AI Laws in Force Worldwide

Coming up

1. 1 Dec 2026
   ChileLey 21.719 que regula la protección y el tratamiento de los datos personales y crea la Agencia de Protección de Datos PersonalesGDPR-style rewrite of Ley 19.628: right not to be subject to solely automated decisions including profiling, new Agencia de Protección de Datos Personales, fines. Published 13 Dec 2024; applies from 1 Dec 2026 unless Boletín 18623-07 (filed 1 Sept 2026) moves the date to 1 Dec 2027. The Agency's council had not been appointed by the 1 June 2026 deadline.VerifiedLawOfficial document →Archived copy
2. 10 Dec 2026
   AustraliaPrivacy and Other Legislation Amendment Act 2024 (automated decision-making transparency, APPs 1.7-1.9)From 10 December 2026, privacy policies must disclose the personal information used and kinds of decisions made by programs that make or substantially contribute to decisions significantly affecting individuals; OAIC guidance issued 30 September 2026.VerifiedLawOfficial document →Archived copy
3. 1 Jan 2027
   United StatesColorado SB 26-189 (automated decision-making technology law replacing the Colorado AI Act)Narrower ADMT regime: consumer notice and disclosure duties for ADMT used in consequential decisions across seven domains; drops duty of care, risk programmes and annual impact assessments; voids indemnity clauses for a party's own discriminatory ADMT acts. Attorney General enforces.VerifiedLawOfficial document →Archived copy
4. 1 Jan 2027
   United StatesNew York Responsible AI Safety and Education (RAISE) Act (S6953B/A6453B, with 2026 chapter amendment)Large frontier developers must publish safety and security protocols and report safety incidents within 72 hours; chapter amendment signed 27 March 2026 aligns the law with California SB 53 and gives NYDFS rulemaking and enforcement powers.VerifiedLawOfficial document →

On one timeline

Every law

1. 11 Aug 2026
   PolandUstawa z dnia 3 lipca 2026 r. o systemach sztucznej inteligencji (Dz.U. 2026 poz. 1003)Implements the AI Act: creates KRiBSI to supervise the market, inspect (remotely by default), order withdrawal of non-compliant systems and impose administrative fines; regulatory sandboxes; excludes national defence; 127 articles. Cabinet 31 Mar 2026; Sejm passed 11 Jun 2026 (print 2443); Sejm accepted 24 of 25 Senate amendments 3 Jul 2026; published 27 Jul 2026. Some provisions from 28 Jul 2026, most chapters from 28 Oct 2026.VerifiedLawOfficial document →Archived copy
2. 2 Aug 2026
   United StatesCalifornia AI Transparency Act (SB 942, amended by AB 853)GenAI providers with >1m monthly California users must offer a free detection tool and embed latent provenance disclosures (optional visible labels) from 2 Aug 2026; AB 853 adds large-platform and GenAI hosting duties from 1 Jan 2027 and capture-device duties from 1 Jan 2028.VerifiedLawOfficial document →Archived copy
3. 31 Jul 2026
   IrelandRegulation of Artificial Intelligence Act 2026Gives domestic effect to the AI Act without adding obligations: establishes the AI Office of Ireland (CEO Paul Byrne; board first met 8 Sep 2026) as coordinator and single point of contact, designates sector regulators, sets investigation and sanction procedures, sandboxes and real-world testing. General Scheme Feb 2026; Bill published 17 Jun 2026 (10 Parts, 139 sections) and passed unamended under an accelerated process; signed 21 Jul 2026.VerifiedLawOfficial document →Archived copy
4. 29 Jul 2026
   GermanyGesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-Marktüberwachungsgesetz, KI-MIG)Implements the AI Act: Bundesnetzagentur as default market-surveillance authority and single point of contact with a coordination and competence centre; BaFin for financial firms; sector regulators for harmonised products; KI-Service Desk and sandbox support. Bundestag 11 Jun 2026, Bundesrat 10 Jul 2026, promulgated 28 Jul 2026.VerifiedLawOfficial document →Archived copy
5. 27 Jul 2026
   European UnionRegulation (EU) 2026/1744 of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 (Digital Omnibus on AI)Proposed 19 Nov 2025 (2025/0359(COD)); political deal April 2026. Delays Annex III high-risk obligations to 2 Dec 2027 and Annex I (product-embedded) to 2 Aug 2028; watermarking grace for systems already on the market to 2 Dec 2026; adds Art. 5 ban on AI 'nudifier' systems and CSAM generation from 2 Dec 2026; reported 2 Aug 2030 date for certain public-authority high-risk systems.VerifiedRegulationOfficial document →Archived copy
