See which AI laws, standards and regulator guidelines apply in every country you operate in, what each one asks you to do, and what evidence an auditor will want.
Loading map…
European Union
United Kingdom
United States
Asia-Pacific
Middle East and Africa
Americas
India
Law/RegulationCoE
The first legally binding international treaty on AI, requiring its Parties to keep AI in line with human rights, democracy and the rule of law. Signed widely, but not yet in force.
FrameworkG7
A voluntary G7 code listing 11 actions for organisations that build the most advanced AI models, plus an OECD form where companies publicly report how they follow it.
StandardISO
International guidance on how any organisation that builds or uses AI can find, judge and treat AI-specific risks, using the familiar ISO risk management cycle.
StandardISO
The first certifiable international standard for running an AI management system: how an organisation governs the AI it builds, sells or uses.
StandardISO
International guidance on how to assess and document the effects an AI system may have on people, groups and society, across its whole life.
FrameworkOECD
The first intergovernmental standard on AI: five values every AI actor should follow and five policy actions for governments, agreed by OECD members and other adherents.
Law/RegulationEU
The EU's horizontal, risk-based AI law: it bans some AI uses, regulates high-risk AI tightly, adds transparency duties for chatbots and generated content, and sets rules for general-purpose AI models.
StandardEU
Status tracker for the European technical standards that let high-risk AI providers prove AI Act compliance. The first one, EN 18286 on quality management, was cited in the Official Journal on 14 Oct 2026; the rest are still in progress.
Law/RegulationEU
The EU's general data protection law. Not written for AI, but it governs any AI that trains on or decides about people in the EU.
Regulatory GuidanceGB
The UK banking regulator's five principles for how banks with internal capital models should find, govern, build, validate and patch every model they rely on, including AI and machine learning models.
Law/RegulationGB
The UK's general data protection law, which since February 2026 has a new, more permissive regime for automated decisions with stronger built-in safeguards.
FrameworkGB
The UK's choice to regulate AI through existing regulators using five shared principles, instead of a single AI law.
Law/RegulationUS·CA
A California law, operative since 2 August 2026, that makes generative AI providers stamp hidden provenance data into the images, video and audio they create and offer a free tool to check it; platforms and camera makers follow in 2027 and 2028.
Law/RegulationUS·CA
California privacy rules, in force since 1 January 2026, that give people notice, opt-out and access rights when a business uses automated tools to make major decisions about them, and require privacy risk assessments and yearly cybersecurity audits.
Law/RegulationUS·CA
California's frontier AI law: the biggest model builders must publish a safety framework, publish a short report for each new model, report serious safety incidents to the state, and protect staff who raise alarms.
Law/RegulationUS·CO
Colorado's 2024 high-risk AI law was replaced before it was ever enforced by a narrower 2026 law on automated decision-making technology (ADMT) that starts on 1 January 2027.
Law/RegulationUS·IL
An Illinois civil rights law that makes discriminatory AI use in employment decisions unlawful and requires employers to tell workers when AI is used.
Regulatory GuidanceUS
A template that US state insurance regulators issue to tell insurers how to govern AI so it does not lead to unfair or unlawful decisions.
Law/RegulationUS·NY
New York's frontier AI law, taking effect 1 January 2027: the largest model developers must publish safety frameworks, report serious incidents within 72 hours, register with a new office inside the state financial regulator, and pay its costs.
FrameworkUS
A free, voluntary US framework that organises AI risk work into four functions (Govern, Map, Measure, Manage), with a companion profile for generative AI risks.
Law/RegulationUS·NYC
A New York City law that bars employers and employment agencies from using AI hiring or promotion tools unless the tool had an independent bias audit in the past year, the results are public, and candidates got 10 business days' notice.
Regulatory GuidanceUS·NY
New York's financial regulator explains how its existing cybersecurity rule (23 NYCRR Part 500) should be applied to threats that AI creates or makes worse.
PolicyUS
Two White House budget office memos that tell US federal agencies how to use AI (M-25-21) and how to buy it (M-25-22).
Law/RegulationUS
A US federal law that makes it a crime to publish non-consensual intimate images, real or AI-made, and forces platforms to remove them within 48 hours of a valid request.
Law/RegulationUS·TX
A Texas law, in force since 1 January 2026, that bans a short list of harmful AI uses, makes government agencies and health providers disclose AI, and gives the Attorney General sole power to enforce it.
PolicyUS
A presidential order telling federal agencies to challenge, defund and eventually override state AI laws the administration sees as burdensome.
Regulatory GuidanceUS
The three US federal bank regulators' 2026 principles for managing the risk of relying on models, which replaced the 2011 SR 11-7 guidance and covers traditional and non-generative AI models but leaves generative and agentic AI out of scope.
