From Brussels to Riyadh to Seoul, the number of binding AI laws, standards and treaties is rising fast — and diverging in form. Beneath the divergence sits a small, stable set of shared obligations. FAIrMind tracks both, so your governance answers to the principles every regime shares rather than to forty moving targets.
The developments a board should already know about. Each entry is dated and sourced; the desk is reviewed on a rolling basis and re-dated at the top of the page.
Fewer than a handful of jurisdictions have a horizontal AI statute in force. Most govern through existing law, sector regulators, free-zone rules or voluntary codes — and the bindingest rules are frequently vertical, aimed at banks and insurers rather than the economy at large. The chips below mark legal force, not maturity.
The world's benchmark horizontal law. Risk-tiered: prohibited, high-risk, limited (transparency) and minimal. General application and Article 50 transparency duties are live; the 2026 Digital Omnibus deferred the heaviest high-risk duties.
Asia's first comprehensive, risk-based AI law. Consolidates 19 bills into one framework covering "high-impact" and generative AI, with transparency, impact assessment, human oversight and extraterritorial reach, administered by MSIT.
The third national comprehensive AI statute to take effect. Eight chapters and 35 articles, with a dedicated chapter on risk-based classification and management; existing systems get a 12–18 month transition.
No single AI act, but a mature stack of enforceable rules: the 2023 generative-AI measures, algorithm-recommendation and deep-synthesis rules, and mandatory labelling of AI-generated content — reinforced by Cybersecurity-Law amendments and new companion/interactive-AI rules.
No comprehensive federal statute. Federal policy runs through executive orders and procurement; binding private-sector duties sit in state law. Around 40 states have acted — California's SB 53 (frontier) and AI Transparency Act, Texas TRAIGA, Illinois, Utah — while Washington pushes to preempt them.
No single AI law. Governance runs through the National AI Strategy 2031, the UAE Charter for AI, the federal PDPL and — often stricter — the DIFC and ADGM free-zone regimes, plus 2026 Central Bank responsible-AI guidance. What binds you depends on where you are established.
The binding layer is the PDPL; AI itself is governed by SDAIA's AI Ethics Principles, Generative AI Guidelines and a 2026 risk-management framework — non-binding, but accreditation increasingly gates public contracts. A draft Responsible AI Policy with a four-tier risk model went to public consultation in 2026.
Across the wider region, binding force sits in data-protection law and central-bank guidance (Qatar, UAE), while AI itself is steered by ethics principles and public-sector risk management (Israel, Egypt). National strategies are advancing faster than statutes.
No AI Act, and none before Parliament. Regulation sits at the point of use with existing regulators; the 2026 agenda is sandboxes and growth (the AI Growth Lab), plus new automated-decision-making rules. The UK has signed the Council of Europe treaty.
No AI Act. The 2024 mandatory-guardrails proposal was shelved by the 2025 National AI Plan in favour of existing, technology-neutral law and voluntary standards. In 2026 the government created an Office of AI and signalled mandatory "Australian Standards for AI" and data-centre rules.
No horizontal Act. The voluntary India AI Governance Guidelines (Nov 2025) set principles; the first binding provision is the MeitY IT-Rules amendment mandating labelling and metadata for synthetic content. The sharpest instrument is vertical: the RBI's FREE-AI framework (7 Sutras, 26 recommendations) for RBI-regulated entities. BIS has adopted ISO/IEC 42001 nationally.
Horizontally voluntary: IMDA's Model AI Governance Framework, AI Verify, and the world-first agentic-AI framework (Jan 2026). Vertically demanding: MAS's FEAT principles and its new AI Risk Management Guidelines for financial institutions (consulted to 31 Jan 2026, 12-month transition once issued) rank among the most structured supervisory regimes anywhere.
Deliberately non-binding: no enforcement mechanism, governance framed as industry self-regulation, with sector regulators layering rules on top. A pro-innovation posture that prioritises adoption over prohibition.
AIDA lapsed when Bill C-27 died. Governance now runs through existing privacy and consumer law plus a voluntary code of conduct for advanced generative systems; a renewed legislative approach is under consideration.
The comprehensive AI Bill (PL 2338) — risk-tiered, rights-based and EU-influenced — has advanced in the Senate but is not yet law. If enacted it would be Latin America's most comprehensive AI statute and a regional template.
The first legally binding international AI treaty, grounding AI in human rights, democracy and the rule of law. It binds states, not companies. The EU deposited the first consent to be bound (May 2026); further ratifications are needed before it enters into force.