6. 15 Jul 2026
   ChinaInterim Measures for the Administration of Anthropomorphic AI Interaction Services (CAC/NDRC/MIIT/MPS/SAMR Order No. 21)AI companion services: no virtual partner/relative services to minors, guardian consent under 14, AI-disclosure and 2-hour usage reminders, security assessment at 1m registered or 100k monthly active users, algorithm filing.VerifiedRegulationOfficial document →Archived copy
7. 29 Jun 2026
   SingaporeOnline Safety (Relief and Accountability) Act 2025Creates a Commissioner of Online Safety and Online Safety Commission that can order takedowns or account restrictions, plus statutory torts against posters, administrators and platforms; first phase covers 5 of 13 harms (intimate image abuse, image-based child abuse, doxxing, online harassment, online stalking).VerifiedLawOfficial document →Archived copy
8. 2 Jun 2026
   United StatesExecutive Order 14409, Promoting Advanced Artificial Intelligence Innovation and SecurityAI cyber-defence priorities for federal systems, an industry AI cybersecurity clearinghouse, a voluntary arrangement for government access to covered frontier models up to 30 days before release, and DOJ priority on AI-enabled cybercrime. No licensing or pre-clearance.VerifiedExecutive orderOfficial document →Archived copy
9. 1 May 2026
   New ZealandPrivacy Amendment Act 2025 (new IPP 3A on indirect collection)Adds IPP 3A: agencies collecting personal information from someone other than the individual must take reasonable steps to tell the individual of the collection, its purpose, recipients and their access and correction rights; Part 2 technical amendments in force 24 Sept 2025; not retrospective.VerifiedLawOfficial document →Archived copy
10. 1 Mar 2026
    VietnamLaw on Artificial Intelligence (No. 134/2025/QH15)35 articles: three-tier risk classification, duties for high-risk AI with a list issued by the Prime Minister, prohibited practices, transparency and labelling of AI-generated content, a National AI Development Fund.VerifiedLawOfficial document →Archived copy
11. Mar 2026
    BrazilTSE Resolution 23.755/2026 (amends Resolution 23.610/2019 on electoral propaganda, AI rules for the 2026 elections)Labelling of synthetic content and an AI-declaration field for boosted ads; no new synthetic content altering candidates' image or voice from 72 hours before to 24 hours after the vote; AI systems may not recommend candidates, parties or votes; platforms jointly liable if they do not promptly remove unlabelled or prohibited content; judges may reverse the burden of proof.VerifiedRegulationApplies from Mar 2026Official document →Archived copy
12. 20 Feb 2026
    IndiaIT (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (G.S.R. 120(E)) on synthetically generated informationDefines synthetically generated audio-visual information; requires visible labels and provenance metadata, user declarations verified by significant social media intermediaries, 3-hour removal of unlawful content on official orders and 2-hour removal for non-consensual intimate imagery.VerifiedRegulationOfficial document →
13. 5 Feb 2026
    United KingdomData (Use and Access) Act 2025, section 80: automated decision-making (UK GDPR Articles 22A-22D)Replaces the general ban on solely automated significant decisions with a safeguards regime (information, representations, human intervention, right to contest); stricter for special category data.VerifiedLawOfficial document →Archived copy
14. 22 Jan 2026
    South KoreaEnforcement Decree of the AI Basic ActSets thresholds and procedures: high-impact AI criteria, labelling methods, a 10^26 FLOP training-compute threshold for safety duties, and domestic-representative triggers (KRW 1tn total revenue, KRW 10bn AI-service revenue or 1m average daily users).VerifiedRegulationOfficial document →Archived copy
15. 22 Jan 2026
    South KoreaFramework Act on the Development of Artificial Intelligence and Establishment of Trust (AI Basic Act), Act No. 20676High-impact AI duties (risk management, explanation, human oversight), notice and labelling for generative AI and deepfakes, safety duties above a compute threshold, domestic representative for large foreign providers.VerifiedLawOfficial document →
