{ "dataset": "policy-index", "title": "AI law and policy instruments", "index": "AI Law and Policy Index", "url": "https://aisafetytracker.org/policy/", "citation": "AI Safety Tracker, \"AI Law and Policy Index\". https://aisafetytracker.org/policy/. Retrieved 23 October 2026.", "licences": [ { "source": "policy-index", "name": "AI Law and Policy Index", "publisher": "This site", "licence": "MIT", "licence_url": "https://opensource.org/licenses/MIT", "attribution": "AI Safety Tracker, \"AI Law and Policy Index\". Licensed MIT." } ], "generated": "2026-10-23T21:53:16+00:00", "retrieved": "2026-10-23T00:00:00+00:00", "unit": null, "notes": "Our own index of instruments relevant to AI across 11 jurisdictions, reviewed 2026-10-23. Each entry links to the primary source and is tagged by how binding it is, because a voluntary standard and an Act of Parliament are not the same kind of object however similar their contents look. Not legal advice, not a compliance checklist, and not exhaustive. Instruments that never mention AI are included where they apply to it, which is most of the list in most jurisdictions.", "count": 86, "records": [ { "jurisdiction": "European Union", "jurisdiction_slug": "european-union", "jurisdiction_code": "EUR", "title": "Regulation (EU) 2024/1689 (Artificial Intelligence Act)", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 2024, "body": "European Parliament and Council", "topics": [ "safety", "transparency", "labelling", "consumer" ], "note": "The first horizontal AI statute to enter into force. Bans a short list of practices, imposes conformity assessment on high-risk uses, sets transparency duties on systems people interact with, and adds obligations for general-purpose models above 1e25 FLOP of training compute. It applies in stages rather than at once, and those stages have since moved.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "European Union", "jurisdiction_slug": "european-union", "jurisdiction_code": "EUR", "title": "Digital Omnibus on AI", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 2026, "body": "European Parliament and Council", "topics": [ "safety", "transparency" ], "note": "Amends the AI Act, in force from July 2026, six days before the high-risk obligations were due to bite. Stand-alone high-risk systems move to December 2027 and systems embedded in regulated products to August 2028. The Article 50 transparency duties were not delayed. Treat any compliance date published before July 2026 as out of date.", "url": "https://digital-strategy.ec.europa.eu/en/policies/digital-omnibus", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "European Union", "jurisdiction_slug": "european-union", "jurisdiction_code": "EUR", "title": "Regulation (EU) 2016/679 (General Data Protection Regulation)", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 2016, "body": "European Parliament and Council", "topics": [ "privacy", "transparency" ], "note": "Predates the AI Act and reaches further in practice. Article 22 restricts decisions based solely on automated processing that produce legal or similarly significant effects, and it is the provision most European automated-decision disputes are actually fought under.", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "European Union", "jurisdiction_slug": "european-union", "jurisdiction_code": "EUR", "title": "Regulation (EU) 2022/2065 (Digital Services Act)", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 2022, "body": "European Parliament and Council", "topics": [ "safety", "transparency", "elections" ], "note": "Systemic-risk assessment and mitigation duties on very large platforms and search engines, explicitly including risks from recommender and generative features. Where a model ships inside a large platform, this usually binds before the AI Act does.", "url": "https://eur-lex.europa.eu/eli/reg/2022/2065/oj", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "European Union", "jurisdiction_slug": "european-union", "jurisdiction_code": "EUR", "title": "Directive (EU) 2024/2853 on liability for defective products", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 2024, "body": "European Parliament and Council", "topics": [ "liability", "consumer", "safety" ], "note": "Brings software and AI systems inside the product liability regime and eases the burden of proof where a claimant could not reasonably be expected to explain how a complex system failed. The separate AI Liability Directive was withdrawn in 2025, so this is what remains.", "url": "https://eur-lex.europa.eu/eli/dir/2024/2853/oj", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "European Union", "jurisdiction_slug": "european-union", "jurisdiction_code": "EUR", "title": "Directive (EU) 2019/790 on copyright in the Digital Single Market", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 2019, "body": "European Parliament and Council", "topics": [ "copyright" ], "note": "Article 4 permits text and data mining of lawfully accessible works unless the rightsholder reserved the right in a machine-readable way. That reservation is the legal basis for most European objections to training on web data.", "url": "https://eur-lex.europa.eu/eli/dir/2019/790/oj", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "European Union", "jurisdiction_slug": "european-union", "jurisdiction_code": "EUR", "title": "European AI Office", "force": "agency-binding", "force_meaning": "Binds government agencies only, not the wider market.", "year": 2024, "body": "European Commission", "topics": [ "safety", "government use" ], "note": "Supervises general-purpose model obligations directly rather than leaving them to national authorities. It is the only body anywhere with statutory supervisory powers aimed specifically at frontier models.", "url": "https://digital-strategy.ec.europa.eu/en/policies/ai-office", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "European Union", "jurisdiction_slug": "european-union", "jurisdiction_code": "EUR", "title": "General-Purpose AI Code of Practice", "force": "voluntary", "force_meaning": "Guidance with no legal force. Compliance is a choice.", "year": 2025, "body": "European Commission and independent experts", "topics": [ "safety", "transparency", "copyright" ], "note": "Voluntary, but signing it is the route to presumed conformity with the AI Act's general-purpose model obligations. A voluntary instrument with that consequence sits between guidance and regulation, which is why it is indexed.", "url": "https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "South Korea", "jurisdiction_slug": "south-korea", "jurisdiction_code": "KOR", "title": "Framework Act on the Development of AI and Establishment of Trust", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 2024, "body": "National Assembly of the Republic of Korea", "topics": [ "safety", "transparency", "labelling" ], "note": "In force from January 2026. Duties on high-impact AI in listed sectors, labelling of generative output, and a domestic representative requirement for large foreign providers. Administrative fines were given a grace period of about a year, so the obligations bind before the penalties do. Cited in the CSET translation, because Korea's own statute database returns no stable English URL.", "url": "https://cset.georgetown.edu/wp-content/uploads/t0625_south_korea_ai_law_EN.pdf", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "South Korea", "jurisdiction_slug": "south-korea", "jurisdiction_code": "KOR", "title": "Enforcement