AI policy explorer

ICO AI guidance

ICO Guidance on AI and data protection

The ICO's guidance explains how UK GDPR and the Data Protection Act 2018 apply when organisations develop or use AI that processes personal data. It covers accountability and governance, lawfulness and fairness, transparency, data minimisation, security, individual rights, and automated decision-making. The guidance is not itself law, but it reflects how the regulator interprets binding obligations and is the reference point in ICO enforcement.

Colorado AI Act

Colorado Senate Bill 24-205: Consumer Protections for Artificial Intelligence (Colorado AI Act)

The Colorado AI Act requires developers and deployers of high-risk AI systems to use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination. High-risk systems are those that make, or are a substantial factor in making, consequential decisions about education, employment, financial or lending services, essential government services, healthcare, housing, insurance or legal services. Deployers must run risk-management programmes and impact assessments, notify consumers, and explain adverse decisions; developers must document systems and disclose known risks.

California SB 53

California SB 53: Transparency in Frontier Artificial Intelligence Act

SB 53 requires "large frontier developers" (developers of the most compute-intensive models above statutory thresholds) to publish a frontier AI framework describing how they assess and mitigate catastrophic risks, publish transparency reports when deploying new frontier models, report critical safety incidents to the California Office of Emergency Services, and protect employees who report safety concerns. It also directs creation of a public computing cluster ("CalCompute").

Illinois HB 3773 (AI in employment, Human Rights Act amendment)

Illinois Public Act 103-0804 (HB 3773): Artificial intelligence in employment decisions – amendment to the Illinois Human Rights Act

Signed 9 August 2024 and effective 1 January 2026, the Act makes it a civil-rights violation for an employer to use artificial intelligence in recruitment, hiring, promotion, discipline, discharge or other terms of employment in a way that subjects employees to discrimination on the basis of protected classes, or to use zip codes as a proxy for protected classes. Employers must notify employees when AI is used for such decisions; the Department of Human Rights is to adopt rules on notice.

UAE Strategy for Artificial Intelligence

UAE Strategy for Artificial Intelligence (UAE National Strategy for AI 2031)

Launched in October 2017, the strategy aims to embed AI across government services and priority sectors such as health, education, transport, energy and space, and to make the UAE a leading AI destination by 2031. Its objectives include AI-friendly legislation, talent development, research capability, data infrastructure and strong governance. The UAE Council for AI was created to drive implementation.

National AI strategy (in development)

Uganda National Artificial Intelligence Strategy

A national AI strategy under development covering governance and ethics, skills, public-sector and agricultural use cases, data and infrastructure, within the Digital Transformation Roadmap.

Draft South Africa National Artificial Intelligence

Draft South Africa National Artificial Intelligence (AI) Policy

Approved by Cabinet in March/April 2026 and gazetted for a 60-day comment period, the draft policy proposed guiding principles, institutional arrangements and implementation pathways for AI across the public and private sectors, building on the department's 2024 National AI Policy Framework. The Minister announced its withdrawal on 26 April 2026 after fictitious citations were found in its reference list, and the withdrawal was formally gazetted in June 2026.

National AI Strategy (2024)

National Strategy on Artificial Intelligence for Sri Lanka

The strategy sets priorities on AI skills and research, public-sector and industry adoption, data and compute infrastructure, and responsible-AI governance, with a national AI centre and implementation task force.

UAE PDPL

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)

The UAE Personal Data Protection Law is the federal data-protection law applying outside the DIFC and ADGM free zones. It sets principles for lawful processing, consent and its exceptions, data-subject rights (including the right to object to automated decision-making without human intervention), controller and processor duties, security and breach notification to the UAE Data Office, cross-border transfer rules, and data protection impact assessments for high-risk processing including new technologies.

