Home / Regulation Tracker
Regulation Tracker
Every law, executive order, treaty and regulator rule that shapes AI security, read for what it requires of security teams: named attack classes, incident reporting clocks, weight protection, provenance and audit duties, with current status and key dates.
| Record | Jurisdiction | Type | Status | Date |
|---|---|---|---|---|
| New York Stop Addictive Feeds Exploitation (SAFE) for Kids Act and implementing rulesNew York's law restricting algorithmic feeds for minors takes effect on 25 January 2027 under final rules published in July 2026, with certified… | United States, New York | State law | Signed, not yet in force | 2027-01-25 |
| Regulation (EU) 2023/1230 on machinery — safety of AI-driven and self-evolving machineryFrom January 2027 machinery whose safety depends on AI or that evolves after deployment requires third-party conformity assessment and decision… | European Union | National or regional law | Signed, not yet in force | 2027-01-20 |
| Colorado Automated Decision-Making Technology ActColorado repealed its 2024 AI Act before it ever applied and replaced it with a narrower automated decision-making statute that takes effect on 1… | United States, Colorado | State law | Signed, not yet in force | 2027-01-01 |
| Colorado SB 26-189 — Consumer protections for automated decision-making technologyWhat became of the first US comprehensive AI law: after two delays and a federal enforcement pause, Colorado repealed SB 24-205 and replaced it in… | United States, Colorado | State law | Signed, not yet in force | 2027-01-01 |
| Illinois SB 315 — Artificial Intelligence Safety Measures ActSigned by Governor Pritzker on 6 July 2026 after passing 110–0 in the House. The third state frontier-model safety law after California and New… | United States, Illinois | State law | Signed, not yet in force | 2027-01-01 |
| New York RAISE ActNew York's frontier model law, signed in December 2025 and reshaped by a March 2026 chapter amendment to align with California, requires large… | United States, New York | State law | Signed, not yet in force | 2027-01-01 |
| New York Responsible AI Safety and Education Act (RAISE Act), S6953-B/A6453-B as amendedNew York's frontier-model safety law, signed in December 2025 and amended in March 2026 to track California's SB 53: large frontier developers… | United States, New York | State law | Signed, not yet in force | 2027-01-01 |
| Chile Ley 21.719 que regula la protección y el tratamiento de los datos personalesChile's GDPR-style privacy law takes effect on 1 December 2026 with a right against solely automated decisions and a new data agency that will… | Chile | National or regional law | Signed, not yet in force | 2026-12-01 |
| California AI Transparency ActRequires large generative AI providers to embed latent provenance disclosures in synthetic content and offer a free public detection tool, with… | United States, California | State law | In force | 2026-08-02 |
| California SB 942 — California AI Transparency Act (as amended by AB 853)Requires large generative AI providers to embed provenance disclosures and offer detection tools, with platform and camera-maker duties phasing in… | United States, California | State law | In force, applied in stages | 2026-08-02 |
| Germany KI-Marktüberwachungs- und Innovationsförderungsgesetz (KI-MIG) — AI Act implementing lawGermany's implementing law for the EU AI Act, in force from 29 July 2026. Names the Bundesnetzagentur as the central market-surveillance authority… | Germany | National or regional law | In force | 2026-07-29 |
| EU Digital Omnibus on AIThe 2026 amendment that moved the high-risk deadlines to December 2027 and August 2028, added two prohibitions, expanded AI Office supervision and… | European Union | National or regional law | In force | 2026-07-27 |
| Regulation (EU) 2026/1744 amending the AI Act (Digital Omnibus on AI)The first amendment to the AI Act. Defers high-risk obligations to December 2027 (Annex III) and August 2028 (Annex I), leaves Article 50… | European Union | National or regional law | In force | 2026-07-27 |
| China Interim Measures for the Management of Anthropomorphic AI Interactive Services (人工智能拟人化互动服务管理暂行办法)Adopted 10 April 2026 and in force from 15 July 2026, the measures regulate services that simulate human personality, thinking and communication… | China | Administrative measures or rules | In force | 2026-07-15 |
| US Executive Order 14409 on Promoting Advanced AI Innovation and SecurityThe first US federal instrument aimed at frontier models with advanced cyber capabilities: a classified benchmarking process, voluntary 30-day… | United States | Executive order | In force | 2026-06-02 |
