AI rules around the world

In one paragraph

Outside the European Union, AI is regulated through a mix of state law, sector regulators, voluntary frameworks and general product rules, rather than through a single AI statute. The result varies by country and, in the United States, by state. This page maps the main ones organisations ask about, each with a link to the original text.

Who it applies to

Whoever operates in the jurisdiction concerned. Unlike the EU AI Act, most of what follows applies within its own borders rather than reaching outward, so the relevant question for each one is simply whether you operate there, sell there, or place a product there.

What it asks for

• United States: there is no general federal AI statute, so states act individually. Colorado's 2024 AI Act did not take effect and was repealed; it was replaced by SB 26-189 on automated decision-making technology, signed 14 May 2026 and effective 1 January 2027, a narrower transparency and documentation regime enforced by the state's Attorney General. Texas's Responsible AI Governance Act has been in force since 1 January 2026, prohibits a defined set of harmful uses, and is likewise enforced only by the Attorney General.
• United Kingdom: no dedicated AI statute as of September 2026. AI is governed through existing data protection law and sector regulators, with guidance on AI from the Information Commissioner's Office.
• Singapore: a voluntary Model AI Governance Framework, with a 2024 edition addressing generative AI specifically, paired with the AI Verify testing toolkit for organisations that want to test systems against it.
• Japan: the AI Promotion Act, in force since 1 September 2025, is a framework law setting out principles with no penalty regime attached; personal data used by AI systems is separately covered by the Act on the Protection of Personal Information.
• OECD: the AI Principles, adopted in 2019 and updated in May 2024, are non-binding and endorsed by 47 or more jurisdictions, and function as a shared reference point rather than a law.
• European Union, beyond the AI Act: the Cyber Resilience Act sets security requirements for products with digital elements, with reporting duties from 11 September 2026 and full application from 11 December 2027; the revised Product Liability Directive extends product liability to software and AI, to be transposed by member states by 9 December 2026; and the Digital Operational Resilience Act, in the financial sector specifically, has applied since 17 January 2025 and reaches the AI systems financial entities rely on.

What it looks like in practice

An organisation operating across several regions has one customer-facing AI tool and a simple question: which of these rules reach it? The answer is rarely a single rule. It is usually a short combination, a state transparency requirement here, a product safety rule there, an existing data protection obligation everywhere, and working that combination out once, in writing, is what makes the next tool faster to assess.

Where it stands now

Colorado's SB 26-189 was signed 14 May 2026 and takes effect 1 January 2027. Texas's Responsible AI Governance Act has applied since 1 January 2026. Japan's AI Promotion Act has applied since 1 September 2025. The OECD AI Principles were updated in May 2024. The EU's Cyber Resilience Act begins reporting duties on 11 September 2026 and applies fully from 11 December 2027; the revised Product Liability Directive is due for transposition by 9 December 2026; the Digital Operational Resilience Act has applied since 17 January 2025. Dates change; the official text linked below is the authority.

How this connects to our work

Working out which of these apply to you, alongside the EU AI Act, is part of deciding where each system is allowed to run and what has to be recorded about it, which is settled when we build your private AI setup.