Decree of the AI Basic Act", "force": "delegated", "force_meaning": "Rules, regulations or codes made under an Act. Binding.", "year": 2026, "body": "Ministry of Science and ICT", "topics": [ "safety", "labelling" ], "note": "Approved by the cabinet in January 2026 and in force with the Act. Sets the detail the Act leaves to decree, including the safety duties on systems trained with 1e26 FLOP or more of cumulative compute that also meet two further conditions, and how generated output is to be labelled.", "url": "https://www.korea.kr/news/policyNewsView.do?newsId=148958380", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "South Korea", "jurisdiction_slug": "south-korea", "jurisdiction_code": "KOR", "title": "Personal Information Protection Act", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 2011, "body": "National Assembly of the Republic of Korea", "topics": [ "privacy", "transparency" ], "note": "Includes a right to refuse or seek an explanation of a fully automated decision, added in 2023. Enforced by the Personal Information Protection Commission, which has been among the more active regulators on generative AI.", "url": "https://www.pipc.go.kr/eng/", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "South Korea", "jurisdiction_slug": "south-korea", "jurisdiction_code": "KOR", "title": "Korea AI Safety Institute", "force": "agency-binding", "force_meaning": "Binds government agencies only, not the wider market.", "year": 2024, "body": "Ministry of Science and ICT", "topics": [ "safety" ], "note": "National evaluation capacity, established alongside the framework Act. Korea is one of a small number of jurisdictions with both a horizontal AI statute and a body able to test models against it.", "url": "https://www.aisi.re.kr/", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "China", "jurisdiction_slug": "china", "jurisdiction_code": "CHN", "title": "Interim Measures for the Management of Generative AI Services", "force": "delegated", "force_meaning": "Rules, regulations or codes made under an Act. Binding.", "year": 2023, "body": "Cyberspace Administration of China and six other bodies", "topics": [ "safety", "transparency", "security" ], "note": "The first binding national rules addressed to generative AI anywhere: security assessment and algorithm filing before public launch, content obligations, and duties on training data.", "url": "https://www.chinalawtranslate.com/en/generative-ai-interim/", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "China", "jurisdiction_slug": "china", "jurisdiction_code": "CHN", "title": "Provisions on Deep Synthesis Internet Information Services", "force": "delegated", "force_meaning": "Rules, regulations or codes made under an Act. Binding.", "year": 2022, "body": "Cyberspace Administration of China", "topics": [ "labelling", "transparency", "safety" ], "note": "Required labelling of synthetic media two years before any comparable Western obligation, and requires consent before generating a likeness of a real person.", "url": "https://www.chinalawtranslate.com/en/deep-synthesis/", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "China", "jurisdiction_slug": "china", "jurisdiction_code": "CHN", "title": "Measures for Labelling AI-Generated Synthetic Content", "force": "delegated", "force_meaning": "Rules, regulations or codes made under an Act. Binding.", "year": 2025, "body": "Cyberspace Administration of China and three other bodies", "topics": [ "labelling", "transparency" ], "note": "In force from September 2025, with a mandatory national standard alongside it. Requires both a label the reader can see and one embedded in file metadata, which is a stronger requirement than the EU's Article 50.", "url": "https://www.chinalawtranslate.com/en/ai-labeling/", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "China", "jurisdiction_slug": "china", "jurisdiction_code": "CHN", "title": "Provisions on Algorithmic Recommendation of Internet Information Services", "force": "delegated", "force_meaning": "Rules, regulations or codes made under an Act. Binding.", "year": 2021, "body": "Cyberspace Administration of China", "topics": [ "transparency", "consumer" ], "note": "Created the algorithm filing regime that the later measures build on, and gave users a right to switch recommendation off. The filing register is the closest thing any jurisdiction has to a public inventory of deployed systems.", "url": "https://www.chinalawtranslate.com/en/algorithms/", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "China", "jurisdiction_slug": "china", "jurisdiction_code": "CHN", "title": "Personal Information Protection Law", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 2021, "body": "National People's Congress", "topics": [ "privacy", "transparency" ], "note": "China's general data protection statute, including rules on automated decision-making and a right to an explanation where a decision has a significant effect on an individual.", "url": "https://www.chinalawtranslate.com/en/pipl/", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "China", "jurisdiction_slug": "china", "jurisdiction_code": "CHN", "title": "Data Security Law", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 2021, "body": "National People's Congress", "topics": [ "security", "export control" ], "note": "Classifies data by importance and restricts cross-border transfer of important data, which constrains where training corpora can be assembled and processed.", "url": "https://www.chinalawtranslate.com/en/datasecuritylaw/", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "China", "jurisdiction_slug": "china", "jurisdiction_code": "CHN", "title": "Cybersecurity Law", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 2016, "body": "National People's Congress", "topics": [ "security" ], "note": "The statute the administrative measures are made under. Network operators carry security obligations and a real-name requirement, which is what makes the algorithm filing and security assessment regimes enforceable. An amendment in force from January 2026 added its first article on AI, covering state support for research and infrastructure, ethics rules and AI safety risk monitoring.", "url": "https://www.chinalawtranslate.com/en/cybersecuritylaw/", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "United States", "jurisdiction_slug": "united-states", "jurisdiction_code": "USA", "title": "Executive Order 14179, Removing Barriers to American Leadership in AI", "force": "agency-binding", "force_meaning": "Binds government agencies only, not the wider market.", "year": 2025, "body": "President of the United States", "topics": [ "government use" ], "note": "Revoked Executive Order 14110 and reset federal policy toward removing regulatory barriers. Executive orders bind the executive branch, not the market, and a successor can revoke them in a day, as this one did.", "url": "https://www.federalregister.gov/executive-order/14179", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "United States", "jurisdiction_slug": "united-states", "jurisdiction_code": "USA", "title": "Executive Order 14365, Ensuring a National Policy Framework for AI", "force": "agency-binding", "force_meaning": "Binds government agencies only, not the wider market.", "year": 2025, "body": "President of the United States", "topics": [ "government use" ], "note": "Directs federal agencies to review state AI laws, a Justice Department task force to challenge them in court, and some federal