Output: 2026-06-13 07:32:16

The Global AI Regulation Patchwork

The Global AI Regulation Patchwork: A Comparative Regulatory Landscape Report

Executive Summary

The global AI regulatory landscape as of mid-2026 is defined by six simultaneous dynamics that collectively determine the compliance environment for any organization developing, deploying, or integrating AI products across borders.

First, a small number of jurisdictions have enacted comprehensive, cross-sector, binding AI-specific statutes. The European Union's AI Act (Regulation (EU) 2024/1689) and South Korea's AI Basic Act—together with its Enforcement Decree, both effective 22 January 2026 [6-7]—are the only two omnibus AI laws in force globally [1-1][1-2]. China has assembled a functionally equivalent layered regime through binding, activityspecific administrative measures covering generative AI, deep synthesis, algorithmic recommendation, and content labeling [1-4][1-5][1-6][1-7].

recommendation, and content labeling [1-4][1-5][1-6][1-7] https://www.chinalawtranslate.com/en/generative-ai-interim https://www.chinalawtranslate.com/en/deep-synthesis https://digichina.stanford.edu/work/translation-internet-information-service-algorithmic-recommendation-management-provisions-effective-march-1-2022 https://www.chinalawtranslate.com/en/ai-labeling .

Second, the United States remains a fragmented dual-layer system comprising a state legislative patchwork—with 1,561 AI-related bills introduced across 45 states by March 2026 and no comprehensive federal AI statute [1-17][1-18]—and a federal enforcement layer in which the FTC, EEOC, and California's CPPA are actively using existing consumer-protection, anti-discrimination, and privacy authorities to create binding AIrelated obligations [4-1][4-2][4-6]. A critical development in 2026 is the substantial revision of Colorado's AI regime: the original SB 24-205 was repealed and reenacted by SB26-189, which narrowed deployer obligations, removed the original duty-of-care and impact-assessment requirements, and delayed developer obligations to 1 January 2027 [6-1][6-2][6-3]. The practical U.S. compliance burden remains substantially higher than an enacted-law inventory alone would suggest, but the highest-burden U.S. deployer regime is now California's CPPA ADMT regulations rather than Colorado. Separately, two states enacted frontier-model developer laws in 2025–2026—California's Transparency in Frontier Artificial Intelligence Act (SB 53, signed 29 September 2025) and New York's RAISE Act (signed 19 December 2025, effective 1 January 2027)—a provider/developer-facing state layer distinct from the CPPA's deployer-facing ADMT rules [1-48][1-47].

rules [1-48][1-47] https://www.whitecase.com/insight-alert/california-enacts-landmark-ai-transparency-law-transparency-frontier-artificial https://www.governor.ny.gov/news/governor-hochul-signs-nation-leading-legislation-require-ai-frameworks-ai-frontier-models .

harmonised-standards pathway through CEN-CENELEC [2-1][2-2][2-3][2-4][2-6][2-8] https://digital-strategy.ec.europa.eu/en/policies/ai-office https://digital-strategy.ec.europa.eu/en/policies/market-surveillance-authorities-under-ai-act https://digital-strategy.ec.europa.eu/en/policies/ai-advisory-forum https://digital-strategy.ec.europa.eu/en/policies/ai-scientific-panel https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai [2-9][3-5][3-6] https://digital-strategy.ec.europa.eu/en/news/commission-presents-template-general-purpose-ai-model-providers-summarise-data-used-train-their https://digital-strategy.ec.europa.eu/en/policies/ai-act-standardisation https://jtc21.eu/ . However, this architecture has not been free of friction: the

Third, the EU has gone further than any other jurisdiction in building a proceduralized enforcement and implementation architecture. This includes a central AI Office, national market surveillance authorities coordinated through the European AI Board, a Scientific Panel, an Advisory Forum, a GPAI Code of Practice, a mandatory training-data transparency template, the AI Pact voluntary pre-compliance initiative, and a harmonised-standards pathway through CEN-CENELEC [2-1][2-2][2-3][2-4][2-6][2-8] [2-9][3-5][3-6]. However, this architecture has not been free of friction: the Commission missed deadlines for guidance on high-risk systems [6-15], industry stakeholders have publicly described the GPAI Code of Practice as imposing a "disproportionate burden" with key guidance still missing [6-12][6-13], and the GPAI Code creates a two-track compliance environment in which signatories benefit from a presumption of compliance while non-signatories must demonstrate conformity through other means [6-14]. The EU's implementation machinery is the most developed globally, but it is being experienced by affected providers as a source of both structure and uncertainty.

Fourth, a parallel layer of non-binding but operationally consequential governance infrastructure is emerging alongside formal legislation. International standards (ISO/IEC 42001), incident-reporting frameworks (OECD), technical guidance (NIST AI 600-1), privacy-regulator technical studies (Brazil's ANPD), and national AI charters (UAE, Saudi Arabia) are creating a form of convergence that transcends the divergence in formal law [3-1][3-2][3-4][3-7][3-8][3-9].

in formal law [3-1][3-2][3-4][3-7][3-8][3-9] https://www.iso.org/standard/42001 https://www.oecd.org/en/publications/towards-a-common-reporting-framework-for-ai-incidents_f326d4ac-en.html https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence https://legismap.com.br/conteudos/artigos-e-noticias/anpd-releases-english-version-of-technology-radar https://uaelegislation.gov.ae/en/policy/details/the-uae-charter-for-the-development-and-use-of-artificial-intelligence https://sdaia.gov.sa/en/SDAIA/about/Documents/ai-principles.pdf .

Fifth, a transnational governance superstructure has materialized above domestic law, with three distinct functions. The Council of Europe's Framework Convention on Artificial Intelligence—the first-ever binding international AI treaty, opened for signature on 5 September 2024 and negotiated with participation from non-European states including the United States, Canada, Japan, and others [5-1][5-2]—provides a treatylevel human-rights baseline that will require States Parties to adopt domestic measures consistent with its standards [5-1][5-3]. The G7 Hiroshima AI Process (HAIP) provides a voluntary but structured transparency and governance mechanism aimed especially at advanced AI organizations, now operationalized through a Reporting Framework that produced 25 reports in its first cycle [5-4][5-7][5-8]. UNESCO's Readiness Assessment Methodology (RAM) provides a state-readiness and governance-capacity tool being used in concrete country-level assessment exercises [5-11][5-12][5-13].

Sixth, several jurisdictions previously characterized as static are in fact evolving faster than earlier assessments suggested. South Korea's Enforcement Decree is already in effect, with provisions on domestic-agent obligations and specific transparency methods for foreign providers [6-7][6-8]. Brazil's PL 2338/2023 has passed the Senate and is now being processed by the Chamber of Deputies [6-10][6- https://www.demarest.com.br/en/inteligencia-artificial-reacende-debates-na-camara-dos-deputados https://www.sidi.org.br/en/blog/the-impacts-of-regulating-artificial-intelligence-in-brazil

passed the Senate and is now being processed by the Chamber of Deputies [6-10][6- 11]. The UK Parliament is actively debating whether cross-sector AI legislation is needed [6-9]. These developments narrow the gap between the "binding-law" jurisdictions and the "soft-law" jurisdictions.

tools, while deployers face nationally distributed market surveillance [2-1][2-2][2-4][2- https://digital-strategy.ec.europa.eu/en/policies/ai-office https://digital-strategy.ec.europa.eu/en/policies/market-surveillance-authorities-under-ai-act https://digital-strategy.ec.europa.eu/en/policies/ai-scientific-panel https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai 8][2-9] https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai https://digital-strategy.ec.europa.eu/en/news/commission-presents-template-general-purpose-ai-model-providers-summarise-data-used-train-their . In the United States, the FTC targets providers directly through AI-capabilityclaims enforcement https://www.ftc.gov/industry/technology/artificial-intelligence [4-1][4-3][4-4] https://www.ftc.gov/news-events/news/press-releases/2024/09/ftc-announces-crackdown-deceptive-ai-claims-schemes https://www.ftc.gov/news-events/news/press-releases/2025/02/ftc-finalizes-order-donotpay-prohibits-deceptive-ai-lawyer-claims-imposes-monetary-relief-requires , while employment and privacy rules place the direct legal obligation on deployers with indirect pressure on vendors [4-6][4-11][4-12] https://cppa.ca.gov/announcements/2025/20250923.html https://www.eeoc.gov/sites/default/files/2024-04/20240429_What%20is%20the%20EEOCs%20role%20in%20AI.pdf https://data.aclum.org/storage/2025/01/EOCC_www_eeoc_gov_laws_guidance_select-issues-assessing-adverse-impact-software-algorithms-and-artificial.pdf .

A critical finding for Espadon's planning: the provider/deployer compliance split is now structurally embedded in the two most consequential regimes, but the specific allocation of burden has shifted in important ways. In the EU, GPAI model providers face centralized AI Office oversight, Scientific Panel scrutiny, and dedicated implementation tools, while deployers face nationally distributed market surveillance [2-1][2-2][2-4][2- 8][2-9]. In the United States, the FTC targets providers directly through AI-capabilityclaims enforcement [4-1][4-3][4-4], while employment and privacy rules place the direct legal obligation on deployers with indirect pressure on vendors [4-6][4-11][4-12]. Colorado's revised SB26-189 retains a developer-to-deployer documentation transfer mechanism but has removed the deployer-side impact-assessment and riskmanagement program requirements that previously made it the closest U.S. analogue to the EU's high-risk deployer regime [6-1][6-2][6-3]. California's CPPA ADMT regulations are now the most operationally significant U.S. deployer-facing AI-adjacent regime, though they are narrower than an AI statute and apply only where technology replaces or substantially replaces human decision-making in "significant decision" contexts [6-4] [6-5][6-6].

For global AI product companies, the "patchwork" is not only a patchwork of laws; it is increasingly a patchwork of interoperable compliance artifacts spanning three layers: (1) binding domestic law, (2) governance infrastructure (standards, frameworks, technical guidance), and (3) transnational instruments (treaty commitments, voluntary codes, readiness assessments). The governance infrastructure and transnational layers provide the most promising basis for building a single global control environment that can be adapted to multiple jurisdictions.

1. The Transnational Governance Superstructure

Before examining individual jurisdictions, it is necessary to describe the transnational layer that now sits above domestic AI law. This layer has emerged rapidly since 2023 and shapes how states and firms operationalize AI governance across borders.

1.1 The Council of Europe Framework Convention on Artificial Intelligence

The Council of Europe's Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law is the first-ever international legally binding treaty in the AI field [5-1]. It was opened for signature on 5 September 2024 [5-1][5-2].

The Convention was drafted by the Council's 46 member states with the participation of observer states including Canada, Japan, Mexico, the Holy See, and the United States, as well as the European Union and additional non-member states including Australia, Argentina, Costa Rica, Israel, Peru, and Uruguay [5-1]. This broad participation means AI governance is now being shaped through a multilateral treaty venue that extends well beyond Europe.

The Convention is a framework treaty, not a directly self-executing AI rulebook. It requires parties to adopt or maintain legislative, administrative, or other measures to give effect to its standards [5-1][5-3]. Its practical focus is on ensuring that activities within the lifecycle of AI systems are consistent with human rights, democracy, and the rule of law [5-1]. Implementation measures are to be graduated and differentiated according to the severity and probability of adverse impacts—a risk-based logic that converges with the EU AI Act's approach, even though the Convention is structured as public international law rather than product regulation [5-1][5-3].

The Convention's significance for comparative analysis is that it creates an additional route for convergence outside the EU model. Because the treaty is open beyond Europe and focuses on lifecycle safeguards and human-rights-consistent governance, it can influence domestic AI governance even in countries that do not adopt the EU AI Act structure [5-1][5-2][5-3]. For firms, the Convention does not directly impose provider or deployer duties, but it will shape the domestic legal environments of its States Parties over time.

1.2 The G7 Hiroshima AI Process (HAIP)

The Hiroshima AI Process was launched in May 2023 following the G7 Hiroshima Summit. The Hiroshima AI Process Comprehensive Policy Framework was agreed in December 2023 and endorsed by G7 leaders the same month [5-4]. The framework includes guiding principles and an international code of conduct aimed at promoting safe, secure, and trustworthy advanced AI systems [5-4].

The Hiroshima Code of Conduct is targeted specifically at organizations developing advanced AI systems, including advanced foundation models and generative AI systems [5-5]. It calls for actions across the lifecycle—design, development, deployment, and use—including identifying, evaluating, and mitigating risks; publishing transparency reports; keeping documentation up to date; reporting evaluations of safety, security, and societal risks; documenting capabilities and limitations; discussing risks such as bias, discrimination, privacy, and fairness; and disclosing governance and risk-management policies [5-5][5-6]. These topics overlap strongly with obligations appearing in binding regimes: the EU AI Act's GPAI documentation requirements, Colorado's developer documentation rules, China's security assessment and filing requirements, and NIST's generative AI guidance [5-5][5-6].

In February 2025, HAIP added a Reporting Framework that turns the Code into a repeatable disclosure mechanism [5-7]. The OECD states that the Reporting Framework provides a standardised structure for organizations to report on their alignment with the Code of Conduct [5-8]. The Framework is open across the AI value chain, including developers, deployers, and providers of advanced AI systems [5-8]. The first reporting cycle produced 25 reports, and the OECD's September 2025 publication How are AI developers managing risks? presents preliminary insights from submissions by 20 organisations across diverse sectors and countries [5-8][5-9][5-10]. Submitted reports are published on the OECD AI Policy Observatory [5-8].

Participants reported internal benefits from engaging in the reporting process, including value as a transparency tool and as a mechanism for internal capacity-building and coordination [5-7]. The HAIP transparency topics map closely onto the compliance artifacts firms are already being asked to produce in stricter jurisdictions [5-6][5-9], making the Reporting Framework a practical tool for organizations building global compliance architectures.

1.3 UNESCO Readiness Assessment Methodology (RAM)

UNESCO's Recommendation on the Ethics of AI is a global normative framework, and UNESCO's Readiness Assessment Methodology (RAM) is directly linked to that Recommendation [5-11][5-12]. RAM evaluates a country's AI ecosystem across multiple dimensions including legal and regulatory, social and cultural, economic, scientific and educational, and technological and infrastructural dimensions [5-12][5-13]. UNDP and UNESCO offer RAM and UNDP's AI Landscape Assessment together as complementary support for governments [5-12].

reports in the Philippines, Trinidad and Tobago, and Lao PDR https://www.undp.org/sites/g/files/zskgke326/files/2024-12/undp-unesco-offer-web-7-aug-2024.pdf [5-11][5-13][5-14] http://mpaai.gov.tt/news/unesco-ai-readiness-assessment-methodology-ram-consultation-sessions https://www.unesco.org/en/articles/lao-pdr-unveil-unesco-ai-ethics-readiness-assessment-report-national-workshop . This

RAM is being used in concrete country processes in 2025–2026, with consultations or reports in the Philippines, Trinidad and Tobago, and Lao PDR [5-11][5-13][5-14]. This demonstrates that UNESCO's AI governance influence is being operationalized through country-level assessment exercises, creating a practical channel through which international organizations shape how national governments diagnose regulatory gaps and prioritize future AI policy actions [5-12][5-13][5-14].

1.4 The Three-Function Transnational Architecture

The transnational layer now performs three distinct functions:

1. Binding international baseline: The Council of Europe Convention provides a treaty-level human-rights standard that will require domestic implementation by its States Parties [5-1][5-2][5-3].

States Parties [5-1][5-2][5-3] https://www.coe.int/en/web/artificial-intelligence/the-framework-convention-on-artificial-intelligence https://www.coe.int/en/web/Conventions/full-list?module=signatures-by-treaty&treatynum=225 https://eucrim.eu/news/council-of-europe-convention-on-artificial-intelligence .

2. Voluntary structured transparency: The G7 HAIP provides a repeatable disclosure and governance mechanism aimed at advanced AI organizations across the value chain [5-4][5-5][5-7][5-8].

the value chain https://www.soumu.go.jp/hiroshimaaiprocess/en/index.html [5-4][5-5][5-7][5-8] https://g7g20-documents.org/database/document/2023-g7-japan-leaders-leaders-annex-hiroshima-process-international-code-of-conduct-for-organizations-developing-advanced-ai-systems https://www.soumu.go.jp/hiroshimaaiprocess/en/report.html https://oecd.ai/en/transparency/overview .

3. State-readiness and capacity-building: UNESCO RAM provides a diagnostic tool that influences how governments prepare for AI regulation [5-11][5-12][5-13].

These mechanisms do not impose the same kind of direct firm-level liability as the EU AI Act or China's administrative rules, but they are now concrete parts of the global AI governance architecture. They help explain why compliance concepts—risk management, documentation, transparency, human oversight, incident handling—are converging internationally even while legal obligations remain fragmented across jurisdictions [5-1][5-8][5-12].

jurisdictions [5-1][5-8][5-12] https://www.coe.int/en/web/artificial-intelligence/the-framework-convention-on-artificial-intelligence https://oecd.ai/en/transparency/overview https://philippines.un.org/en/306159-unesco-ai-readiness-assessment-report-anchoring-ethics-ai-governance-philippines .

2. European Union

2.1 Legal Status and Scope

The EU AI Act, Regulation (EU) 2024/1689, is a binding cross-sector regulation that entered into force on 1 August 2024 [1-1]. It covers providers, deployers, importers, distributors, product manufacturers, and providers of general-purpose AI (GPAI) models, with extraterritorial reach where AI system outputs are used in the EU market [1-1].

[1-1] https://artificialintelligenceact.eu/chapter/5 .

2.2 Risk Model

The Act employs a four-tier risk classification:

Prohibited practices (Article 5): Unacceptable-risk AI applications are banned outright.

High-risk AI systems (Articles 6 and Annex III): Systems deployed in listed sectors or use cases face the most extensive compliance obligations.

Transparency obligations (Article 50): Certain AI systems—such as chatbots and emotion-recognition systems—must meet specified disclosure requirements.

GPAI models (Articles 51, 53, 55): General-purpose AI models, including those with systemic risk, face dedicated obligations [1-1].

2.3 Obligations: Developers/Providers

Providers of high-risk AI systems must implement risk management systems, data governance controls, technical documentation, logging capabilities, transparency and instructions for use, human-oversight design features, accuracy/robustness/cybersecurity safeguards, quality management systems, conformity assessments, registration where applicable, post-market monitoring, and serious incident reporting [1-1].

Providers of GPAI models must prepare technical documentation, furnish information and documentation to downstream providers, comply with EU copyright law, and publish a sufficiently detailed summary about training content [1-1]. Where a GPAI model presents systemic risk, additional obligations include model evaluation, systemic-risk assessment and mitigation, adversarial testing, incident reporting, and cybersecurity protections [1-1].

protections [1-1] https://artificialintelligenceact.eu/chapter/5 .

These GPAI provider obligations have been operationalized through dedicated implementation instruments. The Commission finalized a mandatory training-data transparency template on 24 July 2025, prescribing the specific format GPAI providers must use to summarize data used for model training [2-9]. The GPAI Code of Practice, submitted by independent experts, provides a voluntary compliance tool covering transparency, copyright, and safety and security obligations [2-6][2-8]. The Code directly targets model-provider obligations rather than deployer obligations [2-8].

transparency, copyright, and safety and security obligations [2-6][2-8] https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai . The Code

2.4 Obligations: Deployers/Users/Integrators

Deployers of high-risk AI systems must use systems according to provider instructions, ensure human oversight, monitor operations, maintain logs, and report serious incidents. Certain public-sector or listed use cases trigger mandatory fundamentalrights impact assessments [1-1]. Deployers are primarily subject to enforcement through national market surveillance authorities rather than the central AI Office [2-2].

2.5 Enforcement Architecture

The EU AI Act has generated the most developed enforcement and implementation machinery of any AI regime globally. This architecture operates across multiple institutional layers:

The AI Office is the central EU-level body responsible for implementing the AI Act, with particular authority over GPAI rules. Its tasks include enforcing and supervising GPAI obligations, contributing to the consistent application of the Act across Member States, and promoting implementation tools such as codes of practice and innovation measures [2-1].

National market surveillance authorities are jointly responsible with the AI Office for implementing, supervising, and enforcing the AI Act. Each Member State must designate market surveillance authority capacity, and where multiple authorities exist, one single point of contact must be designated [2-2]. These authorities have affirmative investigative and reporting powers and must report annually to the Commission and relevant national authorities [2-2].

The European AI Board is the coordination mechanism through which national market surveillance authorities cooperate, exchange expertise, and facilitate effective enforcement [2-2].

The Advisory Forum (Article 67) provides technical expertise and advice on a broad range of AI Act matters, including standardization and implementation challenges [2-3].

The Scientific Panel (Article 68, Implementing Regulation (EU) 2025/454) advises the AI Office and national authorities on the impacts and risks of GPAI models. Its core tasks include alerting the AI Office to systemic risks, advising on GPAI classification and evaluation methodologies, and supporting market-surveillance activities [2-4].

The AI Pact is a voluntary pre-compliance initiative that has attracted over 100 company signatories as of 2024 [2-5][2-7]. The pledges include organizational AI governance strategies designed to foster AI uptake and work toward future compliance with the AI Act [2-7].

compliance with the AI Act https://ec.europa.eu/commission/presscorner/detail/en/ip_24_4864 [2-7] .

2.6 The Standardisation Layer

The EU is building a separate compliance layer through harmonised standards. The European Commission's AI Act standardisation page states that harmonised standards will offer legal certainty under the AI Act, and that once standards are published by CEN and CENELEC, the Commission will assess them and reference them in the Official Journal of the EU [3-5]. CEN-CENELEC's JTC 21 states that its purpose is to develop European standards providing manufacturers with a presumption of conformity with the AI Act [3-6].

On 19 November 2025, the Digital Omnibus proposed linking the application of rules for high-risk AI systems to the availability of support tools, including standards [3-5]. Because providers of high-risk systems need to demonstrate compliance and deployers often depend on provider documentation, the standards infrastructure will also affect the information packages, instructions, and conformity artifacts that downstream users receive [3-5][3-6].

receive [3-5][3-6] https://digital-strategy.ec.europa.eu/en/policies/ai-act-standardisation https://jtc21.eu/ .

2.7 Implementation Friction and the GPAI Two-Track Problem

The EU's implementation machinery is real and institutionally advanced, but it has not been frictionless. The European Commission missed deadlines for guidance on highrisk AI systems [6-15], and there was visible mid-2025 uncertainty around possible AI Act timing relief, with strong industry calls for delay [6-16]. CCIA Europe stated in July 2025 that the final GPAI Code of Practice still imposed a "disproportionate burden" and that key AI Office guidance was still missing [6-12]. ITI likewise reacted publicly to the Code's publication [6-13].

The GPAI Code of Practice creates a functionally important two-track compliance environment. Providers who sign the Code benefit from a presumption of compliance with the AI Act's GPAI obligations. Providers who choose not to sign the Code must still meet the Act's legal requirements, but without the benefit of that presumption [6-14]. This means the Code is not binding law in the traditional sense, yet it functionally pressures GPAI providers to participate or face a higher evidentiary burden when demonstrating compliance through alternative means [6-14]. For global model developers, this two-track structure is a material compliance design choice: signing the Code provides legal certainty but commits the organization to its specific requirements; declining creates a bespoke-compliance pathway with more uncertainty.

2.8 Enforcement Timeline

2 February 2025: Prohibited AI practices and AI literacy obligations began applying [1-1].

applying https://artificialintelligenceact.eu/chapter/5 [1-1] .

2 August 2025: Governance rules and GPAI obligations began applying [1-1].

2 August 2026: Most stand-alone Annex III high-risk system obligations apply under the original statutory timeline [1-1].

2 August 2027: High-risk AI systems that are safety components of products already covered by EU harmonisation legislation (Annex I — e.g. medical devices, machinery, radio equipment) become subject to high-risk obligations under the original statutory timeline [1-1].

"Digital Omnibus" deferrals (provisional — not yet adopted): On 7 May 2026 the Council and the European Parliament reached a provisional political agreement on the Commission's "Digital Omnibus" simplification package, which links the application of high-risk rules to the availability of supporting standards and tools and defers, as a backstop, the application of high-risk obligations [2-6]. Under that agreement, stand-alone Annex III high-risk obligations are deferred from 2 August 2026 to no later than 2 December 2027 (≤16 months), and embedded- product (Annex I) high-risk obligations from 2 August 2027 to 2 August 2028 (≤12 months); GPAI obligations and the core governance provisions keep their existing dates [2-6]. These deferred dates take legal effect only upon formal adoption and publication in the Official Journal (expected before 2 August 2026); until then the original statutory dates above remain the legally binding timeline.

2.9 Penalties

Administrative fines reach up to EUR 35 million or 7% of worldwide annual turnover for prohibited-practice breaches; up to EUR 15 million or 3% for certain other violations; and up to EUR 7.5 million or 1.5% for supplying incorrect information, with lower caps for SMEs and startups in some cases [1-1].

2.10 Compliance Burden Assessment

summary template [2-9] https://digital-strategy.ec.europa.eu/en/news/commission-presents-template-general-purpose-ai-model-providers-summarise-data-used-train-their , and the emerging harmonised-standards pathway [3-5][3-6] https://digital-strategy.ec.europa.eu/en/policies/ai-act-standardisation https://jtc21.eu/ .

The EU regime imposes the highest combined compliance burden globally for both model developers/providers and deployers. The burden on GPAI/model providers is increasing through proceduralized implementation detail: providers now face the central AI Office's enforcement authority, Scientific Panel scrutiny pathways, the GPAI Code of Practice (with its two-track presumption structure [6-14]), a mandatory training-data summary template [2-9], and the emerging harmonised-standards pathway [3-5][3-6]. The implementation friction documented through missed guidance deadlines [6-15] and industry contestation [6-12][6-13] does not reduce the legal obligations themselves but does create near-term compliance uncertainty about the precise operational standards expected. Deployers face a substantial but differently structured burden through national market surveillance channels, fundamental-rights impact assessments, humanoversight duties, and logging requirements [1-1][2-2].

The net effect is that the EU's compliance ecosystem now comprises three interlocking layers: (1) the statute itself, (2) institutional enforcement machinery (AI Office, national MSAs, AI Board, Scientific Panel, Advisory Forum), and (3) technical standardisation and voluntary governance tools (harmonised standards, GPAI Code of Practice, training-data template, AI Pact). This three-layer structure has no equivalent in any other jurisdiction.

3. United States: The 50-State Patchwork and Federal Enforcement Layer

3.1 National Structure: A Dual-Layer System

The United States lacks a single federal AI law. The U.S. regulatory environment is best understood as a dual-layer system: a state legislative patchwork and a federal enforcement layer that operates through existing consumer-protection, antidiscrimination, and privacy authorities.

The state legislative layer is a composite of enacted AI-specific state laws, comprehensive privacy laws with automated-decision-making (ADMT) provisions, biometric and deepfake statutes, employment-specific AI rules, executive orders, state agency guidance, and a large volume of pending legislation [1-3][1-17][1-18]. By March 2026, 1,561 AI-related bills had been introduced across 45 states, and 99 AI-related bills were enacted in 2024 [1-17][1-18]. Unlike the EU, which manages internal national

agency guidance, and a large volume of pending legislation [1-3][1-17][1-18] https://ai-law-center.orrick.com/us-ai-law-tracker-see-all-states https://www.ncsl.org/technology-and-communication/artificial-intelligence-2025-legislation https://www.multistate.ai/artificial-intelligence-ai-legislation . By March variation through the European AI Board and single points of contact [2-2], the U.S. state patchwork has no formal coordination mechanism.

The federal enforcement layer creates binding AI-related obligations without a dedicated AI statute. The FTC has built a dedicated AI enforcement and policy hub under its existing consumer-protection authority [4-1], and the EEOC has created an AI and algorithmic fairness initiative for employment discrimination enforcement [4-2]. These agencies are actively bringing enforcement actions and issuing guidance that shapes AI compliance obligations for both providers and deployers. Narrow AI-specific federal statutes have also begun to appear—most notably the TAKE IT DOWN Act (Public Law 119-12, signed 19 May 2025), which criminalizes non-consensual intimate imagery including AI-generated deepfakes and requires covered platforms to operate a notice-and-removal process—though there is still no comprehensive federal AI statute [1-49].

[1-49] https://www.congress.gov/crs-product/LSB11314 .

Additionally, the United States possesses a detailed federal voluntary governance layer. NIST's Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1) is an official cross-sectoral publication intended to help organizations apply the AI RMF to generative AI contexts [3-4]. The Profile recommends lifecycle controls that closely resemble obligations found in binding laws elsewhere: acceptable-use policies, assumptions and limitations of use, disclosure information or notices, incident response plans, data provenance information, humanoversight roles and responsibilities, underlying foundation-model versions and access modes, and updated hierarchies of identified risks [3-4].

3.2 Federal Enforcement: The FTC and AI Providers

The FTC's enforcement activity represents the highest immediate federal compliance risk for AI model developers and providers. In September 2024, the FTC announced "Operation AI Comply," describing five enforcement actions targeting companies that allegedly used AI claims or AI-enabled tools in deceptive or unfair ways [4-3]. The actions focused on false or misleading claims that products were "AI-powered" or could reliably deliver specified outcomes, building on earlier cases involving online storefront schemes, AI moderation claims, AI facial recognition, and AI-related accuracy claims [4- 3].

A concrete 2025 example is the FTC's finalized order against DoNotPay over claims that its service was "the world's first robot lawyer." The FTC stated the company had not tested whether its AI-generated legal documents could substitute for a human lawyer's expertise, and the order prohibits deceptive AI-lawyer claims, imposes monetary relief, and requires notice to past subscribers [4-4][4-5].

The practical U.S. burden for providers therefore includes substantiating capability claims and avoiding "AI-washing": companies face enforcement if they market tools as AI-powered or outcome-capable without adequate support [4-1][4-3][4-4].

