AI Regulations by Country: The Global Compliance Map for 2026

Executive Summary: AI Regulations by Country at a Glance

A prospect's security questionnaire lands with one line in it: "Which AI laws does your product fall under?" Your CEO says the EU AI Act. Your engineer says Colorado. Your lawyer says it depends. Nobody is wrong, and nobody has the full picture of AI regulations by country.

Only a handful of jurisdictions have a binding, comprehensive AI statute: the EU, South Korea and Vietnam, with Italy layering a national law on top of the EU Act. The US has no federal AI statute and a moving patchwork of state laws. The UK, Canada, Australia, India, Singapore and Japan rely on existing law, guidance, or a law with no penalties. China regulates through targeted rules.

Which of them applies to you depends on where your AI system is used and where its outputs land, not where your company is based.

By the end of this guide, you will know which of these laws can reach a company like yours, which dates have moved, and where a table cell hides an exception.

A boundary up front: this is the AI-specific map. It is not the privacy map, and it is not the list of EU and EEA member states. For which countries the GDPR covers, see our GDPR countries guide. For the management-system standard that sits behind several of these laws, see what is ISO 42001.

Here's what's ahead:

• The four models countries use to regulate AI, and a side-by-side table
• Europe, the US, Asia-Pacific and the Americas, one dated section each
• Treaties and standards that sit outside any single country
• What the laws have in common, and a method to work out which ones apply to you
• The mistakes that make AI law summaries wrong within months

AI Regulations by Country: Four Models for Regulating AI in 2026

Which countries have AI laws? Sorted by category rather than counted, the answer is four groups. Each country in the rest of this guide lands in one of them.

Binding comprehensive statute. One law covers AI systems across sectors, with obligations by risk level and fines. The EU, South Korea and Vietnam sit here, and Italy added a national law that follows the EU Act.

Targeted rules. No single AI law, but binding rules on specific uses. China regulates generative AI and AI-generated content labelling. In the US, states pass laws on employment decisions, frontier models or consumer-facing automation.

Guidance or promotion law with no penalties. Japan's AI Promotion Act, Singapore's frameworks, India's governance guidelines and Australia's National AI Plan encourage good practice and rely on existing laws for enforcement.

No AI statute yet. The UK and Canada have no AI-specific law, and Brazil's bill is still in the Chamber of Deputies.

You will not find a headline number of "countries with AI laws" here. Trackers define regulation differently: a self-reported database may count 60 countries and 193 regulations, while another counts only enacted statutes, and the figures are not comparable. A count without a definition tells you nothing about your obligations.

AI Laws by Country: The Global AI Regulation Comparison Table

This AI regulation comparison puts the main instruments side by side, with the maximum penalty and what that number is measured against. Status is as of October 2026.

Read the table by obligation type too. Most of these laws share the same building blocks, and the differences are in who carries them:

AI Regulations by Country in Europe: The EU AI Act, Italy and the UK

Europe holds the most developed AI rulebook in the world, and a lot of outdated summaries of it.

EU AI Act: Dates and Penalties as of October 2026

Among AI regulations around the world, the EU AI Act is the only comprehensive law with full extraterritorial reach and turnover-based fines. It entered into force on 1 August 2024 and phases in over four years. The dates moved in 2026, which is why many guides are now wrong.

On 27 July 2026, the Digital Omnibus on AI (Regulation (EU) 2026/1744) took effect and pushed the high-risk dates back (Cooley). The European Commission's AI Act Service Desk now lists:

Source: EU AI Act Service Desk timeline, checked 9 October 2026.

Penalties come in three tiers under Article 99:

• Prohibited practices: up to EUR 35 million or 7% of total worldwide annual turnover
• Most other operator obligations: up to EUR 15 million or 3%
• Supplying incorrect or misleading information to authorities: up to EUR 7.5 million or 1%

For each tier the higher figure is the cap, except that SMEs and start-ups pay the lower of the two. The Act reaches providers and deployers outside the EU whenever an AI system's output is used in the EU, with no revenue threshold and no requirement for an EU office.

Italy: Law 132/2025 Layers National Rules on the EU Act

Italy is the first EU member state with its own AI law. Law 132/2025 was published in the Official Gazette in September 2025 and has been in force since 10 October 2025. It has 28 articles and is written to be read in line with the EU Act (Squire Patton Boggs).

Its practical additions are sector rules for areas like healthcare and work, parental consent for children under 14, and a criminal offence for spreading AI-generated content that misleads about a real person's image, voice or video, punishable by one to five years in prison. If your product serves Italian users, the EU Act is the main obligation and this law adds sector and criminal-law detail.

