Governance Readiness Index
Our own coding, from primary instruments. It measures how much governance machinery a jurisdiction has built, not how strict that machinery is, not how well it is enforced, and not whether the rules are any good.
The rubric
Five dimensions, 10 points. A score is the points a jurisdiction holds.
| Dimension | Max | What each level means |
|---|---|---|
| Binding law | 3 |
|
| Oversight body | 2 |
|
| Evaluation capacity | 2 |
|
| Transparency duty | 2 |
|
| Strategy | 1 |
|
What it does not mean
- It is not a ranking of good governance. Presence of machinery is not quality of machinery. The United Kingdom scores below jurisdictions with far less capacity because it has deliberately chosen not to legislate horizontally, which is a position rather than a failure.
- Ties are real. South Korea and the EU both score 10 out of 10 while imposing very different burdens. Both have the apparatus; the index does not weigh what they do with it.
- It goes stale. Scores are a reading of public instruments at 2026-10-23. Commencement dates move and institutes open.
- Reasonable people would code it differently. Whether China's stack of binding administrative measures counts as horizontal, or whether Japan's penalty-free AI act counts as applicable, are judgement calls. They are recorded in each jurisdiction's note so the disagreement has something to bite on.
- It is not legal advice. See the terms.
How the EU is handled
The AI Act is a regulation, so it applies directly in all 27 member states rather than needing transposition. The EU is therefore coded once at bloc level and that score is applied to each member state, marked as EU-harmonised. National measures on top of it, most visibly which authority each member state has actually designated, are not separately scored.
Read a member state's number as the floor its membership guarantees, not as a complete account of that country's own position. 27 of the 58 jurisdictions here are scored this way.
Why we coded it ourselves
OECD.AI and the IAPP both publish policy trackers, and both are protected by the EU sui generis database right on top of copyright. Bulk-extracting either would be a licence we do not have. Reading primary instruments and coding them ourselves avoids the question entirely and means the result is ours to license MIT.
Every jurisdiction lists the instruments it was coded from, and a build check probes each of those links. A citation that returns a 404 looks like evidence and is not.
Every score, and what it was coded from
Nationally coded jurisdictions. The 27 EU member states share the bloc score and are listed on the map page.
-
South Korea
10- Binding law 3/3
- Oversight body 2/2
- Evaluation capacity 2/2
- Transparency duty 2/2
- Strategy 1/1
The AI Framework Act, passed in January 2025 and in force from January 2026, makes Korea the second jurisdiction after the EU with a horizontal AI statute actually applying. It carries notification duties for generative output and high-impact systems, enforced by the Ministry of Science and ICT. The Korea AI Safety Institute opened in November 2024. Scoring level with the EU means the machinery exists, not that the obligations are equally demanding.
-
China
9- Binding law 3/3
- Oversight body 2/2
- Evaluation capacity 1/2
- Transparency duty 2/2
- Strategy 1/1
Scores as horizontal because the binding rules, taken together, reach AI services generally, even though they are a stack of administrative measures rather than one omnibus act: algorithmic recommendation, deep synthesis, generative AI services, and from September 2025 mandatory labelling of AI-generated content. The Cyberspace Administration of China registers algorithms and enforces. Article 24 of PIPL gives automated-decision rights.
-
Japan
7- Binding law 2/3
- Oversight body 1/2
- Evaluation capacity 2/2
- Transparency duty 1/2
- Strategy 1/1
The AI Promotion Act of May 2025 is horizontal in scope but carries no penalties and imposes cooperation duties rather than compliance duties, so it scores below an applicable binding regime. The AI Strategy Headquarters coordinates across government. Japan's AI Safety Institute has been running evaluations since February 2024.