| US Executive Order 14409 — Promoting Advanced Artificial Intelligence Innovation and SecuritySigned 2 June 2026 and published in the Federal Register on 5 June 2026 (91 FR 34565). Directs agencies to harden federal systems against… | United States | Executive order | In force | 2026-06-02 |
| Proyecto de Ley Orgánica para el buen uso y la gobernanza de la inteligencia artificialSpain's implementing law for the AI Act, in draft since March 2025, which would empower AESIA (the first dedicated AI regulator in the EU) and… | Spain | Bill or draft legislation | In legislative process | 2026-05-26 |
| UK Cyber Security and Resilience (Network and Information Systems) BillThe UK's NIS2-equivalent reform, still before the House of Lords in September 2026 with Royal Assent expected late in the year, extends cyber… | United Kingdom | Bill or draft legislation | In legislative process | 2026-05-13 |
| Brazil Lei 15.211/2025 — Estatuto da Criança e do Adolescente Digital (ECA Digital)Brazil's children's digital statute, in force from March 2026, bans profiling and targeted advertising to minors and mandates age verification and… | Brazil | National or regional law | In force | 2026-03-17 |
| Luật Trí tuệ nhân tạo — Law No. 134/2025/QH15 on Artificial Intelligence (Vietnam)Southeast Asia's first comprehensive AI law, in force since 1 March 2026: EU-style risk tiers, prohibited practices, labelling of synthetic media,… | Vietnam | National or regional law | In force, applied in stages | 2026-03-01 |
| India IT Rules Amendment 2026 — synthetically generated information labellingIndia's first binding AI-specific rule: since 20 February 2026, platforms and generative-AI tools must label synthetic content and embed permanent… | India | Delegated or implementing act | In force | 2026-02-20 |
| South Korea Framework Act on the Development of AI and Establishment of TrustThe second comprehensive national AI law after the EU's, effective 22 January 2026, with duties for high-impact AI, generative AI labelling and… | South Korea | National or regional law | In force | 2026-01-22 |
| South Korea Basic Act on the Development of AI and Establishment of Trust (Act No. 20676)The second comprehensive national AI law after the EU's, in force since 22 January 2026: transparency duties for generative AI, obligations for… | South Korea | National or regional law | In force | 2026-01-22 |
| Kazakhstan Law No. 230-VIII "On Artificial Intelligence"The first AI law in Central Asia, signed 17 November 2025 and in force from 18 January 2026. Defines AI systems as objects of informatisation,… | Kazakhstan | National or regional law | In force | 2026-01-18 |
| Taiwan Artificial Intelligence Basic Act (人工智慧基本法)Taiwan's first AI statute, passed by the Legislative Yuan on 23 December 2025 and promulgated on 14 January 2026. A principles-based basic act: it… | Taiwan | National or regional law | In force | 2026-01-14 |
| California Generative AI Training Data Transparency ActDevelopers of generative AI systems available to Californians must publish a summary of the datasets used to train them, including sources,… | United States, California | State law | In force | 2026-01-01 |
| California AB 2013 — Generative Artificial Intelligence: Training Data Transparency ActRequires developers of generative AI systems available in California to publish a summary of their training data, including sources, personal data… | United States, California | State law | In force | 2026-01-01 |
| California CPPA regulations on automated decisionmaking technology and risk assessmentsCalifornia's privacy regulator sets the state's automated decision-making regime: pre-use notices, opt-outs and access rights for significant… | United States, California | Regulator rules or guidance | In force, applied in stages | 2026-01-01 |
| California SB 243 — Companion chatbotsThe first law on AI companions: operators must disclose the AI nature of the chatbot, run suicide-prevention protocols, add safeguards for minors… | United States, California | State law | In force | 2026-01-01 |
| California Transparency in Frontier Artificial Intelligence ActThe first US law to require frontier developers to publish safety frameworks and to report critical safety incidents, including model weight theft… | United States, California | State law | In force | 2026-01-01 |
| California SB 53 — Transparency in Frontier Artificial Intelligence ActThe first US frontier-model law in force: developers of models trained above 10^26 FLOP with more than $500 million revenue must publish safety… | United States, California | State law | In force | 2026-01-01 |