funding to be conditioned on them, pending a federal standard that would preempt state law. It changes no state law by itself, and Congress has passed no preemption statute.", "url": "https://www.federalregister.gov/documents/2025/12/16/2025-23092/ensuring-a-national-policy-framework-for-artificial-intelligence", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "United States", "jurisdiction_slug": "united-states", "jurisdiction_code": "USA", "title": "Executive Order 14110, Safe, Secure, and Trustworthy AI (revoked)", "force": "review", "force_meaning": "An inquiry or review. Evidence and recommendations, not obligations.", "year": 2023, "body": "President of the United States", "topics": [ "safety", "security" ], "note": "Listed because it is still widely cited as current US policy and is not. It introduced the 1e26 FLOP reporting threshold, the second compute threshold written into any official instrument, and was revoked in January 2025.", "url": "https://www.federalregister.gov/executive-order/14110", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "United States", "jurisdiction_slug": "united-states", "jurisdiction_code": "USA", "title": "TAKE IT DOWN Act", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 2025, "body": "US Congress", "topics": [ "safety", "children" ], "note": "Criminalises publication of non-consensual intimate imagery including AI-generated depictions, and requires covered platforms to remove it on notice. One of very few federal statutes that names AI-generated material at all.", "url": "https://www.congress.gov/bill/119th-congress/senate-bill/146", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "United States", "jurisdiction_slug": "united-states", "jurisdiction_code": "USA", "title": "Federal Trade Commission Act, section 5", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 1914, "body": "US Congress", "topics": [ "consumer", "competition" ], "note": "The general prohibition on unfair or deceptive acts and practices. With no AI statute in place it is the main federal hook for AI claims that do not hold up, and the FTC has used it against several AI products.", "url": "https://www.ftc.gov/legal-library/browse/statutes/federal-trade-commission-act", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "United States", "jurisdiction_slug": "united-states", "jurisdiction_code": "USA", "title": "NIST AI Risk Management Framework 1.0", "force": "voluntary", "force_meaning": "Guidance with no legal force. Compliance is a choice.", "year": 2023, "body": "National Institute of Standards and Technology", "topics": [ "safety", "government use" ], "note": "No legal force, and the most widely adopted AI governance document in the United States. State bills and procurement rules incorporate it by reference, which is how a voluntary framework acquires teeth.", "url": "https://www.nist.gov/itl/ai-risk-management-framework", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "United States", "jurisdiction_slug": "united-states", "jurisdiction_code": "USA", "title": "California SB 53, Transparency in Frontier Artificial Intelligence Act", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 2025, "body": "California State Legislature", "topics": [ "safety", "transparency" ], "note": "State law, and the first binding frontier-model transparency statute anywhere: developers above a compute threshold must publish a safety framework and report critical safety incidents. It reaches most frontier labs because most of them are in California.", "url": "https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB53", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "United States", "jurisdiction_slug": "united-states", "jurisdiction_code": "USA", "title": "New York RAISE Act, Responsible AI Safety and Education Act", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 2025, "body": "New York State Legislature", "topics": [ "safety", "transparency" ], "note": "Signed in December 2025 and narrowed by a chapter amendment in March 2026 to track California's SB 53: developers with over $500 million in annual revenue that train models above 1e26 FLOP must publish safety protocols and report safety incidents to the state. Applies from January 2027.", "url": "https://www.nysenate.gov/legislation/bills/2025/S6953/amendment/B", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "United States", "jurisdiction_slug": "united-states", "jurisdiction_code": "USA", "title": "Colorado SB26-189, Automated Decision-Making Technology", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 2026, "body": "Colorado General Assembly", "topics": [ "consumer", "transparency" ], "note": "Repealed and re-enacted the 2024 Colorado AI Act, SB24-205, in May 2026, before its duties applied. The impact assessments and risk-management programme are gone; in their place are disclosure duties and rights of access, correction and human review for automated decisions in consequential matters. Developer duties apply from January 2027.", "url": "https://leg.colorado.gov/bills/sb26-189", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "United States", "jurisdiction_slug": "united-states", "jurisdiction_code": "USA", "title": "Advanced computing and semiconductor export controls", "force": "delegated", "force_meaning": "Rules, regulations or codes made under an Act. Binding.", "year": 2022, "body": "Bureau of Industry and Security, Department of Commerce", "topics": [ "export control", "security" ], "note": "The most materially binding AI rules the United States has, and the least discussed as AI policy. They restrict which accelerators can be sold where, which decides who can train large models at all.", "url": "https://www.bis.doc.gov/index.php/policy-guidance/advanced-computing-and-semiconductor-manufacturing-items", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Japan", "jurisdiction_slug": "japan", "jurisdiction_code": "JPN", "title": "Act on Promotion of Research, Development and Utilization of AI-Related Technologies", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 2025, "body": "National Diet of Japan", "topics": [ "safety", "government use" ], "note": "In full effect from September 2025. It is a promotion statute: it establishes an AI Strategy Headquarters, sets out a basic plan and assigns roles, and creates no prohibitions and no monetary penalties. Japan has an AI Act and does not have AI obligations, and both halves of that matter.", "url": "https://www.japaneselawtranslation.go.jp/en/laws/view/5019", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Japan", "jurisdiction_slug": "japan", "jurisdiction_code": "JPN", "title": "Act on the Protection of Personal Information", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 2003, "body": "National Diet of Japan", "topics": [ "privacy" ], "note": "The binding constraint on AI systems handling personal data in Japan, enforced by the Personal Information Protection Commission. Where the AI Act creates no duties, this one does.", "url": "https://www.ppc.go.jp/en/legal/", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Japan", "jurisdiction_slug": "japan", "jurisdiction_code": "JPN", "title": "Copyright Act, Article 30-4", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 1970, "body": "National Diet of Japan", "topics": [ "copyright" ], "note": "One of the most permissive text and data mining provisions in the world: use of a work for machine learning is generally permitted where it is not for enjoying the expression itself. The