The OECD AI Principles (2019, updated 2024) supply the shared vocabulary most regimes borrow; the G7 Hiroshima Process adds a code of conduct for advanced models; the UN's Global Dialogue on AI Governance convened its first session in 2026.
A development-first, phased blueprint adopted in 2024. Phase 1 (2025–26) builds national strategies and governance structures; Phase 2 (2027–30) implements. National strategies are live in Egypt, Nigeria, Rwanda, Mauritius and Senegal; binding force mostly flows through data-protection law.
The instruments differ sharply in legal force, reach and penalty. On the obligations that actually shape a control environment, they converge. Both tables read left to right; the synthesis beneath them is the part worth taking to a board.
| Regime | Legal nature & status | Who it binds / trigger | Risk approach | Reach beyond borders | Assurance & maximum penalty |
|---|---|---|---|---|---|
| EU AI ActReg. (EU) 2024/1689 | Binding regulation; phased, most rules live from Aug 2026, high-risk to 2027–28. | Providers & deployers placing on / using AI in the EU market, by risk tier. | Four tiers (Art. 5 prohibited, Art. 6 / Annex III high-risk, Art. 50 transparency, minimal) plus a GPAI layer (Art. 51–55; systemic-risk presumed at 1025 FLOP). | Extraterritorial — applies where output is used in the EU. | Conformity assessment for high-risk; fines to €35M or 7% of global turnover. |
| US — federal + statesEO 14365 + state laws | No federal statute; executive policy plus ~40 state laws. Active push to preempt. | Varies by state; frontier-developer, sectoral or consumer-protection triggers. | Mixed — frontier-model safety, sector risk, transparency, anti-discrimination. | State laws reach conduct affecting their residents (e.g. CA frontier rules). | Mostly AG enforcement; e.g. CA SB 53 to $1M per violation. No federal certification. |
| ChinaStacked measures | Multiple binding administrative measures; no single act. | Providers of generative, recommendation, deep-synthesis and interactive services. | Use-case specific, with security review and content-control duties. | Applies to services offered within China; content obligations are strict. | Regulator filing, algorithm registration, labelling; suspension & administrative penalties. |
| South KoreaAI Basic Act | Binding framework law, in force Jan 2026. | Operators of "high-impact" and generative AI; extraterritorial. | Risk-based, centred on a "high-impact" category mirroring EU high-risk. | Extraterritorial, with a domestic-representative expectation. | Transparency, impact assessment, human oversight; penalties for high-impact operators. |
| VietnamLaw on AI 2025 | Binding statute, in force Mar 2026. | AI developed or deployed in Vietnam; risk-classified. | Risk-based classification & management (dedicated chapter). | Applies to activity in Vietnam; 12–18 month transition for existing systems. | Classification and management duties; administrative enforcement. |
| UKSector-led | No AI-specific statute; existing regulators + guidance. | Regulated at the point of use by sector regulators. | Principles-based (safety, transparency, fairness, accountability, contestability). | Territorial via existing regulatory remits. | Enforcement through existing regulators; no dedicated AI conformity regime. |
| AustraliaNational AI Plan | No AI Act; 2024 mandatory guardrails shelved. Standards & legislation flagged for 2027. | Existing tech-neutral laws economy-wide; strict rules for Commonwealth public sector. | Voluntary, risk-based guardrails; "high-risk" defined but not enacted. | Territorial via existing law. | Existing-law enforcement; mandatory impact assessments in the public sector. |
| IndiaTechno-legal + sectoral | No horizontal Act; voluntary guidelines, one binding labelling rule, RBI FREE-AI for finance. | Platforms for content labelling; RBI-regulated entities for FREE-AI; principles otherwise. | Principle-based; targeted mandatory duties; risk-tiered supervisory expectations in finance. | Applies to platforms and regulated entities serving Indian users. | IT-Rules enforcement; RBI supervisory expectations; BIS-adopted ISO/IEC 42001 for assurance. |
| UAELayered + free-zone | No single AI law; federal + DIFC/ADGM regimes; dedicated law in development. | Depends where you sit — mainland (PDPL), DIFC (Reg. 10), ADGM. | Charter principles + free-zone / sector rules; impact assessments emerging. | By establishment and sector; free zones are stricter. | Data-protection & sector enforcement; AI-seal / self-assessment expected for tenders. |
| Saudi ArabiaSDAIA-led | No binding AI law; PDPL binding, SDAIA AI guidance non-binding; draft policy consulted 2026. | SDAIA accreditation gates public contracts; PDPL for personal data. | Draft four-tier risk model; 2026 AI risk-management framework. | Kingdom operations; data transfers restrictive by default. | PDPL fines to SAR 5M; SDAIA self-assessment for high-risk use cases. |
