AI RegulationsRegulation
EU AI Act
The EU AI Act (Regulation (EU) 2024/1689) is the European Union’s horizontal law regulating AI systems and general-purpose AI models by risk.
Read full definitionGlossary topic
AI Laws, Regulations & Governance
Laws, regulations, standards and governance concepts that affect AI systems — general information only, not legal advice.
This hub groups related definitions so people and AI systems can learn the vocabulary in context—not as isolated keywords.
Start here
Legal and Compliance
GDPR
GDPR is the European Union’s General Data Protection Regulation governing personal data processing and individual privacy rights.
Read full definitionAI RegulationsRegulation
NIST AI Risk Management Framework
The NIST AI Risk Management Framework (AI RMF) is a voluntary US framework for identifying, measuring, and managing AI risks.
Read full definitionAI Laws, Regulations & GovernanceRegulation
NIST Generative AI Profile
The NIST Generative AI Profile is voluntary guidance for applying the NIST AI Risk Management Framework to generative-AI risks.
Read full definitionLegal and Compliance
CCPA
CCPA is California’s Consumer Privacy Act, a U.S. state privacy law giving residents rights over certain personal information businesses collect.
Read full definitionAI Laws, Regulations & GovernanceRegulation
Colorado Artificial Intelligence Act
The Colorado Artificial Intelligence Act regulates developers and deployers of certain high-risk AI systems used for consequential decisions.
Read full definition208 published definitions in this topic
- AccountabilityAccountability means named parties answer for AI system outcomes, evidence, and remedies.
- Ad TechThe advertising technology stack that auctions attention using personal data, cookies, and identifiers.
- Adversarial TestingAdversarial testing evaluates AI systems against crafted inputs designed to cause errors or unsafe outputs.
- AI AssuranceAI assurance is independent or structured evidence that AI systems meet stated risk, ethics, and performance claims.
- AI AuditAn AI audit is an examination of an AI system’s controls, evidence, and outcomes against defined criteria.
- AI DeployerAn AI deployer is the entity that uses an AI system under its authority, except where the system is for personal non-professional activity.
- AI DeveloperAn AI developer is a person or organization that designs, trains, or builds AI models or systems.
- AI DistributorAn AI distributor makes an AI system available on the market without affecting its properties as provider.
- AI ImporterAn AI importer is an entity established in a jurisdiction that places on the market an AI system from a third-country provider.
- AI Incident ReportingAI incident reporting is the process of documenting and notifying designated parties about serious failures, harms, or security events involving AI.
- AI InventoryAn AI inventory is a maintained register of AI systems and models an organization uses or provides.
- AI LiteracyAI literacy is the understanding staff and users need to use and oversee AI systems responsibly.
- AI OperatorAn AI operator is an organization or team responsible for running and maintaining an AI system in production.
- AI ProviderAn AI provider is the entity that develops an AI system or model and places it on the market or puts it into service under its name.
- AI Regulation in ArgentinaArgentina primarily governs AI-relevant practices through personal-data rules, consumer protection, and public-sector policy rather than a single comprehensive AI Act.
- AI Regulation in AustraliaAustralia’s AI approach combines voluntary AI ethics principles and guidance with privacy law and consumer-protection overlays; comprehensive AI-specific binding legislation remains limited or evolving.
- AI Regulation in AustriaAI regulation in Austria is driven mainly by the EU AI Act (Regulation (EU) 2024/1689) as directly applicable EU law, plus GDPR and nationally designated competent authorities.
- AI Regulation in BelgiumAI regulation in Belgium is driven mainly by the EU AI Act (Regulation (EU) 2024/1689) as directly applicable EU law, plus GDPR and nationally designated competent authorities.
- AI Regulation in BrazilBrazil’s comprehensive AI bill (notably PL 2338/2023) has advanced in Congress but is not treated here as enacted law; binding overlays include LGPD and consumer protection.