United Kingdom: No AI Statute, Regulators Apply Existing Law

The UK has no AI-specific statute and no government AI bill. The King's Speech on 13 May 2026 again omitted one (IAPP). A private member's bill to prohibit artificial superintelligence had its first reading on 8 September 2026, with a second reading scheduled for 13 November 2026 (Lewis Silkin). Private member's bills without government backing rarely become law.

In practice, UK exposure comes through existing regulators, such as the Information Commissioner's Office on data protection, the Financial Conduct Authority and the Competition and Markets Authority, plus the EU Act if you serve EU users.

US AI Regulations by State: No Federal Statute, a Moving Patchwork

The US has no federal AI statute. What it has is a fight over whether the states may write their own.

Does the US Have a Federal AI Law? The Preemption Fight

No. As of October 2026, no federal AI statute has been enacted. The executive branch signed Executive Order 14365 on 11 December 2025, directing the Department of Justice to set up an AI Litigation Task Force to challenge state AI laws.

The White House proposed a legislative framework with preemption in March 2026, and a "Great American AI Act" discussion draft in June 2026 would freeze state rules on how AI is built for three years. It has not been formally introduced (Cloud Security Alliance).

An executive order is not a statute. One Hacker News user, introducing a legal primer on the topic in December 2025, put it plainly: preemption "doesn't occur simply because the president so orders" (Hacker News, December 2025). Until a court or Congress says otherwise, state laws stay enforceable, and law firms tracking the issue advise clients to keep complying with them.

US AI Regulations by State: Colorado, Texas, California and Illinois

Four state laws matter most for a SaaS or AI company. Each is narrower than it sounds, and Colorado's changed shape in 2026.

Colorado. Governor Polis signed SB 26-189 on 14 May 2026, repealing and replacing the 2024 Colorado AI Act before it ever applied.

The new law is a notice-and-rights regime: deployers tell consumers before using automated decision-making technology in decisions on education, employment, housing, financial services, insurance, health care or essential government services, explain adverse outcomes, and keep records for three years. Developers supply documentation to deployers.

Violations are deceptive trade practices under the Colorado Consumer Protection Act (Holland & Knight), which a law-firm summary puts at up to $20,000 per violation (AFS Law). The Attorney General must offer 60 days to cure unless the violation is knowing or repeated, and that right ends on 1 January 2030. There is no private right of action.

Texas. TRAIGA took effect on 1 January 2026. Civil penalties are $10,000 to $12,000 per curable violation, $80,000 to $200,000 per uncurable violation, and $2,000 to $40,000 for each day a violation continues, after a 60-day cure notice (Texas HB 149 text). A defendant is not liable if it finds a violation through internal review and substantially complies with NIST's AI Risk Management Framework Generative AI Profile or another recognized framework.

California and Illinois. California's SB 53 requires frontier developers to publish transparency reports and report critical safety incidents, with penalties of up to $1 million per violation (Future of Privacy Forum). Illinois's HB 3773 amends its Human Rights Act so that an employer's AI use that has a discriminatory effect is unlawful, and it requires notice when AI informs employment decisions (Mayer Brown).

For the broader NIST family, see our NIST compliance guide. For the AI framework Texas rewards, see the NIST AI Risk Management Framework guide.

AI Regulations by Country in Asia-Pacific: China, South Korea, Japan, Vietnam and More

Asia-Pacific covers every model in this guide, from a binding statute with a fine grace period to laws with no penalties at all.

China: Targeted Rules Instead of One AI Law

China has no single AI law. It regulates AI service by service. The Interim Measures for Generative AI Services have applied since 15 August 2023, and the measures on labelling AI-generated content, with a mandatory national standard (GB 45438-2025), took effect on 1 September 2025 (Covington). They require explicit labels (visible markers) and implicit labels (metadata) on AI-generated text, images, audio and video.

On 27 December 2025 the Cyberspace Administration of China released draft measures for human-like interactive AI services, such as companion chatbots, for public comment. Enforcement is active supervision by the regulator, rather than a published fine schedule.

South Korea: The AI Basic Act and Its Fine Grace Period

South Korea's AI Basic Act took effect on 22 January 2026 and is a binding, comprehensive AI statute. It applies to AI that affects Korean users or markets, sets duties for high-impact AI, and requires labelling of generative AI output. Foreign companies above set thresholds must appoint a domestic representative: KRW 1 trillion in total revenue, KRW 10 billion in AI revenue, or one million daily users (Cooley).

The maximum fine is KRW 30 million, about US$21,000, and the Ministry of Science and ICT has said fines will be suspended for at least one year.

The grace period suspends fines, not enforcement: the ministry can still issue corrective orders and run investigations (IAPP). Not everyone is happy. Lim Jung-wook, co-head of South Korea's Startup Alliance, told Reuters in January 2026 that startups feel resentment: "why do we have to be the first to do this?" (Reuters via Yahoo Finance).

