The global AI law map 2026: every major rule, deadline and fine

How do countries regulate AI? The three models

Almost every country falls into one of three groups. The first passes a comprehensive, risk-based AI law. “Risk-based” means the rules get stricter as the potential for harm grows: some uses are banned, some face heavy duties, and most face light-touch transparency or nothing at all. The EU and South Korea are the leading examples.

The second group has no single AI law but a patchwork of narrower rules. The US is the clearest case: individual states regulate particular uses, such as hiring, chatbots or frontier models, while federal agencies use existing powers. The third group relies on guidance and principles. The UK, Singapore, India and Japan ask existing regulators to apply current law to AI and publish voluntary frameworks to fill the gaps.

China does not fit neatly into any of these. It has no single AI Act, but it has detailed, binding rules aimed at specific technologies, such as generative AI, recommendation algorithms and deepfakes, backed by a government registry. Think of it as a fourth, state-supervised model.

• Comprehensive and risk-based: EU, South Korea; Brazil proposed
• Patchwork of targeted laws: US states, plus federal consumer protection
• Guidance and principles: UK, Singapore, India, Japan, much of the Middle East
• Targeted state supervision: China

Europe: the EU AI Act after the Omnibus

The EU AI Act is the world’s most detailed AI law. It sorts AI into banned practices, “high-risk” systems (such as AI used in hiring, education, credit and essential services), transparency-only systems (such as chatbots and deepfakes) and everything else. It applies to anyone who places AI on the EU market or whose AI outputs are used in the EU, wherever they are based.

In July 2026 the EU amended the Act through the Digital Omnibus on AI. The bans have applied since 2 February 2025 and the duties for general-purpose AI models, the large models behind tools like ChatGPT, Claude and Gemini, since 2 August 2025. The transparency duties in Article 50 started on 2 August 2026. The high-risk deadlines moved back: stand-alone high-risk uses now apply from 2 December 2027, and AI built into regulated products such as medical devices from 2 August 2028.

The Omnibus also added new bans, from 2 December 2026, on AI systems that generate non-consensual intimate imagery or child sexual abuse material. The penalty ceilings did not change: up to €35 million or 7% of worldwide annual turnover for banned practices, and up to €15 million or 3% for most other breaches, with the lower figure applying to SMEs.

Member states can add their own rules where the Act allows. Italy became the first to pass a national AI law, Law 132 of 2025, which took effect on 10 October 2025 and adds rules on AI in the workplace, health care, public administration, copyright and harmful deepfakes.

The US: a state patchwork and a federal tug-of-war

There is no federal AI statute in the US. In January 2025 the new administration revoked the previous AI executive order and set a pro-innovation course. In July 2025 the Senate voted 99 to 1 to strip a proposed ten-year moratorium on state AI laws out of a budget bill. On 11 December 2025 the President signed Executive Order 14365, which set up a Justice Department task force to challenge state AI laws and asked Congress for a national framework that would override them. As of October 2026, Congress has not passed one.

So the states are where the binding rules are. California’s SB 53, signed on 29 September 2025 and in force since 1 January 2026, requires large frontier AI developers to publish safety frameworks and report critical safety incidents, with penalties of up to $1 million per violation. California’s AI Transparency Act requires large generative AI providers to embed hidden disclosures and offer a free detection tool from August 2026, and its privacy regulator’s rules on automated decision-making apply from 1 January 2027.

Texas’s TRAIGA took effect on 1 January 2026. It bans developing or deploying AI with intent to cause listed harms, such as manipulating people into self-harm or unlawful discrimination, and adds disclosure duties for government and health care uses. The Attorney General enforces it, with a 60-day cure period and penalties of $10,000 to $12,000 for curable violations and $80,000 to $200,000 for uncurable ones.

Colorado repealed its first AI law in May 2026 and replaced it with SB 26-189, which focuses on automated decisions in areas like jobs, lending and housing and is due to apply from 1 January 2027, although enforcement has been reported as stayed while litigation continues. Illinois has made discriminatory AI in employment decisions unlawful under its Human Rights Act since 1 January 2026. New York City has required bias audits for automated hiring tools since July 2023, and Utah requires businesses to disclose generative AI use in certain consumer interactions.

UK, Singapore, India and Japan: guidance first

The UK has no AI Act as of October 2026, and none was announced in the May 2026 King’s Speech. Instead, existing regulators apply cross-sector principles to AI in their own fields: the ICO for personal data, the CMA for competition and consumer law, the FCA for financial services and Ofcom for online safety. The Data (Use and Access) Act 2025 reshaped the rules on automated decisions from February 2026, allowing them more widely but keeping safeguards such as human intervention and the right to contest.

Singapore offers voluntary frameworks, including its Model AI Governance Framework for Generative AI and the AI Verify testing toolkit, alongside its binding data protection law, the PDPA. India released its AI Governance Guidelines on 5 November 2025. They are principles-based and non-binding, and they rely on existing laws such as the IT Act and the Digital Personal Data Protection Act. India has, however, made AI content labelling mandatory for platforms through amendments to its IT Rules from 20 February 2026.

Japan passed its AI Promotion Act in May 2025, fully in force from September 2025. It sets up a government AI strategy headquarters and asks businesses to cooperate with government measures, but it has no fines. Japan’s privacy and copyright laws still apply in full.