16. 14 Jan 2026
    TaiwanArtificial Intelligence Basic Act20 articles: seven governing principles, an Executive Yuan national AI strategy committee, a risk-classification framework to be set by the Ministry of Digital Affairs, and a duty on agencies to amend conflicting rules within two years; no direct penalties.VerifiedLawOfficial document →Archived copy
17. 9 Jan 2026
    United StatesDOJ Artificial Intelligence Litigation Task Force (Attorney General memorandum)Implements EO 14365. First action: DOJ moved to intervene on 24 April 2026 in xAI v. Weiser (D. Colo., 1:26-cv-01515) against the Colorado AI Act; no standalone DOJ suit against another state confirmed.VerifiedExecutive orderOfficial document →Archived copy
18. 1 Jan 2026
    VietnamLaw on Personal Data Protection (No. 91/2025/QH15)Comprehensive personal data protection law replacing Decree 13/2023; covers AI processing of personal data.VerifiedLawOfficial document →Archived copy
19. 1 Jan 2026
    VietnamLaw on Digital Technology Industry (No. 71/2025/QH15), AI chapterAI definition, principles for AI development and use, transparency duties, risk-based management and labelling of AI-generated products; incentive articles (11, 28, 29) applied from 1 Jul 2025.VerifiedLawOfficial document →Archived copy
20. 1 Jan 2026
    United StatesTexas HB 149, Texas Responsible Artificial Intelligence Governance Act (TRAIGA)Bans AI built to intentionally discriminate, incite self-harm or crime, or produce illegal deepfakes; limits government social scoring and biometric ID; government disclosure duties; 36-month regulatory sandbox; AI Council; AG has exclusive enforcement with cure period.VerifiedLawOfficial document →Archived copy
21. 1 Jan 2026
    United StatesIllinois HB 3773 (Public Act 103-0804), amending the Illinois Human Rights Act on AI in employmentCivil-rights violation for employers to use AI that has a discriminatory effect in hiring, promotion, discipline or discharge, or to use zip codes as a proxy; employers must notify workers of AI use; IDHR rulemaking on notice.VerifiedLawOfficial document →Archived copy
22. 1 Jan 2026
    United StatesCalifornia SB 53, Transparency in Frontier Artificial Intelligence Act (Chapter 138, Statutes of 2025)Frontier developers (>10^26 FLOP) must publish transparency reports; large developers (>$500m revenue) must publish safety frameworks; critical safety incidents to Cal OES within 15 days (24h if imminent harm); whistleblower protection; CalCompute.VerifiedLawOfficial document →Archived copy
23. 1 Jan 2026
    United StatesCCPA regulations on automated decisionmaking technology, risk assessments and cybersecurity audits (CPPA)ADMT that replaces or substantially replaces human decisions in significant decisions: pre-use notice, opt-out and access rights from 1 Jan 2027; risk assessments due by 31 Dec 2027; cybersecurity audits phased 2028-2030.VerifiedRegulationOfficial document →Archived copy
24. 1 Jan 2026
    United StatesCalifornia AB 2013, Generative AI Training Data Transparency (Chapter 817, Statutes of 2024)Developers of generative AI released since 2022 must post a high-level summary of training datasets (sources, copyright, personal data, licensing). xAI's preliminary injunction bid denied 4 March 2026; appeal pending at the Ninth Circuit.VerifiedLawOfficial document →Archived copy
25. 1 Jan 2026
    MalaysiaOnline Safety Act 2025 [Act 866]Applies to licensed application, content and network service providers; risk-based safety measures, child safeguards and user reporting tools; social media and messaging services with 8m+ users deemed licensed from 1 Jan 2026.VerifiedLawOfficial document →Archived copy
26. 1 Jan 2026
    FinlandAct on the Supervision of Certain Artificial Intelligence Systems (1377/2025), from government bill HE 46/2025Designates market surveillance authorities for prohibited and high-risk AI (decentralised model, about 15 regulators); Traficom as single point of contact; investigation, binding orders and administrative fines.VerifiedLawOfficial document →Archived copy
27. 1 Jan 2026
