessibility means alignment with federal Section 508 standards and Section 255 guidelines and with 28 CFR 35.200. The federal rule at 28 CFR 35.200 that the Act names requires a public entity's web content and mobile apps to comply with the Level A and Level AA success criteria and conformance requirements specified in WCAG 2.1. Information and communications technology means any website, application, or other product or service primarily intended to fulfill or enable the function of information processing and communication by electronic means, including transmission and display via the Internet. The head of a covered entity or the head's designee must report to the appropriate executive branch agency any ICT that does not conform with accessibility and is not within the exceptions in 28 CFR 35.201 or in appendix A, section E202, of 36 CFR part 1194. Each executive branch agency must report annually to the General Assembly on such ICT and give an estimate of the fiscal impact of bringing it into compliance with federal and state laws and regulations. Each covered entity must publish, in a conspicuous and easily accessible location on its website, the name, phone number, email address, and office address of its digital accessibility coordinator or other person to whom reports of barriers to digital accessibility may be made, and that person must develop procedures to review and respond to such reports. The head of a covered entity or the head's designee may designate an employee as digital accessibility coordinator, who is responsible for ensuring that the entity complies with state and federal laws, including the Virginians with Disabilities Act and the Virginia Human Rights Act, so that its ICT and other products or services can be accessed by persons with disabilities. Section 2.2-3502 dates from Chapters 769 and 773 of the 1999 Acts of Assembly, and Chapter 571 of the 2025 Acts of Assembly amended it. Chapter 571 of the 2025 Acts of Assembly applies these provisions to a covered entity with a population of 50,000 or more persons, to institutions of higher education and to state public bodies beginning . It applies them to special district governments and to covered entities with a population of less than 50,000 persons beginning . A local school district takes the date that applies to the locality within which it sits.
Information Technology Access Act: the accessibility certification a vendor gives in a covered entity's procurement of information and communications technology
Va. Code Ann. § 2.2-3503
The Secretary of Administration must develop an information and communications technology access clause that requires the vendor to certify that any product procured by a covered entity conforms with accessibility. If the vendor cannot certify conformance, the covered entity may require a current vendor-paid and completed Accessibility Conformance Report indicating the level of conformance of the ICT being procured. Any areas of nonconformance must be documented in a vendor-paid and completed Vendor Accessibility Roadmap that highlights the areas requiring improved accessibility, including a timeline for each nonconforming area's completion. An Accessibility Conformance Report is a completed Voluntary Product Accessibility Template or other document indicating a product's conformance to accessibility standards such as the federal Section 508 standards and Section 255 guidelines, completed by a digital accessibility subject matter expert with significant experience with product evaluation or by a qualified neutral third party. The clause should allow the adoption of non-accessible ICT, provided that its use does not result in individuals with disabilities being denied the benefit of any program, service, or activity provided by the covered entity. The clause must be included in all future contracts for the procurement of ICT by, or for the use of, covered entities for which negotiation or renegotiation begins on or after the effective date of the chapter. The procurement procedure does not supersede or conflict with any vendor procedure or policy that a public institution of higher education adopts under the Restructured Higher Education Financial and Administrative Operations Act. The clause applies only to contracts entered into or renewed on or after the dates on which the Act applies to the covered entity, in accordance with the third and fourth enactments of Chapter 571 of the 2025 Acts of Assembly.
Del. Code Ann. tit. 24, §§ 1720(k)-(l), 1773(d), 1920(h)-(i) (enacted as House Bill 191, 153rd General Assembly, 85 Del. Laws, c. 250)
The Delaware General Assembly's bill detail record for House Bill 191 (153rd General Assembly) shows Progress Status “Signed 4/23/26,” Volume:Chapter 85:250, and Effective Date 4/23/26.
81 straipsnis, Lietuvos Respublikos elektroninių ryšių įstatymas Nr. IX-2135
Article 81, paragraph 1 of the Electronic Communications Law allows the use of electronic communications services, including sending electronic mail messages, for direct marketing only with the prior consent of the subscriber or registered user of public electronic communications services. That consent is not needed where the subscriber or registered user is a legal person, who must instead be given a clear, free and easily exercised possibility to refuse further use of electronic communications services for direct marketing. Under paragraph 2, a person who obtains electronic mail contact details from a customer who is a natural person in the course of providing services or selling goods may use them to market its own similar goods or services, if the customer is offered a clear, free and easily exercised possibility to refuse at the time of collection and, unless the customer objected at first, in every message sent. Paragraph 3 prohibits sending electronic mail for direct marketing that conceals the identity of the sender on whose behalf the information is sent, in breach of the requirements of the Law on Information Society Services, that gives no valid address at which the recipient can demand that sending stop, or that encourages recipients to visit websites that do not meet those requirements. Article 81 was amended by Law No. XV-815 of , published on . Article 14(1) of Law No. XV-815 sets as the date for the Law except its Article 10, which set Article 81 out anew. The register of consolidated texts shows the edition containing that change from .
Article 2 requires providers of intermediary services to comply, within the time the orders set, with the orders of the competent judicial authorities or administrative bodies to act on illegal content, to give information on specific individual recipients, and to supply lists of recipients or information on a group of unidentified recipients. Article 5(1) designates the Autoridade Nacional de Comunicações (ANACOM) as the competent administrative authority and as the Digital Services Coordinator. Article 5(5) designates the Entidade Reguladora para a Comunicação Social (ERC) as the competent administrative authority for Article 14(3), Article 26(1) and (2) and Article 28(1) of the Regulation, and Article 5(6) designates the Comissão Nacional de Proteção de Dados (CNPD) for Article 26(3) and Article 28(2). Article 6(1)(a) lets the Coordinator require providers of intermediary services, and other persons who may know of a suspected infringement, to provide information without undue delay and within the time fixed. Article 7(a) lets the Coordinator, once its other powers are exhausted, notify the management body of a provider in writing to analyze the situation, present an action plan, ensure its implementation and report on it. Article 18(1)(e) and (f) make it an administrative offence to fail to designate a single point of contact or to fail to publish the information needed to identify and reach it. Article 20(2) sets the maximum fine for the offences it lists, including those in points e) to k) of Article 18(1), at 6 percent of a legal person's worldwide annual turnover in the preceding financial year, or 6 percent of a natural person's income in the preceding year. Article 20(1) sets the maximum fine for the offences in points a) to d) and l) of Article 18(1), among others, at 1 percent of the same base. Article 28 lets the Coordinator impose a compulsory penalty payment of up to 5 percent of average daily worldwide turnover or income per day, for no more than 30 days. Article 35 repeals Articles 12 to 19 of Decreto-Lei n.º 7/2004 and Decreto-Lei n.º 20-B/2024. The Act took effect on .
Act 900 of 2025 (SB611), amending Ark. Code Ann. § 4-88-1401 et seq.
By NetChoice, LLC v. Griffin, United States District Court for the Western District of Arkansas
On NetChoice's motion, the Western District of Arkansas preliminarily enjoined the defendants from enforcing the provisions of Act 900 against NetChoice's members, pending final disposition of the issues on the merits. The court found that NetChoice is likely to succeed on its vagueness challenge to the addictive practices provision. It found that NetChoice is likely to succeed on its First Amendment challenges to the other provisions even under intermediate scrutiny, and that the default provisions likely violate the First Amendment. It also found the dashboard provision unlikely to survive even under the lenient standard the State asked the court to apply.
Decreto n.º 14/2026, de 17 de Abril (Conselho de Ministros, Mozambique), Boletim da República, I Série, n.º 72, arts. 1 to 12
Decreto n.º 14/2026, de 17 de Abril, issued by the Council of Ministers and published in the Boletim da República, I Série, n.º 72, creates the National Commission for Artificial Intelligence (CNIA) (art. 1). The Decree makes the CNIA a consultative and technical-advisory body to the Government on scientific, technological, innovation and information-security matters related to artificial intelligence (art. 2(1)), subordinate to the Council of Ministers (art. 5). The CNIA advises the Government and issues opinions on AI policies, strategies, action plans and legal and regulatory proposals (art. 6(1)); the Decree gives it no power to bind a private developer or deployer of an AI system, and states no penalty. The Executive Secretariat is the ICT regulatory authority (art. 9(2)). The CNIA must publish its activity reports, opinions and recommendations every six months on a publicly accessible digital platform (art. 6(1)(v)). The Decree entered into force on the date of its publication (art. 12).
Election Finances and Contributions Disclosure Act, R.S.A. 2000, c. E-2, ss. 44.9499995, 44.971, 51.01
Bill 23, the Justice Statutes Amendment Act, 2026, received Royal Assent on and added Part 6.21 (Deepfakes) to the Election Finances and Contributions Disclosure Act.
17-A M.R.S. sections 281 to 284 (P.L. 2025, c. 719)
Maine amended its sexual exploitation of minors, dissemination, and possession offenses so that child sexual abuse material includes any image, including a computer-generated image, that depicts or has been created or modified so that it appears to depict a minor engaged in sexually explicit conduct, whether or not the depiction is of an identifiable child. Intentionally or knowingly modifying or altering an image of an identifiable child to create child sexual abuse material is a Class B crime. Intentionally or knowingly manufacturing or creating obscene child sexual abuse material, including by using generative AI or machine learning, when the person knows or has reason to know what it is, is also a Class B crime. Intentionally or knowingly disseminating, or possessing with intent to disseminate, obscene child sexual abuse material, including an image created using generative AI or machine learning, is a Class C crime. LD 524 was enacted as Public Law chapter 719. The Governor approved it on . It is an emergency act that takes effect when approved.
Ordonnance n°0011/PR/2026, art. 14, 16-24 et 53 (protection des mineurs), du 26 février 2026 portant réglementation de l'usage des réseaux sociaux
Ordonnance n°0011/PR/2026 sets Gabon's digital age of majority at sixteen and prohibits creating an account or profile on any online communication service, social network, or digital platform for a minor under that age, with a narrow carve-out for educational, cultural, or scientific directories, free and open-source software development and sharing platforms, and pedagogical content consulted at school with a teacher's supervision and the parent's express consent. The person holding parental authority is liable for what a minor under sixteen does on a social network or platform in their charge, and that person may have data about the minor erased. Pornographic content is barred to a minor under eighteen, and the Haute Autorité de la Communication publishes and enforces a technical référentiel setting the minimum requirements an age-verification system must meet, entrusting technical audits of those systems to itself or to the Autorité de Régulation des Communications Electroniques et des Postes (ARCEP) or another independent body with proven expertise. Within twelve months of the ordinance's publication, every social-network or digital-platform editor must deploy an effective technical mechanism to verify a user's age at registration. The editor must block or suspend posting, sharing, and social-interaction features for an account identified as belonging to a user under sixteen unless parental consent is formally registered, disable by default any feature letting an unidentified person contact a minor's account directly, filter out algorithmic recommendation of AI-generated violent, sexual, or psychologically harmful content to accounts identified as minors, and report quarterly on the number of minor accounts detected, blocked, or removed and the verification methods used. A user's own false declaration of age does not relieve the platform of this duty of reasonable vigilance. An editor must also acknowledge a cyberbullying report or a report of harmful content involving a minor within twenty-four hours and decide and notify the user within seventy-two hours.
The Missouri State ICT Standard 3.0, approved by the Missouri Assistive Technology Advisory Council on , names WCAG 2.2 Level A and AA as its current guideline version. The standard applies to the content of public sites, applications, intranets and agency internal communications. Section 161.935 requires accessibility in the development, procurement, maintenance or use of information and communication technology. Section 161.935.3(1) directs the council and the office of information technology services division to adopt accessibility standards to be used by each state department or agency in procuring information technology and in developing and implementing custom-designed information technology systems, websites and other emerging information technology systems.
120 days after its publication, Decreto-Lei n.º 125/2025 entered into force on , repealing the Regime Jurídico da Segurança do Ciberespaço (Lei n.º 46/2018) on the same date.
Cybersecurity Risk-Management Measures and Governance
Decreto-Lei n.º 125/2025, de 4 de dezembro, Artigos 25.º a 29.º
The Act defines an adult film as a film that has, as its main object, the depiction of explicit sexual activity, or a film that contains prescribed scenes. A film is a moving image, other than a video game, and includes videotapes, video discs, film or electronic files. To exhibit a film is to show, project or otherwise display it for viewing by the public. No person may exhibit an adult film to a person who is under 18 years of age. No person may permit a person who is under 18 years of age to handle, have access to or view an adult film. No person may exhibit an adult film, or sell, rent or otherwise make available a physical copy of one, unless an entity authorized to approve adult films under the laws of a province or territory of Canada, or another prescribed entity, has reviewed and approved the film. A person who sells, rents or otherwise makes available physical copies of adult films and of no other films must display a sign reading "No admittance to persons under 18 years of age" at all entrances to the business premises and must not allow a person under 18 years of age to enter the premises. Where such a person also sells, rents or makes available physical copies of other films, the adult films and their advertising material must be segregated from the area in which persons under 18 years of age are allowed. Section 3 of the Act, which requires a person exhibiting a film to display information about the film and its content, does not apply to adult films. The Act came into force on .
Inimgeeniuuringute seadus, RT I, 17.03.2026, 1, §§ 4, 24 and 26
Section 6 of the Inimgeeniuuringute seadus (Human Genetic Research Act) names the University of Tartu as the controller of the gene bank (geenivaramu). Section 24(3) requires the controller to replace, in a donor's tissue sample and personal data, all data that allow the donor to be identified directly with a pseudonym. Section 24(4) requires the controller, the authorised processor and the controller of a research study to mark tissue samples and personal data, including the family tree, with the pseudonym assigned by the controller of the gene bank. Section 12(2) bars the controller from giving an authorised processor the right to pseudonymise and depseudonymise the personal data of gene donors. Section 26(1) allows the controller to depseudonymise a gene donor's personal data without an assessment by the research ethics committee only in the cases the paragraph lists.
Decreto n.º 71/2025, art. 14 (Regulamento de Centros de Dados)
Article 14 of the Data Centre Regulation requires a data centre to sit in a secure zone under continuous surveillance, with the surveillance record kept for at least 90 days. Article 14 requires a data centre to have separate functional spaces under restricted access control with access records. Article 14 requires multi-factor authentication to enter the critical areas of a data centre. Article 14 requires a data centre to run an incident-management system with documented response plans for physical incidents. Article 14 requires that system to provide for notice of breaches to the regulatory authority and to the data centre's users within defined deadlines. Article 14 requires physical and logical redundancy that guarantees recovery, availability and continuity of the services given to users. Article 14 requires cyber-security measures, including protection of the internal networks used for control systems and network segmentation to isolate critical devices. Article 51(1) of the Regulation makes a contravention punishable by a fine of 40 to 60 minimum wages for an individual and 90 to 150 minimum wages for a legal person. Among the contraventions Article 51(1) lists, item (i) is a failure to meet the security obligations of Article 14. Article 54 gives a data centre already operating when the Regulation enters into force one year from that date to adapt to it. The Decree approving the Regulation enters into force 90 days after its publication.
incident notice for data centres serving essential services
Decreto n.º 71/2025, art. 24 (Regulamento de Centros de Dados)
Article 24(1) requires a data-centre operator that serves customers operating essential services to tell them and the regulatory authority, through the Portal and within 24 hours, of an incident that affects or may affect the regular provision of the contracted services, and of its actual or likely impact. Article 24(2) leaves the minimum content of that notice to technical instructions of the regulatory authority. Article 21(1) lists the essential-service sectors as public administration, internal security, national defence, public water supply, health, education, postal, energy, electronic communications, transport and finance. Article 51(1) of the Regulation makes a contravention punishable by a fine of 40 to 60 minimum wages for an individual and 90 to 150 minimum wages for a legal person. Among the contraventions Article 51(1) lists, item (k) is a failure or delay in notifying incidents in the operation of a data centre that serves customers operating essential services. The Decree approving the Regulation enters into force 90 days after its publication.
Law on Intellectual Property (Law No. 50/2005/QH11), art. 7(5)
Article 7(5) permits organizations and individuals to use lawfully published texts and data that the public may access for scientific research, testing and training of artificial intelligence systems, on condition that the use does not unreasonably affect the lawful rights and interests of the author or owner. For texts and data protected by copyright and related rights, the use must also follow the Government's regulations. The paragraph was added by Law No. 131/2025/QH15 with effect from .
Senate Bill 1297 passed the Senate 21-12-2 and the House 54-12-4 and was signed by the Governor on , as Session Law Chapter 249; by its own terms the Act takes effect . Because Title 48 Chapter 21 had already been assigned the same session to the Stop Harms from Addictive Social Media Act, the Idaho Statutes site carries this Act as Chapter 21 [22] and renumbers its sections 48-2101 through 48-2105, as drafted in the enacted bill, to 48-2201 through 48-2205.
Executive Order N-5-26 is an order of the Governor of California, dated . Paragraph 1 has the Department of General Services and the Department of Technology submit recommendations to the Governor for new certifications that may be incorporated into state contracting processes. The certifications would allow entities seeking to do business with the state to attest to and explain their policies and safeguards to protect public safety while preventing the misuse of their technologies. The Order names exploitation or distribution of illegal content such as child sexual abuse material and non-consensual intimate imagery, models that display harmful bias or lack governance to reduce the risk of such bias, and violation of civil rights and civil liberties. Paragraph 2 has the State Chief Information Security Officer review any new designation of a company as a supply chain risk by the federal government. If the State Chief Information Security Officer concludes that the designation is improper, the Department of General Services and the Department of Technology will jointly issue guidance ensuring that departments and agencies can continue to easily procure from that company. Paragraph 3 has the Government Operations Agency submit recommendations on reforms to contractor responsibility provisions, including suspension and ineligibility authorities. Paragraph 4 has the Government Operations Agency and the bodies it names publish a data minimization toolkit for departments and agencies with best practices, templates, special contract provisions and program review checklists. Paragraph 5 has the Department of Technology issue best practice guidance for departments and agencies to appropriately watermark AI-generated or significantly manipulated images or video. The Order does not create any rights or benefits, substantive or procedural, enforceable at law or in equity against the State of California or any other person.
Article 2(1) makes the Polícia Judiciária (PJ) the competent authority to issue the removal or blocking decisions provided for in Article 3 of Regulation (EU) 2021/784 and to act on the decisions of other Member States under Article 4. Article 2(2) makes ANACOM the competent authority to supervise the specific measures under Article 5 of the Regulation and every obligation whose breach is an administrative offence, and to impose sanctions. Article 3 requires the PJ to report each decision to the Public Prosecutor's Office, which must present it to an investigating judge for validation within 48 hours, and the decision lapses if it does not. Article 5(1)(a) and (b) make it an administrative offence (contraordenação) to fail to remove or block terrorist content within one hour of receiving a removal decision, and to fail to report the removal or blocking, with its date and hour. Article 5(3) classifies the offences in points a), c), f), k), l), m) and n) of paragraph 1 as very serious administrative offences. Article 5(5) sets the fine for a very serious offence at EUR 8,000 to 20,500 for a natural person and up to EUR 5,000,500 for a large enterprise. Article 5(6) sets the maximum fine for a repeat of the offences in points a) and c) of paragraph 1 at 4 percent of the provider's worldwide turnover in the preceding financial year, if no higher limit applies. Article 8 makes ANACOM the authority that opens and investigates these administrative proceedings, with its board of directors applying the fines. Article 17 provides that the decree-law enters into force 60 days after its publication.
N.Y. Gen. Bus. Law art. 44-B (§§ 1420-1429), ch. 699 of 2025, as amended by ch. 96 of 2026
S8828 was signed as chapter 96 of the Laws of 2026 on . It amended chapter 699's effective-date section to , and on that date it repeals the 2025 article 44-B and adds a new article 44-B, sections 1420 to 1429, built on published frontier AI frameworks, transparency reports, critical-safety-incident reporting to an office in the Department of Financial Services, and a disclosure statement for large frontier developers.
Zakon o provedbi Uredbe (EU) 2024/1083 o uspostavi zajedničkog okvira za medijske usluge na unutarnjem tržištu i izmjeni Direktive 2010/13/EU (Europski akt o slobodi medija), čl. 23
Article 23 of the Act implementing Regulation (EU) 2024/1083 requires media service providers, providers of electronic publications and video-sharing platforms to label content they publish that has been generated in any way by artificial intelligence. Article 3 makes the Agency for Media (Agencija za medije) the competent authority under the Act. Article 24(1) fines a legal person that publishes AI-generated content without labelling it between EUR 13,270 and EUR 132,720. Article 24(2) fines the responsible person in the legal person between EUR 1,320 and EUR 6,630. Article 24(3) fines a sole trader or other self-employed person between EUR 2,650 and EUR 13,270. Article 33 provides that the Act takes effect on the eighth day after its publication in Narodne novine. The Act was published in Narodne novine 27/2026 on , so it took effect on .
Ley Núm. 85-2018, Art. 14.08(f), datos de víctimas de violencia doméstica (3 L.P.R.A. § 9814g)
The Education Reform Act's school-choice program gives priority for a certificate to the dependents of domestic violence victims who present a protection order, evidence that a domestic violence court case has begun, or a certification from a shelter, a victim services program or a support professional as part of a family safety plan. The data of domestic violence victims and of their dependents who take part in the program are confidential. A person who, directly or through an agent, violates the program's chapter or its regulations commits a misdemeanor punishable by up to six months' imprisonment, a fine of up to $5,000, or both, at the court's discretion.
Privacy Protection Act, N.J. Stat. §§ 52:4CC-4 and 52:4CC-5 and 39:2-3.4(g) (P.L.2026, c.4, sections 4, 5 and 7)
A government entity may not request or collect information from an individual or a non-governmental entity relating to a person's immigration status, citizenship status, place of birth, social security number or individual taxpayer identification number, except when this information is necessary to assess eligibility for, or to provide or administer, a public service, benefit, program, or professional qualification or license or as otherwise required by State law. A government entity is a principal department of State government, a division, board, bureau, office, commission or other instrumentality within or created by a department, an independent State authority, commission, instrumentality or agency including a public institution of higher education, a political subdivision or combination of political subdivisions, and any division, board, bureau, office, commission, or other instrumentality, independent authority or agency within or created by one. Information relating to a person's immigration status, citizenship status, place of birth, social security number or individual taxpayer identification number that is kept to assess eligibility for, or to provide or administer, a public service, benefit, program or professional qualification or license is not a government record under the Open Public Records Act and may not be disclosed except as the section lists. A government entity may not sell, share or transfer automated license plate recognition information concerning the operation of a person's motor vehicle, except to another government entity when permitted by law, under a valid judicial order or judicial warrant, as subsection c. of the section allows, or to a law enforcement agency of another jurisdiction for a criminal investigation that certifies the information will not be used for civil immigration enforcement or be shared, sold, transferred or made searchable. A government entity that is required by a valid judicial order, judicial warrant or federal law to disclose such information or any automated license plate reader information must notify the person to whom it pertains within 90 days of the disclosure, except where notice would compromise a criminal investigation. If a law enforcement agency of another jurisdiction has used or shared automated license plate recognition information in violation of the act or an agreement made under it, the Attorney General may by order prohibit the sharing of that information with the agency or deny it access to the government entity. Each government entity must review its confidentiality policies, guidelines and regulations, make the changes needed for compliance no later than one calendar year following the effective date of the act, and publish them prominently on its Internet website. A government entity that knowingly obtains, discloses or uses such information, or any automated license plate recognition information, for a purpose the act does not permit is subject to injunctive relief and is civilly liable for damages to the person to whom the information pertains, who may bring an action in the Superior Court. The Motor Vehicle Commission and any government entity may not use or disclose to any federal, State or local law enforcement any motor vehicle record containing personal information, or any personal information as section 1 of P.L.1997, c.188 defines it, for any purpose related to Title 8 of the United States Code without the informed consent of the applicant, a judicial warrant or a valid judicial order. Nothing in the section prohibits or restricts any action where the prohibition, restriction or enforcement would be contrary to federal law, a judicial order or a judicial warrant. P.L.2026, c.4 was approved on and takes effect immediately, except that section 6 takes effect on the first day of the 13th month next following enactment.
L. 29(I)/2026, art. 4, inserting articles 49 and 50 into the Intellectual Property Rights and Related Rights Law (L. 59/1976, as amended)
Law 29(I)/2026 inserted new articles 49 and 50 into Cyprus's Intellectual Property and Related Rights Law, defining a deepfake product by reference to Article 3(60) of the EU AI Act. A deepfake imitation of a performer's performance, or of a natural person's personal physical characteristics including voice and biometric data, may not be made available to the public without that person's explicit consent. For a performer's performance, the consent requirement does not apply to an imitation that is satire or parody, unless it amounts to disinformation posing a serious risk to the rights or essential interests of the affected person or others. For a natural person's personal physical characteristics, the consent requirement also does not apply to caricature or political or social commentary, with the same disinformation proviso. The protection lasts until 50 years have passed from the year of death of the performer or the person depicted. It was published in the Official Gazette on . Under article 7 of the Interpretation Law, a Law that provides no other day comes into force on the date of its publication in the Official Gazette.
