AI Compliance Regulations Directory

Regulation (EU) 2024/1689 — the world's first comprehensive AI law. Classifies AI systems by risk: prohibited (social sc…

The EU Digital Services Act (Regulation 2022/2065) has been in force for all online platforms since February 17, 2024. F…

GDPR Article 22 (in force since May 25, 2018) gives EU and EEA residents the right not to be subject to decisions based …

EU DORA (Regulation 2022/2554, in application January 17, 2025) applies to 20 categories of EU-regulated financial entit…

As of August 2, 2025, the EU AI Act's obligations for General-Purpose AI (GPAI) model providers and deployers are in ful…

The EU Cyber Resilience Act (CRA, Regulation 2024/2847, entered into force December 10, 2024) requires manufacturers and…

EU AI Act Article 5 bans eight categories of AI outright — no grace period, no exceptions. These prohibitions became enf…

EU AI Act Article 6(1) classifies AI systems embedded in EU-regulated medical devices as high-risk. Any AI-powered medic…

Directive (EU) 2024/2853, published in the Official Journal 2024-11-18 and entered into force 2024-12-08/09 (20 days aft…

The Italian data protection authority (Garante) temporarily banned ChatGPT in March 2023 (lifted April 28, 2023, after O…

Spain's AEPD has published comprehensive AI-GDPR guidance including a 10-step AI adequacy methodology, algorithmic bias …

The Dutch DPA (AP) is a leading EU enforcement authority on AI profiling and automated decision-making, having fined Ube…

Poland's UODO has issued GDPR-AI guidance requiring DPIAs for AI profiling systems and human review for automated decisi…

Ireland's DPC is the lead GDPR supervisor for most major US tech companies in the EU. DPC issued a €1.2B fine against Me…

Sweden's IMY published detailed generative AI and GDPR guidance in 2023. IMY fined Spotify €5M in 2023. IMY requires a d…

Luxembourg is a major EU financial and tech hub (Amazon EU HQ, Skype, PayPal, Spotify European headquarters). The CNPD (…

Slovakia's data protection authority is the Úrad na ochranu osobných údajov Slovenskej republiky (UOOU). Slovakia has ad…

Estonia is the world's most digitally advanced country — 99% of government services are online, and the X-Road data exch…

Latvia's Datu valsts inspekcija (DVI) supervises GDPR and AI data processing. Latvia's AI Development Guidelines 2021-20…

Lithuania's Valstybinė duomenų apsaugos inspekcija (VDAI) supervises GDPR compliance. Lithuania adopted its AI Strategy …

Bulgaria's Commission for Personal Data Protection (CPDP / Комисия за защита на личните данни) supervises data protectio…

Croatia's Agencija za zaštitu osobnih podataka (AZOP) supervises GDPR. Croatia adopted its National AI Development Strat…

Slovenia's Informacijski pooblaščenec (Information Commissioner, IP) supervises both data protection and freedom of info…

Cyprus's Commissioner for Personal Data Protection (CPDBP) supervises GDPR compliance. Cyprus has positioned itself as a…

Malta made history in 2019 by becoming the first country in the world to publish a National AI Strategy. The Malta Infor…

The CPRA expanded CCPA to cover automated decisionmaking technology (ADMT). The CPPA's ADMT / risk-assessment / cybersec…

California AB 2013 requires any person or company that designs, codes, produces, or substantially modifies a generative …

California SB 942 (California AI Transparency Act) requires "covered providers" — generative AI systems with more than 1…

California SB 243 (signed October 13, 2025, effective January 1, 2026) regulates operators of AI companion chatbots — AI…

HISTORICAL / NOT CURRENTLY ENFORCEABLE — California AB 2655 (Defending Democracy from Deepfake Deception Act of 2024) wa…

CURRENT LAW: Colorado SB 26-189 — signed by Governor Polis on 14 May 2026 — REPEALED AND REENACTED part 17 of the Colora…

Illinois regulates AI on two independent surfaces. (1) EMPLOYMENT. AIVIA (820 ILCS 42, effective January 1, 2020) requir…

Illinois AIVIA (820 ILCS 42, effective January 1, 2020) requires employers to notify applicants before using AI to analy…

