AI policy explorer

Draft act on AI systems (AI Act implementation)

Projekt ustawy o systemach sztucznej inteligencji

The draft act implements the EU AI Act in Poland: it creates the Commission for the Development and Safety of Artificial Intelligence as the market-surveillance authority and single point of contact, sets procedures for complaints and inspections, provides for a regulatory sandbox and defines the national penalty regime.

Decreto Supremo N° 115-2025-PCM

Decreto Supremo N° 115-2025-PCM – Reglamento de la Ley N° 31814 (Supreme Decree No. 115-2025-PCM – Regulation of Law No. 31814)

This regulation, published on 9 September 2025, develops Law 31814 with six titles and 36 articles. It introduces a risk classification distinguishing prohibited uses, high-risk systems and acceptable-risk systems, sets transparency, data protection and governance obligations for public and private actors, and provides for sandboxes, capacity-building and reporting channels. Compliance is phased in over one to four years depending on the sector and type of organisation.

Ley N° 31814

Ley N° 31814 – Ley que promueve el uso de la inteligencia artificial en favor del desarrollo económico y social del país (Law No. 31814 – Law promoting the use of artificial intelligence for the country's economic and social development)

Law 31814, promulgated on 4 July 2023 and published on 5 July 2023, declares AI development of national interest and frames its use within Peru's digital transformation process. It sets principles such as risk-based safety, ethics, transparency and multi-stakeholder participation, and designates the PCM's digital government secretariat as the national AI authority. The law is promotional in character and left detailed obligations to a later regulation.

Nepal Privacy Act 2075

Individual Privacy Act, 2075 (2018) — Nepal

The Individual Privacy Act 2075 gives effect to the constitutional right to privacy in Nepal. It regulates the collection, storage, processing, use and disclosure of personal information by public bodies and private entities, requires consent for collection and use of personal data subject to exceptions, restricts sensitive data, and provides remedies and penalties. It is the main binding law affecting AI systems that process personal data in Nepal. The Individual Privacy Regulation 2077 (2020) provides implementing rules.

Law No. 132/2025 on artificial intelligence

Legge 23 settembre 2025, n. 132 – Disposizioni e deleghe al Governo in materia di intelligenza artificiale

Italy's framework AI law, published in the Official Gazette on 25 September 2025 and in force from 10 October 2025. It states principles (human-centric, transparent, safe AI; protection of fundamental rights), sets sector rules for healthcare (AI as support, not replacement, for clinical decisions), employment (information to workers, an AI-at-work observatory), intellectual professions (client disclosure), justice (judge decides; AI only for organisational support) and public administration, requires parental consent for children under 14, designates AgID and ACN as national authorities, delegates the government to align national law with the EU AI Act, and creates a criminal offence for unlawful dissemination of AI-generated or manipulated content with aggravating circumstances for other crimes committed with AI.

Act on Promotion of Research and Development, and Utilization of Artificial Intelligence-related Technology

Act on Promotion of Research and Development, and Utilization of Artificial Intelligence-related Technology (Act No. 53 of 2025)

Japan's first AI-specific statute establishes basic principles and a governmental framework for promoting AI research, development and use. It creates an AI Strategy Headquarters under the Cabinet, requires the government to adopt an AI Basic Plan, and provides for guidelines, information gathering and investigation of cases where AI infringes rights, together with guidance to businesses and the public. Businesses are asked to cooperate with government measures; the Act contains no fines or prohibitions.

Law on Artificial Intelligence (2025)

Law of the Republic of Kazakhstan "On Artificial Intelligence" (signed November 2025)

The law defines AI systems and their classification by level of autonomy and risk, sets principles (legality, fairness, transparency, safety, human control), assigns duties to owners and operators of AI systems including risk management, labelling of AI-generated content and protection of personal data, prohibits certain manipulative and social-scoring uses, provides for a national AI platform and state support measures, and allocates state regulation to the authorised body.

Law 4961/2022 (emerging technologies, AI chapter)

Νόμος 4961/2022: Αναδυόμενες τεχνολογίες πληροφορικής και επικοινωνιών, ενίσχυση της ψηφιακής διακυβέρνησης και άλλες διατάξεις

Law 4961/2022, published in July 2022, contains a chapter on artificial intelligence: public-sector bodies must carry out an algorithmic impact assessment and publish information before deploying AI systems that affect people, keep a register of AI systems, and ensure the Hellenic Data Protection Authority's oversight; medium and large private companies must inform workers about AI systems used in employment decisions and maintain an ethical-use policy. It also regulates IoT, 3D printing, blockchain and unmanned aircraft.

India DPDP Act

Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025

The DPDP Act is India's cross-sector personal-data law. It applies to digital personal data processed in India and to processing outside India connected with offering goods or services to people in India. It requires a lawful basis (consent or specified legitimate uses), notice, purpose limitation, data accuracy, security safeguards, breach notification to the Data Protection Board and affected individuals, and grants rights of access, correction, erasure and grievance redress. Significant Data Fiduciaries face extra duties such as impact assessments and audits. The Act does not mention AI specifically, but it governs the personal data used to train and operate AI systems.