An Act for the Collection, Processing, Transmission, Storage, Protection, and Use of Personal Information in Liberia (Data Protection Act of Liberia)
Liberia's first standalone personal-data statute is formally titled An Act for the Collection, Processing, Transmission, Storage, Protection, and Use of Personal Information in Liberia. It addresses the protection of personal data and privacy as government services, financial transactions, communications, and commercial activities move increasingly online. President Joseph Nyuma Boakai submitted the Act to the Legislature as a bill in June 2025. The President approved the Act on , as the Ministry of Foreign Affairs' printed copy, printed on , records. Post and Telecommunications Minister Sekou Kromah publicly announced on that the President had signed the Act into law. The Liberia Internet Governance Forum had already reported the same signing in a statement dated . Section 44 provides that the Act takes effect upon publication into handbills, and section 41 gives existing industries, businesses, and offices one year from the day the Act comes into force to comply. Section 2 gives the Act the short title "Personal Data Protection and Privacy Act of 2024". The Act applies to the processing of all types of personal information by any natural or juridical person, including a personal information controller and a processor, in respect of residents of Liberia and the ECOWAS Region or beyond. Personal data must be collected for specified and legitimate purposes, processed fairly and lawfully, kept accurate, adequate and not excessive, and retained only as long as necessary. Processing is permitted only if not otherwise prohibited by law and at least one listed condition exists: the data subject's consent, performance of a contract, compliance with a legal obligation, protection of vital interests, a national emergency or public authority function, or the legitimate interests of the controller or a third party unless overridden by the data subject's fundamental rights. The processing of sensitive personal information and privileged information is prohibited except in the cases section 13 lists, which include the data subject's consent specific to the purpose. A data subject is entitled to be informed of the processing, to be furnished stated information before entry into the system, to reasonable access on demand, to dispute and have corrected inaccurate information, to suspend, withdraw or order the blocking, removal or destruction of the information, and to be indemnified for damages. A data subject may obtain from the controller a copy of personal information processed by electronic means in a structured and commonly used format. A controller must implement reasonable and appropriate organizational, physical and technical measures to protect personal information against accidental or unlawful destruction, alteration and disclosure and against other unlawful processing. A controller must promptly notify the affected data subjects when sensitive personal information or other information that may enable identity fraud is reasonably believed to have been acquired by an unauthorized person and the acquisition is likely to give rise to a real risk of serious harm, describing at least the nature of the breach, the sensitive personal information possibly involved and the measures taken. A controller is responsible for personal information under its control or custody, including information transferred to a third party for processing, whether domestically or internationally, and must use contractual or other reasonable means to provide a comparable level of protection while the information is processed by the third party. The Independent Information Commissioner administers the Act and may authorize trans-border transfers of personal data. The Commissioner may issue cease and desist orders and impose a temporary or permanent ban on the processing of personal information. The Commissioner may also impose administrative and financial sanctions on data controllers. Unauthorized processing of personal information is penalized by imprisonment of one year and a fine of not less than L$25,000. Concealing a security breach after learning of it and of the obligation to notify is penalized by imprisonment of two years and a fine of L$15,000 to L$30,000.
Measures for AI Science and Technology Ethics Review and Services (Trial) (人工智能科技伦理审查与服务办法（试行）), 2026, Arts. 9, 12, 22 and 30
The AI Science and Technology Ethics Review and Services Measures (Trial), issued under document number 工信部联科〔2026〕75号 by the Ministry of Industry and Information Technology and nine other bodies, apply to artificial intelligence research and technology development carried out in China that may bring science and technology ethics risks and challenges in areas such as human dignity, public order, and life and health. Universities, research institutions, medical and health institutions and enterprises that carry out AI science and technology activities are responsible for ethics review management in their own unit and must set up an AI science and technology ethics committee. The person in charge of a covered AI activity must apply to the unit's committee, or to a service center where the unit has no committee or its committee cannot do the review. A committee or service center must decide within 30 days of accepting an application whether to approve, send it back for revision and re-review, or refuse approval. An AI activity on the expert re-review list must, after the preliminary review by the committee or service center, be put forward by its unit for expert re-review. The re-review list covers research and development of human-machine integration systems with a strong influence on human behavior, mental state and health, of algorithm models, applications and systems able to mobilize public opinion and society, and of highly autonomous automated decision systems in settings with safety or health risks. Units must register their committee and the activities on the re-review list on the national science and technology ethics management information registration platform and submit the previous year's committee work report. Violations are investigated and punished under the Cybersecurity Law, the Data Security Law, the Personal Information Protection Law, the Law on Progress of Science and Technology and other laws, regulations and rules. The Measures take effect from the date of issuance.
Decreto nº 12.880, de 18 de março de 2026, regulates Lei nº 15.211, of , the ECA Digital. The decree enters into force on the date of its publication. A supplier of information-technology products or services that makes available content, a product or a service prohibited to children and adolescents must implement effective age verification mechanisms and effectively prevent their access, enjoyment or consumption. For gambling, loot boxes, pornographic content, escort services and services for arranging sexual encounters, the supplier must also bar the creation of accounts and profiles by children and adolescents and identify and remove accounts they operate. A supplier that makes available its own or third-party pornographic content must adopt its own age verification mechanisms that ensure no access by children and adolescents, even in the form of previews, images, titles or captions. A supplier that allows pornographic images or videos to be viewed must, when the user is not registered, the age is not verified or the account is operated by a child or adolescent, hide, blur or not display the content by default, or require age verification to unlock it, and mere self-declaration is barred. A supplier that offers or intermediates the sale of products and services prohibited to children and adolescents under article 15, paragraph 1, items I to VII, must implement effective age verification at registration, with purchases blocked by default and no unlock by self-declaration, or at the time of purchase so that a child or adolescent cannot complete the operation. A social network service that makes available content, products or services prohibited to children and adolescents must either create versions without them, which dispenses with age verification, or adopt effective age verification mechanisms, and self-declaration is barred. Data collected from documents for age assessment must be limited to the age or the confirmation of the age range, and the image, the copy of the document and the information may not be stored or retained but must be deleted immediately and irreversibly after the necessary information is captured. App stores and operating systems must provide users' age signals to suppliers of information-technology products and services free of charge, limited to the data strictly necessary to confirm the minimum age required, with no exact date of birth, civil identity or user profiling data. App stores and operating systems must also request authorization from legal guardians for a child or adolescent to download and install an application, and inform the guardians of the age rating assigned to the application before they authorize it. A supplier whose own age assessment differs from the age signal sent by the app store or operating system must take the measures corresponding to the alternative that better protects children and adolescents. The decree revokes Decreto nº 9.856, of .
Estatuto Digital da Criança e do Adolescente (ECA Digital)
Lei nº 15.211, de 17 de setembro de 2025
Article 41-A, as most recently amended by Lei nº 15.352/2026, fixed the ECA Digital's entry into force at , after an earlier version of the same article, added by Medida Provisória nº 1.319/2025, had set it at six months after publication.
ECA Digital (Lei nº 15.211/2025), children's personal data and profiling
Also known as ECA Digital, Estatuto Digital da Criança e do Adolescente (Digital Statute of the Child and Adolescent), Lei nº 15.211/2025 (Law No. 15,211 of 2025)
Lei nº 15.211, de 17 de setembro de 2025 (Estatuto Digital da Criança e do Adolescente), arts. 7º, 16, 22 and 26
Article 7 requires a provider of an information-technology product or service directed at children and adolescents, or likely to be accessed by them, to configure it by default to the most protective privacy and data-protection setting available, and article 7, paragraph 2 bars processing their personal data in a way that causes, facilitates or contributes to a violation of their privacy. Article 16, sole paragraph, requires a controller processing their data, above all for purposes not strictly necessary to run the product or service, to map the risks and make efforts to mitigate them, and to prepare a data-protection impact, monitoring and evaluation report that is shared when the authority requests it. Article 22 bars profiling techniques to direct commercial advertising at children and adolescents, and article 26 bars building behavioral profiles of them from their personal data, including data obtained in age verification, for that advertising. The law applies to a covered product or service regardless of where it is located, developed, made, offered, marketed or operated, and article 41-A fixed as the date it enters into force.
Reklaamiseadus, RT I 2008, 15, 108, § 30(2-1) to (2-3) and § 34-1
Section 30(2-1) makes the Consumer Protection and Technical Regulatory Authority (Tarbijakaitse ja Tehnilise Järelevalve Amet) the supervisor of compliance with the obligations in Articles 5 to 17 and Article 21 of Regulation (EU) 2024/900 on the transparency and targeting of political advertising. Section 30(2-2) makes the Authority the national contact point within the meaning of Article 22(9), second subparagraph, of the Regulation. Section 30(2-3) lets the Authority ask the Party Financing Supervision Committee (Erakondade Rahastamise Järelevalve Komisjon) for an opinion on whether a published advertisement is political advertising within the meaning of Article 3 of the Regulation. Section 34-1(1) punishes a failure to meet the obligations in Articles 5 to 17 and Article 21 of the Regulation with a fine of up to six percent of a natural person's income in the preceding calendar year. Section 34-1(2) sets the fine for a legal person that commits the same act at up to six percent of its worldwide turnover in the preceding financial year. The provisions took effect on .
AKEP Regulation on Network and Service Security, arts. 6, 11 and 12
Article 11(1) requires an electronic communications undertaking to notify AKEP electronically within 24 hours of recording a security incident. Article 11(1) makes that notification mandatory only where the incident is classified as of medium or high impact. Article 11(2) requires Annexes 1 and 2 to be filed within 72 hours of recording the incident. Article 11(4) requires the updated Annexes 1 and 2 as the final report within 30 calendar days of recording the incident. Article 11(7) requires undertakings to keep all data on an incident for at least 12 months from filing the final notification. Article 12 treats a violation of the regulation that is not a criminal offence as an administrative offence fined under article 184 of Law No. 54/2024. Article 14 provides that the regulation enters into force on the date of its approval by the Governing Council of AKEP. The regulation was approved by decision no. 8 of of the Governing Council of AKEP.
AKEP Regulation on Network and Service Security, arts. 7, 10 and 12
Article 7(1) point a requires undertakings to adopt a written internal information security policy approved by management and reviewed at least once a year. Article 10(1) requires undertakings to file a report on the security measures applied with AKEP once a year, by February of each year. Article 10(2) requires an undertaking with more than 2,000 subscribers, or one that meets another listed condition, to file an ISO 27001 certificate or a security audit report with AKEP. Article 10(2) makes the undertaking bear the cost of that audit in every case. Article 12 treats a violation of the regulation that is not a criminal offence as an administrative offence fined under article 184 of Law No. 54/2024.
By NetChoice, LLC v. Bonta, United States Court of Appeals for the Ninth Circuit
Only § 1798.99.31(a)(1), § 1798.99.31(a)(2), § 1798.99.31(a)(3), § 1798.99.31(a)(4), § 1798.99.31(b)(1), § 1798.99.31(b)(2), § 1798.99.31(b)(3), § 1798.99.31(b)(4), § 1798.99.31(b)(7), § 1798.99.31(c), § 1798.99.33, § 1798.99.35(c). The rest of the law still binds.
The court affirmed the injunction as to the data use restrictions in section 1798.99.31(b)(1) to (4) and the dark patterns restriction in section 1798.99.31(b)(7), on vagueness grounds. It noted that the impact assessment requirement, which it had affirmed enjoining in 2024, remains enjoined and was not at issue in that appeal.
On appeal from the 2025 injunction, the Ninth Circuit held that NetChoice is not likely to succeed on its facial challenge to the Act's coverage definition, vacated the preliminary injunction as to the entire Act and as to the age estimation requirement, and affirmed it only as to the data use restrictions and the dark patterns restriction. It also vacated the finding that the rest of the Act is not severable from the enjoined notice and cure provision, and remanded for further proceedings.
2026 on the Protection of Personal Data, transfers of personal data abroad
Loi n°1/03 du 10 mars 2026, articles 15-16 (transfert de données à l'étranger)
Article 15 allows a controller to transfer personal data to a foreign State or an international organization only if that State or organization ensures a sufficient level of protection of privacy and of the fundamental freedoms and rights of the persons concerned, assessed in the light of the protective rules in force there, the security measures applied, and the characteristics of the processing and the nature, origin and destination of the data. An order of the minister in charge of the digital economy lists the countries whose level of protection is considered sufficient, and a controller may transfer data to a country not on the list if the receiving organization adopts adequate safeguards approved by the personal data protection body in Burundi. Article 16 lists the elements taken into account in assessing sufficiency: the rule of law, respect for human rights and fundamental freedoms and the relevant general and sectoral legislation, the existence and effective operation of independent supervisory authorities, and the international commitments the country has undertaken on personal data protection. Under Article 55 the law entered into force on the day of its promulgation, .
2026 on the Protection of Personal Data, information, access and other rights of the person concerned
Loi n°1/03 du 10 mars 2026, articles 17-18 and 21-33 (droits des personnes concernées)
Article 17 requires a controller that collects personal data directly from the person concerned to tell the person at the time of collection the controller's identity, the purposes, the recipients, the retention period, the existence and exercise of the person's rights, whether the answers are compulsory or optional, and any processing of the data with artificial intelligence for automated decision-making, and Article 18 requires prior information and consent before further processing for another purpose. Article 21 gives a controller that did not collect the data from the person at most one month to give that information and the source of the data. Article 22 gives the person a right to object, for legitimate reasons, to processing, and Article 23 a right to object without charge and without giving a reason to use of the data for prospecting, notably commercial, charitable or political. Articles 24 to 27 give a right to confirmation that data are processed and to access, with a free copy, and provide for referral to the data protection body where the exercise of access is called abusive and for precautionary measures against concealment or disappearance of information. Article 28 gives a right to erasure, and the controller must tell each recipient of an erasure; Article 29 gives a right to rectification; Article 31 gives a right to data portability, with a maximum of fifteen calendar days from receipt of the request for direct transmission between controllers. Article 33 requires the controller to act on requests for access, rectification, objection and erasure without delay and at the latest one month from receipt, and to warn the person and notify the data protection body when it cannot meet that deadline. Under Article 55 the law entered into force on the day of its promulgation, .
2026 on the Protection of Personal Data, automated decisions
Loi n°1/03 du 10 mars 2026, articles 19-20 (décisions automatisées)
Article 19 requires a controller to tell a person that a decision with legal effects or significant effects on the person is automated and to explain the underlying logic in clear and simple terms, and, where the processing merely assists a human decision, to describe the human decision-maker's own contribution, in particular the methods and criteria used. Article 20 permits an automated decision with legal effects or significant effects only where an act of legislation or regulation provides for it with appropriate safeguards, the person consents, or it is strictly necessary to conclude or perform a contract between the person and the controller. Where an automated decision is permitted, Article 20 requires individual reasons, and it gives the person the right to have the decision reformulated: the person may submit written observations and a human takes a new reasoned decision that entirely replaces the first. Under Article 55 the law entered into force on the day of its promulgation, .
2026 on the Protection of Personal Data, the Agence de protection des données à caractère personnel and penalties
Loi n°1/03 du 10 mars 2026, articles 26-27, 35, 42 and 47-51 (organe de protection et dispositions pénales)
Article 42 creates the Agence de protection des données à caractère personnel to oversee application of the law and to monitor processing, and provides that a decree sets the agency's missions, composition, organization and operation. Article 26 lets a person who believes a controller wrongly treated the exercise of the right of access as abusive refer the question to the agency, whose decision may be challenged in the courts, and Article 27 lets the person ask the agency for precautionary measures where information may be concealed or disappear. Article 35 lets the agency, after an unheeded written warning to a major controller to register within six months, suspend that controller's activities for up to three months, and then bar it permanently from collecting and processing personal data. Article 47 punishes a deliberate breach of personal data by a natural person with three months to one year of penal servitude and a fine of 50,000 to 500,000 Burundian francs, or one of them, and a private legal person with a fine of 1 million to 20 million francs, with a suspension of activities of up to six months for a major controller on repeat. Article 48 punishes unfair, unlawful or non-transparent collection or processing, for purposes that are undetermined, not explicit, illegitimate or incompatible with the original purposes, with six months to five years and a fine of 500,000 to 10 million francs, or one of them, for a natural person and a fine of 5 million to 20 million francs, doubled for a major controller, for a private legal person. Article 49 punishes a natural person who without legitimate reason opposes processing for archiving in the public interest, scientific or historical research or statistical purposes. Article 50 punishes processing the Article 9 sensitive data outside the Article 10 exceptions with a fine of 500,000 to 5 million francs, and Article 51 preserves the criminal provisions of other laws, notably the cybercrime law and the Penal Code. Under Article 55 the law entered into force on the day of its promulgation, .
2026 on the Protection of Personal Data, personal data breach notification
Loi n°1/03 du 10 mars 2026, articles 45-46 (notification des violations de données)
Article 45 requires a controller to notify the data protection body of a breach of the obligations arising from processing that is likely to risk the rights and freedoms of the persons concerned as soon as possible and at the latest within 48 hours after becoming aware of it, with the reasons for the delay if the notification is late, describing the nature of the breach, its probable consequences and the measures the controller has taken to mitigate the damage. Article 46 requires a controller to notify the persons concerned of a breach likely to give rise to a high risk to their rights and freedoms within a maximum of 96 hours after becoming aware of it, describing in clear and simple terms the nature of the breach, its possible consequences, the measures taken, and the measures the persons can take to protect themselves. Under Article 55 the law entered into force on the day of its promulgation, .
2026 on the Protection of Personal Data, sensitive data and biometric identification
Loi n°1/03 du 10 mars 2026, articles 9-10 (données sensibles)
Article 9 prohibits processing personal data that reveal, directly or indirectly, racial or ethnic origin, political, philosophical or religious opinions or trade-union membership, data relating to health, and biometric data processed to identify a natural person selectively. Article 10 lifts the prohibition, to the extent the purpose requires, for processing on the person's express consent unless a law bars lifting the prohibition even by consent, processing necessary to safeguard human life where the person cannot consent, processing by a non-profit association for its members, processing for legal claims, medical follow-up of patients in an emergency, and health research with the person's consent, and it lets the minister in charge of civil status add public-interest exceptions by order. Article 10 also provides that sensitive data may be used only for the purposes for which they were collected or compatible ones and must have additional safeguards such as encryption, access controls, secure storage environments and regular security audits. Article 40 presumes a high risk, and so an impact assessment by a major controller, whenever processing rests on Article 9 data. Under Article 55 the law entered into force on the day of its promulgation, .
Loi n°1/03 du 10 mars 2026 portant protection des données à caractère personnel
Burundi's comprehensive personal-data statute is Loi n°1/03 du 10 mars 2026 portant protection des données à caractère personnel (on the protection of personal data). The President of the Republic promulgated it at Gitega on , and under Article 55 it entered into force on the day of its promulgation. The telecommunications regulator ARCT published the law on . The law applies to any automated or non-automated processing of personal data by a natural person, the State, local authorities and legal persons under public or private law, and to processing by a controller or processor, established in Burundi or not, that uses processing means located in Burundi other than for transit; a controller or processor not established in Burundi names a representative there unless its processing is occasional. It excludes only processing by a natural person for exclusively personal or household activities and temporary copies made in the technical transmission of data, and it contains no exclusion for publicly available personal data. Processing must be lawful, fair and transparent, for specified, explicit and legitimate purposes, adequate, accurate, kept no longer than needed and secured, and it is lawful only on a listed basis: consent, contract, a legal obligation, vital interests, a public-interest task, or legitimate interests that the person's rights do not override, notably where the person is a child. A controller must choose a processor that gives sufficient guarantees that it can meet the law's obligations and bind it by a written contract under which it acts only on the controller's instructions, and a processor may not engage another processor without the controller's prior written authorization (Articles 11 to 13). Processing is confidential and may be carried out only by persons acting under the controller's authority and on its instructions who have signed a written undertaking to respect the law, and the controller must take the measures Article 44 lists to protect the integrity and confidentiality of the data, including limiting access to authorized persons, logging who accessed what data and when, and keeping backups (Articles 43 and 44). A major controller, meaning an enterprise of more than 200 employees, a public authority or national public body, or a private legal person managing certain life-saving, legal-claim, patient-care or health-research data, must register with the protection body within six months, keep a register of its processing, appoint a data protection officer and carry out an impact assessment before high-risk processing. Processing begun before the law took effect must comply within one year for the State, public bodies and bodies with a public-service mission, and within six months for anyone else, counted from the day the law took effect.
Resolución No. SPDP-SPD-2026-0009-R, Superintendencia de Protección de Datos Personales, 12 de febrero de 2026
This resolution binds any controller that develops, trains, implements, deploys, or provides an artificial-intelligence system that processes personal data, and, as reformed, a processor only where it has access to, visibility of, or effective control over the data, whenever that system falls within the LOPDP's material and territorial scope. Article 4 as first issued guaranteed, at all times, the data subject's right not to be the object of a decision based solely or partly on automated valuations, together with the right to information and the right to object. The reform replaced Article 4 with a guarantee of the rights the LOPDP recognizes and of access to the mechanisms for exercising them. Article 5 requires the controller or processor to inform the data subject clearly and specifically about the AI-based processing. Article 6 requires a prior risk-management process, and an impact assessment where one is called for, before developing an AI system that will process personal data. The resolution states that it takes effect upon its publication in the Registro Oficial. It was published in Registro Oficial Año I No. 240 of . Resolution SPDP-SPD-2026-0037-R, published in Registro Oficial Año II No. 373 of , made the resolution's obligations enforceable against a processor only for the operations or phases of processing where it has access to, visibility of, or effective control over the personal data.
Circular No. 05/2026/TT-BKHCN of the Ministry of Science and Technology issues the National Artificial Intelligence Ethics Framework, which applies to state management agencies and to any organization or individual that develops, provides, deploys or uses an AI system for state management or public services. Under it those actors are responsible for identifying harmful scenarios in advance and building preventive measures, for setting quality criteria for data, models and outputs and building internal testing, validation and verification before deployment, and for building human oversight and intervention mechanisms proportionate to the system's impact. Other Vietnamese and foreign organizations and individuals working with AI in Vietnam are encouraged, not required, to apply it. The Circular took effect on .
App Distribution Services Online Safety Code (Class 1C and Class 2 Material)
App Distribution Services Online Safety Code (Class 1C and Class 2 Material), registered under section 140 of the Online Safety Act 2021 (Cth)
Requires app store and app distribution platform operators, such as the Apple App Store and Google Play, to take reasonable steps, including age assurance and access controls, before permitting the download or purchase of an app containing Class 1C or Class 2 material such as pornography. Registered by the eSafety Commissioner on , with the age assurance measure required within 6 months of commencement, by about .
Designated Internet Services Online Safety Code (Class 1C and Class 2 Material)
Designated Internet Services Online Safety Code (Class 1C and Class 2 Material), registered under section 140 of the Online Safety Act 2021 (Cth)
Requires providers of designated internet services, including websites hosting online pornography and generative AI services capable of producing Class 1C or Class 2 material, to implement age assurance and access controls to prevent access by children in Australia. Registered by the eSafety Commissioner on .
A government entity may not purchase, sell, trade or transfer personal data without the express written consent of the person the data references, except as otherwise expressly provided by law and the exceptions the section lists. A government entity is the state and all its political subdivisions, agencies, instrumentalities and institutions and any local government entity. The definition of government entity does not include the judicial branch of government or any law enforcement agency in Wyoming. A government entity may transfer personal data to another government entity that complies with the article. A government entity may petition the elected governing person or body with authority over it for an exception, which that person or body may publicly approve in writing for a term of up to two years per petition. The prohibition does not bar the transfer of personal data that is transferable under the Health Insurance Portability and Accountability Act or the Family Education Rights and Privacy Act. A government entity may transfer personal data to a nongovernment entity it contracts with to provide or assist with government services, and the contract must include requirements for the protection of personal data consistent with the article. The nongovernment entity must return or destroy the personal data once it is no longer necessary for the government service, and may not maintain, sell, transfer, process or otherwise use it except as necessary to provide the contracted service. A current or former Wyoming resident, or the resident's legally authorized representative, may request a copy of the resident's personal data from any government entity maintaining it, and the entity may charge a fee consistent with the fees the Wyoming Public Records Act authorizes. A resident who objects to the accuracy, completeness, pertinence, timeliness, relevance, retention, dissemination or denial of access to the resident's own personal data may file an objection with the government entity that maintains the data. The government entity must act on the objection within sixty days of receiving it. Where the article conflicts with another provision of state or federal law, the other provision controls, and nothing in the article abrogates any disclosure of data or public records under the Wyoming Public Records Act. Under section 5 of the act, its section 1, which created these two sections, takes effect immediately upon completion of all acts necessary for a bill to become law. The Governor signed Senate Enrolled Act 32 of 2026 on .
Governor Phil Scott signed S.23 into law as 2026 Act No. 75; the act's own effective-date section states it takes effect on passage, so it commenced the date the Governor signed it.
The Cyber Security (Security Standards for Smart Devices) Rules 2025, registered with a twelve-month transition period, began binding a consumer grade relevant connectable product manufactured on or after , making the password ban, the security-issue reporting duty, and the support-period disclosure duty binding on a manufacturer and supplier of an in-scope device.
The Homebuyers Privacy Protection Act, Public Law 119-36, amends section 604(c) of the Fair Credit Reporting Act by adding a paragraph (4) on the treatment of prescreening report requests. If a person requests a consumer report from a consumer reporting agency in connection with a credit transaction involving a residential mortgage loan, the agency may not, based in whole or in part on that request, furnish a consumer report to another person under that subsection unless the transaction consists of a firm offer of credit or insurance and the other person has submitted documentation certifying that it has the consumer's authorization. The other person may instead be one that has originated a current residential mortgage loan of the consumer, is the servicer of one, or is an insured depository institution or credit union that holds a current account for the consumer. The Act also directs the Comptroller General to study the value of trigger leads received by text message and to report to Congress within 12 months of enactment.