Agency for Cultural Affairs has since narrowed how widely it reads that, which is what the linked guidance covers.", "url": "https://www.bunka.go.jp/english/policy/copyright/", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Japan", "jurisdiction_slug": "japan", "jurisdiction_code": "JPN", "title": "AI Guidelines for Business", "force": "voluntary", "force_meaning": "Guidance with no legal force. Compliance is a choice.", "year": 2024, "body": "Ministry of Economy, Trade and Industry, and Ministry of Internal Affairs and Communications", "topics": [ "safety", "transparency" ], "note": "The practical governance expectation on Japanese developers and deployers, covering the whole lifecycle. Voluntary, and in a jurisdiction with a penalty-free AI Act it does most of the work.", "url": "https://www.meti.go.jp/english/press/2024/0419_002.html", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "United Kingdom", "jurisdiction_slug": "united-kingdom", "jurisdiction_code": "GBR", "title": "A pro-innovation approach to AI regulation", "force": "voluntary", "force_meaning": "Guidance with no legal force. Compliance is a choice.", "year": 2023, "body": "Department for Science, Innovation and Technology", "topics": [ "safety", "government use" ], "note": "The white paper setting out the decision not to legislate horizontally, and to have existing regulators apply five cross-sectoral principles inside their own remits instead. Everything else in this list follows from it.", "url": "https://www.gov.uk/government/publications/ai-regulation-a-pro-innovation-approach", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "United Kingdom", "jurisdiction_slug": "united-kingdom", "jurisdiction_code": "GBR", "title": "Data Protection Act 2018", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 2018, "body": "Parliament of the United Kingdom", "topics": [ "privacy", "transparency" ], "note": "With the UK GDPR, the binding constraint on most AI systems processing personal data, including the restriction on solely automated decisions with legal or similarly significant effects.", "url": "https://www.legislation.gov.uk/ukpga/2018/12/contents", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "United Kingdom", "jurisdiction_slug": "united-kingdom", "jurisdiction_code": "GBR", "title": "Data (Use and Access) Act 2025", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 2025, "body": "Parliament of the United Kingdom", "topics": [ "privacy", "transparency" ], "note": "Relaxes the automated-decision rules outside special-category data, moving from a general prohibition toward a safeguards model. The direction of travel is opposite to the EU's, which matters to anyone assuming the two regimes still track each other.", "url": "https://www.legislation.gov.uk/ukpga/2025/18/contents", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "United Kingdom", "jurisdiction_slug": "united-kingdom", "jurisdiction_code": "GBR", "title": "Online Safety Act 2023", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 2023, "body": "Parliament of the United Kingdom", "topics": [ "safety", "children" ], "note": "Duties of care on user-to-user and search services, enforced by Ofcom. Generative AI chatbots that let users share content fall inside scope, which is the main route by which UK law reaches consumer AI products.", "url": "https://www.legislation.gov.uk/ukpga/2023/50/contents", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "United Kingdom", "jurisdiction_slug": "united-kingdom", "jurisdiction_code": "GBR", "title": "Equality Act 2010", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 2010, "body": "Parliament of the United Kingdom", "topics": [ "discrimination" ], "note": "The indirect discrimination provisions apply to automated decisions without naming them. In a jurisdiction with no AI statute, this is what an unfair hiring or credit model is most likely to be challenged under.", "url": "https://www.legislation.gov.uk/ukpga/2010/15/contents", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "United Kingdom", "jurisdiction_slug": "united-kingdom", "jurisdiction_code": "GBR", "title": "AI Security Institute", "force": "agency-binding", "force_meaning": "Binds government agencies only, not the wider market.", "year": 2023, "body": "Department for Science, Innovation and Technology", "topics": [ "safety" ], "note": "State capacity to test frontier models, established before any comparable body elsewhere and renamed from AI Safety Institute in 2025. It cannot compel access: testing happens by agreement with developers.", "url": "https://www.aisi.gov.uk/", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "United Kingdom", "jurisdiction_slug": "united-kingdom", "jurisdiction_code": "GBR", "title": "ICO guidance on AI and data protection", "force": "regulator-guidance", "force_meaning": "How a regulator states it will apply existing law. Creates no obligations of its own.", "year": 2023, "body": "Information Commissioner's Office", "topics": [ "privacy", "transparency" ], "note": "How the data regulator says it will apply existing law to AI. Not law, and the closest thing to an operational compliance standard the UK has.", "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Canada", "jurisdiction_slug": "canada", "jurisdiction_code": "CAN", "title": "Personal Information Protection and Electronic Documents Act", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 2000, "body": "Parliament of Canada", "topics": [ "privacy" ], "note": "The federal private-sector privacy statute, and with provincial equivalents the main binding constraint on commercial AI in Canada. Its reform was bundled into the same bill as the AI statute, so both fell together.", "url": "https://laws-lois.justice.gc.ca/eng/acts/P-8.6/", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Canada", "jurisdiction_slug": "canada", "jurisdiction_code": "CAN", "title": "Directive on Automated Decision-Making", "force": "agency-binding", "force_meaning": "Binds government agencies only, not the wider market.", "year": 2019, "body": "Treasury Board of Canada Secretariat", "topics": [ "government use", "transparency" ], "note": "Requires an Algorithmic Impact Assessment before a federal department deploys an automated decision system, with obligations scaled to the assessed impact level. The first instrument of its kind anywhere and still among the most concrete, and it binds government rather than the market.", "url": "https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Canada", "jurisdiction_slug": "canada", "jurisdiction_code": "CAN", "title": "Bill C-27, Artificial Intelligence and Data Act (died on the order paper)", "force": "review", "force_meaning": "An inquiry or review. Evidence and recommendations, not obligations.", "year": 2022, "body": "Parliament of Canada", "topics": [ "safety", "discrimination" ], "note": "Would have been the second comprehensive national AI statute after the EU's. It died when Parliament was prorogued in January 2025 and has not been reintroduced. Listed because it is still frequently cited as Canadian law.", "url": "https://www.parl.ca/legisinfo/en/bill/44-1/c-27", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Canada", "jurisdiction_slug": "canada", "jurisdiction_code": "CAN", "title": "Voluntary Code of Conduct on Advanced Generative AI Systems", "force": "voluntary", "force_meaning": "Guidance with no legal force. Compliance is a choice.", "year": 2023, "body": "Innovation, Science and