Know which AI rules apply to you — and level up

European Union

The EU AI Act is the first comprehensive AI law. It bans a short list of practices (social scoring, manipulative systems, most real-time public biometric ID), imposes strict duties on 'high-risk' uses such as hiring and credit scoring, sets transparency rules for chatbots and synthetic media, and regulates general-purpose AI models. It applies in stages from 2025 to 2028. The 2026 Digital Omnibus pushed the high-risk deadlines back and softened the AI-literacy duty.

European Union

The Digital Omnibus on AI is the first amendment to the EU AI Act. Proposed in November 2025 and in force since 27 July 2026, it delays the high-risk obligations (Annex III to 2 December 2027, Annex I to 2 August 2028), gives generative systems already on the market until 2 December 2026 to add machine-readable marking, adds two prohibitions on AI that generates child sexual abuse material or non-consensual intimate imagery, replaces the AI-literacy article with a softer 'support' duty, and extends SME relief to small mid-caps.

European Union

The GDPR is the EU's general privacy law and the one most often enforced against AI so far. Personal data needs a legal basis, transparency and purpose limits, whether it feeds model training, prompts or outputs. Article 22 gives people the right not to be subject to solely automated decisions with legal or similarly significant effects, and Article 35 requires a data protection impact assessment (DPIA) before high-risk processing such as profiling or large-scale monitoring.

United States (federal)

EO 14365 (11 December 2025) declares a federal policy of one 'minimally burdensome' national AI framework and targets the state-by-state patchwork. It creates a DOJ task force to sue states over conflicting AI laws, tells Commerce to list 'onerous' state laws, asks the FTC to say when state rules forcing AI to 'alter truthful outputs' are preempted, ties some broadband (BEAD) funding to state AI policy, and calls for preemption legislation. Child safety, data centres and state procurement are carved out. It creates no direct duties for businesses.

United States · Texas

TRAIGA took effect on 1 January 2026. Instead of a broad high-risk regime, it bans AI built or used with intent to manipulate people into self-harm or crime, to discriminate unlawfully, to run government social scoring or biometric identification, or to make sexual deepfakes and CSAM. Government agencies must tell people when they interact with AI; healthcare providers must disclose AI used in treatment. The Attorney General enforces it after a 60-day cure period, there is no private right of action, and following NIST's AI RMF is a defence.

United States · Illinois

From 1 January 2026, Illinois employers may not use AI that has the effect of discriminating on the basis of a protected class in recruitment, hiring, promotion, training selection, discipline, discharge or terms of employment. Intent does not matter. Employers must notify applicants and employees when AI is used for those decisions and may not use zip codes as a proxy for protected classes. The Illinois Department of Human Rights proposed notice rules in May 2026 and then paused them, but the statutory duties apply regardless.

United States · California

From 1 January 2026, anyone who develops a generative AI system available to people in California must post a high-level summary of its training data on their website. The summary covers about a dozen points: dataset sources or owners, purpose, number and types of data points, whether copyrighted, licensed or personal information is included, cleaning steps, collection periods and synthetic data. It reaches back to systems released since January 2022, with narrow carve-outs for security, aviation and national-security systems. xAI has challenged the law in court.

United States · California

Operative since 2 August 2026, the AI Transparency Act requires large generative AI providers (over one million monthly users, accessible in California) to give users a free public tool to check whether image, video or audio content was AI-generated, to embed a 'latent' machine-readable disclosure in all such outputs, and to offer an optional visible 'manifest' disclosure. Licensees of the system must keep those features or lose their licence. AB 853 delayed the original January 2026 start and added duties for large online platforms (2027) and capture devices (2028).

United States · Colorado

Colorado repealed its landmark 2024 AI Act before it ever applied and replaced it with SB 26-189, effective 1 January 2027. The new law drops the duty-of-care and annual impact-assessment model and instead focuses on transparency: deployers must give notice before a covered ADMT influences a consequential decision, explain adverse decisions within 30 days, and let people correct data and request human review. Developers must give deployers documentation on intended use, training-data categories, limits and human-review instructions. The Attorney General enforces it exclusively.

United States · New York (state)

Since 5 July 2023, NYC employers and employment agencies may not use an automated employment decision tool (AEDT) to screen candidates for hire or promotion unless the tool has had an independent bias audit within the past year, a summary of the audit is published on their website, and candidates are told at least 10 business days in advance that the tool will be used, what it assesses, and how to request an alternative process. The audit reports selection or scoring rates by sex and race/ethnicity.