3.3 Federal Enforcement: The EEOC and Employment AI

The EEOC has made clear that employer use of AI and algorithmic tools is already subject to Title VII disparate-impact analysis [4-2]. The EEOC's public explainer lists recruiting, screening, hiring, monitoring employees, assessing productivity, setting wages, and deciding whom to promote or fire as areas where AI use may violate employment discrimination laws [4-11].

employment discrimination laws https://www.eeoc.gov/sites/default/files/2024-04/20240429_What%20is%20the%20EEOCs%20role%20in%20AI.pdf [4-11] .

The EEOC's Title VII technical-assistance document explains that if a tool has an adverse impact on a protected group, its use violates Title VII unless the employer can show the use is job-related and consistent with business necessity [4-12]. The document also states that employers considering whether to rely on a vendor may want to ask specifically whether the vendor assessed adverse impact using measures such as the four-fifths rule of thumb [4-12]. This creates a concrete vendor-management obligation that makes employment-AI vendors part of the compliance chain even when the legal duty remains on the employer [4-11][4-12].

the legal duty remains on the employer https://www.eeoc.gov/sites/default/files/2024-04/20240429_What%20is%20the%20EEOCs%20role%20in%20AI.pdf [4-11][4-12] https://data.aclum.org/storage/2025/01/EOCC_www_eeoc_gov_laws_guidance_select-issues-assessing-adverse-impact-software-algorithms-and-artificial.pdf .

3.4 California CPPA: The Most Operationally Significant U.S. Deployer- Facing AI-Adjacent Regime

California's privacy rulemaking has matured into the most operationally significant U.S. deployer-facing AI-adjacent regime. In September 2025, the CPPA announced that the Office of Administrative Law approved regulations covering automated decisionmaking technology (ADMT), risk assessments, and cybersecurity audits [6-4]. The compliance timeline is more staggered than broad summaries suggest:

Businesses subject to risk-assessment requirements must begin compliance by 1 January 2026 [6-4].

January 2026 [6-4] https://cppa.ca.gov/announcements/2025/20250923.html .

Businesses using ADMT to make significant decisions must comply with the ADMT-specific requirements beginning 1 January 2027 [6-5][6-6].

For risk assessments conducted in 2026 and 2027, businesses must submit information regarding the assessment to the CPPA by 1 April 2028 (for larger businesses) [6-5].

The final rules are narrower than earlier drafts and narrower than many broad "AI law" descriptions imply. They apply when technology replaces or substantially replaces human decision-making in certain "significant decision" contexts, and explicit references to artificial intelligence were removed from the final text compared with earlier drafts [6-6]. The regulations require businesses to provide notice, opt-out rights in covered cases, and related information/access mechanisms [4-7][4-8].

California's CPPA rules functionally push the state toward the EU/Colorado pattern on impact assessment and significant-decision controls, but the legal vehicle is CCPA rulemaking rather than an AI act, and the scope is limited to a privacy-law definition of automated decisionmaking rather than a general AI-system definition [6-4][6-6].

3.5 Colorado: A Substantially Revised Regime

Colorado's AI regulatory story has undergone a fundamental change. The original SB 24-205, signed on 17 May 2024, was the first broad state high-risk AI law and was widely described as imposing EU-like developer and deployer obligations for high-risk AI systems used in consequential decisions [1-19][1-20]. However, SB26-189 repealed and reenacted those provisions with a materially different compliance architecture [6- 1].

1] https://leg.colorado.gov/bills/sb26-189 .

The revised Colorado regime:

Removes the original duty of care, the deployer risk-management program requirement, the deployer impact-assessment requirement, and certain attorney general reporting duties [6-2][6-3].

general reporting duties [6-2][6-3] https://www.hunton.com/privacy-and-cybersecurity-law-blog/colorado-ai-act-amended-and-effective-date-delayed https://www.hklaw.com/en/insights/publications/2026/05/colorado-governor-signs-sb-189 .

Retains a developer-to-deployer documentation transfer mechanism: developers of covered ADMT must provide deployers with technical documentation on intended uses, categories of training data, known limitations, and instructions for appropriate use and human review [6-1].

Retains consumer-notice, adverse-decision explanation, and human reviewrelated rights for deployers [6-1][6-2][6-3].

related rights for deployers [6-1][6-2][6-3] https://leg.colorado.gov/bills/sb26-189 https://www.hunton.com/privacy-and-cybersecurity-law-blog/colorado-ai-act-amended-and-effective-date-delayed https://www.hklaw.com/en/insights/publications/2026/05/colorado-governor-signs-sb-189 .

Delays developer obligations to 1 January 2027 [6-1], superseding the prior SB 24-205 schedule (obligations originally set for 1 February 2026, later delayed to 30 June 2026).

The practical effect is that Colorado's regime is now centered on documentation transfer and consumer-facing transparency rather than the ex ante risk-management and impact-assessment architecture that made it the closest U.S. analogue to the EU's high-risk deployer framework. Colorado remains significant as the first U.S. state to create a comprehensive developer-to-deployer information-transfer obligation for AI systems used in consequential decisions, but the deployer-side burden is substantially lighter than the original law would have imposed [6-1][6-2][6-3].

lighter than the original law would have imposed [6-1][6-2][6-3] https://leg.colorado.gov/bills/sb26-189 https://www.hunton.com/privacy-and-cybersecurity-law-blog/colorado-ai-act-amended-and-effective-date-delayed https://www.hklaw.com/en/insights/publications/2026/05/colorado-governor-signs-sb-189 .

3.6 Other High-Impact Enacted State Regimes

Utah enacted its AI disclosure law on 13 March 2024, effective 1 May 2024. It requires consumer disclosures when individuals interact with generative AI in covered contexts and established the Office of Artificial Intelligence Policy and an AI Learning Laboratory Program [1-21][1-22]. The law was updated in 2025, with reports noting the state "scaled back" its reach [1-21].

Texas enacted the Responsible Artificial Intelligence Governance Act (TRAIGA) on 22 June 2025. Public analyses describe it as imposing prohibited-practice rules and public-sector notice duties while removing many of the broader private-sector developer/deployer obligations from earlier drafts [1-23][1-24]. The final enacted version is narrower in scope than the EU model or even the revised Colorado law, but it takes effect on 1 January 2026 and reaches both developers and deployers through its prohibited-use and disclosure provisions [1-23].

prohibited-use and disclosure provisions https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20250721-texas-enacts-new-ai-law [1-23] .

Frontier-model developer laws (California and New York). Two states have enacted laws aimed specifically at developers of frontier/foundation models—a category distinct from the deployer-facing and employment-AI rules above. California's Transparency in Frontier Artificial Intelligence Act (SB 53 / TFAIA), signed on 29 September 2025, requires frontier developers (with heightened duties for "large frontier developers") to publish a safety/governance framework and model transparency reports, report critical safety incidents, and extends whistleblower protections; it takes effect 1 January 2026 [1-48]. New York's RAISE Act, signed on 19 December 2025 (Chapter 699) and effective 1 January 2027, imposes safety-framework, disclosure, and incident-reporting duties on large frontier-model developers [1-47]. These are provider/developer-facing regimes, in contrast to California's CPPA ADMT rules (Section 3.4), which are deployerfacing.

New York City Local Law 144 requires annual independent bias audits for automated employment decision tools (AEDTs) used in hiring or promotion, public posting of audit summaries, and at least 10 business days' advance notice to applicants and employees, including information about the tool and alternative assessment requests [1-25].

Illinois has two notable enacted measures. The Artificial Intelligence Video Interview Act requires employers using AI to analyze recorded applicant videos to notify applicants, explain how the AI works and what characteristics it evaluates, obtain consent, limit sharing, and comply with destruction/deletion rules [1-26]. The Biometric Information Privacy Act (BIPA) remains a major enforcement law for AI systems using faceprints, voiceprints, or other biometric identifiers [1-26].

3.7 Privacy-Law Automated Decision-Making Provisions

Multiple states regulate AI indirectly through comprehensive privacy laws with profiling opt-outs, automated-decision-making rights, and data-protection assessment requirements:

Connecticut: Requires opt-outs for profiling in decisions producing legal or similarly significant effects; 2025 amendments added explicit impact assessment requirements for such profiling and additional AI/LLM training disclosures effective 2026 [1-28][1-29].

Virginia: The Consumer Data Protection Act gives consumers the right to opt out of profiling producing legal or similarly significant effects and requires data processing assessments for specified risky processing [1-30][1-31].

Alabama: An enacted privacy law includes an opt-out right for solely automated significant decisions, effective 1 May 2027 [1-3].

California: High legislative activity with enacted 2024–2025 AI laws covering generative AI transparency, training-data disclosures, election/deepfake measures, health and chatbot/frontier-model provisions; multiple additional proposals remain pending or have evolved [1-32][1-33]. The CPPA's ADMT regulations add a further compliance layer as described in Section 3.4 above. California also enacted the Transparency in Frontier Artificial Intelligence Act (SB 53, signed 29 September 2025), a frontier-model developer regime distinct from the deployer-facing ADMT rules [1-48].

3.8 All 50 States: Structured Status Snapshot

3.9 The Provider/Deployer Split in the U.S. System

The U.S. patchwork has a clearer provider/deployer compliance split than an enactedlaw inventory alone would suggest:

[4-3][4-4] https://www.ftc.gov/news-events/news/press-releases/2024/09/ftc-announces-crackdown-deceptive-ai-claims-schemes https://www.ftc.gov/news-events/news/press-releases/2025/02/ftc-finalizes-order-donotpay-prohibits-deceptive-ai-lawyer-claims-imposes-monetary-relief-requires . - Colorado's revised SB26-189 retains developer documentation obligations

For providers/developers: - FTC consumer-protection enforcement targets developers, providers, and marketers making AI capability claims or enabling deceptive uses [4-1] [4-3][4-4]. - Colorado's revised SB26-189 retains developer documentation obligations (intended uses, training-data categories, known limitations, instructions for use and human review) effective 1 January 2027 [6-1]. - California's enacted transparency and training-data disclosure laws create additional provider-facing obligations [1-32][1-33].

For deployers/users/integrators: - California's CPPA ADMT regulations create notice, opt-out, risk-assessment, and reporting obligations, phased from January 2026 through April 2028 [6-4][6-5][6-6]. - Colorado's revised regime retains consumer-notice, adverse-decision explanation, and human review-related rights, but no longer requires deployer impact assessments or risk-management programs [6-1][6-2][6-3]. - EEOCdriven employment testing and vendor-management expectations push employers to obtain adverse-impact evidence from vendors [4-11][4-12]. - State privacy-law profiling and ADMT provisions in Connecticut, Virginia, Alabama, and others impose opt-out rights and assessment duties [1-28][1-30][1-3]. - NYC and Illinois employment rules impose sector-specific deployer obligations [1-25][1-26].

rights and assessment duties https://www.shb.com/intelligence/newsletters/pds/hansen-connecticut-privacy-law-2025 [1-28][1-30][1-3] https://www.cliffordchance.com/insights/resources/blogs/talking-tech/en/articles/2021/03/virginia-s-consumer-data-privacy-act.html https://ai-law-center.orrick.com/us-ai-law-tracker-see-all-states . - NYC and Illinois employment rules impose sector-specific deployer obligations [1-25][1-26] https://www.gtlaw.com/en/insights/2023/6/nycs-law-governing-automated-employment-decision-tools-takes-effect-july-5 https://law.justia.com/codes/illinois/chapter-820/act-820-ilcs-42 .

3.10 Compliance Burden Assessment

The U.S. patchwork creates a high operational burden through volume, fragmentation, and the combination of state legislation with federal enforcement. The burden is being created through: (a) FTC substantiation-of-AI-claims enforcement, (b) consumerprotection enforcement against AI-enabled conduct, (c) EEOC anti-discrimination testing expectations in employment, and (d) CPPA privacy-rule-based notice, opt-out, and risk-assessment duties for automated decisionmaking [4-1][4-3][4-4][6-4][4-11][4- 12].

and risk-assessment duties for automated decisionmaking https://www.ftc.gov/industry/technology/artificial-intelligence [4-1][4-3][4-4][6-4][4-11][4- https://www.ftc.gov/news-events/news/press-releases/2024/09/ftc-announces-crackdown-deceptive-ai-claims-schemes https://www.ftc.gov/news-events/news/press-releases/2025/02/ftc-finalizes-order-donotpay-prohibits-deceptive-ai-lawyer-claims-imposes-monetary-relief-requires https://cppa.ca.gov/announcements/2025/20250923.html https://www.eeoc.gov/sites/default/files/2024-04/20240429_What%20is%20the%20EEOCs%20role%20in%20AI.pdf https://data.aclum.org/storage/2025/01/EOCC_www_eeoc_gov_laws_guidance_select-issues-assessing-adverse-impact-software-algorithms-and-artificial.pdf

The revision of Colorado's regime [6-1][6-2][6-3] means that the highest deployer-side burden in the U.S. has shifted from Colorado to California's CPPA ADMT regulations. However, California's rules are narrower than an AI statute: they apply only where technology replaces or substantially replaces human decision-making in significantdecision contexts [6-6]. The U.S. therefore lacks any state-level deployer regime that matches the breadth of the EU's high-risk system obligations.

Compared with the EU, the U.S. model remains less centralized and less ex ante, but it is not light-touch in operational terms. The NIST Generative AI Profile [3-4] partially mitigates fragmentation for organizations that adopt it as an internal governance framework, and the HAIP Reporting Framework [5-7][5-8] provides an additional international transparency structure. However, neither creates a legal safe harbor.

4. China

4.1 Legal Status and Scope

China's AI regulatory regime is layered and activity-specific rather than omnibus. It consists of binding administrative measures for public-facing generative AI services, deep synthesis internet information services, algorithmic recommendation services, and AI-generated/synthetic content labeling, all overlaid by the Cybersecurity Law, Data Security Law, and Personal Information Protection Law (PIPL) [1-4][1-5][1-6][1-7].

The Interim Measures for the Management of Generative Artificial Intelligence Services apply to entities using generative AI to provide services to the public in mainland China for generating text, images, audio, video, or other content [1-4].

4.2 Risk and Regulatory Model

China's structure is not an EU-style single risk-tier law. It is activity- and content-based, with strong emphasis on public-facing services, content control, security assessment, algorithm filing, data/personal-information compliance, and state oversight [1-4][1-5][1- 6].

4.3 Obligations: Developers/Providers

Generative AI service providers must uphold content-law requirements, adopt measures for data and model security, protect personal information, label or handle illegal content, and for some services complete security assessments and algorithm filing procedures [1-4].

Deep synthesis providers must not produce or disseminate prohibited information, must implement identity/authenticity-related measures, and must apply labeling obligations in specified contexts [1-5].

Algorithm recommendation service providers must establish management systems, protect users, provide options to turn off recommendation services in some contexts, and undergo filing/security oversight where required [1-6].

On 14 March 2025, the CAC and three other agencies released final Measures for Labeling Artificial Intelligence-Generated and Synthetic Content and the national standard GB 45438-2025, imposing explicit and implicit labeling duties and traceability-related duties for providers [1-7].

4.4 Enforcement and Penalties

Violations of the algorithm recommendation provisions may trigger warnings, criticism notices, orders to rectify, suspension of information updates, and fines of RMB 10,000 to RMB 100,000 where no other law provides otherwise; other violations are handled under other applicable laws and regulations [1-6]. The Cybersecurity Law, Data Security Law, and PIPL serve as enforcement overlays [1-4][1-5][1-6].

4.5 Compliance Burden Assessment

China's regime imposes the highest compliance burden on providers of public-facing AI services operating in mainland China. The combination of content-control obligations, security assessments, algorithm filing, labeling duties (explicit and implicit), and data/personal-information compliance creates a dense regulatory layer. The contentcontrol dimension—requiring alignment with state content standards—is a fundamental point of divergence from all other jurisdictions covered in this report and represents a potentially irreconcilable compliance asymmetry for global model developers [1-4][1-5].

transparency and documentation topics [5-5][5-6] https://g7g20-documents.org/database/document/2023-g7-japan-leaders-leaders-annex-hiroshima-process-international-code-of-conduct-for-organizations-developing-advanced-ai-systems https://www.oecd.org/content/dam/oecd/en/publications/reports/2025/09/how-are-ai-developers-managing-risks_fbaeb3ad/658c2ad6-en.pdf do not map onto China's content-

China's regime stands apart from the transnational governance layer. The Council of Europe Convention's human-rights framing [5-1][5-3] and the HAIP Code of Conduct's transparency and documentation topics [5-5][5-6] do not map onto China's contentcontrol and state-oversight requirements. Organizations operating in both China and Western markets face fundamentally incompatible compliance architectures for the content and values dimensions of AI governance.

5. United Kingdom

5.1 Legal Status and Structure

The UK has not enacted a single comprehensive AI law equivalent to the EU AI Act. The current model relies on existing regulators and laws, supplemented by AI-specific guidance and public-policy programs [1-8][1-9]. However, the question of cross-sector AI legislation is not dormant: a 2026 House of Lords Library briefing states the UK government's approach remains based on the 2023 white paper's sector-led framework but discusses active debate on whether cross-sector AI legislation is needed [6-9]. This indicates that binding AI legislation remains a live possibility in the UK, even if no specific timeline has been announced.

5.2 Institutional and Policy Direction

The UK government published the AI Opportunities Action Plan and issued a formal government response in January 2025. The Plan states the UK should invest in compute, data infrastructure, talent, and regulation, and that regulation, safety, and assurance can support AI adoption and growth [1-8][1-34].

5.3 Obligations

For both model developers/providers and deployers, binding duties arise primarily through existing laws: UK GDPR/data protection, consumer protection, equality law, product-safety rules, online safety/content rules, procurement, and sectoral supervision [1-9]. The ICO's guidance on AI and data protection addresses lawfulness, fairness, transparency, governance, accuracy, security, and individual rights for AI processing personal data [1-9].

5.4 Compliance Burden Assessment

The UK's compliance burden is moderate and distributed across multiple existing legal frameworks rather than concentrated in a single AI statute. The absence of a dedicated AI act means there are no AI-specific conformity assessments, model documentation mandates, or risk-tier classifications. However, the cumulative weight of UK GDPR, consumer protection, equality, and sectoral rules creates meaningful obligations, particularly for deployers processing personal data.

The UK's position is influenced by the transnational layer. The UK participated in negotiating the Council of Europe Convention and is among its signatories [5-1]; if the UK ratifies the treaty, it will be required to adopt or maintain domestic measures consistent with the Convention's human-rights, democracy, and rule-of-law standards [5-3]—potentially catalyzing the binding AI legislation currently under parliamentary debate [6-9].

6. Japan

6.1 Legal Status

Japan enacted its first AI-specific statute in 2025, but its substantive approach remains light-touch. The AI Promotion Act (Act on the Promotion of Research and Development and Utilization of AI-Related Technologies) was passed by the Diet on 28 May 2025, promulgated on 4 June 2025, and came into full effect in September 2025 [1-46]. It is a framework ("basic") law: it sets national policy direction, establishes an AI Strategy Headquarters and an AI Basic Plan, and frames private-sector responsibilities as besteffort cooperation rather than enforceable mandates—it imposes no AI-specific penalties [1-46]. Japan's operative cross-sector expectations therefore continue to flow from soft-law guidance: METI and MIC published the AI Guidelines for Business Version

1.0 in April 2024 and Version 1.1 on 28 March 2025 [1-10], with binding obligations arising only through data-protection, copyright, and sectoral law.

6.2 Scope and Actor Categories

The guidelines distinguish AI business actors, including developers, providers, and business users, and organize expected actions by role [1-10].

business users, and organize expected actions by role https://www.meti.go.jp/shingikai/mono_info_service/ai_shakai_jisso/pdf/20240419_15.pdf [1-10] .

6.3 Obligations and Themes

The guidelines address governance, safety, transparency, security, privacy, human rights/fairness, and role-based responsibilities rather than statutory fines [1-10]. The Japan AI Safety Institute (J-AISI) describes the updated guideline version as part of Japan's safety infrastructure [1-35].

6.4 Copyright/Training-Data Overlay

Japan's Agency for Cultural Affairs published "General Understanding on AI and Copyright in Japan," clarifying copyright issues around AI training and outputs [1-36].

6.5 Japan's Role in the Transnational Layer

Japan's significance in the global AI governance landscape extends beyond its domestic soft-law approach. Japan hosted the G7 Hiroshima Summit that launched the HAIP in May 2023 [5-4] and continues to operate the official HAIP Reporting Framework page [5-7]. Japan also participated in negotiating the Council of Europe Convention as an observer state [5-1]. This means Japan is simultaneously maintaining a light-touch domestic regime and playing a leading role in building the transnational governance infrastructure that shapes global AI compliance expectations.

6.6 Compliance Burden Assessment

Japan's compliance burden is low relative to the EU, China, or the U.S., given the nonbinding nature of the guidelines. Binding obligations arise primarily through Japan's data protection and sectoral laws. The guidelines' role-based structure mirrors actorcategory distinctions appearing in binding regimes elsewhere, facilitating governance mapping across jurisdictions.

7. South Korea

7.1 Legal Status and Timeline

South Korea adopted the Framework Act on Artificial Intelligence Development and Establishment of a Foundation for Trustworthiness in January 2025. Both the Act and its Enforcement Decree took effect on 22 January 2026 [6-7]. This makes South Korea, alongside the EU, one of only two jurisdictions with a comprehensive enacted AIspecific statute, and the existence of an effective Enforcement Decree means South Korea has moved beyond statute-only status into operational implementation. That said, MSIT is operating a grace period of at least one year in 2026, during which fact-finding investigations and administrative fines are generally deferred except in cases of serious social harm, so near-term enforcement risk is lower than the in-force date alone suggests [6-7].

7.2 Scope, Reach, and Domestic-Agent Requirements

The Act applies to AI development business operators and AI utilization business operators and has extraterritorial application for certain businesses offering products or services in Korea [1-2]. The Enforcement Decree includes provisions on methods for implementing transparency obligations for generative and high-impact AI business operators, criteria for defining high-performance AI, standards for determining highimpact AI, and the scope of operators required to designate a domestic agent [6-8]. This domestic-agent requirement is particularly significant for foreign model developers and AI service providers, as it creates a concrete in-country compliance presence obligation analogous to GDPR representative requirements.

7.3 Risk Model

The Act distinguishes "generative AI" and "high-impact AI." High-impact AI is defined as AI significantly affecting human life, physical safety, or fundamental rights [1-2].

7.4 Obligations: Developers/Providers

Businesses providing generative AI or high-impact AI have transparency duties, including requirements to notify users when operations use generative or high-impact AI and to label outputs produced by generative AI, including deepfakes [1-2][1-38].

High-impact AI operators face obligations concerning safety and reliability [1-38]. The Enforcement Decree specifies the methods for implementing these transparency obligations [6-8].

7.5 Penalties

Public analyses describe lower financial penalties than the EU model. The U.S. Department of Commerce trade note identifies the Act as a comprehensive framework creating new compliance requirements [1-2][1-37].

creating new compliance requirements https://www.cooley.com/news/insight/2026/2026-01-27-south-koreas-ai-basic-act-overview-and-key-takeaways [1-2][1-37] https://www.trade.gov/market-intelligence/south-korea-artificial-intelligence-ai-basic-act .

7.6 Compliance Burden Assessment

South Korea's regime is binding, comprehensive, and now operationally implemented through the Enforcement Decree [6-7][6-8]. The compliance burden is moderate: lower than the EU AI Act in terms of financial penalties and the absence of comparable threelayer implementation machinery, but higher than previously assessed given the Enforcement Decree's specific transparency methods, high-impact AI determination criteria, and domestic-agent requirements for foreign operators [6-8]. The extraterritorial reach means that foreign model developers and deployers offering products or services in Korea face a concrete and enforceable compliance obligation.

8. Brazil

8.1 Legal Status

(House of Representatives) [6-10][6-11] https://www.demarest.com.br/en/inteligencia-artificial-reacende-debates-na-camara-dos-deputados https://www.sidi.org.br/en/blog/the-impacts-of-regulating-artificial-intelligence-in-brazil . This represents meaningful legislative

Brazil's principal AI framework remains proposed rather than enacted. PL 2338/2023 has passed the Senate and is now being processed by the Chamber of Deputies (House of Representatives) [6-10][6-11]. This represents meaningful legislative progress: the bill is no longer an undifferentiated congressional proposal but has cleared one chamber and is in the final legislative stage before potential enactment.

8.2 Core Bill Structure

Available summaries describe a risk-based bill establishing general standards for development, implementation, and responsible use of AI systems, with governance duties and impact assessments for high-risk systems [1-11][1-39].

8.3 Current Binding Overlays and Emerging Regulatory Activity

Until any AI bill is enacted, Brazil's binding controls relevant to AI come primarily from the LGPD data protection law and sectoral/consumer frameworks [1-11]. However, the Brazilian national data protection authority (ANPD) is already building a technical interpretation layer for generative AI under existing LGPD-based oversight. The ANPD released an English-language version of its Technology Radar – Generative Artificial Intelligence in December 2024, addressing topics such as data scraping/web scraping and synthetic content generation, both of which may involve personal data processing [3-7]. This means Brazil's immediate AI compliance burden is being shaped not only by the pending AI bill and LGPD enforcement generally, but by regulator-authored technical framing of generative AI issues under existing law [3-7].

8.4 Compliance Burden Assessment

The current compliance burden is limited to LGPD and consumer-law obligations, but the ANPD's Technology Radar work signals that regulator expectations around AIrelated data processing are becoming more specific. The bill's passage through the Senate [6-10][6-11] increases the probability of enactment in the near term. If PL 2338/2023 is enacted in a form resembling current summaries, Brazil would join the EU and South Korea in the category of jurisdictions with comprehensive, risk-based AI statutes.

9. India

9.1 Legal Status and Scope

India does not have a dedicated enacted cross-sector AI statute. The current framework is based on the Digital Personal Data Protection Act (DPDP Act) 2023, the IT Act, the Intermediary Guidelines and Digital Media Ethics Code Rules 2021 (as amended), cyber advisories, and MeitY advisories [1-12][1-13].

9.2 MeitY Advisory and Platform Obligations

MeitY's 2024 advisory instructed intermediaries and platforms to ensure that AI/LLM/generative AI software or algorithms do not permit users to host, display, upload, modify, publish, transmit, store, update, or share unlawful content under the IT Rules framework [1-12].

Rules framework [1-12] https://www.meity.gov.in/static/uploads/2024/02/9f6e99572739a3024c9cdaec53a0a0ef.pdf .

9.3 Data Protection Overlay

The DPDP Act 2023 applies extraterritorially where processing outside India is connected with offering goods or services to individuals in India [1-13].

9.4 Deepfakes and Online Harms

A 2025 government statement to Parliament identifies the IT Act 2000 and the IT Rules 2021 as the core legal framework used to address deepfakes and related cyber harms, including sections on identity theft, impersonation, privacy violations, obscene/sexually explicit content, blocking orders, and intermediary notice/removal powers [1-40].

9.5 Compliance Burden Assessment

India's current AI compliance burden is moderate and arises primarily from the DPDP Act's extraterritorial reach and the IT intermediary framework. The absence of a dedicated AI statute means no AI-specific conformity assessments, risk tiers, or model documentation requirements exist.

10. Gulf Region (GCC)

10.1 Regional Overview

specific governance measures [1-14][1-16][1-41] https://www.twobirds.com/en/insights/2025/united-arab-emirates/gcc-navigating-ai-regulations---the-current-landscape https://sdaia.gov.sa/en/SDAIA/about/Files/GenAIGuidelinesForGovernmentENCompressed.pdf https://blogs.loc.gov/law/2024/12/falqs-ai-regulations-in-the-gulf-cooperation-council-member-states-part-two . No evidence was found of a binding

No GCC-wide binding AI law was identified. The landscape is composed of national strategies, data protection laws, cybersecurity rules, sector guidance, and selective AIspecific governance measures [1-14][1-16][1-41]. No evidence was found of a binding UAE federal omnibus AI law despite some public claims online; credible regulatory trackers confirm the UAE does not have a specific standalone AI law and instead relies on strategies, ethical frameworks, data-protection laws, and free-zone regimes [6-17] [6-18].

10.2 United Arab Emirates

There is no dedicated federal AI law in force in the UAE [6-17][6-18]. The applicable framework is built from personal-data and sector rules plus strategy/policy documents [1-15].

DIFC Regulation 10, enacted 1 September 2023, specifically regulates processing personal data through autonomous and semi-autonomous systems, including AI. DIFC describes Regulation 10 as a risk- and outcomes-based framework and provides an accreditation/certification architecture [1-15]. Abu Dhabi created the Artificial Intelligence and Advanced Technology Council under Law No. 3 of 2024 [1-14].

Intelligence and Advanced Technology Council under Law No. 3 of 2024 https://www.twobirds.com/en/insights/2025/united-arab-emirates/gcc-navigating-ai-regulations---the-current-landscape [1-14] .

The UAE has adopted the UAE Charter for the Development and Use of Artificial Intelligence, a policy instrument published on the official legislation portal that aims to achieve the strategic goals of the UAE AI Strategy [3-8]. While not a standalone AI statute, the Charter provides a formal national governance reference point that applies conceptually across sectors [3-8].

10.3 Saudi Arabia

Saudi Arabia's binding baseline is the Personal Data Protection Law (PDPL) and related data/cyber rules [1-16][1-42]. SDAIA's Generative Artificial Intelligence Guidelines for Government require alignment with personal data protection, cybersecurity standards, data-classification rules, and AI Ethics Principles [1-42].

Saudi Arabia's AI Ethics Principles are more structured than a generic principles statement. SDAIA's official document sets out lifecycle-oriented controls covering planning and design, input data preparation, building and validation, and deployment and monitoring [3-9]. The substantive principles include fairness, privacy and security, humanity, social and environmental benefits, reliability and safety, transparency and explainability, and accountability and responsibility [3-9]. The framework incorporates risk categorization and defined organizational roles and responsibilities for adopting entities [3-10][3-11]. While not statutory mandates, these indicate that Saudi Arabia's guidance is moving beyond abstract ethics into implementable governance design resembling the management-system controls found in ISO/IEC 42001 and the NIST AI RMF.