Illinois BIPA (740 ILCS 14, effective 2008, amended 2024) is the nation's strongest biometric privacy law and directly a…

New York Governor Kathy Hochul signed Assembly Bill A6767 (introduced 2025-03-13) creating the Artificial Intelligence C…

New York's Responsible AI Safety and Education (RAISE) Act adds a new Article 44-B (§§ 1420-1429) to the General Busines…

New York State has the RAISE Act (frontier AI developers only, effective Jan 1, 2027) and NYC Local Law 144 (AI hiring b…

The UK uses a sector-led, principles-based approach to AI governance. The ICO enforces AI requirements under UK GDPR (re…

China's Interim Measures for the Management of Generative Artificial Intelligence Services (issued by CAC and six agenci…

China's Personal Information Protection Law (PIPL, effective November 1, 2021) is China's primary personal data protecti…

China's Data Security Law (DSL, effective September 1, 2021) establishes a data classification and tiered protection sys…

Japan's Act on Promotion of Research and Development, and Utilization of Artificial Intelligence-related Technology was …

Australia has no standalone mandatory AI law as of July 2026 (web-verified 2026-07-01), but two frameworks govern AI use…

Qatar Law No. 13 of 2016 (Personal Data Privacy Protection Law, "PDPL"/"PDPPL"), promulgated 13 November 2016 and in for…

Bahrain Law No. 30 of 2018 (Personal Data Protection Law, "PDPL"), in force from 1 August 2019, enforced by the Personal…

Kuwait has NO single comprehensive personal-data-protection law — data-protection obligations are split across three ins…

The UAE Personal Data Protection Law (PDPL/PDPA) is enforced by the UAE Data Office. It covers processing of personal da…

Qatar's Personal Data Privacy Protection Law (PDPPL) governs collection, processing, and transfer of personal data in Qa…

Bahrain's PDPL (Law No. 30 of 2018) is the first comprehensive data protection law in the GCC, predating Saudi Arabia's …

Israel's Privacy Protection Law (PPL, 5741-1981) is administered by the Privacy Protection Authority (PPA, formerly ILIT…

Pakistan's only currently-BINDING cyber/data law is PECA 2016 (Prevention of Electronic Crimes Act, effective 2016-08-19…

Singapore's PDPA (2012, amended 2021) is one of ASEAN's most mature data protection laws, enforced by the Personal Data …

The Philippines Data Privacy Act (DPA 2012, RA 10173) is enforced by the National Privacy Commission (NPC). The DPA appl…

India's Digital Personal Data Protection Act 2023 (DPDPA) is the most significant Indian data law since IT Act 2000. The…

South Korea's PIPA (Personal Information Protection Act) is one of Asia's most comprehensive privacy laws, significantly…

Colombia's SIC (Superintendencia de Industria y Comercio) Circular Externa 002 of 2024 (21 Aug 2024) addresses processin…

Peru's PDPL (Law No. 29733) is now implemented by DS 016-2024-JUS (published Nov 30, 2024, effective March 30, 2025), wh…

The LFPDPPP was entirely republished on 2025-03-20 (in force 2025-03-21), replacing the 2010 law. Enforcement transferre…

Morocco's Law 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data (2009) and its imple…

Nigeria has Africa's most comprehensive data protection framework. The Nigeria Data Protection Regulation (NDPR 2019) wa…

Turkey's KVKK (Kişisel Verileri Koruma Kanunu, Law No. 6698) is Turkey's GDPR-equivalent, administered by the Personal D…

UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("UAE PDPL") came into force January 2, 2022. T…

Argentina's Personal Data Protection Act (Law 25,326) has been in force since 2001 and is enforced by the AAIP. Argentin…

Hong Kong's PCPD published two distinct AI-relevant documents: the "Guidance on the Ethical Development and Use of Artif…

Austria's Datenschutzgesetz (DSG) implements GDPR at national level and applies to AI systems processing personal data o…

Belgium's Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit — APD/GBA) has …

Brazil's Lei Geral de Proteção de Dados (LGPD, Law 13,709/2018) has been in force since September 18, 2020. Article 20 g…

Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) governs AI and automated decision-making …

Alberta's Personal Information Protection Act (PIPA Alberta, SA 2003) applies to private sector organizations in Alberta…

