AI Regulations by Jurisdiction
Where each major AI law actually stands right now — enacted, proposed, or stalled — tracked jurisdiction by jurisdiction and kept current in place.
"AI regulation" isn't one law you can read once and be done with. It's a different statute in every jurisdiction, moving at a different pace, using different definitions of the same underlying idea — and the gap between what a law says on paper and what's actually being enforced is often the most important detail in the whole analysis.
This hub is organized by jurisdiction because that's how the obligations actually attach: a system that's high-risk under the EU AI Act may sit entirely outside a comparable U.S. state law's scope, and a company operating in three of our four target markets is really managing three or four independent compliance programs that happen to overlap in places.
Every regulation page here carries a status — proposed, enacted, in force, amended, or repealed — and a last-reviewed date that's tied to an actual review, not a decorative timestamp. When a tracked law changes, we update the page in place rather than burying the change in a separate news post you'd have to go find.
Jurisdictions
EU AI Regulations
The EU AI Act is the most comprehensive AI-specific law in force anywhere, phasing in on a multi-year schedule — here's where it actually stands today.
US AI Regulations
No federal AI statute yet — instead, a fast-growing patchwork of state laws, agency guidance, and sector-specific rules that a compliance program has to track state by state.
UK AI Regulations
The UK has deliberately avoided a single AI statute in favor of empowering existing sector regulators to apply a shared set of principles within their own remits.
Canada AI Regulations
Canada's federal AI bill has stalled in Parliament — provincial privacy regulators and existing federal law are doing most of the practical work in the meantime.
Australia AI Regulations
Australia dropped its plan for a standalone AI act and mandatory guardrails in December 2025. Existing law applies, and automated decision-making transparency rules under the Privacy Act start on December 10, 2026.
Recently updated
US employers using AI in hiring face existing federal civil rights law plus city and state rules: NYC Local Law 144's bias audits, Illinois HB 3773's notice duty, California's automated-decision regulations, and Colorado's new automated decision-making law. This checklist maps what each requires and what to do first.
Governome Editorial Team · 4 min read
Article 26 sets the obligations of deployers of high-risk AI systems: use the system per the provider's instructions, assign competent human oversight, monitor and report incidents, keep logs for at least six months, and tell workers and affected people. Here is what each paragraph requires and when it applies.
Governome Editorial Team · 4 min read
Article 27 requires certain deployers of high-risk AI systems, including public bodies, private entities providing public services, and deployers of some credit and insurance systems, to assess the impact on fundamental rights before first use. Here is who must do it, the six required elements, and how it relates to a GDPR DPIA.
Governome Editorial Team · 4 min read
regulations us
Massachusetts AI Regulatory Guidance: What Exists Today
There's no Massachusetts AI Act to check against, and there may not be one for a while. What there is: an Attorney General's advisory applying consumer protection, anti-discrimination, and data security law directly to AI systems, a state policy governing how executive branch agencies use generative AI internally, and a frontier-AI safety bill reconciling between the House and Senate. Here's what's actually binding today, what isn't, and what to watch.
Governome Editorial Team · 8 min read
regulations us
Washington State AI Regulations: Current Status
There's no single 'Washington AI law' to check compliance against. The My Health My Data Act, a 2020 government facial-recognition statute, and two new 2026 laws on companion chatbots and AI content provenance each reach AI products through a different trigger. A fifth, on AI in health-insurance prior authorization, is already in force. Here's what each one actually requires.
Governome Editorial Team · 8 min read
SB 2, the duty-of-care bill compliance teams have tracked since 2024, failed twice and was shelved. What's actually in force is SB 5 (Public Act 26-15), a four-track statute with obligations phasing in from October 2026 through January 2028. Here's what each track requires and when.
Governome Editorial Team · 8 min read
regulations us
New York AI Regulations Beyond NYC Local Law 144
NYC Local Law 144 only reaches automated hiring and promotion tools used inside New York City. Separately, New York State has enacted the RAISE Act, the AI Companion Models Law, the Algorithmic Pricing Disclosure Act, and NYDFS Circular Letter No. 7 — four instruments covering frontier AI safety, companion chatbots, personalized pricing, and insurance underwriting. Here's what each one actually requires.