- AI Regulation in CanadaCanada does not currently have a comprehensive federal AI statute in force; proposed AIDA (Bill C-27) did not become law, so AI is governed mainly by privacy law, voluntary codes, and public-sector directives.
- AI Regulation in ChileChile has advanced AI policy and bill discussions alongside privacy and consumer law; a comprehensive AI Act is not assumed in force in this educational snapshot.
- AI Regulation in ChinaChina regulates AI through sector-specific binding measures—especially generative AI, deep synthesis, and algorithm recommendation filing—rather than a single EU-style horizontal AI Act alone.
- AI Regulation in ColombiaColombia addresses AI through digital policy, personal-data rules, and consumer-protection oversight rather than an assumed EU-style horizontal AI Act.
- AI Regulation in DenmarkAI regulation in Denmark is driven mainly by the EU AI Act (Regulation (EU) 2024/1689) as directly applicable EU law, plus GDPR and nationally designated competent authorities.
- AI Regulation in EgyptEgypt’s AI approach centers on national digital/AI strategy and emerging data rules alongside sector oversight, without assuming an EU-style AI Act is in force.
- AI Regulation in FinlandAI regulation in Finland is driven mainly by the EU AI Act (Regulation (EU) 2024/1689) as directly applicable EU law, plus GDPR and nationally designated competent authorities.
- AI Regulation in FranceAI regulation in France is driven mainly by the EU AI Act (Regulation (EU) 2024/1689) as directly applicable EU law, plus GDPR and nationally designated competent authorities.
- AI Regulation in GermanyAI regulation in Germany is driven mainly by the EU AI Act (Regulation (EU) 2024/1689) as directly applicable EU law, plus GDPR and nationally designated competent authorities.
- AI Regulation in GreeceAI regulation in Greece is driven mainly by the EU AI Act (Regulation (EU) 2024/1689) as directly applicable EU law, plus GDPR and nationally designated competent authorities.
- AI Regulation in Hong KongHong Kong (SAR) is distinct from mainland China’s generative-AI measures; AI is mainly addressed via privacy law, sector guidance, and policy rather than mainland CAC generative-AI rules automatically applying.
- AI Regulation in IcelandIceland, as an EEA state, generally tracks EU digital regulation; EU AI Act applicability depends on EEA incorporation and national steps—verify rather than assume identical EU timelines.
- AI Regulation in IndiaIndia’s AI landscape mixes MeitY advisories and strategy materials with emerging digital personal-data rules and sector regulation, without a single EU-style horizontal AI Act in force.
- AI Regulation in IndonesiaIndonesia mixes national AI ethics/strategy guidance with the Personal Data Protection Law and sector circulars rather than an EU-style horizontal AI Act.
- AI Regulation in IrelandAI regulation in Ireland is driven mainly by the EU AI Act (Regulation (EU) 2024/1689) as directly applicable EU law, plus GDPR and nationally designated competent authorities.
- AI Regulation in IsraelIsrael primarily addresses AI through policy, ethics guidance, and privacy/sector law rather than a single comprehensive binding AI Act comparable to the EU AI Act.
- AI Regulation in ItalyAI regulation in Italy is driven mainly by the EU AI Act (Regulation (EU) 2024/1689) as directly applicable EU law, plus GDPR and nationally designated competent authorities.
- AI Regulation in JapanJapan combines soft-law AI business guidelines with a 2025 AI promotion basic law focused on coordination and innovation; it is not an EU AI Act–style prohibition-and-conformity regime.
- AI Regulation in KenyaKenya addresses AI primarily through data-protection law, ICT policy, and strategy documents rather than a verified comprehensive AI Act in this snapshot.
- AI Regulation in MalaysiaMalaysia’s AI approach emphasizes national AI roadmaps and personal-data rules, without assuming a comprehensive binding AI Act comparable to the EU AI Act.
- AI Regulation in MexicoMexico addresses AI mainly through privacy, consumer, and sector rules plus policy initiatives, without assuming a comprehensive binding AI Act in force.