Economic Development Canada", "topics": [ "safety", "transparency" ], "note": "Signed by a list of named Canadian developers. With the statute gone this is the operative federal expectation of generative AI developers, and it carries no consequence for ignoring it.", "url": "https://ised-isde.canada.ca/site/ised/en/voluntary-code-conduct-responsible-development-and-management-advanced-generative-ai-systems", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Canada", "jurisdiction_slug": "canada", "jurisdiction_code": "CAN", "title": "Bill C-36, Protecting Privacy and Consumer Data Act", "force": "proposal", "force_meaning": "Proposed, consulted on, or before Parliament. Creates no duties yet.", "year": 2026, "body": "Parliament of Canada", "topics": [ "privacy", "transparency" ], "note": "Tabled in June 2026 to modernise the federal private-sector privacy law. It would require transparency about automated decision-making in significant decisions about individuals, administered by a new Digital Safety and Data Protection Commission. It contains no AI statute of the kind AIDA was.", "url": "https://www.canada.ca/en/innovation-science-economic-development/news/2026/06/government-of-canada-tables-new-legislation-to-protect-childrens-data-strengthen-privacy-and-build-trust-in-the-digital-economy.html", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Brazil", "jurisdiction_slug": "brazil", "jurisdiction_code": "BRA", "title": "Lei 13.709/2018 (Lei Geral de Protecao de Dados)", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 2018, "body": "National Congress of Brazil", "topics": [ "privacy", "transparency" ], "note": "Brazil's data protection statute, closely modelled on the GDPR, including a right to review of decisions taken solely on automated processing. Enforced by the ANPD, which is also the proposed AI supervisor.", "url": "https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Brazil", "jurisdiction_slug": "brazil", "jurisdiction_code": "BRA", "title": "PL 2338/2023 (Marco Legal da Inteligencia Artificial)", "force": "proposal", "force_meaning": "Proposed, consulted on, or before Parliament. Creates no duties yet.", "year": 2023, "body": "National Congress of Brazil", "topics": [ "safety", "discrimination", "copyright" ], "note": "Risk-tiered like the EU AI Act, with additions the EU does not have: rights for affected people, and remuneration for copyright holders whose works are used in training. Passed the Senate in December 2024 and is still before the Chamber of Deputies. It creates no duties yet.", "url": "https://www25.senado.leg.br/web/atividade/materias/-/materia/157233", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Brazil", "jurisdiction_slug": "brazil", "jurisdiction_code": "BRA", "title": "Lei 12.965/2014 (Marco Civil da Internet)", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 2014, "body": "National Congress of Brazil", "topics": [ "safety", "privacy" ], "note": "The internet civil rights framework, including platform liability. A 2025 Supreme Court ruling narrowed its safe harbour, which changes the exposure of any platform hosting AI-generated content in Brazil.", "url": "https://www.planalto.gov.br/ccivil_03/_ato2011-2014/2014/lei/l12965.htm", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Brazil", "jurisdiction_slug": "brazil", "jurisdiction_code": "BRA", "title": "Lei 8.078/1990 (Codigo de Defesa do Consumidor)", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 1990, "body": "National Congress of Brazil", "topics": [ "consumer", "liability" ], "note": "Strict supplier liability for defective products and services. Where an AI product causes harm to a consumer in Brazil, this applies now and does not wait for the AI bill.", "url": "https://www.planalto.gov.br/ccivil_03/leis/l8078compilado.htm", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Australia", "jurisdiction_slug": "australia", "jurisdiction_code": "AUS", "title": "Privacy Act 1988", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 1988, "body": "Parliament of Australia", "topics": [ "privacy", "transparency" ], "note": "The main constraint on AI systems that handle personal information. The Australian Privacy Principles apply to collection, use and disclosure regardless of whether a model is involved, which is why an Australian AI compliance question is usually a privacy question first.", "url": "https://www.legislation.gov.au/C2004A03712/latest/text", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Australia", "jurisdiction_slug": "australia", "jurisdiction_code": "AUS", "title": "Privacy and Other Legislation Amendment Act 2024", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 2024, "body": "Parliament of Australia", "topics": [ "privacy", "transparency" ], "note": "The first tranche of reform from the Privacy Act Review. Creates a statutory tort for serious invasions of privacy, and requires privacy policies to disclose where personal information is used in automated decisions that significantly affect someone. The automated-decision transparency duty is the closest thing Australia has to an AI transparency obligation, and it commences in December 2026.", "url": "https://www.legislation.gov.au/C2024A00125/asmade/text", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Australia", "jurisdiction_slug": "australia", "jurisdiction_code": "AUS", "title": "Online Safety Act 2021", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 2021, "body": "Parliament of Australia", "topics": [ "safety", "children" ], "note": "Gives the eSafety Commissioner removal powers and the ability to register industry codes and make standards. The codes and standards made under it now reach generative AI services, which is how Australia regulates AI-generated harmful material without an AI statute.", "url": "https://www.legislation.gov.au/C2021A00076/latest/text", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Australia", "jurisdiction_slug": "australia", "jurisdiction_code": "AUS", "title": "Criminal Code Amendment (Deepfake Sexual Material) Act 2024", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 2024, "body": "Parliament of Australia", "topics": [ "safety", "children" ], "note": "Criminalises transmitting sexual material depicting an adult without consent, including material that has been generated or altered. One of the few Australian statutes written with generative models in view.", "url": "https://www.legislation.gov.au/C2024A00081/asmade/text", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Australia", "jurisdiction_slug": "australia", "jurisdiction_code": "AUS", "title": "Competition and Consumer Act 2010, Schedule 2 (Australian Consumer Law)", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 2010, "body": "Parliament of Australia", "topics": [ "consumer" ], "note": "Misleading or deceptive conduct and the consumer guarantees apply to claims made about AI products and to products that fail because of them. The ACCC has been explicit that overstating what a model does is ordinary consumer law territory, with no AI-specific provision needed.", "url": "https://www.legislation.gov.au/C2004A00109/latest/text", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Australia", "jurisdiction_slug": "australia", "jurisdiction_code": "AUS", "title": "Copyright Act 1968", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 1968, "body": "Parliament of Australia", "topics": [ "copyright" ], "note": "Australia has fair dealing for specified purposes, not fair use, and