Misinformation is domain 3 of the MIT AI Risk Repository's domain taxonomy. It groups 2 kinds of risk: false or misleading information and pollution of information ecosystem and loss of consensus reality. 196 incidents in the AI Incident Database are classified under it. 80 risk entries in the MIT database are coded to it.
AI systems that inadvertently generate or spread incorrect or deceptive information, which can lead to inaccurate beliefs in users and undermine their autonomy. Humans that make decisions based on false beliefs can experience physical, emotional or material harms
Highly personalized AI-generated misinformation creating “filter bubbles” where individuals only see what matches their existing beliefs, undermining shared reality, weakening social cohesion and political processes.
Instruments tagged with the use cases this domain concerns. A law listed covers the area; it is not a finding that it applies to any particular system or incident.
A pro-innovation approach to AI regulation (white paper and government response)
The UK white paper sets out a principles-based, context-specific approach to regulating AI. Instead of a single AI law, it asks existing regulators to interpret and apply five cross-cutting principles within their remits: safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; and contestability and redress. Central government provides coordination, monitoring and guidance.
Adopted 29 Mar 2023Verified (reviewed by Bhaskar Bhatt; a factual check against the official source, not a legal review)Official source
Accredits third-party firms that test AI systems, in benchmarking and red teaming, for 12 months at a time; the first five were AIDX Tech, Knovel Engineering, PwC Singapore, Resaro and Vulcan. Accreditation does not certify that a tester is independent or that a tested system is safe.
Pending review (a factual check against the official source, not a legal review)Official source
AI – Here for Good: National Artificial Intelligence Strategy for Ireland (2021, refreshed 2024)
Ireland's national AI strategy, first published in July 2021 and refreshed in November 2024 to reflect the EU AI Act and generative AI, is organised around building public trust, leveraging AI for economic and societal benefit, and enablers such as data, infrastructure, skills and governance. The refresh sets out Ireland's AI Act implementation model, public-sector AI guidelines and an AI advisory council.
Adopted 8 Jul 2021Verified (reviewed by Bhaskar Bhatt; a factual check against the official source, not a legal review)Official source
Anteproyecto de Ley para el buen uso y la gobernanza de la inteligencia artificial
The draft implements the EU AI Act in Spain: it allocates supervision among AESIA, the data-protection authority, the electoral board, the financial and audiovisual regulators, sets the national penalty scale (up to EUR 35 million or 7% of turnover for prohibited practices), treats failure to label AI-generated content as a serious infringement and provides for the national sandbox to continue.
Verified (reviewed by Bhaskar Bhatt; a factual check against the official source, not a legal review)Official source
Artificial Intelligence: Model Personal Data Protection Framework
Published 11 June 2024, the framework gives organisations that procure, implement and use AI systems involving personal data recommendations in four areas: AI strategy and governance (an AI governance committee, procurement due diligence), risk assessment and human oversight (a risk-based approach with levels of human involvement), customisation and implementation of AI models (data preparation, testing, security), and communication and engagement with stakeholders (transparency, explainability, opt-out, feedback). It builds on the 2021 Guidance on the Ethical Development and Use of AI.
Adopted 11 Jun 2024Verified (reviewed by Bhaskar Bhatt; a factual check against the official source, not a legal review)Official source
Beijing: Several Measures for Promoting the Innovation and Development of General Artificial Intelligence
北京市促进通用人工智能创新发展的若干措施
Twenty-one measures on compute, data, models, application scenarios and an "inclusive and prudent" approach to regulation and ethics for general-purpose AI in Beijing.
Adopted 23 May 2023Pending review (a factual check against the official source, not a legal review)Official source
CNIL recommendations on the development of AI systems and the GDPR (AI how-to sheets)
A series of practical guidance sheets, first published in 2024 and extended since, explaining how organisations can develop and train AI systems in compliance with the GDPR: defining a purpose, choosing a legal basis (including legitimate interest for web-scraped training data), data minimisation, retention, data-protection impact assessments, informing people and honouring their rights, and security of training datasets and models.
Adopted 8 Apr 2024Verified (reviewed by Bhaskar Bhatt; a factual check against the official source, not a legal review)Official source
California AB 2013: Generative artificial intelligence: training data transparency (Chapter 817, Statutes of 2024)
Developers of generative AI systems made available to Californians must post documentation of the data used to train them on their websites, including summaries of the datasets, whether they include copyrighted material, whether they were purchased or licensed, and whether they include personal information.