Law/RegulationUS·UT
Utah's light-touch AI law: businesses must admit they are using generative AI when a consumer clearly asks, licensed professionals must say so up front in high-risk interactions, and a state Office of AI Policy runs a sandbox until mid-2027.
FrameworkAU
Australia's national, voluntary six-practice playbook for responsible AI, plus APRA's April 2026 warning to banks, insurers and super funds to lift AI risk management.
Regulatory GuidanceHK
Hong Kong's bank regulator expects banks to own every AI decision, explain it, test it, tell customers, and give them a way to challenge it, with extra care for generative AI.
Law/RegulationJP
Japan's framework law that builds a government AI command centre and a national AI plan, asks businesses to cooperate, and sets no fines.
Law/RegulationKR
South Korea's framework AI law: mostly about promoting the AI industry, with a short set of binding duties on transparency, high-impact AI, very large models and foreign companies' local representatives.
Law/RegulationKR
Korea's general privacy law, which since 2024 lets people refuse or demand an explanation of fully automated decisions, and which in 2026 gained special rules for using personal data to build AI.
Regulatory GuidanceSG
Singapore's central bank expectations for how every financial institution should find, rank and control its AI, from simple copilots to AI agents.
FrameworkSG
Singapore's voluntary guide for organisations deploying AI agents: bound the risks early, keep humans accountable, add technical controls, and help users use agents well.
Law/RegulationVN
Vietnam's standalone AI statute: three risk tiers, notification on a national AI portal, labelling of AI content, and a local contact for foreign high-risk providers.
FrameworkJO
Jordan's central bank blueprint telling every bank how to govern, test, secure and report on AI, with opt-outs and explanations for customers.
Regulatory GuidanceAE
What is verifiable in the UAE today: central bank guidance telling banks and insurers to govern AI, test it for bias every year, explain high-impact decisions such as loans, and let customers ask for a human.
BillBR
Brazil's proposed general AI law, modelled on a risk-based approach like the EU AI Act; passed by the Senate in December 2024 and still being reviewed by the Chamber of Deputies.
Law/RegulationBR
Brazil's general data protection law, which gives people a right to have purely automated decisions reviewed and lets the regulator audit algorithms for discrimination.
PolicyCA
Canada's binding rulebook for federal departments that use algorithms or AI to make or help make decisions about people.
Regulatory GuidanceCA
Canada's federal financial regulator's principles for managing the risk of every model a bank or insurer uses, written with AI and machine learning explicitly in mind, effective 1 May 2027.
Law/RegulationPE
A short 2023 law that promotes AI under risk-based principles, made operational in 2025 by a detailed regulation with banned uses, high-risk duties and phased deadlines.
BillIN
A private member's bill in the Lok Sabha that would set up a national AI Ethics Committee, put duties on AI developers and allow fines up to Rs 5 crore. It is only a proposal and is unlikely to become law in this form.
FrameworkIN
ICMR's ethics rulebook for building, testing and using AI in medical research and patient care in India, aimed at developers, clinicians, hospitals and ethics committees.
FrameworkIN
India's national, non-binding blueprint for AI governance: seven principles, six pillars of recommendations, new coordinating bodies, and no new AI law for now.
Law/RegulationIN
India's first general data protection law. Not an AI law, but it decides how Indian companies may collect and use personal data to train and run AI.
Law/RegulationIN
Binding Indian rules that make online platforms and AI content tools block unlawful deepfakes, label lawful synthetic media, and take content down much faster.
Regulatory GuidanceIN
A run of MeitY letters (late 2023 to March 2024) telling platforms how the existing IT Rules apply to AI models and deepfakes; persuasive, partly codified in 2026.
FrameworkIN
India's first national set of responsible AI principles (Part 1) and a plan for putting them into practice through government, companies and researchers (Part 2). Guidance only.
FrameworkIN
An RBI-appointed committee's blueprint of 7 principles and 26 recommendations for safe, responsible AI use by banks, NBFCs and other regulated entities.
Regulatory GuidanceIN
SEBI's draft principles for how exchanges, brokers, mutual funds and other market participants should govern, test, disclose and secure their AI/ML systems.
PolicyIN·TN
A Tamil Nadu government order that makes state bodies score and check any AI system before they buy it or roll it out to the public.
PolicyIN
TRAI's advice to the Government to create a cross-sector, risk-based AI regulator, plus ideas for using AI in telecom security, grievances and spam control.
Dates that recently passed and the ones coming up, across every policy we track.
Library last verified 19 Oct 2026
40 controls cover the 309 obligations we have mapped, each with a checklist, evidence examples and a crosswalk to ISO 42001, ISO 27001 and SOC 2.
Browse the controlsSecComply’s AI Governance service builds your AI inventory, risk classification and evidence, mapped to every rule in this tracker that reaches you.
Explore AI GovernanceGeneral information, not legal advice. Confirm the current position with qualified counsel before acting.