-
Vietnam
7- Binding law 3/3
- Oversight body 1/2
- Evaluation capacity 0/2
- Transparency duty 2/2
- Strategy 1/1
The Law on Artificial Intelligence, No. 134/2025/QH15, passed in December 2025 and in force from March 2026, is Vietnam's first standalone AI statute and replaces the AI chapter of the Law on Digital Technology Industry. Systems already on the market have grace periods into 2027, and it is scored 3 on the same basis as the EU AI Act, whose obligations also phase in. Worth noting against Australia: Vietnam has a binding AI labelling duty and Australia does not.
-
Australia
6- Binding law 1/3
- Oversight body 1/2
- Evaluation capacity 2/2
- Transparency duty 1/2
- Strategy 1/1
No horizontal AI statute and no AI regulator. The mandatory guardrails for high-risk AI proposed in September 2024 were set aside by the December 2025 National AI Plan in favour of existing law; in July 2026 the government announced it would legislate Australian Standards for AI instead, with legislation expected in 2027, and opened an Office of AI in the Department of the Prime Minister and Cabinet. Until then binding duties on AI use exist inside government through the DTA policy, and in privacy, consumer, online safety and financial services law. The Australian AI Safety Institute began operating in 2026 and started testing frontier models in July.
-
India
6- Binding law 1/3
- Oversight body 1/2
- Evaluation capacity 1/2
- Transparency duty 2/2
- Strategy 1/1
No AI statute. MeitY governs largely by advisory, which is persuasive rather than binding. The exception is synthetic media: an amendment to the IT Rules in force from February 2026 requires platforms to label AI-generated audio and video and embed provenance metadata. The Digital Personal Data Protection Act 2023 is passed and its rules are phasing in. An India AI Safety Institute was announced in January 2025.
-
Singapore
6- Binding law 1/3
- Oversight body 1/2
- Evaluation capacity 2/2
- Transparency duty 1/2
- Strategy 1/1
Governs AI through frameworks and testing rather than statute. AI Verify gives Singapore genuine evaluation capacity, and the Digital Trust Centre was designated its AI safety institute in 2024. Binding duties arrive through the PDPA and sector regulators, not through AI law.
-
United Kingdom
6- Binding law 1/3
- Oversight body 1/2
- Evaluation capacity 2/2
- Transparency duty 1/2
- Strategy 1/1
Deliberately has no horizontal AI statute. The 2023 white paper puts five principles into the hands of existing regulators, so binding duties arrive through sector law rather than AI law. The AI Security Institute, renamed from the AI Safety Institute in February 2025, is among the best resourced evaluation bodies anywhere. Automated-decision rights run through UK GDPR.
-
United States
6- Binding law 1/3
- Oversight body 1/2
- Evaluation capacity 2/2
- Transparency duty 1/2
- Strategy 1/1
No federal horizontal AI statute. Executive Order 14110 was rescinded in January 2025 and replaced by Executive Order 14179, which directs policy without creating duties on developers; Executive Order 14365 of December 2025 directs federal challenges to state AI laws. Binding obligations sit in sectoral rules and in state law: Colorado's SB 26-189 on automated decisions, which replaced its 2024 AI Act in May 2026, and frontier-model statutes in California, SB 53, in force from January 2026, and New York, the RAISE Act, from January 2027. The Center for AI Standards and Innovation at NIST, formerly the US AI Safety Institute, runs model evaluations.
- Executive Order 14179 2025
- Executive Order 14365 2025
- NIST AI Risk Management Framework 2023
- Colorado SB 26-189 2026
- California SB 53 2025
- New York RAISE Act (S6953-B) 2025
-
Canada
5- Binding law 1/3
- Oversight body 1/2
- Evaluation capacity 1/2
- Transparency duty 1/2
- Strategy 1/1
The Artificial Intelligence and Data Act died on the order paper when Parliament was prorogued in January 2025, so Canada has no horizontal AI statute. The Directive on Automated Decision-Making binds federal institutions but not the wider market. The Canadian AI Safety Institute was announced in November 2024.