10.4 Qatar

Qatar has a National Artificial Intelligence Strategy and a federal data protection law, Law No. 13 of 2016 [1-44][1-45]. The national AI strategy includes an "AI Ethics and

Governance" pillar and states that explainability guidelines are needed for different types of AI decisions [1-44].

types of AI decisions [1-44] https://www.dataguidance.com/jurisdictions/qatar .

10.5 Bahrain, Kuwait, and Oman

cross-sector AI law was identified https://www.twobirds.com/en/insights/2025/united-arab-emirates/gcc-navigating-ai-regulations---the-current-landscape [1-14][1-41] https://blogs.loc.gov/law/2024/12/falqs-ai-regulations-in-the-gulf-cooperation-council-member-states-part-two . Kuwait is in early stages of developing

Bahrain is characterized as active on digital policy and data protection, but no enacted cross-sector AI law was identified [1-14][1-41]. Kuwait is in early stages of developing an AI regulatory framework aligned with Vision 2035 [1-41]. Oman has a draft National Artificial Intelligence Policy defining governance for data management and development/use of AI systems [1-41].

development/use of AI systems [1-41] https://blogs.loc.gov/law/2024/12/falqs-ai-regulations-in-the-gulf-cooperation-council-member-states-part-two .

10.6 Compliance Burden Assessment

The GCC region presents a relatively low AI-specific compliance burden compared to the EU, China, or the U.S. The DIFC's Regulation 10 is the most developed AI-specific binding regime in the region, but it applies only within the DIFC free zone. Governmentsector AI users in Saudi Arabia face additional guidance-based obligations through SDAIA's guidelines and ethics framework. The UAE Charter and Saudi AI Ethics Principles add governance expectations that, while not legally binding in the manner of the EU AI Act, are increasingly structured enough to influence procurement decisions, public-sector requirements, and organizational governance practices.

11. The Global Governance Infrastructure Layer

11.1 A Second Layer Beyond Formal Law

By mid-2026, a parallel layer of non-binding but operationally consequential governance infrastructure has emerged alongside formal legislation. This layer includes international standards, incident-reporting frameworks, technical guidance, privacyregulator technical studies, and national AI charters [3-1][3-2][3-4][3-5][3-7][3-8][3-9].

regulator technical studies, and national AI charters [3-1][3-2][3-4][3-5][3-7][3-8][3-9] https://www.iso.org/standard/42001 https://www.oecd.org/en/publications/towards-a-common-reporting-framework-for-ai-incidents_f326d4ac-en.html https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence https://digital-strategy.ec.europa.eu/en/policies/ai-act-standardisation https://legismap.com.br/conteudos/artigos-e-noticias/anpd-releases-english-version-of-technology-radar https://uaelegislation.gov.ae/en/policy/details/the-uae-charter-for-the-development-and-use-of-artificial-intelligence https://sdaia.gov.sa/en/SDAIA/about/Documents/ai-principles.pdf .

11.2 ISO/IEC 42001: The Global Management-System Baseline

ISO/IEC 42001:2023 is the world's first AI management system standard. It specifies requirements for establishing, implementing, maintaining, and continually improving an AI management system (AIMS) within organizations [3-1]. The standard is designed for entities providing or utilizing AI-based products or services, mapping directly onto the developer/provider versus deployer/user split [3-1]. It is process-focused rather than model- or sector-specific, offering a management-system structure rather than prescribing prohibited practices or high-risk categories [3-1].

11.3 NIST Generative AI Profile

NIST AI 600-1 provides detailed voluntary risk-management guidance for generative AI contexts [3-4]. Its recommended lifecycle controls—acceptable-use policies, data provenance information, human-oversight roles, incident response plans, disclosure notices, and risk hierarchies—converge operationally with concepts embedded in the EU AI Act, Colorado's revised developer documentation requirements, and South Korea's AI Basic Act [3-4].

11.4 OECD Incident-Reporting Framework

The OECD's 2025 paper Towards a common reporting framework for AI incidents contains 29 criteria intended to help policymakers understand AI incidents across diverse contexts [3-2]. The OECD's AI Incidents and Hazards Monitor is developing definitions and monitoring through a common reporting framework, supported by an Expert Group on AI Incidents [3-3]. The framework distinguishes between AI incidents and AI hazards, includes fields for quantifying harm, and is actor- and sector-neutral [3- 2][3-3].

11.5 EU Harmonised Standards

Within the EU specifically, harmonised standards published by CEN and CENELEC, once referenced in the Official Journal, will provide a presumption of conformity with the AI Act [3-5][3-6]. The Digital Omnibus proposal of 19 November 2025 explicitly proposed linking the application of rules for high-risk AI systems to the availability of support tools, including standards [3-5].

11.6 Convergence Through Infrastructure

Across ISO/IEC 42001, the NIST Generative AI Profile, the OECD incident framework, EU standardization, Brazil's ANPD Technology Radar, the UAE Charter, Saudi AI Ethics Principles, and the HAIP Reporting Framework, recurring themes include governance systems, documentation, data provenance, monitoring, human oversight, incident handling, transparency, and lifecycle controls [3-1][3-2][3-4][3-5][3-7][3-8][3-9][5-5] https://www.iso.org/standard/42001 https://www.oecd.org/en/publications/towards-a-common-reporting-framework-for-ai-incidents_f326d4ac-en.html https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence https://digital-strategy.ec.europa.eu/en/policies/ai-act-standardisation https://legismap.com.br/conteudos/artigos-e-noticias/anpd-releases-english-version-of-technology-radar https://uaelegislation.gov.ae/en/policy/details/the-uae-charter-for-the-development-and-use-of-artificial-intelligence https://sdaia.gov.sa/en/SDAIA/about/Documents/ai-principles.pdf https://g7g20-documents.org/database/document/2023-g7-japan-leaders-leaders-annex-hiroshima-process-international-code-of-conduct-for-organizations-developing-advanced-ai-systems

handling, transparency, and lifecycle controls [3-1][3-2][3-4][3-5][3-7][3-8][3-9][5-5] [5-6][5-8]. This convergence is distinct from convergence in formal law: jurisdictions remain divergent on penalties, enforcement powers, and prohibited practices, but they are increasingly similar in the kinds of internal controls they expect organizations to build.

12. Cross-Jurisdictional Convergence and Divergence

12.1 Areas of Convergence

Several regulatory concepts are converging across jurisdictions, reinforced by formal law, governance infrastructure, and the transnational layer:

Transparency and disclosure: EU Article 50 disclosures and mandatory trainingdata summary template [1-1][2-9], Utah consumer disclosures [1-21], South Korea generative-AI notices/labeling with Enforcement Decree-specified methods [1-2] [1-38][6-8], China mandatory explicit/implicit labeling [1-7], NYC applicant notice [1-25], Illinois candidate notice [1-26], HAIP Code of Conduct transparency reports [5-5][5-6], FTC enforcement against unsubstantiated AI claims [4-3][4-4], Qatar strategy references to explainability [1-44], Saudi/UAE guidance [1-42][3-8].

[1-38][6-8] https://www.kimchang.com/en/insights/detail.kc?sch_section=4&idx=33805 https://www.kimchang.com/en/insights/detail.kc?sch_section=4&idx=32909 , China mandatory explicit/implicit labeling [1-7] https://www.chinalawtranslate.com/en/ai-labeling , NYC applicant notice [1-25] https://www.gtlaw.com/en/insights/2023/6/nycs-law-governing-automated-employment-decision-tools-takes-effect-july-5 , Illinois candidate notice https://law.justia.com/codes/illinois/chapter-820/act-820-ilcs-42 [1-26] , HAIP Code of Conduct transparency reports [5-5][5-6] https://g7g20-documents.org/database/document/2023-g7-japan-leaders-leaders-annex-hiroshima-process-international-code-of-conduct-for-organizations-developing-advanced-ai-systems https://www.oecd.org/content/dam/oecd/en/publications/reports/2025/09/how-are-ai-developers-managing-risks_fbaeb3ad/658c2ad6-en.pdf , FTC enforcement against unsubstantiated AI claims https://www.ftc.gov/news-events/news/press-releases/2024/09/ftc-announces-crackdown-deceptive-ai-claims-schemes [4-3][4-4] https://www.ftc.gov/news-events/news/press-releases/2025/02/ftc-finalizes-order-donotpay-prohibits-deceptive-ai-lawyer-claims-imposes-monetary-relief-requires , Qatar strategy references to explainability [1-44] https://www.dataguidance.com/jurisdictions/qatar , Saudi/UAE guidance https://my.gov.sa/en/news/640446 [1-42][3-8] https://uaelegislation.gov.ae/en/policy/details/the-uae-charter-for-the-development-and-use-of-artificial-intelligence .

[6-5] https://www.hunton.com/privacy-and-cybersecurity-law-blog/newly-approved-ccpa-regulations-have-staggered-deadlines-for-compliance , privacy-law assessments in Virginia and Connecticut https://www.shb.com/intelligence/newsletters/pds/hansen-connecticut-privacy-law-2025 [1-28][1-30] https://www.cliffordchance.com/insights/resources/blogs/talking-tech/en/articles/2021/03/virginia-s-consumer-data-privacy-act.html , DIFC

Risk and impact assessments: EU conformity/risk management and deployer FRIAs [1-1], California CPPA ADMT risk assessments (phased from Jan 2026) [6-4] [6-5], privacy-law assessments in Virginia and Connecticut [1-28][1-30], DIFC Regulation 10 [1-15], Saudi risk categorization [3-10][3-11], Council of Europe Convention's graduated-and-differentiated approach [5-3]. Colorado's deployer impact-assessment requirement has been removed by SB26-189 [6-2][6-3], narrowing the U.S. convergence with EU-style deployer assessments.

Human oversight and contestability: EU high-risk rules [1-1], UK data protection guidance [1-9], Colorado's revised human review-related rights [6-1][6-2], U.S. privacy/employment frameworks [1-25], NIST Profile recommendations [3-4], HAIP Code of Conduct [5-5].

privacy/employment frameworks [1-25] https://www.gtlaw.com/en/insights/2023/6/nycs-law-governing-automated-employment-decision-tools-takes-effect-july-5 , NIST Profile recommendations [3-4] https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence , HAIP Code of Conduct [5-5] https://g7g20-documents.org/database/document/2023-g7-japan-leaders-leaders-annex-hiroshima-process-international-code-of-conduct-for-organizations-developing-advanced-ai-systems .

Data governance, privacy, and security: Central in EU [1-1], China [1-4], UK ICO guidance [1-9], India DPDP [1-13], UAE/DIFC [1-15], Saudi PDPL/SDAIA [1-42], Brazil ANPD [3-7], California CPPA [6-4].

Brazil ANPD [3-7] https://legismap.com.br/conteudos/artigos-e-noticias/anpd-releases-english-version-of-technology-radar , California CPPA [6-4] https://cppa.ca.gov/announcements/2025/20250923.html .

Documentation and model information: EU GPAI and high-risk providers (with prescribed template [2-9]), Colorado developers (documentation transfer retained under SB26-189 [6-1]), China filing/security processes [1-4], HAIP Code of

Conduct documentation requirements [5-5][5-6] https://g7g20-documents.org/database/document/2023-g7-japan-leaders-leaders-annex-hiroshima-process-international-code-of-conduct-for-organizations-developing-advanced-ai-systems https://www.oecd.org/content/dam/oecd/en/publications/reports/2025/09/how-are-ai-developers-managing-risks_fbaeb3ad/658c2ad6-en.pdf , NIST Profile model versioning

Conduct documentation requirements [5-5][5-6], NIST Profile model versioning [3-4].

Content labeling and synthetic media controls: Strong in China [1-7], present in South Korea [1-38] and several U.S. states [1-32].

South Korea [1-38] https://www.kimchang.com/en/insights/detail.kc?sch_section=4&idx=33805 and several U.S. states [1-32] https://fpf.org/wp-content/uploads/2026/02/Enacted-AI-Legislation-Chart-.pdf .

Internal governance systems: EU AI Pact governance pledges [2-7], EU GPAI Code of Practice [2-8], ISO/IEC 42001 management-system structure [3-1], NIST lifecycle controls [3-4], Saudi lifecycle-oriented ethics framework [3-9], HAIP Reporting Framework organizational governance disclosures [5-7][5-8].

Incident handling and post-deployment monitoring: EU serious incident reporting [1-1], OECD 29-criterion incident framework [3-2][3-3], NIST incident response plans [3-4], China security assessment/oversight [1-4].

Vendor-documentation transmission: EU provider-to-deployer documentation [1- 1], Colorado developer-to-deployer packages (retained under SB26-189 [6-1]), EEOC vendor-management expectations [4-12].

EEOC vendor-management expectations [4-12] https://data.aclum.org/storage/2025/01/EOCC_www_eeoc_gov_laws_guidance_select-issues-assessing-adverse-impact-software-algorithms-and-artificial.pdf . [5-1], HAIP lifecycle actions [5-5], ISO/IEC 42001 lifecycle management [3-1], https://www.coe.int/en/web/artificial-intelligence/the-framework-convention-on-artificial-intelligence https://g7g20-documents.org/database/document/2023-g7-japan-leaders-leaders-annex-hiroshima-process-international-code-of-conduct-for-organizations-developing-advanced-ai-systems https://www.iso.org/standard/42001

Lifecycle-oriented governance: Council of Europe Convention lifecycle approach [5-1], HAIP lifecycle actions [5-5], ISO/IEC 42001 lifecycle management [3-1], Saudi AI Ethics Principles lifecycle controls [3-9], NIST lifecycle framework [3-4].

12.2 Areas of Material Divergence

Several points of divergence are potentially irreconcilable for global AI products:

1. Content control: China's content-control obligations have no equivalent in any other jurisdiction and create a fundamental compliance asymmetry for global model developers [1-4][1-5]. The Council of Europe Convention's human-rights framing [5-1] and the HAIP Code of Conduct's transparency approach [5-5] are structurally incompatible with China's content-alignment requirements.

framing [5-1] https://www.coe.int/en/web/artificial-intelligence/the-framework-convention-on-artificial-intelligence and the HAIP Code of Conduct's transparency approach https://g7g20-documents.org/database/document/2023-g7-japan-leaders-leaders-annex-hiroshima-process-international-code-of-conduct-for-organizations-developing-advanced-ai-systems [5-5] are

2. Regulatory architecture: The EU's single omnibus risk-tier statute with three-layer compliance ecosystem versus China's layered activity-specific measures versus the U.S. dual-layer system versus the UK's regulator-led approach creates structurally incompatible frameworks. The EU's formal coordination through the European AI Board [2-2] and harmonised-standards pathway [3-5][3-6] contrasts with the entirely uncoordinated U.S. state landscape.

European AI Board [2-2] https://digital-strategy.ec.europa.eu/en/policies/market-surveillance-authorities-under-ai-act and harmonised-standards pathway https://digital-strategy.ec.europa.eu/en/policies/ai-act-standardisation [3-5][3-6] https://jtc21.eu/ contrasts

3. Penalty scale and enforcement mechanism: The EU's fines of up to EUR 35 million or 7% of worldwide annual turnover dwarf other jurisdictions [1-1]. China's RMB 10,000–100,000 fines under algorithmic recommendation rules are modest [1- 6], and South Korea's penalties are described as lower than the EU model [1-2]. In the U.S., the FTC operates through consent orders and monetary relief rather than a statutory fine schedule [4-4][4-5].

a statutory fine schedule [4-4][4-5] https://www.ftc.gov/news-events/news/press-releases/2025/02/ftc-finalizes-order-donotpay-prohibits-deceptive-ai-lawyer-claims-imposes-monetary-relief-requires https://www.ftc.gov/legal-library/browse/cases-proceedings/donotpay .

4. Developer versus deployer allocation: The EU places substantial obligations on both [1-1]. China focuses primarily on public-facing service providers [1-4]. Colorado's revised regime retains developer documentation duties but has scaled back deployer obligations [6-1][6-2][6-3]. Many U.S. states regulate only deployers in specific contexts [1-25][1-26]. California's CPPA rules focus on deployers using ADMT for significant decisions [6-4][6-6].

back deployer obligations https://leg.colorado.gov/bills/sb26-189 [6-1][6-2][6-3] https://www.hunton.com/privacy-and-cybersecurity-law-blog/colorado-ai-act-amended-and-effective-date-delayed https://www.hklaw.com/en/insights/publications/2026/05/colorado-governor-signs-sb-189 . Many U.S. states regulate only deployers in specific contexts https://www.gtlaw.com/en/insights/2023/6/nycs-law-governing-automated-employment-decision-tools-takes-effect-july-5 [1-25][1-26] https://law.justia.com/codes/illinois/chapter-820/act-820-ilcs-42 . California's CPPA rules focus on deployers using ADMT for significant decisions https://cppa.ca.gov/announcements/2025/20250923.html [6-4][6-6] https://www.coblentzlaw.com/news/california-finalizes-ccpa-regulations-on-automated-decision-making-technology-risk-assessments-and-cybersecurity-audits .

5. Extraterritorial reach: The EU AI Act, South Korea's AI Basic Act (with domesticagent requirements [6-8]), India's DPDP Act, and the Council of Europe Convention (through state implementation obligations) all assert cross-border application through different mechanisms [1-1][1-2][1-13][5-1][5-3].

application through different mechanisms https://artificialintelligenceact.eu/chapter/5 [1-1][1-2][1-13][5-1][5-3] https://www.cooley.com/news/insight/2026/2026-01-27-south-koreas-ai-basic-act-overview-and-key-takeaways https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf https://www.coe.int/en/web/artificial-intelligence/the-framework-convention-on-artificial-intelligence https://eucrim.eu/news/council-of-europe-convention-on-artificial-intelligence .

6. Implementation depth: The EU's proceduralized implementation—templates, codes, expert panels, pre-compliance initiatives, harmonised-standards pathways —is unmatched [2-1][2-8][2-9][3-5][3-6], though it has been accompanied by missed guidance deadlines and industry contestation [6-12][6-13][6-15].

—is unmatched https://digital-strategy.ec.europa.eu/en/policies/ai-office [2-1][2-8][2-9][3-5][3-6] https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai https://digital-strategy.ec.europa.eu/en/news/commission-presents-template-general-purpose-ai-model-providers-summarise-data-used-train-their https://digital-strategy.ec.europa.eu/en/policies/ai-act-standardisation https://jtc21.eu/ , though it has been accompanied by missed guidance deadlines and industry contestation https://ccianet.org/news/2025/07/ai-act-eus-final-gpai-code-imposes-disproportionate-burden-improvements-required [6-12][6-13][6-15] https://www.itic.org/news-events/news-releases/iti-reacts-to-publication-of-ai-act-gpai-code-of-practice https://iapp.org/news/a/european-commission-misses-deadline-for-ai-act-guidance-on-high-risk-systems .

7. Binding versus non-binding status: The same organizational control—a documented risk management system or incident response plan—may be legally required in one jurisdiction (EU), effectively required through enforcement risk in another (U.S. FTC/EEOC), expected under a treaty obligation that awaits domestic implementation (Council of Europe Convention Parties), voluntarily disclosed through a reporting framework (HAIP), and merely recommended in a third (Japan, UK, Gulf).

13. Comparative Classification Matrix

EU — Binding enacted law + harmonised standards pathway

Risk model: 4-tier risk + GPAI

Developer/provider burden: Very high

Deployer/user burden: High

Enforcement: AI Office + national MSAs + AI Board + Scientific Panel + Advisory Forum + CEN-CENELEC [2-1][2-2][2-3][2-4][3-5][3-6]

Forum + CEN-CENELEC https://digital-strategy.ec.europa.eu/en/policies/ai-office [2-1][2-2][2-3][2-4][3-5][3-6] https://digital-strategy.ec.europa.eu/en/policies/market-surveillance-authorities-under-ai-act https://digital-strategy.ec.europa.eu/en/policies/ai-advisory-forum https://digital-strategy.ec.europa.eu/en/policies/ai-scientific-panel https://digital-strategy.ec.europa.eu/en/policies/ai-act-standardisation https://jtc21.eu/

Penalty ceiling: EUR 35M / 7% turnover [1-1]

Key dates: Phased (statutory): Feb 2025–Aug 2026, embedded-product Aug 2027; Digital Omnibus (provisional, pending adoption) would defer Annex III to Dec 2027 and embedded-product to Aug 2028 [1-1][2-6]

2027 and embedded-product to Aug 2028 [1-1][2-6] https://artificialintelligenceact.eu/chapter/5 https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai

U.S. (federal enforcement) — Enforcement through existing law

Risk model: No AI-specific tiers

Developer/provider burden: High (AI-washing/claims) [4-3][4-4]

Developer/provider burden: High (AI-washing/claims) https://www.ftc.gov/news-events/news/press-releases/2024/09/ftc-announces-crackdown-deceptive-ai-claims-schemes [4-3][4-4] https://www.ftc.gov/news-events/news/press-releases/2025/02/ftc-finalizes-order-donotpay-prohibits-deceptive-ai-lawyer-claims-imposes-monetary-relief-requires Deployer/user burden: High (employment/privacy) [6-4][4-11][4-12] https://cppa.ca.gov/announcements/2025/20250923.html https://www.eeoc.gov/sites/default/files/2024-04/20240429_What%20is%20the%20EEOCs%20role%20in%20AI.pdf https://data.aclum.org/storage/2025/01/EOCC_www_eeoc_gov_laws_guidance_select-issues-assessing-adverse-impact-software-algorithms-and-artificial.pdf Enforcement: FTC + EEOC + CPPA (uncoordinated) [4-1][4-2][6-4] https://www.ftc.gov/industry/technology/artificial-intelligence https://www.eeoc.gov/newsroom/eeoc-launches-initiative-artificial-intelligence-and-algorithmic-fairness https://cppa.ca.gov/announcements/2025/20250923.html

Deployer/user burden: High (employment/privacy) [6-4][4-11][4-12]

Enforcement: FTC + EEOC + CPPA (uncoordinated) [4-1][4-2][6-4]

Penalty ceiling: Varies by agency/case

Key dates: Ongoing

Colorado (revised) — Binding enacted law (repealed and reenacted by SB26-189)

Risk model: Consequential-decision ADMT

Developer/provider burden: Moderate (documentation transfer) [6-1]

Deployer/user burden: Low–moderate (consumer notice, human review rights; no impact assessment) [6-1][6-2][6-3]

impact assessment) https://leg.colorado.gov/bills/sb26-189 [6-1][6-2][6-3] https://www.hunton.com/privacy-and-cybersecurity-law-blog/colorado-ai-act-amended-and-effective-date-delayed https://www.hklaw.com/en/insights/publications/2026/05/colorado-governor-signs-sb-189

Enforcement: AG enforcement

Penalty ceiling: AG enforcement

Key dates: Developer obligations: 1 Jan 2027 [6-1]

California (CPPA) — Binding regulation under privacy law

Risk model: Significant-decision ADMT (narrower than AI statute) [6-6]

Developer/provider burden: Low–moderate

Deployer/user burden: High [6-4][6-5]

Deployer/user burden: High https://cppa.ca.gov/announcements/2025/20250923.html [6-4][6-5] https://www.hunton.com/privacy-and-cybersecurity-law-blog/newly-approved-ccpa-regulations-have-staggered-deadlines-for-compliance

Enforcement: CPPA [6-4] https://cppa.ca.gov/announcements/2025/20250923.html

Enforcement: CPPA [6-4]

Penalty ceiling: CCPA penalties

Key dates: Risk assessments: Jan 2026; ADMT: Jan 2027; reporting: Apr 2028 [6- 4][6-5]

South Korea — Binding enacted law + Enforcement Decree

Risk model: Generative AI + high-impact AI

Developer/provider burden: Moderate–high (with domestic-agent requirement for foreign operators) [6-7][6-8]

foreign operators) [6-7][6-8] https://www.trade.gov/market-intelligence/south-korea-ai-basic-act https://www.kimchang.com/en/insights/detail.kc?sch_section=4&idx=32909

Deployer/user burden: Moderate

Enforcement: Government authorities [1-2]

Penalty ceiling: Lower than EU [1-2]

Key dates: 22 Jan 2026 (Act + Decree) [6-7]

China — Binding administrative measures (layered)

Risk model: Activity/content-based

Developer/provider burden: Very high (public-facing)

Deployer/user burden: Moderate

Enforcement: CAC + multi-agency [1-4][1-6]

Enforcement: CAC + multi-agency https://www.chinalawtranslate.com/en/generative-ai-interim [1-4][1-6] https://digichina.stanford.edu/work/translation-internet-information-service-algorithmic-recommendation-management-provisions-effective-march-1-2022 Penalty ceiling: RMB 10K–100K + overlay laws [1-6] https://digichina.stanford.edu/work/translation-internet-information-service-algorithmic-recommendation-management-provisions-effective-march-1-2022

Penalty ceiling: RMB 10K–100K + overlay laws [1-6]

Key dates: Various (2022–2025)

UK — Regulator guidance + existing law (cross-sector legislation under active parliamentary debate [6-9])

Risk model: No AI-specific tiers

Developer/provider burden: Low (AI-specific)

Deployer/user burden: Moderate (existing law)

Enforcement: Existing sectoral regulators + ICO [1-9]

Penalty ceiling: Varies by underlying law

Key dates: Ongoing

Japan — Basic law (AI Promotion Act, 2025; non-binding) + soft-law guidance

Risk model: No binding tiers

Developer/provider burden: Low

Deployer/user burden: Low

Enforcement: AI Strategy HQ (policy) + sectoral regulators

Penalty ceiling: None (AI-specific; no penalties)

Key dates: AI Promotion Act in force Sep 2025; Guidelines v1.1 Mar 2025 [1-46][1- https://www.whitecase.com/insight-alert/japans-first-ai-legislation-becomes-law-focus-promoting-research-and-development-no https://www.meti.go.jp/shingikai/mono_info_service/ai_shakai_jisso/pdf/20240419_15.pdf

Key dates: AI Promotion Act in force Sep 2025; Guidelines v1.1 Mar 2025 [1-46][1- 10]

Brazil — Proposed bill (passed Senate, in Chamber of Deputies [6-10][6-11]) + existing

Brazil — Proposed bill (passed Senate, in Chamber of Deputies [6-10][6-11] https://www.demarest.com.br/en/inteligencia-artificial-reacende-debates-na-camara-dos-deputados https://www.sidi.org.br/en/blog/the-impacts-of-regulating-artificial-intelligence-in-brazil ) + existing

law + ANPD analysis

Risk model: Risk-based (proposed)

Developer/provider burden: Low (current)

Deployer/user burden: Low (current)

Enforcement: ANPD + LGPD + sectoral [1-11][3-7]

Enforcement: ANPD + LGPD + sectoral [1-11][3-7] https://www.mofo.com/artificial-intelligence/brazil https://legismap.com.br/conteudos/artigos-e-noticias/anpd-releases-english-version-of-technology-radar

Penalty ceiling: LGPD/consumer law

Key dates: Pending

India — Advisories + existing law

Risk model: No AI-specific tiers

Developer/provider burden: Low

Deployer/user burden: Low–moderate

Enforcement: MeitY + sectoral https://www.meity.gov.in/static/uploads/2024/02/9f6e99572739a3024c9cdaec53a0a0ef.pdf [1-12][1-13] https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf

Enforcement: MeitY + sectoral [1-12][1-13]

Penalty ceiling: DPDP/IT Act

Key dates: Ongoing

UAE — Data/sector rules + free-zone regulation + charter; no federal AI law [6-17][6-18]

UAE — Data/sector rules + free-zone regulation + charter; no federal AI law https://www.twobirds.com/en/capabilities/artificial-intelligence/ai-legal-services/ai-regulatory-horizon-tracker/uae [6-17][6-18] https://uaelegislation.gov.ae/en/policy/details/uae-s-international-stance-on-artificial-intelligence-policy

Risk model: DIFC risk-based (limited scope)

Developer/provider burden: Low–moderate

Deployer/user burden: Low–moderate

Enforcement: Data commissioners + free-zone authorities [1-15][3-8]

Penalty ceiling: Data law penalties

Key dates: DIFC Reg 10: Sep 2023 [1-15]

Saudi Arabia — Data law + structured ethics/guidance

Risk model: Risk categorization in guidance [3-10][3-11]

Developer/provider burden: Low

Deployer/user burden: Low

Enforcement: SDAIA + PDPL authority [1-16][1-42]

Penalty ceiling: PDPL penalties

Key dates: Ongoing

Qatar — Strategy + data law

Risk model: No binding AI tiers

Deployer/user burden: Low

Developer/provider burden: Low

Enforcement: Data protection authority [1-44][1-45]

Penalty ceiling: Data law penalties

Key dates: Ongoing

Council of Europe Convention — Binding international treaty (framework)

Risk model: Risk-based, lifecycle [5-1][5-3]

Developer/provider burden: Indirect (through state implementation)

Deployer/user burden: Indirect (through state implementation)

Enforcement: State parties' domestic measures [5-3]

Penalty ceiling: Determined by domestic law

Key dates: Opened for signature Sep 2024 [5-2]

G7 HAIP — Voluntary code + reporting framework

Risk model: Lifecycle-based [5-5]

Risk model: Lifecycle-based https://g7g20-documents.org/database/document/2023-g7-japan-leaders-leaders-annex-hiroshima-process-international-code-of-conduct-for-organizations-developing-advanced-ai-systems [5-5] Developer/provider burden: Moderate (governance expectations) [5-5][5-8] https://g7g20-documents.org/database/document/2023-g7-japan-leaders-leaders-annex-hiroshima-process-international-code-of-conduct-for-organizations-developing-advanced-ai-systems https://oecd.ai/en/transparency/overview

Developer/provider burden: Moderate (governance expectations) [5-5][5-8]

Deployer/user burden: Moderate (now open to deployers) [5-8]

Enforcement: Voluntary / OECD publication [5-8]

Penalty ceiling: None

Key dates: Code: Dec 2023; Reporting: Feb 2025 https://www.soumu.go.jp/hiroshimaaiprocess/en/index.html [5-4][5-7] https://www.soumu.go.jp/hiroshimaaiprocess/en/report.html

Key dates: Code: Dec 2023; Reporting: Feb 2025 [5-4][5-7]

Global non-binding layer — ISO/IEC 42001, NIST AI 600-1, OECD incident framework

Risk model: Process/lifecycle-based

Developer/provider burden: Moderate (governance expectations)

Deployer/user burden: Moderate (governance expectations)

Enforcement: Voluntary / procurement-driven [3-1][3-2][3-4]

Penalty ceiling: None

Key dates: Active (2023–2026)

14. Operational Burden: Developers versus Deployers

The following section details the compliance burden ranking for both model developers/providers and deployers/users across jurisdictions. See Figure 4 above for a visual comparison.