    ChinaDecision of the NPCSC on Amending the Cybersecurity Law (Presidential Order No. 61), adding Article 20 on AIFirst AI provision in national statute: state support for AI research, data and compute infrastructure, ethics rules, AI risk monitoring and safety supervision; also higher penalties and wider extraterritorial reach.VerifiedLawOfficial document →Archived copy
28. 1 Jan 2026
    United Arab EmiratesDIFC Data Protection Regulations, Regulation 10 (personal data processed through autonomous and semi-autonomous systems)DIFC free zone only: deployers (as controllers) and operators (as processors) of autonomous and semi-autonomous systems must give notice, follow design principles and limit purposes; high-risk processing requires a pre-deployment assessment, certification (valid up to three years) and an Autonomous Systems Officer. A June 2026 consultation proposes amendments and a new Regulation 11 on accreditation.VerifiedRegulationOfficial document →Archived copy
29. 11 Dec 2025
    United StatesExecutive Order 14365, Ensuring a National Policy Framework for Artificial IntelligenceCreates a DOJ AI Litigation Task Force to challenge state AI laws; Commerce to list 'onerous' state laws within 90 days; conditions BEAD non-deployment funds; FCC disclosure-standard proceeding; FTC preemption policy statement; legislative recommendation for a preemptive federal framework (child safety, data-centre and state procurement laws carved out).VerifiedExecutive orderOfficial document →Archived copy
30. 10 Dec 2025
    AustraliaOnline Safety Amendment (Social Media Minimum Age) Act 2024 (No. 127, 2024)Age-restricted social media platforms must take reasonable steps to stop under-16s holding accounts; age-assurance data cannot be reused without consent; enforced by eSafety.VerifiedLawOfficial document →Archived copy
31. 13 Nov 2025
    IndiaDigital Personal Data Protection Rules 2025 (G.S.R. 846(E))Phased commencement: Data Protection Board rules (Rules 1, 2, 17-21) on notification; consent managers (Rule 4) after 12 months; most obligations after 18 months (May 2027).VerifiedRegulationOfficial document →Archived copy
32. 13 Nov 2025
    IndiaDigital Personal Data Protection Act 2023Consent-based processing, data principal rights, duties on significant data fiduciaries; applies to personal data used in AI.VerifiedLawOfficial document →Archived copy
33. 3 Nov 2025
    New ZealandBiometric Processing Privacy Code 2025Binding rules for automated biometric verification, identification and categorisation (e.g. facial recognition): proportionality assessment, notification and limits on inferring sensitive traits. Applies to existing processing from 3 Aug 2026; Amendment No 1 (rule 3A etc.) applies from 1 May 2026 for newer processing.VerifiedRegulationOfficial document →Archived copy
34. 10 Oct 2025
    ItalyLegge 23 settembre 2025, n. 132 - Disposizioni e deleghe al Governo in materia di intelligenza artificialeFirst national AI framework law in the EU: principles for AI in health, work, justice and public administration; parental consent under 14; AgID/ACN governance; new deepfake offence (art. 612-quater c.p.); 12-month delegation for implementing decrees (deadline 10 Oct 2026).VerifiedLawOfficial document →
35. 19 Sep 2025
    NigeriaNDPA General Application and Implementation Directive (GAID) 2025Requires DPIAs before automated decision-making/profiling, biometrics and surveillance, ongoing monitoring of emerging-technology tools; replaces NDPR 2019.VerifiedRegulationOfficial document →Archived copy
36. 1 Sep 2025
    JapanAct on Promotion of Research, Development and Utilization of Artificial Intelligence-Related Technologies (Act No. 53 of 2025)Framework law: basic principles, duties of state and businesses to cooperate, AI Strategy Headquarters chaired by the Prime Minister, AI Basic Plan, government research and guidance on misuse; promulgated and partly in force 4 Jun 2025.VerifiedLawOfficial document →
37. 1 Sep 2025
    ChinaMeasures for Labelling AI-Generated and Synthetic ContentExplicit labels on AI text, audio, images, video and virtual scenes plus implicit metadata labels; platforms must check metadata and flag content; app stores must check labelling; ban on removing or forging labels.VerifiedRegulationOfficial document →Archived copy
38. 14 Aug 2025