Applies from 1 Jan 2026Pending review (a factual check against the official source, not a legal review)Official source
California AI Transparency Act (SB 942, as amended by AB 853)
Covered providers of generative AI systems must offer a free AI-detection tool and embed disclosures and provenance data in AI-generated content. AB 853 (Chapter 674, Statutes of 2025) moved the operative date to 2 August 2026 and added duties for large online platforms and generative-AI hosting platforms.
Applies from 2 Aug 2026Pending review (a factual check against the official source, not a legal review)Official source
California SB 53: Transparency in Frontier Artificial Intelligence Act
SB 53 requires "large frontier developers" (developers of the most compute-intensive models above statutory thresholds) to publish a frontier AI framework describing how they assess and mitigate catastrophic risks, publish transparency reports when deploying new frontier models, report critical safety incidents to the California Office of Emergency Services, and protect employees who report safety concerns. It also directs creation of a public computing cluster ("CalCompute").
Applies from 1 Jan 2026Verified (reviewed by Bhaskar Bhatt; a factual check against the official source, not a legal review)Official source
California SB 813: Independent verification organizations for AI (Chapter 179, Statutes of 2026)
The Government Operations Agency must, by 1 January 2028, set up a process to designate and oversee independent verification organisations that assess AI models and applications. The law does not require any developer to use one.
Adopted 9 Sep 2026Pending review (a factual check against the official source, not a legal review)Official source
A broad online-safety act that covers frontier developers, AI companions, AI in employment and synthetic content. Its frontier provisions bar retaliation against whistleblowers and require large frontier developers to set up an anonymous internal reporting process and report to their boards quarterly; no duty to publish a safety framework or transparency report was found.
In force 1 Oct 2026Pending review (a factual check against the official source, not a legal review)Official source
Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025
The DPDP Act is India's cross-sector personal-data law. It applies to digital personal data processed in India and to processing outside India connected with offering goods or services to people in India. It requires a lawful basis (consent or specified legitimate uses), notice, purpose limitation, data accuracy, security safeguards, breach notification to the Data Protection Board and affected individuals, and grants rights of access, correction, erasure and grievance redress. Significant Data Fiduciaries face extra duties such as impact assessments and audits. The Act does not mention AI specifically, but it governs the personal data used to train and operate AI systems.
Adopted 11 Aug 2023Verified (reviewed by Bhaskar Bhatt; a factual check against the official source, not a legal review)Official source
Ensuring Likeness, Voice, and Image Security (ELVIS) Act of 2024 (Tennessee Public Chapter 588)
Signed 21 March 2024 and effective 1 July 2024, the ELVIS Act updates Tennessee's Personal Rights Protection Act to add voice to the protected attributes of name, photograph and likeness, prohibits publishing or making available an individual's voice or likeness without authorisation, and creates liability for distributing or making available an algorithm, software or tool whose primary purpose is producing an individual's voice or likeness without authorisation. It provides civil actions for individuals and licensees and criminal penalties.
In force 1 Jul 2024Verified (reviewed by Bhaskar Bhatt; a factual check against the official source, not a legal review)Official source
Entwurf eines Gesetzes zur Durchführung der KI-Verordnung (KI-Marktüberwachungs- und Innovationsförderungsgesetz, KI-MIG)
The draft implementation act designates the Bundesnetzagentur as the central market-surveillance authority and single point of contact under the EU AI Act, keeps sector regulators (financial supervision, data protection for law-enforcement uses) competent in their fields, sets the national penalty framework within the Regulation's ranges and creates a national AI regulatory sandbox and an AI service desk for companies.
Verified (reviewed by Bhaskar Bhatt; a factual check against the official source, not a legal review)Official source
Executive Order 14179: Removing Barriers to American Leadership in Artificial Intelligence
Executive Order 14179, signed 23 January 2025, sets US federal policy to sustain and enhance American AI dominance, directs the development of an AI Action Plan within 180 days, and orders agencies to review and revise or rescind actions taken under the revoked Executive Order 14110 that are inconsistent with the new policy. It also called for revision of the OMB memoranda governing federal agency use and procurement of AI, which OMB replaced in April 2025 with M-25-21 and M-25-22.