United States · Utah

Utah's AI Policy Act, in force since 1 May 2024, was the first US state generative-AI disclosure law. As amended in 2025, a business must clearly disclose that a person is interacting with generative AI when asked, and proactively in 'high-risk' interactions — those collecting sensitive data or giving financial, legal, medical or mental-health advice. Regulated professionals must disclose up front. Using AI is no defence to a consumer-protection breach. The Act created an Office of AI Policy and a sandbox and sunsets on 1 July 2027 unless renewed.

United States · New York (state)

The RAISE Act, signed in December 2025 and finalised by chapter amendment in March 2026, applies from 1 January 2027 to 'large frontier developers' — companies with over $500 million in annual revenue that train models above 10^26 operations. They must publish a frontier AI safety framework, report critical safety incidents to a new office in the Department of Financial Services within 72 hours of determining one occurred, and submit periodic risk assessments. It follows California's SB 53 model and is enforced by the Attorney General.

Canada (federal)

PIPEDA is Canada's federal private-sector privacy law. It has no AI-specific chapter, but its ten fair-information principles — accountability, identified purposes, consent, limited collection, limited use and retention, accuracy, safeguards, openness, access and challenge — apply to any AI that collects or uses personal data, from training on scraped data to automated decisions. The May 2026 joint findings on OpenAI confirmed that scraping personal data from the internet is not 'publicly available' information and needs a valid legal basis.

Canada (federal)

AIDA was Canada's proposed federal AI law, tabled in June 2022 as part of Bill C-27 alongside a new privacy act. It would have imposed risk-assessment, mitigation, monitoring and record-keeping duties on 'high-impact' AI systems, with a new AI and Data Commissioner. The bill stalled in committee and died when Parliament was prorogued on 6 January 2025. Canada currently has no federal AI-specific statute; PIPEDA, provincial privacy laws, human-rights law and the voluntary generative-AI code fill the gap.

Canada · Quebec

Quebec's Law 25 modernised the province's private-sector privacy law with GDPR-style duties. Three rules matter most for AI. When a decision about a person is made exclusively by automated processing, you must tell them by the time of the decision and, on request, explain the information and main factors used, let them correct data and make representations to a human. When technology profiles, locates or identifies people, you must say so and offer to deactivate it. A privacy impact assessment is required for new systems handling personal information.

Canada · Ontario

From 1 January 2026, Ontario employers with 25 or more employees must state in every publicly advertised job posting whether artificial intelligence is used to screen, assess or select applicants. The same law requires pay ranges, a statement on whether the posting is for an existing vacancy, no 'Canadian experience' requirements, follow-up with interviewed candidates within 45 days, and retention of postings and application forms for three years. 'AI' is defined broadly as a machine-based system that infers from inputs to produce predictions, recommendations or decisions.

Canada (federal)

The Directive governs how federal departments use automated systems to make or support administrative decisions about people. Before launching a system, a department must complete and publish an Algorithmic Impact Assessment that scores the system into one of four impact levels; higher levels trigger peer review, human-in-the-loop decision-making, more testing and monitoring. Plain-language notices, explanations of decisions, bias testing and data-governance duties apply. The 2023 amendments extended it to internal services such as hiring and required the AIA to be published before launch.

Canada (federal)

Launched in September 2023 while AIDA was still before Parliament, the Code sets out six outcomes that signatories commit to for advanced generative AI: accountability, safety, fairness and equity, transparency, human oversight and monitoring, and validity and robustness. Developers commit to risk assessments, red-teaming, content provenance measures and publishing capabilities and limits; managers commit to monitoring after deployment. With AIDA dead, the Code is currently Canada's main federal statement of expected practice for generative AI, and ISED lists around 50 signatories.

International standard

The NIST AI RMF is a free, voluntary US framework for managing AI risk across the lifecycle, built on four functions: Govern (policies and accountability), Map (context and risks), Measure (testing and metrics) and Manage (prioritising and responding). The 2024 Generative AI Profile adds about 200 suggested actions for twelve generative-AI risks such as confabulation, data privacy, provenance, bias and harmful content. It is the most common reference point in US state laws and contracts, and a practical starting point for SMBs that need a defensible programme.

International standard

ISO/IEC 42001 is the first certifiable international standard for an AI management system (AIMS). Like ISO 27001 for security, it asks an organisation to set AI policy and objectives, assess AI risks and impacts, assign roles, control the AI lifecycle and suppliers, and improve continually, with an Annex A of controls. Certification involves a two-stage audit and annual surveillance. It does not make you legally compliant by itself, but it maps well onto EU AI Act quality-management and documentation duties and is increasingly requested in procurement.