Kultuuriministri määrus nr 4 „Nõuded audiovisuaalmeedia teenuste ligipääsetavusele ja nende täitmise tähtajad” (RT I, 27.02.2026, 13)
Regulation No. 4 of the Culture Minister is made under section 23(1^1) of the Media Services Act. Section 1(1) sets accessibility requirements for the audiovisual media services of Eesti Rahvusringhääling, for the on-demand audiovisual media services offered by electronic communications undertakings that provide audiovisual media services, and for the two most-watched programs of private television service providers. Section 1(2) has TTJA name the two private programs for the next calendar year and publish them on its website by 1 December, on the basis of the programs' average viewing over ten months of the current calendar year. Section 1(3) applies the requirements, for the electronic communications undertakings and the two private programs, to Estonian-language programs whose first showing is after . Section 1(4) provides that the requirements do not apply to programs and program catalogues aimed at a specific narrower target group whose main content has features such as little or no verbal content, an exclusively musical or visual content or another specific thematic focus that makes applying the requirements unjustified. Section 2 requires news programs, current affairs programs and election programs to be subtitled for at least 70 percent of their weekly volume. Section 3 requires Eesti Rahvusringhääling to provide sign-language interpretation for twelve listed national events and addresses, to broadcast at least one "Aktuaalne kaamera" news program a day with sign language, and to tell viewers accessibly in the program guide and the catch-up environment that sign language is available. Section 4 requires Eesti Rahvusringhääling to provide audio description for the Estonian Republic anniversary concert-performance and the Estonian general dance festival and youth dance festival. Section 5 requires audio description, where a program has it, to be available together with the program on every platform that carries it, and viewers to be told accessibly in the program guide and the catch-up environment that it exists. Section 6 requires every subtitled program of Eesti Rahvusringhääling to have audio subtitles. Section 7 requires a service aimed specifically at the hard of hearing and the visually impaired to ensure that the accessibility elements are delivered completely and in sufficient quality, with sound and video synchronized, and that the user can adjust display and use. Section 8 provides that where Eesti Rahvusringhääling broadcasts an event and meets the accessibility requirements, another media service provider that carries the same event need not meet them. Section 9 requires subtitles, sign-language interpretation or audio description to be added when Estonian films and series made with Estonian state funding that have them are shown or transmitted, and, where possible, for other Estonian-language films and series. Section 10 provides that the share of programs with selectable subtitles rises to 95 percent by 2030 in the programs covered, and that the share of programs, films and series with audio description in the programs of Eesti Rahvusringhääling rises by at least 3 percent by 2028 and at least 5 percent by 2030 compared with 2025. The Regulation was made on , published on and took effect on . Section 54(1) of the Media Services Act makes TTJA the authority that supervises compliance with that Act and the legal acts made under it, apart from sections 15 and 19^2. Section 56 of the Media Services Act sets the ceiling of the penalty payment for a precept that is not complied with at EUR 15,000 and, where a precept is repeatedly not complied with, at EUR 30,000.
Defamation Act 2009 (No. 31 of 2009), s. 45, inserted by the Defamation (Amendment) Act 2026 (No. 2 of 2026), s. 22
Section 45(3) of the Defamation Act 2009, inserted by section 22 of the Defamation (Amendment) Act 2026, lets the Circuit Court make an identification order requiring a relevant intermediary service provider to provide the applicant with such relevant information as the court may specify. Relevant information, in relation to an anonymous publisher, means information as to the identity, address or other contact information of the anonymous publisher. A relevant intermediary service provider is an intermediary service provider that provides the intermediary service by means of which the statement is published, or caused to be published, by the anonymous publisher. An intermediary service means a mere conduit, caching or hosting service that is an information society service. The court may make the order only where it is satisfied that a statement was published on an information society service by means of an intermediary service provider by an anonymous publisher whose identity is unknown to the applicant. The court must also be satisfied that the applicant's defamation claim against the anonymous publisher is likely to succeed at trial, that the relevant information is necessary to enable the applicant to bring defamation proceedings, that it is likely to be in the possession of the provider, and that the applicant has no other practicable means of obtaining it. The court may make the order only where it considers that it is in the interests of justice and that the interests favouring disclosure outweigh those against, and may attach conditions, including terms restricting the use of the information disclosed to the bringing of defamation proceedings against the anonymous publisher. An application must be made in good faith and on notice to the relevant intermediary service provider concerned. The court may order the applicant to pay any or all of the costs of the relevant intermediary service provider in relation to an application and the costs resulting from the making of any identification order.
It is unlawful to sell, license, or otherwise provide to a Berkeley landlord a coordinated pricing algorithm, a category that includes software using competitor rent or occupancy data, that sets or recommends rents or occupancy levels for a residential unit, and separately unlawful for a landlord to use such an algorithm. Each month of use and each affected unit is a separate violation. The City Attorney or an aggrieved tenant may sue for damages, injunctive relief, or civil penalties of up to $1,000 per violation.
A landlord (owner or operator) may not use an algorithmic device, defined to include software that uses nonpublic competitor rent or occupancy data, when setting rents or occupancy levels for a dwelling unit in Minneapolis. The section does not separately prohibit selling, licensing, or otherwise supplying such a device. A tenant may bring a civil action to recover compensatory damages and reasonable attorney's fees.
Article 11 requires a provider to design and operate an AI system that interacts directly with humans so that a user can recognise they are interacting with such a system, unless the law provides otherwise, and to mark AI-generated audio, image, and video content in a machine-readable format under forthcoming Government regulations. A deployer must clearly notify the public when providing AI-generated or AI-edited text, audio, images, or video that could cause confusion about the authenticity of an event or a person, and must attach an easily recognisable label to AI-generated or AI-edited content that simulates or replicates a real person's appearance or voice or recreates a real event, with a lighter labeling standard for cinematographic, artistic, or creative works so the label does not obstruct enjoyment of the work. Both providers and deployers must keep this transparency information current throughout the life of the system, product, or content.
Article 12 requires every developer, provider, deployer and user of an artificial intelligence system to keep the system safe, secure and reliable, and to promptly detect and remedy an incident capable of harming people, property, data or social order. When a serious incident occurs in an artificial intelligence system, the developer and provider must urgently apply technical measures to remedy, suspend or recall the system, and must simultaneously notify the competent state agency of the incident. The deployer and the user of the system must record the incident, notify it promptly, and coordinate with one another during the remediation process. The competent state management agency receives, verifies and guides the remediation, and may require the system to be suspended, recalled or reassessed when necessary. Reporting and remediation of the incident is carried out through the one-stop artificial intelligence portal. Article 12 does not itself state a reporting deadline; instead it directs the Government to specify the reporting procedure and the responsibilities of the agencies, organisations and individuals involved, calibrated to the severity of the incident and the scope of its impact. Article 12 addresses the developer, provider, deployer and user of the system and the competent state agency; it does not itself direct any notice to a person affected by the incident. Decree 142/2026/ND-CP sets the preliminary-report deadline for an urgent serious incident at 72 hours from confirmation. For any other serious incident the Decree makes the preliminary report due within five working days of confirmation.
During an inspection or examination, the organizations and individuals concerned must provide technical dossiers, trace logs, training data and other necessary information to determine the cause of a violation or incident or to apportion responsibility. That information must be provided in compliance with the law on protecting state secrets, data, personal data and intellectual property. The agencies and organizations assigned state management of artificial intelligence are responsible for checking that organizations and individuals comply with the law in their artificial intelligence activity.
Article 7 bars developing, providing, deploying, or using an AI system to use forged elements or simulations of real people or events to intentionally and systematically deceive or manipulate human perceptions or behaviour where this causes serious harm, to exploit weaknesses of a vulnerable group such as children, the elderly, people with disabilities, or people with limited cognitive or civil-act capacity, or to create or disseminate fake content capable of posing a serious danger to national security, public order, or social safety. It separately bars collecting, processing, or using data to develop, train, test, or operate an AI system in a way that contravenes Vietnam's data, personal data protection, intellectual property, or cybersecurity law, and bars obstructing, disabling, or distorting the human-oversight mechanisms the Law requires over an AI system.
By NetChoice v. Jones, United States District Court for the Eastern District of Virginia
On NetChoice's motion, the Eastern District of Virginia granted a preliminary injunction against enforcement of SB 854 by the Attorney General. The court found that NetChoice has established associational standing to sue on behalf of its members. It found that SB 854 is content based, and that it is likely not the least restrictive means of achieving the government's interest of protecting minors from the harms of social media use and therefore fails strict scrutiny. It found in the alternative that SB 854 is still likely to fail under intermediate scrutiny.
Ordonnance n°0011/PR/2026, art. 14, 16-24 et 53 (protection des mineurs), du 26 février 2026 portant réglementation de l'usage des réseaux sociaux
Ordonnance n°0011/PR/2026, signed by the President of the Republic on and published in the Journal Officiel n°110 of , fixes Gabon's digital majority at sixteen, bars account creation below that age on any social network or digital platform, and gives platforms twelve months from publication to deploy age-verification systems meeting a technical référentiel the Haute Autorité de la Communication is to publish.
Information Security Management System for Aviation Organizations (Part-IS.I.OR)
Commission Implementing Regulation (EU) 2023/203, Annex II
Article 4(1) of Regulation (EU) 2023/203 requires the organizations referred to in Article 2(1) to comply with the requirements of Annex II (Part-IS.I.OR) to that Regulation. Article 2(1) applies the Regulation to the following classes of organization, subject to the exceptions it lists for organizations solely involved in the activities it names. The classes are maintenance organizations under Part-145, continuing airworthiness management organizations under Part-CAMO, air operators under Part-ORO, approved training organizations, aircrew aero-medical centers, flight simulation training device operators, air traffic controller training organizations and aero-medical centers, organizations under Part-ATM/ANS.OR, and U-space service providers and single common information service providers. Point IS.I.OR.200(a) requires the organization to set up, implement and maintain an information security management system with a policy on information security, risk identification and treatment, internal and external reporting schemes, detection of information security events, response to and recovery from incidents, and compliance monitoring. Point IS.I.OR.200(b) requires a continuous improvement process. Point IS.I.OR.200(e) lets the competent authority approve an organization not to implement these requirements if it demonstrates that its activities, facilities, resources and services pose no information security risks with a potential impact on aviation safety to itself or to other organizations. Point IS.I.OR.205(a) requires the organization to identify all its elements that could be exposed to information security risks. Point IS.I.OR.205(c) requires the organization to identify the information security risks that may have a potential impact on aviation safety and to assign each risk a level according to a predefined classification. Point IS.I.OR.205(d) requires the organization to review and update the risk assessment when the elements, the interfaces, the information used to classify risks or the lessons learnt from incidents change. Point IS.I.OR.210(a) requires the organization to develop measures to address unacceptable risks, implement them in a timely manner and check their continued effectiveness. Point IS.I.OR.215(a) requires an internal reporting scheme to collect and evaluate information security events, including those to be reported externally. Point IS.I.OR.220 requires measures to detect incidents and vulnerabilities, measures to respond to events that may develop into an information security incident, and measures to recover from incidents. Point IS.I.OR.225(a) requires the organization, after the competent authority notifies findings, to identify the root causes, define a corrective action plan and demonstrate the correction to the authority's satisfaction. Point IS.I.OR.235(a) requires the organization to ensure that the activities it contracts out comply with the Regulation and that the contracted organization works under its oversight. Point IS.I.OR.240(a) requires the accountable manager to ensure that the resources needed to comply are available, to establish and promote the information security policy and to demonstrate a basic understanding of the Regulation. Point IS.I.OR.245 requires the organization to keep archived and traceable records of approvals, contracts, key processes, risks and risk treatment measures, reported incidents and vulnerabilities, and events that may need reassessment. The records of key processes, of risks and risk treatment measures, and of reported incidents and vulnerabilities are kept for at least 5 years. The Regulation applies from , and from to the air navigation service provider of the European Geostationary Navigation Overlay Service. Article 5(1) treats compliance with equivalent security requirements laid down in accordance with Article 14 of Directive (EU) 2016/1148 as compliance with this Regulation. Directive (EU) 2022/2555 repealed Directive (EU) 2016/1148 with effect from , and references to the repealed Directive are construed as references to Directive (EU) 2022/2555. The authority responsible for certifying and overseeing compliance is, for each class of organization, the competent authority designated under the regulation that governs that class (Article 6(1)). Article 131 of Regulation (EU) 2018/1139 requires Member States to lay down the rules on penalties applicable to infringement of that Regulation and of the delegated and implementing acts adopted on the basis of it. The Regulation enters into force on the twentieth day following its publication in the Official Journal of the European Union.
Point IS.I.OR.230(b) requires the organization to ensure that any information security incident or vulnerability that may represent a significant risk to aviation safety is reported to its competent authority. Where the incident or vulnerability affects an aircraft or associated system or component, the organization also reports it to the design approval holder, and where it affects a system or constituent the organization uses, to the organization responsible for the design of that system or constituent. Point IS.I.OR.230(c) requires a notification as soon as the condition is known, a report as soon as possible and not exceeding 72 hours from the time the condition has been known to the organization, and a follow-up report on the recovery and prevention actions. The report is made in the form the competent authority defines and contains all relevant information about the condition known to the organization. Point IS.I.OR.230(a) requires an information security reporting system that complies with Regulation (EU) No 376/2014 and its delegated and implementing acts where that Regulation is applicable to the organization. Article 5(2) treats the cybersecurity requirements in point 1.7 of the Annex to Implementing Regulation (EU) 2015/1998 as equivalent to the requirements of this Regulation for an operator or entity in the national civil aviation security programs, except as regards point IS.I.OR.230, which must be complied with as such. The Regulation applies from , and from to the air navigation service provider of the European Geostationary Navigation Overlay Service. The authority responsible for certifying and overseeing compliance is, for each class of organization, the competent authority designated under the regulation that governs that class (Article 6(1)). Article 131 of Regulation (EU) 2018/1139 requires Member States to lay down the rules on penalties applicable to infringement of that Regulation and of the delegated and implementing acts adopted on the basis of it.
Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, rule 3(3), as inserted by the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (G.S.R. 120(E), dated )
Rule 3(3), inserted into the Intermediary Guidelines and Digital Media Ethics Code Rules, 2021 by amendment notified , applies where an intermediary offers a computer resource which may enable, permit, or facilitate the creation, generation, modification, alteration, publication, transmission, sharing, or dissemination of information as synthetically generated information. Such an intermediary must ensure that any such information not falling within a listed prohibited category (such as child sexual exploitative material or content falsely depicting a real person or event) is prominently labelled, in the visual display or by a prefixed audio disclosure, so a viewer can immediately identify it as synthetically generated. It must also embed that information with permanent metadata or another technical provenance mechanism, including a unique identifier, to the extent technically feasible. The intermediary must not enable removal, suppression or modification of that label or metadata. "Synthetically generated information" is defined as audio, visual or audio-visual information artificially or algorithmically created, generated, modified or altered using a computer resource so that it appears real, authentic or true, subject to listed exclusions for routine or good-faith editing, formatting and accessibility work. Under rule 3(3)(a)(i), such an intermediary must also deploy reasonable and appropriate technical measures, including automated tools or other suitable mechanisms, to not allow any user to create, generate, modify, alter, publish, transmit, share or disseminate synthetically generated information that violates any law in force. The rule's listed examples include information that contains child sexual exploitative and abuse material, non-consensual intimate imagery content, or is obscene, pornographic, invasive of another person's privacy or sexually explicit. Under rule 3(1)(ca), an intermediary of that kind must additionally inform its users that directing or causing its computer resource to produce or spread such prohibited synthetically generated information may attract penalty or punishment under any law in force. Rule 3(1)(ca) also requires that notice to say that such a contravention may lead to the immediate disabling of access to or removal of the information, suspension or termination of the violating user's account without vitiating the evidence, and disclosure of the violating user's identity to a complainant who is a victim of the contravention or acts on a victim's behalf. A significant social media intermediary is a social media intermediary with registered users in India above the threshold the Central Government notifies. Under rule 4(1A), a significant social media intermediary that enables displaying, uploading or publishing information must, before that display, require users to declare whether the information is synthetically generated and deploy appropriate technical measures, including automated tools, to verify the accuracy of the declaration. Where the declaration or verification confirms that the information is synthetically generated, that intermediary must ensure it is clearly and prominently displayed with a label or notice saying so. These provisions have applied since , the day the amendment rules state they come into force; the amendment was notified on .
The President signed the Act of amending the National Cybersecurity System Act on . It was published in the Journal of Laws on as item 252 and entered into force one month later under its own Article 49, rewriting the 2018 Act's risk-management, incident-reporting and penalty provisions to transpose the NIS2 Directive.
Zgłaszanie Incydentów Poważnych
Art. 11 ustawy z dnia 5 lipca 2018 r. o krajowym systemie cyberbezpieczeństwa (Dz.U. 2026 poz. 20), w brzmieniu nadanym ustawą z dnia 23 stycznia 2026 r. (Dz.U. 2026 poz. 252)
Art. 8 ustawy z dnia 5 lipca 2018 r. o krajowym systemie cyberbezpieczeństwa (Dz.U. 2026 poz. 20), w brzmieniu nadanym ustawą z dnia 23 stycznia 2026 r. (Dz.U. 2026 poz. 252)
Cybersecurity Act (Zakon za kibersigurnost, ZKS), Certified ICT Products and Restriction of Risky Technologies
Закон за киберсигурност (ЗКС), чл. 24 и 27, изм. с §§ 28 и 31 от Закона за изменение и допълнение на ЗКС, обн. ДВ, бр. 17 от 13.02.2026 г. (English: Cybersecurity Act, Arts. 24 and 27, as replaced by §§ 28 and 31 of the Act Amending and Supplementing the Cybersecurity Act, State Gazette No. 17 of )
Article 24 of the Cybersecurity Act, as replaced by Paragraph 28 of the Amending Act promulgated in State Gazette issue 17 of , lets the Council of Ministers, on the Cybersecurity Council's proposal, require essential and important entities by decree to use specific ICT products, services and processes certified under a European cybersecurity certification scheme adopted under Article 49 of Regulation (EU) 2019/881, to show compliance with the Article 22 risk-management measures. Article 27(1), as replaced by Paragraph 31, has the Cybersecurity Council propose to the Council of Ministers a decree restricting the use by the entities under Articles 4 and 4a of specific technologies or critical ICT supply chains. Under Article 27(2), an entity that already uses a technology such a decree restricts must stop using it within three years of the decree's adoption, or within the shorter period the decree sets where the risk to national security is high.
Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS)
Закон за киберсигурност (ЗКС), чл. 21 и 22, изм. с §§ 25 и 26 от Закона за изменение и допълнение на ЗКС, обн. ДВ, бр. 17 от 13.02.2026 г. (English: Cybersecurity Act, Arts. 21 and 22, as substituted by §§ 25 and 26 of the Act Amending and Supplementing the Cybersecurity Act, State Gazette No. 17 of )
The 51st National Assembly adopted the Act Amending and Supplementing the Cybersecurity Act, transposing the NIS2 Directive, on , and it was promulgated in State Gazette issue 17 on . It states no commencement date of its own, so it entered into force three days after promulgation under Article 5(5) of the Constitution, on .
Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS)
Закон за киберсигурност (ЗКС), чл. 23, изм. с § 27 от Закона за изменение и допълнение на ЗКС, обн. ДВ, бр. 17 от 13.02.2026 г. (English: Cybersecurity Act, Art. 23, as substituted by § 27 of the Act Amending and Supplementing the Cybersecurity Act, State Gazette No. 17 of )
The 51st National Assembly adopted the Act Amending and Supplementing the Cybersecurity Act, transposing the NIS2 Directive, on , and it was promulgated in State Gazette issue 17 on . It states no commencement date of its own, so it entered into force three days after promulgation under Article 5(5) of the Constitution, on .
Rule 3358:11-3-61 of the Ohio Administrative Code designates items such as a student's name, telephone number, mailing address, college e-mail address and major fields of study as directory information of Owens Community College. The college may disclose any of the directory information items without prior written consent, in accordance with the Family Educational Rights and Privacy Act of 1974. A student may prohibit the release of directory information by submitting an authorization to withhold directory information form to the records office. The rule took effect . The Ohio Administrative Code lists Owens Community College among the state community colleges. Section 3345.011 of the Revised Code counts community colleges, state community colleges and technical colleges among the state institutions of higher education.
Internet Code of Practice 2026, data breach notification (s. 3.4)
Section 3.4(a) of the Internet Code of Practice 2026 requires an Internet Access Service Provider to notify affected customers of any breach relating to the customer's information within 48 hours of becoming aware of the breach. Where full details are not immediately available, the provider issues a preliminary notification within the same 48 hours and a comprehensive update within 14 days after, or within a longer period the Commission approves. The customer notification is made through email and text message, or by another effective means the Commission approves. Section 3.4(b) requires the provider to notify the Commission in writing of any breach no later than 48 hours after it reasonably determines that a breach has occurred. The Code defines a data breach as an incident in which sensitive or confidential data is viewed, stolen or used by an unauthorized party. The Code applies to Internet Access Service Providers, which it defines as any entity licensed by the Nigerian Communications Commission that is engaged in the provision of an Internet Access Service. The Nigerian Communications Commission issued the Code as a Guidelines under section 70 of the Nigerian Communications Act 2003. The Commission published the Code as an amended edition of the Internet Code of Practice it first published in 2019. The Code's date line is . The Code states no commencement day of its own, and under section 2(2)(b) of the Interpretation Act an enactment with no provision on its commencement that is not contained in an Act of the National Assembly comes into force on the day it is made, so this row takes the Code's date line as its start. The Commission's Guidance Notes on the Code set a 90-day regulatory gestation period, running from the date of publication of the Code, before compliance monitoring and enforcement begin.
Article 13 of the Ombudsman Law (Tiesībsarga likums) gives the Ombudsman two tasks that concern artificial intelligence systems. Point 15 gives the Ombudsman the task of requesting and accessing the documentation of artificial intelligence systems that a review case needs. Point 16 gives the Ombudsman the task of submitting to the market surveillance authority, within its competence, a reasoned request to have an artificial intelligence system tested by technical means, where the documentation the review case needs is not sufficient. Points 15 and 16 are in the text of the Ombudsman Law in force on . Article 13 was amended by the law of , which took effect on .
Lei Estadual nº 24.085, de 10 de fevereiro de 2026 (Goiás)
Article 1 institutes the State Week of Awareness of the Use of Social Networks by Children and Adolescents, to be held every year in the second week of October. Article 2, item I, sets as an objective of the Week to spread information and guidance on the conscious and responsible use of social networks. Article 3 provides that, during the Week, activities aimed at awareness of the use of social networks by children and adolescents are to be stimulated. Article 5 enters the Law into force on the date of its publication.
Article 126: AI systems used in digital well-being services are systems of increased danger
Digital Code, Law No. 178, Art. 126 (read with Art. 1, definition 61), in force
Article 126 of the Digital Code provides that artificial intelligence systems used to provide digital well-being are artificial intelligence systems of increased danger. A provider of a digital well-being service that uses artificial intelligence systems within the service must comply with the requirements the Code sets for artificial intelligence systems of increased danger. The Code defines a digital well-being service as a service directed at improving the quality of life of a natural person on the basis of processing digital data on that person's physiological characteristics.
Digital Code, Law No. 178 (), in force , Chapter 11, Arts. 78, 88
The Kyrgyz Republic Digital Code, Law No. 178 of , entered into force on , moving personal-data law from the 2008 Law No. 58 into the Code's own Chapter 11. Article 1 of the introducing Law No. 179 of brings the Code into force after six months from that Law's official publication, and that Law was published in the official gazette Erkin Too on . Article 2 of Law No. 179 repeals Law No. 58.
Chapter 23: AI system design and risk-management obligations
Digital Code, Law No. 178 (), in force , Chapter 23, Arts. 191-196
Arts. 191-196, read in full, establish Kyrgyzstan's AI governance framework: Art. 191 sets non-binding design principles (risk reduction, openness, explainability, human oversight, accuracy, reliability, security) that any later binding requirement must implement, and Arts. 192-196 attach binding duties once an owner's own hazard assessment finds a system poses increased danger to a protected interest. An owner of such a system must reassess and republish the hazard assessment at each life-cycle stage, meet Cabinet of Ministers risk-management and documentation requirements, keep operating logs, and declare conformity by a published, digitally signed document before deployment. A user of such a system must operate it per its instructions, maintain effective human oversight, immediately suspend use and notify the owner once it has grounds to believe use could cause harm, keep logs, comply with a suspension or final court order, and, where the system's output feeds a rights-affecting decision, explain that result to an affected person on request free of charge; a person using the system solely for personal or family needs is excused most of these duties. Chapter 23 states no duty for an owner or a user to notify the authorized state body of a suspension or of grounds to believe a system may cause harm: that body's role under Arts. 194(5)(7) and 196(1)(7) is to demand a suspension the owner or user must then carry out, enforceable by a final court act ordering the system's use to stop.
Chapter 23: AI interaction and deepfake disclosure duties
Digital Code, Law No. 178 (), in force , Chapter 23, Art. 197
Art. 197, read in full, requires an owner or user of an AI system who applies it to interact with natural-person consumers to inform them they are dealing with an AI system, unless that is obvious from context; a user of a system that recognizes emotion or classifies a person by biometric characteristics must inform that person the system is being applied to them; and a user who applies such a system to create deepfakes must disclose that the material's origin or content was artificially produced or altered. The consumer-interaction and biometric-classification duties are excused where disclosure would defeat a lawful defense, national-security, or crime-prevention purpose, and the deepfake duty is separately excused for lawful use protecting those same interests or exercising freedom of scientific, technical, artistic or educational creation, each excused case still conditioned on measures protecting the rights the disclosure would otherwise serve.
Article 63, positioned in the Digital Code's general chapter on digital resilience outside its dedicated personal-data chapter, requires a record owner or digital service provider to notify the sectoral regulator of any incident in the digital environment affecting digital resilience or the rights and legitimate interests of a subject of a digital-environment legal relationship. That notice is due no later than 72 hours after the record owner or digital service provider discovers the incident, and a notice given after that clock must explain the reason for the delay. A processor must separately notify the record owner of an incident within whatever period their contract or an applicable legal act sets, and in any event no later than 48 hours after discovering it. The notification itself must describe the incident, estimate the number of affected users, name a contact responsible for the incident or for personal-data processing, describe the incident's consequences, and describe the remedial measures already taken. The record owner or digital service provider must update that notification as new facts about the incident or its consequences emerge. The duty is triggered by an incident affecting digital resilience broadly, not only one exposing personal data, and Kyrgyzstan's dedicated personal-data chapter states no separate breach-notification article of its own.