14.1 Highest Burden for Model Developers/Providers

1. EU: GPAI providers face the AI Office's centralized enforcement, Scientific Panel scrutiny, the GPAI Code of Practice's two-track presumption structure [6-14], a mandatory training-data transparency template [2-9], and the emerging harmonised-standards pathway [3-5][3-6]. High-risk system providers face conformity assessments, technical documentation, post-market monitoring, and incident reporting [1-1]. The EU's burden on model developers is the highest globally. The implementation friction documented through missed guidance deadlines [6-15] and industry contestation [6-12][6-13] adds near-term uncertainty to the compliance experience without reducing the underlying legal obligations.

deadlines [6-15] https://iapp.org/news/a/european-commission-misses-deadline-for-ai-act-guidance-on-high-risk-systems and industry contestation [6-12][6-13] https://ccianet.org/news/2025/07/ai-act-eus-final-gpai-code-imposes-disproportionate-burden-improvements-required https://www.itic.org/news-events/news-releases/iti-reacts-to-publication-of-ai-act-gpai-code-of-practice adds near-term uncertainty

algorithm filing, labeling, and data/personal-information compliance https://www.chinalawtranslate.com/en/generative-ai-interim [1-4][1-5][1-6] https://www.chinalawtranslate.com/en/deep-synthesis https://digichina.stanford.edu/work/translation-internet-information-service-algorithmic-recommendation-management-provisions-effective-march-1-2022

2. China: Public-facing service providers face content-control, security assessment, algorithm filing, labeling, and data/personal-information compliance [1-4][1-5][1-6] [1-7]. The content-control dimension adds a compliance burden with no equivalent elsewhere.

3. United States (federal enforcement layer): The FTC's enforcement of AI capability claims and "AI-washing" creates a substantiation burden that directly affects model vendors and AI application developers [4-1][4-3][4-4].

affects model vendors and AI application developers https://www.ftc.gov/industry/technology/artificial-intelligence [4-1][4-3][4-4] https://www.ftc.gov/news-events/news/press-releases/2024/09/ftc-announces-crackdown-deceptive-ai-claims-schemes https://www.ftc.gov/news-events/news/press-releases/2025/02/ftc-finalizes-order-donotpay-prohibits-deceptive-ai-lawyer-claims-imposes-monetary-relief-requires .

4. Colorado (revised): Developers of covered ADMT must provide deployers with technical documentation on intended uses, training-data categories, known limitations, and instructions for appropriate use and human review, effective 1 January 2027 [6-1]. The original duty-of-care requirement has been removed [6-2] [6-3], reducing the developer burden from the original SB 24-205 level.

5. South Korea: AI development operators face transparency and safety/reliability obligations for generative and high-impact AI, with Enforcement Decree-specified methods and domestic-agent requirements for foreign operators [1-2][1-38][6-7] [6-8].

methods and domestic-agent requirements for foreign operators https://www.cooley.com/news/insight/2026/2026-01-27-south-koreas-ai-basic-act-overview-and-key-takeaways [1-2][1-38][6-7] https://www.kimchang.com/en/insights/detail.kc?sch_section=4&idx=33805 https://www.trade.gov/market-intelligence/south-korea-ai-basic-act [6-8] https://www.kimchang.com/en/insights/detail.kc?sch_section=4&idx=32909 .

14.2 Highest Burden for Deployers/Users/Integrators

1. EU: Deployers of high-risk systems face human-oversight, monitoring, logging, incident-reporting, and fundamental-rights impact assessment duties [1-1]. Enforcement flows through national market surveillance authorities [2-2].

2. California (CPPA): Businesses using ADMT for significant decisions face notice, opt-out, risk-assessment, and reporting obligations, phased from January 2026 through April 2028 [6-4][6-5][6-6]. The rules are narrower than an AI statute— applying only where technology replaces or substantially replaces human decision-making [6-6]—but they represent the most operationally significant U.S. deployer-facing AI-adjacent regime.

3. U.S. employment context (EEOC + state rules): Employers face Title VII disparate-impact liability [4-12], with vendor-management obligations to obtain adverse-impact testing evidence [4-12]. NYC's Local Law 144 requires annual bias audits, public posting, and applicant notice [1-25]. Illinois's AI Video Interview Act requires notification, explanation, consent, and data-handling controls [1-26].

4. Colorado (revised): Deployers retain consumer-notice, adverse-decision explanation, and human review-related rights obligations, but the original impactassessment and risk-management program requirements have been removed [6-1] [6-2][6-3]. Colorado's deployer burden is now substantially lighter than the EU's or California's CPPA regime.

5. U.S. privacy-law states: Connecticut, Virginia, Alabama, and others impose profiling opt-outs, impact assessments, and automated-decision-making rights [1- 28][1-30][1-3].

28][1-30][1-3] https://www.shb.com/intelligence/newsletters/pds/hansen-connecticut-privacy-law-2025 https://www.cliffordchance.com/insights/resources/blogs/talking-tech/en/articles/2021/03/virginia-s-consumer-data-privacy-act.html https://ai-law-center.orrick.com/us-ai-law-tracker-see-all-states .

6. UK: Deployers face existing-law compliance across data protection, consumer protection, equality, and sectoral supervision [1-9].

14.3 The Provider/Deployer Split: A Structural Feature

The EU and the United States have each institutionalized the distinction between developer/provider and deployer compliance, but through fundamentally different mechanisms:

In the EU, the split is built into the enforcement architecture itself. GPAI model providers are subject to the AI Office's centralized oversight and dedicated implementation tools [2-1][2-4][2-8][2-9]. Deployers are primarily subject to national market surveillance authorities [2-2].

[2-1][2-4][2-8][2-9] https://digital-strategy.ec.europa.eu/en/policies/ai-office https://digital-strategy.ec.europa.eu/en/policies/ai-scientific-panel https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai https://digital-strategy.ec.europa.eu/en/news/commission-presents-template-general-purpose-ai-model-providers-summarise-data-used-train-their . Deployers are primarily subject to national market surveillance

The FTC targets providers https://www.ftc.gov/industry/technology/artificial-intelligence [4-1][4-3][4-4] https://www.ftc.gov/news-events/news/press-releases/2024/09/ftc-announces-crackdown-deceptive-ai-claims-schemes https://www.ftc.gov/news-events/news/press-releases/2025/02/ftc-finalizes-order-donotpay-prohibits-deceptive-ai-lawyer-claims-imposes-monetary-relief-requires . Employment and privacy rules target deployers with indirect vendor pressure https://cppa.ca.gov/announcements/2025/20250923.html [6-4][4-11][4-12] https://www.eeoc.gov/sites/default/files/2024-04/20240429_What%20is%20the%20EEOCs%20role%20in%20AI.pdf https://data.aclum.org/storage/2025/01/EOCC_www_eeoc_gov_laws_guidance_select-issues-assessing-adverse-impact-software-algorithms-and-artificial.pdf . Colorado's revised SB26-189

In the United States, the split emerges from the fragmented enforcement landscape. The FTC targets providers [4-1][4-3][4-4]. Employment and privacy rules target deployers with indirect vendor pressure [6-4][4-11][4-12]. Colorado's revised SB26-189 retains the developer-to-deployer documentation transmission mechanism but has removed the deployer-side impact assessment and risk-management program [6-1][6- 2][6-3], making the U.S. developer/deployer split less symmetrical than the EU's.

2][6-3] https://www.hunton.com/privacy-and-cybersecurity-law-blog/colorado-ai-act-amended-and-effective-date-delayed https://www.hklaw.com/en/insights/publications/2026/05/colorado-governor-signs-sb-189 , making the U.S. developer/deployer split less symmetrical than the EU's.

At the transnational level, the HAIP Reporting Framework has expanded from its original developer focus to include deployers and providers across the AI value chain [5-8], reflecting recognition that governance transparency obligations must span the entire supply chain.

Organizations that are both providers and deployers face dual compliance tracks in both the EU and the U.S. The key difference is that the EU provides a more predictable, institutionally defined framework (despite implementation friction [6-12][6-15]), while the U.S. requires navigating multiple uncoordinated enforcement channels.

institutionally defined framework (despite implementation friction https://ccianet.org/news/2025/07/ai-act-eus-final-gpai-code-imposes-disproportionate-burden-improvements-required [6-12][6-15] https://iapp.org/news/a/european-commission-misses-deadline-for-ai-act-guidance-on-high-risk-systems ), while

14.4 The Role of Voluntary Governance Infrastructure in Burden Allocation

risk-management processes [3-1][3-4][3-7][3-9] https://www.iso.org/standard/42001 https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence https://legismap.com.br/conteudos/artigos-e-noticias/anpd-releases-english-version-of-technology-radar https://sdaia.gov.sa/en/SDAIA/about/Documents/ai-principles.pdf . ISO/IEC 42001 applies to both

Even where there is no binding omnibus AI law, organizations face strong expectations to maintain governance systems, inventories, incident workflows, documentation, and risk-management processes [3-1][3-4][3-7][3-9]. ISO/IEC 42001 applies to both providers and users [3-1]. The NIST Generative AI Profile recommends lifecycle controls for both model developers and downstream users [3-4]. The OECD incident framework captures both developer-side and deployer-side failures [3-2]. The HAIP Reporting Framework is open to developers, deployers, and providers [5-8]. These instruments can influence procurement requirements, regulator dialogue, assurance programs, and readiness for future binding rules [3-1][3-5][3-8][5-7].

readiness for future binding rules [3-1][3-5][3-8][5-7] https://www.iso.org/standard/42001 https://digital-strategy.ec.europa.eu/en/policies/ai-act-standardisation https://uaelegislation.gov.ae/en/policy/details/the-uae-charter-for-the-development-and-use-of-artificial-intelligence https://www.soumu.go.jp/hiroshimaaiprocess/en/report.html .

15. Binding-Law versus Guidance Snapshot

16. Trajectory and Emerging Developments

August 2026 marks the full operationalization of the EU AI Act's Annex III high-risk obligations under the original statutory timeline—the single most consequential compliance milestone globally [1-1]. The provisional "Digital Omnibus" agreement (7 May 2026, pending adoption) would defer stand-alone Annex III high-risk obligations to 2 December 2027 and the transition for high-risk AI systems embedded into regulated products to 2 August 2028 [2-6]. The harmonisedstandards pathway through CEN-CENELEC JTC 21 [3-6] will add a further compliance dimension as standards are published. The GPAI Code of Practice's two-track presumption structure [6-14] will become increasingly important as providers decide whether to sign or pursue alternative compliance pathways.

1 January 2027 is the effective date for Colorado's revised SB26-189 developer obligations [6-1], creating the first U.S. state regime with a mandatory developerto-deployer documentation transfer for ADMT used in consequential decisions— though without the original law's broader risk-management and impactassessment architecture [6-2][6-3].

assessment architecture [6-2][6-3] https://www.hunton.com/privacy-and-cybersecurity-law-blog/colorado-ai-act-amended-and-effective-date-delayed https://www.hklaw.com/en/insights/publications/2026/05/colorado-governor-signs-sb-189 .

California's CPPA ADMT regulations require risk-assessment compliance beginning January 1, 2026; ADMT-specific compliance beginning January 1, 2027; and risk-assessment information submission to the CPPA by April 1, 2028 [6-4][6- 5][6-6].

and risk-assessment information submission to the CPPA by April 1, 2028 [6-4][6- https://cppa.ca.gov/announcements/2025/20250923.html https://www.hunton.com/privacy-and-cybersecurity-law-blog/newly-approved-ccpa-regulations-have-staggered-deadlines-for-compliance

FTC enforcement against AI-related deceptive claims will continue to create compliance pressure on providers [4-3][4-4].

compliance pressure on providers [4-3][4-4] https://www.ftc.gov/news-events/news/press-releases/2024/09/ftc-announces-crackdown-deceptive-ai-claims-schemes https://www.ftc.gov/news-events/news/press-releases/2025/02/ftc-finalizes-order-donotpay-prohibits-deceptive-ai-lawyer-claims-imposes-monetary-relief-requires .

near term [1-17][1-18] https://www.ncsl.org/technology-and-communication/artificial-intelligence-2025-legislation https://www.multistate.ai/artificial-intelligence-ai-legislation . Colorado's experience with SB26-189 [6-1][6-2][6-3] https://leg.colorado.gov/bills/sb26-189 https://www.hunton.com/privacy-and-cybersecurity-law-blog/colorado-ai-act-amended-and-effective-date-delayed https://www.hklaw.com/en/insights/publications/2026/05/colorado-governor-signs-sb-189

The volume of U.S. state AI bills—1,561 introduced across 45 states by March 2026—indicates continued fragmentation and likely additional enacted laws in the near term [1-17][1-18]. Colorado's experience with SB26-189 [6-1][6-2][6-3] demonstrates that even enacted AI laws can be substantially revised before their original effective dates, creating compliance-planning uncertainty for organizations preparing for state-level obligations.

South Korea's Enforcement Decree is already in effect [6-7], with provisions on transparency methods, high-impact AI criteria, and domestic-agent requirements [6-8] creating concrete operational obligations for foreign providers.

Brazil's PL 2338/2023 has passed the Senate and is in the Chamber of Deputies [6-10][6-11], making enactment more likely than at any previous point.

[6-10][6-11] https://www.demarest.com.br/en/inteligencia-artificial-reacende-debates-na-camara-dos-deputados https://www.sidi.org.br/en/blog/the-impacts-of-regulating-artificial-intelligence-in-brazil , making enactment more likely than at any previous point.

The UK Parliament is actively debating cross-sector AI legislation [6-9], and UK signature and ratification of the Council of Europe Convention [5-1] could catalyze future binding legislation.

The Council of Europe Convention will gain additional signatories and ratifications, creating treaty-level obligations for domestic AI governance measures across its States Parties [5-1][5-2][5-3].

measures across its States Parties [5-1][5-2][5-3] https://www.coe.int/en/web/artificial-intelligence/the-framework-convention-on-artificial-intelligence https://www.coe.int/en/web/Conventions/full-list?module=signatures-by-treaty&treatynum=225 https://eucrim.eu/news/council-of-europe-convention-on-artificial-intelligence .

The HAIP Reporting Framework will likely expand beyond its initial 25 reports [5- 8], with OECD continuing to publish analytical insights [5-9][5-10].

UNESCO RAM assessments will continue in additional countries https://www.undp.org/sites/g/files/zskgke326/files/2024-12/undp-unesco-offer-web-7-aug-2024.pdf [5-11][5-13][5-14] http://mpaai.gov.tt/news/unesco-ai-readiness-assessment-methodology-ram-consultation-sessions https://www.unesco.org/en/articles/lao-pdr-unveil-unesco-ai-ethics-readiness-assessment-report-national-workshop ,

UNESCO RAM assessments will continue in additional countries [5-11][5-13][5-14], influencing how governments in the developing world diagnose AI governance gaps.

17. Key Uncertainties and Alternative Scenarios

17.1 EU Implementation Intensity

Central scenario: The EU's proceduralized enforcement machinery will produce active, technically informed enforcement by 2027–2028, with the harmonised-standards pathway adding presumption-of-conformity mechanisms. The GPAI Code of Practice's two-track structure [6-14] will incentivize most major GPAI providers to sign, creating a de facto compliance standard.

[6-15] https://iapp.org/news/a/european-commission-misses-deadline-for-ai-act-guidance-on-high-risk-systems , and industry resistance to the GPAI Code's burden [6-12][6-13] https://ccianet.org/news/2025/07/ai-act-eus-final-gpai-code-imposes-disproportionate-burden-improvements-required https://www.itic.org/news-events/news-releases/iti-reacts-to-publication-of-ai-act-gpai-code-of-practice signal broader

Alternative scenario: Member State capacity constraints, political pressure, the targeted extension for embedded-product AI systems [2-6], missed guidance deadlines [6-15], and industry resistance to the GPAI Code's burden [6-12][6-13] signal broader delayed or softened enforcement, with the implementation architecture producing more process than substance.

Assessment: The central scenario is more likely because: (a) the AI Office, Scientific Panel, and Advisory Forum are already operational [2-1][2-3][2-4]; (b) the GPAI Code of Practice and training-data template have been published [2-8][2-9]; (c) over 100 companies have signed the AI Pact [2-7]; (d) the omnibus extension is narrowly targeted [2-6]; and (e) CEN-CENELEC JTC 21 work is actively underway [3-6]. The implementation friction is real but reflects the normal challenges of operationalizing a complex new regulatory system, not a fundamental failure of the enforcement model. The industry contestation [6-12][6-13] is itself evidence that the regime is being taken seriously by affected organizations. The alternative scenario would require a broader political decision to deprioritize enforcement, which is inconsistent with the institutional investments already made.

17.2 U.S. Federal Preemption

Central scenario: Continued state-level fragmentation with no federal AI law in the near term.

Alternative scenario: Congress enacts a federal AI statute that preempts or harmonizes state laws.

[4-2][6-4] https://www.eeoc.gov/newsroom/eeoc-launches-initiative-artificial-intelligence-and-algorithmic-fairness https://cppa.ca.gov/announcements/2025/20250923.html ; and (d) Colorado's experience with SB26-189 [6-1][6-2][6-3] https://leg.colorado.gov/bills/sb26-189 https://www.hunton.com/privacy-and-cybersecurity-law-blog/colorado-ai-act-amended-and-effective-date-delayed https://www.hklaw.com/en/insights/publications/2026/05/colorado-governor-signs-sb-189 shows that

Assessment: The central scenario is more likely because: (a) no federal bill has advanced to enactment; (b) the sheer volume of state activity [1-17] indicates states are not waiting; (c) the FTC, EEOC, and CPPA are actively creating de facto obligations [4-1] [4-2][6-4]; and (d) Colorado's experience with SB26-189 [6-1][6-2][6-3] shows that even states with enacted laws are still iterating on their frameworks, suggesting the policy landscape is too fluid for federal consensus. However, a major AI incident or election-cycle pressure could shift the calculus rapidly.

17.3 Colorado's Revised Regime as a Model

Central scenario: Colorado's SB26-189 represents a durable political equilibrium in which the developer-to-deployer documentation transfer and consumer-facing transparency are preserved while the broader risk-management and impactassessment architecture is abandoned. Other states considering comprehensive AI laws will follow this narrower model rather than the original SB 24-205 approach.

Alternative scenario: Colorado's revision was a temporary political concession, and the state or other states will re-expand deployer obligations toward the original SB 24-205 model once the documentation-transfer mechanism is established and operational.

assessments, risk-management programs) https://www.hunton.com/privacy-and-cybersecurity-law-blog/colorado-ai-act-amended-and-effective-date-delayed [6-2][6-3] https://www.hklaw.com/en/insights/publications/2026/05/colorado-governor-signs-sb-189 ; (b) Texas's TRAIGA also adopted

Assessment: The central scenario is more likely because: (a) the revision was a deliberate legislative choice to remove specific obligations (duty of care, impact assessments, risk-management programs) [6-2][6-3]; (b) Texas's TRAIGA also adopted a narrower approach than earlier drafts [1-23][1-24]; (c) the pattern across multiple states suggests a political preference for disclosure-based rather than prescriptivemanagement-based AI regulation; and (d) the FTC and CPPA are already filling some of the deployer-side gap through enforcement and rulemaking [4-3][6-4]. The alternative scenario would require a significant shift in political dynamics or a high-profile AI harm that catalyzes demand for stronger deployer obligations.

the deployer-side gap through enforcement and rulemaking https://www.ftc.gov/news-events/news/press-releases/2024/09/ftc-announces-crackdown-deceptive-ai-claims-schemes [4-3][6-4] https://cppa.ca.gov/announcements/2025/20250923.html . The alternative

Central scenario: PL 2338/2023 is enacted by the Chamber of Deputies in late 2026 or 2027, creating a comprehensive risk-based AI statute. The bill's passage through the Senate [6-10][6-11] and the ANPD's active technical work on generative AI [3-7] indicate sufficient institutional momentum.

Senate [6-10][6-11] https://www.demarest.com.br/en/inteligencia-artificial-reacende-debates-na-camara-dos-deputados https://www.sidi.org.br/en/blog/the-impacts-of-regulating-artificial-intelligence-in-brazil and the ANPD's active technical work on generative AI https://legismap.com.br/conteudos/artigos-e-noticias/anpd-releases-english-version-of-technology-radar [3-7]

Alternative scenario: The bill stalls in the Chamber, and Brazil continues to rely on LGPD and consumer-law enforcement for AI governance.

Senate [6-10][6-11] https://www.demarest.com.br/en/inteligencia-artificial-reacende-debates-na-camara-dos-deputados https://www.sidi.org.br/en/blog/the-impacts-of-regulating-artificial-intelligence-in-brazil ; (b) the ANPD is building enforcement capacity under existing law

Assessment: The central scenario is more likely because: (a) the bill has cleared the Senate [6-10][6-11]; (b) the ANPD is building enforcement capacity under existing law [3-7], creating institutional readiness for a new statute; (c) Brazil's civil-law tradition and consumer-protection culture favor comprehensive legislative frameworks; and (d) international developments (the EU AI Act, the Council of Europe Convention, UNESCO RAM assessments in the region [5-12]) create external pressure for legislative action. The alternative scenario would require sustained political opposition or a change in government priorities, which is possible but less likely given the bill's advanced procedural status.

17.5 UK Binding AI Legislation

Central scenario: The UK maintains its regulator-led approach through 2026–2027, with cross-sector AI legislation remaining under parliamentary debate [6-9] but not enacted during this period.

Alternative scenario: The government introduces binding AI legislation sooner than expected, potentially catalyzed by the Council of Europe Convention ratification process [5-1][5-3] or by competitive pressure from the EU's operational AI Act.

Assessment: The central scenario is more likely because: (a) the AI Opportunities Action Plan emphasizes growth [1-8][1-34]; (b) no specific legislative timeline has been announced; and (c) the UK's political preference for sector-led regulation has been consistent. However, the active parliamentary debate [6-9] indicates the issue is closer to legislative action than at any previous point, and the Convention's ratification requirement for domestic measures [5-3] could accelerate the timeline.

17.6 Convergence Through Governance Infrastructure

Central scenario: The non-binding governance infrastructure layer and the transnational superstructure will become increasingly influential, creating practical convergence that partially offsets legal fragmentation.

Alternative scenario: These layers remain marginal, with compliance driven entirely by jurisdiction-specific requirements.

Assessment: The central scenario is more likely because: (a) ISO/IEC 42001 is published and globally applicable [3-1]; (b) NIST AI 600-1 fills the federal U.S. gap [3-4]; (c) the OECD incident framework is backed by an Expert Group [3-2][3-3]; (d) EU harmonised standards will create presumption-of-conformity pathways [3-5][3-6]; (e) the HAIP Reporting Framework is producing comparable disclosures across organizations and countries [5-8][5-9][5-10]; (f) the Council of Europe Convention will require signatory states to adopt domestic measures consistent with its standards [5-3]; and (g) recurring themes across all these instruments indicate genuine convergence in expected organizational controls [3-1][3-2][3-4][3-5][3-9][5-5][5-6].

organizations and countries https://oecd.ai/en/transparency/overview [5-8][5-9][5-10] https://oecd.ai/en/ai-publications/how-are-ai-developers-managing-risks-insights-from-responses-to-the-reporting-framework-of-the-hiroshima-ai-process-code-of-conduct https://www.unesco.org/en/artificial-intelligence/recommendation-ethics ; (f) the Council of Europe Convention will

expected organizational controls https://www.iso.org/standard/42001 [3-1][3-2][3-4][3-5][3-9][5-5][5-6] https://www.oecd.org/en/publications/towards-a-common-reporting-framework-for-ai-incidents_f326d4ac-en.html https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence https://digital-strategy.ec.europa.eu/en/policies/ai-act-standardisation https://sdaia.gov.sa/en/SDAIA/about/Documents/ai-principles.pdf https://g7g20-documents.org/database/document/2023-g7-japan-leaders-leaders-annex-hiroshima-process-international-code-of-conduct-for-organizations-developing-advanced-ai-systems https://www.oecd.org/content/dam/oecd/en/publications/reports/2025/09/how-are-ai-developers-managing-risks_fbaeb3ad/658c2ad6-en.pdf .

18. Strategic Implications for Espadon

1. EU compliance is the highest-priority, highest-burden obligation and is becoming more operationally demanding through implementation tools rather than solely through the statute itself [2-1][2-8][2-9][3-5][3-6]. The GPAI Code of Practice's two-track presumption structure [6-14] makes a sign-or-justify decision necessary for GPAI providers. The implementation friction [6-12][6-15] creates near-term uncertainty but does not reduce underlying legal obligations.

solely through the statute itself [2-1][2-8][2-9][3-5][3-6] https://digital-strategy.ec.europa.eu/en/policies/ai-office https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai https://digital-strategy.ec.europa.eu/en/news/commission-presents-template-general-purpose-ai-model-providers-summarise-data-used-train-their https://digital-strategy.ec.europa.eu/en/policies/ai-act-standardisation https://jtc21.eu/ . The GPAI Code of necessary for GPAI providers. The implementation friction [6-12][6-15] https://ccianet.org/news/2025/07/ai-act-eus-final-gpai-code-imposes-disproportionate-burden-improvements-required https://iapp.org/news/a/european-commission-misses-deadline-for-ai-act-guidance-on-high-risk-systems creates

2. The distinction between GPAI/model provider and deployer compliance is now institutionally embedded in the EU, the U.S., and the transnational HAIP framework [2-1][2-2][4-1][6-4][4-12][5-8]. Organizations that are both providers and deployers face dual compliance tracks.

framework [2-1][2-2][4-1][6-4][4-12][5-8] https://digital-strategy.ec.europa.eu/en/policies/ai-office https://digital-strategy.ec.europa.eu/en/policies/market-surveillance-authorities-under-ai-act https://www.ftc.gov/industry/technology/artificial-intelligence https://cppa.ca.gov/announcements/2025/20250923.html https://data.aclum.org/storage/2025/01/EOCC_www_eeoc_gov_laws_guidance_select-issues-assessing-adverse-impact-software-algorithms-and-artificial.pdf https://oecd.ai/en/transparency/overview . Organizations that are both providers

3. U.S. compliance burden is substantially higher than enacted AI-specific statutes alone would suggest, but the specific allocation of burden has shifted. Colorado's revision [6-1][6-2][6-3] reduces the deployer-side burden, making California's CPPA ADMT regulations [6-4][6-5][6-6] the most operationally significant U.S. deployer-facing AI-adjacent regime. The FTC's AI-washing enforcement [4-3][4- 4] and EEOC's employment AI expectations [4-11][4-12] remain the primary federal provider- and deployer-side risks, respectively.

revision [6-1][6-2][6-3] https://leg.colorado.gov/bills/sb26-189 https://www.hunton.com/privacy-and-cybersecurity-law-blog/colorado-ai-act-amended-and-effective-date-delayed https://www.hklaw.com/en/insights/publications/2026/05/colorado-governor-signs-sb-189 reduces the deployer-side burden, making California's CPPA ADMT regulations [6-4][6-5][6-6] https://cppa.ca.gov/announcements/2025/20250923.html https://www.hunton.com/privacy-and-cybersecurity-law-blog/newly-approved-ccpa-regulations-have-staggered-deadlines-for-compliance https://www.coblentzlaw.com/news/california-finalizes-ccpa-regulations-on-automated-decision-making-technology-risk-assessments-and-cybersecurity-audits the most operationally significant U.S. deployer-facing AI-adjacent regime. The FTC's AI-washing enforcement [4-3][4- https://www.ftc.gov/news-events/news/press-releases/2024/09/ftc-announces-crackdown-deceptive-ai-claims-schemes https://www.ftc.gov/news-events/news/press-releases/2025/02/ftc-finalizes-order-donotpay-prohibits-deceptive-ai-lawyer-claims-imposes-monetary-relief-requires 4] https://www.ftc.gov/news-events/news/press-releases/2025/02/ftc-finalizes-order-donotpay-prohibits-deceptive-ai-lawyer-claims-imposes-monetary-relief-requires and EEOC's employment AI expectations https://www.eeoc.gov/sites/default/files/2024-04/20240429_What%20is%20the%20EEOCs%20role%20in%20AI.pdf [4-11][4-12] https://data.aclum.org/storage/2025/01/EOCC_www_eeoc_gov_laws_guidance_select-issues-assessing-adverse-impact-software-algorithms-and-artificial.pdf remain the primary federal

4. Colorado's revised regime still matters for developer-to-deployer

documentation infrastructure. The SB26-189 documentation transfer requirement [6-1] means providers must build and maintain the information packages that deployers need. This is a narrower but still meaningful compliance obligation that aligns with EU-style provider documentation logic.

5. China compliance is structurally different from all other jurisdictions due to the content-control dimension and requires a separate compliance architecture [1-4] [1-5].

[1-5] https://www.chinalawtranslate.com/en/deep-synthesis .

6. South Korea's regime is more concrete than commonly assumed. The Enforcement Decree's provisions on transparency methods, high-impact AI criteria, and domestic-agent requirements [6-7][6-8] mean foreign providers must establish in-country compliance infrastructure.

7. Build a global governance backbone using ISO/IEC 42001 and NIST-aligned lifecycle controls. The convergence in governance expectations across jurisdictions, the transnational layer (HAIP, Council of Europe Convention), and the governance infrastructure layer (ISO, NIST, OECD) means that a well-designed internal AI management system can serve as a reusable compliance foundation [3- 1][3-4][5-5][5-8].