Japan: The AI Promotion Act Has No Penalties

Japan's AI Promotion Act took effect in June 2025 and has no penalties. It creates an AI Strategy Headquarters in the Cabinet and asks businesses only to "endeavor to cooperate" with government AI measures (Future of Privacy Forum). The government's tools are gathering information and issuing guidance, so the pressure is reputational rather than financial.

Vietnam: Risk-Based AI Law in Force Since 1 March 2026

Vietnam passed its AI Law (Law 134/2025/QH15) in December 2025, and it has applied since 1 March 2026. It sorts AI systems into three risk tiers: high-risk (may significantly affect life, health or individual rights), medium-risk (may influence or mislead users) and low-risk (GvW). Decree 142/2026/ND-CP, effective 1 May 2026, adds risk classification, labelling, incident reporting and a national AI database (Viet An Law).

Systems already running before the law got a transition period: 12 months, or 18 months in medical, educational and financial sectors (Rajah & Tann). Violations can bring administrative penalties or, in serious cases, criminal liability, and no fine schedule has been confirmed in the sources reviewed, so this guide does not quote a figure.

India, Singapore and Australia: Guidance Over Statutes

India issued AI Governance Guidelines on 5 November 2025. They are non-binding and built on existing law. Separately, an amendment to the IT Rules took effect on 20 February 2026 and requires platforms to label synthetic content (Hogan Lovells). So India's guidelines are voluntary, while its content-labelling rules bind.

Singapore relies on voluntary frameworks. Its Infocomm Media Development Authority launched a Model AI Governance Framework for Agentic AI in January 2026, with no penalty clause or registration requirement (Bird & Bird).

Australia chose existing law. The National AI Plan of December 2025 ruled out a standalone AI Act and the earlier proposed mandatory guardrails, encourages voluntary labelling of AI content, and committed $29.9 million to an AI Safety Institute (MinterEllison).

AI Regulations by Country in the Americas: Canada and Brazil

Canada has no AI statute. The Artificial Intelligence and Data Act lapsed in January 2025, and the "AI for All" strategy released on 4 June 2026 does not revive it. Law firms reading the strategy describe a path through privacy reform, online safety and consumer protection rather than one AI law (Fasken, Miller Thomson). No timelines are set.

Brazil's bill is still pending. PL 2338/2023 passed the Senate in December 2024 and sits in a special committee of the Chamber of Deputies, awaiting the rapporteur's opinion. The Chamber's record shows its latest entry on 2 September 2026 (CASRAI). It is not law, and a general election year makes timing uncertain.

AI Laws Around the World: Treaties and Standards Beyond AI Regulations by Country

Three instruments sit outside any single country's statute book.

Council of Europe Framework Convention on AI (CETS No. 225). The first international legally binding AI treaty. The EU ratified it on 15 May 2026. It enters into force only after five ratifications, including three Council of Europe member states, and the sources reviewed do not show that threshold being met (Council of Europe). It binds states, not companies directly.

ISO 42001. A certifiable AI management system standard, not a law. It is not a harmonised standard under the EU AI Act, so a certificate is not a presumption of legal compliance.

One Hacker News commenter made the same point under news of a major AI lab's certification in January 2025: "ISO 42001 certification doesn't ensure compliance with the EU AI Act" (Hacker News, January 2025). Our guides on what is ISO 42001 and ISO 42001 certification cost cover what it does and does not do.

NIST AI RMF. Voluntary US guidance. It is not a law, but it carries legal weight in Texas, where substantial compliance is an affirmative defense.

AI Regulations by Country: What the Laws Have in Common

Read across countries, global AI regulation looks more alike than the headlines suggest. Almost all of them are built from the same six blocks.

• Risk tiers or "high-impact" definitions: the EU, Korea and Vietnam sort systems by harm, and Colorado sorts decisions by consequence
• Transparency and labelling: AI-generated content and AI interactions must be disclosed (EU Article 50, China, Korea, India)
• Human oversight: a person can intervene or override in high-risk uses
• Documentation and records: Colorado requires three years of records, and the EU requires technical documentation
• A local representative for foreign providers: Korea and, in some cases, Vietnam
• Grace periods: Korea's fines, Vietnam's transition and Colorado's cure right

The differences sit in who is liable and how much. Colorado's new law puts duties on the deployer as well as the developer. The EU measures fines as a percentage of worldwide turnover, Korea caps them at a fixed amount, and Texas scales them by whether a violation can be cured.

Which country has the strictest AI regulations? By reach and penalty basis, the EU. It applies to any company whose system's output is used in the EU, and its top tier is 7% of worldwide turnover. By enforcement today, none can be named: Korea's fines are paused, and most EU high-risk duties do not apply until 2027 or 2028.

Not everyone welcomes that strictness. One commenter on a Hacker News thread about Europe scaling back its rules, in November 2025, worried about "the constant risk of a new AI Act massively increasing compliance and legal costs" for startups (Hacker News, November 2025).

