An organisation that builds, buys or deploys AI in more than one country now faces binding AI rules in some markets, voluntary frameworks in others, and fast-moving executive policy in the United States. This map summarises the main AI laws and frameworks: the EU AI Act as amended by the Digital Omnibus on AI, the UK's principles-based approach, US federal executive orders and state laws in Colorado and California, China's generative AI and labelling measures, Canada, Japan, South Korea, Brazil and the international instruments from the Council of Europe, the OECD and the G7. It is written for security, risk, legal and AI platform leads designing one AI governance programme across markets. Facts in the at-a-glance table were checked against official sources in October 2026, except where a law firm source is named; items that change often carry an "as of" date.
Key takeaways
- Only a few regimes are both binding and broad. The EU AI Act, China's measures, South Korea's AI Basic Act and, from 2027, Colorado's reenacted law put duties on ordinary deployers; the UK, Japan and US federal policy rely on existing law, cooperation duties or voluntary frameworks.
- Labelling of AI-generated content is the most common hard rule. China has required explicit and metadata labels since 1 September 2025, Korea requires notice and labels, and EU Article 50 transparency rules apply from August 2026.
- Frontier model rules use compute or capability thresholds. The EU presumes systemic risk above 10^25 FLOPs, Korea's high-performance AI threshold is reported as 10^26 FLOPs, California's SB 53 targets large frontier developers, and the US relies on a voluntary covered frontier model process.
- The US is pushing against state AI laws. Executive Order 14365 created an AI Litigation Task Force and funding levers aimed at "onerous" state laws, while Colorado repealed and reenacted its AI Act with a 1 January 2027 start.
- Dates keep moving. The EU high-risk deadlines moved to December 2027 and August 2028, Colorado's to 2027, and Brazil's bill was still in the Chamber of Deputies in September 2026; check the "as of" notes before relying on this map.
Regulations and frameworks at a glance
| Instrument | Jurisdiction | Status (as of October 2026 unless stated) | Who it applies to | Key obligations | Enforcement |
|---|---|---|---|---|---|
| AI Act, Regulation (EU) 2024/1689, as amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744 | EU and EEA, with extraterritorial reach | In force 1 August 2024; prohibitions and AI literacy from 2 February 2025; general-purpose AI from 2 August 2025; most rules from 2 August 2026; new prohibition on non-consensual intimate imagery and CSAM generators from December 2026; Annex III high-risk from 2 December 2027; Annex I from 2 August 2028. Omnibus in force 27 July 2026 | Providers, deployers, importers and distributors of AI systems; providers of general-purpose AI models | Prohibited practices, high-risk requirements, Article 50 transparency, GPAI documentation and systemic risk duties | National market surveillance authorities; AI Office for GPAI; fines up to EUR 35 million or 7% of turnover for prohibited practices |
| Pro-innovation approach to AI regulation (white paper response, CP 1019) | United Kingdom | Non-statutory principles since February 2024; no comprehensive AI bill, and a law firm assessment in September 2026 did not expect one before late 2027 | Applied by existing sector regulators such as the ICO, CMA, Ofgem and the CAA | Five principles: safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; contestability and redress | Existing regulators under their own powers; AI Security Institute tests frontier models but is not a regulator |
| Executive orders 14179, 14365, 14409 and 14434; America's AI Action Plan; OMB M-25-21 | United States (federal) | EO 14179 (23 January 2025) revoked EO 14110; Action Plan July 2025; EO 14365 (11 December 2025); EO 14409 (2 June 2026); EO 14434 (29 September 2026) | Federal agencies; AI developers through voluntary frameworks; states through funding conditions and litigation | Agency AI governance and use case inventories (M-25-21); voluntary covered frontier model access; challenges to state AI laws | No general federal AI statute; existing laws such as the FTC Act and 18 U.S.C. 1030 apply |
| SB 26-189 (repealed and reenacted the Colorado AI Act, SB 24-205) | Colorado | Signed May 2026; effective 1 January 2027; Attorney General rules due before 1 January 2027, hearing 26 October 2026 | Developers and deployers of automated decision-making technology used in consequential decisions | Requirements for ADMT in consequential decisions, to be detailed in the Attorney General's rules | Colorado Attorney General |
| SB 53, Transparency in Frontier Artificial Intelligence Act | California | Signed 29 September 2025; in force from 1 January 2026 | Frontier developers, with most duties on large frontier developers | Publish a frontier AI framework; report critical safety incidents to the Office of Emergency Services; whistleblower protections | Civil penalties enforced by the Attorney General |
