The AI and data laws your product meets.

Applies to

Providers and deployers of AI systems placed on the EU market or whose outputs are used in the EU, wherever they are based.

Key obligations

• Avoid prohibited practices and support AI literacy among staff
• Transparency for chatbots, deepfakes and synthetic content
• Risk management, data governance, logging and oversight for high-risk AI

Applies to

Organisations established in the EU, and those outside it that offer goods or services to, or monitor, people in the EU.

Key obligations

• A lawful basis and transparency for every processing activity
• Data subject rights, DPIAs, records and breach notification within 72 hours
• Safeguards for transfers outside the EU

Applies to

Intermediary services offered to users in the EU, from hosting to marketplaces and social platforms.

Key obligations

• Notice-and-action for illegal content and statements of reasons
• Terms, advertising and recommender transparency
• Protections for minors and bans on certain dark patterns

Applies to

Designated gatekeepers, but it creates new rights and openings for startups that depend on them.

Key obligations

• Gatekeepers may not self-preference or combine data without consent
• Interoperability and side-loading openings
• Business-user data access rights

Applies to

Makers of connected products and related services, data holders and cloud and data-processing providers.

Key obligations

• Give users access to data generated by connected products
• Remove barriers to switching cloud providers
• Avoid unfair data-sharing terms with smaller businesses

Applies to

Medium and large entities in listed sectors, including digital infrastructure, cloud, data centres and many digital providers.

Key obligations

• Cybersecurity risk-management measures, including supply chain
• Staged incident reporting (early warning within 24 hours)
• Management accountability and training

Applies to

EU financial entities, including crypto-asset service providers, and the ICT vendors that serve them.

Key obligations

• ICT risk-management framework and resilience testing
• Major ICT incident reporting
• Mandatory contract terms with ICT third-party providers

Applies to

Manufacturers, importers and distributors of products with digital elements, including most commercial software.

Key obligations

• Report actively exploited vulnerabilities and severe incidents (24h / 72h / 14 days)
• Secure-by-design development and vulnerability handling
• Security updates for the support period and conformity assessment

Applies to

Manufacturers of products and software, and in some cases importers, representatives and fulfilment providers.

Key obligations

• Strict liability for damage caused by defective software
• Liability can follow updates, upgrades and missing security patches
• Disclosure of evidence and presumptions that ease claims

Applies to

Issuers of crypto-assets and crypto-asset service providers (CASPs) serving EU clients.

Key obligations

• CASP authorisation in one member state, then passporting
• White papers and marketing rules for token offers
• Reserve and redemption rules for stablecoins

Applies to

Health data holders, EHR system makers and organisations seeking health data for secondary use.

Key obligations

• Patient access and portability of electronic health data
• Requirements for electronic health record systems
• Permits through health data access bodies for secondary use

Applies to

Organisations processing personal data in the UK or targeting UK individuals.

Key obligations

• Lawful basis, rights and accountability as under the GDPR
• Safeguards for significant automated decisions
• A data protection complaints procedure

Applies to

Services with UK users that let people share content or interact, and search services, wherever based.

Key obligations

• Illegal content risk assessments and safety measures
• Children’s risk assessments and highly effective age assurance where required
• Transparency and user reporting tools

Applies to

AI products used in the UK, through each sector regulator’s existing powers.

Key obligations

• Data protection rules on AI and automated decisions (ICO)
• Consumer and competition law (CMA)
• Sector rules, for example financial services (FCA)

Applies to

For-profit businesses meeting revenue or data-volume thresholds that collect California residents’ personal information.

Key obligations

• Notices, opt-outs of sale and sharing, and honouring opt-out preference signals
• Risk assessments and, for some, cybersecurity audits
• Pre-use notices, opt-outs and access rights for ADMT

Applies to

Businesses meeting each state’s thresholds for residents’ data; some, such as Texas, have no revenue threshold.

Key obligations

• Privacy notices and consumer rights
• Opt-in consent for sensitive data in most states
• Data protection assessments for high-risk processing

Applies to

Developers and deployers of AI used for consequential decisions about Colorado consumers.

Key obligations

• Advance notice of AI use in consequential decisions
• Adverse-outcome explanations and human review
• Recordkeeping and developer documentation

Applies to

Developers and deployers doing business in Texas or whose AI is used by Texas residents.

Key obligations

• No AI developed or deployed with intent to cause listed harms
• Disclosure duties for government and healthcare uses
• Cure periods and safe harbours tied to recognised frameworks

Applies to

Large frontier developers (SB 53), developers of public generative AI (AB 2013) and large generative AI providers (SB 942).

Key obligations

• Published safety frameworks and critical incident reporting (frontier developers)
• Public summaries of training data
• Free AI-detection tools and latent disclosures in generated content

Applies to

Employers and employment agencies using automated tools to screen candidates or employees for NYC roles.

Key obligations

• Annual independent bias audit, with a published summary
• Notice to candidates before use
• Information on data collected, on request

Applies to

Most businesses operating in or targeting the US.

Key obligations

• Substantiate claims about what your AI can do
• Honour your privacy and security promises
• Avoid unfair data practices; remedies can include deleting models

Applies to

Online services directed to children under 13, or with actual knowledge that they collect children’s data.

Key obligations

• Verifiable parental consent before collection
• Separate consent for disclosure to third parties, such as for targeted ads
• Written security programme and data retention limits

Applies to

Covered platforms hosting user-generated content.

