AI Compliance & Regulatory Frameworks

The US Federal Trade Commission applies existing consumer protection and competition laws (Section 5 FTC Act) to AI systems - prohibiting deceptive AI capability claims, biased algorithms causing discriminatory harm, and unfair AI-driven practices. The FTC is actively investigating and taking enforcement action against AI companies.

The FDA regulatory framework for AI/ML-based Software as a Medical Device (SaMD) addresses how AI models can be continuously updated post-deployment while maintaining safety and effectiveness. Requires pre-market submission for high-risk devices, post-market surveillance, and a Predetermined Change Control Plan for AI updates.

Brazil's AI Bill (PL 2338/2023) was approved by the Senate plenary on 10 December 2024, after amendment by its temporary AI committee, and was transmitted to the Chamber of Deputies on 17 March 2025, where it remains under committee review as of 2 October 2026. Nothing in it is in force and it creates no obligation today. Inspired heavily by the EU AI Act, it adopts a risk-based classification approach (minimal, limited, high risk), establishes AI governance requirements, and creates an oversight authority. Brazil is the 8th-largest economy and home to 215 million people — the largest AI regulatory jurisdiction in Latin America.

South Korea's Framework Act on the Development of Artificial Intelligence and Establishment of Trust, known as the AI Basic Act, was signed into law on 21 January 2025 and took effect on 22 January 2026 together with its Enforcement Decree, Presidential Decree No. 36053. It is the first comprehensive AI statute in East Asia outside China, pairing industrial promotion with baseline obligations on safety, transparency and user protection, including watermarking duties for generative output. A grace period of about a year applies before administrative fines are actively pursued, with the transition handled through administrative guidance and advisory audits, so the Act binds today while penalties sit in that window.

Japan's Ministry of Economy, Trade and Industry (METI) and Cabinet Office published the AI Guidelines for Business in April 2024 — a voluntary, principles-based framework for responsible AI development and use. Japan takes a notably pro-innovation stance: rather than binding AI-specific legislation, it relies on existing laws (Act on Protection of Personal Information, copyright law, Unfair Competition Prevention Act) supplemented by voluntary guidance. The framework strongly emphasizes human-centricity, sustainability, and international interoperability, aligning with OECD AI Principles and G7 Hiroshima AI Process commitments.

The UAE was the first country in the world to appoint a Minister of State for Artificial Intelligence (2017) and launched the UAE National AI Strategy 2031 — aiming to make the UAE a global AI hub and derive 50% of government services from AI by 2031. The UAE combines aspirational AI adoption with a sector-specific regulatory approach: the CBUAE (Central Bank) and TDRA (Telecommunications and Digital Government Regulatory Authority) issue AI-specific guidance for their sectors. The UAE's AI governance model is pro-innovation and explicitly designed to attract AI companies and investment.

The EU Cyber Resilience Act (Regulation 2024/2847) establishes mandatory cybersecurity requirements for products with digital elements placed on the EU market — including AI-enabled software, connected hardware, and AI components embedded in products. Signed into law October 2024, it fills a critical gap alongside the EU AI Act by ensuring AI-powered products meet baseline security-by-design requirements throughout their lifecycle.

The Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law is the world's first legally binding international treaty on AI. Opened for signature in September 2024, it commits signatory states — including non-European nations such as the United States, United Kingdom, Canada, Japan, and Israel — to ensure that activities within the AI lifecycle are consistent with human rights, democratic values, and the rule of law. Unlike the EU AI Act's product-safety approach, the Convention sets state-level obligations and principles rather than technical product requirements.

Colorado passed the first comprehensive US state-level AI law (SB 24-205) in May 2024, imposing a duty of reasonable care on developers and deployers of 'high-risk' AI to prevent algorithmic discrimination in consequential decisions. It never took effect. Its start date was pushed from February 2026 to June 2026, a federal magistrate judge stayed enforcement in April 2026 amid a constitutional challenge the US Department of Justice joined, and on 14 May 2026 Governor Polis signed SB 26-189, which repeals and replaces it. The replacement drops the risk-based duty-of-care model for a narrower transparency framework covering automated decision-making technology (ADMT), and takes effect 1 January 2027. Plan against SB 26-189, not against the original Act.