| Interim Measures for the Management of Generative AI Services; Measures for Labelling AI-Generated Synthetic Content | China | Interim Measures in force 15 August 2023; Labelling Measures in force 1 September 2025 | Generative AI services offered to the public in mainland China; content platforms and app stores for labelling | Lawful training data (Art. 7), complaints channels (Art. 15), security assessment and algorithm filing for services with public opinion attributes (Art. 17); explicit labels and metadata labels on generated content | Cyberspace Administration of China with other departments |
| Artificial Intelligence and Data Act (AIDA), in Bill C-27 | Canada (federal) | Not enacted: Bill C-27 never left House of Commons committee and the session ended on 6 January 2025 | Would have covered high-impact AI systems | None in force; privacy and human rights law still apply | None |
| Act on Promotion of Research and Development, and Utilization of AI-related Technology | Japan | Passed 28 May 2025; partly in force 4 June 2025; fully in force 1 September 2025 | Government, research bodies, businesses and citizens | AI Strategic Headquarters chaired by the Prime Minister; AI Basic Plan; businesses "shall endeavor to cooperate"; government investigates cases where rights are infringed | Guidance, advice and public information; no penalties in the official outline |
| AI Basic Act (Act on the Development of Artificial Intelligence and Establishment of Trust) | South Korea | In force 22 January 2026, according to Cooley; MSIT reportedly indicated a one-year grace period before fines | AI business operators, including foreign firms above revenue or user thresholds | High-impact AI duties (explanation, user protection plan, human oversight, documentation); generative AI notice and labelling; domestic representative; duties for models trained with 10^26 FLOPs or more | Ministry of Science and ICT; fines up to KRW 30 million |
| PL 2338/2023 | Brazil | Passed by the Senate; in the Chamber of Deputies since 17 March 2025, status "Aguardando Parecer" (awaiting committee report) and subject to a plenary vote, as of 2 September 2026 | Would cover AI developers and deployers on a risk basis | Not in force | Not in force |
| Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law | Council of Europe, open to non-members | Opened for signature 5 September 2024; signatories include the UK, the US, the EU, Canada, Japan and Switzerland; the Council of Europe lists the EU as a Party | States that ratify; covers public authorities and private actors, with defence excluded | Lifecycle measures protecting human rights, democracy and the rule of law; parties choose how to apply it to the private sector | Through national law once ratified |
| OECD Recommendation on AI (AI Principles) | 47 adherents | Adopted May 2019; updated May 2024 | Governments; widely reused by companies | Five values-based principles, including transparency and explainability, robustness, security and safety, and accountability | Voluntary |
| G7 Hiroshima Process International Code of Conduct | G7, open to others | Published October 2023; organisations can report through the Hiroshima AI Reporting Framework on OECD.AI | Organisations developing advanced AI systems | Risk identification, testing, transparency reporting, security controls, content authentication | Voluntary |
Other laws to track
The instruments below were not re-verified against official text for this edition, so the table gives only scope and the body responsible; check the official source before relying on dates.
| Instrument | Jurisdiction | Responsible body | Note |
|---|---|---|---|
| Texas Responsible Artificial Intelligence Governance Act (HB 149) | Texas | Texas Attorney General | Prohibited AI uses and government AI disclosure; effective 1 January 2026 |
| Utah Artificial Intelligence Policy Act | Utah | Utah Division of Consumer Protection | Disclosure when consumers interact with generative AI |
| Local Law 144 of 2021 | New York City | Department of Consumer and Worker Protection | Bias audits and notices for automated employment decision tools |
| California AI Transparency Act (SB 942) and AB 2013 | California | California Attorney General and local prosecutors | Detection tools and disclosures for large generative AI providers; training data documentation for generative AI |
| Chatbot Safety Act (HB 26-1263) | Colorado | Colorado Attorney General | Conversational AI services; signed 1 July 2026, effective 1 January 2027 (confirmed by the Attorney General) |
| Product Liability Directive (EU) 2024/2853 | EU | National courts | Treats software, including AI systems, as a product for no-fault liability |
| Model AI Governance Framework | Singapore | IMDA and PDPC | Voluntary; companion framework for generative AI and the AI Verify testing toolkit |
| Recommendation on the Ethics of Artificial Intelligence | UNESCO member states | UNESCO | Adopted November 2021; ethics impact and readiness assessments |
Obligations mapped across regimes
Design one control set to the strictest version of each obligation. The table shows where each theme is a legal duty.