    IsraelProtection of Privacy Law, Amendment 13Broadens personal data (online identifiers, location), 'especially sensitive' data category, privacy officer duties, higher administrative fines and stronger enforcement powers for the Privacy Protection Authority.VerifiedLawOfficial document →
39. 2 Aug 2025
    DenmarkAct on Supplementary Provisions to the Regulation on Artificial Intelligence (Law No. 467 of 14 May 2025)Designates competent authorities for prohibited practices (Art. 5); makes breaches of the prohibitions punishable by fine; information and inspection powers; publication of decisions; appeals only to courts.VerifiedLawOfficial document →
40. 19 May 2025
    United StatesTAKE IT DOWN Act (S.146, Public Law 119-12)Federal crime to knowingly publish non-consensual intimate images, including AI 'digital forgeries'; covered platforms must remove reported images within 48 hours (platform duty applied from 19 May 2026, FTC enforcing).VerifiedLawOfficial document →Archived copy
41. 25 Apr 2025
    BrazilLei 15.123/2025 (aggravated penalty for psychological violence against women using AI)Penal Code amendment increasing the penalty for psychological violence against women when committed with AI or technology that alters the victim's image or voice.VerifiedLawOfficial document →Archived copy
42. 21 Mar 2025
    MexicoLey Federal de Protección de Datos Personales en Posesión de los Particulares (2025)New private-sector data-protection law (DOF 20 March 2025) replacing the 2010 law; oversight moved from the dissolved INAI to the Secretaría Anticorrupción y Buen Gobierno; ARCO rights apply to automated processing. A 22 Sept 2026 initiative would require notice when personal data are processed by AI systems.VerifiedLawOfficial document →Archived copy
43. 23 Jan 2025
    United StatesExecutive Order 14179, Removing Barriers to American Leadership in Artificial IntelligenceSets policy of sustaining US AI dominance, orders review and rescission of actions taken under EO 14110, and required an AI Action Plan within 180 days.VerifiedExecutive orderOfficial document →Archived copy
44. 8 Dec 2024
    European UnionDirective (EU) 2024/2853 on liability for defective products (revised Product Liability Directive)Repeals Directive 85/374/EEC and brings software, including AI systems, within strict no-fault product liability (non-commercial open-source software excluded); manufacturers stay liable for defects from updates or machine learning they control; damage includes destroyed or corrupted non-professional data; presumptions of defect and causation ease the burden of proof. Published in the OJ 18 Nov 2024; member states must transpose by 9 Dec 2026 and it applies to products placed on the market after that date. The separate AI Liability Directive proposal was withdrawn.VerifiedLawOfficial document →Archived copy
45. 17 Oct 2024
    IndonesiaLaw No. 27 of 2022 on Personal Data ProtectionData subject rights incl. objection to decisions based solely on automated processing.VerifiedLawOfficial document →Archived copy
46. Oct 2024
    South KoreaAct on Special Cases Concerning the Punishment of Sexual Crimes amendment (sexual deepfakes)Criminalises possessing, buying, storing or viewing sexually explicit deepfakes; raises the maximum sentence for creating them to seven years.VerifiedLawApplies from Oct 2024Official document →
47. 3 Sep 2024
    AustraliaCriminal Code Amendment (Deepfake Sexual Material) Act 2024 (No. 78, 2024)Offence of transmitting sexual material depicting a real adult without consent, whether real or created/altered with technology; aggravated offences for creators.VerifiedLawOfficial document →
48. 1 Aug 2024
    FinlandEU AI Act (Regulation (EU) 2024/1689)Directly applicable: prohibitions and AI literacy from Feb 2025, GPAI duties from Aug 2025; Annex III high-risk duties moved to 2 Dec 2027 by the Digital Omnibus.VerifiedRegulationOfficial document →Archived copy
49. 1 Aug 2024
    European UnionRegulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (AI Act)Risk tiers. Prohibitions and AI literacy apply from 2 Feb 2025; GPAI obligations, governance and penalty rules from 2 Aug 2025; Art. 50 transparency and Commission GPAI enforcement powers from 2 Aug 2026; high-risk dates as amended by Regulation 2026/1744 (Annex III 2 Dec 2027, Annex I 2 Aug 2028).VerifiedRegulationOfficial document →Archived copy
50. 1 Aug 2024