- AI Regulation in NetherlandsAI regulation in Netherlands is driven mainly by the EU AI Act (Regulation (EU) 2024/1689) as directly applicable EU law, plus GDPR and nationally designated competent authorities.
- AI Regulation in New ZealandNew Zealand does not have a comprehensive AI-specific binding statute comparable to the EU AI Act; AI uses are mainly addressed through privacy law, public-sector guidance, and general consumer and sector rules.
- AI Regulation in NigeriaNigeria’s AI posture combines national digital/AI strategy materials with data-protection rules and NITDA guidance, without assuming an EU-style horizontal AI Act.
- AI Regulation in NorwayNorway is an EEA state closely aligned with EU digital rules; EU AI Act relevance depends on EEA incorporation and national implementation—treat as Partially applicable / Mixed pending official EEA status checks.
- AI Regulation in PolandAI regulation in Poland is driven mainly by the EU AI Act (Regulation (EU) 2024/1689) as directly applicable EU law, plus GDPR and nationally designated competent authorities.
- AI Regulation in PortugalAI regulation in Portugal is driven mainly by the EU AI Act (Regulation (EU) 2024/1689) as directly applicable EU law, plus GDPR and nationally designated competent authorities.
- AI Regulation in RomaniaAI regulation in Romania is driven mainly by the EU AI Act (Regulation (EU) 2024/1689) as directly applicable EU law, plus GDPR and nationally designated competent authorities.
- AI Regulation in Saudi ArabiaSaudi Arabia’s AI approach centers on SDAIA strategy and data governance frameworks, with personal-data rules overlaying many AI uses rather than a single EU-style AI Act.
- AI Regulation in SingaporeSingapore is best known for voluntary AI governance tools such as the Model AI Governance Framework, paired with binding personal-data rules under the PDPA rather than an EU-style horizontal AI Act.
- AI Regulation in South AfricaSouth Africa mainly addresses AI through the Protection of Personal Information Act (POPIA), consumer and sector law, and national AI policy discussions rather than a comprehensive AI Act.
- AI Regulation in South KoreaSouth Korea enacted the AI Basic Act (Framework Act on AI development and trustworthiness), a binding national AI framework that took effect in January 2026, alongside privacy and sector rules.
- AI Regulation in SpainAI regulation in Spain is driven mainly by the EU AI Act (Regulation (EU) 2024/1689) as directly applicable EU law, plus GDPR and nationally designated competent authorities.
- AI Regulation in SwedenAI regulation in Sweden is driven mainly by the EU AI Act (Regulation (EU) 2024/1689) as directly applicable EU law, plus GDPR and nationally designated competent authorities.
- AI Regulation in SwitzerlandSwitzerland is not an EU Member State; AI is addressed through federal policy, data-protection law, and sector rules, with attention to EU market spillover rather than automatic AI Act application.
- AI Regulation in TaiwanTaiwan addresses AI through strategy, guidance, and personal-data law, with AI-specific legislation status requiring verification against official sources.
- AI Regulation in ThailandThailand addresses AI through digital agency guidance, PDPA personal-data rules, and policy initiatives rather than an assumed EU-style AI Act.
- AI Regulation in the Czech RepublicAI regulation in Czech Republic is driven mainly by the EU AI Act (Regulation (EU) 2024/1689) as directly applicable EU law, plus GDPR and nationally designated competent authorities.
- AI Regulation in the European UnionThe European Union regulates AI primarily through Regulation (EU) 2024/1689 (the AI Act), a risk-based horizontal law with staggered application, alongside GDPR and sector rules.
- AI Regulation in the PhilippinesThe Philippines primarily governs AI-relevant practices through the Data Privacy Act, DICT policy, and sector rules rather than a verified comprehensive AI Act.
- AI Regulation in the United Arab EmiratesThe UAE combines national AI strategy and emerging sector or free-zone rules with data-protection overlays; it is not described here as a single EU-style horizontal AI Act.