Connecticut's comprehensive AI statute, enacted as Public Act 26-15 in June 2026, with its first tranche of obligations effective 1 October 2026. It is broader in subject matter than the other state AI laws: it reaches employment decision technology, generative content provenance, companion chatbots, social media and frontier model development in one instrument. Two features make it distinctive. It amends the state's anti-discrimination statutes so that attributing a decision to an AI system is not a defence, including where a third party supplied the technology. And it requires employers covered by the federal WARN Act to tell the state labour department whether a workforce reduction is related to their use of AI — the first disclosure of its kind in a US state.

California's law on automated decision systems in the workplace. Signed on 30 September 2026 and effective 1 July 2027, it bars an employer from relying solely on an automated decision system to discipline or terminate a worker, and requires meaningful human review and written notice to affected workers when such a system plays a primary role in the decision. It follows the version Governor Newsom vetoed in October 2025, which he called overly broad; the signed text is a revised one. It is narrower than a general AI statute: its subject is discipline and termination, plus two further prohibitions on inferring protected status and on predicting and acting against workers who exercise legal rights.

Texas's comprehensive AI law (HB 149), signed in 2025, taking a duty-and-prohibition-based approach rather than a broad risk-tier system. It bars specific harmful uses of AI — intentional discrimination, manipulation to incite self-harm or crime, unlawful biometric identification, and certain non-consensual intimate or child-exploitation content — and imposes transparency duties on government agencies using AI to interact with consumers. It creates a regulatory 'sandbox' for AI innovation and vests exclusive enforcement in the Texas Attorney General with a cure period before penalties.

California's frontier-AI safety and transparency law (SB 53), signed in 2025, targeting the largest developers of the most capable 'frontier' AI models. Rather than a broad risk-tier regime, it imposes transparency, safety-framework publication, and critical-incident reporting duties on frontier developers above defined compute and revenue thresholds, and adds whistleblower protections for employees raising catastrophic-risk concerns. It reflects a shift toward regulating advanced foundation models at the point of development.

Saudi Arabia's national AI governance approach, led by the Saudi Data and Artificial Intelligence Authority (SDAIA). It centers on the AI Ethics Principles and supporting frameworks that guide responsible AI development and deployment across public and private sectors, aligning with the Kingdom's Vision 2030 and its National Strategy for Data and AI (NSDAI). The approach is principles-based and risk-tiered, emphasizing fairness, transparency, accountability, privacy, and human oversight rather than a single binding AI statute.

New York City's Local Law 144 regulates the use of Automated Employment Decision Tools (AEDTs) in hiring and promotion decisions for positions in New York City. It requires employers and employment agencies to have AEDTs independently bias-audited within the prior year, to publicly post a summary of the audit results, and to notify candidates and employees before using such tools. It is one of the first US laws specifically targeting AI in hiring, enforced by the NYC Department of Consumer and Worker Protection.

Illinois House Bill 3773 amends the Illinois Human Rights Act to expressly regulate employers' use of artificial intelligence in employment decisions. It makes it a civil rights violation for an employer to use AI that has a discriminatory effect on employees or applicants on the basis of protected classes, or to use ZIP codes as a proxy for protected classes. It also requires employers to notify employees and applicants when AI is used in recruitment, hiring, promotion, discipline, discharge, and other terms of employment, building on Illinois' earlier AI Video Interview Act.

The reference list of the most critical security risks in applications built on large language models and AI agents. Unlike governance frameworks, which address process and accountability, this addresses the application layer directly: what an attacker does to an LLM system and how engineering teams prevent it. Widely used to structure security review and penetration testing of generative AI features.