To turn these shared requirements into one internal rulebook, start with an AI governance policy, and see our AI governance framework guide for the program behind it.

Which AI Laws Apply to My Business? Using AI Regulations by Country

Applicability follows your users and the people your AI affects, not your headquarters. This table is the fastest way to a first answer.

A minimum viable multi-country AI program has five steps:

1. Inventory every AI system: your own features and the third-party models behind them
2. Tier each one by risk: high-impact decisions about people go in the top tier
3. Add notices and labels: tell users when they deal with AI and mark AI-generated content
4. Keep vendor and model records: who supplied which model, under what terms, with what documentation
5. Retain evidence: policies, reviews and incident logs, kept for the longest period any law asks for (three years in Colorado)

If you already hold an audit, check what it covers before starting from zero. Our guides on ISO 27001 and AI compliance and whether SOC 2 covers AI explain what existing certifications do and do not say about AI.

Common Mistakes When Reading AI Regulations by Country

These errors turn up in summaries, questionnaires and board decks, and each one is easy to avoid.

• Trusting a pre-Omnibus EU date. High-risk Annex III rules now apply on 2 December 2027, not 2 August 2026, and many pages still carry the old date.
• Treating the old Colorado Act as current. SB 24-205 is repealed. SB 26-189 applies from 1 January 2027, and it is a notice-and-rights law without the risk-management program duties of its predecessor.
• Reading "enacted" as "enforced." Korea's law is in force, and its fines are paused for at least a year. Colorado's is signed, and it applies in 2027.
• Assuming a US company is outside the EU Act. If your system's output is used in the EU, it can reach you.
• Treating guidance as law. India's guidelines, Singapore's frameworks and NIST AI RMF are voluntary. The exceptions are specific: Texas gives NIST a legal defense, and India's IT Rules bind platforms.
• Treating ISO 42001 as proof of legal compliance. A certificate shows a management system. It does not certify you against the EU AI Act or any national law.

How ComplyJet Fits Into a Multi-Country AI Compliance Program

We built ComplyJet for early-stage teams who need compliance work to hold up in an enterprise review. For AI, that means ISO 42001 support: one management-system backbone for the policies, risk records and evidence that several of these laws ask for, on flat per-company pricing instead of per-seat fees.

Be clear about the limits. ComplyJet does not certify anyone against the EU AI Act or any national AI law, no such certification exists, and it does not give legal advice. For AI companies choosing a platform, our comparison of the top SOC 2 platforms for AI companies lays out the options.

FAQs

Which countries have AI laws, and is the EU AI Act the only comprehensive one?

No. The EU AI Act is the broadest, but South Korea's AI Basic Act (in force since 22 January 2026) and Vietnam's AI Law (in force since 1 March 2026) are also comprehensive statutes. Italy added a national law on top of the EU Act. Most other countries rely on targeted rules, guidance or existing law.

Does the US have a federal AI law?

No. As of October 2026 there is no federal AI statute. The federal government has pursued executive action and proposed preemption, while states such as Colorado, Texas, California and Illinois have their own laws, and those remain enforceable.

Which country has the strictest AI regulations?

By reach and penalty basis, the EU: it applies wherever an AI system's output is used in the EU, with fines up to 7% of worldwide turnover. In current enforcement, no country stands clearly apart, because Korea's fines are paused and most EU high-risk duties start in 2027 and 2028.

Does China have an AI law, and what about the UK?

China has no single AI law. It has binding rules for generative AI services and for labelling AI-generated content, in force since 2023 and 2025. The UK has no AI-specific statute and no government bill, and its regulators apply existing law.

Does the EU AI Act apply to US companies?

Yes, if an AI system's output is used in the EU. The Act applies to providers and deployers outside the EU with no revenue threshold and no requirement for an EU office. Small companies pay the lower of the fixed amount and the percentage if fined.

What is South Korea's AI Basic Act?

It is South Korea's comprehensive AI law, in force since 22 January 2026. It covers AI that affects Korean users, sets duties for high-impact AI, requires labelling of generative AI output, and caps fines at KRW 30 million. Fines are paused for at least one year.

Related Reading

• What is ISO 42001: the standard behind the ISO 42001 pointers above
• ISO 42001 certification cost: what certification costs
• AI governance policy: the policy that turns these laws into internal rules
• ISO 27001 and AI compliance: how ISO 27001 and 42001 differ for AI governance
• Does SOC 2 cover AI: what a SOC 2 report does and does not say about AI
• GDPR countries: the privacy-law counterpart for EU and EEA reach
• EU AI Act compliance guide: the EU Act in depth
• EU AI Act risk classification: how the four risk tiers work
• Data privacy laws by country: the global privacy-law list