Key obligations

• Notice-and-removal process for intimate imagery
• Removal within 48 hours of a valid request
• Reasonable efforts to remove copies

Applies to

Covered entities (providers, plans, clearinghouses) and vendors acting as business associates.

Key obligations

• Business associate agreements
• Privacy, security and breach notification rules
• Minimum-necessary use and disclosure

Applies to

Indirectly, every company subject to state AI laws.

Key obligations

• No new federal obligations by themselves
• State AI laws remain in force unless a court rules otherwise
• Federal procurement and agency guidance can still shape requirements

Applies to

Processing of digital personal data in India, and processing outside India connected with offering goods or services to people in India.

Key obligations

• Itemised notice and consent, with easy withdrawal
• Security safeguards and breach intimation
• Verifiable parental consent for children; extra duties for SDFs

Applies to

Intermediaries and platforms serving users in India, with additional duties for significant social media intermediaries.

Key obligations

• Due diligence and grievance redressal
• Labels and provenance metadata for synthetic content
• Takedown of unlawful content within tight timelines

Applies to

Organisations developing or deploying AI in India (non-binding).

Key obligations

• Principles including trust, accountability, fairness and safety
• Voluntary measures and techno-legal tools
• Signals future targeted amendments, for example to the IT Act

Applies to

Service providers, intermediaries, data centres and body corporates, with extra duties for VPN, cloud and VDA providers.

Key obligations

• Report specified cyber incidents within 6 hours
• Retain ICT logs for 180 days within India
• Synchronise clocks with Indian time servers

Applies to

VDA service providers serving Indian users, including offshore platforms, and investors.

Key obligations

• Register with FIU-IND and run KYC and suspicious-transaction reporting
• 30% tax on VDA income and 1% TDS on transfers
• Record-keeping under the PMLA

Applies to

Processing in China, and processing abroad of personal information of people in China for products, services or analysis.

Key obligations

• Consent-based processing with separate consent for sensitive data
• CAC security assessment, standard contract or certification for exports
• Local representative for offshore processors

Applies to

Providers of generative AI services to the public in China, and content platforms distributing AI content.

Key obligations

• Algorithm filing and security assessment for public services
• Explicit and implicit (metadata) labels on AI-generated content
• Training-data and content-governance duties

Applies to

AI businesses whose services affect the Korean market, including some foreign providers.

Key obligations

• Notice and labelling for generative AI outputs
• Risk management for high-impact AI
• A domestic representative for qualifying foreign providers

Applies to

AI developers and users in Japan, through cooperation duties and government guidance.

Key obligations

• Cooperate with government measures and investigations
• Follow sector guidance and the AI basic plan
• Existing laws (APPI, copyright, consumer) still apply

Applies to

Businesses handling personal information of people in Japan, including foreign businesses.

Key obligations

• Purpose specification and notice
• Consent or safeguards for third-party and overseas transfers
• Breach reporting to the PPC

Applies to

Organisations collecting or using personal data in Singapore; AI frameworks are voluntary.

Key obligations

• Consent, purpose limitation and notification
• Mandatory breach notification
• Voluntary AI governance and testing

Applies to

APP entities handling personal information of Australians; age-restricted social platforms for the minimum age law.

Key obligations

• Disclose automated decisions in privacy policies
• Stronger penalties and OAIC enforcement
• Reasonable steps to keep under-16s off age-restricted platforms

Applies to

Processing of personal data in the Kingdom, including by entities outside it processing residents’ data.

Key obligations

• Lawful basis, notices and data subject rights
• Breach notification to SDAIA
• Conditions on transfers outside the Kingdom

Applies to

Processing in the UAE; free-zone entities follow their own laws.

Key obligations

• Consent and transparency under the federal law
• Free-zone registration, DPO and transfer rules
• DIFC rules for processing through AI and autonomous systems

Applies to

VASPs operating in or from the UAE.

Key obligations

• Licence before offering virtual-asset activities
• Rulebooks on custody, marketing and compliance
• AML and Travel Rule compliance

Applies to

Processing in Brazil, or of data of people in Brazil, or to offer goods and services there.

Key obligations

• Legal bases including legitimate interest
• A DPO (encarregado) and incident reporting
• Standard contractual clauses for international transfers

Applies to

Would apply to AI developers and deployers in Brazil if enacted.

Key obligations

• Risk classification and high-risk duties (proposed)
• Rights for people affected by AI (proposed)
• Copyright remuneration for training data (proposed)

Applies to

Organisations collecting personal information in commercial activity in Canada; Québec Law 25 for Québec residents.

Key obligations

• Meaningful consent and accountability
• Privacy impact assessments, including before transfers outside Québec
• Notice of decisions based exclusively on automated processing (Québec)

Applies to

States that ratify, which then apply it through national law.

Key obligations

• Risk and impact management for AI
• Transparency and remedies for affected people
• Requires five ratifications, including three Council of Europe members

Applies to

Voluntary; widely referenced in procurement and policy.

Key obligations

• Trustworthy AI principles: transparency, robustness, accountability
• Risk identification and mitigation for advanced AI
• Voluntary reporting under the Hiroshima framework

Applies to

Virtual-asset service providers, through national AML laws.

Key obligations

• Customer due diligence and monitoring
• Originator and beneficiary information with transfers
• Licensing or registration of VASPs

Applies to

Voluntary; increasingly expected by enterprise buyers and referenced in laws such as TRAIGA.

Key obligations

• Govern, Map, Measure and Manage AI risk (NIST)
• AI management system, roles and controls (ISO 42001)
• Evidence for procurement and audits