no text and data mining exception. Training on copyright material in Australia has a narrower set of defences available than in the United States, which is the central question the Copyright and AI Reference Group was set up to examine.", "url": "https://www.legislation.gov.au/C1968A00063/latest/text", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Australia", "jurisdiction_slug": "australia", "jurisdiction_code": "AUS", "title": "Security of Critical Infrastructure Act 2018", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 2018, "body": "Parliament of Australia", "topics": [ "security" ], "note": "Risk management obligations for responsible entities in eleven critical sectors. Where an AI system is part of a critical infrastructure asset, the hazard categories and the reporting duties apply to it like anything else.", "url": "https://www.legislation.gov.au/C2018A00029/latest/text", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Australia", "jurisdiction_slug": "australia", "jurisdiction_code": "AUS", "title": "Therapeutic Goods Act 1989", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 1989, "body": "Parliament of Australia", "topics": [ "health", "safety" ], "note": "Clinical decision-support and diagnostic software can be a medical device and require TGA inclusion in the Register. This is the one area where an Australian AI developer faces pre-market approval rather than after-the-fact enforcement.", "url": "https://www.legislation.gov.au/C2004A03952/latest/text", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Australia", "jurisdiction_slug": "australia", "jurisdiction_code": "AUS", "title": "Corporations Act 2001", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 2001, "body": "Parliament of Australia", "topics": [ "finance", "government use" ], "note": "Directors' duties of care and diligence, and the obligation on financial services licensees to provide services efficiently, honestly and fairly, both reach board-level decisions about deploying AI. ASIC has said so directly.", "url": "https://www.legislation.gov.au/C2004A00818/latest/text", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Australia", "jurisdiction_slug": "australia", "jurisdiction_code": "AUS", "title": "Digital ID Act 2024", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 2024, "body": "Parliament of Australia", "topics": [ "privacy", "security" ], "note": "Accreditation for digital identity providers, with restrictions on biometric information and on using it for anything beyond verification. Relevant to any face-matching or liveness system operating in the accredited scheme.", "url": "https://www.legislation.gov.au/C2024A00025/asmade/text", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Australia", "jurisdiction_slug": "australia", "jurisdiction_code": "AUS", "title": "Policy for the responsible use of AI in government", "force": "agency-binding", "force_meaning": "Binds government agencies only, not the wider market.", "year": 2024, "body": "Digital Transformation Agency", "topics": [ "government use", "transparency" ], "note": "Mandatory for non-corporate Commonwealth entities from September 2024. Requires an accountable official and a public transparency statement. This is the most concrete binding AI obligation in Australia, and it binds the government rather than the market.", "url": "https://www.digital.gov.au/policy/ai/policy", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Australia", "jurisdiction_slug": "australia", "jurisdiction_code": "AUS", "title": "National framework for the assurance of artificial intelligence in government", "force": "agency-binding", "force_meaning": "Binds government agencies only, not the wider market.", "year": 2024, "body": "Data and Digital Ministers Meeting", "topics": [ "government use" ], "note": "Agreed by Commonwealth, state and territory ministers. Applies the AI Ethics Principles to government use and sets a common assurance approach across jurisdictions, which matters because most public-facing AI in Australia is deployed by states, not the Commonwealth.", "url": "https://www.finance.gov.au/publications/national-framework-assurance-artificial-intelligence-government", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Australia", "jurisdiction_slug": "australia", "jurisdiction_code": "AUS", "title": "Australian AI Safety Institute", "force": "agency-binding", "force_meaning": "Binds government agencies only, not the wider market.", "year": 2025, "body": "Department of Industry, Science and Resources", "topics": [ "safety" ], "note": "Announced in November 2025 and operating from early 2026, with the Australian Signals Directorate as a technical partner. It began testing frontier models in July 2026.", "url": "https://www.industry.gov.au/science-technology-and-innovation/technology/artificial-intelligence/ai-safety-institute", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Australia", "jurisdiction_slug": "australia", "jurisdiction_code": "AUS", "title": "Voluntary AI Safety Standard", "force": "voluntary", "force_meaning": "Guidance with no legal force. Compliance is a choice.", "year": 2024, "body": "Department of Industry, Science and Resources", "topics": [ "safety", "transparency" ], "note": "Ten guardrails covering accountability, risk management, testing, human oversight and disclosure. Written to line up with the mandatory guardrails that were proposed at the same time, so an organisation that adopts it is positioned for legislation that has not arrived.", "url": "https://www.industry.gov.au/publications/voluntary-ai-safety-standard", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Australia", "jurisdiction_slug": "australia", "jurisdiction_code": "AUS", "title": "Australia's AI Ethics Principles", "force": "voluntary", "force_meaning": "Guidance with no legal force. Compliance is a choice.", "year": 2019, "body": "Department of Industry, Science and Resources", "topics": [ "safety", "discrimination" ], "note": "Eight principles, voluntary since 2019. Their practical significance is that later binding government policy adopts them by reference, which gives them force inside the public sector that they do not have outside it.", "url": "https://www.industry.gov.au/publications/australias-artificial-intelligence-ethics-principles", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Australia", "jurisdiction_slug": "australia", "jurisdiction_code": "AUS", "title": "National AI Capability Plan", "force": "voluntary", "force_meaning": "Guidance with no legal force. Compliance is a choice.", "year": 2025, "body": "Department of Industry, Science and Resources", "topics": [ "government use" ], "note": "The economic strategy rather than the regulatory one: skills, compute, adoption and sovereign capability. Included here because it sets the policy frame the regulatory decisions are being made inside.", "url": "https://www.industry.gov.au/publications/national-ai-capability-plan", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Australia", "jurisdiction_slug": "australia", "jurisdiction_code": "AUS", "title": "Proposals paper: introducing mandatory guardrails for AI in high-risk settings", "force": "proposal", "force_meaning": "Proposed, consulted on, or before Parliament. Creates no duties yet.", "year": 2024, "body": "Department of Industry, Science and Resources", "topics": [ "safety", "transparency" ], "note": "Consulted on in late 2024. Proposed a risk-based regime with ten mandatory guardrails and