-
Russia
5- Binding law 2/3
- Oversight body 1/2
- Evaluation capacity 0/2
- Transparency duty 1/2
- Strategy 1/1
Federal Law 243-FZ of July 2026 is Russia's first AI statute. It governs large foundation models, those above a billion parameters, and sets requirements for models granted sovereign or national status; its general provisions apply from September 2026 and its duties, including AI content labelling, from March 2027. Federal Law 258-FZ creates experimental legal regimes bounded to specific pilots. The AI Code of Ethics is voluntary and industry-signed. National AI Development Strategy to 2030 updated in 2024.
-
Brazil
4- Binding law 1/3
- Oversight body 1/2
- Evaluation capacity 0/2
- Transparency duty 1/2
- Strategy 1/1
PL 2338/2023, the closest thing to a Brazilian AI Act, passed the Senate in December 2024 and has not completed passage, so it creates no duties yet. Article 20 of the LGPD gives a right to review of automated decisions, supervised by the ANPD, which the bill would also make the AI coordinator.
-
Norway
4- Binding law 1/3
- Oversight body 1/2
- Evaluation capacity 0/2
- Transparency duty 1/2
- Strategy 1/1
In the EEA but not the EU, so the AI Act does not apply automatically and must be incorporated into the EEA Agreement first. Until that completes, Norway's binding position is GDPR plus sector law, with Datatilsynet running a regulatory sandbox for AI.
-
Switzerland
4- Binding law 1/3
- Oversight body 1/2
- Evaluation capacity 0/2
- Transparency duty 1/2
- Strategy 1/1
The Federal Council decided in February 2025 to ratify the Council of Europe AI Convention and to regulate sectorally rather than horizontally, so binding AI duties will arrive through existing sector law. The revised Federal Act on Data Protection carries the automated-decision route.
-
Thailand
4- Binding law 0/3
- Oversight body 1/2
- Evaluation capacity 1/2
- Transparency duty 1/2
- Strategy 1/1
A royal decree on AI service business has been in draft since 2022 without taking effect. ETDA's AI Governance Center gives Thailand some assessment capacity short of a testing institute. PDPA is the binding route.
-
United Arab Emirates
4- Binding law 1/3
- Oversight body 1/2
- Evaluation capacity 0/2
- Transparency duty 1/2
- Strategy 1/1
Heavy state investment and an early ministerial portfolio for AI, but no horizontal AI statute. Binding rules exist inside the financial free zones, notably the DIFC data protection regulations covering autonomous systems, which do not reach the wider federal market.
-
Argentina
3- Binding law 0/3
- Oversight body 1/2
- Evaluation capacity 0/2
- Transparency duty 1/2
- Strategy 1/1
No AI statute. The data protection authority issued recommendations for trustworthy AI in 2023, which are guidance. Law 25.326 is the binding route and predates modern automated-decision drafting.
-
Chile
3- Binding law 0/3
- Oversight body 1/2
- Evaluation capacity 0/2
- Transparency duty 1/2
- Strategy 1/1
An AI bill has been before Congress since 2024 without being enacted. Law 21.719, the new data protection statute, creates a real data protection agency and automated-decision rights, but phases in over two years from its December 2024 publication.
-
Colombia
3- Binding law 0/3
- Oversight body 1/2
- Evaluation capacity 0/2
- Transparency duty 1/2
- Strategy 1/1
CONPES 4144 set national AI policy in February 2025. Binding duties run through Law 1581 on data protection, supervised by the Superintendencia de Industria y Comercio. No AI statute.
-
Egypt
3- Binding law 0/3
- Oversight body 1/2
- Evaluation capacity 0/2
- Transparency duty 1/2
- Strategy 1/1
The National AI Strategy was first published in 2021 and a second edition followed. The Personal Data Protection Law of 2020 is the binding route and its executive regulations were slow to arrive. No AI statute.
