Privacy & Security is domain 2 of the MIT AI Risk Repository's domain taxonomy. It groups 2 kinds of risk: compromise of privacy by obtaining, leaking or correctly inferring sensitive information and ai system security vulnerabilities and attacks. 112 incidents in the AI Incident Database are classified under it. 199 risk entries in the MIT database are coded to it.
AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized sharing of data and information can compromise user expectation of privacy, assist identity theft, or loss of confidential intellectual property.
Vulnerabilities in AI systems, software development toolchains, and hardware that can be exploited, resulting in unauthorized access, data and privacy breaches, or system manipulation causing unsafe outputs or behavior.
Instruments tagged with the use cases this domain concerns. A law listed covers the area; it is not a finding that it applies to any particular system or incident.
Calabria Regional Law No. 4 of 2 February 2026 on the use of artificial intelligence systems in the region
Legge regionale 2 febbraio 2026, n. 4, "Disposizioni concernenti l'impiego di sistemi di intelligenza artificiale in ambito regionale"
Governs the use of AI in the regional administration, with human review, data protection and transparency; sets up a health-AI pilot programme, a voluntary regional register of AI developers and a regional AI Office.
Adopted 2 Feb 2026Pending review (a factual check against the official source, not a legal review)Official source
California SB 243: Companion chatbots (Chapter 677, Statutes of 2025)
Operators of companion chatbots must disclose that the chatbot is AI and maintain a protocol for responding to suicidal ideation and self-harm that refers users to crisis services. Users known to be minors get break reminders and protection from sexual content. Annual reports to the Office of Suicide Prevention begin 1 July 2027, and a person injured by a violation can bring a civil action.
Adopted 13 Oct 2025Pending review (a factual check against the official source, not a legal review)Official source
Colorado Senate Bill 24-205: Consumer Protections for Artificial Intelligence (Colorado AI Act)
The Colorado AI Act requires developers and deployers of high-risk AI systems to use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination. High-risk systems are those that make, or are a substantial factor in making, consequential decisions about education, employment, financial or lending services, essential government services, healthcare, housing, insurance or legal services. Deployers must run risk-management programmes and impact assessments, notify consumers, and explain adverse decisions; developers must document systems and disclose known risks.
Adopted 17 May 2024Pending review (a factual check against the official source, not a legal review)Official source
Colorado Senate Bill 26-189: Automated Decision-Making Technology (replacement of the Colorado AI Act)
SB 26-189 replaces the Colorado AI Act's regulation of "high-risk" AI systems with duties that attach when automated decision-making technology materially influences a consequential decision about a Colorado consumer in areas such as employment, lending, housing, education, healthcare, insurance and government services. It drops the earlier duty of reasonable care, the mandatory risk-management programme, impact assessments and Attorney General notification, and substitutes advance notice to the consumer, disclosure after an adverse outcome, meaningful human review, three-year record keeping and developer documentation obligations.
Applies from 1 Jan 2027Pending review (a factual check against the official source, not a legal review)Official source
Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025
The DPDP Act is India's cross-sector personal-data law. It applies to digital personal data processed in India and to processing outside India connected with offering goods or services to people in India. It requires a lawful basis (consent or specified legitimate uses), notice, purpose limitation, data accuracy, security safeguards, breach notification to the Data Protection Board and affected individuals, and grants rights of access, correction, erasure and grievance redress. Significant Data Fiduciaries face extra duties such as impact assessments and audits. The Act does not mention AI specifically, but it governs the personal data used to train and operate AI systems.
Adopted 11 Aug 2023Verified (reviewed by Bhaskar Bhatt; a factual check against the official source, not a legal review)Official source
Illinois Wellness and Oversight for Psychological Resources Act (HB 1806, Public Act 104-0054)
No one may provide therapy or psychotherapy in Illinois, including through AI, unless it is delivered by a licensed professional. AI may be used only for administrative and supplementary support, with notice to and consent from the client. The Department of Financial and Professional Regulation enforces it.
In force 1 Aug 2025Pending review (a factual check against the official source, not a legal review)Official source
The Individual Privacy Act 2075 gives effect to the constitutional right to privacy in Nepal. It regulates the collection, storage, processing, use and disclosure of personal information by public bodies and private entities, requires consent for collection and use of personal data subject to exceptions, restricts sensitive data, and provides remedies and penalties. It is the main binding law affecting AI systems that process personal data in Nepal. The Individual Privacy Regulation 2077 (2020) provides implementing rules.
In force 18 Sep 2018Verified (reviewed by Bhaskar Bhatt; a factual check against the official source, not a legal review)Official source
Legge 23 settembre 2025, n. 132 – Disposizioni e deleghe al Governo in materia di intelligenza artificiale
Italy's framework AI law, published in the Official Gazette on 25 September 2025 and in force from 10 October 2025. It states principles (human-centric, transparent, safe AI; protection of fundamental rights), sets sector rules for healthcare (AI as support, not replacement, for clinical decisions), employment (information to workers, an AI-at-work observatory), intellectual professions (client disclosure), justice (judge decides; AI only for organisational support) and public administration, requires parental consent for children under 14, designates AgID and ACN as national authorities, delegates the government to align national law with the EU AI Act, and creates a criminal offence for unlawful dissemination of AI-generated or manipulated content with aggravating circumstances for other crimes committed with AI.