1][3-4][5-5][5-8] https://www.iso.org/standard/42001 https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence https://g7g20-documents.org/database/document/2023-g7-japan-leaders-leaders-annex-hiroshima-process-international-code-of-conduct-for-organizations-developing-advanced-ai-systems https://oecd.ai/en/transparency/overview .

8. Participate in the HAIP Reporting Framework. The framework produces governance disclosures that map onto compliance artifacts required under binding regimes [5-6][5-8][5-9], provides internal capacity-building benefits [5-7], and generates public evidence of governance maturity.

regimes https://www.oecd.org/content/dam/oecd/en/publications/reports/2025/09/how-are-ai-developers-managing-risks_fbaeb3ad/658c2ad6-en.pdf [5-6][5-8][5-9] https://oecd.ai/en/transparency/overview https://oecd.ai/en/ai-publications/how-are-ai-developers-managing-risks-insights-from-responses-to-the-reporting-framework-of-the-hiroshima-ai-process-code-of-conduct , provides internal capacity-building benefits [5-7] https://www.soumu.go.jp/hiroshimaaiprocess/en/report.html , and

9. Invest in vendor-documentation infrastructure. Both the EU and Colorado's revised regime require providers to furnish deployers with detailed documentation packages [1-1][6-1], and the EEOC pushes deployers to demand testing evidence from vendors [4-12].

from vendors [4-12] https://data.aclum.org/storage/2025/01/EOCC_www_eeoc_gov_laws_guidance_select-issues-assessing-adverse-impact-software-algorithms-and-artificial.pdf .

10. Monitor the EU harmonised-standards pathway. CEN-CENELEC JTC 21 standards [3-6] will become the most practical route to demonstrating conformity with EU high-risk system requirements [3-5].

11. Prepare for California's staggered CPPA obligations. Risk assessments from January 2026; ADMT-specific compliance from January 2027; risk-assessment information submission by April 2028 [6-4][6-5][6-6].

information submission by April 2028 https://cppa.ca.gov/announcements/2025/20250923.html [6-4][6-5][6-6] https://www.hunton.com/privacy-and-cybersecurity-law-blog/newly-approved-ccpa-regulations-have-staggered-deadlines-for-compliance https://www.coblentzlaw.com/news/california-finalizes-ccpa-regulations-on-automated-decision-making-technology-risk-assessments-and-cybersecurity-audits .

Senate [6-10][6-11] https://www.demarest.com.br/en/inteligencia-artificial-reacende-debates-na-camara-dos-deputados https://www.sidi.org.br/en/blog/the-impacts-of-regulating-artificial-intelligence-in-brazil makes enactment more likely, and the ANPD's Technology

12. Track Brazil's Chamber of Deputies proceedings. The bill's passage through the Senate [6-10][6-11] makes enactment more likely, and the ANPD's Technology Radar work [3-7] is creating regulatory expectations under existing law.

13. Monitor the UK's parliamentary debate on cross-sector AI legislation [6-9] and the Council of Europe Convention's ratification progress [5-1][5-2].

14. Soft-law jurisdictions (Japan, GCC) present lower immediate compliance burdens but should be monitored for movement toward binding regulation through the Council of Europe Convention [5-1] and UNESCO RAM processes [5-12][5-13].

References

[1-1] EU Artificial Intelligence Act Explorer / Regulation (EU) 2024/1689 materials (2024) https://artificialintelligenceact.eu/chapter/5 [1-2] South Korea's AI Basic Act: Overview and Key Takeaways (2026) https://www.cooley.com/news/insight/2026/2026-01-27-south-koreas-ai-basicact-overview-and-key-takeaways [1-3] U.S. State AI Law Tracker – All States (2026) https://ai-lawcenter.orrick.com/us-ai-law-tracker-see-all-states [1-4] Interim Measures for the Management of Generative Artificial Intelligence Services (2023) https://www.chinalawtranslate.com/en/generative-ai-interim [1-5] Provisions on the Administration of Deep Synthesis Internet Information Services (2022) https://www.chinalawtranslate.com/en/deep-synthesis [1-6] Translation: Internet Information Service Algorithmic Recommendation Management Provisions (2022) https://digichina.stanford.edu/work/translationinternet-information-service-algorithmic-recommendation-managementprovisions-effective-march-1-2022 [1-7] Measures for Labeling of AI-Generated Synthetic Content (2025) https://www.chinalawtranslate.com/en/ai-labeling [1-8] AI Opportunities Action Plan (2025) https://www.gov.uk/government/publications/ai-opportunities-action-plan/aiopportunities-action-plan [1-9] Guidance on AI and data protection | ICO (N/A) https://ico.org.uk/fororganisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidanceon-ai-and-data-protection [1-10] Outline of "AI Guidelines for Business Ver1.1" (2024) https://www.meti.go.jp/shingikai/mono_info_service/ai_shakai_ jisso/pdf/20240419 _15.pdf [1-11] AI Library Brazil (N/A) https://www.mofo.com/artificial-intelligence/brazil https://www.meity.gov.in/static/uploads/2024/02/9f6e99572739a3024c9cdaec53 a0a0ef.pdf

[1-13] The Digital Personal Data Protection Act, 2023 (official PDF) (2023) https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c4 2aa5.pdf

[1-14] GCC Navigating AI Regulations - the Current Landscape (2025) https://www.twobirds.com/en/insights/2025/united-arab-emirates/gcc-navigatingai-regulations---the-current-landscape

[1-15] DIFC Regulation 10 (2023) https://www.difc.com/business/registrars-andcommissioners/commissioner-of-data-protection/regulation-10

[1-16] Generative Artificial Intelligence Guidelines For Government (2024) https://sdaia.gov.sa/en/SDAIA/about/Files/GenAIGuidelinesForGovernmentENCom pressed.pdf

[1-17] Summary of Artificial Intelligence 2025 Legislation (2025) https://www.ncsl.org/technology-and-communication/artificial-intelligence-2025- legislation

[1-18] Artificial Intelligence (AI) Legislation Tracker 2026: All 50 States (2026) https://www.multistate.ai/artificial-intelligence-ai-legislation

[1-19] Colorado AI Act (SB 205) text summary (2024) https://agora.eto.tech/instrument/1376

[1-20] Complying With Colorado's AI Law: Your SB24-205 Compliance Guide (2025) https://trustarc.com/resource/colorado-ai-law-sb24-205-complianceguide

[1-21] Utah scales back reach of generative AI consumer protection law (2025) https://www.davispolk.com/insights/client-update/utah-scales-back-reachgenerative-ai-consumer-protection-law

[1-22] Utah Becomes First State To Enact AI-Centric Consumer Protection Law (2024) https://www.skadden.com/insights/publications/2024/04/utah-becomesfirst-state

[1-23] Texas Enacts New AI Law (2025) https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-andcybersecurity-law/20250721-texas-enacts-new-ai-law

[1-24] Texas Responsible AI Governance Act Enacted (2025) https://www.wiley.law/alert-Texas-Responsible-AI-Governance-Act-Enacted

[1-25] NYC's Law Governing Automated Employment Decision Tools Takes Effect July 5 (2023) https://www.gtlaw.com/en/insights/2023/6/nycs-law-governingautomated-employment-decision-tools-takes-effect-july-5

[1-26] 820 ILCS 42/ - Artificial Intelligence Video Interview Act (2025) https://law.justia.com/codes/illinois/chapter-820/act-820-ilcs-42

[1-27] US State Privacy Legislation Tracker (2026) https://iapp.org/resources/article/us-state-privacy-legislation-tracker

[1-28] Connecticut Revamps Its Privacy Law (Again) (2025) https://www.shb.com/intelligence/newsletters/pds/hansen-connecticut-privacylaw-2025

[1-29] Connecticut Amends the Connecticut Data Privacy Act (2025) https://www.hunton.com/privacy-and-cybersecurity-law-blog/connecticutamends-the-connecticut-data-privacy-act

[1-30] Virginia's Consumer Data Privacy Act (2021) https://www.cliffordchance.com/insights/resources/blogs/talkingtech/en/articles/2021/03/virginia-s-consumer-data-privacy-act.html

[1-31] Virginia Contemplates Sweeping New Data Protection Law (2021) https://www.hinshawlaw.com/en/insights/privacy-cyber-and-ai-decodedalert/virginia-contemplates-sweeping-new-data-protection-law

[1-32] Enacted AI Legislation Chart (2026) https://fpf.org/wpcontent/uploads/2026/02/Enacted-AI-Legislation-Chart-.pdf

[1-33] California 2025 legislative wrap-up: More privacy and first-of-its kind AI laws adopted (2025) https://iapp.org/news/a/california-2025-legislative-wrap-upmore-privacy-and-first-of-its-kind-ai-laws-adopted

[1-34] AI Opportunities Action Plan Government Response (2025) https://assets.publishing.service.gov.uk/media/678639913a9388161c5d2376/ai_op portunities_action_plan_government_repsonse.pdf

[1-35] Japan AI Safety Institute (J-AISI) (2025) https://aisi.go.jp/assets/pdf/20250501_AISI_en.pdf

[1-36] General Understanding on AI and Copyright in Japan (2024) https://www.bunka.go.jp/english/policy/copyright/pdf/94055801_01.pdf

[1-37] South Korea Artificial Intelligence (AI) Basic Act (2025) https://www.trade.gov/market-intelligence/south-korea-artificial-intelligence-aibasic-act

[1-38] Recent Developments in AI Basic Act (2025) https://www.kimchang.com/en/insights/detail.kc?sch_section=4&idx=33805

[1-39] Artificial intelligence reignites debates in the Brazilian House of Representatives (2025) https://www.demarest.com.br/en/inteligencia-artificialreacende-debates-na-camara-dos-deputados

[1-40] Press Release Page | Press Information Bureau (2025) https://www.pib.gov.in/PressReleasePage.aspx?PRID=2154268

[1-41] FALQs: AI Regulations in the Gulf Cooperation Council Member States – Part Two (2024) https://blogs.loc.gov/law/2024/12/falqs-ai-regulations-in-the-gulfcooperation-council-member-states-part-two

[1-42] SDAIA Supports Saudi Arabia's Leadership in Shaping ... (N/A) https://my.gov.sa/en/news/640446

[1-44] National Artificial Intelligence Strategy for Qatar (2021) https://policy.mada.org.qa/wp-content/uploads/2022/06/national_ai_strategy_- _english_0.pdf

[1-45] Qatar | Jurisdictions (N/A) https://www.dataguidance.com/jurisdictions/qatar

[1-46] Japan's first AI legislation becomes law — AI Promotion Act, White & Case (2025) https://www.whitecase.com/insight-alert/japans-first-ai-legislationbecomes-law-focus-promoting-research-and-development-no

[1-47] New York RAISE Act — Governor Hochul signs frontier-model AI legislation, Dec. 19, 2025 (2025) https://www.governor.ny.gov/news/governor-hochul-signsnation-leading-legislation-require-ai-frameworks-ai-frontier-models

[1-48] California enacts SB 53 / Transparency in Frontier Artificial Intelligence Act, White & Case (2025) https://www.whitecase.com/insight-alert/california-enactslandmark-ai-transparency-law-transparency-frontier-artificial

[1-49] The TAKE IT DOWN Act (Public Law 119-12), Congressional Research Service LSB11314 (2025) https://www.congress.gov/crs-product/LSB11314

[2-1] European AI Office | Shaping Europe's digital future (2026) https://digitalstrategy.ec.europa.eu/en/policies/ai-office

[2-2] Market Surveillance Authorities under the AI Act (2026) https://digitalstrategy.ec.europa.eu/en/policies/market-surveillance-authorities-under-ai-act

[2-3] AI Act Advisory Forum | Shaping Europe's digital future (2026) https://digitalstrategy.ec.europa.eu/en/policies/ai-advisory-forum

[2-4] AI Act Scientific Panel | Shaping Europe's digital future (2026) https://digitalstrategy.ec.europa.eu/en/policies/ai-scientific-panel

[2-5] AI Pact | Shaping Europe's digital future (2026) https://digitalstrategy.ec.europa.eu/en/policies/ai-pact

[2-6] AI Act | Shaping Europe's digital future (2026) https://digitalstrategy.ec.europa.eu/en/policies/regulatory-framework-ai

[2-7] Over a hundred companies sign EU AI Pact pledges to drive trustworthy and safe AI development (2024) https://ec.europa.eu/commission/presscorner/detail/en/ip_24_4864

[2-8] The General-Purpose AI Code of Practice (2026) https://digitalstrategy.ec.europa.eu/en/policies/contents-code-gpai

[2-9] Commission presents template for General-Purpose AI model providers to summarise the data used to train their model (2025) https://digitalstrategy.ec.europa.eu/en/news/commission-presents-template-general-purposeai-model-providers-summarise-data-used-train-their

[3-1] ISO/IEC 42001:2023 - AI management systems (2023) https://www.iso.org/standard/42001

[3-2] Towards a common reporting framework for AI incidents (2025) https://www.oecd.org/en/publications/towards-a-common-reporting-frameworkfor-ai-incidents_f326d4ac-en.html

[3-3] AI incidents Overview - OECD.AI (2025) https://oecd.ai/en/site/incidents

[3-4] Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (2024) https://www.nist.gov/publications/artificial-intelligencerisk-management-framework-generative-artificial-intelligence

[3-5] Standardisation of the AI Act | Shaping Europe's digital future (2026) https://digital-strategy.ec.europa.eu/en/policies/ai-act-standardisation

[3-6] European AI Standardization | CEN-CENELEC JTC 21 (2026) https://jtc21.eu

[3-7] ANPD releases English version of Technology Radar (2024) https://legismap.com.br/conteudos/artigos-e-noticias/anpd-releases-englishversion-of-technology-radar

[3-8] The UAE Charter for the Development and Use of Artificial Intelligence (2024) https://uaelegislation.gov.ae/en/policy/details/the-uae-charter-for-thedevelopment-and-use-of-artificial-intelligence

[3-9] AI Ethics Principles (2023) https://sdaia.gov.sa/en/SDAIA/about/Documents/ai-principles.pdf

[3-10] Saudi Arabia: SDAIA publishes AI Ethics Principles version 2.0 (2023) https://www.dataguidance.com/news/saudi-arabia-sdaia-publishes-ai-ethicsprinciples

[3-11] Saudi Arabia - AI Ethics Principles (2023) https://regulations.ai/regulations/RAI-SA-NA-PCAESXX-2023

[4-1] Artificial Intelligence | Federal Trade Commission (N/A) https://www.ftc.gov/industry/technology/artificial-intelligence

[4-2] EEOC Launches Initiative on Artificial Intelligence and Algorithmic Fairness (2021) https://www.eeoc.gov/newsroom/eeoc-launches-initiative-artificialintelligence-and-algorithmic-fairness

[4-3] FTC Announces Crackdown on Deceptive AI Claims and Schemes (2024) https://www.ftc.gov/news-events/news/press-releases/2024/09/ftc-announcescrackdown-deceptive-ai-claims-schemes

[4-4] FTC Finalizes Order with DoNotPay That Prohibits Deceptive 'AI Lawyer' Claims, Imposes Monetary Relief, and Requires Notice to Past Subscribers (2025)

https://www.ftc.gov/news-events/news/press-releases/2025/02/ftc-finalizesorder-donotpay-prohibits-deceptive-ai-lawyer-claims-imposes-monetary-reliefrequires

[4-5] DoNotPay | Federal Trade Commission (N/A) https://www.ftc.gov/legallibrary/browse/cases-proceedings/donotpay

[4-6] California Finalizes Regulations to Strengthen Consumers' Privacy (2025) https://cppa.ca.gov/announcements/2025/20250923.html

[4-7] California Finalizes CCPA Regulations for Automated Decision-Making Technology, Risk Assessments and Cybersecurity Audits (2025) https://www.skadden.com/insights/publications/2025/10/california-finalizes-cpparegulations

[4-8] California Finalizes CCPA Regulations on Automated Decision-Making Technology, Risk Assessments, and Cybersecurity Audits (2025) https://www.coblentzlaw.com/news/california-finalizes-ccpa-regulations-onautomated-decision-making-technology-risk-assessments-and-cybersecurityaudits

[4-9] Senate Bill 24-205 - Colorado General Assembly (2024) https://leg.colorado.gov/bill_files/47770/download

[4-10] SB24-205 Consumer Protections for Artificial Intelligence | Colorado General Assembly (2024) https://leg.colorado.gov/bills/sb24-205

[4-11] What is the EEOC's role in AI? (2024) https://www.eeoc.gov/sites/default/files/2024- 04/20240429_What%20is%20the%20EEOCs%20role%20in%20AI.pdf

[4-12] Select Issues: Assessing Adverse Impact in Software, Algorithms, and Artificial Intelligence Used in Employment Selection Procedures Under Title VII of the Civil Rights Act of 1964 (2023) https://data.aclum.org/storage/2025/01/EOCC_www_eeoc_gov_laws_guidance_sel ect-issues-assessing-adverse-impact-software-algorithms-and-artificial.pdf

[5-1] The Framework Convention on Artificial Intelligence (2026) https://www.coe.int/en/web/artificial-intelligence/the-framework-convention-onartificial-intelligence

[5-2] Chart of signatures and ratifications of Treaty 225 (2026) https://www.coe.int/en/web/Conventions/full-list?module=signatures-bytreaty&treatynum=225

[5-3] Council of Europe Convention on Artificial Intelligence - eucrim (2024) https://eucrim.eu/news/council-of-europe-convention-on-artificial-intelligence

[5-4] Hiroshima AI Process (2026) https://www.soumu.go.jp/hiroshimaaiprocess/en/index.html

[5-5] Hiroshima Process International Code of Conduct for Organizations Developing Advanced AI Systems (2023) https://g7g20- documents.org/database/document/2023-g7-japan-leaders-leaders-annexhiroshima-process-international-code-of-conduct-for-organizations-developingadvanced-ai-systems

[5-6] How are AI developers managing risks? (OECD PDF) (2025) https://www.oecd.org/content/dam/oecd/en/publications/reports/2025/09/howare-ai-developers-managing-risks_fbaeb3ad/658c2ad6-en.pdf

[5-7] Reporting Framework | Hiroshima AI Process (2025) https://www.soumu.go.jp/hiroshimaaiprocess/en/report.html

[5-8] HAIP Reporting Framework - OECD.AI (2025) https://oecd.ai/en/transparency/overview

[5-9] How are AI developers managing risks? Insights from responses to the reporting framework of the Hiroshima AI Process Code of Conduct (2025) https://oecd.ai/en/ai-publications/how-are-ai-developers-managing-risksinsights-from-responses-to-the-reporting-framework-of-the-hiroshima-aiprocess-code-of-conduct

[5-10] Ethics of Artificial Intelligence - UNESCO (2026) https://www.unesco.org/en/artificial-intelligence/recommendation-ethics

[5-11] Artificial Intelligence Assessments (UNDP-UNESCO) (2024) https://www.undp.org/sites/g/files/zskgke326/files/2024-12/undp-unesco-offerweb-7-aug-2024.pdf

[5-12] UNESCO AI Readiness Assessment Report: Anchoring Ethics in AI Governance in the Philippines (2024) https://philippines.un.org/en/306159- unesco-ai-readiness-assessment-report-anchoring-ethics-ai-governancephilippines

[5-13] UNESCO AI Readiness Assessment Methodology (RAM) - Consultation Sessions (2025) http://mpaai.gov.tt/news/unesco-ai-readiness-assessmentmethodology-ram-consultation-sessions

[5-14] Lao PDR to unveil UNESCO AI Ethics Readiness Assessment report at national workshop (2026) https://www.unesco.org/en/articles/lao-pdr-unveilunesco-ai-ethics-readiness-assessment-report-national-workshop

[6-1] SB26-189 Automated Decision-Making Technology (2026) https://leg.colorado.gov/bills/sb26-189

[6-2] Colorado AI Act Amended and Effective Date Delayed (2026) https://www.hunton.com/privacy-and-cybersecurity-law-blog/colorado-ai-actamended-and-effective-date-delayed

[6-3] Colorado Governor Signs SB 189, Significantly Amending the State's AI Law (2026) https://www.hklaw.com/en/insights/publications/2026/05/colorado- governor-signs-sb-189

[6-4] California Finalizes Regulations to Strengthen Consumers' Privacy (2025) https://cppa.ca.gov/announcements/2025/20250923.html

[6-5] Newly Approved CCPA Regulations Have Staggered Deadlines for Compliance (2025) https://www.hunton.com/privacy-and-cybersecurity-lawblog/newly-approved-ccpa-regulations-have-staggered-deadlines-forcompliance

[6-6] California Finalizes CCPA Regulations on Automated Decision-Making Technology, Risk Assessments, and Cybersecurity Audits (2025) https://www.coblentzlaw.com/news/california-finalizes-ccpa-regulations-onautomated-decision-making-technology-risk-assessments-and-cybersecurityaudits

[6-7] South Korea AI Basic Act (2026) https://www.trade.gov/marketintelligence/south-korea-ai-basic-act

[6-8] The MSIT Releases Draft Enforcement Decree of the AI Basic Act (2025) https://www.kimchang.com/en/insights/detail.kc?sch_section=4&idx=32909

[6-9] AI regulation in the UK: Debate on the need for cross-sector legislation (2026) https://lordslibrary.parliament.uk/ai-regulation-in-the-uk-debate-on-theneed-for-cross-sector-legislation

[6-10] Artificial intelligence reignites debates in the Brazilian House of Representatives (2025) https://www.demarest.com.br/en/inteligencia-artificialreacende-debates-na-camara-dos-deputados

[6-11] PL 2338/2023: the impacts of regulating Artificial Intelligence in Brazil (2026) https://www.sidi.org.br/en/blog/the-impacts-of-regulating-artificialintelligence-in-brazil

[6-12] AI Act: EU's Final GPAI Code Imposes Disproportionate Burden, Improvements Required (2025) https://ccianet.org/news/2025/07/ai-act-eus-finalgpai-code-imposes-disproportionate-burden-improvements-required

[6-13] ITI Reacts to Publication of AI Act GPAI Code of Practice (2025) https://www.itic.org/news-events/news-releases/iti-reacts-to-publication-of-aiact-gpai-code-of-practice

[6-14] EU AI Act Update: What the New Code of Practice Means for Business (2025) https://ai-analytics.wharton.upenn.edu/wharton-accountable-ai-lab/eu-aiact-update-what-the-new-code-of-practice-means-for-business

[6-15] European Commission misses deadline for AI Act guidance on high-risk systems (2025) https://iapp.org/news/a/european-commission-misses-deadlinefor-ai-act-guidance-on-high-risk-systems

[6-16] European Commission hints at delaying the AI Act (2025) https://www.insideglobaltech.com/2025/06/12/european-commission-hints-at- delaying-the-ai-act

[6-17] AI Regulatory Horizon Tracker - United Arab Emirates (2026) https://www.twobirds.com/en/capabilities/artificial-intelligence/ai-legalservices/ai-regulatory-horizon-tracker/uae

[6-18] UAE's International Stance on Artificial Intelligence Policy (N/A) https://uaelegislation.gov.ae/en/policy/details/uae-s-international-stance-onartificial-intelligence-policy

Appendix

Research 1:

Findings on the current global AI regulation patchwork (as of June 2026)

1. Cross-jurisdiction picture

2. The EU and South Korea have enacted comprehensive AI-specific cross-sector laws. The EU AI Act entered into force on 1 August 2024 and applies in phases; South Korea’s AI Basic Act took effect on 22 January 2026.[1][2]

3. The United States does not have a single federal AI law. State regulation is a mix of enacted AI-specific laws, privacy laws with profiling/automated-decision rules, biometric laws, deepfake laws, employment rules, executive policies, and many pending bills. Orrick’s 50-state tracker shows state-by-state AI-related measures, including privacy-law automated decision-making rights in multiple states.[3]

4. China has a layered AI regime based on binding rules for algorithmic recommendation, deep synthesis, generative AI services, and AI-generated content labeling, overlaid by the Cybersecurity Law, Data Security Law, and Personal Information Protection Law.[4][5][6][7]

5. The UK continues to use a regulator-led, sectoral approach rather than a single AI law; the government’s 2025 AI Opportunities Action Plan response states that regulation, safety, and assurance are part of the UK’s AI growth agenda.[8][9]

6. Japan enacted the AI Promotion Act (Act on the Promotion of Research and Development and Utilization of AI-Related Technologies) on 28 May 2025, in full effect from September 2025, but it is a non-binding framework law with no AIspecific penalties, so Japan's framework remains primarily soft law in effect (White & Case, 2025). METI/MIC's AI Guidelines for Business were issued in April 2024 and updated to Version 1.1 on 28 March 2025.[10]

7. Brazil’s main cross-sector AI bill remains proposed rather than enacted; PL 2338/2023 is still under congressional consideration.[11]

8. India’s current regime remains a mix of advisories, IT intermediary/platform rules, cyber measures, and the Digital Personal Data Protection Act 2023 rather than a dedicated AI law.[12][13]

dedicated AI law. [12][13] https://www.meity.gov.in/static/uploads/2024/02/9f6e99572739a3024c9cdaec53a0a0ef.pdf https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf

9. In the GCC, no single harmonized AI law exists across the six states; the landscape is composed of national strategies, data protection/cyber laws, government guidance, and selective sectoral or free-zone rules. UAE and Saudi Arabia are the most institutionally developed within the region.[14][15][16]

most institutionally developed within the region. [14][15][16] https://www.twobirds.com/en/insights/2025/united-arab-emirates/gcc-navigating-ai-regulations---the-current-landscape https://www.difc.com/business/registrars-and-commissioners/commissioner-of-data-protection/regulation-10 https://sdaia.gov.sa/en/SDAIA/about/Files/GenAIGuidelinesForGovernmentENCompressed.pdf

10. European Union Legal status and scope

11. Regulation (EU) 2024/1689 is a binding cross-sector regulation. The Act covers providers, deployers, importers, distributors, product manufacturers, and providers of general-purpose AI models, including some non-EU actors where outputs are used in the EU market.[1]

used in the EU market. [1] https://artificialintelligenceact.eu/chapter/5

12. The Act classifies AI by risk and contains rules for prohibited AI practices, highrisk AI systems, transparency obligations for certain AI systems, and generalpurpose AI (GPAI) models.[1]

purpose AI (GPAI) models. https://artificialintelligenceact.eu/chapter/5 [1]

Risk model - The EU regime uses a risk-based structure: prohibited practices (Article 5), high-risk systems (Articles 6 and Annex III), transparency obligations for specified AI systems (Article 50), and GPAI/GPAI with systemic risk (Articles 51, 53, 55).[1]

Developer/provider obligations - Providers of high-risk AI systems have obligations covering risk management, data governance, technical documentation, logging, transparency and instructions for use, human oversight design, accuracy/robustness/cybersecurity, quality management systems, conformity assessment, registration where applicable, post-market monitoring, and serious incident reporting.[1] - Providers of GPAI models must prepare technical documentation, provide information and documentation to downstream providers, comply with EU copyright law obligations, and publish a sufficiently detailed summary about the content used for training.[1] - Providers of GPAI models with systemic risk face additional obligations including model evaluation, systemic-risk assessment and mitigation, adversarial testing where appropriate, incident reporting, and cybersecurity protections. [1]

[1] https://artificialintelligenceact.eu/chapter/5

Deployer obligations - Deployers of high-risk AI systems must use systems in accordance with provider instructions, ensure relevant human oversight, monitor operation, keep logs when under their control, and notify serious incidents. Certain public-sector or listed use cases require fundamental-rights impact assessments.[1]

Timeline - The AI Act entered into force on 1 August 2024.[1] - Prohibited AI practices and AI literacy obligations started applying on 2 February 2025.[1] - Governance rules and GPAI obligations started applying on 2 August 2025.[1] - Most stand-alone Annex III high-risk obligations apply from 2 August 2026, and embedded-product (Annex I) highrisk obligations from 2 August 2027, under the original statutory timeline.[1] The provisional "Digital Omnibus" agreement (7 May 2026, pending Official Journal adoption) would defer these to 2 December 2027 and 2 August 2028 respectively.[6]

Penalties - The Act provides fines up to EUR 35 million or 7% of worldwide annual turnover for certain prohibited-practice breaches; up to EUR 15 million or 3% for certain other violations; and up to EUR 7.5 million or 1.5% for supplying incorrect information, with lower caps possible for SMEs/startups in some cases.[1]

1. United States: 50-state patchwork National structure

2. NCSL’s 2025 legislation summary and Multistate’s tracker show the scale of the state patchwork: 1,561 AI-related bills had been introduced in 45 states by March 2026, and 99 AI-related bills were enacted in 2024.[17][18]

3. The U.S. state landscape is not a single regime. It includes: (a) AI-specific transparency laws, (b) high-risk/consequential decision laws, (c) employmentspecific AI rules, (d) biometric/privacy/deepfake laws, and (e) comprehensive privacy laws with profiling opt-outs and impact assessments.[3][17][18]

now begin 1 January 2027). https://agora.eto.tech/instrument/1376 [19][20] https://trustarc.com/resource/colorado-ai-law-sb24-205-compliance-guide - Colorado’s law requires developers to use

High-impact enacted state regimes - Colorado SB 24-205 created the first enacted broad state high-risk AI law. It regulates developers and deployers of high-risk AI systems used in consequential decisions and was signed on 17 May 2024, with obligations originally scheduled to apply from 1 February 2026 and later delayed to 30 June 2026, before SB26-189 repealed and reenacted the regime (developer obligations now begin 1 January 2027).[19][20] - Colorado’s law requires developers to use reasonable care to protect consumers from algorithmic discrimination, make specified documentation available, disclose known or reasonably foreseeable risks, and notify the attorney general under certain circumstances. Deployers must use reasonable care, implement risk management policies, conduct impact assessments, review for algorithmic discrimination, provide consumer notices where consequential decisions are made, and offer disclosures on request.[19][20] - Utah’s Artificial Intelligence Policy Act was enacted on 13 March 2024 and took effect 1 May 2024. It imposes disclosure obligations when consumers interact with generative AI in covered contexts and establishes the Office of Artificial Intelligence Policy and an AI Learning Laboratory