Article 63(1) states that state regulation of digital resilience exists to ensure the continuity of operation of the subjects and objects of the digital environment and their recovery after an incident there, expressly recognizing the practical impossibility of fully protecting against one. Article 63(2) requires every subject of a digital-environment legal relationship to achieve digital resilience by ensuring the integrity and availability of the objects of that relationship and the confidentiality of the digital data it processes. The same provision also requires monitoring for and helping prevent incidents in the digital environment and exchanging data about them, managing risk under a risk-management system, and managing the resources continuity of operation requires. Article 63(3) reserves the specific procedure for integrity, availability, and confidentiality measures over critical information infrastructure, and for monitoring and exchanging data about incidents affecting it, to Kyrgyzstan's cybersecurity legislation, a body of law not described here. Article 63(4) lets a sectoral regulator direct measures a digital-environment participant must implement to prevent an incident or reduce its negative consequences, and binds the participant to follow them.
Art. 80(1), read in full and confirmed word for word against the official portal, prohibits processing by default: data revealing racial or ethnic origin, political views, religious or philosophical beliefs, or trade-union membership; genetic information; biometric data for the digital identification of a natural person; and data concerning health, sex life, or sexual orientation. Art. 80(2) lifts the prohibition for contract necessity, explicit statutory authorization, vital-interest necessity, data the subject has explicitly made public, medical or public-health purposes, and (in part) membership processing by an association or religious organization. No definition of biometric data as a general term was found anywhere in the official Code text (confirmed by a search for the root "биометрич" (biometric) across the whole document, which surfaces only Art. 48's state-system provisions and Art. 80(1)(3)'s bare category name); the only enumerated biometric-modality list in the Code is Art. 48(3)'s narrower, government-identification-system-specific list, confirmed at the official source to read exactly: digital facial image, papillary-pattern fingerprints of both hands, and handwritten signature, naming no voice modality, which should not be read as governing this general provision.
Art. 81(1) allows processing of a child's personal data only in the cases listed in Art. 81(2), and only where the processing is in the child's interest and the safeguards of the Article apply. Art. 81(2) lists seven cases: a law that expressly requires the processing and sets its purposes, protection of the vital interests of the child or another person, medical and preventive purposes, public health or humanitarian aid, the administration of justice, national security, defense, public security or the prevention and prosecution of crime, and scientific, statistical or other research with appropriate data-protection measures and regard for the interests of children, or with anonymized records. Where none of those cases applies, Art. 81(3) allows processing only with the consent of the child's legal representative, for the purposes for which it was given. A child who has reached the age of fourteen may give consent personally when exercising rights and duties within the capacity set by civil law. Art. 81(4) requires the request for consent and the information about the processing to be written in clear, accessible language that a child can understand, and Art. 81(5) requires record owners to take the measures needed to prevent unlawful processing of children's personal data.
Art. 89, read in full and confirmed word for word against the official portal, has the sectoral personal-data regulator approve and publish a list of foreign states ensuring adequate protection; transfer to a listed state is carried out under the Code and may not be prohibited or restricted, a notably strong free-flow guarantee once a state is listed, and the record-owner must verify a destination's listing before transferring. Transfer to a non-listed state may still occur on subject consent, an international treaty, statutory necessity for the constitutional order, national defense, or state security, or contract necessity, with the article's remaining grounds past a fourth not extracted here. No localization or in-country-storage mandate was found anywhere in Art. 89 or elsewhere in what was read, a real jurisdictional contrast with Kazakhstan, Uzbekistan, Tajikistan, and Turkmenistan in this batch.
Digital Code, Law No. 178, Art. 90 (State Agency for Protection of Personal Data)
Art. 90, read at the official source, requires the sectoral personal-data regulator to be created under Art. 9 of the Code and to be independent of the persons it oversees, with a head who must hold qualifications and experience in personal-data protection. Art. 90(3) gives it real powers: applying and overseeing the Code; raising subject and controller awareness; advising state bodies; accrediting inspection bodies under Cabinet of Ministers procedure; hearing complaints and conducting inspections, including on its own initiative; taking preventive, corrective, and enforcement measures for violations; and publishing guidance. Art. 90(4) has it maintain a registry of record-owners recording incidents, inspection results, and binding decisions. No fine schedule or private-right-of-action provision appears within Art. 90 or in the other provisions of the Code described here. The Code's own text never names the regulator (it uses only "отраслевой регулятор в сфере персональных данных," sectoral regulator in the field of personal data, throughout, confirmed by a search finding zero occurrences of "Агентство" (Agency) anywhere in the Code); its identity as the State Agency for Protection of Personal Data (DPA) rests on the DPA's own official site, which describes itself in exactly these Digital-Code terms and institutionally predates the Code, having been established by a 2021 amendment to the now-repealed Law No. 58.
UK GDPR and Data Protection Act 2018, as Amended by the Data (Use and Access) Act 2025
Data Protection Act 2018 (c. 12); UK GDPR, as amended by the Data (Use and Access) Act 2025, c. 18
The Data (Use and Access) Act 2025's Part 5 data protection reforms, including the new recognised legitimate interests lawful basis, took effect, commenced by S.I. 2026/82.
Automated Decision-Making: Significant Decisions Based Solely on Automated Processing (UK GDPR Articles 22A to 22D)
Data (Use and Access) Act 2025, c. 18, s. 80, substituting Articles 22A to 22D into the UK GDPR
Section 80 of the Data (Use and Access) Act 2025 replaces Article 22 of the UK GDPR with Articles 22A to 22D. A decision is based solely on automated processing where there is no meaningful human involvement in taking it, and it is a significant decision where it produces a legal effect for the person or a similarly significant effect. A significant decision that rests entirely or partly on special category personal data may not be taken solely by automated processing unless the decision is based entirely on processing to which the person has given explicit consent, or the decision is necessary for entering into or performing a contract with the person, or is required or authorised by law, and point (g) of Article 9(2) applies. Where a controller takes a significant decision based solely on automated processing that uses personal data, it must have safeguards that give the person information about the decision, let them make representations, let them obtain human intervention and let them contest the decision. The Secretary of State may make regulations on what counts as meaningful human involvement and a similarly significant effect, and on further safeguards.
PECR, Storage of and Access to Information on Terminal Equipment
PECR (S.I. 2003/2426), reg. 6 and Sch. A1, as substituted by the Data (Use and Access) Act 2025
Regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 bars a person from storing information, or gaining access to information already stored, in a subscriber's or user's terminal equipment, subject to the exceptions Schedule A1 lists. Schedule A1, substituted with regulation 6 on by the Data (Use and Access) Act 2025, keeps the pre-existing consent exception, the exception for technical transmission, and the exception for storage or access strictly necessary for a requested information society service, and adds two new ones: collecting information for statistical purposes to improve a service or website, and adapting or enhancing a website's appearance or functionality, each conditioned on clear and comprehensive information to the subscriber or user and a simple, free means of objecting that they do not use.
UK GDPR Articles 44A-50, Cross-Border Transfer of Personal Data from the United Kingdom
UK GDPR, Arts. 44A-50, as amended by the Data (Use and Access) Act 2025
The Data (Use and Access) Act 2025 omitted the original UK GDPR Article 44 and inserted a new Article 44A restating the same adequacy, safeguards, or derogation structure, as the consolidated legislation.gov.uk text shows.
Age-Appropriate Design Code, sensitive personal data and biometric data
S.C. Code Ann. sec. 39-80-10(18) (Act No. 96 of 2026, H. 3431)
Chapter 80 defines sensitive personal data to include a Social Security number, precise geolocation, racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, union membership, the contents of an individual's mail, email, or text messages, genetic data, biometric data for the purpose of uniquely identifying an individual, and health data. The chapter uses that category only in the annual public report, which must state whether, how, and for what purpose the covered online service collects or processes minors' personal data and sensitive personal data. 'Biometric data' itself is never defined anywhere in the enacted text; the term appears exactly twice, once in this sensitive-data list and once in the publicly-available-data carve-out below, with no accompanying definitional entry among the chapter's twenty defined terms. Whether the term excludes an identifier derived from a photograph, video, or audio recording therefore cannot be determined from the statutory text; there is no definitional clause to read as imposing or narrowing such an exclusion. A narrower, separate carve-out excludes only 'biometric data collected by a covered online service about a minor without the minor's knowledge' from the chapter's definition of publicly available data, which does not address an adult's biometric data, or a knowingly collected minor's, drawn from a public recording.
S.C. Code Ann. sec. 39-80-80 (Act No. 96 of 2026, H. 3431)
The Attorney General enforces Chapter 80. A covered online service is liable for treble the financial damages incurred as a result of a violation, and officers and employees of a covered online service may be held personally liable for willful and wanton violations. The enacted text does not resolve whether the treble-damages remedy is available to a private plaintiff or is confined to a suit the Attorney General brings: no clause reads that an injured person may bring a civil action, the phrasing South Carolina's breach statute uses to grant one, and no clause reads that the chapter creates no private right of action. Whether a private right of action exists is therefore not established for this instrument; the treble-damages and personal-liability clauses read most naturally as remedies within the Attorney General's own suit given the enforcement section's framing naming only the Attorney General, and no construing case settles it.
South Carolina Age-Appropriate Design Code, general applicability and minor-protective design duties
S.C. Code Ann. secs. 39-80-10 et seq. (Act No. 96 of 2026, H. 3431)
The Age-Appropriate Design Code applies to a covered online service reasonably likely to be accessed by a minor (a person under 18). It is not a general controller or processor personal-data regime; it imposes design and data-minimization duties specifically toward minor users, including default privacy settings, limits on profiling, targeted advertising, and precise-geolocation collection for known minors, parental controls, and an annual public report by an independent auditor. The Act was enacted as Act No. 96 of 2026 (H. 3431, the South Carolina Social Media Regulation Act on its own caption) and creates Chapter 80 of Title 39; it took effect immediately upon the Governor's approval on .
Requires online services reasonably likely to be accessed by minors to set protective default privacy settings for known minors, offer opt outs from personalized recommendation systems, limit addictive design features and nighttime and school hours notifications, and undergo independent third party audits reported to the Attorney General. NetChoice sued days after enactment and a preliminary injunction motion is pending.
Decreto Supremo N.° 126-2025-PCM, Reglamento del Decreto de Urgencia N.° 007-2020 (Marco de Confianza Digital)
Notification of Digital-Security Incidents
Decreto Supremo N.° 126-2025-PCM, Reglamento del Decreto de Urgencia N.° 007-2020 (Marco de Confianza Digital), arts. 18.1(a) and 31 to 34
Article 18.1(a) of the Regulation requires such a provider to notify the Centro Nacional de Seguridad Digital (CNSD) of the digital-security incidents of its organization through the established protocols, channels and deadlines. Article 32.1 of the Regulation requires a critical-level incident to be notified to the CNSD within a maximum of forty-eight hours from when the provider becomes aware of it. Article 32.2 of the Regulation requires an incident of any other classification to be notified within the periods the Secretaría de Gobierno y Transformación Digital sets. Article 31.2 of the Regulation requires the notification to contain at least a description of the incident, its classification and its impact. Article 34.4 of the Regulation makes the provider responsible for notifying the CNSD of an incident, with its third-party service providers reporting to the provider the incidents under their control. Notifying the CNSD does not release the provider from notifying the Autoridad Nacional de Protección de Datos Personales where the incident compromised the personal data of its users. Supreme Decree 126-2025-PCM was published in the official gazette El Peruano on . The Regulation enters into force ninety calendar days after the day following its publication.
Decreto Supremo N.° 126-2025-PCM, Reglamento del Decreto de Urgencia N.° 007-2020 (Marco de Confianza Digital), arts. 12, 14 and 18
Article 14.1 of the Regulation requires digital service providers in the financial, basic-service, health, passenger-transport, internet-service, critical-activity and education sectors to manage digital-security risks in their organization so as to set controls that protect the confidentiality, integrity and availability of information. Article 18.1(b) of the Regulation requires such a provider to implement security controls and measures in providing its digital services according to its risk assessment. Article 18.1(f) of the Regulation requires such a provider to maintain a secure, scalable and interoperable infrastructure. Article 18.1(i) of the Regulation requires such a provider to test its digital services proactively for vulnerabilities. Where a provider is also regulated by a law or special rule, article 18.2 of the Regulation requires it to comply with its sector rules, and the Regulation then applies only in what those rules do not provide. A private organization outside the scope of Decreto de Urgencia 007-2020 treats the Regulation as reference only. Article 15 of the Regulation leaves it to a private entity whether to designate a digital security and trust officer. Supreme Decree 126-2025-PCM was published in the official gazette El Peruano on . The Regulation enters into force ninety calendar days after the day following its publication.
Rule 3.5.18 requires an Authorised Person to notify the Regulator immediately, and in any event no later than 24 hours, after it becomes aware or has information which reasonably suggests that a material Cyber Incident has occurred. Rule 3.5.18 states that notification to the Regulator should use the prescribed incident reporting form available on the relevant electronic portal. Rule 3.5.16 requires an Authorised Person to review its Cyber Incident Response Plan after the occurrence of a material Cyber Incident that is reportable under Rule 3.5.18. The FSRA notice of states that Authorised Persons must notify the FSRA immediately upon discovery of a suspected material cyber incident and, in any event, no later than 24-hours after they become aware of information that reasonably suggests such an incident has occurred. The ADGM Financial Services Regulatory Authority states that the Cyber Risk Management Rules under GEN 3.5 come into effect on .
ADGM General Rulebook (GEN), Rules 3.5.1 to 3.5.17
Rule 3.5.1 of the ADGM General Rulebook requires an Authorised Person to establish and maintain a Cyber Risk Management Framework to identify, assess and manage its Cyber Risks effectively. Rule 3.5.1 also requires the framework to be in writing and approved by the Governing Body of the Authorised Person. Rule 3.5.4 requires an Authorised Person to carry out an assessment of the Cyber Risk associated with its ICT Assets regularly and no less than annually. Rule 3.5.10 requires an Authorised Person to establish a process for the management of software updates that addresses security vulnerabilities in its ICT Assets. Rule 3.5.11 requires an Authorised Person to implement appropriate encryption techniques to protect the confidentiality and integrity of information in transit, at rest, and at end of life. Rule 3.5.14 requires an Authorised Person to have a comprehensive programme to test the resilience of its IT Systems and Networks, carried out regularly and, for internet-facing systems, at least annually. Rule 3.5.16 requires an Authorised Person to establish and maintain a robust Cyber Incident Response Plan providing for measures to respond to and limit the consequences of a Cyber Incident. The ADGM Financial Services Regulatory Authority states that the Cyber Risk Management Rules under GEN 3.5 come into effect on .
By The Babylon Bee, LLC v. Lopez, United States District Court for the District of Hawaii
On cross-motions for summary judgment, the District of Hawaii granted summary judgment to The Babylon Bee, LLC and Dawn O'Brien and denied the State Defendants' motion for summary judgment. It permanently enjoined the State Defendants from enforcing Act 191. The court found that Act 191 discriminates based on content and speaker and, in doing so, restricts constitutionally protected political speech, making it presumptively invalid and subject to strict scrutiny, and that it fails narrow tailoring. It also concluded that Act 191 is unconstitutionally vague under the Fourteenth Amendment.
N.Y.C. Council Int. No. 504 of 2026 (proposed Admin. Code tit. 3, new ch. 12, § 1057-h)
Council Member Nantasha M. Williams's bill was introduced and referred to committee on , and was re-referred to committee on and heard and laid over by the Committee of the Whole on .
Article 1 provides that, for the purpose of Article 45 of Regulation (EU) 2016/679, Brazil ensures an adequate level of protection for personal data transferred from the European Union to controllers and processors in Brazil subject to the General Data Protection Law (LGPD). The Decision cites the LGPD as Law No 13.709 of , the General Data Protection Law (Lei Geral de Proteção de Dados Pessoais). Article 2 requires a Member State whose competent authorities exercise their powers under Article 58 of Regulation (EU) 2016/679 over data transfers within the scope of Article 1 to inform the Commission without delay. Article 3(1) requires the Commission to monitor continuously the application of the legal framework upon which the Decision is based with a view to assessing whether Brazil continues to ensure an adequate level of protection within the meaning of Article 1. Article 3(2) requires the Member States and the Commission to inform each other of cases where the Brazilian Data Protection Authority (Agência Nacional de Proteção de Dados, ANPD), or any other competent Brazilian authority, fails to ensure compliance with the legal framework upon which the Decision is based. Article 3(4) requires the Commission, after four years from the date of the notification of the Decision to the Member States and subsequently at least every four years, to evaluate the finding in Article 1 on the basis of all available information, including the information received as part of the review carried out together with the relevant Brazilian authorities. Article 3(5) provides that, where the Commission has indications that an adequate level of protection is no longer ensured, it informs the competent Brazilian authorities and may suspend, repeal, or amend the Decision. Article 3(6) provides that the Commission may also suspend, repeal, or amend the Decision if the lack of cooperation of the Brazilian government prevents the Commission from determining whether the finding in Article 1 is affected. Article 4 provides that the Decision is addressed to the Member States.
Legal Notice 22 of 2026, published in the Malta Government Gazette No. 21,575 of , is the Commencement Notice under article 1(3) of the Order. The Minister responsible for critical infrastructure protection established as the date on which all of its provisions come into force.
Risk-Management Measures for Essential and Important Entities
S.L. 460.41, arts. 18, 19 and 24, Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order
AI Framework Act, Article 31 (transparency obligations for AI outputs)
Act No. 20676, Article 31
An AI business operator providing a product or service using high-impact or generative AI must give users prior notice that it operates on that AI. An operator providing generative AI, or a product or service using it, must indicate that output was AI-generated, either through a human-perceptible label or machine-readable metadata or watermark. Where an operator uses AI to produce a virtual sound, image, or video difficult to distinguish from reality, only a user-perceptible label satisfies the deepfake-specific duty, with a narrow exception for artistic or creative works. The Act reaches conduct outside Korea affecting Korean users under its own extraterritoriality clause, and a foreign operator meeting revenue or user thresholds must appoint a domestic representative.
AI Framework Act, Article 32 (safety-assurance duty for high-compute AI systems)
Act No. 20676, Article 32
The Act's Addenda set general commencement at one year after promulgation, which the statute's own header confirms as . Article 32 is not among the provisions the Addenda schedule separately, so it took effect on that general date together with the Enforcement Decree's Article 24, which defines the compute threshold.
AI Framework Act, Article 34 (business-operator duties for high-impact AI)
Act No. 20676, Article 34
The Act's Addenda set general commencement at one year after promulgation, which the statute's own header confirms as . Article 34 is not among the provisions the Addenda schedule separately, so it took effect on that general date together with the Enforcement Decree's Article 27, which sets the posting and retention rules.
AI Framework Act, Article 35 (impact assessment for high-impact AI)
Act No. 20676, Article 35
An AI business operator that provides a product or service using high-impact AI must endeavor to assess in advance the effect on people's fundamental rights. The duty to endeavor to assess took effect on , with the rest of the Act. The assessment must also reflect the characteristics of vulnerable groups of AI users, according to the nature of the product or service. That sentence comes from an amending Act promulgated on , and took effect six months after promulgation. A state organ or similar body that intends to use such a product or service must give priority consideration to one that has undergone an impact assessment. The Enforcement Decree requires the assessment to cover seven matters, among them the individuals and groups likely to be affected, the types of fundamental rights engaged, the metrics used, and measures to prevent, mitigate and recover from harm. The operator may carry out the assessment itself or commission a third party.
AI Framework Act, Article 36 (domestic representative of a foreign AI business operator)
Act No. 20676, Article 36
An AI business operator with no address or business office in Korea, whose users or revenue meet the thresholds the Enforcement Decree sets, must designate a domestic representative in writing and report the designation to the Minister of Science and ICT. The representative acts for the operator in submitting the results required by Article 32(2), in asking the Minister to confirm that its AI is high-impact, and in supporting the Article 34(1) safety measures, including checking that the documents are current and accurate. The representative must have an address or business office in Korea. A violation of the Act by the representative in these matters is treated as the act of the operator that designated it. The Enforcement Decree sets the thresholds as prior-year revenue of KRW 1 trillion or more, prior-year AI-service revenue of KRW 10 billion or more, an average of 1,000,000 or more daily domestic users over the last three months of the prior year, or a past fine under Article 43(1)(3) of the Act. An operator that fails to designate a representative is subject to an administrative fine of up to KRW 30 million. Article 36 took effect on , with the rest of the Act.
Enforcement Decree of the AI Framework Act, Article 23 (method of notice and AI-generated indication)
Presidential Decree No. 36053, Article 23
An operator providing a product or service that uses high-impact or generative AI must tell users in advance that it runs on that AI, by stating it on the product or in a contract, manual or terms of use, by showing it on the user's screen or device, by posting it where the product or service is provided, or by another method the Minister recognizes. The indication that output was AI-generated may be given in a way people can perceive or in a machine-readable way. A machine-readable indication must be accompanied, at least once, by a notice in text or voice that the output was generated by generative AI. A notice or indication of a virtual sound, image or video that is difficult to distinguish from reality must be given in a way the user can clearly recognize, taking account of the main users' age and physical and social conditions. The notice and indication rules may be set aside, wholly or in part, where the use of high-impact or generative AI is obvious, where the AI serves only the operator's internal work, or where the Minister's public notice provides an exception. The Enforcement Decree took effect on , together with the Act.
Decreto Supremo 115-2025-PCM, arts. 22-23 (Reglamento de la Ley 31814, Clasificación de Riesgos: Uso Indebido)
Article 22 classifies AI risk into two named categories, uso indebido (misuse, deemed prohibited by definition) and high-risk use, and treats every other use as acceptable risk. Article 23 deems it misuse to influence a person's decision-making in a deceptive or manipulative way, including through subliminal techniques or by exploiting cognitive, emotional, or socioeconomic vulnerabilities to substantially alter behavior. It is also misuse to generate an autonomous lethal capability that decides without human supervision and can cause physical harm or affect life or physical integrity in a civilian setting. Carrying out mass surveillance without a legal basis or where it generates or may generate a disproportionate impact on the exercise of fundamental rights is misuse as well. So is analyzing, classifying, or inferring a person's sensitive data from their biometric data to deduce racial or ethnic origin, political opinions, union affiliation, religious or philosophical convictions, or sexual life or orientation, or evaluating or classifying natural persons or groups in a way that produces discriminatory or disproportionate results violating fundamental rights. Carrying out real-time biometric identification to categorize natural persons in public spaces is misuse too, except for pure digital-identity authentication or the preliminary investigation of a defined list of serious crimes. Predicting that a natural person will commit a crime based on profiling or an assessment of personality traits is likewise misuse. Article 23.4 excepts, specifically from the real-time biometric identification prohibition, a system that supports a human evaluator's assessment of a person's involvement in an existing criminal activity, provided the assessment rests on objective, verifiable facts and the system carries human-oversight, transparency, and auditability mechanisms guaranteeing non-discrimination. The Regulation applies to public-administration entities and to private-sector organizations, civil society, citizens, and academia, and enters into force ninety business days after its publication. It creates no sanctioning regime of its own for a breach of these prohibitions distinct from referring suspected violations to the competent authority.
Decreto Supremo 115-2025-PCM, arts. 24-25 (Reglamento de la Ley 31814, Riesgo Alto y Transparencia Algorítmica)
Article 24 classifies an AI-based system's use as high-risk where, among other criteria, it manages critical national assets supporting essential services (energy, telecommunications, health, transport, water, and banking, among others) or is used to evaluate a person in a selection process. A developer or implementer may ask the SGTD to determine whether a use falls within the high-risk category. Article 25 requires the developer or implementer of a high-risk system to establish mechanisms guaranteeing algorithmic transparency, informing the user beforehand, clearly and simply, of the system's purpose or use, its main functions, and the kind of decisions it can make, and, where the system's decisions affect human rights, to explain its results to affected users in accessible language. For a private-sector developer or implementer, article 25's transparency duty and a related Title VI chapter phase in gradually by sector, starting the day after the Decreto Supremo's publication: one year for AI uses in health, education, justice, security, and economy-finance; two years for transport, commerce, and labor; three years for production, agriculture, energy, and mining; and four years for every other use nationwide, with a further, longer schedule for small businesses and innovative start-ups. Public-sector entities implement article 25 on their own graduated schedule, running from one to three years after the Decreto Supremo's publication depending on the type of entity; only for the smallest local governments (Tipo D, E, F, and G) is implementing article 25 described as facultative, according to their resources and capacities. Article 26 requires compliance with the personal-data and privacy rules in force for any high-risk system's development, implementation, or use, and states that liability for a breach of those data-protection duties is determined under Ley No. 29733's own sanctioning regime rather than under this Decreto Supremo.
Law ZRU-1115, personal data processed using artificial intelligence
Law of the Republic of Uzbekistan ZRU-1115 (), Article 2 (Code of Administrative Responsibility, Article 46-2, Part 2) and Article 1(5) (Law on Informatization, Article 12-1)
Law ZRU-1115 of adds a second part to Article 46-2 of the Code of Administrative Responsibility, which makes unlawful processing of personal data using artificial intelligence technologies, and the distribution of such data in the media, telecommunications networks or the internet, an administrative offence. The offence carries a fine of 50 to 100 basic calculated values, with confiscation of the objects of the administrative offence. Article 12-1 of the Law on Informatization requires a website owner, including a blogger, not to allow a website, page or other information resource on which publicly available information is posted to be used for the purposes it lists. Law ZRU-1115 added to that list the unlawful processing of personal data using artificial intelligence technologies and the distribution of such data in the media, telecommunications networks or the internet. The Law enters into force on the day of its official publication. The official legislation portal gives as its date of entry into force.
Radio equipment in a class or category specified by a Commission delegated act under Article 44 of the Radio Equipment Directive, for the purposes of Article 3(3), must comply with the essential requirements in Article 3(3)(a) to (i) that the delegated act requires, while it is in force (regulation 4(5)). A person may make radio equipment available on the market, or put it into service, only if it complies with the Regulations (regulation 4(3) and (4)). The Commission for Communications Regulation is designated as the competent authority (regulation 9). A person who commits an offence under the Regulations is liable on summary conviction to a class A fine or imprisonment for up to 6 months or both, and on conviction on indictment to a fine of up to 500,000 euro or imprisonment for up to 2 years or both (regulation 58). The Regulations were made on (the closing formula) and revoke the Regulations of 2017 (regulation 61).
