Skip to content
Interactive explorer · Updated October 2026

Global AI Regulations Map & Tracker

A human-verified, interactive map of AI laws across 70+ jurisdictions. Pick your role (develop, deploy, or use AI), select a country, and see what applies, its status, key dates, and the practical steps an SME should take.

Updated October 2026: reflects the EU AI Act Digital Omnibus and Colorado's replacement AI Act
My role(s):
Loading world map…
Binding Law29Actively Enforced1Voluntary / Guidelines18Draft / Proposed19No AI Regulation3

United States

📋 Voluntary / Guidelines

No federal AI law. Patchwork of state laws + voluntary NIST framework. Federal push to preempt state laws.

NIST AI Risk Management Framework

Voluntary / Guidelines

2023

Develop AI

Govern, Map, Measure, Manage. Safe harbor in CO & TX. Flexible adoption.

Deploy AI

Demonstrates 'reasonable care'. Document implementation.

Use AI Tools

Lightweight adoption for due diligence.

  • 4 functions: Govern, Map, Measure, Manage
  • Safe harbor in CO & TX laws
  • Voluntary but key compliance benchmark
SME note: THE framework to adopt. Creates legal defense in states with binding laws.
Read the guide

Colorado AI Act (SB 26-189)

Binding Law

Effective Jan 1, 2027 (replaced SB 24-205)

Develop AI

Document intended and known harmful uses, training data categories, limitations and risks, and human-oversight instructions. Notify deployers of material updates; keep records for 3 years.

Deploy AI

Notify consumers before AI materially influences a consequential decision. Within 30 days of an adverse outcome, explain it in plain language and how to request details. Offer data correction and human review where commercially reasonable.

  • Repealed and replaced SB 24-205 (signed May 14, 2026); narrower and transparency-focused
  • Consequential decisions: education, employment, housing, lending, insurance, healthcare, government services
  • 60-day notice and cure period before AG enforcement
SME note: The old impact-assessment and risk-programme duties are gone. Prepare consumer notices, adverse-outcome explanations and a human-review route before Jan 1, 2027.
Read the guide

Texas TRAIGA (HB 149)

Binding Law

Effective Jan 1, 2026

Develop AI

Must not design for discrimination, manipulation, rights infringement. Red-team testing = defense.

Deploy AI

Disclose AI interactions. No deployment for prohibited purposes.

  • Prohibited-practices approach
  • NIST compliance = safe harbor
  • Fines: $10K–$12K per curable violation (60-day cure period); $80K–$200K for uncurable violations
  • Regulatory sandbox
SME note: A list of what you CAN'T do, rather than processes you must run. NIST adoption = key defense.
Read the guide

California AB 2013

Binding Law

Effective Jan 1, 2026

Develop AI

Publish training dataset summaries: sources, licensing, personal/synthetic data.

  • Training data transparency for GenAI developers
  • Court refused to block it (Mar 2026); xAI appeal pending at the Ninth Circuit; the law remains enforceable
SME note: Applies to GenAI model developers only.
Read the guide

NYC Local Law 144

Actively Enforced

2023

Deploy AI

Annual third-party bias audits for AI hiring tools.

Use AI Tools

Ensure AI hiring tools are audited.

  • Annual bias audit
  • Public disclosure
SME note: Applies if you use AI in hiring for NYC roles.
Read the guide

International frameworks

OECD AI PrinciplesG7 HiroshimaCouncil of Europe Convention

Snapshot for education only, human-verified to October 2026, not legal advice. Laws evolve quickly; verify details with official sources or qualified counsel before acting.

Region by region

AI regulations around the world, decoded for operators

European Union: the EU AI Act (post-Omnibus)

The EU AI Act (Regulation 2024/1689) is the world's first comprehensive AI law, using a four-tier risk model from banned practices through high-risk to minimal-risk uses. Following the Digital Omnibus, in force since 27 July 2026, the high-risk timeline shifted: Annex III obligations (employment, credit, essential services and more) now apply from 2 December 2027, and Annex I regulated-product rules from 2 August 2028. Article 50 transparency duties, telling users they are interacting with AI and labelling AI-generated content, have applied since 2 August 2026; generative systems already on the market before then have until 2 December 2026 to add machine-readable watermarking. SMEs benefit from reduced documentation, proportionate fines and free regulatory-sandbox access. Norway is bringing in the same rules through the EEA with its own AI Act, although adoption is running behind the EU timetable, and members like France (CNIL), Germany (DSK guidance and works-council rights), Italy (its national AI law) and Spain (the AESIA agency) layer national measures on top.