In force 10 Oct 2025Verified (reviewed by Bhaskar Bhatt; a factual check against the official source, not a legal review)Official source
Published in March 2019, the strategy sets a responsible foundation for AI (ethical principles, data ethics council, legal clarity), more and better data, strong competences and new knowledge, and increased investment, with priority sectors of health, energy and utilities, agriculture and transport, and a set of public-sector pilot projects.
Adopted 14 Mar 2019Verified (reviewed by Bhaskar Bhatt; a factual check against the official source, not a legal review)Official source
New York AI companion safeguards (General Business Law Article 47, sections 1700-1704)
Operators of AI companions must have a protocol to detect and respond to suicidal ideation and self-harm, and must tell users they are talking to AI at the start of a session and at least every three hours.
In force 5 Nov 2025Pending review (a factual check against the official source, not a legal review)Official source
Quebec Law 25 (S.Q. 2021, c. 25): provisions on decisions based exclusively on automated processing and biometric systems
Section 12.1 of the private-sector privacy act (as amended by Law 25, in force 22 September 2023) requires any enterprise that uses personal information to render a decision based exclusively on automated processing to inform the person no later than when the decision is made, and, on request, to tell them what personal information was used, the reasons and principal factors and parameters, and their right to have the information corrected, and to give them an opportunity to submit observations to a person who can review the decision. Biometric identification databases must be declared to the Commission d'accès à l'information 60 days before use, and privacy impact assessments are mandatory for projects involving personal information. Penalties reach CAD 25 million or 4% of worldwide turnover.
Applies from 22 Sep 2023Verified (reviewed by Bhaskar Bhatt; a factual check against the official source, not a legal review)Official source
The EU AI Act is a binding regulation that sets rules for developing, placing on the market and using AI systems in the European Union. It bans a small set of practices considered unacceptable, imposes detailed requirements on "high-risk" AI systems used in areas such as employment, education, credit, essential services, law enforcement and safety-critical products, requires transparency for chatbots and synthetic content, and creates separate duties for providers of general-purpose AI models. Obligations apply in phases between 2025 and 2028.
Applies from 2 Aug 2026Pending review (a factual check against the official source, not a legal review)Official source
Signed on 22 June 2025 and effective 1 January 2026, TRAIGA bans developing or deploying AI systems intended to manipulate people into self-harm or crime, government social scoring, biometric identification by government from public data without consent, intentional unlawful discrimination against protected classes, and production of child sexual abuse material or unlawful sexual deepfakes. State agencies and health-care providers must disclose AI interactions. It creates a 36-month regulatory sandbox administered by the Department of Information Resources, a Texas Artificial Intelligence Council, and gives the Attorney General exclusive enforcement with civil penalties after a 60-day cure period; disparate impact alone does not prove intent to discriminate.
Applies from 1 Jan 2026Verified (reviewed by Bhaskar Bhatt; a factual check against the official source, not a legal review)Official source
UNESCO Recommendation on the Ethics of Artificial Intelligence (adopted by the General Conference, 23 November 2021)
The first global normative instrument on AI ethics. It sets values (human rights and dignity, environment and ecosystem flourishing, diversity and inclusiveness, peaceful and just societies) and principles (proportionality and do no harm, safety and security, fairness, sustainability, privacy, human oversight, transparency and explainability, responsibility, awareness and literacy, multi-stakeholder governance), and eleven policy action areas from ethical impact assessment and data policy to gender, education, health and the environment. UNESCO supports implementation with a Readiness Assessment Methodology (RAM) and an Ethical Impact Assessment tool used by dozens of countries.
Adopted 23 Nov 2021Verified (reviewed by Bhaskar Bhatt; a factual check against the official source, not a legal review)Official source
Utah Artificial Intelligence Policy Act (SB 149, 2024, as amended by SB 226 and SB 332 in 2025)
Effective 1 May 2024, the Act requires a person using generative AI to interact with a consumer in a consumer transaction to disclose clearly that the consumer is interacting with AI when asked (as amended in 2025, when the interaction is high-risk or on request), and requires providers of regulated occupations (for example health and legal services) to disclose generative-AI use proactively. It states that using AI is no defence to consumer-protection violations, created the Office of Artificial Intelligence Policy and an AI learning laboratory allowing regulatory mitigation agreements, and originally sunset in 2025, extended to 2027.
Applies from 1 May 2024Verified (reviewed by Bhaskar Bhatt; a factual check against the official source, not a legal review)Official source
Mental health chatbots must disclose that they are AI; suppliers may not sell or share users' health information or input, or use it to target advertising. A written policy filed with the Division of Professional Licensing gives a supplier an affirmative defence.
In force 7 May 2025Pending review (a factual check against the official source, not a legal review)Official source
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.