canvassed three options for giving them effect: a new AI act, framework legislation, or amendments to existing law. The December 2025 National AI Plan set it aside in favour of existing law. In July 2026 the government announced it would legislate Australian Standards for AI instead, with legislation expected in 2027. Nothing has been legislated, which is the single most important fact in this index.", "url": "https://consult.industry.gov.au/ai-mandatory-guardrails", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Australia", "jurisdiction_slug": "australia", "jurisdiction_code": "AUS", "title": "Getting it right: Building AI infrastructure that works for Australia", "force": "proposal", "force_meaning": "Proposed, consulted on, or before Parliament. Creates no duties yet.", "year": 2026, "body": "Office of AI, Department of the Prime Minister and Cabinet", "topics": [ "safety" ], "note": "Consultation paper of September 2026 on the proposed Australian AI standards: mandatory minimum requirements for large data centres, covering energy, water and community engagement, and conditions for frontier AI training in Australia. Submissions closed in October 2026. No bill has been introduced.", "url": "https://www.pmc.gov.au/resources/getting-it-right-building-ai-infrastructure-works-australia", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Australia", "jurisdiction_slug": "australia", "jurisdiction_code": "AUS", "title": "Guidance on privacy and the use of commercially available AI products", "force": "regulator-guidance", "force_meaning": "How a regulator states it will apply existing law. Creates no obligations of its own.", "year": 2024, "body": "Office of the Australian Information Commissioner", "topics": [ "privacy" ], "note": "What the Australian Privacy Principles require of an organisation buying in a model rather than building one. Includes the OAIC's position that entering personal information into a public generative AI tool is a disclosure.", "url": "https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Australia", "jurisdiction_slug": "australia", "jurisdiction_code": "AUS", "title": "Guidance on privacy and developing and training generative AI models", "force": "regulator-guidance", "force_meaning": "How a regulator states it will apply existing law. Creates no obligations of its own.", "year": 2024, "body": "Office of the Australian Information Commissioner", "topics": [ "privacy", "copyright" ], "note": "The regulator's view on scraping and on training with personal information, including that publicly available does not mean freely usable under the Privacy Act. Directly relevant to anyone training on Australian web data.", "url": "https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-developing-and-training-generative-ai-models", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Australia", "jurisdiction_slug": "australia", "jurisdiction_code": "AUS", "title": "REP 798 Beware the gap: governance arrangements in the face of AI innovation", "force": "regulator-guidance", "force_meaning": "How a regulator states it will apply existing law. Creates no obligations of its own.", "year": 2024, "body": "Australian Securities and Investments Commission", "topics": [ "finance", "consumer" ], "note": "A review of AI use across 23 licensees which found governance lagging deployment. ASIC's position is that existing obligations already bite and that boards cannot wait for AI-specific law.", "url": "https://asic.gov.au/regulatory-resources/find-a-document/reports/rep-798-beware-the-gap-governance-arrangements-in-the-face-of-ai-innovation/", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Australia", "jurisdiction_slug": "australia", "jurisdiction_code": "AUS", "title": "Prudential Standard CPS 230 Operational Risk Management", "force": "delegated", "force_meaning": "Rules, regulations or codes made under an Act. Binding.", "year": 2023, "body": "Australian Prudential Regulation Authority", "topics": [ "finance", "security" ], "note": "Binding on APRA-regulated entities from July 2025. Requires identification of critical operations and management of material service provider risk, which captures dependence on a third-party model provider.", "url": "https://www.apra.gov.au/sites/default/files/2023-07/Prudential%20Standard%20CPS%20230%20Operational%20Risk%20Management%20-%20clean.pdf", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Australia", "jurisdiction_slug": "australia", "jurisdiction_code": "AUS", "title": "Copyright and Artificial Intelligence Reference Group", "force": "review", "force_meaning": "An inquiry or review. Evidence and recommendations, not obligations.", "year": 2023, "body": "Attorney-General's Department", "topics": [ "copyright" ], "note": "The standing forum on whether Australian copyright law needs changing for AI training and AI output. No statutory change has followed, so the Copyright Act as it stands remains the answer.", "url": "https://www.ag.gov.au/rights-and-protections/copyright/copyright-and-artificial-intelligence-reference-group", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Australia", "jurisdiction_slug": "australia", "jurisdiction_code": "AUS", "title": "Select Committee on Adopting Artificial Intelligence, final report", "force": "review", "force_meaning": "An inquiry or review. Evidence and recommendations, not obligations.", "year": 2024, "body": "Senate of Australia", "topics": [ "safety", "consumer", "discrimination" ], "note": "Recommended that general-purpose models be declared high-risk and that Australia legislate a dedicated AI act. The government has not adopted the recommendation, and the gap between this report and the statute book is worth understanding before reading Australian AI coverage.", "url": "https://www.aph.gov.au/Parliamentary_Business/Committees/Senate/Adopting_Artificial_Intelligence_AI/AdoptingAI/Report", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Australia", "jurisdiction_slug": "australia", "jurisdiction_code": "AUS", "title": "Royal Commission into the Robodebt Scheme, final report", "force": "review", "force_meaning": "An inquiry or review. Evidence and recommendations, not obligations.", "year": 2023, "body": "Commonwealth of Australia", "topics": [ "government use", "transparency" ], "note": "Not an AI inquiry, and the most important document here for understanding Australian automated decision-making. An automated income-averaging scheme unlawfully raised debts against hundreds of thousands of people. Its recommendations on transparency and on a legislative basis for automated decisions are the reason government AI policy here is as cautious as it is.", "url": "https://robodebt.royalcommission.gov.au/publications/report", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Australia", "jurisdiction_slug": "australia", "jurisdiction_code": "AUS", "title": "Privacy Act Review Report", "force": "review", "force_meaning": "An inquiry or review. Evidence and recommendations, not obligations.", "year": 2023, "body": "Attorney-General's Department", "topics": [ "privacy", "transparency" ], "note": "116 proposals, agreed or agreed in principle by the government in 2023. The 2024 amendment act delivered the first tranche; the proposals on automated decisions, a fair and reasonable test, and small business exemptions are still outstanding and would change the AI picture