British Columbia's Personal Information Protection Act (PIPA BC, SBC 2003) applies to private sector organizations in BC…

Ontario's Working for Workers Four Act, 2024 added job-posting rules to the Employment Standards Act, 2000 (ss. 8.1–8.6)…

Québec's Act to modernize legislative provisions respecting the protection of personal information (Law 25 / Bill 64) is…

Switzerland's revised Federal Act on Data Protection (nFADP / revDSG, in force September 1, 2023) applies to any organiz…

Czech Republic's Úřad pro ochranu osobních údajů (ÚOOÚ — Office for Personal Data Protection) enforces GDPR and has publ…

Germany is an EU member state subject to all EU AI Act obligations (see EU AI Act entry for primary compliance), and as …

Denmark's Datatilsynet (Data Protection Authority) has published detailed AI-specific guidance and conducted high-profil…

Finland's Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) enforces GDPR and has published guida…

France is an EU member state subject to all EU AI Act obligations (see EU AI Act entry). France has NOT yet finalized it…

Greece's Hellenic Data Protection Authority (HDPA / Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα — APDPX) enforces GDP…

Hungary's National Authority for Data Protection and Freedom of Information (NAIH — Nemzeti Adatvédelmi és Információsza…

Indonesia's Personal Data Protection Act (Law No. 27 of 2022, "UU PDP") entered into force on October 17, 2022, with a t…

Israel's Privacy Protection Law (PPL, 1981) was comprehensively overhauled by Amendment 13 (approved 2024-08-05, most pr…

Kenya's Data Protection Act No. 24 of 2019 entered into force November 8, 2019, with the Data Protection (General) Regul…

South Korea's AI Basic Act (Framework Act on AI Development and Trust; passed by the National Assembly December 26, 2024…

Egypt's PDPL (No. 151/2020), enforced by the Personal Data Protection Centre (PDPC), is the first comprehensive data pro…

Malaysia has no mandatory AI law as of August 2026 (web-verified 2026-08-22; not yet enacted) — its first comprehensive …

Nigeria's Data Protection Act 2023 (signed June 12, 2023) replaced the 2019 NDPR framework and established the Nigeria D…

Norway is an EEA member that has committed to incorporating the EU AI Act through the EEA Agreement, but as of this cycl…

New Zealand has no standalone mandatory AI law as of July 2026 (web-verified 2026-07-01), but several overlapping framew…

New Zealand's Privacy Act 2020 regulates AI systems that process personal information of New Zealand residents. The Priv…

The Philippines National Privacy Commission (NPC) issued Advisory No. 2024-04 on December 19, 2024: Guidelines on the Ap…

Portugal's Comissão Nacional de Proteção de Dados (CNPD) enforces GDPR and has issued sector-specific AI guidance for fi…

Romania's National Supervisory Authority for Personal Data Processing (ANSPDCP — Autoritatea Națională de Supraveghere a…

Saudi Arabia's Personal Data Protection Law (Royal Decree M/19, September 2021) became fully enforceable on September 14…

Saudi Arabia's PDPL enforced by SDAIA (Saudi Data and AI Authority) is one of the Gulf's most comprehensive data protect…

The Monetary Authority of Singapore (MAS) has two NON-MANDATORY AI workstreams for financial institutions, not a binding…

Thailand's Personal Data Protection Act B.E. 2562 (2019) became fully effective June 1, 2022, and the PDPC imposed its f…

Taiwan's Legislative Yuan passed the Artificial Intelligence Basic Act on December 23, 2025; it was promulgated and took…

Alaska enacted its first AI-specific criminal provisions in 2026: HB 47's AI-generated child-sexual-abuse-material and d…

Alaska has no comprehensive private-sector AI statute reaching insurers. What it has is the FIRST adoption of the NAIC A…

Alabama has no comprehensive cross-sector private-sector AI statute as of August 2026, but it has enacted FOUR AI-specif…

Arkansas regulates insurer AI by BULLETIN and constrains AI in health-plan prior authorization by STATUTE, on top of sev…

Arizona HB 2311 passed both chambers of the Arizona legislature (enrolled March 9, 2026) and would have required operato…

Connecticut regulates AI through four stacked instruments, three of which are already in force and one of which lands on…

