AI risk domain 6
A Blueprint for Greece's AI Transformation – report of the AI Advisory Committee
Delivered in November 2024, the Advisory Committee's report proposes a national AI strategy: public-sector AI deployment, AI in health, education and agriculture, sovereign Greek language models, compute, skills, regulatory sandboxes and governance aligned with the EU AI Act.
Aðgerðaáætlun um gervigreind 2024–2026 (Action plan on artificial intelligence)
The 2024–2026 action plan implements Iceland's AI policy with measures on AI in public services, the Icelandic language in AI systems, skills and research, ethics and security, and preparation for the EU AI Act.
AI – Here for Good: National Artificial Intelligence Strategy for Ireland (2021, refreshed 2024)
Ireland's national AI strategy, first published in July 2021 and refreshed in November 2024 to reflect the EU AI Act and generative AI, is organised around building public trust, leveraging AI for economic and societal benefit, and enablers such as data, infrastructure, skills and governance. The refresh sets out Ireland's AI Act implementation model, public-sector AI guidelines and an AI advisory council.
AI Portugal 2030: Portuguese National Initiative on Digital Skills – Artificial Intelligence strategy
Published in 2019 under the INCoDe.2030 initiative, AI Portugal 2030 sets objectives for research, skills, public administration, industry adoption and international positioning, with priority application areas such as natural language, mobility, energy and health, and a commitment to ethical and trustworthy AI.
Algorithm Charter for Aotearoa New Zealand (2020)
Launched in July 2020, the charter commits signatory government agencies to transparency (plain-English explanations of how algorithms are used), partnership with Māori (Te Tiriti), people-focused use, data fit for purpose, privacy, ethics and human rights safeguards, human oversight and channels for challenge, applied through a risk matrix for high-impact algorithms. Around 30 agencies have signed; a 2021 review recommended stronger implementation.
Algoritmeregister van de Nederlandse overheid (Government Algorithm Register)
A public register in which Dutch government organisations describe the algorithms they use that affect citizens: purpose, legal basis, data, human oversight, risks and contact points. Launched in December 2022 and extended since, it aims to make automated decision-making by government transparent and contestable. Ministries were asked to publish all impactful and high-risk algorithms.
A pro-innovation approach to AI regulation (white paper and government response)
The UK white paper sets out a principles-based, context-specific approach to regulating AI. Instead of a single AI law, it asks existing regulators to interpret and apply five cross-cutting principles within their remits: safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; and contestability and redress. Central government provides coordination, monitoring and guidance.
Artificial Intelligence: a strategic vision for Luxembourg
Published in May 2019, the vision positions Luxembourg as a living lab for applied AI with priorities on skills, data and infrastructure, public-sector use, research and trustworthy, human-centric AI.
Artificial Intelligence Strategy of the Republic of Azerbaijan for 2025–2028 (presidential decree, March 2025)
Approved by presidential decree in March 2025, the strategy sets goals for AI in public administration, the economy and education, data and computing infrastructure, talent, ethical and safe AI, and a coordinating institutional structure, with an action plan to 2028.
Cambodia National Artificial Intelligence Strategy
A national AI strategy and ethics framework under preparation with UNESCO support, expected to cover governance, talent, public-sector use and the digital economy.
Colorado Senate Bill 24-205: Consumer Protections for Artificial Intelligence (Colorado AI Act)
The Colorado AI Act requires developers and deployers of high-risk AI systems to use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination. High-risk systems are those that make, or are a substantial factor in making, consequential decisions about education, employment, financial or lending services, essential government services, healthcare, housing, insurance or legal services. Deployers must run risk-management programmes and impact assessments, notify consumers, and explain adverse decisions; developers must document systems and disclose known risks.
Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225)
The first international treaty on AI. Parties must adopt or maintain measures so that activities within the lifecycle of AI systems are consistent with human rights, democracy and the rule of law, covering public authorities and actors on their behalf and, by choice of approach, private actors. It sets principles (human dignity and autonomy, transparency and oversight, accountability, equality and non-discrimination, privacy, reliability, safe innovation), requires remedies, procedural safeguards and risk and impact assessment, allows moratoria or bans for incompatible uses, and creates a Conference of the Parties for follow-up. National-security activities and defence are excluded.
Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025
The DPDP Act is India's cross-sector personal-data law. It applies to digital personal data processed in India and to processing outside India connected with offering goods or services to people in India. It requires a lawful basis (consent or specified legitimate uses), notice, purpose limitation, data accuracy, security safeguards, breach notification to the Data Protection Board and affected individuals, and grants rights of access, correction, erasure and grievance redress. Significant Data Fiduciaries face extra duties such as impact assessments and audits. The Act does not mention AI specifically, but it governs the personal data used to train and operate AI systems.
Eesti tehisintellekti tegevuskava 2024–2026 (Estonia's national AI action plan)
The third Estonian AI action plan continues the "kratt" programme: adoption of AI in public services and the Bürokratt virtual-assistant ecosystem, support for private-sector use, skills and research, data availability, and preparation for the EU AI Act, including public-sector guidelines on generative AI.
Estrategia Nacional de Inteligencia Artificial de Costa Rica 2024–2027
Launched in October 2024, the strategy sets pillars on governance and ethics, talent and skills, research and innovation, infrastructure and data, and adoption in the public sector and productive sectors, with an action plan to 2027 informed by UNESCO's Readiness Assessment Methodology.
Estrategia Nacional de Inteligencia Artificial de la República Dominicana (ENIA)
Adopted in 2023, ENIA sets objectives on ethical and responsible AI, talent development, AI in public services and priority sectors (health, education, tourism, security), data infrastructure and research, with a governance committee and action plan.
Estrategia Nacional de Inteligencia Artificial de Panamá
Panama has been developing a national AI strategy with UNESCO support, covering governance and ethics, public-sector adoption, talent, data infrastructure and the logistics and financial sectors.
Estrategia para el desarrollo y uso de la inteligencia artificial en Cuba
The strategy sets principles for the ethical development and use of AI in Cuba, priorities for public administration, health and education, and a governance structure led by the Ministry of Communications.
Färdplan för Sverige – AI-kommissionens slutbetänkande (SOU 2024:94)
The government-appointed AI Commission's final report sets out a roadmap for Sweden with around 75 proposals: a national AI task force and data factory, compute and skills investment, AI in public administration and health care, access to data for research and innovation, and measures to make the most of the EU AI Act. It estimates costs and proposes a funding envelope over several years.
Federal Council decision on the regulation of artificial intelligence: ratification of the Council of Europe Convention and sector-specific adjustments
On 12 February 2025 the Federal Council decided how Switzerland will regulate AI: it will ratify the Council of Europe Framework Convention on AI and implement it mainly through targeted changes to existing law where needed (for example transparency, data protection and non-discrimination), avoid a horizontal AI act, and complement legislation with non-binding measures such as self-regulation and agreements with industry. Federal departments were tasked to prepare a consultation draft by the end of 2026.
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)
The UAE Personal Data Protection Law is the federal data-protection law applying outside the DIFC and ADGM free zones. It sets principles for lawful processing, consent and its exceptions, data-subject rights (including the right to object to automated decision-making without human intervention), controller and processor duties, security and breach notification to the UAE Data Office, cross-border transfer rules, and data protection impact assessments for high-risk processing including new technologies.
Federal Law No. 123-FZ of 24 April 2020 on an experiment to establish special regulation to create the conditions for the development and implementation of AI technologies in Moscow
Establishes a five-year experimental legal regime in Moscow (from 1 July 2020) allowing participants to develop and deploy AI technologies under special rules, including processing of anonymised personal data for AI purposes, coordinated by the Moscow government with a register of participants. It was accompanied by amendments to the personal-data law.
Finland's Age of Artificial Intelligence: Turning Finland into a leading country in the application of AI (objective and recommendations for measures)
The 2017 report of the steering group appointed by the Minister of Economic Affairs proposed eight key actions to make Finland a leader in applying AI: enhancing business competitiveness, using data in all sectors, faster adoption, top-level expertise and talent, bold decisions and investments, the best public services, new cooperation models and a human-centred approach. It launched the national AI programme continued in the 2019 final report and the AI 4.0 programme.
ICO Guidance on AI and data protection
The ICO's guidance explains how UK GDPR and the Data Protection Act 2018 apply when organisations develop or use AI that processes personal data. It covers accountability and governance, lawfulness and fairness, transparency, data minimisation, security, individual rights, and automated decision-making. The guidance is not itself law, but it reflects how the regulator interprets binding obligations and is the reference point in ICO enforcement.
Informational only, not legal advice. Verify every claim against the linked official sources and consult qualified counsel before acting.