Governome Editorial Team · 8 min read
regulations us
Utah AI Policy Act: A Practical Breakdown
Utah regulates AI through disclosure, not a duty of care. SB 149 set the baseline in 2024; SB 226 narrowed and added a safe harbor in 2025; a separate law, HB 452, covers mental health chatbots on its own terms. Here's what each actually requires.
Governome Editorial Team · 9 min read
BIPA (2008) regulates biometric data regardless of AI, and HB 3773 (2024) regulates AI in employment decisions regardless of biometrics. Here's what each actually requires, where HB 3773's implementing rules currently stand, and the one place the two statutes overlap.
Governome Editorial Team · 7 min read
regulations us
Texas AI Regulations (TRAIGA): What's Actually Required
TRAIGA (HB 149) took effect January 1, 2026, with a prohibited-practices list and an intent-based liability standard that's deliberately harder to trigger than the reasonable-care duty in Colorado's original AI Act. Here's who it covers, what it bans, and how enforcement actually works.
Governome Editorial Team · 9 min read
There's no single federal AI procurement law. OMB Memorandum M-25-22 governs most federal AI contracts today, a separate executive order adds ideological-neutrality terms for LLM vendors specifically, and a GSA contract clause meant to tie it together is still only a draft.
Governome Editorial Team · 8 min read
Teams look for 'the AI regulator' and don't find one, then assume nothing applies. Jurisdiction follows the underlying function — hiring, lending, marketing claims, investment advice, medical use, calling — and a single product can trigger more than one agency at once.
Governome Editorial Team · 7 min read
An executive order can't preempt state law by itself. Real preemption needs an act of Congress, a court ruling, or funding leverage coercive enough to force repeal — and the federal government's most advanced attempt at any of the three just got mooted by the state rewriting the law it was suing over.
Governome Editorial Team · 8 min read
Congress has introduced nearly 400 AI bills and passed none. The reason isn't simple gridlock — it's fragmented committee jurisdiction, a task force that recommended against one big law, and an unresolved fight over federal preemption that's now spilled into the courts.
Governome Editorial Team · 9 min read
regulations us
A History of US Federal AI Executive Orders
US federal AI policy has never come from a statute. It's come from a sequence of executive orders running from 2019 to 2025 — American AI leadership, then trustworthy government use, then a comprehensive safety order, then that order's rescission and replacement. Here's the full timeline, what each order actually required, and why none of it can outlast a change in administration the way a law would.
Governome Editorial Team · 9 min read
regulations us
FCC Rules on AI-Generated Robocalls and Voice Cloning
The FCC's February 2024 declaratory ruling confirmed that an AI-generated voice counts as an 'artificial voice' under the TCPA, closing an argument a political operative tried to use against a wave of AI-cloned robocalls. A separate rule requiring calls to disclose AI use is still pending, not in force.
Governome Editorial Team · 7 min read
regulations us
FDA's Regulatory Pathway for AI/ML-Based Medical Devices
AI-enabled medical software doesn't get its own FDA lane. It goes through the same device pathways as a stethoscope or an infusion pump, with one addition built for software that keeps learning after it ships — and a real threshold question of whether it's regulated as a device at all.
Governome Editorial Team · 9 min read
regulations us
SEC AI-Washing Enforcement: What Counts as a Violation
Four SEC cases so far — two investment advisers, a trading-fraud scheme, and a public company's SEC filings — show the agency doesn't need new legislation to charge AI-washing. It just applies the antifraud and disclosure rules that already existed to a specific, checkable capability claim that turned out to be false.
Governome Editorial Team · 8 min read
A machine-learning underwriting model that can't explain why it declined an application isn't a legal gray area. ECOA has required a specific, accurate reason since 1974, and the CFPB spent 2022 and 2023 explaining exactly how that applies to AI — before withdrawing the explanation, not the rule, in 2025.
Governome Editorial Team · 9 min read
regulations us
EEOC Guidance on AI in Employment Decisions, Explained
The EEOC's AI hiring guidance no longer exists on eeoc.gov. That doesn't mean algorithmic hiring discrimination became legal — it means the agency's own explanation of the law disappeared while the law itself stayed exactly as it was. Here's what the withdrawn guidance said, and what actually still applies.
Governome Editorial Team · 8 min read
There's no federal AI enforcement statute, yet the FTC has extracted settlements — including forced deletion of the AI models themselves — from companies making AI claims. Here's the legal theory behind 'algorithmic deception,' the real case record, and what actually crosses the line.