| California CCPA Regulations on Automated Decision-Making Technology, Risk Assessments and Cybersecurity AuditsThe CPPA's 2025 regulations add three security-relevant regimes to the CCPA: ADMT rights, mandatory risk assessments for high-risk processing, and… | United States, California | Regulator rules or guidance | In force, applied in stages | 2026-01-01 |
| China Cybersecurity Law as amended in 2025 — artificial intelligence provisionsThe 2025 amendment to China's Cybersecurity Law added the first statutory provision on AI governance and sharply increased penalties for network… | China | National or regional law | Amended | 2026-01-01 |
| Illinois Human Rights Act AI AmendmentMakes it a civil rights violation for employers to use AI that has a discriminatory effect in employment decisions, requires notice to workers,… | United States, Illinois | State law | In force | 2026-01-01 |
| Illinois HB 3773 (Public Act 103-0804) — AI in employment decisionsMakes discriminatory use of AI in employment decisions a civil rights violation in Illinois and requires notice to workers when AI is used,… | United States, Illinois | State law | In force | 2026-01-01 |
| Ontario Working for Workers Four Act, 2024 — AI disclosure in job postingsSince January 2026 Ontario employers with 25 or more staff must disclose in job postings whether AI is used to screen or assess applicants,… | Canada | National or regional law | In force | 2026-01-01 |
| Texas HB 149 — Texas Responsible Artificial Intelligence Governance ActThe broadest US state AI law in force: bans intentional harmful uses (manipulation, discrimination, deepfake abuse), restricts government social… | United States, Texas | State law | In force | 2026-01-01 |
| Texas Responsible Artificial Intelligence Governance ActA conduct-based law that bans specific harmful uses of AI, requires disclosure by government agencies and healthcare providers, and creates a… | United States, Texas | State law | In force | 2026-01-01 |
| Vietnam Law on Personal Data Protection (Law No. 91/2025/QH15)Vietnam's first personal data protection statute, in force since January 2026, sits beside the AI Law and the Data Law; it carries revenue-based… | Vietnam | National or regional law | In force | 2026-01-01 |
| US Executive Order 14365 on a National AI Policy FrameworkThe federal push against state AI regulation: a litigation task force to challenge state laws, a Commerce review of onerous statutes, conditions… | United States | Executive order | In force | 2025-12-11 |
| Executive Order 14365 on Ensuring a National Policy Framework for Artificial IntelligenceThe federal pre-emption push: directs the Justice Department to litigate against burdensome state AI laws, ties broadband funding to state AI… | United States | Executive order | In force | 2025-12-11 |
| Australia Online Safety Amendment (Social Media Minimum Age) Act 2024The world's first national under-16 social media ban, in force since December 2025, forces platforms to deploy age-estimation and assurance… | Australia | National or regional law | In force | 2025-12-10 |
| India Digital Personal Data Protection Act 2023 and DPDP Rules 2025India's data protection regime, now with rules that specify security safeguards, breach notification and a phased 18-month implementation ending… | India | National or regional law | In force, applied in stages | 2025-11-14 |
| India Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025India's first comprehensive privacy law finally has a timetable: rules notified in November 2025 phase in obligations through May 2027. It bars… | India | National or regional law | In force, applied in stages | 2025-11-13 |
| India AI Governance Guidelines (MeitY, November 2025)India's stated approach: no horizontal AI law, but principles applied through existing statutes, an AI Safety Institute, incident reporting and… | India | Policy framework | Voluntary guidance | 2025-11-05 |
| India AI Governance GuidelinesIndia's techno-legal governance framework, released ahead of the 2026 AI Impact Summit, which relies on existing law, a new institutional… | India | Policy framework | Voluntary guidance | 2025-11-05 |
| Getty Images v Stability AI [2025] EWHC — UK judgment on AI training and outputsThe first major AI copyright judgment in the UK: Stability AI's image model was held not to be an infringing copy of Getty's photographs, leaving… | United Kingdom | Court ruling | In force | 2025-11-04 |
| 中华人民共和国反不正当竞争法 (2025年修订) — Anti-Unfair Competition Law as revised in 2025China's 2025 competition-law revision targets algorithmic abuses by platforms, including ranking manipulation and data-driven exclusivity, adding… | China | National or regional law | Amended | 2025-10-15 |