Federal Council AI regulatory approach (2025)

Federal Council decision on the regulation of artificial intelligence: ratification of the Council of Europe Convention and sector-specific adjustments

On 12 February 2025 the Federal Council decided how Switzerland will regulate AI: it will ratify the Council of Europe Framework Convention on AI and implement it mainly through targeted changes to existing law where needed (for example transparency, data protection and non-discrimination), avoid a horizontal AI act, and complement legislation with non-binding measures such as self-regulation and agreements with industry. Federal departments were tasked to prepare a consultation draft by the end of 2026.

National AI strategy (in development)

Tanzania National Artificial Intelligence Strategy

A national AI strategy under development covering governance and ethics, skills, public-sector and agricultural use cases, data and infrastructure.

Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust

Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act, Act No. 20676)

Korea's AI Basic Act is a comprehensive framework statute combining industrial promotion with trust and safety rules. It gives a legal basis for a national AI master plan every three years and the National AI Committee, supports R&D, data, standardisation and SMEs, and imposes duties on operators of high-impact AI (risk management, explanation, human oversight) and transparency duties to notify users of generative AI output. Foreign operators above a threshold must designate a domestic representative. It was promulgated in January 2025 and took effect on 22 January 2026 after a one-year grace period.

UAE AI Strategy 2031

UAE National Strategy for Artificial Intelligence 2031

The UAE National Strategy for AI 2031 aims to position the UAE as a global leader in AI by 2031. It sets objectives across priority sectors, AI talent and research, data and infrastructure, government adoption and governance, including a commitment to AI ethics and to developing appropriate regulation. It is a strategy document that guides government programmes and does not itself impose obligations on private organisations.

National AI Programme to 2025 (NpUI)

Nacionalni program spodbujanja razvoja in uporabe umetne inteligence v Republiki Sloveniji do leta 2025

Adopted in May 2021, the programme sets measures on research and innovation, skills, data and infrastructure, public-sector and business adoption, ethics and trustworthy AI, and international cooperation, including support for the UNESCO IRCAI centre.

National AI Strategy 2030

Národná stratégia pre umelú inteligenciu 2030

The strategy to 2030 sets objectives for AI research, skills, data and infrastructure, adoption in public administration and industry, and trustworthy AI aligned with the EU AI Act.

Thailand National AI Strategy and Action Plan

Thailand National AI Strategy and Action Plan (2022-2027)

A cabinet-approved strategy and action plan with five strategies: readiness in ethics, law and regulation; national AI infrastructure; human capability and education; AI technology and innovation development; and promotion of AI use in public and private sectors. It sets targets for AI talent, research prototypes and economic impact through 2027 and is implemented in phases coordinated across ministries.

National AI Strategy 2021–2025

Ulusal Yapay Zekâ Stratejisi 2021–2025 (National Artificial Intelligence Strategy)

Published by Presidential Circular in August 2021, the strategy sets six priorities: training AI experts and increasing employment, supporting research and innovation, access to quality data and technical infrastructure, regulations to accelerate socio-economic adaptation, strengthening international cooperation, and accelerating structural and workforce transformation. Its action plan was updated for 2024–2025.

AI Development Strategy to 2040

Strategy for the Development of Artificial Intelligence in the Republic of Tajikistan for the period up to 2040

Approved by government decree in 2021, the strategy sets long-term goals for AI research, education, infrastructure and use in the economy and public administration to 2040.

(Draft) Principles of the Law on Artificial Intelligence

Draft principles for a Thai AI law released for public hearing by MDES and ETDA. They propose a risk-based structure that distinguishes prohibited and high-risk AI, duties for providers and deployers, human oversight, incident reporting and a regulatory sandbox, while leaving sector regulators to set proportionate rules. The draft merges the 2022 ONDE royal decree draft and the 2023 ETDA promotion act draft.

Draft Artificial Intelligence Law (2024)

Yapay Zekâ Kanunu Teklifi (Artificial Intelligence Law proposal submitted to the Grand National Assembly, June 2024)

A short framework bill proposing principles for AI (safety, transparency, fairness, accountability, privacy), a risk-based approach with registration of high-risk systems, operator obligations and penalties, and supervision by designated authorities, broadly modelled on the EU AI Act.