China, South Korea and the rest of the world

China regulates AI technology by technology. Its Interim Measures for generative AI services have applied since August 2023, and earlier rules cover recommendation algorithms and “deep synthesis” (deepfakes). Public-facing services must file their algorithms in a government registry and, for generative AI, pass a security assessment. Labelling Measures in force since 1 September 2025 require visible labels and hidden metadata on AI-generated content, and an amendment to the Cybersecurity Law with China’s first AI clause took effect on 1 January 2026.

South Korea’s AI Basic Act took effect on 22 January 2026. It covers “high-impact” AI in areas such as health, energy and hiring, requires notice and labelling for generative AI, and requires some foreign providers to appoint a local representative. Fines are capped at 30 million won, about US$20,000, and the government has said it will not impose them for a grace period of at least a year.

In the Middle East, neither the UAE nor Saudi Arabia has a comprehensive AI law. The UAE relies on its federal data protection law, free-zone rules such as the DIFC’s regulation on AI and autonomous systems, and a new federal AI and data authority created in 2026. Saudi Arabia’s data and AI authority, SDAIA, consulted on a draft Responsible AI Policy in April and May 2026, and enforces the Personal Data Protection Law.

In the Americas, Brazil’s AI bill, PL 2338/2023, passed the Senate in December 2024 but is still awaiting a committee report in the Chamber of Deputies. Canada’s proposed Artificial Intelligence and Data Act lapsed when Parliament was prorogued in January 2025, leaving privacy law, including Québec’s Law 25, to fill the gap.

Which AI laws apply to my business? Country by country

The table below is a quick reference. “Who it hits” is the short version; most laws have thresholds and exceptions. “Max penalty” is the headline ceiling, not what a small business would typically pay.

A simple rule of thumb: what matters is where your users or customers are, not where your company is registered. A freelancer in Lisbon serving clients in Texas, or a SaaS start-up in Bengaluru with customers in Germany, can be caught by both.

Key AI law deadlines from 2025 to 2028

Many of the biggest dates have already passed, which surprises people who think AI regulation is still “coming”. The next wave lands between December 2026 and the end of 2027.

Some dates depend on rulemaking or litigation, notably Colorado. Treat those as planning dates rather than certainties, and check again before you rely on them.

The laws that already regulate AI without saying “AI”

Most AI enforcement so far has not used AI laws at all. Regulators and courts have reached for privacy, consumer protection, discrimination and contract law, which apply to AI just as they apply to any other tool. If you are waiting for an AI Act to arrive in your country before acting, these laws already cover you.

Privacy law is the biggest. Article 22 of the GDPR gives people in the EU the right not to be subject to decisions based solely on automated processing that have legal or similarly significant effects, unless an exception applies. Using customer data to train a model also needs a lawful basis and clear notice. Consumer protection law forbids misleading claims, including exaggerated claims about what your “AI-powered” product does.

Product liability is the newest addition. The EU’s revised Product Liability Directive applies to products placed on the market from 9 December 2026 and expressly treats software, including AI systems, as a product. That means a business can be liable for damage caused by defective AI without anyone proving it was careless.

Who has been fined so far? AI enforcement in practice

Privacy regulators have been the most active. Italy’s Garante fined OpenAI €15 million in December 2024 over ChatGPT’s training data, transparency and age checks, although the Court of Rome annulled the fine in March 2026 on the ground that the Irish regulator was responsible once OpenAI had its EU base in Ireland. Clearview AI, which scraped billions of facial images, was fined €30.5 million by the Dutch regulator in 2024, after earlier fines of €20 million each in Italy, France and Greece.

Chinese chatbot DeepSeek showed how fast regulators can act. In January 2025 the Garante ordered it to stop processing Italian users’ data, and in February 2025 South Korea’s privacy regulator suspended new downloads for about two months until it fixed its consent process and data transfers.

In the US, the FTC’s Operation AI Comply, announced in September 2024, targeted deceptive AI claims, including against DoNotPay, which marketed itself as “the world’s first robot lawyer”. And in Canada, a tribunal held Air Canada responsible in 2024 for wrong bereavement-fare advice given by its website chatbot, rejecting the argument that the chatbot was responsible for its own statements.

Copyright disputes are running alongside. In the US, the Bartz v. Anthropic class action over pirated training books settled for about $1.5 billion. In Germany, a Munich court found in GEMA v. OpenAI in November 2025 that a model had memorised song lyrics in a way that infringed copyright. No AI Act fine has been reported yet; the first are more likely once transparency and high-risk duties bed in.

What is happening in the market right now?

The direction of travel is clearer than the detail. Rules that look very different on paper are converging on a small set of duties. Labelling AI-generated content is now required in the EU, China, South Korea, India and, for large providers, California. Transparency when people talk to a chatbot is required in the EU, South Korea and Utah. Explanations and human review for automated decisions are spreading through the EU, UK, California, Colorado and Australia.

Frontier model safety has become its own category. The EU regulates general-purpose AI models, California’s SB 53 targets developers with very large training runs, and New York’s RAISE Act, finalised in March 2026, is due to apply to large frontier developers from 1 January 2027. These rules mostly hit a handful of large labs, but businesses building on their models will see the effects through contracts and documentation.

There is also a clear split in tone. The US federal government is pushing deregulation and trying to rein in state laws, while the EU is simplifying its rules, delaying some deadlines and easing paperwork, without abandoning the AI Act. Neither is a retreat from enforcement under existing law.

Internationally, the Council of Europe’s Framework Convention on AI, the first binding international AI treaty, was opened for signature in September 2024 and ratified by the EU in May 2026, but had not yet entered into force as of October 2026. The OECD AI Principles and the G7 Hiroshima Process code of conduct remain voluntary, but they shape national laws and what large customers ask for in procurement.