Accessibility standard for State agency web pages, web sites and web content
State agency websites, N.J.S.A. 52:18A-234(b) (P.L.2025, c.289)
WCAG 2.1 Level AA, or the most up-to-date version the World Wide Web Consortium publishes where the State agency deems it practicable, is the accessibility standard for the web pages, web sites and web content of all State agencies. Each web page, site and content must be configured so that it can be navigated, viewed and accessed on a mobile device. A State agency is the executive and legislative branches of the State, including any department, board, bureau, commission, division, office, council, agency or instrumentality, independent agency, public authority or public benefit corporation. The amending act took effect immediately on its approval on .
Statewide Longitudinal Data System for Education and Workforce Development: NIST standards, secure environment with aggregate-only release, and privacy standards
Statewide Longitudinal Data System, N.J.S.A. 18A:4-2.1 (P.L.2025, c.388, section 1)
The Statewide Longitudinal Data System Governing Body consists of one representative from each of the Department of Education, the Office of the Secretary of Higher Education, the Higher Education Student Assistance Authority and the Department of Labor and Workforce Development. The governing body must establish and maintain a Statewide Longitudinal Data System for Education and Workforce Development, or may enter into an agreement with a separate entity to do so. The system must meet the standards of the National Institute of Standards and Technology and maintain certification or accreditation, as applicable, from it. The system must follow rigorous data security guidelines and may release only aggregate-level data from the secure environment. The governing body must operate with the objective of defining and maintaining standards for privacy, confidentiality and security of data. Each participating agency in the governing body must provide the data necessary to carry out the act. Data provided to the system must be provided in accordance with all State and federal laws governing the protection, retention and sharing of the data. The act took effect immediately and was approved on .
Under rule 3356-4-22 of the Ohio Administrative Code, Youngstown State University is committed to ensuring that all communication with university constituents with disabilities, including students, prospective students, employees, guests and visitors, is as effective as communication with those without disabilities. All digital content must be accessible to university constituents and must adhere to the university's digital accessibility standards. The policy applies to all digital content, excluding digital content intended for private use only. The university's digital accessibility standards are drawn from the W3C web accessibility initiative, the section 508 standards and the most current web content accessibility guidelines. All software and IT systems, free or purchased, must produce accessible products and documents or be compatible with assistive technology. The digital accessibility coordinator is authorized to disable any digital content found to be in violation of the digital accessibility standards. The current version of the rule took effect .
Law on Artificial Intelligence, prohibited practices
Law No. 230-VIII (), Art. 17(3)
Article 31 of the Law brings it into force upon expiry of sixty calendar days after its first official publication on , so the Article 17(3) prohibited-practices list took effect on .
Law on Artificial Intelligence, copyright and training data
Law No. 230-VIII (), Art. 23
Article 31 of the Law brings it into force upon expiry of sixty calendar days after its first official publication on , so Article 23's copyright and training-data provisions took effect on .
Law on Artificial Intelligence, machine-readable opt-out for training on published works
Law No. 230-VIII (), Art. 23(5)
Article 31 of the Law brings it into force upon expiry of sixty calendar days after its first official publication on , so Article 23's training-data opt-out took effect on .
Law on Artificial Intelligence, transparency and disclosure duties
Law No. 230-VIII (), Arts. 7, 21
Article 31 of the Law brings it into force upon expiry of sixty calendar days after its first official publication on , so the transparency and labelling duties took effect on .
Code of Administrative Offences, artificial intelligence violations
Law No. 232-VIII (), Administrative Offences Code Art. 641-1
Article 2 of Law No. 232-VIII brings it into force upon expiry of sixty calendar days after its first official publication on , except for a named handful of unrelated subparagraphs, so the subparagraph adding Article 641-1 took effect on .
Law on Personal Data and Their Protection, data subject rights
Law No. 94-V (), Art. 24; Art. 8(7); Art. 19-1
Law No. 231-VIII was officially published and by its own terms came into force upon expiry of sixty calendar days, on , bringing the new Article 19-1 objection right into effect.
Latvijas Bankas noteikumi Nr. 409, Prasības digitālās darbības nepārtrauktības un noturības jomā finanšu tirgus dalībniekiem, kuriem nepiemēro Regulu (ES) 2022/2554 (2026. gada 5. janvāris)
The Bank of Latvia's Regulations No. 409 (Latvijas Bankas noteikumi), issued under Article 6(3) of the Financial Market Digital Operational Resilience and Use of Artificial Intelligence Law, set ICT risk-management, information-security, ICT-operations and business-continuity requirements for the financial market participants that Regulation (EU) 2022/2554 (DORA) does not cover. The regulations were adopted on , published in Latvijas Vēstnesis No. 3 on and took effect on . They apply to small alternative investment fund managers, small insurers and reinsurers, micro, small and medium-sized insurance intermediaries, the persons in points 2, 3, 4, 6, 7, 9, 12, 13, 15 and 16 of Article 101(7) of the Financial Instrument Market Law, savings and loan associations, small private pension funds with no more than 15 plan members and giro settlement institutions. A participant must put in place and document an ICT risk-management and control framework for which its management bears overall responsibility, and must draw up, document and implement an information security policy that protects the confidentiality, integrity and availability of data and services. A participant must carry out and document an ICT risk assessment at least once a year.
The Swedish government issued the Cybersäkerhetslag (2025:1506) on ; it entered into force on and its transitional provisions repealed the prior lag (2018:1174) om informationssäkerhet för samhällsviktiga och digitala tjänster, Sweden's NIS1 transposition, on the same date.
Unlike some other Member States' NIS2 transpositions, Sweden's notification clock applied from the Act's own commencement on , with no separate transitional delay.
Cybersäkerhetsförordning (2025:1507), Notification Channels and Supervisory Authorities
Cybersäkerhetsförordning (2025:1507), 4-8 §§ och 18 §
The Cybersäkerhetsförordning (2025:1507) (Cybersecurity Ordinance) was issued by the Government on as supplementary provisions to the Cybersäkerhetslag (2025:1506) and entered into force on , repealing the earlier ordinance (2018:1175) on information security for essential and digital services. Section 4 brings the state authorities listed in Annex 1 to the ordinance (2022:524) on state authorities' preparedness within the Act, unless they are exempted under chapter 1, section 12 of the Act. Under sections 5 and 6, a notification under chapter 2, section 2 of the Act is made to the single point of contact, and incident reporting under chapter 2, sections 5 to 8 is made to the CSIRT unit. Section 7 names the supervisory authority for each sector, among them the Post- och telestyrelsen for digital infrastructure, digital providers and ICT service management between businesses, the Finansinspektionen for banking and financial market infrastructure, the Statens energimyndighet for energy and the Transportstyrelsen for transport. Section 8 also makes the Post- och telestyrelsen the supervisory authority for the county administrative boards and for operators offering domain name registration services. Section 18 requires the supervisory authority to cooperate with the Integritetsskyddsmyndigheten (Swedish Authority for Privacy Protection) when handling incidents that are also personal data incidents.
The Parliament of the Republic of Kazakhstan adopted the Digital Code, officially published in Egemen Qazaqstan No. 5-6 and Kazakhstanskaya Pravda No. 5-6.
Banque du Liban Basic Decision No. 13790 of (Basic Circular No. 1 to Electronic Payment Services Providers), Arts. 9, 24 and 39
Article 2 requires any institution intending to provide a covered service to obtain a prior approval from Banque du Liban to be licensed as an Electronic Payment Services Provider in one or more of five categories of services. Article 24 requires the licensed institution to comply with the regulatory rules on IT security and with Basic Decision 12725 on cybercrime prevention. Article 9 requires the institution to prepare a detailed description of its IT infrastructure and information security framework, including information security measures protecting customers' funds and financial and personal data. Article 39 requires an institution providing the Payment Gateway service to obtain a Payment Card Industry Data Security Standard certification. Article 40 lets the Central Council impose a fine of up to 1,500,000,000 Lebanese pounds for each violation of the Decision. Article 41 lets Banque du Liban refer a violating institution to the Higher Banking Commission, which may impose a warning, limits on its activities, a ban on its managers and license revocation. Article 46 provides that the Decision enters into force upon its issuance.
Section 20^1 of the Põhikooli- ja gümnaasiumiseadus (Basic Schools and Upper Secondary Schools Act) gives a school the right to process a pupil's personal data in order to use an artificial intelligence application in teaching. The school processes the pupil's general data, the personal data, including special categories, that the pupil enters into the application to complete the curriculum, and other personal data, including special categories, that the pupil enters while using it. The school keeps the personal data for up to three months after the pupil leaves the school. The application must let the pupil delete the other personal data that the pupil entered while using it, which point 3 of subsection 2 describes, and where the two kinds of data cannot be told apart, must let the pupil delete all the data the pupil entered. The application must not allow a school representative access to those other data, or, where the two kinds of data cannot be told apart, to any of the data the pupil entered. The minister responsible for the field may by regulation set further safeguards for the use of an artificial intelligence application.
Regulations Governing the Reporting, Response and Drills for Cyber Security Incidents (資通安全事件通報應變及演練辦法), full-text amendment issued (Ministry of Digital Affairs Order Shu-Shou-Zi-Fa-Zi No. 1145000415), Arts. 11 and 13
The Regulations are prescribed under Article 24(4) of the Cyber Security Management Act, among other provisions of that Act. Article 24(4) of the Act leaves the necessary items of the reporting and response mechanism, the reporting content and the submission of reports to rules the competent authority prescribes.
Article 11(1) of the Regulations requires a specific non-government agency to report a cyber security incident within one hour after becoming aware of it.
Article 13(1) of the Regulations requires a specific non-government agency to complete damage-control or recovery operations within 72 hours of becoming aware of a level 1 or level 2 incident and within 36 hours of becoming aware of a major incident. Article 13(2) of the Regulations requires the agency to submit an investigation, handling and corrective action report within one month after those operations.
The Act defines a specific non-government agency as a critical infrastructure provider, a government-owned enterprise, a designated foundation, or any enterprise, organization or institution under control of the government.
Article 29 of the Act punishes a specific non-government agency that fails to report an incident under Article 24(2) with a fine of NT$300,000 to NT$10,000,000. Article 30 of the Act fines a specific non-government agency NT$100,000 to NT$5,000,000 for each violation it lists, after an unheeded order to correct. Those violations include a failure to submit an investigation, handling and corrective action report of a cyber security incident.
The full-text amendment of took effect on the date of its issuance.
Law on Cybersecurity: Service Provider Security Obligations in Vital Sectors
Law on Cybersecurity, arts. 1, 9, 16, 17, 18, 20 and 25 (Law of the Republic of Armenia No. HO-442-N)
Article 1(3) extends the Law to legal entities and individual entrepreneurs that carry out activities in one or more vital sectors and operate an information system or critical information infrastructure, and to state and local self-government bodies. Article 1(4) excludes micro and small enterprises unless they operate a critical information infrastructure. Article 16(4) lists fourteen vital sectors, among them energy, transport, communications, financial services, healthcare and information technology, which includes digital infrastructures such as cloud computing services, electronic trading platforms and online search engines (Article 3(1)(8)). Article 16(3) deems information systems for qualified trust services, top-level domain registry services, DNS services and, for medium-sized entities, electronic communications or Internet access services to be critical information infrastructures by operation of law. Article 9(1) requires a service provider to take organisational and technical measures around the clock to detect and manage cyber threats and to prevent, detect, block and resolve cyber incidents. Article 9(2) requires a service provider to have an internal cybersecurity regulation. Article 9(3)(4) requires a service provider to ensure daily monitoring to detect cyberattacks, cyber threats and vulnerabilities, from the day its secondary legal act takes effect. Article 9(3)(7) requires a service provider to prepare reports on its response to a cyber incident and to retain them for at least three years. Article 9(3)(11) requires a service provider to comply with basic cyberhygiene requirements based on the Zero Trust Principle. Article 20(2) requires a service provider to undergo a cybersecurity audit once every three years unless a standard sets another interval. Article 25 sets the Law in force on the tenth day after promulgation, except Article 8 and some provisions of Article 9 that start when their secondary legal acts take effect. Article 25(5) gives service providers eighteen months after the Law enters into force to adopt internal regulations, carry out risk assessments and prepare a plan of measures. Article 25(2) gives operators of critical information infrastructure twenty-four months after the Law enters into force to submit a document certifying compliance with a cybersecurity standard.
Law on Cybersecurity, art. 11 (Law of the Republic of Armenia No. HO-442-N)
Article 11(1) requires a service provider to notify the Autonomous body of a cyber incident immediately upon becoming aware of it, and no later than within 24 hours, where the incident has a significant impact on the continuous and secure operation of the information system or critical information infrastructure, or where such an impact cannot yet be assessed but may reasonably be presumed. Article 11(2) sets the conditions under which an incident has a significant impact. Article 11(4) requires updated information, including the incident's severity and consequences, within 72 hours after becoming aware. Article 11(7) requires the service provider to notify the persons potentially affected by the incident immediately, or within two days where that is not possible. Article 11(9) requires a final report to the Autonomous body within one month after the updated information. Article 12(1) lets a person that is not a service provider, including a natural person, notify the Autonomous body voluntarily of a cyber incident, cyberattack, cyber threat or vulnerability.
Law No. 1 of 2023, Article 332, Criminal Code (KUHP)
Article IX of Law No. 1 of 2026 provides that it takes effect on , and its preamble records as the day the Criminal Code takes effect. Article VII item 35 of that Law substitutes new text for article 332 of the Code.
The Decree by Law took effect, starting the one-year window for covered internet service providers and digital platforms to bring their age-verification, privacy-default, and parental-control practices into compliance.
Personal Data Protection Order, 2025 (S 1/2025), s.24
Government Gazette No. S 11/2025 appointed as the commencement date for Parts 3 to 9 of the Order, section 42, and Schedules 1 to 5, bringing section 24's comparable-protection transfer standard into force.
Personal Data Protection Order, 2025 (S 1/2025), ss.18-20
Government Gazette No. S 11/2025 appointed as the commencement date for Parts 3 to 9 of the Order, section 42, and Schedules 1 to 5, bringing Part 5's access and correction rights into force.
Personal Data Protection Order, 2025 (S 1/2025), ss.2, 3, 8
Government Gazette No. S 11/2025 appointed as the commencement date for Parts 3 to 9 of the Order, section 42, and Schedules 1 to 5, bringing section 8's consent requirement and the rest of the collection, use and disclosure duties into force.
Personal Data Protection Order, 2025 (S 1/2025), ss.37, 59
Government Gazette No. S 11/2025 appointed as the commencement date for Parts 3 to 9 of the Order, section 42, and Schedules 1 to 5, bringing section 37's financial-penalty power into force.
Personal Data Protection Order, 2025 (S 1/2025), Part 7 (ss.25-29)
Government Gazette No. S 11/2025 appointed as the commencement date for Parts 3 to 9 of the Order, section 42, and Schedules 1 to 5, bringing Part 7's breach notification duties into force.
Employment Standards Act, 2000, use of artificial intelligence in job postings
Employment Standards Act, 2000, S.O. 2000, c. 41, ss. 8.1, 8.4, as enacted by the Working for Workers Four Act, 2024, S.O. 2024, c. 3, Sched. 2, s. 2(1), and Ontario Regulation 476/24 (Rules and Exemptions re Job Postings), ss. 1, 2(1)
Section 8.4 came into force by proclamation. Ontario Regulation 476/24's definitions of artificial intelligence and publicly advertised job posting and its 25-employee exemption came into force the same day, because the Regulation had already been filed and its own commencement clause ties those provisions to the later of the Regulation's filing date and the day section 8.4 comes into force.
Personal Health Information Protection Act, 2004, breach notification by the prescribed organization for digital health identifier records
S.O. 2004, c. 3, Sched. A, s. 55.24; O. Reg. 329/04, ss. 18.13 and 18.14
If the prescribed organization determines that digital health identifier records have been stolen, lost or used or disclosed without authority, it shall, at the first reasonable opportunity, notify the individual to whom the personal health information relates. The notice to the individual must include a statement that the individual is entitled to make a complaint to the Commissioner under Part VI. The prescribed organization shall, in accordance with the regulations, if any, notify the Commissioner of a theft or loss of or an unauthorized use or disclosure of digital health identifier records if the circumstances meet the prescribed requirements. The circumstances in which the Agency must notify the Commissioner include reasonable grounds to believe that a digital health identifier record was used or disclosed without authority by a person who knew or ought to have known that they were doing so, and reasonable grounds to believe that a digital health identifier record was stolen. The Agency shall notify the Commissioner of the existence of such a circumstance at the first reasonable opportunity. The Agency is an agent of the Crown and may exercise its powers only as an agent of the Crown. On or before March 1 in each year starting in 2027, the Agency shall provide the Commissioner with a report setting out the number of times in the previous calendar year that digital health identifier records were stolen, lost, used without authority or disclosed without authority, and that personal health information was collected by the Agency for the purposes of Part V.2 without authority. Section 8 of Schedule 6 to chapter 7 of 2025, which enacted section 55.24, was in force on .
Personal Health Information Protection Act, 2004, access to electronic health record and digital health identifier records
S.O. 2004, c. 3, Sched. A, ss. 51 (5)-(8), 55 (1.1)-(1.2); O. Reg. 329/04, ss. 18.1.1 and 18.1.2.3
Part V applies to the prescribed organization as if it were a health information custodian, and as if it had custody or control of a record of personal health information that is accessible to health information custodians by means of the electronic health record developed and maintained by the prescribed organization, subject to prescribed exceptions and additional requirements. Part V applies to the prescribed organization as if it were a health information custodian with respect to an electronic record the prescribed organization keeps under paragraphs 4, 5 and 6 of section 55.3, subject to prescribed exceptions and additional requirements. Part V applies to the prescribed organization as if it were a health information custodian with respect to digital health identifier records, subject to prescribed exceptions and additional requirements. Part V applies to a record in the custody or control of a health information custodian respecting all instances where all or part of an individual's personal health information that is accessible by means of the electronic health record is viewed, handled or otherwise dealt with by the custodian, subject to prescribed exceptions and additional requirements. An individual is not entitled to request a correction by the prescribed organization when it acts as if it were a health information custodian with respect to the records described in subsection 51 (5), (6) or (7). An individual is not entitled to request a correction by a health information custodian with respect to the records described in subsection 51 (8). The Agency shall make available an electronic system or systems to act as a digital means of access that permits individuals who have a digital health identifier and who are specified by the Agency on its website to access the records described in subsection 18.1.1 (2) of the regulation. From the regulation requires the Agency to make available both the digital means of access and an alternative process for individuals who cannot or do not wish to use the digital means of access. The Agency shall provide an annual report to the Commissioner with respect to the previous calendar year. The Agency shall provide the report to the Commissioner on or before March 1 in each year starting in 2027. Section 5 of Schedule 6 to chapter 7 of 2025, which enacted subsections 51 (5) to (8), was in force on . Section 6 of Schedule 6 to chapter 7 of 2025, which enacted subsections 55 (1.1) and (1.2), was in force on .
Personal Health Information Protection Act, 2004, digital health identifier activities of the prescribed organization
S.O. 2004, c. 3, Sched. A, ss. 55.15-55.23, 55.25, 55.26; O. Reg. 329/04, s. 18.1
The Agency, the corporation continued by section 3 of the Connecting Care Act, 2019, is prescribed as the prescribed organization for the purposes of the Act. The Agency is an agent of the Crown and may exercise its powers only as an agent of the Crown. The prescribed organization may, in accordance with Part V.2 and the regulations, carry out digital health identifier activities. The prescribed organization may, with the express consent of the individual to whom the personal health information relates, collect or use personal health information for the purpose of carrying out digital health identifier activities. In carrying out digital health identifier activities, the prescribed organization shall not collect, use or disclose personal health information if other information will serve the purpose, or collect, use or disclose more personal health information than is reasonably necessary to meet the purpose. On and after the first anniversary of the day section 55.19 comes into force, the prescribed organization shall have in place and comply with practices and procedures for protecting the privacy of the individuals whose personal health information is in the digital health identifier records, approved by the Commissioner. The prescribed organization shall make available to the public a plain language description of the activities or services it provides under Part V.2, including a general description of the technical, administrative and physical safeguards in place. The prescribed organization shall take steps that are reasonable in the circumstances to ensure that digital health identifier records are protected against theft, loss and unauthorized use or disclosure, and against unauthorized copying, modification or disposal. The prescribed organization shall ensure that a digital health identifier that has been inactive for two or more years is disposed of in a secure manner. The prescribed organization shall assess the threats, vulnerabilities and risks to the security and integrity of digital health identifier records, and how its digital health identifier activities may affect the privacy of the individuals to whom the information relates. The prescribed organization shall carry out every directive that the Minister issues to it under section 55.26 about digital health identifiers and digital health identifier activities. Section 8 of Schedule 6 to chapter 7 of 2025, which enacted Part V.2, was in force on .
Article 20 (state support for artificial intelligence)
Cybersecurity Law of the People's Republic of China (网络安全法), Art. 20, added by the Decision of
Article 20 of the Cybersecurity Law, added by the Decision of the Standing Committee of the National People's Congress adopted on , provides that the State supports basic theory research and key technology development in artificial intelligence, advances infrastructure such as training data resources and computing power, improves artificial intelligence ethics norms, strengthens risk monitoring and assessment and safety regulation, and promotes the application and healthy development of artificial intelligence. Its second paragraph provides that the State supports innovating cybersecurity management methods by using new technologies such as artificial intelligence to raise the level of cybersecurity protection. Both paragraphs are framed as what the State supports or does, and neither states a duty on a developer or operator of an AI system. The Decision takes effect on .
Cybersecurity Law of the People's Republic of China (as amended by the Decision of , effective ), Art. 24
Presidential Order No. 61 fixed the amendment's effective date at , the date from which the Article 24 product and service security duty described here governs in its current, amended form.
Act No. 270/2025 Sb. inserted Section 191a into the Criminal Code (Article I, point 73). Article XLV of the Act provides that it takes effect on , apart from listed provisions of other articles that take effect on or ; Article I is not among the listed exceptions.
Criminal Code Section 181(2), Realistic Fake Depiction of a Person Made to Cause Serious Harm to Rights
Zakon c. 40/2009 Sb., trestni zakonik, Sec. 181(2)
Section 181(2) of the Criminal Code makes it an offense to produce, with intent to cause another person serious harm to rights, a work that wrongfully shows, records or otherwise uses that person's likeness or an expression of his personal nature, appears genuine, and is known to the offender not to be genuine. The offense also reaches whoever makes such a work publicly accessible, mediates it, puts it into circulation, sells it or otherwise supplies it to another. The penalty is that of paragraph 1, imprisonment of up to two years or a ban on activity. Imprisonment of up to three years applies where the act causes significant harm to rights, brings a significant benefit, involves posing as an official person, or is committed through the press, film, radio, television, a publicly accessible computer network or a similarly effective means. Imprisonment of six months to five years applies where the act causes harm to rights on a large scale or brings a benefit on a large scale.
Küberturvalisuse seadus (Cybersecurity Act), RT I, 30.12.2025, 4
System Security Measures and Management-Body Duties
Küberturvalisuse seadus (Cybersecurity Act), RT I, 30.12.2025, 4, §§ 6-1 and 7, as amended by RT I, 06.10.2026, 1
The Küberturvalisuse seaduse ja teiste seaduste muutmise seadus (küberturvalisuse 2. direktiivi ülevõtmine), adopted by the Riigikogu on and proclaimed by the President on , entered into force on under its own Section 11, carrying the new Section 6-1 management-body duty and the amended Section 7 risk-management duty into the consolidated Küberturvalisuse seadus.
Küberturvalisuse seadus (Cybersecurity Act), RT I, 30.12.2025, 4, §§ 8 and 8-1, as amended by RT I, 06.10.2026, 1
The Küberturvalisuse seaduse ja teiste seaduste muutmise seadus (küberturvalisuse 2. direktiivi ülevõtmine), adopted by the Riigikogu on and proclaimed by the President on , entered into force on under its own Section 11, carrying the amended Section 8 notification clock and the new voluntary-reporting Section 8-1 into the consolidated Küberturvalisuse seadus.
Laki eraiden tekoalyjarjestelmien valvonnasta (1377/2025)
The Act's own Section 29 sets its entry into force on , and provides that Section 21's prohibited-practices fine does not reach a violation that occurred before that date.
Cap. 653, s. 28 and Schedule 6 (Protection of Critical Infrastructures (Computer Systems) Ordinance)
A CI operator that becomes aware that a computer-system security incident has occurred in respect of a critical computer system of a critical infrastructure it operates must notify the Commissioner of the incident. A computer-system security incident is an event that involves access, without lawful authority, to the critical computer system, or another act done without lawful authority on or through it, and has an actual adverse effect on its computer-system security. The notification is due 12 hours after becoming aware of the incident if it disrupts or is likely to disrupt the core function of the critical infrastructure. In any other case the notification is due 48 hours after becoming aware of the incident. If the notification is not made in the specified form and way, the operator must subsequently submit a written record of the incident to the Commissioner within the specified time. The specified time for the written record is 48 hours after the notification. The operator must further submit a written report of the incident to the Commissioner within the specified time. The specified time for the written report is 14 days after the operator becomes aware of the incident. Failure to comply is an offence with a fine of 3,000,000 dollars on summary conviction and 5,000,000 dollars on conviction on indictment.
Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653), ss. 12, 19 to 27, 55 and 65
The Commissioner of Critical Infrastructure (Computer-system Security), or a designated authority for a regulated organization of its own, designates by written notice an organization that operates a critical infrastructure as a CI operator, and the duties below bind only a designated operator. Schedule 1 specifies energy, information technology, banking and financial services, air transport, land transport, maritime transport, healthcare services, and telecommunications and broadcasting services as the sectors for the definition of critical infrastructure. A CI operator must maintain a unit (however described) for managing the computer-system security of its critical computer systems and ensuring that the Ordinance is complied with. The operator may set up the unit itself or engage a service provider to do so. The operator must notify the regulating authority within 1 month after the date a specified event occurs, such as a material change to a critical computer system. The operator must submit a computer-system security management plan within 3 months of designation. The operator must conduct a computer-system security risk assessment within 12 months of designation and at least once every 12 months afterwards. The operator must arrange a computer-system security audit within 24 months of designation and at least once every 24 months afterwards. The operator must submit an emergency response plan to the Commissioner within 3 months of designation. The operator must notify the regulating authority of a change of the organization that operates the critical infrastructure within 1 month after the change, and must take part in a computer-system security drill when the Commissioner requires it after reasonable written notice. Failing to notify an operator change, or to take part in a drill, is an offence with a fine of 3,000,000 dollars on summary conviction and 5,000,000 dollars on conviction on indictment. Failure to submit a plan or a revised plan, like a failure under the office, unit, material-change, risk-assessment and audit duties, is an offence with a fine of 300,000 dollars on summary conviction and 500,000 dollars on conviction on indictment, plus a further daily fine while the offence continues. A defendant is acquitted where the offence was due to a cause beyond its control and it took all reasonable precautions and exercised all due diligence, and the Commissioner may exempt an operator from an obligation in the public interest. The Ordinance has been in operation since .
1997. évi XLVII. törvény az egészségügyi és a hozzájuk kapcsolódó személyes adatok kezeléséről és védelméről, 35/A. § (4)-(8) bekezdés
Section 35/A(4) of the Health Data Act lets the operator of the Electronic Health Service Space (EESZT), on request, permit access to the data stored there for AI development, meaning the training, testing and evaluation of AI algorithms and the development of medical devices and digital health applications. Section 35/A(5) confines that development to a secure processing environment inside the EESZT. The secure processing environment logs access to it and the activities carried out in it, and keeps the entries for one year. Under Section 35/A(7), AI development in the secure processing environment may be permitted only on anonymous data, and only for a person who holds the permit for scientific research issued by the competent ethics committee of the Health Science Council (Egészségügyi Tudományos Tanács). That person must ensure that what is learned during AI development is used only for it, guarantee that development uses only anonymous data, give adequate safeguards against use outside the permit and for the protection of individuals, and carry out a data protection impact assessment before development starts. Section 35/A(8) has the operator and the applicant agree the conditions for using the data and for making the results available. Section 35/A(4) was inserted by Section 25 of Act XXIX of 2024. Section 25 of Act XXIX of 2024 sits in the twelfth subtitle of that Act, which amends the Health Data Act. Section 3(15) of Act XXIX of 2024 puts its twelfth subtitle into force on .
Law on Security of Network and Information Systems, arts. 33 and 54
Article 33(1) obliges essential and important entities to notify the competent computer incident response team immediately, and within three hours at the latest, of learning of a significant cyber security incident or significant cyber threat. Article 33(3) point 1 requires an early warning to the competent team within 24 hours of learning of a significant cyber security incident. Article 33(3) point 2 requires an incident notification to the competent team within 72 hours of learning of a significant cyber security incident. Article 33(3) point 4 requires a final report to the competent team within one month of the incident notification. Article 33(4) requires a trust service provider to notify the competent team within 24 hours of learning of a significant cyber security incident that affects its trust services. Article 33(2) requires entities, where possible, to inform the recipients of their services who may be affected by a serious cyber threat by the next working day at the latest. Article 54(1) fines an essential entity up to 2% of its total annual revenue for failing to notify the competent team of a significant cyber security incident.
Entities Covered and Cyber Security Risk Management Measures
Law on Security of Network and Information Systems, arts. 4, 8 and 31-32
Article 4(2) applies the Law to medium and large entities that provide services in energy, transport, banking, the financial market, health, digital infrastructure and the management of ICT services. Article 4(3) applies the Law to all legal persons seated in the Republic that provide public electronic communications networks or services or trust services, whatever their size. Article 5(2) excludes the National Bank of the Republic of North Macedonia from the Law. Article 61(2) defers the Law's application to the areas in points 8 to 16 of article 4(2) until North Macedonia accedes to the European Union. Article 62 provides that the Law enters into force on the eighth day after publication in the Official Gazette and applies from . Article 32(1) obliges essential and important entities to take appropriate technical, operational and organisational measures proportionate to the risk. Article 32(7) requires an entity that does not meet the article 32(3) measures to take corrective action immediately and within 30 days at the latest. Article 54(1) fines an essential entity up to 2% of its total annual revenue for failing to take the article 32 measures, unless a special law prescribes a higher fine.
Now in forceContent moderationDigital accessibility#
3 laws
Lag (2025:1242) med kompletterande bestämmelser till EU:s mediefrihetsförordning (Act Supplementing the European Media Freedom Act)
Lag (2025:1242) med kompletterande bestämmelser till EU:s mediefrihetsförordning
The Act supplements Regulation (EU) 2024/1083, the European Media Freedom Act. Section 3 states that the national regulatory authority is the authority designated as the national regulatory authority under Article 30 of the Audiovisual Media Services Directive. Section 4 requires a person who has made information accessible under Article 6(1), or published information under Article 25(2), of the Regulation to give the supervisory authority the information and a note of where it is available as soon as possible. Section 5 requires a media market concentration to be notified to the supervisory authority if it has been notified to the Competition Authority (Konkurrensverket) or to the European Commission. That duty applies only if the undertakings concerned together had a turnover in Sweden above SEK 1 billion in the preceding financial year and at least one of them is a provider of media services or of an online platform giving access to media content. The person who notified the concentration to the Competition Authority or the Commission is to make the notification to the supervisory authority the same day. Section 8 requires a person with obligations under Article 6(1), 18(1) to (6), 18(8), 24(1), 24(2), 25(1) or 25(2) of the Regulation, or under section 5, to give the supervisory authority on request the information and documents it needs. Section 9 lets the supervisory authority issue the orders needed to make those articles of the Regulation, or sections 4, 5 or 8, be followed, and an order may carry a periodic penalty (vite). Section 10 allows an appeal of an order under section 9 to the general administrative court, with leave to appeal required for the administrative court of appeal. Lag (2025:1243) amends sections 8 and 9 with effect from . From that date section 8 adds a duty on a person with obligations under Article 20(2) or 20(3) of the Regulation to hand over on request the product samples or similar items the authority needs. Under Förordning (2025:1244), section 5, the Swedish Agency for Media (Mediemyndigheten) is to complete its assessment of a media market concentration within 45 working days of a notification containing the required information. The Act took effect on .
Lag (2025:1408) med kompletterande bestämmelser till EU:s förordning om politisk reklam (Act Supplementing the Political Advertising Regulation)
Lag (2025:1408) med kompletterande bestämmelser till EU:s förordning om politisk reklam
The Act supplements Regulation (EU) 2024/900 on the transparency and targeting of political advertising. Section 4 makes the authority or authorities the government designates the competent authority under Article 22(3) and (4) of the Regulation. Section 4 also notes that Article 22(1) of the Regulation makes the data protection supervisory authorities competent to supervise Articles 18 and 19. Under Förordning (2025:1410), section 4, the Swedish Agency for Media (Mediemyndigheten) is the competent authority under Article 22(3) and (4). Section 6 gives the competent authority, beyond the powers in Article 22(5), the power to carry out inspections, decide remedial measures, charge sanction fees and attach periodic penalties to orders. Section 11 allows a sanction fee from a provider of political advertising services that breaches an obligation under Article 7(1) first sentence, 7(2), 9(1), 9(3), 11(1), 11(3), 12(1), 12(3), 12(4), 13(2) to (4), 14(1) or 21(1) of the Regulation as originally worded. Section 13 sets the sanction fee at a minimum of SEK 5,000 and a maximum of 6 percent of the provider's global annual turnover in the preceding financial year. Section 10 caps a periodic penalty at 5 percent of the average global daily turnover or daily income per day. Section 18 makes the Administrative Court in Stockholm (Förvaltningsrätten i Stockholm) the competent court. The Act took effect on . A sanction fee may be decided only for breaches that took place after the Act took effect.
Radio- och tv-lag (2010:696) (Radio and Television Act), accessibility of television broadcasts and on-demand television for persons with disabilities, and the Mediemyndigheten decisions under it
Radio- och tv-lag (2010:696), 5 kap. 12 och 12 a §§, 16 kap. 6 a §, 17 kap. 5 a och 6 §§
Chapter 3 of the Radio and Television Act defines a media service provider as the person who has the editorial responsibility for the choice of content in a radio or television broadcast, on-demand radio, on-demand television or searchable teletext and decides how the content is structured. Chapter 1 section 2 states that the Act partly implements Directive 2010/13/EU, the Audiovisual Media Services Directive. The Radio and Television Act was issued on and entered into force on . Chapter 5 section 12 requires a media service provider to design the service so that it is accessible to persons with disabilities through subtitling, interpretation, spoken text or similar technology. Chapter 5 section 12 sets the extent of the accessibility as the Government decides where the provider works under a mandate under the Public Service Act (2025:986) and as the Mediemyndigheten decides in other cases, for a set period. Chapter 5 section 12 requires the provider's financial conditions and the technical development of accessibility services to be taken into account, and requires the provider to prepare an action plan for increasing the accessibility of the service. Chapter 5 section 12 a requires a media service provider that broadcasts messages of public importance to design them as soon as possible so that they are accessible to persons with disabilities. Chapter 16 section 6 a requires a media service provider to report how a service has been made accessible under a decision under chapter 5 section 12, including the action plan. The Mediemyndigheten supervises the accessibility rules in chapter 5 section 12 where it made the decision. The Broadcasting Commission (Granskningsnämnden för radio och tv) supervises the accessibility rules in chapter 5 section 12 where the Government made the decision. Chapter 17 section 5 a lets a media service provider that does not follow a decision on accessibility under chapter 5 section 12 be ordered to pay a special fee. Chapter 17 section 6 sets the special fee at not less than SEK 5,000 and not more than SEK 5,000,000. Chapter 17 section 7 requires the special fee to be paid to the Mediemyndigheten within thirty days of the decision becoming final. Chapter 19 section 4 a assigns the question of the special fee to the Broadcasting Commission where the Government made the decision and to the Mediemyndigheten in other cases, with a five-year limit. Chapter 20 section 3 allows a decision of the Mediemyndigheten under chapter 5 section 12 on accessibility for persons with disabilities to be appealed to the general administrative court. Lag (2020:875), which gave chapter 16 section 6 a and chapter 17 sections 5 a and 6 their current wording, entered into force on . Lag (2025:990), which gave chapter 5 section 12 its current wording, entered into force on . Lag (2025:990) applies the current wording of chapter 5 section 12 first to broadcasts and provision of programmes after . The Mediemyndigheten decides what accessibility is required of every media service provider except the public service companies, whose requirements the Government decides. The Mediemyndigheten's special requirements apply to TV3, TV4, TV6, Sjuan, TV8, TV10, TV12, TV4 Play and Viaplay.se. Linear TV services and on-demand services directed at a Swedish audience with a viewing-time share of one percent or more are subject to special requirements, and services with a lower share are subject to a general requirement to promote accessibility. A service with special requirements need not meet the obligation to the extent the cost of making programmes accessible exceeds one percent of the service's net turnover. The Mediemyndigheten's decision to TV4 AB applies from to . That decision requires all pre-recorded programmes in Swedish to be subtitled on all platforms in every period. The decision requires 68 percent of the broadcast time of live programmes in Swedish to be subtitled in periods 1 and 2, and 71 percent in periods 3 and 4. The decision requires 10 percent of the broadcast time of programmes in Swedish to be made accessible by sign language interpretation in every period. The decision requires 10 percent of the broadcast time of programmes in Swedish to be made accessible by audio description in every period. The decision requires 20 percent of the broadcast time of non-live programmes with Swedish translation text to be made accessible by spoken text in period 1, and 25 percent in periods 2, 3 and 4. The decision exempts live sports and repeats of live sports from the quantitative requirements for sign language interpretation, audio description and spoken text where it is not technically or practically possible to make them accessible. The Mediemyndigheten's decision on promotion requires a provider to make at least some programmes accessible by some of the technologies in each period. The decision on promotion requires the making of programmes accessible to increase for each period. The decision to TV4 AB requires it to report after each period how the requirements were met and to attach an action plan for increasing accessibility. The Mediemyndigheten's decision of to Viaplay Group Sweden AB places special requirements on TV3, TV6, TV8, TV10 and the on-demand service Viaplay.se from to . That decision sets for TV3, TV6, TV8 and TV10 the same quotas for subtitling, sign language interpretation, audio description and spoken text as the decision to TV4 AB. That decision requires every programme in Swedish published on Viaplay.se to be subtitled. SVT and UR must make programmes accessible by subtitling, sign language interpretation, audio description and spoken text, to an extent the Government decides.
Vyhláška Úradu pre reguláciu elektronických komunikácií a poštových služieb č. 345/2025 Z. z., ktorou sa ustanovujú podrobnosti o požiadavkách na prístupnosť služieb pre osoby so zdravotným postihnutím a kritériá na posúdenie neprimeranej záťaže
Decree 345/2025 of the Office is made on the basis of section 82(5) of the Electronic Communications Act as amended by Act 351/2022. Section 1 of the Decree sets the details of the accessibility requirements for a publicly available electronic communications service within section 83a of the Act. Section 2(a) requires the availability of terminal equipment capable of enabling persons with disabilities to use the service. Section 2(b) requires information on how the service works and, where products are used to provide it, on their link to the service, their accessibility features and their interoperability with assistive devices, in seven listed ways. Section 2(c) requires the websites and mobile applications through which the service is provided to follow the standards for the accessibility and functionality of websites and applications, so that they are perceivable, operable, understandable and robust. Section 2(d) requires support services, which it lists as help desk, telephone information centers, technical support, conversion services and training, to give information on the accessibility of the service and its compatibility with assistive technologies by accessible modes of communication. Section 3(a) requires the display of text in real time alongside voice communication. Section 3(b) requires total conversation where video is available in addition to voice, so that emergency communication by voice and text, including real-time text, is synchronized with the video. Section 4(1) sets as the criteria of a disproportionate burden the ratio of the net cost of compliance to the provider's total costs, the estimated costs and benefits for the provider against the benefit for persons with disabilities, and the ratio of the net cost of compliance to the provider's net turnover. Section 4(2) lists the one-off organizational costs and the ongoing production and development costs that count toward the net cost of compliance. Section 5 of Decree 345/2025 sets as its commencement day, and for the real-time text requirement of its section 3(a). Section IV, point (a), of Annex I to Directive (EU) 2019/882 requires electronic communications services to provide real-time text in addition to voice communication and total conversation where video is provided in addition to voice. Section 122(4)(a) of the Act has the Office supervise compliance with the generally binding legal regulations issued on the basis of the Act. Section 124(1) to (3) of the Act, which set the fines the Office imposes, list neither section 83a nor the Decree. Section 122(14)(d) of the Act obliges the supervised person to remove the deficiencies found within the period the Office sets and to notify the Office of their removal in writing. Section 122(18) of the Act lets the Office impose a procedural fine of up to EUR 2,000, also repeatedly, on a person that obstructs supervision by not meeting its duties under section 122(14). Footnote 1 to section 2(c) refers to section 24(1)(b) and section 31(l) of Act 95/2019 on information technologies in public administration for the standards for the accessibility and functionality of websites and applications.
Law of Turkmenistan "On Virtual Assets" of , arts. 29, 31, 33 and 35
Article 29(6) of the Law on Virtual Assets requires a virtual asset service provider that offers storage of virtual assets to keep its clients' funds on electronic media not connected to the Internet, called cold wallets, in the manner a legal act of the authorized body sets. Article 29(5) requires custody, management and control of virtual assets to preserve the virtual assets or the instruments that control them. Article 33(3) requires a crypto exchange acting as a virtual asset service provider to protect its clients' personal information and virtual assets. Article 31(9) provides that the protection of the specialized platforms, and of the personal data stored on them, follows Turkmenistan's legislation on information and cybersecurity. Article 35(3) lets the authorized body respond to a violation with a prescription, a fine, a limit on some services, suspension of the licence or annulment of the licence. Article 43 brings the Law into force on .
Alaska Stat. secs. 21.23.250 and 21.23.260 (Insurance Data Security)
A licensee must conduct a risk assessment commensurate with its size and complexity and the nature and scope of its activities, to evaluate the security and confidentiality of the nonpublic information it uses or controls. A licensee must develop, implement and maintain a comprehensive written information security program based on that risk assessment. The program must contain administrative, technical and physical safeguards to protect the security and confidentiality of nonpublic information and the security of the licensee's information system. A licensee must establish a written incident response plan designed to promptly respond to, and recover from, a cybersecurity event that compromises the confidentiality, integrity, or availability of nonpublic information in its possession or its information systems. A licensee must require a third-party service provider that has access to or holds nonpublic information to notify the licensee as soon as possible, and not later than 10 business days, after determining that the provider has experienced a cybersecurity event involving nonpublic information associated with a consumer. The duties to exercise due diligence in selecting a third-party service provider and to require it to protect the information systems and nonpublic information it can access, AS 21.23.260(c)(7) and (8), take effect . A licensee that is an insurer domiciled in Alaska must submit to the director by February 15 of each year a written statement certifying that the insurer complies with AS 21.23.250 and 21.23.260. AS 21.23.250 and 21.23.260 do not apply to a licensee, including an independent contractor, with fewer than 10 employees. The article does not apply to a licensee subject to the Health Insurance Portability and Accountability Act of 1996 that maintains and complies with a program under that Act and certifies this to the director in writing. A person who violates the article is subject to the penalties provided under AS 21.27.440.
Article 11 of the California Privacy Protection Agency's CCPA regulations, adopted by the Agency Board on , approved by the Office of Administrative Law and filed with the Secretary of State on , and effective per the Agency's own regulations page, governs a business's use of automated decisionmaking technology (ADMT) to make a 'significant decision' about a consumer, defined as a decision granting or denying financial or lending services, housing, education enrollment or opportunities, employment or independent-contracting opportunities or compensation, or healthcare services. A business using ADMT for a significant decision must give consumers a Pre-use Notice describing the use and the consumer's rights to opt out of and access information about that use (Section 7220), must let a consumer opt out of that use except where the business offers an appeal to a human reviewer empowered to overturn the decision or another listed exception applies (Section 7221), and must respond to a consumer's request to access ADMT with a plain-language explanation of the specified information about that use (Section 7222). A business using ADMT for a significant decision before has until that date to come into compliance with this article; a business beginning such use on or after must already be in compliance. Confirmed against the Agency's own approved regulation text, which places the automated-decisionmaking-technology article at Sections 7200 to 7222, not the 7040-to-7057 range sometimes cited for it.
AB 316 was chaptered on as Chapter 672 of the Statutes of 2025 and adds Section 1714.46 to the Civil Code. Section 1714.46 defines artificial intelligence as an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments. In an action against a defendant who developed, modified, or used artificial intelligence that is alleged to have caused a harm to the plaintiff, it is not a defense, and the defendant may not assert, that the artificial intelligence autonomously caused the harm to the plaintiff. The section does not limit or preclude a defendant from presenting any other affirmative defense, including evidence relevant to causation or foreseeability, or other evidence relevant to the comparative fault of any other person or entity. Statutes the Legislature passed on or before that were in the Governor's possession after that date take effect on under Article IV, section 8(c) of the California Constitution.
Generative Artificial Intelligence Training Data Transparency Act (AB 2013)
Cal. Assemb. B. 2013, 2023-2024 Reg. Sess. (chaptered )
Signed , this law requires developers of generative AI systems to publish on their websites summaries of training data used, disclosing copyright status, data ownership, and whether personal information or third-party copyrighted content (including news) was included; compliance required by . The law does not grant publishers an explicit opt-out or compensation right but creates de facto disclosure pressure on AI developers who scraped news content for training. A December 2025 federal executive order directed review of state AI regulations for conflict with federal policy, creating some enforceability uncertainty.
AB 2481 (2024), Youth Social Media Protection Act: verified reporter process for large social media platforms
Cal. Bus. & Prof. Code §§ 22588.2-22588.4
Requires a large social media platform to let school principals and licensed mental health professionals who serve minors in California become verified reporters of social media-related threats to a minor, and to respond to such a report within 72 hours, or within 24 hours if the report is of a severe risk. A large social media platform is one that does not prohibit use by a child, lets a child share images, text or video with users the child met on the platform, and has more than 100,000,000 monthly global active users or generates more than one billion dollars in gross revenue per year. A platform that receives a report from a verified reporter must report annually on a public website on the reports it received. The chapter was added by Chapter 832, Statutes of 2024 (AB 2481) and became operative on .
Companion Chatbot Safety and Accountability Act (SB 243)
Cal. Bus. and Prof. Code Sections 22601 to 22606
California's Companion Chatbot Safety and Accountability Act was added by SB 243, chaptered as Stats 2025 Chapter 677, and is effective per the code's own history note. An operator of a companion chatbot platform, one providing an adaptive, human-like AI system capable of sustaining an emotionally or socially engaging relationship across multiple interactions, to issue a clear and conspicuous notification that the companion chatbot is artificially generated and not human whenever a reasonable person interacting with it could be misled otherwise. An operator may not let a companion chatbot engage with users unless it maintains, and publishes on its website, a protocol for preventing the chatbot from producing suicidal-ideation, suicide, or self-harm content, including a crisis-service referral notification. For a user the operator knows is a minor, Section 22602(c) requires the operator to disclose that the user is interacting with artificial intelligence, provide a break reminder by default at least every three hours, and take reasonable measures to keep the chatbot from producing sexually explicit visual material or urging the minor toward sexually explicit conduct. The operator must also disclose, wherever a user can access the platform, that companion chatbots may not be suitable for some minors. SB 1119 was chaptered on as Chapter 190 of the Statutes of 2026. It amends Section 22602 to delete the provisions that apply to a user the operator knows is a minor. Under Article IV, section 8(c)(1) of the California Constitution, a statute enacted at a regular session goes into effect on the January 1 next following a 90-day period from its enactment, which for that amendment is . It amends no other section of the companion chatbot chapter. Beginning , an operator must report annually to the Office of Suicide Prevention on crisis-referral notifications issued and protocols in place. A person who suffers injury in fact from a violation may bring a civil action for injunctive relief, the greater of actual damages or $1,000 per violation, and attorney's fees and costs; the chapter excludes bots used only for customer service or internal business purposes, video-game bots limited to game-related replies, and stand-alone voice-command consumer devices that do not sustain a relationship across interactions. Confirmed against leginfo's chaptered bill text.
Transparency in Frontier Artificial Intelligence Act (SB 53)
Cal. Bus. and Prof. Code Sections 22757.10 to 22757.16
California's Transparency in Frontier Artificial Intelligence Act (TFAIA) was added by SB 53, chaptered as Stats 2025 Chapter 138, and is effective per the code's own history note. A large frontier developer (a frontier developer whose group had annual gross revenues over $500,000,000 in the preceding year) to write, implement and publish on its website a frontier AI framework describing how it defines and assesses catastrophic-risk thresholds for its frontier models (foundation models trained using more than 10^26 integer or floating-point operations) and applies mitigations, and to review that framework at least annually. The framework must also describe the developer's cybersecurity practices to secure unreleased model weights from unauthorized modification or transfer by internal or external parties. Before or when deploying a new or substantially modified frontier model, every frontier developer must publish a transparency report with baseline model information, and a large frontier developer must add summaries of its catastrophic-risk assessments and any third-party evaluator involvement. A large frontier developer must also transmit summaries of internal-use catastrophic-risk assessments to the Office of Emergency Services on a quarterly or agreed schedule, and every frontier developer must report a critical safety incident to the Office within 15 days of discovering it, or 24 hours if it poses an imminent risk of death or serious injury. A frontier developer may not make a materially false or misleading statement about catastrophic risk or, for a large frontier developer, about its framework compliance, and a companion whistleblower chapter (Lab. Code Section 1107 et seq.) bars a frontier developer from retaliating against a covered employee who reports a reasonable belief of catastrophic-risk danger or a TFAIA violation, arming that employee with a private civil action and attorney's fees, separate from the chapter's own civil penalty which the Attorney General alone may bring.
Health Care Professional Title Protection for Artificial Intelligence Act (AB 489)
Cal. Bus. and Prof. Code Sections 4999.8 and 4999.9
AB 489, Chapter 615 of the Statutes of 2025, added Sections 4999.8 and 4999.9 to the Business and Professions Code, effective . The use of a term, letter or phrase in the advertising or functionality of an AI or generative AI system, program, device or similar technology that indicates or implies that the care, advice, reports or assessments it offers are provided by a natural person who holds the appropriate license or certificate to practice as a health care professional is prohibited. Any provision of the division that prohibits specified terms, letters or phrases implying a health care license without holding it is enforceable against a person or entity that develops or deploys a system or device that uses them in the advertising or functionality of an AI or generative AI system. Each use of a prohibited term, letter or phrase is a separate violation. A violation is subject to the jurisdiction of the appropriate health care professional licensing board or enforcement agency. The licensing board may pursue an injunction or restraining order as authorized by Section 125.5.
