Global AI regulation: what is actually in force
The short answer is: far less than the volume of coverage suggests. As at mid-2026 the number of jurisdictions with a comprehensive, mandatory, horizontal AI law in force can be counted on one hand, and one of the most-cited examples was repealed before it ever took effect.
High-volatility page
Non-EU AI law is moving faster than any other area this site covers, and public trackers disagree on several jurisdictions. Everything below is dated to our last review and states the instrument by name so you can check it. Where sources conflict we say so. Verify against the primary text before relying on any of it. Our standards →
Comprehensive horizontal laws in force
| Jurisdiction | Instrument | Status |
|---|---|---|
| European Union | Regulation (EU) 2024/1689, as amended by Reg. (EU) 2026/1744 | In force, phased. High-risk applies 2 Dec 2027 / 2 Aug 2028. Timeline → |
| South Korea | AI Framework Act (also cited as the AI Basic Act) | In force 22 Jan 2026, passed Dec 2024, promulgated Jan 2025, one-year transition. Risk-based, with transparency, human oversight and impact assessment duties |
Some trackers add further jurisdictions to this list. We include only those where multiple independent sources agree the instrument is comprehensive, mandatory, horizontal and in force.
Where this usually goes next
Three situations account for most people reading this page. Each has a different answer.
A deal is blocked on an AI questionnaire
Legal will not sign until you can evidence how AI is governed. HumanAudit’s AI Trust Package is a fixed $3,500 over five business days: a public trust page, a pre-filled SIG Lite / CAIQ / SSPA Section K questionnaire bank, and your AI inventory and classification.
You need ISO/IEC 42001 documentation
23 clause-mapped AIMS documents with all 38 Annex A controls pre-populated, editable and yours to keep, from $199. Or score your gaps first: 18 questions, free, no signup to begin.
You are not sure what reaches you
Twenty minutes with the founder. No prep, no deck, straight to the person accountable for the work. If none of this applies to you, you get told that on the call.
This reference is published by HumanAudit Inc. Not a law firm, not an accredited certification body, not a registered auditor. We build documentation, your counsel interprets it, and an accredited body of your choosing certifies you. How this is funded →
The rest, by approach
| Jurisdiction | Approach | What is actually binding |
|---|---|---|
| United States | No federal statute; state patchwork | Texas Responsible AI Governance Act (HB 149) in force since Jan 2026. California instruments including training-data transparency in force from Jan 2026. Illinois AI Video Interview Act. New York City Local Law 144 bias audits. A federal preemption effort is live and contested |
| Colorado | Repealed and replaced | SB 24-205, the first comprehensive US state AI law, was delayed and then repealed before taking effect. It was repealed in May 2026 and replaced by SB 189, a transparency-focused law effective 1 January 2027. SB 189 no longer contains the ISO 42001 / NIST AI RMF affirmative defence, nor the risk- and impact-assessment mandates of the original Act |
| China | Targeted binding measures, not an omnibus | A stack of instruments covering algorithmic recommendation, deep synthesis and generative AI, with pre-deployment assessment and content labelling obligations. Operationally demanding, structurally different from the EU model |
| United Kingdom | Sector-led, no horizontal act | Existing regulators applying existing powers. EU AI Act reach into the UK → |
| Canada | No federal AI statute | AIDA formed part of Bill C-27 and died on prorogation, 6 January 2025. Not reintroduced. Federal strategy and voluntary commitments, plus provincial rules in Ontario and Quebec |
| Japan | Promotion-oriented | AI Promotion Act (2025): deliberately light-touch, no monetary penalties, government able to name companies publicly |
| Brazil | Bill in progress | PL 2338/2023 passed the Senate in December 2024; still before the Chamber of Deputies as at mid-2026. LGPD applies to AI processing personal data in the meantime |
| India | Data protection first | DPDP Rules notified in late 2025 with obligations phasing in. No dedicated horizontal AI statute |
| Singapore, Australia | Voluntary frameworks | Governance frameworks and guidance rather than binding statute |
Three things this map actually tells you
- The EU is still the binding constraint for most multinationals. Not because it is the only law, but because it is the most demanding and it reaches extra-territorially through output used in the Union. Article 2 scope →
- “Comprehensive AI law” headlines outrun the statute book. Colorado was cited for two years as the American answer to the EU AI Act and was repealed before it applied. Canada’s AIDA was cited almost as often and never became law. A compliance plan built on either would have been built on nothing.