Program.[21][22] - Texas enacted the Texas Responsible Artificial Intelligence Governance Act on 22 June 2025. Public analyses describe it as imposing prohibitedpractice rules and public-sector notice duties, while removing many of the broader private-sector developer/deployer obligations from earlier drafts; it takes effect on 1 January 2026 and applies to developers and deployers through its prohibited-use and disclosure provisions.[23][24]

Local and sectoral examples - New York City Local Law 144 requires annual independent bias audits for automated employment decision tools used in hiring or promotion, public posting of audit summaries, and at least 10 business days’ advance notice to applicants/employees, including information about the tool and alternative assessment requests.[25] - Illinois’ Artificial Intelligence Video Interview Act requires employers using AI to analyze recorded applicant videos to notify applicants, explain how the AI works and what characteristics it evaluates, obtain consent, limit sharing, and comply with destruction/deletion-related rules.[26] - Illinois BIPA remains a major biometric enforcement law relevant to AI systems using faceprints/voiceprints or other biometric identifiers.[26]

biometric identifiers. https://law.justia.com/codes/illinois/chapter-820/act-820-ilcs-42 [26]

Privacy-law automated decision/profiling provisions - Many states use comprehensive privacy laws to regulate automated decision-making indirectly through profiling rights, opt-outs, and data-protection assessments. Orrick’s all-state tracker shows this across states, and IAPP tracks comprehensive state privacy laws separately.[3][27] - Connecticut’s privacy law requires opt-outs for profiling in decisions producing legal or similarly significant effects, and 2025 amendments added explicit impact assessment requirements for such profiling and additional AI/LLM training disclosures effective 2026.[28][29] - Virginia’s Consumer Data Protection Act gives consumers the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects and requires data processing assessments for specified risky processing.[30] [31] - Alabama’s enacted privacy law includes an opt-out right for solely automated significant decisions, effective 1 May 2027, according to Orrick’s state tracker.[3]

All 50 U.S. states: structured tracker snapshot - Alabama: enacted privacy law with automated-decision opt-out right effective 2027.[3] - Alaska: no major enacted crosssector AI law identified in the search set; patchwork consists mainly of general laws and pending activity.[3][17] - Arizona: no major enacted cross-sector AI law identified in the search set; pending/activity tracked in state trackers.[3][17] - Arkansas: enacted AIrelated transparency legislation appears in FPF’s enacted chart for 2025 generative AI transparency.[32] - California: high legislative activity; enacted 2024-2025 AI laws include generative AI transparency, training-data disclosures, election/deepfake measures, and health and chatbot provisions—plus the Transparency in Frontier

[32][33] https://fpf.org/wp-content/uploads/2026/02/Enacted-AI-Legislation-Chart-.pdf https://iapp.org/news/a/california-2025-legislative-wrap-up-more-privacy-and-first-of-its-kind-ai-laws-adopted - Colorado: enacted comprehensive high-risk AI law (SB 24-205). https://agora.eto.tech/instrument/1376 [19][20] https://trustarc.com/resource/colorado-ai-law-sb24-205-compliance-guide -

Artificial Intelligence Act (SB 53), signed 29 September 2025, which regulates frontiermodel developers; multiple additional proposals remain pending or changed over time. [32][33] - Colorado: enacted comprehensive high-risk AI law (SB 24-205).[19][20] - Connecticut: privacy/profiling regime with impact-assessment amendments.[28][29] - Delaware: AI innovation/task-force style activity appears in trackers.[17][32] - Florida: state AI activity tracked; no comprehensive enacted cross-sector AI law identified in the retrieved set.[3][17] - Georgia: state AI activity tracked; no comprehensive enacted cross-sector AI law identified in the retrieved set.[3][17] - Hawaii: state AI activity tracked; no comprehensive enacted cross-sector AI law identified in the retrieved set. [3][17] - Idaho: state AI activity tracked; no comprehensive enacted cross-sector AI law identified in the retrieved set.[3][17] - Illinois: AI Video Interview Act; BIPA; employment/health updates appear in trackers.[26][32] - Indiana: state AI activity tracked; no comprehensive enacted cross-sector AI law identified in the retrieved set. [3][17] - Iowa: state AI activity tracked; no comprehensive enacted cross-sector AI law identified in the retrieved set.[3][17] - Kansas: state AI activity tracked; no comprehensive enacted cross-sector AI law identified in the retrieved set.[3][17] - Kentucky: state AI activity tracked; no comprehensive enacted cross-sector AI law identified in the retrieved set.[3][17] - Louisiana: state AI activity tracked; no comprehensive enacted cross-sector AI law identified in the retrieved set.[3][17] - Maine: enacted 2025 chatbot law appears in FPF chart.[32] - Maryland: state AI activity tracked; no comprehensive enacted cross-sector AI law identified in the retrieved set. [3][17] - Massachusetts: active proposals referenced in analysis pieces; no enacted comprehensive AI law identified in retrieved set.[17][27] - Michigan: state AI activity tracked; no comprehensive enacted cross-sector AI law identified in the retrieved set. [3][17] - Minnesota: privacy/AI related activity appears in trackers.[32] - Mississippi: state AI activity tracked; no comprehensive enacted cross-sector AI law identified in the retrieved set.[3][17] - Missouri: state AI activity tracked; no comprehensive enacted cross-sector AI law identified in the retrieved set.[3][17] - Montana: state AI activity tracked; no comprehensive enacted cross-sector AI law identified in the retrieved set. [17][18] - Nebraska: state AI activity tracked; no comprehensive enacted cross-sector AI law identified in the retrieved set.[3][17] - Nevada: health-related AI law appears in FPF enacted chart for 2025.[32] - New Hampshire: enacted 2025 chatbot law appears in FPF chart.[32] - New Jersey: state AI activity tracked; no comprehensive enacted cross-sector AI law identified in the retrieved set.[3][17] - New Mexico: proposal activity referenced in analysis pieces; no enacted comprehensive AI law identified in retrieved set.[17][27] - New York: local employment AEDT rule in NYC (Local Law 144); the state RAISE Act was subsequently enacted on 19 December 2025 (Chapter 699), effective 1 January 2027, regulating frontier-model developers (Governor of New York, 2025).[25] [18] - North Carolina: state AI activity tracked; no comprehensive enacted cross-sector

AI law identified in the retrieved set.[3][17] - North Dakota: state AI activity tracked; no comprehensive enacted cross-sector AI law identified in the retrieved set.[3][17] - Ohio: state AI activity tracked; no comprehensive enacted cross-sector AI law identified in the retrieved set.[3][17] - Oklahoma: state AI activity tracked; no comprehensive enacted cross-sector AI law identified in the retrieved set.[3][17] - Oregon: state AI activity tracked; no comprehensive enacted cross-sector AI law identified in the retrieved set. [3][17] - Pennsylvania: state AI activity tracked; no comprehensive enacted crosssector AI law identified in the retrieved set.[3][17] - Rhode Island: state AI activity tracked; no comprehensive enacted cross-sector AI law identified in the retrieved set. [3][17] - South Carolina: state AI activity tracked; no comprehensive enacted crosssector AI law identified in the retrieved set.[3][17] - South Dakota: state AI activity tracked; no comprehensive enacted cross-sector AI law identified in the retrieved set. [3][17] - Tennessee: enacted 2024 IP/digital replica law appears in FPF chart.[32] - Texas: enacted TRAIGA 2025.[23][24] - Utah: enacted AI disclosure law 2024; updated in 2025.[21][32] - Vermont: state AI activity tracked; no comprehensive enacted crosssector AI law identified in the retrieved set.[3][17] - Virginia: privacy/profiling regime; 2024 AI-specific bills failed according to NCSL summary.[17][30][31] - Washington: state AI activity tracked; no comprehensive enacted cross-sector AI law identified in the retrieved set.[3][17] - West Virginia: state AI activity tracked; no comprehensive enacted cross-sector AI law identified in the retrieved set.[3][17] - Wisconsin: state AI activity tracked; no comprehensive enacted cross-sector AI law identified in the retrieved set. [3][17] - Wyoming: state AI activity tracked; no comprehensive enacted cross-sector AI law identified in the retrieved set.[3][17]

law identified in the retrieved set. https://ai-law-center.orrick.com/us-ai-law-tracker-see-all-states [3][17] https://www.ncsl.org/technology-and-communication/artificial-intelligence-2025-legislation

1. China Legal status and scope

2. China has binding AI-specific administrative measures for public-facing generative AI services, deep synthesis internet information services, algorithmic recommendation services, and AI-generated/synthetic content labeling.[4][5][6] [7]

3. The Interim Measures for the Management of Generative Artificial Intelligence Services apply to using generative AI to provide services to the public in mainland China for generating text, images, audio, video, or other content.[4]

Risk and regulatory model - China’s structure is not an EU-style single risk-tier law. It is activity- and content-based, with strong emphasis on public-facing services, content control, security assessment, algorithm filing, data/personal-information compliance, and state oversight.[4][5][6]

Developer/provider obligations - Generative AI service providers must uphold contentlaw requirements, adopt measures for data and model security, protect personal information, label or handle illegal content, and for some services complete security assessments and algorithm filing procedures.[4] - Deep synthesis rules prohibit producing or disseminating prohibited information, require identity/authenticity-related measures, and impose labeling obligations in specified contexts.[5] - Algorithm recommendation rules require algorithmic recommendation service providers to establish management systems, protect users, provide options to turn off recommendation services in some contexts, and undergo filing/security oversight where required.[6] - On 14 March 2025, CAC and three other agencies released final Measures for Labeling Artificial Intelligence-Generated and Synthetic Content and GB 45438-2025, imposing explicit and implicit labeling duties and traceability-related duties for providers.[7]

duties for providers. https://www.chinalawtranslate.com/en/ai-labeling [7]

Enforcement and penalties - The algorithm recommendation provisions state that certain violations may trigger warnings, criticism notices, orders to rectify, suspension of information updates, and fines of RMB 10,000 to RMB 100,000 where no other law provides otherwise; other violations are handled under other applicable laws and regulations.[6] - China’s AI rules are enforced by CAC and other agencies, with the Cybersecurity Law, Data Security Law, and PIPL available as overlays.[4][5][6]

1. United Kingdom Legal status and structure

2. The UK has not enacted a single comprehensive AI law equivalent to the EU AI Act. The current model relies on existing regulators and laws, with AI-specific guidance and public-policy programs.[8][9]

3. The ICO’s “Guidance on AI and data protection” remains a core regulatory document for privacy-law compliance in AI systems under UK GDPR/data protection law.[9]

Institutional and policy direction - The UK government published the AI Opportunities Action Plan on GOV.UK and issued a formal government response in January 2025.[8] [34] - The Action Plan states the UK should invest in compute, data infrastructure, talent, and regulation, and that regulation, safety, and assurance can support AI adoption and growth.[8][34]

Obligations by source of law - For model developers/providers and deployers, binding duties arise mainly through existing laws: UK GDPR/data protection, consumer protection, equality law, product-safety rules, online safety/content rules, procurement, and sectoral supervision.[9] - The ICO guidance addresses lawfulness, fairness, transparency, governance, accuracy, security, and individual rights for AI processing personal data.[9]

1. Japan Legal status

2. Japan now has AI-specific legislation—the AI Promotion Act (passed 28 May 2025, in full effect September 2025)—but it is a non-binding framework law with no penalties, so Japan's cross-sector framework remains soft law in effect rather than a prescriptive binding regime (White & Case, 2025). METI and MIC published the AI Guidelines for Business Version 1.0 in April 2024 and Version 1.1 on 28 March 2025.[10]

Scope and actor categories - The guidelines distinguish AI business actors, including developers, providers, and business users, and organize expected actions by role.[10]

Obligations and themes - The guidelines address governance, safety, transparency, security, privacy, human rights/fairness, and role-based responsibilities rather than statutory fines.[10] - Japan AI Safety Institute materials note the updated guideline version and describe the governance framework as part of Japan’s safety infrastructure.[35]

infrastructure. [35] https://aisi.go.jp/assets/pdf/20250501_AISI_en.pdf

Copyright/training-data overlay - Japan’s Agency for Cultural Affairs published “General Understanding on AI and Copyright in Japan,” clarifying copyright issues around AI training and outputs.[36]

training and outputs. [36] https://www.bunka.go.jp/english/policy/copyright/pdf/94055801_01.pdf

1. South Korea Legal status and timeline

2. South Korea adopted the Framework Act on Artificial Intelligence Development and Establishment of a Foundation for Trustworthiness in January 2025, with effect from 22 January 2026.[2][37]

Scope and reach - The Act applies to AI development business operators and AI utilization business operators and has extraterritorial application for certain businesses offering products or services in Korea.[2]

Risk model - The Act distinguishes “generative AI” and “high-impact AI.” High-impact AI is defined as AI significantly affecting human life, physical safety, or fundamental rights. [2]

Developer/provider obligations - Businesses providing generative AI or high-impact AI have transparency duties. Articles discussed in legal summaries describe requirements to notify users when operations use generative or high-impact AI and to label outputs produced by generative AI, including deepfakes.[2][38] - High-impact AI operators face obligations concerning safety and reliability.[38]

obligations concerning safety and reliability. [38] https://www.kimchang.com/en/insights/detail.kc?sch_section=4&idx=33805

Penalties - Public analyses describe lower financial penalties than the EU model; the U.S. Department of Commerce trade note identifies the Act as a comprehensive framework creating new compliance requirements.[2][37]

1. Brazil Legal status

2. Brazil’s principal AI framework is still proposed rather than enacted. PL 2338/2023 remains under legislative processing in Congress.[11]

Core bill structure in current summaries - Available summaries describe a risk-based bill establishing general standards for development, implementation, and responsible use of AI systems, with governance duties and impact assessments for high-risk systems.[11] [39]

Current binding overlays - Until any AI bill is enacted, Brazil’s binding controls relevant to AI come primarily from LGPD data protection law and sectoral/consumer frameworks. [11]

[11] https://www.mofo.com/artificial-intelligence/brazil

1. India Legal status and scope

2. India does not yet have a dedicated enacted cross-sector AI statute in the retrieved materials. The current framework is based on the Digital Personal Data Protection Act, the IT Act, the Intermediary Guidelines and Digital Media Ethics Code Rules 2021 (as amended), cyber advisories, and MeitY advisories.[12][13]

MeitY advisory and platform obligations - MeitY’s 2024 advisory instructed intermediaries and platforms to ensure that AI/LLM/generative AI software or algorithms do not permit users to host, display, upload, modify, publish, transmit, store, update, or share unlawful content under the IT Rules framework.[12]

Data protection overlay - The DPDP Act 2023 applies extraterritorially where processing outside India is connected with offering goods or services to individuals in India.[13]

Deepfakes and online harms - A 2025 government statement to Parliament identifies the IT Act 2000 and the IT Rules 2021 as the core legal framework used to address deepfakes and related cyber harms, including sections on identity theft, impersonation, privacy violations, obscene/sexually explicit content, blocking orders, and intermediary notice/removal powers.[40]

notice/removal powers. https://www.pib.gov.in/PressReleasePage.aspx?PRID=2154268 [40]

1. Gulf region (GCC) Regional overview

2. The GCC remains a patchwork of AI strategies, data protection laws, cybersecurity rules, sector guidance, and selective AI-specific governance measures. No GCCwide binding AI law was identified in the retrieved materials.[14][16][41]

wide binding AI law was identified in the retrieved materials. [14][16][41] https://www.twobirds.com/en/insights/2025/united-arab-emirates/gcc-navigating-ai-regulations---the-current-landscape https://sdaia.gov.sa/en/SDAIA/about/Files/GenAIGuidelinesForGovernmentENCompressed.pdf https://blogs.loc.gov/law/2024/12/falqs-ai-regulations-in-the-gulf-cooperation-council-member-states-part-two

United Arab Emirates - There is no dedicated federal AI law in force in the UAE in the retrieved materials; the applicable framework is built from personal-data and sector rules plus strategy/policy documents.[15] - The UAE’s Protection of Personal Data Law and Emirate/free-zone rules are the primary binding overlays for AI involving personal data.[14][15] - DIFC Regulation 10, enacted 1 September 2023, specifically regulates processing personal data through autonomous and semi-autonomous systems, including AI. DIFC states Regulation 10 is a risk- and outcomes-based framework and provides accreditation/certification architecture.[15] - Abu Dhabi created the Artificial Intelligence and Advanced Technology Council under Law No. 3 of 2024, according to GCC/UAE legal summaries.[14]

GCC/UAE legal summaries. [14] https://www.twobirds.com/en/insights/2025/united-arab-emirates/gcc-navigating-ai-regulations---the-current-landscape

Saudi Arabia - Saudi Arabia’s binding baseline is the Personal Data Protection Law and related data/cyber rules; current AI-specific materials identified in the search set are guidance and strategy rather than a general AI act.[16][42] - SDAIA’s Generative Artificial Intelligence Guidelines for Government require alignment with personal data protection, cybersecurity standards, data-classification rules, and AI Ethics Principles, and address legal/ethical compliance, privacy and security, and government-data use. [42] - Saudi government/public statements confirm SDAIA has issued AI ethics principles.[43]

Qatar - Qatar has a National Artificial Intelligence Strategy and a federal data protection law, Law No. 13 of 2016 Concerning Privacy and Protection of Personal Data.[44][45] - The national AI strategy includes an “AI Ethics and Governance” pillar and states that explainability guidelines are needed for different types of AI decisions.[44]

Bahrain - The retrieved sources characterize Bahrain as active on digital policy and data protection, but no enacted cross-sector AI law was identified in the retrieved official/near-official materials.[14][41]

official/near-official materials. https://www.twobirds.com/en/insights/2025/united-arab-emirates/gcc-navigating-ai-regulations---the-current-landscape [14][41] https://blogs.loc.gov/law/2024/12/falqs-ai-regulations-in-the-gulf-cooperation-council-member-states-part-two

Kuwait - The Law Library of Congress summary states Kuwait is in early stages of developing an AI regulatory framework aligned with Vision 2035.[41]

Oman - The same Law Library of Congress summary states Oman has a draft National Artificial Intelligence Policy defining governance for data management and development/use of AI systems.[41]

development/use of AI systems. [41] https://blogs.loc.gov/law/2024/12/falqs-ai-regulations-in-the-gulf-cooperation-council-member-states-part-two

1. Convergence themes visible across jurisdictions

2. Transparency/disclosure: EU Article 50 disclosures; Utah consumer disclosures; South Korea generative-AI notices/labeling; China’s mandatory explicit/implicit labeling; NYC applicant notice; Illinois candidate notice; Qatar strategy references explainability; Saudi/UAE guidance emphasizes transparency.[1][7][21][25][26][38] [42][44]

explainability; Saudi/UAE guidance emphasizes transparency. https://artificialintelligenceact.eu/chapter/5 [1][7][21][25][26][38] https://www.chinalawtranslate.com/en/ai-labeling https://www.davispolk.com/insights/client-update/utah-scales-back-reach-generative-ai-consumer-protection-law https://www.gtlaw.com/en/insights/2023/6/nycs-law-governing-automated-employment-decision-tools-takes-effect-july-5 https://law.justia.com/codes/illinois/chapter-820/act-820-ilcs-42 https://www.kimchang.com/en/insights/detail.kc?sch_section=4&idx=33805

3. Risk/impact assessments: EU conformity/risk management and some deployer FRIAs; Colorado deployer impact assessments; privacy-law data protection risk processing architecture. https://artificialintelligenceact.eu/chapter/5 [1][19][28][30][15] https://agora.eto.tech/instrument/1376 https://www.shb.com/intelligence/newsletters/pds/hansen-connecticut-privacy-law-2025 https://www.cliffordchance.com/insights/resources/blogs/talking-tech/en/articles/2021/03/virginia-s-consumer-data-privacy-act.html https://www.difc.com/business/registrars-and-commissioners/commissioner-of-data-protection/regulation-10 data protection guidance and U.S. privacy/employment frameworks. https://artificialintelligenceact.eu/chapter/5 [1][9][25] https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection https://www.gtlaw.com/en/insights/2023/6/nycs-law-governing-automated-employment-decision-tools-takes-effect-july-5 DPDP, UAE/DIFC, and Saudi PDPL/SDAIA guidance. https://artificialintelligenceact.eu/chapter/5 [1][4][9][13][15][42] https://www.chinalawtranslate.com/en/generative-ai-interim https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf https://www.difc.com/business/registrars-and-commissioners/commissioner-of-data-protection/regulation-10 https://my.gov.sa/en/news/640446 Colorado developers, and China filing/security processes. https://artificialintelligenceact.eu/chapter/5 [1][19][4] https://agora.eto.tech/instrument/1376 https://www.chinalawtranslate.com/en/generative-ai-interim

assessments in states such as Virginia and Connecticut; DIFC Regulation 10 highrisk processing architecture.[1][19][28][30][15] 4. Human oversight/contestability: explicit in EU high-risk rules and reflected in UK data protection guidance and U.S. privacy/employment frameworks.[1][9][25] 5. Data governance/privacy/security: central in EU, China, UK ICO guidance, India DPDP, UAE/DIFC, and Saudi PDPL/SDAIA guidance.[1][4][9][13][15][42] 6. Documentation/model information: explicit for EU GPAI and high-risk providers, Colorado developers, and China filing/security processes.[1][19][4] 7. Content labeling and synthetic media controls: strong in China; present in South Korea and several U.S. states; active in California and Arkansas trackers.[7][38] [32]

8. Main differences by actor type in the current patchwork

9. Developer/provider-focused regimes are strongest in the EU (high-risk providers and GPAI providers), China (public-facing service providers plus filing/security), South Korea (AI development operators), and Colorado (developers of high-risk AI).[1][4][2][19]

AI). [1][4][2][19] https://artificialintelligenceact.eu/chapter/5 https://www.chinalawtranslate.com/en/generative-ai-interim https://www.cooley.com/news/insight/2026/2026-01-27-south-koreas-ai-basic-act-overview-and-key-takeaways https://agora.eto.tech/instrument/1376

10. Deployer/user/integrator-focused rules are especially visible in Colorado deployer duties, NYC employment-tool use, Utah consumer-facing disclosure, UK existinglaw compliance, and privacy-law profiling/assessment obligations in states such as Connecticut and Virginia.[19][25][21][28][30]

as Connecticut and Virginia. https://agora.eto.tech/instrument/1376 [19][25][21][28][30] https://www.gtlaw.com/en/insights/2023/6/nycs-law-governing-automated-employment-decision-tools-takes-effect-july-5 https://www.davispolk.com/insights/client-update/utah-scales-back-reach-generative-ai-consumer-protection-law https://www.shb.com/intelligence/newsletters/pds/hansen-connecticut-privacy-law-2025 https://www.cliffordchance.com/insights/resources/blogs/talking-tech/en/articles/2021/03/virginia-s-consumer-data-privacy-act.html

11. Several jurisdictions regulate specific use contexts rather than general model development: NYC employment, Illinois hiring/video interviews, sectoral privacy rules, China online information services, and Gulf government-sector guidance. [25][26][5][42]

[25][26][5][42] https://www.gtlaw.com/en/insights/2023/6/nycs-law-governing-automated-employment-decision-tools-takes-effect-july-5 https://law.justia.com/codes/illinois/chapter-820/act-820-ilcs-42 https://www.chinalawtranslate.com/en/deep-synthesis https://my.gov.sa/en/news/640446

12. Binding-law versus guidance snapshot by covered jurisdiction

synthesis/algorithm/generative AI rules. https://artificialintelligenceact.eu/chapter/5 [1][2][4][5][6][7][19][21][23][25][26] https://www.cooley.com/news/insight/2026/2026-01-27-south-koreas-ai-basic-act-overview-and-key-takeaways https://www.chinalawtranslate.com/en/generative-ai-interim https://www.chinalawtranslate.com/en/deep-synthesis https://digichina.stanford.edu/work/translation-internet-information-service-algorithmic-recommendation-management-provisions-effective-march-1-2022 https://www.chinalawtranslate.com/en/ai-labeling https://agora.eto.tech/instrument/1376 https://www.davispolk.com/insights/client-update/utah-scales-back-reach-generative-ai-consumer-protection-law https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20250721-texas-enacts-new-ai-law https://www.gtlaw.com/en/insights/2023/6/nycs-law-governing-automated-employment-decision-tools-takes-effect-july-5 https://law.justia.com/codes/illinois/chapter-820/act-820-ilcs-42

13. Binding AI-specific enacted law/regulation: EU, South Korea, China, Colorado, Utah, Texas, NYC (local), Illinois hiring law, China labeling/deep synthesis/algorithm/generative AI rules.[1][2][4][5][6][7][19][21][23][25][26]
14. Binding through sectoral/privacy/consumer law instead of general AI act: UK, Japan, Brazil (currently), India, many U.S. states, UAE, Saudi Arabia, Qatar, Bahrain, Kuwait, Oman.[9][10][11][13][15][42][45][41]
15. Soft law/guidance/strategy dominant: Japan AI Guidelines, UK actionplan/regulator-guidance model, Saudi guidelines, Qatar strategy, much of the GCC outside specific free-zone/data regimes.[10][8][42][44][41]

Bahrain, Kuwait, Oman. [9][10][11][13][15][42] https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection https://www.meti.go.jp/shingikai/mono_info_service/ai_shakai_jisso/pdf/20240419_15.pdf https://www.mofo.com/artificial-intelligence/brazil https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf https://www.difc.com/business/registrars-and-commissioners/commissioner-of-data-protection/regulation-10 https://my.gov.sa/en/news/640446 [45] https://blogs.loc.gov/law/2024/12/falqs-ai-regulations-in-the-gulf-cooperation-council-member-states-part-two [41]

Sources:

[1] EU Artificial Intelligence Act Explorer / Regulation (EU) 2024/1689 materials (2024) https://artificialintelligenceact.eu/chapter/5

[2] South Korea’s AI Basic Act: Overview and Key Takeaways (2026) https://www.cooley.com/news/insight/2026/2026-01-27-south-koreas-ai-basicact-overview-and-key-takeaways

[3] U.S. State AI Law Tracker – All States (2026) https://ai-lawcenter.orrick.com/us-ai-law-tracker-see-all-states

[4] Interim Measures for the Management of Generative Artificial Intelligence Services (2023) https://www.chinalawtranslate.com/en/generative-ai-interim

[5] Provisions on the Administration of Deep Synthesis Internet Information Services (2022) https://www.chinalawtranslate.com/en/deep-synthesis

[6] Translation: Internet Information Service Algorithmic Recommendation Management Provisions (2022) https://digichina.stanford.edu/work/translationinternet-information-service-algorithmic-recommendation-managementprovisions-effective-march-1-2022

[7] Measures for Labeling of AI-Generated Synthetic Content (2025) https://www.chinalawtranslate.com/en/ai-labeling

[8] AI Opportunities Action Plan (2025) https://www.gov.uk/government/publications/ai-opportunities-action-plan/aiopportunities-action-plan

[9] Guidance on AI and data protection | ICO (N/A) https://ico.org.uk/fororganisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidanceon-ai-and-data-protection

[10] Outline of “AI Guidelines for Business Ver1.1” (2024) https://www.meti.go.jp/shingikai/mono_info_service/ai_shakai_ jisso/pdf/20240419 _15.pdf

[11] AI Library Brazil (N/A) https://www.mofo.com/artificial-intelligence/brazil

[12] MeitY advisory (PDF) (2024) https://www.meity.gov.in/static/uploads/2024/02/9f6e99572739a3024c9cdaec53 a0a0ef.pdf

[13] The Digital Personal Data Protection Act, 2023 (official PDF) (2023) https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c4 2aa5.pdf

[14] GCC Navigating AI Regulations - the Current Landscape (2025) https://www.twobirds.com/en/insights/2025/united-arab-emirates/gcc-navigatingai-regulations---the-current-landscape

[15] DIFC Regulation 10 (2023) https://www.difc.com/business/registrars-andcommissioners/commissioner-of-data-protection/regulation-10

[16] Generative Artificial Intelligence Guidelines For Government (2024) https://sdaia.gov.sa/en/SDAIA/about/Files/GenAIGuidelinesForGovernmentENCom pressed.pdf

[17] Summary of Artificial Intelligence 2025 Legislation (2025) https://www.ncsl.org/technology-and-communication/artificial-intelligence-2025- legislation

[18] Artificial Intelligence (AI) Legislation Tracker 2026: All 50 States (2026) https://www.multistate.ai/artificial-intelligence-ai-legislation

[19] Colorado AI Act (SB 205) text summary (2024) https://agora.eto.tech/instrument/1376

[20] Complying With Colorado's AI Law: Your SB24-205 Compliance Guide (2025) https://trustarc.com/resource/colorado-ai-law-sb24-205-compliance-guide

[21] Utah scales back reach of generative AI consumer protection law (2025) https://www.davispolk.com/insights/client-update/utah-scales-back-reachgenerative-ai-consumer-protection-law

[22] Utah Becomes First State To Enact AI-Centric Consumer Protection Law (2024) https://www.skadden.com/insights/publications/2024/04/utah-becomesfirst-state

[23] Texas Enacts New AI Law (2025) https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-andcybersecurity-law/20250721-texas-enacts-new-ai-law

[24] Texas Responsible AI Governance Act Enacted (2025) https://www.wiley.law/alert-Texas-Responsible-AI-Governance-Act-Enacted

[25] NYC’s Law Governing Automated Employment Decision Tools Takes Effect July 5 (2023) https://www.gtlaw.com/en/insights/2023/6/nycs-law-governingautomated-employment-decision-tools-takes-effect-july-5

[26] 820 ILCS 42/ - Artificial Intelligence Video Interview Act (2025) https://law.justia.com/codes/illinois/chapter-820/act-820-ilcs-42

[27] US State Privacy Legislation Tracker (2026) https://iapp.org/resources/article/us-state-privacy-legislation-tracker

[28] Connecticut Revamps Its Privacy Law (Again) (2025) https://www.shb.com/intelligence/newsletters/pds/hansen-connecticut-privacylaw-2025

[29] Connecticut Amends the Connecticut Data Privacy Act (2025) https://www.hunton.com/privacy-and-cybersecurity-law-blog/connecticutamends-the-connecticut-data-privacy-act

[30] Virginia’s Consumer Data Privacy Act (2021) https://www.cliffordchance.com/insights/resources/blogs/talkingtech/en/articles/2021/03/virginia-s-consumer-data-privacy-act.html

[31] Virginia Contemplates Sweeping New Data Protection Law (2021) https://www.hinshawlaw.com/en/insights/privacy-cyber-and-ai-decodedalert/virginia-contemplates-sweeping-new-data-protection-law

[32] Enacted AI Legislation Chart (2026) https://fpf.org/wpcontent/uploads/2026/02/Enacted-AI-Legislation-Chart-.pdf

[33] California 2025 legislative wrap-up: More privacy and first-of-its kind AI laws adopted (2025) https://iapp.org/news/a/california-2025-legislative-wrap-upmore-privacy-and-first-of-its-kind-ai-laws-adopted

[34] AI Opportunities Action Plan Government Response (2025) https://assets.publishing.service.gov.uk/media/678639913a9388161c5d2376/ai_op portunities_action_plan_government_repsonse.pdf

[35] Japan AI Safety Institute (J-AISI) (2025) https://aisi.go.jp/assets/pdf/20250501_AISI_en.pdf

[36] General Understanding on AI and Copyright in Japan (2024) https://www.bunka.go.jp/english/policy/copyright/pdf/94055801_01.pdf

[37] South Korea Artificial Intelligence (AI) Basic Act (2025) https://www.trade.gov/market-intelligence/south-korea-artificial-intelligence-aibasic-act

[38] Recent Developments in AI Basic Act (2025) https://www.kimchang.com/en/insights/detail.kc?sch_section=4&idx=33805

[39] Artificial intelligence reignites debates in the Brazilian House of Representatives (2025) https://www.demarest.com.br/en/inteligencia-artificialreacende-debates-na-camara-dos-deputados

[40] Press Release Page | Press Information Bureau (2025) https://www.pib.gov.in/PressReleasePage.aspx?PRID=2154268

[41] FALQs: AI Regulations in the Gulf Cooperation Council Member States – Part Two (2024) https://blogs.loc.gov/law/2024/12/falqs-ai-regulations-in-the-gulfcooperation-council-member-states-part-two

[42] SDAIA Supports Saudi Arabia's Leadership in Shaping ... (N/A) https://my.gov.sa/en/news/640446

[43] National Artificial Intelligence Strategy for Qatar (2021) https://policy.mada.org.qa/wp-content/uploads/2022/06/national_ai_strategy_- _english_0.pdf

[44] Qatar | Jurisdictions (N/A) https://www.dataguidance.com/jurisdictions/qatar

Research 2:

Additional angle selected: Deepening research — EU AI Act implementation and enforcement architecture, focusing on the operational machinery that turns legal obligations into actual compliance pressure. This angle was only lightly covered in the existing report, which focused mainly on substantive obligations and timelines, but not on who enforces them, what implementation tools now exist, and how this changes the practical burden for providers versus deployers.