AB 621 was chaptered on as Chapter 673 of the Statutes of 2025. Civil Code Section 1708.86, as amended by AB 621, is effective per the code's own history note. A depicted individual has a cause of action against a person who creates and intentionally discloses digitized sexually explicit material portraying the individual, or intentionally discloses such material the person did not create, when the person knows or reasonably should know that the individual did not consent or was a minor when the material was created. Digitized sexually explicit material is any portion of a visual or audiovisual work created or substantially altered through digitization, including an image, that shows the depicted individual in the nude or appearing to engage in, or being subjected to, sexual conduct. The cause of action also reaches a person who knowingly facilitates or recklessly aids or abets that conduct. A deepfake pornography service is an internet website, mobile application, or other service the primary purpose of which is to create digitized sexually explicit material. A person that owns, operates, or controls a deepfake pornography service is treated as creating and intentionally disclosing the material and is presumed to have known that the depicted individual did not consent, unless the person produces evidence of the depicted individual's express written consent. A person that provides a service that enables the ongoing operation of a deepfake pornography service is presumed to be in violation of the facilitation provision if a depicted individual or public prosecutor provides the person with evidence sufficient to demonstrate that it is providing services that enable the ongoing operation of a deepfake pornography service that engages in conduct that violates the section. The presumption applies only if the person fails to take all necessary steps to stop providing those services within 30 days of receiving that evidence. A court may extend the 30 days if it finds that additional time is needed to conduct an ongoing law enforcement investigation or operation. A disclaimer in the material, or a statement by a deepfake pornography service that users are prohibited from generating such material without consent, is not a defense. The section does not apply to conduct protected by federal law, including Section 230 of Title 47 of the United States Code. An internet service provider is not held liable under the section for the mere transmission, routing, or provision of access to third-party content over its network. A prevailing depicted individual may recover an amount equal to the monetary gain made by the defendant from the creation and disclosure of the material, together with economic and noneconomic damages, including damages for emotional distress. On request, the plaintiff may instead recover statutory damages with respect to any one work of not less than $1,500 and not more than $50,000, increased to a maximum of $250,000 if the act was committed with malice. A public prosecutor may bring a civil action to enforce the section. A prevailing public prosecutor is entitled to a civil penalty of $25,000 per violation, or $50,000 per violation for a violation committed with malice.
California Data Breach Notification Law, as amended by SB 446
Cal. Civ. Code section 1798.82, as amended by SB 446 (2025, Ch. 319)
SB 446's fixed 30-day notification deadline and the 15-day Attorney General notice requirement took effect. SB 446's text carries no separate operative-date clause of its own; this date is confirmed directly on the current codified section's amendment-history annotation.
Health and Location Data Privacy: geofencing of health care entities (AB 45)
Cal. Civ. Code section 1798.99.92
Civil Code section 1798.99.92 makes it unlawful to geofence an entity that provides in-person health care services in California to identify or track a person seeking, receiving or providing health care services. Section 1798.99.92(a) also makes it unlawful to geofence such an entity to collect personal information from a person seeking, receiving or providing health care services or to send the person notifications or advertisements related to their personal information or health care services. Section 1798.99.92(b) makes it unlawful to sell personal information to, or share it with, a third party for use in violating the geofencing prohibition. Under section 1798.99.92(d)(1), a violator is subject to an injunction and a civil penalty of $25,000 for each violation, recovered in an action by the Attorney General. Section 1798.99.92(f) does not prohibit a person that owns, operates, manages or provides services to an in-person health care entity from geofencing the entity's own location to provide necessary health care services. Civil Code section 1798.99.92 took effect on .
Health and Location Data Privacy: location data at family planning centers (AB 45)
Cal. Civ. Code sections 1798.99.90 and 1798.99.91
Civil Code section 1798.99.91 makes it unlawful to collect, use, disclose, sell, share or retain the personal information of a person who is physically located at, or within a precise geolocation of, a family planning center. Section 1798.99.90 of the Civil Code defines a precise geolocation as a geographic area equal to or less than a circle with a radius of 1,850 feet. Under section 1798.99.91(b), a person may collect or use that personal information only as necessary to perform the services or provide the goods the person requested. Section 1798.99.91(c) lets an aggrieved person or entity, including a family planning center, sue a violator for injunctive and monetary relief and attorney's fees within three years of discovery of the violation. Recovery in an action under section 1798.99.91(c) is three times the amount of actual damages and any other expenses, costs or reasonable attorney's fees incurred in the litigation. Section 1798.99.91 does not apply to a provider of health care, a health care service plan or a contractor as defined in section 56.05 of the Civil Code, or to a covered entity or its business associate as defined in the federal regulations, and a contractor or business associate qualifies for the exemption only if it is contractually obligated to comply with all applicable state and federal privacy laws. Civil Code section 1798.99.91 took effect on .
Generative AI Training Data Transparency Act (AB 2013)
Cal. Civ. Code Sections 3110 and 3111
A developer of a generative AI system made publicly available to Californians must post on its website, before making the system available and before any substantial modification, documentation describing the training data: a high-level summary of the datasets, their sources and owners, an approximate count and description of data points, whether the data includes copyrighted or personal information, and whether synthetic data generation was used. The posting duty reaches systems first made publicly available on or after , though it did not attach until the operative date, now past. This corrects the derived citation on record, Civil Code Section 22756 et seq., which does not exist in Civil Code; confirmed against leginfo, the correct codification is Title 15.2 (commencing with Section 3110), Sections 3110 and 3111.
Social Media Platforms Endangering Californians: account deletion (AB 656)
Cal. Civ. Code sections 3273.90 and 3273.91
Civil Code section 3273.91 requires a social media platform to provide a clear and conspicuous button that enables the user to delete their account. Under section 3273.90(d) of the Civil Code, a social media platform is one that generates more than $100,000,000 per year in gross revenues. Section 3273.91(c) bars a social media platform from obstructing or interfering with a user's ability to delete their account, including by using dark patterns. Under section 3273.91(d), a deletion request counts as a request to delete the user's personal information under section 1798.105 of the Civil Code and is processed under the California Consumer Privacy Act. Civil Code section 3273.91 took effect on .
Article 9 of the California Privacy Protection Agency's CCPA regulations, adopted by the Agency Board on and effective , requires a business whose processing of personal information meets the CCPA's revenue-from-data-sales threshold, or its revenue threshold combined with processing the personal information of 250,000 or more consumers or households or the sensitive personal information of 50,000 or more consumers in the preceding calendar year, to complete a cybersecurity audit using a qualified, independent auditor, who may be internal or external to the business, and to submit a written certification of that completion to the Agency each year by April 1. The underlying audit report is not filed with the Agency; the business and auditor must retain it for five years, and it goes only to an executive with direct responsibility for the cybersecurity program. First certifications are due on a staggered schedule starting for businesses with 2026 annual gross revenue over $100 million, then for the $50 million to $100 million tier, and for smaller covered businesses, after which every covered business audits and certifies annually.
Article 10 of the CCPA Regulations, sections 7150 to 7157, requires a business to conduct a risk assessment before it starts processing that presents significant risk to consumers' privacy. Selling or sharing personal information and processing sensitive personal information are among the activities that present significant risk. The risk assessment must determine whether the risks to consumers' privacy from the processing outweigh the benefits to the consumer, the business, other stakeholders and the public. A business must review and update its risk assessments at least once every three years. A business must complete a risk assessment for processing it began before and continues after that day no later than . A business must retain its risk assessments for as long as the processing continues or for five years after the completion of the risk assessment, whichever is later. For risk assessments conducted in 2026 and 2027, a business must submit the required information to the Agency no later than . The Agency's amended regulations carry an effective date of .
Requires a social media platform with more than 100,000 active Colorado users to give users under 18 information on how social media affects the developing brain and youth mental and physical health, and to display a notification every 30 minutes once a minor has spent one hour on the platform in a 24 hour period or is using it between 10 p.m. and 6 a.m. Signed , with the platform requirement set for , but preliminarily enjoined before that date. The order enjoins Section 4 of the Act, which is section 6-1-1601. The school resource bank in section 22-2-127.8 is a separate part of the Act that the order does not enjoin. Colorado has appealed the injunction to the Tenth Circuit.
The mandatory cure notice period ended; the Department of Justice may now consider a list of statutory factors in deciding whether to offer a cure opportunity before enforcing.
SB 1920 / P.A. 104-0399 (2025), Artificial intelligence in schools: State Board of Education guidance
105 ILCS 5/2-3.118a (P.A. 104-0399, eff. )
Section 2-3.118a of the School Code, added by Public Act 104-0399, requires the State Board of Education, in consultation with stakeholders, to develop statewide guidance for school districts and educators on the use of artificial intelligence in elementary and secondary education. The guidance must include, among other subjects, best practices for developing student literacy in artificial intelligence and engaging students in age-appropriate discussions on the responsible and ethical use of artificial intelligence. The guidance must also include the impact of artificial intelligence on student-data privacy, including federal and State statutes associated with student-data privacy that are important to be aware of when setting policy for the use of artificial intelligence technologies in schools. The State Board of Education must develop and publish the guidance by and provide continuous updates as it deems necessary. The State Superintendent of Education may convene stakeholders for a statewide council to consult on the further development of guidance, resources, and other support for school districts and educators on the use of artificial intelligence in schools. The council must include individuals with expertise in artificial intelligence and no fewer than 2 currently practicing classroom teachers. The Act took effect .
Child sexual abuse material, computer-generated and digitally altered depictions
720 ILCS 5/11-20.1 (P.A. 104-245, eff. )
Section 11-20.1(a)(7) defines child sexual abuse material to include a film, photograph, or other visual medium or depiction by computer that is or appears to be a person under 18, regardless of the method by which it is created, adopted, or modified to appear as such, a technology-neutral test that reaches an artificial-intelligence-generated or AI-altered depiction on the same footing as a photograph of a real event. Producing, disseminating, or possessing such material is a felony under subsection (c): a still-image violation is a Class 1 felony and a moving-image violation a Class X felony for most paragraphs of subsection (a), each carrying a mandatory minimum fine and a maximum fine of $100,000, with the mandatory minimum ranging from $1,000 to $2,000 depending on which paragraph of subsection (a) was violated; subsection (c-5) raises every tier to a Class X felony, and a repeat offender to a mandatory 9-year minimum term, where the child depicted is under 13. The section was renamed from Child Pornography to Child Sexual Abuse Material by Public Act 104-245, effective , without changing the underlying prohibition.
Illinois Human Rights Act, use of artificial intelligence in employment decisions
775 ILCS 5/2-102(L) (P.A. 103-0804, eff. )
Section 2-102(L)(1) makes it a civil rights violation for an employer to use artificial intelligence that has the effect of subjecting employees to discrimination on the basis of a protected class, or to use zip codes as a proxy for a protected class, with respect to recruitment, hiring, promotion, discharge, discipline, or the terms and conditions of employment. Section 2-102(L)(2) separately makes it a civil rights violation for an employer to fail to provide notice to an employee that the employer is using artificial intelligence for those purposes; the Illinois Department of Human Rights is directed to adopt rules on the timing, circumstances, and means of that notice. The Human Rights Act's own employer definition reaches the State and every political subdivision as well as private employers, so this duty binds government and private employers alike.
IC 24-15-2-19(b) defines personal data to exclude de-identified data, aggregate data, or publicly available information. IC 24-15-2-26 defines publicly available information as information that is lawfully made available through federal, state, or local government records, or that a business has a reasonable basis to believe is lawfully made available to the general public through widely distributed media, by the consumer to whom the information pertains, or by a person to whom the consumer has disclosed it, unless the consumer has restricted the information to a specific audience. The exclusion removes information lawfully made available through government records or widely distributed media from the definition of personal data itself, rather than exempting it by a separate carve-out. IC 24-15-1-1(a) applies the Act to a person conducting business in Indiana or targeting Indiana residents that, during a calendar year, controls or processes personal data of at least 100,000 Indiana consumers, or of at least 25,000 Indiana consumers while deriving more than half of its gross revenue from selling personal data. Enforcement is Attorney-General-only; there is no private right of action.
Indiana Consumer Data Protection Act (INCDPA), general applicability and controller duties
Ind. Code §§ 24-15-1-1, 24-15-4-1, 24-15-11-1
Indiana's comprehensive consumer data protection law's applicability, controller responsibilities, and preemption provisions became binding on covered persons.
Indiana Consumer Data Protection Act, Attorney General enforcement
Ind. Code §§ 24-15-10-1 to 24-15-10-4
The Indiana Attorney General became the exclusive enforcer of INCDPA, subject to a mandatory 30-day cure right with no stated sunset, and civil penalties of up to $7,500 per violation.
Indiana Consumer Data Protection Act, de-identified data
Ind. Code §§ 24-15-2-12, 24-15-7-1, 24-15-7-3
Section 24-15-2-12 defines de-identified data as data that cannot reasonably be linked to an identified or identifiable individual because the controller that possesses it takes reasonable measures to ensure the data cannot be associated with an individual, publicly commits to maintaining and using it without attempting to re-identify it, and obligates any recipients through contractual requirements to comply with all applicable provisions of the article. Under section 24-15-7-1(a), a controller in possession of de-identified data must take reasonable measures to ensure that the data cannot be associated with an individual, publicly commit to maintaining and using it without attempting to re-identify it, and contractually obligate any recipients to comply with all provisions of chapter 7. Section 24-15-7-1(b) provides that chapter 7 does not require a controller or processor to re-identify de-identified data or pseudonymous data, to maintain data in identifiable form, or to collect, obtain, retain or access any data or technology in order to be capable of associating an authenticated consumer request with personal data. Under section 24-15-7-3, a controller that discloses pseudonymous data or de-identified data must exercise reasonable oversight to monitor compliance with any contractual commitments to which the data is subject and must take appropriate steps to address any breaches of those commitments. Section 24-15-2-19(b)(1) provides that the term personal data does not include de-identified data.
Indiana Consumer Data Protection Act, pseudonymous data
Ind. Code §§ 24-15-2-25, 24-15-7-2
Section 24-15-2-25 defines pseudonymous data as personal data that cannot be attributed to a specific individual because additional information that would allow the data to be attributed to a specific individual is kept separately and is subject to appropriate technical and organizational measures to ensure that the personal data is not attributed to an identified or identifiable individual. Under section 24-15-7-2, the consumer rights in section 24-15-3-1(b)(1) through (4) and the controller responsibilities in section 24-15-4-1(1) through (5) do not apply to pseudonymous data in any case in which the controller is able to demonstrate that any information necessary to identify the consumer is kept separately and is subject to effective technical and organizational controls that prevent the controller from accessing such information.
Indiana Consumer Data Protection Act, sensitive data and biometric data definitions
Ind. Code §§ 24-15-2-4, 24-15-2-28, 24-15-4-1(5)
Indiana's consent requirement for processing sensitive data, including genetic or biometric data collected to uniquely identify a person, became binding, with biometric data itself excluding anything generated from a photograph, video, or audio recording.
Indiana Consumer Data Protection Act, consumer rights
Ind. Code § 24-15-3-1
Indiana consumers gained the rights to confirm, access, correct, delete, and port their personal data, and to opt out of targeted advertising, sale, and qualifying profiling.
Indiana Consumer Data Protection Act, data protection impact assessments
Ind. Code §§ 24-15-6-1, 24-15-6-2
INCDPA requires a controller to conduct and document a data protection impact assessment of each of these processing activities involving personal data: targeted advertising, the sale of personal data, profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, injury, an offensive intrusion or other substantial injury to consumers, the processing of sensitive data, and any processing that presents a heightened risk of harm to consumers. Each assessment must identify and weigh the benefits of the processing to the controller, the consumer, other stakeholders and the public against the potential risks to the rights of the consumer, as mitigated by safeguards. The Attorney General may request, pursuant to a civil investigative demand, that a controller disclose any such assessment relevant to an investigation, and the controller must make it available to the Attorney General, who may evaluate it for compliance with the controller responsibilities in chapter 4. Assessments are confidential and exempt from public inspection and copying, and disclosing one to the Attorney General does not waive attorney-client privilege or work product protection. The requirements apply to processing activities created or generated after .
Kentucky Consumer Data Protection Act, publicly available information exclusion
KRS 367.3611
The Kentucky Consumer Data Protection Act (KCDPA), in force since , defines personal data as information linked or reasonably linkable to an identified or identifiable natural person, and expressly excludes de-identified data and publicly available information from that definition. Publicly available information means information lawfully made available through federal, state, or local government records, or that a business has a reasonable basis to believe is lawfully made available to the general public through widely distributed media, by the consumer, or by a person to whom the consumer disclosed it, unless the consumer has restricted it to a specific audience. This places most scraped public personal data outside the KCDPA's coverage at the definitional level, the same approach Virginia's parallel statute takes. The Act applies only to a person conducting business in Kentucky, or producing products or services targeted to Kentucky residents, that controls or processes the personal data of 100,000 or more consumers a year, or of 25,000 or more while deriving over half of gross revenue from selling personal data, and it expressly excludes a city, state agency, or other political subdivision. The Act's consumer rights, controller and processor duties, and Attorney General enforcement are personal-data duties rather than scraping law.
Kentucky Consumer Data Protection Act, sensitive data and biometric data definitions
KRS 367.3611(28), 367.3611(3), 367.3617
KCDPA classifies genetic or biometric data processed to uniquely identify a person as sensitive data, requiring opt-in consent under KRS 367.3617. "Biometric data" means data from automatic measurement of a biological characteristic, such as a fingerprint, voiceprint, or eye retina or iris, used to identify a specific individual; a photograph, video, or audio recording, or data generated from one, is excluded only until that data is generated to identify a specific individual or is health care information governed by HIPAA, at which point the general exclusion lifts. A 2026 amendment effective leaves this definition's operative text unchanged.
Kentucky Consumer Data Protection Act, consumer rights
KRS 367.3615
Kentucky consumers gained the rights to access, correct, delete, and port their personal data and to opt out of targeted advertising, sale, and significant-effect profiling, with a 45-day (plus one 45-day extension) response window and a 60-day appeal.
Kentucky Consumer Data Protection Act, data protection impact assessments
KRS 367.3621
KCDPA requires a controller to conduct and document a data protection impact assessment of each of these processing activities involving personal data: targeted advertising, selling personal data, profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, injury, an offensive intrusion or other substantial injury to consumers, the processing of sensitive data, and any processing that presents a heightened risk of harm to consumers. Each assessment must identify and weigh the benefits of the processing to the controller, the consumer, other stakeholders and the public against the potential risks to the rights of the consumer, as mitigated by safeguards. The Attorney General may request, pursuant to an investigative demand, that a controller disclose any such assessment relevant to an investigation, and the controller must make it available to the Attorney General, who may evaluate it for compliance with KRS 367.3611 to 367.3629. Assessments are confidential and exempt from disclosure, public inspection and copying under KRS 61.870 to 61.884, and disclosing one to the Attorney General does not waive attorney-client privilege or work product protection. The assessment requirements apply to processing activities created or generated on or after .
Kentucky Consumer Data Protection Act, de-identified and pseudonymous data
KRS 367.3623
KRS 367.3623(1) requires a controller in possession of de-identified data to take reasonable measures to ensure the data cannot be associated with a natural person, to publicly commit to maintaining and using the data without attempting to re-identify it, and to contractually obligate any recipients of the data to comply with all provisions of KRS 367.3611 to 367.3629. KRS 367.3623(5) requires a controller that discloses pseudonymous data or de-identified data to exercise reasonable oversight to monitor compliance with any contractual commitments to which that data is subject, and to take appropriate steps to address any breach of those commitments. KRS 367.3623(2) provides that KRS 367.3611 to 367.3629 do not require a controller or processor to re-identify de-identified data or pseudonymous data. KRS 367.3623(4) provides that the consumer rights in KRS 367.3615 do not apply to pseudonymous data where the controller is able to demonstrate that any information necessary to identify the consumer is kept separately and is subject to appropriate technical and organizational measures to ensure that the personal data is not attributed to an identified or identifiable natural person. KRS 367.3623 is effective .
Kentucky Consumer Data Protection Act, Attorney General enforcement
KRS 367.3627
The Kentucky Attorney General became the exclusive enforcer of KCDPA, subject to a permanent 30-day cure notice and damages of up to $7,500 per continued violation, with no private right of action.
Section 151.212, subdivision 4, requires a pharmacy that receives a request for an accessible prescription drug container label to provide the label in large print or Braille, or by another method in the best practices of the United States Access Board, depending on the need and preference of the patient. On and after , all pharmacies must be able to provide an accessible prescription drug container label in the timely manner that section 151.212, subdivision 4, requires. The Board of Pharmacy may impose a civil penalty not exceeding $10,000 for each separate violation of a licensee's prohibited conduct. A pharmacy's violation of any provision of the pharmacy chapter is grounds for disciplinary action by the Board of Pharmacy.
Insurance Data Security Act: notice of a cybersecurity event to the director
Insurance Data Security Act, Mo. Rev. Stat. sec. 375.1410
A licensee must notify the director as promptly as practicable, and in no event later than four business days, from a determination that a cybersecurity event involving nonpublic information in its possession has occurred when a listed criterion is met. The notice duty is met where the licensee is domiciled in Missouri, or Missouri is its home state, and the event has a reasonable likelihood of materially harming a consumer residing in Missouri or a material part of its normal operations. The notice duty is also met where the licensee reasonably believes that the nonpublic information involved is of two hundred fifty or more consumers residing in Missouri and the event meets either of two further conditions. An assuming insurer must notify its affected ceding insurers and the director of its state of domicile within three business days of making the determination that a cybersecurity event has occurred. The licensee must provide as much of the listed information as practicable, in electronic form as directed by the director, and has a continuing obligation to update its notices. A licensee must comply with section 407.1500, as applicable, and give the director a copy of the notice sent to consumers when it is required to notify the director. The Insurance Data Security Act takes effect on . In the Act, a person means any individual or any nongovernmental entity, including a nongovernmental partnership, corporation, branch, agency, or association.
Insurance Data Security Act: licensee information security program, investigation of a cybersecurity event and incident response plan
Insurance Data Security Act, Mo. Rev. Stat. secs. 375.1405, 375.1407 and 375.1417
Each licensee must develop, implement, and maintain a comprehensive written information security program that is based on its risk assessment and contains administrative, technical, and physical safeguards for nonpublic information and its information system. Each licensee must establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity, or availability of nonpublic information. If a licensee learns that a cybersecurity event has or may have occurred, the licensee, or an outside vendor or service provider designated to act on its behalf, must conduct a prompt investigation. A licensee must maintain records concerning all cybersecurity events for a period of at least three years from the date of the cybersecurity event. Each insurer domiciled in Missouri must submit to the director by April fifteenth each year a written statement certifying that it is in compliance with section 375.1405. Licensees have until to implement section 375.1405 and until to implement its third-party service provider duty in subsection 6. A licensee with fewer than ten employees, including any independent contractors, is exempt from section 375.1405. The Insurance Data Security Act takes effect on . In the Act, a person means any individual or any nongovernmental entity, including a nongovernmental partnership, corporation, branch, agency, or association.
The Digital Likeness and Voice Rights Act gives a Montana resident, or a person domiciled in Montana at death, a property right in their own name, voice, and visual likeness, freely transferable and descendible, that does not expire on death and continues for 20 years afterward in the rights holder's executors, heirs, transferees, or devisees. A person is liable for actual damages and any profits from the unauthorized use if, without the consent of the individual or the rights holder, the person distributes, transmits, or otherwise makes available an algorithm, software, tool, or other technology whose primary purpose, known to that person, is to produce an unauthorized digital voice or visual depiction of a particular, identified individual for commercial use, or if the person intentionally publishes or distributes such a depiction for commercial use knowing it is unauthorized. A digital voice or visual depiction is one newly created or altered using digital technology so that it is nearly indistinguishable from the individual's actual voice or likeness and a reasonable person would believe it genuine. A person who held an objectively reasonable belief that the material did not qualify as an unauthorized depiction is not liable for damages. The action may be brought by the individual or by an assignee, transferee, or exclusive licensee of the rights, within 4 years of discovery of the violation, and does not apply to a provider of broadband internet access service. Exemptions, to the extent the use is protected by the First Amendment and the Montana Constitution's free expression clause, cover news-gathering, public affairs and sports reporting, comment, criticism, scholarship, satire and parody, and an individual's authentic self-representation in an audiovisual work. The act took effect under its own effective-date clause. It directs its own codification as part of Title 30, chapter 14.
Ensuring Transparency in Prior Authorization Act, artificial-intelligence utilization review restriction
Neb. Rev. Stat. §§ 44-5432 to 44-5444
LB 77 (2025), the Ensuring Transparency in Prior Authorization Act, bars a utilization review agent's artificial intelligence-based algorithm from being the sole basis of a decision to deny, delay, or modify health care services based, in whole or in part, on medical necessity. The agent must disclose to the Department of Insurance, to each health care provider in its network, to each enrollee, and on its public website whether artificial intelligence-based algorithms are used or will be used in the utilization review process. The department may audit, itself or through a third-party entity, the agent's automated utilization management system. These provisions became operative on .
Requires a covered online service (over $25 million in annual revenue that derives at least half its revenue from selling or sharing personal data) to give minors accessible controls over addictive design features such as infinite scroll and push notifications, default to the highest available privacy and safety settings, limit profiling and targeted advertising to minors, and restrict sharing of precise geolocation data.
No person may knowingly create, produce, manufacture, or direct an intimate visual representation of an identifiable child for prurient purposes. The chapter defines the covered representation to include a synthetic image, one that has been altered or created depicting an individual's image in a realistic but false representation, alongside an ordinary photograph, film, video, or digital image, so an AI-generated or AI-altered intimate image of a child falls within the prohibition on the same footing as an authentic one. A violation is a class B felony.
AB 73 (2025), AI-manipulated media disclosure in paid political communications
Nev. Rev. Stat. 294A.3493
AB 73 (2025) added this section to NRS chapter 294A. The enrolled act specifically prescribes as its effective date, so the state's default October-1 rule for legislation with no prescribed date does not apply here.
Disclosure of pupil educational information to law enforcement officers
NRS 388.276(2)
A school district or public school, and any employee of one, must not disclose or provide in writing, verbally or in any other manner educational information to a law enforcement officer carrying out official duties, except under a lawful order, warrant or subpoena issued by a court of competent jurisdiction, or as necessary during or in the immediate aftermath of a mass casualty event or other emergency on or within school grounds, buildings or facilities where the delay of obtaining an order or warrant would endanger human life. Educational information means information concerning a pupil or the family or household of a pupil that is protected under the Family and Educational Rights and Privacy Act. A law enforcement officer for this purpose does not include a school resource officer, a person upon whom some or all of the powers of a peace officer are conferred under NRS 289.150 to 289.360, or a person authorized to make an arrest under NRS 171.124 to 171.1257. A person who knowingly and willfully violates the section is subject to disciplinary action by the school district or public school that employs the person. Section 46.5 of Assembly Bill 4 of the 36th Special Session of 2025 added this section to chapter 388 of NRS. Assembly Bill 4 of the 36th Special Session became effective on .
