United States
·
Framework
Voluntary standard
NIST AI Risk Management Framework (AI RMF 1.0) and Generative AI Profile
The NIST AI Risk Management Framework is a voluntary framework for managing risks to individuals, organisations and society from AI. It organises practices into four functions: Govern, Map, Measure and Manage, and describes characteristics of trustworthy AI such as validity, safety, security, accountability, explainability, privacy and fairness. The July 2024 Generative AI Profile (NIST AI 600-1) adds risks and suggested actions specific to generative AI. Many US procurement requirements and state laws reference the framework as a recognised approach.
Adopted 26 Jan 2023
Source-linked
Official source
United Kingdom
·
Guidance
Guidance
ICO Guidance on AI and data protection
The ICO's guidance explains how UK GDPR and the Data Protection Act 2018 apply when organisations develop or use AI that processes personal data. It covers accountability and governance, lawfulness and fairness, transparency, data minimisation, security, individual rights, and automated decision-making. The guidance is not itself law, but it reflects how the regulator interprets binding obligations and is the reference point in ICO enforcement.
United Kingdom
·
Policy
Guidance
A pro-innovation approach to AI regulation (white paper and government response)
The UK white paper sets out a principles-based, context-specific approach to regulating AI. Instead of a single AI law, it asks existing regulators to interpret and apply five cross-cutting principles within their remits: safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; and contestability and redress. Central government provides coordination, monitoring and guidance.
Adopted 29 Mar 2023
Source-linked
Official source
Colorado (United States)
·
Act / statute
Adopted
Binding
Colorado Senate Bill 24-205: Consumer Protections for Artificial Intelligence (Colorado AI Act)
The Colorado AI Act requires developers and deployers of high-risk AI systems to use reasonable care to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination. High-risk systems are those that make, or are a substantial factor in making, consequential decisions about education, employment, financial or lending services, essential government services, healthcare, housing, insurance or legal services. Deployers must run risk-management programmes and impact assessments, notify consumers, and explain adverse decisions; developers must document systems and disclose known risks.
Applies from 30 Jun 2026
Source-linked
Official source
United Arab Emirates
·
Act / statute
In force
Binding
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)
The UAE Personal Data Protection Law is the federal data-protection law applying outside the DIFC and ADGM free zones. It sets principles for lawful processing, consent and its exceptions, data-subject rights (including the right to object to automated decision-making without human intervention), controller and processor duties, security and breach notification to the UAE Data Office, cross-border transfer rules, and data protection impact assessments for high-risk processing including new technologies.
In force 2 Jan 2022
Source-linked
Official source
Singapore
·
Guidance
Guidance
PDPC Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems
These advisory guidelines explain how the Personal Data Protection Act applies when organisations use personal data to develop, test and deploy AI systems that make recommendations, predictions or decisions. They clarify the consent obligation and relevant exceptions (business improvement and research), what to include in notifications to individuals, accountability practices such as documenting data provenance and model development, and expectations for service providers building bespoke AI systems.
Adopted 1 Mar 2024
Source-linked
Official source
Singapore
·
Framework
Voluntary standard
Model AI Governance Framework (Second Edition) and Model AI Governance Framework for Generative AI
Singapore's Model AI Governance Framework is a voluntary, sector-agnostic guide for organisations deploying AI. The second edition (January 2020) covers four areas: internal governance structures and measures, determining the level of human involvement in AI-augmented decision-making, operations management (data, model development, monitoring), and stakeholder interaction and communication. The May 2024 Model AI Governance Framework for Generative AI extends it with nine dimensions including accountability, data, trusted development and deployment, incident reporting, testing and assurance, security, content provenance, safety and alignment research, and AI for the public good.
Adopted 21 Jan 2020
Source-linked
Official source
Nepal
·
Act / statute
In force
Binding
Individual Privacy Act, 2075 (2018) — Nepal
The Individual Privacy Act 2075 gives effect to the constitutional right to privacy in Nepal. It regulates the collection, storage, processing, use and disclosure of personal information by public bodies and private entities, requires consent for collection and use of personal data subject to exceptions, restricts sensitive data, and provides remedies and penalties. It is the main binding law affecting AI systems that process personal data in Nepal. The Individual Privacy Regulation 2077 (2020) provides implementing rules.
In force 18 Sep 2018
Source-linked
Official source
India
·
Act / statute
Partially applicable
Binding
Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025
The DPDP Act is India's cross-sector personal-data law. It applies to digital personal data processed in India and to processing outside India connected with offering goods or services to people in India. It requires a lawful basis (consent or specified legitimate uses), notice, purpose limitation, data accuracy, security safeguards, breach notification to the Data Protection Board and affected individuals, and grants rights of access, correction, erasure and grievance redress. Significant Data Fiduciaries face extra duties such as impact assessments and audits. The Act does not mention AI specifically, but it governs the personal data used to train and operate AI systems.
Adopted 11 Aug 2023
Source-linked
Official source
European Union
·
Regulation
Partially applicable
Binding
Regulation (EU) 2024/1689 — Artificial Intelligence Act
The EU AI Act is a binding regulation that sets rules for developing, placing on the market and using AI systems in the European Union. It bans a small set of practices considered unacceptable, imposes detailed requirements on "high-risk" AI systems used in areas such as employment, education, credit, essential services, law enforcement and safety-critical products, requires transparency for chatbots and synthetic content, and creates separate duties for providers of general-purpose AI models. Obligations apply in phases between 2025 and 2027.
Applies from 2 Aug 2026
Source-linked
Official source
Quebec (Canada)
·
Act / statute
In force
Binding
Quebec Law 25 (S.Q. 2021, c. 25): provisions on decisions based exclusively on automated processing and biometric systems
Section 12.1 of the private-sector privacy act (as amended by Law 25, in force 22 September 2023) requires any enterprise that uses personal information to render a decision based exclusively on automated processing to inform the person no later than when the decision is made, and, on request, to tell them what personal information was used, the reasons and principal factors and parameters, and their right to have the information corrected, and to give them an opportunity to submit observations to a person who can review the decision. Biometric identification databases must be declared to the Commission d'accès à l'information 60 days before use, and privacy impact assessments are mandatory for projects involving personal information. Penalties reach CAD 25 million or 4% of worldwide turnover.
Applies from 22 Sep 2023
Source-linked · checked 11 Sep 2026
Official source
Australia
·
Consultation
Under consultation
Proposals paper: introducing mandatory guardrails for AI in high-risk settings (Australia)
The proposals paper sought views on ten mandatory guardrails for developers and deployers of AI in high-risk settings, a principles-based definition of high-risk AI (with general-purpose AI treated as high-risk), and three regulatory options: adapting existing laws, framework legislation, or a new cross-economy AI Act. The guardrails mirror the Voluntary AI Safety Standard, covering accountability, risk management, data governance, testing, human control, transparency, contestability, supply-chain transparency, records, and conformity assessment.
Australia
·
Standard
Voluntary standard
Voluntary AI Safety Standard (Australia)
The Voluntary AI Safety Standard gives Australian organisations ten guardrails for developing and deploying AI safely and responsibly: accountability and governance, risk management, data governance and protection, testing and monitoring, human control and intervention, user transparency, contestability, supply-chain transparency, record keeping, and stakeholder engagement. The guardrails were designed to align with the mandatory guardrails proposed for high-risk settings so that early adopters would be prepared if those became law.
Adopted 5 Sep 2024
Source-linked
Official source