substantially.", "url": "https://www.ag.gov.au/rights-and-protections/publications/privacy-act-review-report", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Australia", "jurisdiction_slug": "australia", "jurisdiction_code": "AUS", "title": "Royal Commission into Artificial Intelligence", "force": "review", "force_meaning": "An inquiry or review. Evidence and recommendations, not obligations.", "year": 2026, "body": "Government of South Australia", "topics": [ "safety" ], "note": "Began in October 2026 and reports by 1 July 2027. Its terms of reference cover AI's effect on productivity and growth in South Australia, the policy, legislative and regulatory frameworks needed for safe adoption, and protection of people from its risks.", "url": "https://www.royalcommissionai.sa.gov.au/", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Australia", "jurisdiction_slug": "australia", "jurisdiction_code": "AUS", "title": "NSW Artificial Intelligence Assessment Framework", "force": "agency-binding", "force_meaning": "Binds government agencies only, not the wider market.", "year": 2024, "body": "Digital NSW", "topics": [ "government use" ], "note": "Mandatory for NSW government AI projects and the most developed state-level instrument. Most public-facing government AI in Australia is deployed by states, so Commonwealth policy alone does not describe what citizens meet.", "url": "https://www.digital.nsw.gov.au/policy/artificial-intelligence/nsw-artificial-intelligence-assessment-framework", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "India", "jurisdiction_slug": "india", "jurisdiction_code": "IND", "title": "Digital Personal Data Protection Act 2023", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 2023, "body": "Parliament of India", "topics": [ "privacy" ], "note": "India's first comprehensive data protection statute. Consent-centred, with narrow exemptions and no explicit automated-decision right. Its rules were notified in stages, so the date it binds a given duty is not the date it passed.", "url": "https://www.meity.gov.in/data-protection-framework", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "India", "jurisdiction_slug": "india", "jurisdiction_code": "IND", "title": "Information Technology Act 2000", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 2000, "body": "Parliament of India", "topics": [ "safety", "security" ], "note": "The statute everything else is made under, including the intermediary rules. Section 79 safe harbour is the lever the government uses on platforms, and by extension on the generative features inside them.", "url": "https://www.indiacode.nic.in/handle/123456789/1999", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "India", "jurisdiction_slug": "india", "jurisdiction_code": "IND", "title": "Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021", "force": "delegated", "force_meaning": "Rules, regulations or codes made under an Act. Binding.", "year": 2021, "body": "Ministry of Electronics and Information Technology", "topics": [ "safety", "labelling", "elections" ], "note": "Due diligence duties on intermediaries. An amendment in force from 20 February 2026 reaches synthetically generated audio and video: platforms must label it, embed provenance metadata, and remove flagged unlawful content within three hours. This, not an AI statute, is how India regulates deepfakes.", "url": "https://www.meity.gov.in/content/information-technology-intermediary-guidelines-and-digital-media-ethics-code-rules-2021", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "India", "jurisdiction_slug": "india", "jurisdiction_code": "IND", "title": "India AI Governance Guidelines", "force": "voluntary", "force_meaning": "Guidance with no legal force. Compliance is a choice.", "year": 2025, "body": "Ministry of Electronics and Information Technology", "topics": [ "safety", "transparency" ], "note": "The national framing: govern AI through existing law and institutions rather than a new statute, with voluntary commitments and a techno-legal approach. India's position is closer to the UK's than to the EU's.", "url": "https://indiaai.gov.in/", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Singapore", "jurisdiction_slug": "singapore", "jurisdiction_code": "SGP", "title": "Model AI Governance Framework for Generative AI", "force": "voluntary", "force_meaning": "Guidance with no legal force. Compliance is a choice.", "year": 2024, "body": "Infocomm Media Development Authority and AI Verify Foundation", "topics": [ "safety", "transparency" ], "note": "Nine dimensions from accountability and data to incident reporting and security. Voluntary, and widely used as a template outside Singapore, which gives it influence well beyond its legal force.", "url": "https://aiverifyfoundation.sg/resources/mgf-gen-ai/", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Singapore", "jurisdiction_slug": "singapore", "jurisdiction_code": "SGP", "title": "Model AI Governance Framework for Agentic AI", "force": "voluntary", "force_meaning": "Guidance with no legal force. Compliance is a choice.", "year": 2026, "body": "Infocomm Media Development Authority", "topics": [ "safety", "transparency" ], "note": "Guidance for organisations deploying AI agents, built on the 2020 framework: bounding risk before deployment, human approval checkpoints, technical controls across the agent's lifecycle, and transparency to end users. Voluntary.", "url": "https://www.mddi.gov.sg/newsroom/singapore-launches-new-model-ai-governance-framework-for-agentic-ai--/", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Singapore", "jurisdiction_slug": "singapore", "jurisdiction_code": "SGP", "title": "Personal Data Protection Act 2012", "force": "statute", "force_meaning": "Act of Parliament. Binding on everyone it applies to.", "year": 2012, "body": "Parliament of Singapore", "topics": [ "privacy" ], "note": "The binding instrument. Singapore's AI governance work is voluntary; its data protection law is not, and that is where enforcement actually happens.", "url": "https://sso.agc.gov.sg/Act/PDPA2012", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Singapore", "jurisdiction_slug": "singapore", "jurisdiction_code": "SGP", "title": "Advisory Guidelines on Use of Personal Data in AI Systems", "force": "regulator-guidance", "force_meaning": "How a regulator states it will apply existing law. Creates no obligations of its own.", "year": 2024, "body": "Personal Data Protection Commission", "topics": [ "privacy", "transparency" ], "note": "How the regulator reads consent, legitimate interests and business improvement exceptions when personal data is used to train or run a model. The operative compliance document for anyone deploying AI in Singapore. Linked to the guidelines index rather than the document, because the PDPC moves its own document URLs and the deep link 404s.", "url": "https://www.pdpc.gov.sg/guidelines-and-consultation", "reviewed": "2026-10-23", "source_id": "policy-index" }, { "jurisdiction": "Singapore", "jurisdiction_slug": "singapore", "jurisdiction_code": "SGP", "title": "AI Verify", "force": "voluntary", "force_meaning": "Guidance with no legal force. Compliance is a choice.", "year": 2022, "body": "AI Verify Foundation", "topics": [ "safety", "transparency" ], "note": "A testing toolkit rather than a document: it runs technical tests and produces a report against the governance principles. Few jurisdictions have turned AI principles into something executable, and this is the clearest attempt.", "url": "https://aiverifyfoundation.sg/", "reviewed": "2026-10-23", "source_id": "policy-index" } ] }