    DenmarkEU AI Act (Regulation (EU) 2024/1689)Directly applicable: prohibitions and AI literacy from Feb 2025, GPAI duties from Aug 2025; Annex III high-risk duties moved to 2 Dec 2027 by the Digital Omnibus.VerifiedRegulationOfficial document →Archived copy
51. 1 Aug 2024
    GermanyEU AI Act (Regulation (EU) 2024/1689) as amended by Regulation (EU) 2026/1744Directly applicable; Bundesnetzagentur states prohibitions and Art. 50 transparency are enforced now, Annex III high-risk from 2 Dec 2027, Annex I from 2 Aug 2028.VerifiedRegulationOfficial document →
52. 29 Jul 2024
    ArgentinaResolución 710/2024, Ministerio de Seguridad (Unidad de Inteligencia Artificial Aplicada a la Seguridad)Creates the Unidad de Inteligencia Artificial Aplicada a la Seguridad within the cybercrime directorate, using AI to patrol open social networks, websites and the dark web and to analyse camera images with facial recognition; must comply with Ley 25.326; an opposition bill (4125-D-2024) seeks its annulment.VerifiedRegulationOfficial document →Archived copy
53. 23 May 2024
    FranceLoi n° 2024-449 du 21 mai 2024 visant à sécuriser et à réguler l'espace numérique (SREN)Rewrote Code pénal art. 226-8 to cover publishing algorithmically generated images or voice of a person without consent where the artificial nature is not obvious or stated, and created art. 226-8-1 on sexual deepfakes, punishable even if labelled; higher penalties when spread online. Also age-verification powers for Arcom, cloud-switching rules and DSA enforcement powers.VerifiedLawOfficial document →Archived copy
54. 1 May 2024
    United StatesUtah Artificial Intelligence Policy Act (SB 149 of 2024, amended by SB 226 and SB 332 of 2025)GenAI disclosure when a consumer asks, and proactive disclosure in high-risk interactions by regulated occupations; Office of AI Policy and regulatory learning lab; repeal date extended to 1 July 2027. 2026 frontier transparency bill HB 286 stalled.VerifiedLawOfficial document →Archived copy
55. 15 Mar 2024
    South KoreaPersonal Information Protection Act, Article 37-2 (rights on automated decisions)Data subjects may refuse, or ask for an explanation or review of, fully automated decisions that significantly affect their rights; controllers must disclose criteria and procedures. Refusal is limited where the decision was disclosed in advance via consent, contract or law.VerifiedLawOfficial document →
56. Mar 2024
    BrazilTSE Resolution 23.732/2024 (AI and deepfakes in electoral propaganda)Amended TSE Resolution 23.610/2019: bans deepfakes to harm or favour candidates, requires labelling of AI-generated campaign content (art. 9-B), regulates chatbots and platform duties; later amended for the 2026 election by Resolution 23.755/2026.VerifiedRegulationApplies from Mar 2024Official document →Archived copy
57. 31 Jan 2024
    United KingdomIntimate image offences: sharing (Online Safety Act 2023 s.188, SOA 2003 ss.66B-66D) and creating or requesting purported intimate images (Data (Use and Access) Act 2025 s.138, SOA 2003 ss.66E-66H)Sharing an intimate image, including a deepfake, without consent is an offence from 31 Jan 2024; creating or requesting a sexually explicit deepfake of an adult without consent is an offence from 6 Feb 2026.VerifiedLawOfficial document →Archived copy
58. 29 Jan 2024
    South KoreaPublic Official Election Act, Article 82-8 (deepfake campaign material)Bans realistic AI-generated campaign videos, images and audio in the 90 days before election day; outside that window such material must be labelled as AI-generated.VerifiedLawOfficial document →Archived copy
59. 22 Sep 2023
    CanadaQuebec Law 25 (Act to modernize legislative provisions as regards the protection of personal information), automated-decision provisionsSection 12.1 of Quebec's private-sector privacy Act (added by Law 25, in force 22 September 2023): organisations must tell individuals when a decision is based exclusively on automated processing, explain factors on request and allow review by a person.VerifiedLawOfficial document →Archived copy
60. 14 Sep 2023
    Saudi ArabiaPersonal Data Protection Law (Royal Decree M/19 of 1443H, amended by M/148 of 1444H)Consent, purpose limitation, transfer limits and data-subject rights for AI training and deployment; enforcement began 14 September 2024 after a one-year grace period.VerifiedLawOfficial document →Archived copy