The District of Columbia has no comprehensive private-sector AI regulation as of June 2026 (R234 re-verified the negativ…

The District of Columbia has no comprehensive private-sector AI statute — the recurring "Stop Discrimination by Algorith…

Delaware has no comprehensive cross-sector private-sector AI statute as of August 2026, but it has enacted THREE private…

Delaware has no comprehensive private-sector AI statute reaching insurers, and its AI bulletin is the most faithful copy…

Florida has no COMPREHENSIVE private-sector AI statute as of August 2026, but it has enacted FOUR targeted AI-adjacent l…

Florida enacted Chapter 2024-118 (CS/CS/SB 1680, "Advanced Technology"), effective July 1, 2024. Verified via direct pri…

GEORGIA MULTI-SURFACE ENTRY (R510, 2026-08-25 — was single-surface/chatbot-only). Georgia has NO comprehensive consumer-…

Georgia SB 540 was signed into law by Governor Kemp on May 11, 2026 and takes effect July 1, 2027 (codified at O.C.G.A. …

Hawaii has NO comprehensive cross-sector AI statute, but it has THREE private-binding AI/deepfake laws now in force. (1)…

Iowa's AI duties sit on three separate surfaces, and only the first is criminal law. (1) SYNTHETIC MEDIA. Two bills effe…

Idaho S 1297, the Conversational AI Safety Act, was signed by Governor Brad Little on March 31, 2026 (Session Law Chapte…

Idaho S 1227 was signed by Governor Little on March 27, 2026, and took effect July 1, 2026 (web-verified 2026-08-02: eff…

Indiana has no single horizontal "AI act," but as of August 2026 it regulates automated decision-making through a LIVE c…

Kansas has no comprehensive cross-sector private-sector AI statute as of August 2026, but it has enacted AI-specific cri…

Kentucky has no COMPREHENSIVE cross-sector private-sector AI statute as of June 2026, but it has enacted TWO AI provisio…

Louisiana has no COMPREHENSIVE cross-sector private-sector AI statute as of August 2026, but it has enacted SIX targeted…

Executive Order JML 25-103 (signed by Governor Jeff Landry, September 16, 2025; amended by JML 25-109) governs how Louis…

Massachusetts has no comprehensive AI statute and no enacted election-deepfake, chatbot-disclosure, employment-AI, or he…

Maryland regulates insurance AI on THREE stacked surfaces, and only the third is healthcare-specific. (1) MIA BULLETIN 2…

Maine LD 1727 (An Act to Ensure Transparency in Consumer Transactions Involving Artificial Intelligence) was signed by G…

Michigan has no comprehensive cross-sector private-sector AI statute as of June 2026, but it has enacted two in-force AI…

Minnesota has no comprehensive cross-sector private-sector AI statute as of August 2026, but it has multiple in-force AI…

ROUND 517 (2026-08-25) rebuilt this entry around the obligation that actually binds most Minnesota businesses and that t…

Missouri has NO AI-specific statute. Every AI bill introduced in the 2026 session died, including SB 1444 (proposed RSMo…

Mississippi has no COMPREHENSIVE cross-sector AI statute as of June 2026, but its 2024 Regular Session enacted TWO targe…

Montana Governor Greg Gianforte signed Senate Bill 212 (the Montana Right to Compute Act) on April 17, 2025 — the first …

North Carolina has no comprehensive/standalone private-sector AI statute as of June 2026, but it has enacted one AI-spec…

North Dakota is NOT an AI-unregulated state — its 2025 (69th) and 2023 (68th) sessions enacted narrow AI statutes, thoug…

Nebraska LB 525 (the Conversational Artificial Intelligence Safety Act) was signed by Governor Pillen on April 14, 2026,…

Nebraska LB 525 was signed by Governor Pillen on April 14, 2026, enacting the Conversational Artificial Intelligence Saf…

New Hampshire HB 143 (Chapter 270, signed August 1, 2025 by Gov. Ayotte, effective January 1, 2026) — an omnibus act who…

New Hampshire has no comprehensive private-sector AI statute, and the one AI statute it did enact does not reach insurer…

New Jersey regulates AI across four distinct, independently enforceable surfaces. (1) DEEPFAKES: A3540/S2544, signed 202…

