AI regulation tracker

Applies outside the EU when AI is placed on the EU market or its output is used there. The Digital Omnibus delayed high-risk duties; it did not remove them.

Do now: Classify each AI use by risk level, and build oversight, logging and documentation into agents now.

All industries

Covers notice, consent, security, breach reporting and data rights for digital personal data in India.

Do now: Make sure every agent that reads personal data can check purpose and consent status before it acts.

All industries

Seven principles and 26 recommendations for banks, NBFCs and other regulated entities, including a board-approved AI policy, an inventory of AI systems and periodic audits. Recommendations, not yet binding rules.

Do now: Adopt a board-approved AI policy and keep a live register of every model and agent.

Banking and payments

Expected to require kill switches, human-in-the-loop controls, data controls and accountability for third-party tools.

Do now: Confirm every trading, advice and surveillance model has a tested off switch and a named owner.

Banking and payments

Replaces the 2024 Colorado AI Act with a disclosure-based law for consequential decisions in areas such as employment, lending, housing, insurance and healthcare.

Do now: Add notices, adverse-outcome explanations and a human review route to AI-assisted decisions.

Banking and paymentsHealthcareReal estate+2

A voluntary US framework widely used to structure AI risk programmes: govern, map, measure, manage.

Do now: Use it as the backbone of your AI risk register if you have none.

All industries

No AI-specific law yet. SDAIA sets AI ethics principles and generative AI guidance, and personal data is governed by the PDPL.

Do now: Treat SDAIA principles as the expected standard, and track the Responsible AI Policy as it is finalised.

All industries

A principles-based approach: data protection law, the national AI charter and sector guidance, including for financial institutions.

Do now: Check free-zone rules (DIFC, ADGM) where they apply, and sector regulator guidance for financial services.

All industries

Australia dropped the proposed mandatory guardrails for high-risk AI and relies on existing technology-neutral laws, voluntary guidance and a new AI Safety Institute.

Do now: Map agents against existing privacy, consumer and anti-discrimination law, and adopt the voluntary guidance as your baseline.

All industries

The international, certifiable standard for running an AI management system. Increasingly asked for in enterprise procurement.

Do now: Use it to show customers and auditors that AI is governed, especially across several jurisdictions.

All industries