Surat Edaran Menteri Komunikasi dan Informatika Nomor 9 Tahun 2023 tentang Etika Kecerdasan Artifisial

Surat Edaran Menteri Komunikasi dan Informatika Nomor 9 Tahun 2023 tentang Etika Kecerdasan Artifisial (Circular Letter No. 9 of 2023 on AI Ethics)

A ministerial circular that lays out ethical values for developing and using AI, such as inclusivity, humanity, security, accessibility, transparency, accountability, personal data protection, sustainability and respect for intellectual property. It applies to AI-related businesses and to public and private electronic system operators in Indonesia. It is soft-law guidance intended as a basis for future regulation.

AI Act implementation act (KI-MIG, draft)

Entwurf eines Gesetzes zur Durchführung der KI-Verordnung (KI-Marktüberwachungs- und Innovationsförderungsgesetz, KI-MIG)

The draft implementation act designates the Bundesnetzagentur as the central market-surveillance authority and single point of contact under the EU AI Act, keeps sector regulators (financial supervision, data protection for law-enforcement uses) competent in their fields, sets the national penalty framework within the Regulation's ranges and creates a national AI regulatory sandbox and an AI service desk for companies.

Law for the Promotion of AI and Emerging Technologies

Ley para el Fomento de la Inteligencia Artificial y Tecnologías Emergentes (Decreto Legislativo, febrero de 2025)

Approved by the Legislative Assembly in February 2025, the law promotes AI development and investment, creates the National Agency for Artificial Intelligence (ANIA) as regulator, defines rights and principles (human oversight, transparency, non-discrimination, data protection), sets registration and sandbox mechanisms and limits liability of developers who act in good faith under the law, alongside data-processing rules for AI training.

EU AI Act

Regulation (EU) 2024/1689 — Artificial Intelligence Act

The EU AI Act is a binding regulation that sets rules for developing, placing on the market and using AI systems in the European Union. It bans a small set of practices considered unacceptable, imposes detailed requirements on "high-risk" AI systems used in areas such as employment, education, credit, essential services, law enforcement and safety-critical products, requires transparency for chatbots and synthetic content, and creates separate duties for providers of general-purpose AI models. Obligations apply in phases between 2025 and 2027.

Draft Organic Law on AI

Proyecto de Ley Orgánica de Regulación y Promoción de la Inteligencia Artificial

The draft organic law proposes principles for AI (human-centric, transparency, non-discrimination, safety), a risk-based classification with prohibited and high-risk uses, obligations for developers and deployers, a national AI authority and sanctions, drawing on the EU AI Act and UNESCO recommendation.

Ontario Enhancing Digital Security and Trust Act, 2024 (Bill 194)

Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024 (Bill 194), Schedule 1: Enhancing Digital Security and Trust Act, 2024

The Act allows the Ontario government to make regulations governing the use of AI systems by public-sector entities (ministries, agencies, hospitals, school boards, municipalities as prescribed): requirements to disclose AI use, to develop and implement accountability frameworks, to take steps to manage risks, to have human oversight, and prohibitions on prescribed uses. It also addresses cyber security and children's digital information.

Ontario Working for Workers Four Act (AI disclosure in job postings)

Working for Workers Four Act, 2024 (Bill 149): disclosure of artificial intelligence use in publicly advertised job postings

Amends the Employment Standards Act, 2000 to require employers with 25 or more employees to disclose in every publicly advertised job posting whether artificial intelligence is used to screen, assess or select applicants, alongside new rules on salary ranges and Canadian-experience requirements. The AI disclosure requirement is in force from 1 January 2026.

Quebec Law 25 (automated decisions and biometrics)

Quebec Law 25 (S.Q. 2021, c. 25): provisions on decisions based exclusively on automated processing and biometric systems

Section 12.1 of the private-sector privacy act (as amended by Law 25, in force 22 September 2023) requires any enterprise that uses personal information to render a decision based exclusively on automated processing to inform the person no later than when the decision is made, and, on request, to tell them what personal information was used, the reasons and principal factors and parameters, and their right to have the information corrected, and to give them an opportunity to submit observations to a person who can review the decision. Biometric identification databases must be declared to the Commission d'accès à l'information 60 days before use, and privacy impact assessments are mandatory for projects involving personal information. Penalties reach CAD 25 million or 4% of worldwide turnover.

Framework Convention on AI (CETS 225)

Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225)

The first international treaty on AI. Parties must adopt or maintain measures so that activities within the lifecycle of AI systems are consistent with human rights, democracy and the rule of law, covering public authorities and actors on their behalf and, by choice of approach, private actors. It sets principles (human dignity and autonomy, transparency and oversight, accountability, equality and non-discrimination, privacy, reliability, safe innovation), requires remedies, procedural safeguards and risk and impact assessment, allows moratoria or bans for incompatible uses, and creates a Conference of the Parties for follow-up. National-security activities and defence are excluded.

Measures for Labeling Artificial Intelligence-Generated and Synthetic Content

These measures require providers of AI generation and synthesis services to attach explicit labels (visible text, audio or graphic notices) and implicit labels (embedded metadata) to generated text, images, audio, video and virtual scenes. Platforms distributing content must check for and preserve labels, users must declare AI-generated material, and removing or forging labels is prohibited. Compliance is checked during algorithm filing and security assessments. The measures took effect on 1 September 2025.

Interim Measures for the Management of Generative Artificial Intelligence Services

These measures govern generative AI services offered to the public in China, whether producing text, images, audio or video. Providers must use lawfully sourced training data, take steps against discrimination, protect personal information, label generated content, handle user complaints and ensure outputs comply with content rules. Services with public-opinion or social-mobilisation capacity must complete security assessments and algorithm filing. The measures took effect on 15 August 2023.