| Obligation | EU AI Act | China | South Korea | US states |
|---|---|---|---|---|
| Label or disclose AI-generated content | Art. 50: machine-readable marking of generated output; disclosure of deepfakes; tell people they are interacting with AI | Explicit labels (text, audio, image, video) and metadata labels with provider name and content ID | Notice before use; labels on generative AI output, clear notice where output is hard to tell from real | Utah generative AI disclosure; California SB 942; Colorado chatbot law from 2027 |
| Classify risk before deployment | Art. 6 high-risk classification, documented before placing on the market | Security assessment for services with public opinion attributes | Operators assess whether AI is high-impact; can ask MSIT | Colorado ADMT rules for consequential decisions from 2027 |
| Register or file | EU database registration for high-risk systems | Algorithm filing under the Algorithmic Recommendation Provisions | Reporting to MSIT for high-performance AI (details in decrees) | None general |
| Human oversight and explanation | Art. 14 oversight; Art. 26 deployer duties | Complaint and reporting channels (Art. 15) | Human intervention, supervision and "meaningful explanation" for high-impact AI | Colorado rules pending |
| Incident reporting | Art. 73 serious incidents to market surveillance authorities | No AI-specific incident duty in these measures | No AI-specific incident duty confirmed; high-performance AI operators report to MSIT | California SB 53: critical safety incidents to the Office of Emergency Services |
| Frontier or general-purpose models | GPAI duties since August 2025; systemic risk presumed above 10^25 FLOPs | Covered by the generative AI measures | Risk management for models at or above 10^26 FLOPs | California SB 53 frontier AI framework |
| Local presence | Authorised representative for non-EU providers | No representative rule in these measures | Domestic representative above KRW 1 trillion revenue, KRW 10 billion AI revenue or 1 million daily users | None |
For EU detail, including deployer duties, fundamental rights impact assessments and the Omnibus changes, see the AI Governance Guide. For how the AI Act interacts with the GDPR on training data and automated decisions, see the AI and Privacy Guide.
United States: federal policy and the states
- Federal direction (as of October 2026): EO 14179 revoked the 2023 order (EO 14110) under which NIST's Generative AI Profile was written. America's AI Action Plan of July 2025 asked OMB to "consider a state's AI regulatory climate when making funding decisions" and NIST to revise the AI Risk Management Framework, which NIST confirms is under revision.
- Pressure on state laws: EO 14365 told the Attorney General to set up an AI Litigation Task Force whose "sole responsibility shall be to challenge State AI laws", asked Commerce to list "onerous" state laws within 90 days, and called for a preemptive federal framework that would not cover child safety, data centre infrastructure or state procurement. It names Colorado's algorithmic discrimination law as an example. Check whether the Commerce list has been published before relying on any state law.
- Frontier models and cyber defence: EO 14409 asks agencies to design a voluntary framework under which developers of a "covered frontier model" give the government access for up to 30 days before release to other trusted partners, and states that it does not create a "mandatory governmental licensing, preclearance, or permitting requirement".
- Terminology: EO 14434 directs agencies to use "Super Intelligence" and "SI" instead of "artificial intelligence" and "AI" in their documents, without changing legal definitions or creating new obligations.
- Agencies: OMB M-25-21 requires Chief AI Officers, annual AI use case inventories and minimum practices for high-impact AI. Suppliers to federal agencies should expect these to flow into contracts.
Where identity fits
Every regime above assumes you can say which AI systems you run, who owns them and what they did. Agents and AI services act through service accounts, API keys and OAuth grants; logs that tie each action to an agent identity are the evidence for EU deployer logging and Korean human oversight duties, and revoking those credentials is how a system is actually withdrawn. See the Agentic AI Compliance Guide and the Identity Security Regulatory Map.
Time-sensitive items to watch
- EU (as of October 2026): Article 50 transparency rules apply from August 2026, with a grace period to 2 December 2026 for some generative systems already on the market; harmonised standards from CEN and CENELEC are still in development.
- Colorado (as of October 2026): the Attorney General's ADMT rules hearing is on 26 October 2026, and rules must be adopted before the 1 January 2027 start.
- US federal (as of October 2026): watch the Commerce list of state laws, the FCC and FTC actions under EO 14365, the EO 14409 frontier model framework and NIST's revised AI RMF.
- South Korea (as of January 2026): enforcement decrees and guidance on high-impact and high-performance AI were still being finalised, and fines were expected to follow a grace period.
- Brazil (as of September 2026): PL 2338/2023 awaits a committee report and a plenary vote in the Chamber of Deputies; any amendment would return it to the Senate.
- UK (as of September 2026): no government AI bill; a Private Member's Bill on artificial superintelligence has a second reading scheduled for 13 November 2026 and is unlikely to progress, according to Lewis Silkin.
- Council of Europe: entry into force requires five ratifications, including at least three Council of Europe member states; check the Treaty Office for the current count.
Standards and references
- European Commission: AI Act
- GOV.UK: A pro-innovation approach to AI regulation, government response
- The White House: Ensuring a National Policy Framework for Artificial Intelligence
- Colorado Attorney General: Artificial intelligence
- Cyberspace Administration of China: Measures for Labelling AI-Generated Synthetic Content
- Cabinet Office of Japan: Outline of the AI Promotion Act
- Council of Europe: Framework Convention on Artificial Intelligence
- OECD.AI: OECD AI Principles
Related NHI Mgmt Group resources: AI Governance Guide · AI and Privacy Guide · Agentic AI Compliance Guide · Global Privacy Regulatory Map. This guide summarises AI laws, executive policy and international AI frameworks as of October 2026 and is not legal advice.