1. The EU AI Act now has a multi-layer enforcement architecture, not just a statute.

The European Commission’s AI Office is the central EU-level body for implementing the AI Act, especially for general-purpose AI (GPAI). The Commission states that the AI Office’s tasks include enforcing and supervising GPAI rules, contributing to the consistent application of the AI Act, and promoting tools such as codes of practice and innovation measures.[1] This adds an institutional layer that the current report only briefly noted.

2. EU enforcement is split between Union-level and Member State-level actors.

The Commission states that the AI Office and national market surveillance authorities are jointly responsible for implementing, supervising, and enforcing the AI Act.[2] In practical terms, this means the EU is not using a single regulator for all AI: GPAI oversight is centralized more heavily at EU level, while rules for AI systems in Member States are supervised through national authorities.[1][2]

3. Member States must designate market surveillance authorities and single points

of contact. The Commission’s market-surveillance page states that each Member State must have market surveillance authority capacity under the AI Act, and where multiple authorities exist, one single point of contact must be designated.[2] This is significant for deployers and system providers because enforcement channels can differ by country even under one EU regulation.[2]

4. Market surveillance authorities have affirmative investigative and reporting

powers. The Commission states these authorities can investigate and enforce compliance with prohibitions and high-risk AI rules, and must report annually to the Commission and relevant national authorities, while also informing the Commission and other Member States of measures adopted and risk-evaluation results.[2] This indicates that the enforcement system is designed for active crossborder information exchange, not only complaint-based enforcement.[2]

5. The European AI Board is the coordination mechanism for national enforcers.

The Commission states that national market surveillance authorities “come together under the framework of the European AI Board” to facilitate cooperation, expertise exchange, and effective enforcement.[2] This matters for the patchwork analysis because, inside the EU, national variation is meant to be managed through a formal coordination body rather than left entirely decentralized.[2]

6. Two additional advisory bodies now support EU AI Act enforcement: the

Advisory Forum and the Scientific Panel. The Commission states that the Advisory Forum is established under Article 67 as a general advisory body to the Commission and the AI Board, while the Scientific Panel is an expert body established under Article 68 and Implementing Regulation (EU) 2025/454.[3][4] This expands the EU regime beyond classic market surveillance toward a more technically intensive governance model.[3][4]

7. The Scientific Panel is specifically focused on GPAI risks and technical

evaluation. According to the Commission, the Scientific Panel advises the AI Office and national authorities on implementation of the AI Act and on the impacts and risks of GPAI models; its core tasks include alerting the AI Office to systemic risks, advising on GPAI classification and evaluation methodologies, and supporting market-surveillance activities.[4] This is directly relevant to foundationmodel developers because it creates an expert route through which model-risk evidence can feed into enforcement.[4]

8. The Advisory Forum adds structured stakeholder input to enforcement and

implementation. The Commission describes it as providing technical expertise and advice on a broad range of AI Act matters, including standardisation and implementation challenges, and notes that it complements the Scientific Panel.[3] This shows that the EU implementation model is not only regulator-driven but also organized around formal expert and stakeholder consultation.[3]

9. The EU has created voluntary pre-compliance tools that are already shaping

market behavior ahead of full high-risk enforcement. The Commission states that the AI Pact is a voluntary initiative launched to support future implementation and to invite providers and deployers from Europe and beyond to comply with key AI Act obligations early.[5][6] This is a practical compliance-development tool that sits between soft law and binding law.[5][6]

sits between soft law and binding law. [5][6] https://digital-strategy.ec.europa.eu/en/policies/ai-pact https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai

10. More than 100 companies signed the EU AI Pact pledges in 2024. In a

Commission press release, the Commission announced that over a hundred companies became the first signatories of the AI Pact and its voluntary pledges.[7] This is concrete evidence that the AI Act is already influencing provider and deployer governance practices before all phases of the Act fully apply.[7]

11. The AI Pact is structured around organizational governance commitments, not just abstract principles. The Commission press release says the pledges include an AI governance strategy to foster AI uptake in the organization and work toward future compliance with the AI Act.[7] This is important because it shows early convergence around internal governance systems as a compliance expectation, even before certain mandatory obligations bite.[7]

12. A key 2025 implementation development is the GPAI Code of Practice. The Commission’s AI Act page states that the GPAI Code of Practice is a voluntary compliance tool submitted by independent experts to help providers comply with AI Act obligations related to transparency, copyright, and safety and security.[6] The Commission’s dedicated page on the code describes its contents and presents it as one of the main implementation tools for GPAI obligations.[8]

13. The GPAI Code of Practice directly targets model-provider obligations, not mainly deployer obligations. The Commission states that the code is intended to help providers comply with obligations related to transparency, copyright, and safety and security.[6][8] This reinforces the point that, within the EU framework, foundation-model/provider compliance is becoming operationalized through dedicated instruments separate from the high-risk system rules that affect many deployers.[6][8]

14. The Commission finalized a mandatory training-data transparency template for GPAI providers on 24 July 2025. The Commission press release states it presented a template for GPAI model providers to summarize the data used to train their models.[9] This is a major implementation step because the existing report noted the underlying transparency duty, but this new tool shows that the obligation has moved from statutory text to a prescribed operational format.[9]

15. The training-data summary template standardizes how GPAI providers must disclose training-content information. The Commission’s July 2025 release describes the template as the instrument GPAI providers use to summarize the data used for training.[9] This means training-data transparency is no longer only a principle-level obligation; it now has a defined reporting format that providers must use.[9]

16. The emerging EU implementation trend is proceduralization: obligations are being converted into templates, codes, boards, expert panels, and reporting channels. This is not a matter of opinion but an observable fact from the Commission’s implementation pages and press materials: the AI Office exists,[1] national authorities are being designated,[2] the Advisory Forum and Scientific

Panel are operational, https://digital-strategy.ec.europa.eu/en/policies/ai-advisory-forum [3][4] https://digital-strategy.ec.europa.eu/en/policies/ai-scientific-panel the AI Pact is active, https://digital-strategy.ec.europa.eu/en/policies/ai-pact [5][7] https://ec.europa.eu/commission/presscorner/detail/en/ip_24_4864 the GPAI Code of Practice

Panel are operational,[3][4] the AI Pact is active,[5][7] the GPAI Code of Practice exists,[6][8] and a mandatory training-data transparency template has been issued.[9] Collectively, these show that the EU is moving beyond legislation toward an administrative compliance system.

[4][6][8][9] https://digital-strategy.ec.europa.eu/en/policies/ai-scientific-panel https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai https://digital-strategy.ec.europa.eu/en/news/commission-presents-template-general-purpose-ai-model-providers-summarise-data-used-train-their By contrast, deployers are more exposed to national market-

17. Implication for comparative burden: the EU’s operational burden on model developers is increasing through implementation detail, not just legal text. Factually, GPAI providers now face a central AI Office, expert-panel scrutiny pathways, a code of practice, and a mandatory training-data summary template.[1] [4][6][8][9] By contrast, deployers are more exposed to national marketsurveillance channels and Member State authority structures for system-level enforcement.[2] This deepens the existing report’s conclusion that the EU imposes a high burden on both groups, but shows that the burden is being institutionalized differently for providers and deployers.[1][2][4][6][9]

differently for providers and deployers. https://digital-strategy.ec.europa.eu/en/policies/ai-office [1][2][4][6][9] https://digital-strategy.ec.europa.eu/en/policies/market-surveillance-authorities-under-ai-act https://digital-strategy.ec.europa.eu/en/policies/ai-scientific-panel https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai https://digital-strategy.ec.europa.eu/en/news/commission-presents-template-general-purpose-ai-model-providers-summarise-data-used-train-their

18. This implementation architecture also helps explain why the EU may be operationally more coherent than the U.S. state patchwork despite national variation. Within the EU, national enforcement is explicitly linked through single points of contact, annual reporting obligations, and the European AI Board.[2] The current report discussed divergence across jurisdictions globally; this additional evidence shows that, internally, the EU is trying to reduce fragmentation through formal coordination machinery.[2]

19. A notable 2026 development in the Commission’s official AI Act page is a further extension for certain AI systems embedded in regulated products. The Commission’s AI Act page states that, as a result of the political agreement on the ‘AI omnibus’ simplification proposal, the rules for high-risk AI systems embedded into regulated products have an extended transition period until 2 August 2028.[6] This timing detail is incorporated in the body of this report (Section 2.8).

20. This 2028 extension is narrower than a general delay of the AI Act. The Commission page specifically ties the extended transition to “high-risk AI systems

• embedded into regulated products,” while separately maintaining the broader framework, including the GPAI Code of Practice and other implementation tools.[6] The fact pattern therefore suggests targeted timing relief for a subset of high-risk systems rather than wholesale postponement of the Act.[6] However, the same "AI omnibus" provisional agreement (reached by the Council and the European Parliament on 7 May 2026) is broader than the embedded-product extension alone: it also defers stand-alone Annex III high-risk obligations from 2 August 2026 to no later than 2 December 2027 by linking their application to the availability of harmonised standards and support tools, while GPAI obligations and the core governance provisions keep their existing dates.[6]

Overall, this deepening research shows that the EU is no longer just the jurisdiction with the most detailed AI statute; it is also the jurisdiction with the most developed implementation machinery currently visible in official sources. That machinery increasingly differentiates the compliance experience of GPAI/model providers from that of system providers and deployers, and it is likely to be a major practical driver of compliance burden in 2026–2028.[1][2][3][4][6][8][9]

Sources:

[1] European AI Office | Shaping Europe's digital future (2026) https://digitalstrategy.ec.europa.eu/en/policies/ai-office

[2] Market Surveillance Authorities under the AI Act (2026) https://digitalstrategy.ec.europa.eu/en/policies/market-surveillance-authorities-under-ai-act

[3] AI Act Advisory Forum | Shaping Europe’s digital future (2026) https://digitalstrategy.ec.europa.eu/en/policies/ai-advisory-forum

[4] AI Act Scientific Panel | Shaping Europe's digital future (2026) https://digitalstrategy.ec.europa.eu/en/policies/ai-scientific-panel

[5] AI Pact | Shaping Europe's digital future (2026) https://digitalstrategy.ec.europa.eu/en/policies/ai-pact

[6] AI Act | Shaping Europe's digital future (2026) https://digitalstrategy.ec.europa.eu/en/policies/regulatory-framework-ai

[7] Over a hundred companies sign EU AI Pact pledges to drive trustworthy and safe AI development (2024) https://ec.europa.eu/commission/presscorner/detail/en/ip_24_4864

[8] The General-Purpose AI Code of Practice (2026) https://digitalstrategy.ec.europa.eu/en/policies/contents-code-gpai

[9] Commission presents template for General-Purpose AI model providers to summarise the data used to train their model (2025) https://digitalstrategy.ec.europa.eu/en/news/commission-presents-template-general-purposeai-model-providers-summarise-data-used-train-their

Research 3:

Additional angle selected: Complementary research — the growth of non-binding but operationally important governance infrastructure that sits below or alongside AI legislation. This angle adds new information not centered on statutes themselves: international standards, incident-reporting frameworks, national governance charters, and privacy-regulator technical studies. These instruments matter because they can shape practical compliance burdens and create convergence even where jurisdictions have no binding omnibus AI law.

1. A global layer of implementation infrastructure is emerging alongside formal AI

laws. The current report focuses mainly on legislation and regulator guidance. Additional research shows that, by 2026, multiple jurisdictions and international bodies are building practical governance tools below the level of statute: management-system standards, incident-reporting frameworks, technical standardisation, and national AI charters [1][2][3][4][5][6][7]. These tools are not necessarily binding, but they are increasingly specific enough to influence procurement, internal governance, audits, and evidence of due care [1][3][4].

standardisation, and national AI charters [1][2][3][4][5][6][7] https://www.iso.org/standard/42001 https://www.oecd.org/en/publications/towards-a-common-reporting-framework-for-ai-incidents_f326d4ac-en.html https://oecd.ai/en/site/incidents https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence https://digital-strategy.ec.europa.eu/en/policies/ai-act-standardisation https://jtc21.eu/ https://legismap.com.br/conteudos/artigos-e-noticias/anpd-releases-english-version-of-technology-radar . These tools are not

2. ISO/IEC 42001 has created a cross-jurisdictional organizational governance

baseline for both AI providers and AI users. ISO states that ISO/IEC 42001:2023 is the world’s first AI management system standard and that it specifies requirements for establishing, implementing, maintaining, and continually improving an AI management system (AIMS) within organizations [1]. ISO also states that the standard is designed for entities providing or utilizing AI-based products or services, which is notable because it maps directly onto the developer/provider versus deployer/user split used in the main report [1]. This means that, outside binding AI statutes, there is now a global governance template that applies to both sides of the AI value chain [1].

3. ISO/IEC 42001 is process-focused rather than model- or sector-specific. ISO describes the AIMS as a set of organizational elements used to establish policies, objectives, and processes for the responsible development, provision, or use of AI systems [1]. Factually, this differs from the EU AI Act’s use-case and risk-tier approach and from China’s activity-specific rules; it offers a management-system structure rather than prescribing prohibited practices or high-risk categories [1].

4. The U.S. governance stack now includes detailed voluntary generative-AI risk guidance from NIST, even without a federal AI statute. NIST’s official publication page states that the Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile is an official NIST publication [4]. The publication itself states that it is a cross-sectoral profile for generative AI and is intended to help organizations apply the AI RMF to generative AI contexts [4]. This adds a concrete operational layer to the U.S. landscape described in the report: even though the United States lacks a federal AI law, it has increasingly detailed federal technical guidance for AI risk management [4].

5. NIST’s Generative AI Profile is oriented to lifecycle controls that resemble obligations found in binding laws elsewhere. In the NIST AI 600-1 publication, examples of recommended inventory and governance information include acceptable-use policies, assumptions and limitations of use, disclosure information or notices, incident response plans, data provenance information, human-oversight roles and responsibilities, underlying foundation-model versions and access modes, and updated hierarchies of identified risks [4]. These are objective indicators that the U.S. voluntary framework is converging operationally with concepts that appear in the EU AI Act and other regimes: documentation, transparency, incident handling, human oversight, provenance, and ongoing monitoring [4].

6. The OECD has built a structured incident-reporting framework that could become a common language across otherwise divergent legal regimes. The OECD’s 2025 paper Towards a common reporting framework for AI incidents states that the framework contains 29 criteria intended to help policymakers understand AI incidents across diverse contexts and identify high-risk systems [2]. The OECD’s AI Incidents and Hazards Monitor page further states that the OECD is developing definitions and monitoring through a common reporting framework, supported by an Expert Group on AI Incidents [3]. This is significant because the current report emphasized divergence in legal architecture; the OECD work shows convergence at the level of post-deployment incident description and analysis [2] [3].

[3] https://oecd.ai/en/site/incidents .

7. The OECD framework defines both incidents and hazards, not only realized harms. The OECD paper and related OECD materials distinguish between AI incidents and AI hazards, and the paper includes fields for quantifying harm such as economic losses, death, injury, number of affected stakeholders, and compensation [2]. This is notable because many national regimes focus on serious incidents once obligations have already been triggered, whereas the OECD framework is designed to support broader international learning across both realized and potential harms [2][3].

8. The OECD incident framework is actor- and sector-neutral. The OECD paper includes categories for the business function where an incident occurred, such as human resource management, sales, ICT management and information security, marketing and advertisement, logistics, citizen/customer service, procurement, compliance and justice, and research and development [2]. Factually, this means the framework is not limited to a single sector like employment or healthcare, and it can capture both developer-side and deployer-side failures [2].

9. In the EU, standardisation is becoming a separate compliance layer in addition to the AI Act’s legal obligations. The European Commission’s AI Act standardisation page states that harmonised standards will offer legal certainty under the AI Act, and that once standards are published by CEN and CENELEC, the Commission will assess them and then reference them in the Official Journal of the EU [5]. The Commission also states that, on 19 November 2025, the Digital Omnibus proposed linking the application of rules for high-risk AI systems to the availability of support tools, including standards [5]. This adds a new operational dimension to the EU landscape: practical compliance for high-risk systems will depend not only on the statute and AI Office machinery already covered, but also on the production and citation of harmonised standards [5].

10. EU standardisation is designed to create presumption-of-conformity pathways. CEN-CENELEC’s JTC 21 states that its purpose is to develop European standards that provide manufacturers with a presumption of conformity with the AI Act [6]. This matters because it shows that, for EU high-risk providers in particular, compliance may increasingly be evidenced through adherence to technical standards rather than only bespoke legal interpretation [5][6].

11. The EU’s standards pathway is especially relevant to high-risk system providers, but it may indirectly shape deployers as well. The Commission describes harmonised standards as a source of legal certainty under the Act [5]. Because providers of high-risk systems need to demonstrate compliance and deployers often depend on provider documentation, the standards infrastructure is likely to affect the information packages, instructions, and conformity artifacts that downstream users receive [5][6].

12. Brazil’s data protection authority has begun to translate AI governance into privacy-regulator technical analysis before any AI bill is enacted. The Brazilian ANPD announced an English-language version of its Technology Radar – Generative Artificial Intelligence in December 2024, aimed at an international audience [7]. According to ANPD-related reporting describing the official publication, the study addresses topics such as data scraping/web scraping and synthetic content generation, both of which may involve personal data processing [7]. This adds a new fact pattern for Brazil beyond the pending PL 2338/2023 bill: the national privacy authority is already developing a technical interpretation layer for generative AI under existing LGPD-based oversight [7].

13. Brazil’s ANPD work shows how privacy regulators can shape AI governance without an AI-specific law. The ANPD’s Technology Radar series is expressly about how emerging technologies affect the personal-data-protection landscape [7]. Factually, that means Brazil’s immediate AI compliance burden is being shaped not only by the pending AI bill and LGPD enforcement generally, but by regulatorauthored technical framing of issues like scraping, synthetic content, and personal-data risks in generative AI [7].

14. The Gulf region is adding principle-based national AI governance instruments even where binding AI laws remain limited. The UAE’s official legislation portal states that the UAE Charter for the Development and Use of Artificial Intelligence aims to achieve the strategic goals of the UAE AI Strategy [8]. This provides a formal national governance reference point beyond the data-protection and freezone rules already noted in the main report [8].

15. The UAE Charter is a policy instrument rather than a standalone AI statute, but it is meant to guide development and use. The official UAE policy page identifies the charter as a framework for the development and use of AI [8]. This is important because it adds a governance layer that applies conceptually across sectors even though the UAE still lacks a general binding AI law in the material reviewed [8].

16. Saudi Arabia’s AI ethics framework is more structured than a generic principles statement. SDAIA’s official AI Ethics Principles document sets out lifecycleoriented controls covering planning and design, input data preparation, building and validation, and deployment and monitoring [9]. The document also includes substantive principles such as fairness, privacy and security, humanity, social and environmental benefits, reliability and safety, transparency and explainability, and accountability and responsibility [9]. This adds a finer-grained operational view to the Saudi discussion in the main report.

17. Saudi Arabia’s ethics framework incorporates a risk-based logic and defined organizational roles. Secondary descriptions of SDAIA’s 2023 AI Ethics Principles report that the framework includes risk categorisation and roles/responsibilities for adopting entities [10][11]. While these descriptions are not the same as statutory mandates, they indicate that Saudi Arabia’s guidance is moving beyond abstract ethics into implementable governance design [10][11].

18. These non-binding infrastructures create a new kind of convergence across very different legal systems. Across ISO/IEC 42001, the NIST Generative AI Profile, the OECD incident framework, EU standardisation, Brazil’s ANPD Technology Radar, the UAE Charter, and Saudi AI ethics materials, recurring factual themes include governance systems, documentation, data provenance, monitoring, human oversight, incident handling, transparency, and lifecycle controls [1][2][4][5][7][8][9]. This convergence is distinct from convergence in formal law: jurisdictions remain divergent on penalties, enforcement powers, and prohibited practices, but they are increasingly similar in the kinds of internal controls they expect organizations to build [1][2][4][5][9].

19. This trend changes the practical compliance picture for firms operating globally. Even where there is no binding omnibus AI law, organizations may still face strong expectations to maintain governance systems, inventories, incident workflows, documentation, and risk-management processes because those elements are now embedded in standards and official technical guidance [1][4][7][9]. These expectations can influence procurement, regulator dialogue, assurance programs, and readiness for future binding rules [1][5][8].

20. Implication for the comparative report: the “global AI regulation patchwork” is not only a patchwork of laws; it is increasingly also a patchwork of interoperable compliance artifacts. The legal layer is still fragmented, but a second layer of governance infrastructure is becoming more standardized internationally through ISO, OECD, NIST, EU harmonised standards work, and national charters/guidance [1][2][4][5][8][9]. That second layer may become especially important for model developers and enterprise deployers trying to build one global control environment that can be reused across jurisdictions [1][4][5].

Sources:

[1] ISO/IEC 42001:2023 - AI management systems (2023) https://www.iso.org/standard/42001 [2] Towards a common reporting framework for AI incidents (2025) https://www.oecd.org/en/publications/towards-a-common-reporting-frameworkfor-ai-incidents_f326d4ac-en.html [3] AI incidents Overview - OECD.AI (2025) https://oecd.ai/en/site/incidents [4] Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (2024) https://www.nist.gov/publications/artificial-intelligencerisk-management-framework-generative-artificial-intelligence [5] Standardisation of the AI Act | Shaping Europe's digital future (2026) https://digital-strategy.ec.europa.eu/en/policies/ai-act-standardisation [6] European AI Standardization | CEN-CENELEC JTC 21 (2026) https://jtc21.eu [7] ANPD releases English version of Technology Radar (2024) https://legismap.com.br/conteudos/artigos-e-noticias/anpd-releases-englishversion-of-technology-radar

[8] The UAE Charter for the Development and Use of Artificial Intelligence (2024) https://uaelegislation.gov.ae/en/policy/details/the-uae-charter-for-thedevelopment-and-use-of-artificial-intelligence

[9] AI Ethics Principles (2023) https://sdaia.gov.sa/en/SDAIA/about/Documents/aiprinciples.pdf

[10] Saudi Arabia: SDAIA publishes AI Ethics Principles version 2.0 (2023) https://www.dataguidance.com/news/saudi-arabia-sdaia-publishes-ai-ethicsprinciples

[11] Saudi Arabia - AI Ethics Principles (2023) https://regulations.ai/regulations/RAI-SA-NA-PCAESXX-2023

Research 4:

Additional angle selected: Deepening research — the U.S. enforcement-andrulemaking layer that regulates AI through existing consumer protection, employment, and privacy authorities rather than through omnibus AI statutes. This angle adds detail not fully developed in the report’s U.S. section, which already covers state enacted laws and privacy statutes, but gives less attention to how enforcement and sub-regulatory mechanisms create practical obligations for AI model developers, vendors, and deployers.

1. In the United States, a major part of the AI compliance burden still comes from enforcement under existing laws rather than AI-specific statutes. The FTC’s AI page shows the agency has built a dedicated AI enforcement/policy hub under its existing authority, and the EEOC has separately created an AI and algorithmic fairness initiative for employment discrimination enforcement.[1][2] This confirms that U.S. AI regulation is not only legislative patchwork; it is also an enforcement patchwork.