Guidance on managing risk specific to artificial intelligence, adapting the general ISO 31000 risk management approach to AI systems. Where ISO/IEC 42001 specifies a certifiable management system, 23894 supplies the risk methodology used inside it — how AI risk is identified, analysed, evaluated, and treated across the system lifecycle.

Published in May 2025, ISO/IEC 42005 gives organisations a structured method for assessing how an AI system — and its foreseeable uses — may affect individuals, groups, and society. It completes the ISO AI trio: 42001 specifies the certifiable management system, 23894 supplies the risk methodology, and 42005 supplies the impact assessment that both reference. It is guidance rather than a certifiable standard: there is no external auditor and no certificate, and it is used internally to make impact assessment repeatable and documented.

The voluntary code providers of general-purpose AI models can sign to demonstrate compliance with their EU AI Act obligations. The AI Office published the final version on 10 July 2025 after a process involving close to 1,000 stakeholders, and the Commission and AI Board confirmed it as an adequate means of demonstrating compliance. It has three chapters: transparency and copyright, which apply to all GPAI model providers, and safety and security, which applies only to providers of models with systemic risk.

The voluntary code for meeting the Article 50 transparency duties of the EU AI Act, covering disclosure that content is AI-generated and the machine-readable marking that makes it detectable. The Commission published its final Article 50 guidelines on 20 July 2026 and confirmed this code as an adequate means of demonstrating compliance. It is the transparency counterpart to the General-Purpose AI Code of Practice: that one addresses model providers, this one addresses whoever generates or manipulates content that reaches people.

In force since 1 January 2026, AB 2013 requires developers of generative AI systems made available to Californians to publish a high-level summary of the datasets used to train them, covering systems released or substantially modified since January 2022. It is the first US law to force training-data disclosure, and it applies to anyone who designs, codes, produces, or substantially modifies a public generative AI system — not only large model developers.

The reference list of security risks specific to autonomous and multi-agent AI systems. It is a companion to the LLM Top 10 rather than a replacement, and the distinction is the point: the LLM list covers what a model says, while this list covers what a system does once that model is given autonomy, memory, tools and the ability to delegate. Risks here arise across steps and trust boundaries rather than in a single prompt and response.

California's rules on automated decisionmaking technology, adopted as part of a package that also covers risk assessments and cybersecurity audits. They matter because they bind through privacy law rather than AI law, which means they apply to businesses that never considered themselves AI companies, and because employment sits squarely in scope: decisions about hiring, compensation and contracting opportunities are significant decisions under these rules.

The standard that governs the auditors rather than the audited. It sets what a certification body must do to audit and certify an ISO/IEC 42001 management system: auditor competence, team composition, audit duration, scope determination, multi-site arrangements and impartiality. Its significance is indirect but real. Without it, a 42001 certificate means whatever the issuing body decided it meant; with it, accredited certificates carry comparable weight whoever issued them.

The United Kingdom has no AI Act and has signalled none in the near term. What it has instead is a statutory code of practice on AI and automated decision-making, which the Information Commissioner is now under a legal duty to prepare, and a rewritten automated decision-making regime in data protection law. For organisations operating in the UK, that pairing is the regime, and the second half is already in force.

Italy's comprehensive national AI law and the first domestic AI statute adopted by an EU member state. It is built around the EU AI Act: Article 1(2) requires its provisions to be interpreted and applied in conformity with Regulation (EU) 2024/1689. On top of that baseline it adds national rules for specific sectors (healthcare, employment, the professions, justice, education and intellectual property). It creates a criminal offence for the unlawful spreading of AI-generated or manipulated content, requires parental consent before children under 14 use AI, and names national AI authorities.

Southeast Asia's first comprehensive standalone AI statute. It sets up a three-tier risk regime (high, medium, low) based on potential impact on human rights, safety, security and the public interest. Prohibited practices are handled separately from the tiers. Providers self-classify their systems and must notify the Ministry of Science and Technology through a national AI portal before deploying medium- and high-risk systems. Much of the operational detail is left to implementing decrees.