Oregon Laws 2025, chapter 116 (HB 2299), which extended ORS 163.472 to a digitally created, manipulated or altered depiction that is reasonably realistic, was approved by the Governor and filed in the office of the Secretary of State on , with a printed effective date of .
Oregon Unlawful Telephone Solicitations Act (as amended by 2025 Or. Laws ch. 580, effective January 1, 2026)
ORS 646.561, 646.563
House Bill 3865 (Oregon Laws 2025, chapter 580) amended this section, effective . As amended, Oregon bars a person from making a subsequent telephone solicitation, by call or text message, of a party who has stated during a telephone solicitation a desire not to be called or texted again. It also bars initiating a telephone solicitation outside the hours of 8 a.m. to 8 p.m., or more than three separate times to a party within 24 hours, unless the person has an established business relationship with the party. An established business relationship for this purpose means a transaction within the preceding 18 months. And it bars misrepresenting or falsifying the caller's own identity or the identity of the person on whose behalf the call is made, or the purpose of the solicitation. A telephone solicitation for this purpose is a call or text message encouraging a party to purchase real estate, goods or services or to make a donation, and it excludes a charitable organization or public agency contacting its own members or donors, a call or text limited to polling or soliciting opinions or votes, a business-to-business contact, and a call or text that responds directly to a message the party sent. A party is a telephone customer of a telecommunications company, and a person may rely on a mobile number's area code to decide whether the party is in Oregon. A violation is an unlawful trade practice, letting a person who suffers an ascertainable loss from a willful violation sue under ORS 646.638 for actual damages or $200, whichever is greater, plus attorney fees, in addition to the Attorney General's own enforcement powers.
Oregon Automatic Dialing and Announcing Device Statute (as amended by 2025 Or. Laws ch. 580, effective January 1, 2026)
ORS 646A.370-646A.376
House Bill 3865 (Oregon Laws 2025, chapter 580) amended this statute, effective . As amended, a caller may not use an automatic dialing and announcing device, a device that selects and dials numbers and disseminates a prerecorded or synthesized voice or text message, to call a subscriber by telephone unless the device disconnects within 10 seconds after the subscriber ends the call and, within the first 10 seconds, offers a one-touch or one-digit method for the subscriber to opt out of future calls; the opt-out duty does not reach a collection agency, debt buyer or debt collector, a public safety or law enforcement representative, or a caller with an established business relationship with the subscriber. The device may not dial a number for a fire, law enforcement or other emergency agency, a hospital, health care facility, physician's office, poison control center, or suicide-prevention or domestic-violence counseling service, or a subscriber who used the opt-out (unless the caller is a collection agency, debt buyer or debt collector, a public safety or law enforcement representative, or has an established business relationship), and, when dialing randomly or sequentially, a subscriber on an official government do-not-call list (unless the caller has an established business relationship, is a debt buyer or subject to the Fair Debt Collection Practices Act, is a public safety or law enforcement representative, or is a school district or school calling its employees, students or their families). It may be used to call a subscriber only between 8 a.m. and 8 p.m. and no more than three times in 24 hours, with the same exceptions as the government-list rule plus a caller responding directly to the subscriber's own message, and a caller may rely on a mobile number's area code to decide whether the subscriber is in Oregon. A caller using such a device may not misrepresent or falsify, in speaking with the subscriber, in the prerecorded or synthesized message or in any text message, the caller's own or a represented person's identity, the caller's telephone number, the caller's location, or the purpose of the call. Separately, a caller, a term that section does not limit to a user of such a device, may not intentionally alter, misrepresent or falsify the information a caller identification service would ordinarily provide. A person who knowingly, or while consciously avoiding knowledge, provides substantial assistance for a misrepresentation or caller-ID violation, including carrying or facilitating the calls, is liable to the same extent as the caller, except a common carrier or a network operator on whose network the call merely terminates. A violation of the misrepresentation and caller-ID duties is an unlawful trade practice, letting a person who suffers an ascertainable loss from a willful violation sue under ORS 646.638 for actual damages or $200, whichever is greater, plus attorney fees. A violation of the usage limits is an unlawful trade practice subject to Attorney General investigation and enforcement with a civil penalty of up to $5,000 for each violation, and ORS 646.608, whose list the private action under ORS 646.638 depends on, names ORS 646A.374 but not ORS 646A.372.
Oregon Consumer Privacy Act (OCPA), general applicability and controller duties
ORS 646A.570, 646A.578
House Bill 2008 took effect: a ban on selling precise geolocation data and a prohibition on processing a known under-16 consumer's data for targeted advertising or profiling and on selling it.
Use of nursing titles by a nonhuman entity (HB 2748)
ORS 678.027
Oregon Laws 2025, chapter 378 (HB 2748), which created ORS 678.027, was approved by the Governor and filed in the office of the Secretary of State on , with a printed effective date of .
Bars a controller that has actual knowledge that, or willfully disregards whether, a consumer is under 16 from selling that consumer's personal data, using it for targeted advertising, or profiling in furtherance of decisions with legal or similarly significant effects, with no consent exception, and separately bars selling personal data that identifies a consumer's location within a 1,750 foot radius. Signed by Governor Kotek on .
Rhode Island Data Transparency and Privacy Protection Act, publicly available information exemption
R.I. Gen. Laws § 6-48.1-2(24)
RIDTPPA's definition of "personal data" at section 6-48.1-2(18) excludes "publicly available information," defined at (24) as information that is lawfully made available through federal, state, or municipal government records or widely distributed media, or that a controller has a reasonable basis to believe a customer has lawfully made available to the general public. Unlike California's four-prong CCPA exemption, Rhode Island's exemption has no separate prong reaching information a third party (rather than the data subject) disclosed without restricting the audience, so personal data a scraper pulls from a re-hosted directory or an aggregator that is neither a government record nor the data subject's own act falls outside the exemption and inside RIDTPPA's reach for a controller the Act otherwise covers. RIDTPPA applies only to for-profit entities that conduct business in, or target products or services to, Rhode Island residents and meet its 35,000-customer or 10,000-customer-plus-20-percent-revenue thresholds; its enforcement and further customer-rights detail are researched in this jurisdiction's privacy topic document.
Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA), general applicability
R.I. Gen. Laws ch. 6-48.1, secs. 6-48.1-2, 6-48.1-5, 6-48.1-6
Rhode Island's comprehensive data privacy law's general applicability provisions became binding on covered for-profit entities, enacted through two companion 2024 public laws for the same chapter.
Rhode Island Data Transparency and Privacy Protection Act, sensitive data and biometric data definitions
R.I. Gen. Laws sec. 6-48.1-2(26), (3)
RIDTPPA classifies genetic or biometric data processed to uniquely identify a person, along with racial or ethnic origin, religious belief, health condition, sex life, sexual orientation, citizenship or immigration status, a known child's data, and precise geolocation, as sensitive data. "Biometric data" means data generated by automatic measurements of an individual's biological characteristics, such as a fingerprint, a voiceprint, eye retinas, irises, or other unique biological patterns or characteristics that are used to identify a specific individual. It does not include a digital or physical photograph, an audio or video recording, or any data generated from one, unless such data is generated to identify a specific individual.
Rhode Island Data Transparency and Privacy Protection Act, data protection assessments
R.I. Gen. Laws sec. 6-48.1-7(a), (e) to (i)
A controller must conduct and document a data protection assessment for each processing activity that presents a heightened risk of harm to a customer, which includes targeted advertising, the sale of personal data, some profiling and the processing of sensitive data. The attorney general may require a controller to disclose any data protection assessment that is relevant to an investigation, and the controller must make it available. Data protection assessments are confidential and exempt from disclosure under the access to public records law. The assessment requirements apply to processing activities created or generated after , and are not retroactive. The section applies to for-profit entities that conduct business in the state or produce products or services targeted to residents of the state and that meet one of two thresholds on the number of customers whose personal data they control or process.
Rhode Island Data Transparency and Privacy Protection Act, enforcement
R.I. Gen. Laws sec. 6-48.1-8
The Rhode Island Attorney General became the sole enforcer of RIDTPPA, with fines of $100 to $500 per intentional unlawful disclosure, no mandatory cure period, and no private right of action.
Rhode Island Data Transparency and Privacy Protection Act, de-identified data
R.I. Gen. Laws secs. 6-48.1-2(13), 6-48.1-7(j), (n)
Section 6-48.1-2(13) defines de-identified data as data that cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable individual, or a device linked to such individual. Section 6-48.1-7(j)(1) requires a controller in possession of de-identified data to take reasonable measures to ensure that the data cannot be associated with an individual. Section 6-48.1-7(j)(2) requires a controller in possession of de-identified data to publicly commit to maintaining and using the data without attempting to re-identify it. Section 6-48.1-7(j)(3) requires a controller in possession of de-identified data to contractually obligate any recipients of the data to comply with all provisions of the chapter. Section 6-48.1-7(n) requires a controller that discloses pseudonymous data or de-identified data to exercise reasonable oversight to monitor compliance with any contractual commitments to which the data is subject and to take appropriate steps to address any breaches of those commitments. Section 6-48.1-7(k)(1) provides that the chapter does not require a controller or processor to re-identify de-identified data or pseudonymous data.
Rhode Island Data Transparency and Privacy Protection Act, customer rights
R.I. Gen. Laws secs. 6-48.1-5, 6-48.1-6
Rhode Island customers gained the rights to access, correct, delete, and port their personal data and to opt out of targeted advertising, sale, and significant-effect profiling, with a 45-day (plus one 45-day extension) response window and a 60-day appeal.
Law Enforcement Personal Privacy Protection Act: restriction of a law enforcement officer's home address, personal cellular telephone number and tax map number on agency web sites
S.C. Code Ann. secs. 30-2-500 to 30-2-515
A law enforcement officer's personal contact information in a disclosed record must be restricted on a publicly available internet website maintained by or operated on behalf of the state or local government agency if the law enforcement officer notifies the individual agency of the choice to restrict public access by submitting the designated form and any supplemental information the agency requests, and provides a notarized affidavit affirming current employment or previous employment as a law enforcement officer. Personal contact information means the home address, personal cellular telephone number, or property tax map number, if applicable, of the eligible requesting party. Law enforcement officer means an active or former federal, state or local certified law enforcement officer or corrections officer. Disclosed records means records accessible by a database or an image of an official record that are placed on a publicly available internet website maintained by or operated on behalf of a state or local government agency, and do not include records available for purchase or through an account, by registration or subscription, from a state or local government agency. Restricted personal contact information must remain within the official records held or maintained by a state or local government agency, but may not be included in an index or displayed on an image of an official record on a publicly available internet website maintained or operated on behalf of a state or local government agency. If a home address or tax map number cannot be restricted from a disclosed record within an index or from being displayed on an image of an official record, the image of the official record must not be displayed and the agency must restrict the home address or tax map number portion from the display within the index. A governmental agency that restricts or withholds information under the article must provide to a requestor a description of the restricted or withheld information and a citation to the article. Restricted personal contact information may be disclosed under subpoena, by order of the court, upon written consent of the eligible law enforcement officer, or to a government agency. Restricted personal contact information may also be disclosed to a title insurer or its affiliate, a title insurance agent or agency, a personal representative of a deceased eligible requesting party, a South Carolina attorney in good standing with the South Carolina Bar, or a professional engineer or professional surveyor, or to a person each appoints in writing to receive the restricted information on that person's behalf. The eligible requesting party's request to restrict information does not apply to a subsequent home address, and the eligible requesting party is responsible for notifying each state or local government agency, through the designated form, of a subsequent home address and of any documents filed after the original request. The restricted status of a home address in the official records within a county register of deeds is maintained only during the period when the eligible requesting party resides at the dwelling location. An eligible requesting party may petition the court for an order directing compliance with the article. Liability may not accrue to a state or local government employee or to the employee's agents for claims or damages that arise from personal contact information on the public record.
Judicial Personal Privacy Protection Act: restriction of a judge's home address, personal cellular telephone number and tax map number on agency web sites
S.C. Code Ann. secs. 30-2-700 to 30-2-715
A judge's personal contact information in a disclosed record must be restricted on a publicly available internet website maintained by or operated on behalf of the state or local government agency if the judge notifies the individual agency of the choice to restrict public access by submitting the designated form and any supplemental information the agency requests, and provides a notarized affidavit affirming the current or prior service as a judge. Personal contact information means the home address, personal cellular telephone number, or tax map number, if applicable, of the eligible requesting party. An eligible requesting party is an active or a former judge who has filed a formal request under the article. Disclosed records means records accessible by a database or an image of an official record that are placed on a publicly available internet website maintained by or operated on behalf of a state or local government agency, and do not include records available for purchase or through an account, by registration or subscription, from a state or local government agency. Restricted personal contact information must remain within the official records held or maintained by a state or local government agency, but may not be included in an index or displayed on an image of an official record on a publicly available internet website maintained or operated on behalf of a state or local government agency. If a home address or tax map number cannot be restricted from a disclosed record within an index or from being displayed on an image of an official record, the image of the official record must not be displayed and the agency must restrict the home address or tax map number portion from the display within the index. A state or local government agency that restricts or withholds information under the article must provide to a requestor a description of the restricted or withheld information and a citation to the article. Restricted personal contact information may be disclosed under subpoena, by order of the court, upon written consent of the eligible judge, or to a government agency. Restricted personal contact information may also be disclosed to a title insurer or its affiliate, a title insurance agent or agency, a personal representative of a deceased eligible requesting party, a South Carolina attorney in good standing with the South Carolina Bar, or a professional engineer or professional surveyor, or to a person each appoints in writing to receive the restricted information on that person's behalf. The eligible requesting party's request to restrict information does not apply to a subsequent home address, and the eligible requesting party is responsible for notifying each state or local government agency, through the designated form, of a subsequent home address and of any documents filed after the original request. The restricted status of a home address in the official records within a county register of deeds is maintained only during the period when the eligible requesting party resides at the dwelling location. An eligible requesting party may petition the court for an order directing compliance with the article. Liability may not accrue to a state or local government employee or to the employee's agents for claims or damages that arise from personal contact information on the public record.
Texas Capture or Use of Biometric Identifier Act (CUBI), publicly available media clause
Tex. Bus. & Com. Code § 503.001
CUBI, added in 2007 by Acts 2007, 80th Legislature, chapter 885, section 2.01, effective and amended by HB 149 (TRAIGA, 2025 Legislature, effective ), requires that a person inform an individual before capturing a biometric identifier (a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry) for a commercial purpose and receive that individual's consent. The 2025 amendment adds a rule bearing directly on scraping: the mere existence of an image or other media containing someone's biometric identifiers on the Internet or another publicly available source does not, by itself, count as that person having been informed of or having consented to the capture or storage of their biometric identifier for a commercial purpose, unless the individual themselves made that image or media publicly available. A separate clause in the same 2025 amendment exempts the training, processing, or storage of biometric identifiers to develop, train, evaluate, disseminate, or otherwise offer an artificial intelligence system, unless that system is used or deployed to uniquely identify a specific individual. A civil penalty of not more than $25,000 per violation is recoverable solely by the Attorney General; CUBI carries no private right of action, unlike Illinois's BIPA.
A governmental agency that makes an AI system available to interact with consumers must disclose, before or at the time of interaction, that the consumer is interacting with an AI system, regardless of whether that would already be obvious; the disclosure must be clear, conspicuous, in plain language, free of dark patterns, and may be given by hyperlink. The same disclosure duty extends to any provider of a health care service or treatment, public or private, that uses an AI system in that service or treatment, who must give it to the patient or the patient's representative by the time the service is first provided, or as soon as reasonably possible in an emergency.
TRAIGA (H.B. 149, 2025), prohibited AI practices binding any person
Tex. Bus. & Com. Code §§ 552.052, 552.055-552.057
A person may not develop or deploy an AI system that intentionally aims to incite self-harm, harm to another, or criminal activity; may not develop or deploy an AI system with the sole intent of infringing a constitutional right; may not develop or deploy an AI system with intent to unlawfully discriminate against a protected class, though disparate impact alone does not show that intent; and may not develop or distribute an AI system with the sole intent of producing AI-generated child pornography or deepfake sexually explicit media, or that engages a minor in simulated sexual conversation while impersonating a child. Enforcement is exclusively by the Attorney General, with no private right of action and a 60-day notice-and-cure period. Civil penalties run from $10,000 to $12,000 per curable violation, $80,000 to $200,000 per uncurable violation, and $2,000 to $40,000 per day for a continuing violation, and the Attorney General cannot bring an action over a system that has not been deployed.
TRAIGA (H.B. 149, 2025), Attorney General enforcement, civil investigative demand, cure period, penalties and defenses
Tex. Bus. & Com. Code §§ 552.101-552.106
The Attorney General has exclusive authority to enforce the chapter, and the chapter provides no basis for a private right of action. The Attorney General maintains an online mechanism through which a consumer may submit a complaint. On a complaint alleging a violation, the Attorney General may issue a civil investigative demand under the procedures of Section 15.10. A demand may ask for a high-level description of the system's purpose, intended use, deployment context and associated benefits, a description of the type of data used to program or train it, a high-level description of the categories of input data and of the outputs, any performance metrics, any known limitations, and a high-level description of post-deployment monitoring and user safeguards. Before suing, the Attorney General must notify the person in writing of the specific provisions allegedly violated, and may not bring an action before the 60th day after the notice or if the person cures the violation within that period and provides a written statement that it has cured the violation, supporting documentation, and any necessary changes to internal policies to reasonably prevent further violation. A person who violates the chapter and does not cure the violation is liable for a civil penalty of $10,000 to $12,000 for each curable violation or breach of a cure statement, $80,000 to $200,000 for each uncurable violation, and $2,000 to $40,000 for each day a violation continues, and the Attorney General may also seek an injunction and recover attorney's fees, court costs and investigative expenses. There is a rebuttable presumption that a person used reasonable care as required under the chapter. A defendant may seek an expedited hearing or other process, including a request for declaratory judgment, if it believes in good faith that it has not violated the chapter. A defendant may not be found liable if another person uses its AI system in a manner the chapter prohibits, or if it discovers a violation through feedback from a developer, deployer, or other person who believes a violation has occurred, through testing including adversarial or red-team testing, through following guidelines set by applicable state agencies, or, if it substantially complies with the most recent version of the National Institute of Standards and Technology's Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile or another nationally or internationally recognized risk management framework for AI systems, through an internal review process. The Attorney General may not bring an action to collect a civil penalty against a person for an AI system that has not been deployed. A state agency may impose sanctions, including suspension, probation or revocation of a license, registration or certificate or a monetary penalty not to exceed $100,000, on a person it licenses, registers or certifies if the person has been found in violation under Section 552.105 and the Attorney General has recommended additional enforcement by that agency.
Requires app store providers to verify a user's age category, link a minor's account to a parent account, and obtain parental consent before a minor can download an app or make an in app purchase, and to share age and consent information with app developers. Violations are deceptive trade practices under Texas consumer protection law.
Capture or Use of Biometric Identifier Act (CUBI), as amended by HB 149
Tex. Bus. & Com. Code sec. 503.001, as amended by Tex. HB 149, 89th Legislature (2025)
New provisions clarify that an individual's biometric identifiers appearing in publicly available online media do not by themselves establish consent to capture, and exempt biometric identifiers used only to train, process, or store data for developing or evaluating an AI model, and AI systems used to prevent fraud, harassment, or other illegal activity.
Texas electronic health records: storage in the United States, access limits and safeguards
Tex. Health & Safety Code sec. 183.002
In chapter 183 a covered entity has the meaning section 181.001 assigns and includes a health care practitioner, but does not include a home and community support services agency, a nursing facility, a continuing care facility, an assisted living facility, an intermediate care facility, a day activity and health services facility, or a provider under the Texas home living or home and community-based services waiver program. A covered entity must ensure that electronic health records under its control that contain patient information are physically maintained in the United States or a territory of the United States, including records stored by a third-party or subcontracted computing facility or cloud computing service and records stored using a technology through which patient information may be retrieved, accessed or transmitted. A covered entity must ensure that the electronic health record information of this state's residents, other than open data, is accessible only to individuals who require it to perform duties within the scope of their employment related to treatment, payment or health care operations. Each covered entity must implement reasonable and appropriate administrative, physical and technical safeguards to protect the confidentiality, integrity and availability of electronic health record information. The attorney general may institute an action for injunctive relief to restrain a violation of chapter 183. The attorney general may institute an action for civil penalties against a covered entity, which may not exceed $5,000 for each negligent violation in a single year, $25,000 for each knowing or intentional violation in a single year, or $250,000 for each violation in which the covered entity knowingly or intentionally used protected health information for financial gain. The appropriate regulatory agency may take disciplinary action against a covered entity that violates chapter 183 three or more times in the same manner as if the covered entity violated an applicable licensing or regulatory law. Chapter 183 was added by Acts 2025, 89th Legislature, chapter 1002 (Senate Bill 1188), effective . Section 2(b) of the Act that added chapter 183 provides that section 183.002 applies to the storage of an electronic health record on or after , regardless of the date on which the record was prepared.
S.B. 815 (2025), utilization review agent ban on automated decision systems for adverse determinations
Tex. Ins. Code § 4201.156
Senate Bill 815 added Section 4201.156 to the Texas Insurance Code, under which a utilization review agent may not use an automated decision system to make, wholly or partly, an adverse determination. An automated decision system is an algorithm, including an algorithm incorporating an artificial intelligence system, that uses data-based analytics to make, suggest, or recommend certain determinations, decisions, judgments, or conclusions. An adverse determination is a determination by a utilization review agent that health care services provided or proposed to be provided to a patient are not medically necessary or appropriate or are experimental or investigational. The ban does not prohibit the use of an algorithm, artificial intelligence system, or automated decision system for administrative support or fraud-detection functions. The commissioner may audit and inspect at any time a utilization review agent's use of an automated decision system for utilization review. A notice of an adverse determination must include a description of and the source of the screening criteria and review procedures used as guidelines in making the adverse determination. The amended chapter applies only to utilization review conducted for a health benefit plan delivered, issued for delivery, or renewed on or after . The act is Chapter 989 of the Acts of the 89th Legislature, Regular Session. The act took effect .
Article 20(1) lists the cross-border transfers the Law covers: moving personal data stored in Vietnam to a storage system outside Vietnam, an agency, organization, or individual in Vietnam passing personal data to a counterpart abroad, and using a platform outside Vietnam to process personal data collected in Vietnam. Under Article 20(2), whoever transfers personal data across the border must prepare a cross-border transfer impact assessment dossier and send one original to the specialized personal data protection agency within 60 days of the first day of transfer. Under Article 20(3), the assessment is done once for the whole period of the party's operation and updated as Article 22 requires. Under Article 20(5), that agency decides to require a transfer to stop when the data is being sent for use in activity that may harm national defense or security. Article 20(6) excuses transfers by competent state bodies, an organization storing its own employees' data on a cloud service, and a data subject transferring his or her own data. The paragraphs of Article 20 set no adequacy list, no approval step, and no data-localization element. Article 20(7) leaves the detailed conditions and procedures to the Government. A separate penalties article sets the maximum fine for an organization violating the cross-border transfer rules at 5 percent of its prior-year revenue, a tier distinct from the Law's general fine.
Article 23 requires the personal data controller, the personal data controlling and processing party, or a third party to notify the agency in charge of personal data protection within 72 hours after detecting a violation likely to cause harm to national defense and security and social order and safety, or to infringe upon the life, health, honor, dignity, or property of the personal data subject. Where a personal data processor detects a violation, it must promptly notify the controller or the controlling and processing party.
Article 31 defines biometric data as data on physical attributes and unique and stable biological characteristics of a person used to identify that person. It requires an organization, agency, or individual collecting or processing biometric data to apply physical security measures for storage and transmission devices, limit access, maintain a monitoring system to detect infringement, and comply with relevant laws and international standards. Where the processing damages the data subject, the collecting and processing party must notify that data subject as the Government prescribes. Article 31 names no facial, voice, or fingerprint example, resting entirely on the general physical-attribute language; whether the definition reaches an identifier derived from a photo, video, or audio recording is unresolved. This provision functions as heightened, category-wide protection rather than a named consent-at-capture rule distinct from the Law's general Article 9 consent duty.
Law No. 91/2025/QH15, enforcement and data subject rights provisions
Article 33(1)(a) names the specialized personal data protection agency under the Ministry of Public Security as part of the personal data protection force. Article 36(2) makes the Ministry of Public Security the focal agency answerable to the Government for state management of personal data protection, except for matters within the Ministry of National Defence's scope. Under Article 8(4), the administrative fine for an organization violating the cross-border transfer rules reaches up to 5 percent of the prior year's revenue. Under Article 8(3), the fine for buying or selling personal data reaches up to 10 times the proceeds. Under Article 8(5), the fine for other violations reaches up to VND 3 billion. Under Article 8(6), individuals are capped at half the organizational maximum. Article 4(1) gives individuals the right to request the provision, deletion, or restriction of processing of their personal data and to object to its processing. Article 4(1) also gives individuals the right to file complaints and denunciations, initiate lawsuits, and request compensation for damage in accordance with law, arming a private plaintiff.
A law, an amendment, a regulation or court guidance was passed, signed or adopted. Dated by signature or adoption.
Now in force
Obligations started to bind. Dated by the start date the law itself states.
Blocked by a court
A court paused enforcement. An injunction can be lifted, so the duty may return. The court's order is the source and gives the date.
No longer in force
Repealed, replaced or struck down. The repealing act or the court's judgment is the source and gives the date.
Proposed
A bill introduced or a draft published, or one that failed before it passed. It binds nobody unless it passes.
Sources
Every change on this page is sourced to an official record: the law as published, the legislature's record, the official journal, the court's docket or a government announcement. News coverage is listed for context and is never the source. Changes reported only in the news are on News until they are sourced. This page reports changes in the law. It is not legal advice.