Governome Editorial Team · 9 min read
Article 2(7) of the EU AI Act states plainly that the Act applies without prejudice to the GDPR. The two regimes overlap on automated decision-making and impact assessments, but diverge on scope triggers, risk classification, and enforcement — and meeting one doesn't discharge the other.
Governome Editorial Team · 7 min read
The EU AI Act's General-Purpose AI Code of Practice gets covered as a headline — 'OpenAI and Anthropic signed a pledge' — when it's actually three chapters of specific, auditable commitments tied to Article 53 and 55 obligations. Here's what a signatory agrees to do, chapter by chapter, and what happens to a provider that skips it or signs only part.
Governome Editorial Team · 7 min read
The EU AI Act doesn't ask where your company is incorporated. Article 2 sets two independent triggers — placing an AI system on the EU market, and having its output used in the Union — and the second one catches non-EU companies with no EU office, no EU sale, and no EU contract at all. Here's how both triggers actually work, what genuinely takes a company out of scope, and what happens next once you're in it.
Governome Editorial Team · 8 min read
The EU AI Act's original phased schedule got rewritten mid-2026: the Digital Omnibus on AI pushed the high-risk-system deadline from August 2026 to December 2027, and the product-embedded high-risk deadline from August 2027 to August 2028. Article 5 prohibited practices, GPAI obligations, and the governance framework weren't touched. Here's what's actually in force right now, what moved, what didn't, and why.
Governome Editorial Team · 8 min read
regulations eu
EU AI Act Penalties: The Full Tiered Structure
EU AI Act fines aren't a single €35 million number. Article 99 defines three separate tiers by violation type, Article 101 sets a fourth track for general-purpose AI model providers enforced directly by the Commission, and Article 100 even reaches EU institutions themselves. Here's the full structure, including the SME inversion rule that changes real exposure by orders of magnitude.
Governome Editorial Team · 7 min read
regulations eu
The EU AI Office: What It Does and Why It Matters to You
The EU AI Office is a European Commission body with real fining power — but only over one specific category of company: providers of general-purpose AI models. Everyone else's high-risk obligations are enforced by their national market surveillance authority instead. Here's the actual jurisdiction map, the fine amounts, and how the Office differs from the AI Board, the Advisory Forum, and the Scientific Panel.
Governome Editorial Team · 7 min read
CE marking under Article 48 of the EU AI Act is the provider's own compliance signal, applied after conformity assessment — for most high-risk systems, with no external body involved at all. Here's what has to be visible, legible, and indelible, how digital marking works for software-delivered AI, and what importers have to verify before a marked system reaches the EU market.
Governome Editorial Team · 8 min read
Article 43 conformity assessment has two routes: internal control, which covers most high-risk systems and involves no external reviewer at all, and notified-body assessment, reserved for a narrow slice of biometric systems. Here's how each one actually works, what gets produced, and what forces a redo.
Governome Editorial Team · 7 min read
Articles 51 through 56 of the EU AI Act put a separate, model-level obligations track on any provider of a general-purpose AI model — documentation, copyright, and training-data transparency for everyone, with a further layer of testing and incident-reporting duties for the models classified as posing systemic risk. Here's exactly what applies to whom, and what open source does and doesn't exempt.
Governome Editorial Team · 9 min read
Article 10 requires documented data governance practices for training, validation, and testing data — provenance, bias examination, gap identification, and relevance to intended purpose — a materially different and broader standard than generic data cleaning. Here's what it actually covers.
Governome Editorial Team · 5 min read
Article 11 requires a technical documentation file, built before market placement and kept current, that lets regulators verify a high-risk system's compliance. Annex IV's scope is real, but the more expensive mistake is assembling it retroactively instead of incrementally — here's what's actually required.
Governome Editorial Team · 5 min read
Article 12 requires high-risk AI systems to automatically log events built for three specific purposes — risk identification, post-market monitoring, and deployer oversight — plus an extra minimum spec for remote biometric identification systems. Generic application logs rarely satisfy all three by accident.
Governome Editorial Team · 5 min read
Article 13 requires high-risk AI providers to produce instructions for use that let deployers interpret and correctly apply the system's output. It's routinely confused with end-user AI disclosure rules elsewhere in the Act — here's what it actually requires and why the distinction matters.