- Obligations differ in kind, not only in degree. Building to the EU AI Act puts you ahead of most regimes on documentation and oversight, but it does not produce China’s pre-deployment assessments, and it does not answer US state adverse-decision notice requirements framed around consequential decisions rather than risk tiers.
How we would sequence a multinational programme
Practical recommendation. Build the EU AI Act evidence base first, because it is the superset for documentation, risk management and oversight. Then treat each other jurisdiction as a delta: what does this regime ask for that my EU file does not already produce? For most that delta is disclosure and notice obligations rather than a second compliance programme. The exception is China, where the model differs enough to need its own workstream.
Status labels on this page
Verified fact: That the EU and South Korea have comprehensive horizontal AI laws in force; South Korea's 22 January 2026 date; that Colorado's SB 24-205 was repealed and replaced before taking effect; that Canada's AIDA died on prorogation on 6 January 2025; that Texas's TRAIGA has been in force since January 2026; and that Brazil's PL 2338/2023 passed the Senate in December 2024 and remains before the Chamber.
Expert analysis: The sequencing recommendation, the delta framing, and the three conclusions above.
Unsettled: The precise identity, number and effective date of Colorado's successor instrument, on which sources vary; the status of the US federal preemption effort; and UK secondary legislation on AI and automated decision-making. Verify against primary texts.
Build the superset once
The EU AI Act evidence base, inventory, classification, risk file, oversight records, technical documentation — is the widest set any current regime asks for. Everything else is a delta against it.
Not sure where you sit?
The classifier maps your system against Articles 5, 6, 50 and Annex III. Twelve questions, no email.
Frequently asked
Which countries have comprehensive AI laws in force?
As at mid-2026, very few. The European Union's AI Act, Regulation (EU) 2024/1689 as amended, is in force with phased application. South Korea's AI Framework Act, also referred to as the AI Basic Act, was passed in December 2024, promulgated in January 2025 and took effect on 22 January 2026, making it the first comprehensive horizontal AI law in the Asia-Pacific region.
Most other jurisdictions, including the United Kingdom, Canada, Japan, Australia, Singapore and India, govern AI through sector regulators, data protection law or voluntary frameworks rather than a dedicated horizontal statute.
Is there a federal AI law in the United States?
No comprehensive federal AI statute exists as at mid-2026. Governance comes from sector regulators acting under existing authority, executive orders and procurement rules at federal level, and binding obligations at state level. Texas's Responsible AI Governance Act has been in force since January 2026. Colorado's AI Act, SB 24-205, was delayed and then repealed and replaced before taking effect, with the successor instrument reported to take effect on 1 January 2027. A federal preemption effort is live and adds uncertainty to the state layer.
What happened to Canada's AIDA?
The Artificial Intelligence and Data Act formed part of Bill C-27 and was still at committee stage when Parliament was prorogued on 6 January 2025. It did not become law and has not been reintroduced. Canada's operative layer is federal strategy and voluntary commitments together with provincial rules, notably in Ontario and Quebec.
Does complying with the EU AI Act cover other jurisdictions?
Not automatically, though it is the most demanding baseline. The EU's risk classification, technical documentation, human oversight and post-market monitoring requirements substantially exceed what most other regimes ask for, so an organisation built to the AI Act is usually well placed elsewhere. But obligations differ in kind rather than only in degree: South Korea's framework and several US state laws impose disclosure and adverse-decision duties framed differently, and China's regime imposes pre-deployment assessment and content labelling obligations the AI Act does not.