61. 1 Sep 2023
    SwitzerlandRevised Federal Act on Data Protection (FADP, SR 235.1)Applies to AI processing of personal data. Art. 21: controllers must inform data subjects of decisions based exclusively on automated processing with legal or considerably adverse effects, let them state their view and request review by a natural person (exceptions for contracts and explicit consent); federal bodies must label such decisions.VerifiedLawOfficial document →Archived copy
62. 15 Aug 2023
    ChinaInterim Measures for the Management of Generative AI ServicesCovers public-facing generative AI in China: lawful training data and IP, content controls, labelling of images/video, user data protection, security assessment and algorithm filing for services with public-opinion attributes.VerifiedRegulationOfficial document →Archived copy
63. 12 Jun 2023
    NigeriaNigeria Data Protection Act, 2023Lawful-basis, DPIA and data-subject rights, including a right not to be subject to decisions based solely on automated processing with legal or similar effects (s.37).VerifiedLawOfficial document →Archived copy
64. Jun 2023
    TaiwanCivil Servants Election and Recall Act, Article 51-3 (and parallel amendment to the Presidential and Vice Presidential Election and Recall Act) on deepfakesCandidates may ask police to examine suspected deepfake audio or video of themselves; once confirmed, broadcasters and platforms must stop or remove it within two days and keep records for six months.VerifiedLawApplies from Jun 2023Official document →Archived copy
65. 10 Jan 2023
    ChinaProvisions on the Administration of Deep Synthesis of Internet Information Services (CAC/MIIT/MPS Order No. 12)Real-name verification, review of inputs and outputs, labelling of synthetic content, separate consent for face/voice editing, algorithm filing for deep synthesis services.VerifiedRegulationOfficial document →
66. 16 Nov 2022
    European UnionRegulation (EU) 2022/2065 (Digital Services Act)Fully applicable since 17 Feb 2024; very large online platforms and search engines (over 45m EU users) must assess and mitigate systemic risks; the Commission's March 2024 election guidelines ask those whose services can create or spread generative-AI content to label it, deepfakes included; recommender-system transparency.VerifiedRegulationOfficial document →Archived copy
67. 1 Mar 2022
    ChinaProvisions on the Management of Algorithmic Recommendation in Internet Information Services (CAC/MIIT/MPS/SAMR Order No. 9)Algorithm filing within 10 working days for services with public-opinion or social-mobilisation attributes, security assessment, opt-out of personalised recommendation, bans on manipulating rankings and unfair price discrimination.VerifiedRegulationOfficial document →Archived copy
68. 2 Jan 2022
    United Arab EmiratesFederal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL)Federal data-protection law (outside DIFC/ADGM free zones and sectoral health/credit regimes), published in Official Gazette No. 712 on 26 Sept 2021, including a right to object to decisions based solely on automated processing; UAE Data Office (Decree-Law 44/2021) is the regulator. Issuance of the executive regulations could not be confirmed from a primary source.VerifiedLawOfficial document →Archived copy
69. 1 Nov 2021
    ChinaPersonal Information Protection Law (2021), Article 24 on automated decision-makingAutomated decision-making must be transparent and fair with no unreasonable differential treatment on prices or terms; personalised push and marketing must offer a non-personalised option or easy opt-out; individuals may demand an explanation of, and refuse, solely automated decisions with a major effect on their rights. Art. 55 requires a prior impact assessment.VerifiedLawOfficial document →Archived copy
70. 2 Jun 2021
    MexicoLey Olimpia (federal decree amending the Ley General de Acceso de las Mujeres a una Vida Libre de Violencia and the Federal Penal Code)Recognises digital violence (Ley General, Chapter IV Ter, arts. 20 Quáter-20 Sexies) and creates the federal offence of violating sexual intimacy (Federal Penal Code arts. 199 Octies-199 Decies: sharing, recording or producing intimate images, video or audio without consent; the same penalties apply where the content attributed to a person does not actually depict them); authorities can order platforms to remove content; states had 180 days to align their laws.VerifiedLawOfficial document →Archived copy