In force 23 Jan 2025Verified (reviewed by Bhaskar Bhatt; a factual check against the official source, not a legal review)Official source
Executive Order 14365: Ensuring a National Policy Framework for Artificial Intelligence
Directs the Attorney General to set up an AI Litigation Task Force to challenge state AI laws, asks the Commerce Department to identify "onerous" state AI laws (with non-deployment broadband (BEAD) funds tied to that list), and asks the FTC for a policy statement on AI outputs. It does not itself pre-empt any state law; that would take legislation or a court ruling.
In force 11 Dec 2025Pending review (a factual check against the official source, not a legal review)Official source
Expanded ASEAN Guide on AI Governance and Ethics – Generative AI
Endorsed in January 2025, the expanded guide addresses risks specific to generative AI (hallucination, deepfakes and misinformation, intellectual property, privacy, security, bias, embedded values) and proposes governance dimensions covering accountability, data, development and deployment, incident reporting, testing and assurance, security, content provenance, safety research and public-interest use, with policy recommendations for member states.
Adopted 17 Jan 2025Verified (reviewed by Bhaskar Bhatt; a factual check against the official source, not a legal review)Official source
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)
The UAE Personal Data Protection Law is the federal data-protection law applying outside the DIFC and ADGM free zones. It sets principles for lawful processing, consent and its exceptions, data-subject rights (including the right to object to automated decision-making without human intervention), controller and processor duties, security and breach notification to the UAE Data Office, cross-border transfer rules, and data protection impact assessments for high-risk processing including new technologies.
In force 2 Jan 2022Verified (reviewed by Bhaskar Bhatt; a factual check against the official source, not a legal review)Official source
Hiroshima Process International Code of Conduct for Organizations Developing Advanced AI Systems (G7, 30 October 2023)
Eleven voluntary actions for organisations developing the most advanced AI systems, including foundation and generative models: risk identification and mitigation across the lifecycle, post-deployment vulnerability and incident monitoring, public transparency reports, responsible information sharing, security controls, content authentication such as watermarking, research on societal risks, priority to global challenges, technical standards, and data-input and personal-data safeguards. It sits alongside the Hiroshima Process guiding principles and, from 2025, an OECD-run voluntary reporting framework.
Adopted 30 Oct 2023Verified (reviewed by Bhaskar Bhatt; a factual check against the official source, not a legal review)Official source
Hong Kong Generative Artificial Intelligence Technical and Application Guideline
Published in April 2025, the guideline covers the technical characteristics and risks of generative AI, governance principles (safety, transparency, accountability, data protection, fairness) and practical application guidance for developers, service providers and users across the AI lifecycle, and is intended as a reference for industry and government.
Adopted 15 Apr 2025Verified (reviewed by Bhaskar Bhatt; a factual check against the official source, not a legal review)Official source
The ICO's guidance explains how UK GDPR and the Data Protection Act 2018 apply when organisations develop or use AI that processes personal data. It covers accountability and governance, lawfulness and fairness, transparency, data minimisation, security, individual rights, and automated decision-making. The guidance is not itself law, but it reflects how the regulator interprets binding obligations and is the reference point in ICO enforcement.
Verified (reviewed by Bhaskar Bhatt; a factual check against the official source, not a legal review)Official source
Illinois's frontier-AI safety and transparency law, built on the model of California SB 53: large frontier developers must publish a frontier AI framework and update it every year, publish a transparency report when they deploy a new or substantially modified frontier model, report critical safety incidents to the Illinois Emergency Management Agency and Office of Homeland Security, and protect whistleblowing employees. Unlike the California and New York laws, it also requires annual independent third-party audits, with a published summary.
Adopted 6 Jul 2026Pending review (a factual check against the official source, not a legal review)Official source
The India AI Governance Guidelines set out a principle-based, pro-innovation approach to governing AI in India. They articulate guiding principles (such as trust, people-first design, fairness, accountability, safety and transparency), propose an institutional framework including an AI governance group and an AI Safety Institute role, favour applying existing laws over a new AI statute, and recommend voluntary commitments, techno-legal measures, risk-based oversight and incident reporting for AI systems.
Adopted 5 Nov 2025Verified (reviewed by Bhaskar Bhatt; a factual check against the official source, not a legal review)Official source
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.