-
Indonesia
3- Binding law 0/3
- Oversight body 1/2
- Evaluation capacity 0/2
- Transparency duty 1/2
- Strategy 1/1
The 2023 circular letter on AI ethics is explicitly non-binding. The Personal Data Protection Law became fully effective in October 2024 and is the binding route. A presidential regulation on AI was in draft at the review date.
-
Israel
3- Binding law 0/3
- Oversight body 1/2
- Evaluation capacity 0/2
- Transparency duty 1/2
- Strategy 1/1
The 2023 Policy on AI Regulation and Ethics is explicitly sectoral and non-binding, leaving existing regulators to act within their own remits. No AI statute, no AI regulator, no evaluation institute.
-
Kenya
3- Binding law 0/3
- Oversight body 1/2
- Evaluation capacity 0/2
- Transparency duty 1/2
- Strategy 1/1
The National AI Strategy 2025 to 2030 was launched in March 2025. Section 35 of the Data Protection Act gives rights against solely automated decisions, enforced by the Office of the Data Protection Commissioner. No AI statute.
-
Malaysia
3- Binding law 0/3
- Oversight body 1/2
- Evaluation capacity 0/2
- Transparency duty 1/2
- Strategy 1/1
The National AI Office opened in December 2024 to coordinate policy, and the national AI governance guidelines published that year are voluntary. The PDPA is the binding route. No AI statute: a draft AI Governance Bill, consulted on in July 2026, was completed for Cabinet in September 2026 and has not been tabled.
-
Mexico
3- Binding law 0/3
- Oversight body 1/2
- Evaluation capacity 0/2
- Transparency duty 1/2
- Strategy 1/1
Several AI bills have been introduced and none enacted. Oversight is unsettled: INAI, the data protection authority, was abolished in 2025 and its functions moved into the executive, which is a reduction in independent supervision rather than an increase in AI capacity.
-
New Zealand
3- Binding law 0/3
- Oversight body 1/2
- Evaluation capacity 0/2
- Transparency duty 1/2
- Strategy 1/1
Deliberately light touch. The first national AI strategy was approved in 2025 and explicitly rules out new AI legislation for now. The Algorithm Charter binds signatory agencies only. Privacy Act 2020 is the binding route.
-
Nigeria
3- Binding law 0/3
- Oversight body 1/2
- Evaluation capacity 0/2
- Transparency duty 1/2
- Strategy 1/1
The National AI Strategy was published in 2024 after an unusually open drafting process. Binding duties run through the Nigeria Data Protection Act 2023 and NITDA, not through AI law.
-
Saudi Arabia
3- Binding law 0/3
- Oversight body 1/2
- Evaluation capacity 0/2
- Transparency duty 1/2
- Strategy 1/1
SDAIA sets AI policy and published AI ethics principles, which are guidance rather than law. The Personal Data Protection Law became enforceable in 2024 and carries the automated-decision route. No AI statute.
-
South Africa
3- Binding law 0/3
- Oversight body 1/2
- Evaluation capacity 0/2
- Transparency duty 1/2
- Strategy 1/1
The National AI Policy Framework of 2024 sets direction without creating duties. Section 71 of POPIA restricts decisions based solely on automated processing and is enforced by the Information Regulator. No AI statute.
-
Turkey
3- Binding law 0/3
- Oversight body 1/2
- Evaluation capacity 0/2
- Transparency duty 1/2
- Strategy 1/1
An AI bill was introduced in 2024 and has not been enacted. Binding duties run through KVKK, the data protection law, which mirrors pre-GDPR European drafting. National AI Strategy published 2021.
-
Ukraine
3- Binding law 0/3
- Oversight body 1/2
- Evaluation capacity 0/2
- Transparency duty 1/2
- Strategy 1/1
The 2023 White Paper sets a bottom-up path toward eventual AI Act alignment as part of the EU accession process, starting with voluntary codes. No binding AI instrument at the review date.