New Mexico has no comprehensive cross-sector private-sector AI statute as of June 2026, but it has enacted one AI-specif…

Nevada regulates AI through three separate surfaces. (1) INSURANCE — Division of Insurance Bulletin 24-001, "Use of Arti…

NYC Local Law 144 (Int. 1894-A) requires any employer or employment agency in New York City that uses an automated emplo…

Ohio has NO comprehensive AI statute and NO comprehensive consumer-privacy statute as of 2026-08-25 — both negatives re-…

Oklahoma has no COMPREHENSIVE cross-sector private-sector AI statute as of June 2026, but it has enacted one AI provisio…

Oregon SB 1546, passed in the 2026 short session (Senate 26-1, House 52-0) and signed into law by Governor Tina Kotek, r…

Pennsylvania has NO comprehensive AI statute and NO comprehensive consumer-privacy or biometric-privacy statute as of Au…

Rhode Island has no comprehensive cross-sector private-sector AI statute as of August 2026, but it has enacted FIVE AI/s…

Rhode Island has no comprehensive private-sector AI statute (the "Artificial Intelligence Act", S 0627 of 2025, died in …

South Carolina has no COMPREHENSIVE cross-sector private-sector AI statute as of June 2026, but it has enacted TWO AI pr…

South Dakota Senate Bill 41, signed March 18, 2026, takes effect July 1, 2026. The law amends SDCL § 22-21-4 to add a NE…

Tennessee's ELVIS Act (HB 2091/SB 2096, Public Chapter 588, signed March 21, 2024, effective July 1, 2024) was the first…

The Preventing Deepfake Images Act (SB 1346/HB 1299, 2025 Tenn. Pub. Ch. 466; passed April 21, 2025, approved May 9, 202…

The Transparency for Deepfakes in Political Advertising Act (HB 1513/SB 1624, 2026 Tenn. Pub. Ch. 625; passed March 12, …

Tennessee SB 1580, enacted as Public Chapter No. 647 (passed March 16, 2026; approved by Governor Bill Lee April 1, 2026…

Texas HB 149 (TRAIGA), signed June 22, 2025 and codified as Tex. Bus. & Com. Code Title 11, Subtitle D (ch. 551–552, wit…

Texas SB 441 (signed June 20, 2025, effective September 1, 2025) makes knowingly producing or distributing nonconsensual…

Utah was the first US state to pass AI-focused consumer protection legislation. The AI Policy Act (SB 149, effective May…

Utah SB 319 (Health Insurance Preauthorization Amendments, 2026 General Session; Chief Sponsor Sen. John D. Johnson, Hou…

Utah HB 276 ("Artificial Intelligence Modifications") was signed by Governor Cox on March 24, 2026, and — per the enroll…

Utah SB 256 ("Identity Protection Modifications"), signed March 26, 2026 and effective May 6, 2026, expressly extends Ut…

Virginia's Consumer Data Protection Act (Va. Code § 59.1-575 et seq.), effective January 1, 2023, includes automated dec…

Vermont's S.23 (Act 75), "An act relating to the use of synthetic media in elections," was signed by Governor Phil Scott…

Vermont has no comprehensive private-sector AI statute reaching insurers, and its AI bulletin is among the EARLIEST adop…

Washington HB 2225, signed by Governor Ferguson on March 24, 2026, regulates AI companion chatbots — AI systems with nat…

Washington HB 1170, signed by Governor Bob Ferguson on March 24, 2026, requires "covered providers" — entities whose gen…

Washington SB 5395 (signed by Governor Ferguson, effective June 11, 2026) prohibits health insurance carriers and Washin…

Wisconsin has no COMPREHENSIVE cross-sector private-sector AI statute as of June 2026, but it has enacted THREE targeted…

West Virginia has NO comprehensive AI statute, NO consumer-privacy statute and NO biometric-privacy statute as of August…

Wyoming has no comprehensive cross-sector private-sector AI statute as of August 2026, but it has enacted its first AI-s…

Vietnam's Law on Artificial Intelligence was passed by the National Assembly on December 10, 2025 and took effect March …

South Africa's Protection of Personal Information Act (POPIA, Act No. 4 of 2013) became fully effective and enforceable …