United States: NIST plus a patchwork of state laws

There is no comprehensive US federal AI law. The voluntary NIST AI Risk Management Framework (Govern, Map, Measure, Manage) has become the de-facto benchmark and provides an affirmative defence or safe harbour under several state laws. Binding state rules are arriving fast: Texas TRAIGA has taken a prohibited-practices approach since January 2026, Colorado's replacement AI Act (SB 26-189, which repealed SB 24-205) requires consumer notices and adverse-outcome explanations for AI-driven consequential decisions from 1 January 2027, California AB 2013 requires GenAI training-data transparency, and NYC Local Law 144 mandates annual bias audits for AI hiring tools. For most SMEs, adopting the NIST framework is the single highest-value step because it travels across states.

United Kingdom & the rest of Europe

The UK still has no dedicated AI law. Existing regulators such as the ICO, FCA and CMA apply five principles (safety, transparency, fairness, accountability and contestability), and the 2026 King's Speech favoured a pro-innovation Regulating for Growth bill with AI sandboxes over AI-specific rules. The binding change came through data protection: since 5 February 2026 the Data (Use and Access) Act 2025 has replaced the UK GDPR's automated decision-making rules, allowing more solely automated decisions but requiring safeguards such as telling people, letting them make representations, and offering human review and a way to contest the outcome. Switzerland issues voluntary guidance, but Swiss firms selling into the EU must still meet the EU AI Act. Turkey has no comprehensive AI law yet; its 2024 AI bill remains under review alongside proposed criminal-code rules on deepfakes.

Asia-Pacific: from binding laws to innovation-first codes

China enforces a layered regime: algorithm-recommendation rules, deep-synthesis provisions, the Interim Measures for Generative AI and mandatory labelling of AI-generated content, and since 1 January 2026 its amended Cybersecurity Law has written AI governance into national law. South Korea's AI Basic Act took effect on 22 January 2026 and reaches foreign companies serving Korean users, although fines are deferred for at least a year. Vietnam's EU-style AI Law has applied since 1 March 2026, with grace periods into 2027 for existing systems, and Kazakhstan's AI law took effect on 18 January 2026. Japan's AI Promotion Act relies on soft law, backed by a national AI Basic Plan and updated AI Business Guidelines (March 2026). Singapore's Model AI Governance Framework and AI Verify toolkit remain Asia's most-adopted voluntary standards. Australia has paused plans for mandatory guardrails and now relies on existing laws, six voluntary AI practices and a new AI Safety Institute.

Middle East, Latin America & Africa

Adoption is accelerating but uneven. Saudi Arabia has named 2026 its Year of Artificial Intelligence and governs through SDAIA's voluntary ethics principles, while the UAE has no dedicated AI law but combines its AI Charter and data-protection law with binding free-zone rules such as the DIFC's regulation on autonomous systems. Israel favours a sector-based, principles-led approach. In Latin America, Brazil's risk-based AI bill (PL 2338/2023) passed the Senate in December 2024 but still awaits a vote in the Chamber of Deputies, now expected after the October 2026 elections; meanwhile its LGPD already governs AI processing of personal data, and Mexico, Chile and others have bills in progress. Across Africa, Rwanda, Nigeria, Kenya, South Africa and Egypt are publishing national AI strategies and draft policies, with existing data-protection laws doing much of the enforcing today.

Common questions

AI regulations map: FAQ

Which AI regulations apply to a small business?

It depends on where your customers are and how you use AI. If you handle EU residents' data, GDPR applies today and the EU AI Act's transparency and AI-literacy duties reach businesses of every size. US businesses face the voluntary NIST AI RMF plus state laws such as Texas TRAIGA and NYC Local Law 144 (already in force) and Colorado's replacement AI Act (from 1 January 2027). The map lets you filter by your role (develop, deploy, or use AI) to see exactly what applies.

What changed with the EU AI Act Digital Omnibus in 2026?

The Digital Omnibus, in force since 27 July 2026, deferred the EU AI Act's high-risk obligations. Annex III high-risk duties now apply from 2 December 2027 (previously 2 August 2026) and Annex I regulated-product rules from 2 August 2028. Article 50 transparency duties applied on schedule from 2 August 2026. Generative AI systems already on the market before that date have until 2 December 2026 to add machine-readable watermarking; new systems had to comply from 2 August 2026. This map reflects the post-Omnibus timeline.

How often is this AI regulation tracker updated?

This map is human-verified and last reviewed in October 2026. Because AI law is moving quickly across every continent, we re-check the headline dates and status of each jurisdiction regularly and flag material changes such as the EU Digital Omnibus.

Is this legal advice?

No. This is educational guidance to help SMEs understand the landscape and ask the right questions. Regulations change and apply differently by jurisdiction, sector and circumstance, so always confirm decisions with qualified counsel.

Not sure which of these applies to you?

The free AI Starter Pack includes a one-page worksheet that maps your business to the regulations that actually reach it.

Get the Free AI Starter PackAsk us directly