71. 10 Feb 2021
    IrelandHarassment, Harmful Communications and Related Offences Act 2020 (Coco's Law)Criminalises distributing or threatening to distribute intimate images with intent to cause harm (s.2) and recording or distributing them without consent (s.3), plus threatening or grossly offensive communications (s.4); the explanatory memo to Bill 13 of 2026 states the Act does not extend to computer-generated fake images of identifiable people.VerifiedLawOfficial document →Archived copy
72. 14 Oct 2020
    EgyptPersonal Data Protection Law No. 151 of 2020 and its Executive Regulations (Decree No. 816 of 2025)Consent, licensing of controllers and processors, record-keeping, breach notification, cross-border transfer authorisation by the Personal Data Protection Centre, and data-subject rights that apply to AI data processing; executive regulations issued 1 Nov 2025 and in force from the day after publication, with about a one-year compliance window.VerifiedLawOfficial document →Archived copy
73. 18 Sep 2020
    BrazilLei Geral de Proteção de Dados (Lei 13.709/2018), Article 20 on automated decisionsRight to request review of decisions taken solely on automated processing that affect the data subject's interests, including profiling; controller must give information on criteria and procedures (subject to trade secrecy) and ANPD may audit for discrimination. Lei 13.853/2019 removed the original requirement that review be by a natural person.VerifiedLawOfficial document →Archived copy
74. 1 Jul 2020
    South AfricaProtection of Personal Information Act 4 of 2013 (POPIA), section 71 (automated decision-making)Bars decisions with legal or similar effects based solely on automated profiling unless an exception applies (contract, law or code), with a right to make representations.VerifiedLawOfficial document →Archived copy
75. 25 Nov 2019
    KenyaData Protection Act, 2019 (s.35 automated decision-making) and Data Protection (General) Regulations 2021 (reg. 22)Right not to be subject to decisions based solely on automated processing with significant effects; DPIAs required for high-risk processing (s.31).VerifiedLawOfficial document →Archived copy
76. 1 Apr 2019
    CanadaTreasury Board Directive on Automated Decision-MakingBinds federal institutions using automated decision systems for administrative decisions: Algorithmic Impact Assessment, notice before and explanation after decisions, recourse, human intervention and public reporting; compliance from 1 April 2020. A fourth review consulted to January 2025; publication of a revised version was not confirmed.VerifiedRegulationOfficial document →Archived copy
77. 25 May 2018
    European UnionRegulation (EU) 2016/679 (GDPR), Article 22 on automated individual decision-makingRight not to be subject to a decision based solely on automated processing with legal or similarly significant effects, save for contractual necessity, legal authorisation or explicit consent, with safeguards including human intervention and the right to express a view and contest the decision; the CJEU SCHUFA judgment (C-634/21, 7 Dec 2023) held that a credit score a lender relies on heavily is itself such a decision.VerifiedRegulationOfficial document →Archived copy
78. 7 Apr 2016
    TurkeyPersonal Data Protection Law No. 6698 (KVKK), Article 11(1)(g): right to object to results produced by automated analysisData subjects may object to a result against them that arises from analysis of their personal data exclusively by automated systems; requests go to the controller in writing (reply within 30 days), then to the KVK Board by complaint. An objection right, not a general ban on automated decisions; Law 7499 (2024) amended other provisions.VerifiedLawOfficial document →Archived copy
79. 2 Nov 2000
    ArgentinaLey 25.326 de Protección de los Datos PersonalesGeneral data-protection (habeas data) law, published 2 Nov 2000 and regulated by Decree 1558/2001; applies to AI processing of personal data; AAIP is the authority; reform bills pending.VerifiedLawOfficial document →Archived copy