| CoE ConventionCETS 225 | Binding treaty on states; not yet in force. | State parties — obligations flow into national law, not directly onto firms. | Rights-based: human rights, democracy, rule of law across the lifecycle. | Open to non-European states; effect depends on ratification and transposition. | No corporate penalty regime; parties must provide domestic remedies. |
Scroll the table sideways to see every column →
| Framework | Type | Primary focus | Certifiable? | Core structure | Best used for |
|---|---|---|---|---|---|
| ISO/IEC 42001:2023AI Management System | Certifiable management-system standard. | Organisational governance of the AI lifecycle. | Yes — accredited third-party, two-stage audit. | Harmonised Structure shared with ISO 27001 / 9001; Annex A controls. | Demonstrable, auditable AI governance for customers & regulators. |
| ISO/IEC 23894:2023AI risk management | Guidance standard. | AI-specific risk identification, analysis, treatment. | No — guidance, not certifiable. | Applies ISO 31000 to AI, with AI risk examples. | Building the risk process that feeds an ISO 42001 system. |
| ISO/IEC 42005:2025AI impact assessment | Guidance standard. | Impacts of an AI system on individuals, groups and society. | No — guidance, not certifiable. | Lifecycle assessment process + documentation template. | The impact-assessment evidence the EU AI Act and rights-based regimes expect. |
| NIST AI RMF 1.0+ Generative AI Profile | Voluntary US framework. | Trustworthy-AI outcomes across the lifecycle. | No formal certification; self-attestation. | Four functions — Govern, Map, Measure, Manage — + 7 trust characteristics. | Engineering-level risk discipline; a common US reference point. |
| ISO 31000:2018Risk management | Guidance standard (all risk). | Enterprise-wide risk principles, framework, process. | No — guidance, not certifiable. | Principles → framework → process. | The parent discipline AI risk work should nest inside. |
| ISO 22301:2019Business continuity | Certifiable management-system standard. | Operational resilience & continuity. | Yes — accredited third-party. | Plan-Do-Check-Act; business impact analysis. | Ensuring AI-enabled operations degrade safely, not catastrophically. |
| COSO ERM (2017)Enterprise risk | Framework (voluntary). | Integrating risk with strategy & performance. | No — framework, not certifiable. | Five components, 20 principles. | Board-level linkage of AI risk to strategy and appetite. |
| Three Lines Model (IIA)2020 update | Governance model. | Roles across management, oversight & assurance. | No. | Governing body; management (1st/2nd line); internal audit (3rd line). | Assigning who owns, oversees and independently assures AI risk. |
Scroll the table sideways to see every column →
The convergent core — build to these once and most regimes are substantially answered.
The differences that decide cost, liability and where you certify.
Laws tell you what is prohibited. Standards tell you how to run an organisation that stays inside the line — and they are the evidence procurers, insurers and courts increasingly ask for. FAIrMind builds one governance architecture that maps to all of them.
Short reads on AI governance — our own field notes and the external sources worth your time. A working bibliography for boards, risk owners and builders, refreshed as the desk publishes.
Have a note or paper worth featuring — yours or someone else's? Send it to solutions@fairmind.tech.
You cannot staff forty compliance regimes.
You can govern to the obligations they share.
Book a 30-minute regulatory-exposure briefing. We map your AI footprint against the regimes that actually reach you — from the EU to the Gulf to APAC — and show you the shortest defensible path to a single, audit-ready governance architecture.
Opens a pre-filled email to our advisory desk. Prefer a calendar link? Reach us at solutions@fairmind.tech.
Every status on this page is checked against primary texts and independent trackers before it is published.
Triangulation. No status is published on this page unless it is corroborated by the primary text and at least two independent trackers or advisories. Where sources disagree — as they did on the Council of Europe treaty's entry into force — we state the conservative, verifiable position.
Review cadence. The desk is reviewed on a rolling basis and re-dated at the top of the page. A freshness note appears automatically when the review is more than 30 days old.
Not legal advice. This page is regulatory intelligence for orientation, not legal advice. Obligations depend on your specific systems, role and markets. Confirm any date or threshold against the primary source before acting.