Governome Editorial Team · 6 min read
Article 14 requires human oversight measures that give a person real capability to understand, monitor, interpret, and override a high-risk AI system — not a procedural approval step. Here's the five specific capabilities the Act requires, including the automation-bias problem most teams never design for.
Governome Editorial Team · 5 min read
Article 15 requires high-risk AI systems to meet defined, maintained levels of accuracy, robustness, and cybersecurity — including AI-specific threats like data and model poisoning that a standard application security review typically doesn't test for. Here's what's actually required, and who tends to miss it.
Governome Editorial Team · 5 min read
Article 5 of the EU AI Act originally prohibited eight specific AI practices (two more have since been added) — social scoring, manipulative and exploitative AI, untargeted facial-recognition scraping, workplace emotion inference, and more — with no compliance path around them. It's also been in force since February 2025, earlier than almost everything else in the Act.
Governome Editorial Team · 8 min read
Article 9 requires high-risk AI providers to run a continuous risk management process across the system's entire lifecycle, not produce a one-time document. Here's what the process actually has to include, and the gap auditors flag most.
Governome Editorial Team · 7 min read
regulations australia
Australia AI Regulation
The National AI Plan (December 2025) dropped the proposed mandatory guardrails for high-risk AI and committed to relying on existing technology-neutral law. The most concrete new duty is the Privacy Act's automated decision-making transparency rule, in force from December 10, 2026.
Governome Editorial Team · 3 min read
regulations canada
Canada AI Regulation
Canada's proposed Artificial Intelligence and Data Act did not survive the federal legislative process. Here's what actually governs AI in Canada right now.
Governome Editorial Team · 2 min read
regulations uk
UK AI Regulation
The UK's pro-innovation approach empowers existing regulators like the FCA and ICO to apply shared AI principles within their own sectors, rather than passing a single comprehensive AI law.
Governome Editorial Team · 3 min read
regulations us california
California AI Regulations
California regulates AI through several parallel tracks rather than one comprehensive law: CPPA rulemaking on automated decision-making technology, generative AI disclosure statutes, and employment law amendments.
Governome Editorial Team · 4 min read
regulations us colorado
Colorado AI Act (SB 24-205 and SB 26-189)
SB 24-205 was repealed and reenacted by SB 26-189, signed May 14, 2026. The new law centers on notice, post-decision disclosure, human review, and record-keeping for automated decisions that affect consumers, with developer and deployer duties starting January 1, 2027.
Governome Editorial Team · 3 min read
regulations us
US Federal AI Regulation: What Actually Exists Today
There's no single federal AI law in the US. Here's what federal agencies have actually said about AI, and why existing law already covers more AI use cases than most companies assume.
Governome Editorial Team · 5 min read
regulations eu
The EU AI Act
The EU AI Act classifies AI systems into risk tiers and phases its obligations in on a multi-year schedule. Here's what's actually in force today, what's still phasing in, and how the risk tiers work.
Governome Editorial Team · 4 min read
Frequently asked questions
- Is there a single global AI law companies need to comply with?
- No. There's no global AI statute — every jurisdiction covered here has written (or is writing) its own law, with its own definitions, thresholds, and enforcement mechanism. The closest thing to international alignment is voluntary frameworks like the OECD AI Principles, which shape national laws but don't themselves create legal obligations.
- Which AI regulations are already in effect, not just proposed?
- The EU AI Act is the furthest along, with prohibitions and literacy obligations already applicable and high-risk provisions phasing in on a set schedule. Several U.S. states, including Colorado, have enacted AI-specific statutes with their own effective dates. Track the status badge on each jurisdiction page here rather than assuming — "passed" and "in force" are not the same thing, and the gap between them is often a year or more.
- Do I need to comply with the EU AI Act if my company isn't based in the EU?
- Often yes. Like the GDPR before it, the EU AI Act applies extraterritorially: if your AI system's output is used within the EU, you can fall within scope regardless of where your company is incorporated. This is one of the most commonly missed points in early compliance planning — see our EU AI Act coverage for the specific triggers.
- What's the difference between a regulation and a framework?
- A regulation is a binding law with a government enforcement mechanism behind it — the EU AI Act, a state statute. A framework, like the NIST AI RMF, is voluntary guidance with no legal force on its own, though regulators and courts increasingly point to frameworks as evidence of what "reasonable" AI risk management looks like. See our frameworks hub for that side of the picture.