2. The FTC publicly framed AI enforcement as a crackdown on deceptive AI claims and AI-enabled schemes in 2024. In September 2024, the FTC announced “Operation AI Comply,” describing five enforcement actions targeting companies that allegedly used AI claims or AI-enabled tools in deceptive or unfair ways.[3] The FTC’s press release stated that the actions built on earlier AI-related cases involving online storefront schemes, AI moderation claims, AI facial recognition, and AI-related accuracy claims.[3]

3. This FTC activity is highly relevant to AI developers/providers because it targets representations about AI capability, not only end-use harms. The FTC’s 2024 Operation AI Comply announcement focused on false or misleading claims that products were “AI-powered” or could reliably deliver specified outcomes.[3] That means the U.S. federal enforcement layer can directly affect model vendors and AI application developers even without a federal AI statute.[3]

4. The FTC’s DoNotPay order is a concrete 2025 example of AI-specific

enforcement through general consumer-protection law. In February 2025, the FTC finalized an order against DoNotPay over claims that its service was “the world’s first robot lawyer.” The FTC stated the company had not tested whether its AI-generated legal documents could substitute for a human lawyer’s expertise and that the order prohibits deceptive AI-lawyer claims, imposes monetary relief, and requires notice to past subscribers.[4][5] This shows that, in the U.S., AI vendor marketing and substantiation can itself be a regulated compliance domain.[4][5]

5. The practical U.S. burden for providers therefore includes substantiating capability claims and avoiding “AI-washing.” The FTC’s official materials show that companies can face enforcement if they market tools as AI-powered or outcome-capable without adequate support.[1][3][4] This is a different burden from the EU AI Act’s ex ante technical documentation and conformity-assessment system, but it is still a real burden on developers/providers.[1][3][4]

6. The FTC’s enforcement examples also show that U.S. AI oversight can attach to downstream harms such as fake reviews, child safety, and facial-recognition deployment. The FTC’s Operation AI Comply press release explicitly pointed to prior cases involving anonymous messaging moderation claims, AI facial recognition used without reasonable safeguards, and business-opportunity schemes using “AI-powered” storefront tools.[3] This indicates that federal U.S. enforcement spans both provider claims and deployer conduct.[3]

7. California’s privacy rulemaking has matured into one of the most operationally significant U.S. deployer-facing AI regimes, even though it is not a standalone AI law. In September 2025, the California Privacy Protection Agency (CPPA) announced that the Office of Administrative Law approved regulations covering automated decisionmaking technology (ADMT), risk assessments, and cybersecurity audits.[6] CPPA stated that businesses subject to risk-assessment requirements must begin compliance by January 1, 2026, while businesses have additional time for some ADMT-related obligations.[6]

8. California’s ADMT rules are important because they create procedural

obligations around AI-like decision systems under privacy law rather than AI- specific law. Secondary summaries of the final rules report that the regulations apply where ADMT is used to make “significant decisions” concerning consumers and require businesses to provide notice, opt-out rights in covered cases, and related information/access mechanisms.[7][8] The same summaries report that the regulations are narrower than earlier drafts and are focused on cases where technology replaces or substantially replaces human decision-making.[8]

9. California therefore deepens the U.S. patchwork by adding a privacy-rule-based deployer regime that resembles some AI-law concepts. The approved CPPA rules connect automated decision systems with risk assessments, consumer rights, and governance obligations.[6][7][8] Functionally, this pushes California closer to the EU/Colorado pattern on impact assessment and significant-decision controls, even though the legal vehicle is CCPA rulemaking rather than an AI act. [6][7][8]

10. The California rules also create a formal reporting channel for risk-assessment information. Legal analyses of the finalized rules state that for risk assessments conducted in 2026 and 2027, businesses must submit information regarding the assessment to the CPPA by April 1, 2028, even if not the full assessment document itself.[7] This is a concrete operational obligation that increases audit-readiness and recordkeeping burdens for deployers.[7]

11. Colorado’s AI Act is more detailed on developer-to-deployer information transfer than many summaries suggest. The official bill text requires developers of high-risk AI systems to provide deployers with documentation that includes a general statement of reasonably foreseeable uses and known harmful or inappropriate uses; high-level summaries of training-data types; known or reasonably foreseeable limitations and risks of algorithmic discrimination; the system’s purpose, intended benefits and uses; and additional information necessary for deployers to comply with their own obligations.[9][10]

12. Colorado also requires developers to disclose evaluation and data-governance information to deployers. The official text requires documentation describing how the system was evaluated for performance and mitigation of algorithmic discrimination before being made available; what data-governance measures were used for training data and suitability/bias review; the intended outputs; riskmitigation measures; and how the system should and should not be used and monitored by an individual when used to make or substantially influence a consequential decision.[9] This is a significant provider burden that mirrors some EU-style provider documentation logic.[9]

13. This means Colorado’s law operationally depends on provider documentation to make deployer compliance possible. Because deployers must manage risk, review for algorithmic discrimination, and give notices, the developer’s disclosure package is a core compliance dependency.[9][10] This is an important structural mechanism in the U.S. patchwork: some state AI obligations are transmitted downstream through vendor documentation rather than enforced purely as standalone rules on users.[9][10]

standalone rules on users. https://leg.colorado.gov/bill_files/47770/download [9][10] https://leg.colorado.gov/bills/sb24-205

14. In employment, the EEOC has made clear that employer use of AI and algorithmic tools is already subject to Title VII disparate-impact analysis. The EEOC’s AI initiative announcement states the agency is focused on ensuring that AI and other emerging tools used in hiring and employment decisions comply with federal civil-rights laws.[2] The EEOC’s public explainer on its role in AI lists recruiting, screening, hiring, monitoring employees, assessing productivity, setting wages, and deciding whom to promote or fire as areas where AI use may violate employment discrimination laws.[11]

employment discrimination laws. https://www.eeoc.gov/sites/default/files/2024-04/20240429_What%20is%20the%20EEOCs%20role%20in%20AI.pdf [11]

15. The EEOC’s AI materials matter primarily for deployers/employers, but also indirectly for vendors. The EEOC’s Title VII technical-assistance document on adverse impact in software, algorithms, and AI used in employment selection procedures explains that if a tool has an adverse impact on a protected group, its use violates Title VII unless the employer can show the use is job-related and consistent with business necessity.[12] The document also states that employers considering whether to rely on a vendor may want to ask specifically whether the vendor assessed adverse impact using measures such as the four-fifths rule of thumb.[12]

16. This creates a concrete vendor-management obligation for U.S. deployers using AI in employment. The EEOC does not create a dedicated AI statute, but its guidance pushes employers to obtain evidence from vendors about testing and adverse-impact assessment.[12] In practice, this makes employment-AI vendors part of the compliance chain even when the legal duty remains on the employer. [11][12]

capability claims or enabling deceptive uses. https://www.ftc.gov/industry/technology/artificial-intelligence [1][3][4] https://www.ftc.gov/news-events/news/press-releases/2024/09/ftc-announces-crackdown-deceptive-ai-claims-schemes https://www.ftc.gov/news-events/news/press-releases/2025/02/ftc-finalizes-order-donotpay-prohibits-deceptive-ai-lawyer-claims-imposes-monetary-relief-requires Employment and privacy

17. The U.S. patchwork therefore has a clearer provider/deployer split than an enacted-law inventory alone might suggest. Federal consumer-protection enforcement by the FTC targets developers/providers and marketers making AI capability claims or enabling deceptive uses.[1][3][4] Employment and privacy rules, by contrast, often place the direct legal obligation on deployers/employers/businesses using the systems, while indirectly pressuring vendors to supply documentation, testing results, and substantiation.[6][7][9][11] [12]

vendors to supply documentation, testing results, and substantiation. https://cppa.ca.gov/announcements/2025/20250923.html [6][7][9][11] https://www.skadden.com/insights/publications/2025/10/california-finalizes-cppa-regulations https://leg.colorado.gov/bill_files/47770/download https://www.eeoc.gov/sites/default/files/2024-04/20240429_What%20is%20the%20EEOCs%20role%20in%20AI.pdf

18. Compared with the EU, the U.S. model remains less centralized and less ex ante, but it is not light-touch in operational terms. The U.S. system uses a combination of FTC deception/unfairness enforcement, EEOC anti-discrimination enforcement, CPPA privacy rulemaking, Colorado-style state AI statutes, and local employment rules rather than one omnibus law.[1][2][3][6][9] The result is a compliance model that is fragmented by legal theory and regulator, not just by geography.[1][2][6][9]

19. A key implication for comparative analysis is that U.S. compliance burden is understated if measured only by enacted AI-specific statutes. Official FTC, EEOC, and CPPA materials show that AI obligations in the U.S. are also being created through: (a) substantiation of AI claims, (b) consumer-protection enforcement against AI-enabled conduct, (c) anti-discrimination testing expectations in employment, and (d) privacy-rule-based notice, opt-out, and riskassessment duties for automated decisionmaking.[1][3][4][6][11][12]

20. This deepening research supports a refined classification of the U.S. regime: binding AI-specific law exists in a minority of states, but a large share of the practical burden comes from enforcement through existing laws and rulemaking under existing privacy and discrimination authorities.[1][2][6][9][12] For model developers, the highest immediate federal risk visible in the sources is deceptiveclaims/AI-washing enforcement by the FTC.[3][4] For deployers, the strongest documented burdens in the sources are California ADMT/privacy obligations, Colorado consequential-decision duties, and EEOC-driven employment testing and vendor-management expectations.[6][7][9][12]

Sources:

[1] Artificial Intelligence | Federal Trade Commission (N/A) https://www.ftc.gov/industry/technology/artificial-intelligence

[2] EEOC Launches Initiative on Artificial Intelligence and Algorithmic Fairness (2021) https://www.eeoc.gov/newsroom/eeoc-launches-initiative-artificialintelligence-and-algorithmic-fairness

[3] FTC Announces Crackdown on Deceptive AI Claims and Schemes (2024) https://www.ftc.gov/news-events/news/press-releases/2024/09/ftc-announcescrackdown-deceptive-ai-claims-schemes

[4] FTC Finalizes Order with DoNotPay That Prohibits Deceptive 'AI Lawyer' Claims, Imposes Monetary Relief, and Requires Notice to Past Subscribers (2025) https://www.ftc.gov/news-events/news/press-releases/2025/02/ftc-finalizesorder-donotpay-prohibits-deceptive-ai-lawyer-claims-imposes-monetary-reliefrequires

[5] DoNotPay | Federal Trade Commission (N/A) https://www.ftc.gov/legallibrary/browse/cases-proceedings/donotpay

[6] California Finalizes Regulations to Strengthen Consumers' Privacy (2025) https://cppa.ca.gov/announcements/2025/20250923.html

[7] California Finalizes CCPA Regulations for Automated Decision-Making Technology, Risk Assessments and Cybersecurity Audits (2025) https://www.skadden.com/insights/publications/2025/10/california-finalizes-cpparegulations

[8] California Finalizes CCPA Regulations on Automated Decision-Making Technology, Risk Assessments, and Cybersecurity Audits (2025) https://www.coblentzlaw.com/news/california-finalizes-ccpa-regulations-onautomated-decision-making-technology-risk-assessments-and-cybersecurityaudits

[9] Senate Bill 24-205 - Colorado General Assembly (2024) https://leg.colorado.gov/bill_files/47770/download

[10] SB24-205 Consumer Protections for Artificial Intelligence | Colorado General Assembly (2024) https://leg.colorado.gov/bills/sb24-205

[11] What is the EEOC's role in AI? (2024) https://www.eeoc.gov/sites/default/files/2024- 04/20240429_What%20is%20the%20EEOCs%20role%20in%20AI.pdf

[12] Select Issues: Assessing Adverse Impact in Software, Algorithms, and Artificial Intelligence Used in Employment Selection Procedures Under Title VII of the Civil Rights Act of 1964 (2023) https://data.aclum.org/storage/2025/01/EOCC_www_eeoc_gov_laws_guidance_sel ect-issues-assessing-adverse-impact-software-algorithms-and-artificial.pdf

Research 5:

Additional angle selected: Complementary research — the emerging transnational governance layer above domestic AI law. This angle adds information not separately covered in the current report: binding and voluntary international instruments that do not replace national law, but increasingly shape how states and firms operationalize AI governance across borders.

1. The Council of Europe AI Framework Convention adds a new binding

international-law layer to the AI patchwork. The Council of Europe states that its Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law is the first-ever international legally binding treaty in this field.[1] It was opened for signature on 5 September 2024.[1][2] This matters because the current report focuses mainly on national and regional regimes; the Convention creates a separate treaty-level baseline that can influence domestic implementation across signatory states.[1][2]

implementation across signatory states. [1][2] https://www.coe.int/en/web/artificial-intelligence/the-framework-convention-on-artificial-intelligence https://www.coe.int/en/web/Conventions/full-list?module=signatures-by-treaty&treatynum=225

2. The Convention is broader geographically than the EU and was negotiated with non-European participants. The Council of Europe states that the Convention was drafted by its 46 member states with the participation of observer states including Canada, Japan, Mexico, the Holy See, and the United States, as well as the European Union and additional non-member states including Australia, Argentina, Costa Rica, Israel, Peru, and Uruguay.[1] This is a concrete sign that AI governance is no longer only being shaped by single jurisdictions such as the EU or China; there is now a multilateral treaty venue with participation from countries inside and outside Europe.[1]

3. The Convention is designed as a framework treaty, not a directly self-executing AI rulebook. The Council of Europe signature chart states the treaty is open for signature by participating states and, after entry into force, accession by other non-member states.[2] Council of Europe materials describe it as requiring parties to adopt or maintain legislative, administrative, or other measures to give effect to the Convention.[3] This means the Convention does not itself impose EU-style detailed provider or deployer duties; instead, it requires states to implement domestic measures consistent with the treaty’s standards.[1][3]

4. The Convention applies across the AI lifecycle and is explicitly risk-based.

Council of Europe materials state the treaty aims to ensure that activities within the lifecycle of AI systems are consistent with human rights, democracy, and the rule of law.[1] Supporting summaries of the Convention explain that implementation measures are to be graduated and differentiated according to the severity and probability of adverse impacts.[3] This is important because it shows convergence with the risk-based logic seen in the EU AI Act, even though the Convention is structured as public international law rather than product regulation.[1][3]

5. The Convention’s practical focus is on public-law outcomes rather than market- access compliance. The Council of Europe describes the objective as ensuring compatibility with human rights, democracy and the rule of law, while also being conducive to innovation.[1] Compared with the EU AI Act, which creates direct obligations for providers and deployers placing systems on the market, the Convention is oriented toward what states must ensure in their legal systems.[1][3] This makes it a different regulatory instrument: treaty-level minimum standards rather than a directly operational compliance code for firms.

governance even in countries that do not adopt the EU AI Act structure. https://www.coe.int/en/web/artificial-intelligence/the-framework-convention-on-artificial-intelligence [1][2][3] https://www.coe.int/en/web/Conventions/full-list?module=signatures-by-treaty&treatynum=225 https://eucrim.eu/news/council-of-europe-convention-on-artificial-intelligence

6. The Convention therefore creates an additional route for convergence outside the EU model. Because the treaty is open beyond Europe and focuses on lifecycle safeguards and human-rights-consistent governance, it can influence domestic AI governance even in countries that do not adopt the EU AI Act structure.[1][2][3] For comparative analysis, this means “global AI regulation” now includes not only jurisdiction-specific statutes, but also treaty commitments that may shape future national laws and enforcement frameworks.[1]

7. A second transnational layer is the G7 Hiroshima AI Process (HAIP), which created a structured voluntary code for advanced AI systems. Japan’s official Hiroshima AI Process page states that the Process was launched in May 2023 following the G7 Hiroshima Summit, and that the Hiroshima AI Process Comprehensive Policy Framework was agreed in December 2023 and endorsed by G7 leaders the same month.[4] The framework includes guiding principles and an international code of conduct aimed at promoting safe, secure, and trustworthy advanced AI systems.[4]

advanced AI systems. https://www.soumu.go.jp/hiroshimaaiprocess/en/index.html [4]

8. The Hiroshima Code of Conduct is targeted specifically at organizations developing advanced AI systems, including advanced foundation models and generative AI. The official code states that it is intended for organizations developing the most advanced AI systems, including the most advanced foundation models and generative AI systems.[5] It also states that organizations should apply the actions across the lifecycle, including design, development, deployment and use.[5] This is notable because it is one of the clearest international instruments focused directly on frontier-model developers, rather than on governments alone.[5]

9. The Code of Conduct’s subject matter overlaps strongly with obligations

appearing in binding regimes. The official code includes actions on identifying, evaluating, and mitigating risks across the AI lifecycle; publishing transparency reports; keeping documentation up to date; reporting evaluations of safety, security, and societal risks; documenting capabilities and limitations; discussing risks such as bias, discrimination, privacy, and fairness; and disclosing governance and risk-management policies.[5][6] These are factual overlaps with themes already visible in the EU AI Act, Colorado’s provider documentation rules, and NIST’s generative AI guidance.[5][6]

10. In February 2025, HAIP added a Reporting Framework that turns the Code into a repeatable disclosure mechanism. Japan’s official Reporting Framework page states that the framework was launched on 7 February 2025 as a direct outcome of the G7 Hiroshima AI Process.[7] OECD’s HAIP transparency page likewise states that the Reporting Framework provides a standardised structure for organizations to report on their alignment with the Hiroshima Code of Conduct.[8] This is important because it moves the process from high-level principles to an operational reporting tool.

11. The Reporting Framework is no longer limited only to developers; it is open across the AI value chain. OECD states that the Hiroshima AI Reporting Framework is open to organizations across the AI value chain, including developers, deployers, and providers of advanced AI systems.[8] This expands the framework beyond its original title focus on organizations “developing” advanced AI systems and makes it relevant to the provider/deployer split used in the main report.[8]

the main report. [8] https://oecd.ai/en/transparency/overview

12. The first reporting cycle produced a measurable disclosure dataset. OECD states that the first round of the Hiroshima AI Process Reporting Framework resulted in 25 reports.[8] OECD’s September 2025 publication How are AI developers managing risks? presents preliminary insights from submissions by 20 organisations across diverse sectors and countries.[9][10] Together, these sources show that the Reporting Framework has already generated a body of comparable governance disclosures, even though it is voluntary.[8][9][10]

13. OECD has become the publication and analysis platform for HAIP transparency. OECD states that submitted Hiroshima reports will be published on the OECD AI Policy Observatory to promote transparency and support responsible development and use of AI.[8] OECD also published the 2025 analytical report on how AI developers manage risks based on Reporting Framework responses.[9][10] This gives OECD an operational role in cross-border AI governance beyond its earlier principles and incident-monitoring work.

14. The HAIP framework creates a practical international transparency channel for advanced AI organizations without waiting for binding law. Japan’s official page says participants reported internal benefits from engaging in the reporting process, including value as a transparency tool and as a mechanism for internal capacity-building and coordination.[7] Factually, this means the framework is serving not only as an external disclosure mechanism but also as an internal governance exercise for participating organizations.[7]

15. The HAIP transparency topics map closely onto the compliance artifacts firms are already being asked to produce in stricter jurisdictions. OECD’s 2025 HAIP report quotes Code-of-Conduct actions calling for transparency reports, technical management policies. [6][9] https://www.oecd.org/content/dam/oecd/en/publications/reports/2025/09/how-are-ai-developers-managing-risks_fbaeb3ad/658c2ad6-en.pdf https://oecd.ai/en/ai-publications/how-are-ai-developers-managing-risks-insights-from-responses-to-the-reporting-framework-of-the-hiroshima-ai-process-code-of-conduct This is relevant for global firms because these are the

documentation, evaluation details, model capabilities and limitations, discussion of societal and rights-related risks, red-teaming results, and governance/riskmanagement policies.[6][9] This is relevant for global firms because these are the same kinds of artifacts increasingly expected under the EU AI Act, U.S. enforcement/risk-management expectations, and standards-based governance frameworks.[6][8][9]

frameworks. [6][8][9] https://www.oecd.org/content/dam/oecd/en/publications/reports/2025/09/how-are-ai-developers-managing-risks_fbaeb3ad/658c2ad6-en.pdf https://oecd.ai/en/transparency/overview https://oecd.ai/en/ai-publications/how-are-ai-developers-managing-risks-insights-from-responses-to-the-reporting-framework-of-the-hiroshima-ai-process-code-of-conduct

16. UNESCO adds a different transnational layer focused on state readiness and implementation capacity. UNESCO states that its Recommendation on the Ethics of AI is a global normative framework, and UNDP/UNESCO materials describe UNESCO’s Readiness Assessment Methodology (RAM) as a tool directly linked to that Recommendation.[11][12] RAM evaluates a country’s AI ecosystem across multiple dimensions including legal and regulatory, social and cultural, economic, scientific and educational, and technological and infrastructural dimensions.[12] [13] This is complementary to law-focused analysis because it addresses how countries prepare governance capacity, not just whether they have enacted statutes.

17. UNESCO RAM is being used in concrete country processes in 2025–2026. Official and UN-linked materials show RAM consultations or reports in countries including the Philippines and Trinidad and Tobago, and UNESCO announced a 2026 workshop to unveil the Lao PDR RAM report.[11][13][14] This demonstrates that UNESCO’s AI governance influence is being operationalized through countrylevel assessment exercises, not only through broad ethics language.[11][13][14]

18. UNDP and UNESCO are explicitly packaging AI assessments as governance tools for governments. A joint UNDP-UNESCO document states that UNESCO RAM and UNDP’s AI Landscape Assessment are offered together as complementary support for governments, with RAM taking a deeper dive into the ethical dimensions of AI governance.[12] This creates a practical channel through which international organizations can shape how national governments diagnose regulatory gaps and prioritize future AI policy actions.[12]

19. These transnational instruments do not impose the same kind of direct firm- level liability as the EU AI Act or China’s administrative rules, but they still matter operationally. The Council of Europe treaty works through state implementation. [1][3] HAIP works through standardized voluntary disclosures by organizations.[7] [8] UNESCO RAM works through country-assessment and policy-capacity building.[12][13] Together, they show that a meaningful part of the global AI governance landscape now operates through treaty commitments, reporting frameworks, and diagnostic tools rather than only through statutes and enforcement actions.

20. Implication for the main report: the “global AI regulation patchwork” now has a transnational superstructure with three distinct functions. First, the Council of Europe Convention provides a binding international human-rights baseline for states.[1][2][3] Second, the G7 Hiroshima AI Process provides a voluntary but structured transparency and governance mechanism aimed especially at advanced AI organizations.[4][5][7][8] Third, UNESCO RAM provides a statereadiness and governance-capacity tool that can influence future domestic regulation.[11][12][13] These mechanisms are not substitutes for domestic law, but they are now concrete parts of the global AI governance architecture and help explain why some compliance concepts are converging internationally even while legal obligations remain fragmented.[1][8][12]

Sources:

[1] The Framework Convention on Artificial Intelligence (2026) https://www.coe.int/en/web/artificial-intelligence/the-framework-convention-onartificial-intelligence

[2] Chart of signatures and ratifications of Treaty 225 (2026) https://www.coe.int/en/web/Conventions/full-list?module=signatures-bytreaty&treatynum=225

[3] Council of Europe Convention on Artificial Intelligence - eucrim (2024) https://eucrim.eu/news/council-of-europe-convention-on-artificial-intelligence

[4] Hiroshima AI Process (2026) https://www.soumu.go.jp/hiroshimaaiprocess/en/index.html

[5] Hiroshima Process International Code of Conduct for Organizations Developing Advanced AI Systems (2023) https://g7g20- documents.org/database/document/2023-g7-japan-leaders-leaders-annexhiroshima-process-international-code-of-conduct-for-organizations-developingadvanced-ai-systems

[6] How are AI developers managing risks? (OECD PDF) (2025) https://www.oecd.org/content/dam/oecd/en/publications/reports/2025/09/howare-ai-developers-managing-risks_fbaeb3ad/658c2ad6-en.pdf

[7] Reporting Framework | Hiroshima AI Process (2025) https://www.soumu.go.jp/hiroshimaaiprocess/en/report.html

[8] HAIP Reporting Framework - OECD.AI (2025) https://oecd.ai/en/transparency/overview

[9] How are AI developers managing risks? Insights from responses to the reporting framework of the Hiroshima AI Process Code of Conduct (2025) https://oecd.ai/en/ai-publications/how-are-ai-developers-managing-risksinsights-from-responses-to-the-reporting-framework-of-the-hiroshima-aiprocess-code-of-conduct

[10] Ethics of Artificial Intelligence - UNESCO (2026) https://www.unesco.org/en/artificial-intelligence/recommendation-ethics

[11] Artificial Intelligence Assessments (UNDP-UNESCO) (2024) https://www.undp.org/sites/g/files/zskgke326/files/2024-12/undp-unesco-offerweb-7-aug-2024.pdf

[12] UNESCO AI Readiness Assessment Report: Anchoring Ethics in AI Governance in the Philippines (2024) https://philippines.un.org/en/306159-unesco-aireadiness-assessment-report-anchoring-ethics-ai-governance-philippines

[13] UNESCO AI Readiness Assessment Methodology (RAM) - Consultation Sessions (2025) http://mpaai.gov.tt/news/unesco-ai-readiness-assessmentmethodology-ram-consultation-sessions

[14] Lao PDR to unveil UNESCO AI Ethics Readiness Assessment report at national workshop (2026) https://www.unesco.org/en/articles/lao-pdr-unveil-unesco-aiethics-readiness-assessment-report-national-workshop

Research 6:

Additional angle selected: Adversarial research — identifying facts that materially qualify or contradict elements of the current report.

1. Colorado’s regime changed materially from the original SB 24-205 baseline. SB 24-205 was the first broad U.S. high-risk AI law, with developer/deployer duties and obligations originally scheduled for 1 February 2026 (later delayed to 30 June 2026). Official Colorado legislative materials for SB26-189 state that the act repeals and reenacts those provisions with new requirements regarding the use of automated decision-making technology in consequential decisions, and that developer obligations start 1 January 2027.[1] The body of this report reflects the revised SB26-189 regime rather than the original SB 24-205 framework.

2. Colorado’s revised law is narrower and more disclosure-focused than the original SB 24-205. Colorado’s bill page states the reenacted law requires developers of covered ADMT to provide deployers with technical documentation on intended uses, categories of training data, known limitations, and instructions for appropriate use and human review, starting 1 January 2027.[1] Secondary analyses report that the 2026 amendment removed the original duty of care, deployer risk-management program requirement, impact-assessment requirement, and certain AG reporting duties.[2][3] If accurate, this means the current report overstates Colorado’s 2026 compliance burden for deployers and overstates convergence with the EU model.[1][2][3]

3. The practical U.S. “highest burden for deployers” ranking in the current report may need revision because Colorado’s deployer burden was scaled back. After SB26-189, the remaining Colorado regime is centered more on documentation transfer, consumer notice, adverse-decision explanation, and human reviewrelated rights than on the original ex ante risk-management architecture.[1][2][3] This weakens the report’s conclusion that Colorado is the clearest U.S. analogue to the EU’s high-risk deployer regime.[1][2][3]

4. Colorado’s key date is 1 January 2027 under SB26-189. The earlier SB 24-205 schedule (originally 1 February 2026, later delayed to 30 June 2026) was superseded; official Colorado materials for SB26-189 specify that the new developer obligations begin 1 January 2027, which is the date used in the body of this report.[1]

this report. https://leg.colorado.gov/bills/sb26-189 [1]

5. California’s ADMT rules are more staggered than the current report suggests. The CPPA’s official September 2025 announcement states the regulations were approved by the Office of Administrative Law and that businesses subject to risk assessment requirements must begin compliance by 1 January 2026, but that there is additional time for some requirements, including ADMT.[4] Secondary legal summaries report that businesses using ADMT to make significant decisions must comply with the ADMT requirements beginning 1 January 2027, and that risk-assessment submission information is due beginning 1 April 2028 for larger businesses.[5][6] This qualifies any impression that California’s deployer-facing ADMT obligations broadly began in 2026; the timeline is phased and some ADMT duties begin later.[4][5][6]

6. California’s final ADMT rules are narrower than many broad “AI law”

descriptions imply. Secondary summaries of the final CPPA rules state they apply when technology replaces or substantially replaces human decision-making and are limited to certain “significant decision” contexts, with explicit references to artificial intelligence removed from the final text compared with earlier drafts.[6] This qualifies the report’s framing of California as moving toward an EU/Coloradostyle regime: some functional convergence exists, but the final rule is narrower and privacy-law based rather than a broad AI statute.[4][6]

7. South Korea’s regime is more operationalized than the current report indicates because the Enforcement Decree also took effect. The U.S. International Trade Administration states that South Korea’s AI Basic Act and its Enforcement Decree took effect on 22 January 2026.[7] The current report mentions the Act’s effective date and notes that implementing posture remains to be observed, but the existence of an effective decree means South Korea has moved beyond statute-only status.[7]

8. Draft-decree materials show South Korea’s implementation details include domestic-agent obligations and more specific transparency methods. Kim & Chang’s analysis of the draft Enforcement Decree states it includes provisions on methods for implementing transparency obligations for generative and highimpact AI business operators, criteria for defining high-performance AI, standards for determining high-impact AI, and the scope of operators required to designate a domestic agent.[8] This suggests South Korea’s regime may impose more concrete operational requirements on foreign providers than the current report captures.[7][8]

captures. [7][8] https://www.trade.gov/market-intelligence/south-korea-ai-basic-act https://www.kimchang.com/en/insights/detail.kc?sch_section=4&idx=32909

9. The UK still lacks a cross-sector AI law, but parliamentary materials show the issue remains active and unresolved rather than settled. A 2026 House of Lords Library briefing says the UK government’s approach remains based on the 2023 white paper’s sector-led framework and discusses debate on whether crosssector AI legislation is needed.[9] This does not contradict the report’s statement that the UK has no comprehensive AI Act, but it does qualify any inference that the issue is dormant; cross-sector legislation remains under active parliamentary debate.[9]

10. Brazil remains without an enacted AI law, but current materials confirm the center of gravity has shifted to the Chamber of Deputies after Senate approval. Recent Brazil-focused materials state that PL 2338/2023 was approved in the Senate and is currently being processed by the House of Representatives (Chamber of Deputies).[10][11] This supports the report’s classification of Brazil as still pending, but it qualifies the procedural status: the bill is no longer merely an undifferentiated congressional proposal; it has passed one chamber and is in the next.[10][11]

(Chamber of Deputies) . https://www.demarest.com.br/en/inteligencia-artificial-reacende-debates-na-camara-dos-deputados [10][11] https://www.sidi.org.br/en/blog/the-impacts-of-regulating-artificial-intelligence-in-brazil This supports the report’s classification of Brazil as

next. https://www.demarest.com.br/en/inteligencia-artificial-reacende-debates-na-camara-dos-deputados [10][11] https://www.sidi.org.br/en/blog/the-impacts-of-regulating-artificial-intelligence-in-brazil

11. Industry and stakeholder sources are openly contesting the EU GPAI

implementation path, especially around clarity and burden. CCIA Europe stated in July 2025 that the final GPAI Code of Practice still imposed a “disproportionate burden” and that key AI Office guidance was still missing.[12] ITI likewise reacted publicly to the code’s publication.[13] These are not official legal changes, but they are concrete evidence that an important stakeholder constituency disputes whether the EU’s implementation machinery is currently delivering clarity. This qualifies the current report’s portrayal of the EU implementation layer as a coherence-enhancing architecture; it may also be experienced as a source of uncertainty and burden by affected providers.[12][13]

12. The EU GPAI code is voluntary, and non-signatories do not automatically get a compliance presumption. Wharton’s summary of the July 2025 code states that providers choosing not to sign the Code still must meet the AI Act’s legal requirements, but without the benefit of a presumption of compliance.[14] This fact sharpens the provider-side burden analysis: the code is not itself binding law, yet it functionally creates a two-track environment between signatories and nonsignatories.[14]

13. There was visible mid-2025 uncertainty around possible EU AI Act timing relief before the later targeted extension was formalized. Reporting cited strong industry calls for delay and noted missed deadlines for guidance on high-risk systems.[15][16] While the Commission’s current page now reflects a targeted extension for high-risk AI embedded in regulated products, the documented delay debate and missed-guidance deadlines qualify any claim that EU implementation has been smooth or fully synchronized.[15][16]

14. No evidence was found in this search set of a binding UAE federal omnibus AI law, despite some public claims online. More credible regulatory trackers continue to state that the UAE does not have a specific standalone AI law and instead relies on strategies, ethical frameworks, data-protection laws, and freezone regimes such as DIFC Regulation 10.[17][18] This supports the current report against contrary internet claims and is a useful adversarial check.

zone regimes such as DIFC Regulation 10. [17][18] https://www.twobirds.com/en/capabilities/artificial-intelligence/ai-legal-services/ai-regulatory-horizon-tracker/uae https://uaelegislation.gov.ae/en/policy/details/uae-s-international-stance-on-artificial-intelligence-policy This supports the current report

provider/deployer analysis are now partly outdated. [1][2][3] https://leg.colorado.gov/bills/sb26-189 https://www.hunton.com/privacy-and-cybersecurity-law-blog/colorado-ai-act-amended-and-effective-date-delayed https://www.hklaw.com/en/insights/publications/2026/05/colorado-governor-signs-sb-189 - The strongest factual staggered than broad summaries imply. https://cppa.ca.gov/announcements/2025/20250923.html [4][5][6] https://www.hunton.com/privacy-and-cybersecurity-law-blog/newly-approved-ccpa-regulations-have-staggered-deadlines-for-compliance https://www.coblentzlaw.com/news/california-finalizes-ccpa-regulations-on-automated-decision-making-technology-risk-assessments-and-cybersecurity-audits - A second important qualification is

Bottom line from the adversarial lens: - The strongest factual contradiction to the current report is Colorado: the original AI Act framework was significantly revised and delayed, so the report’s Colorado timeline, burden characterization, and provider/deployer analysis are now partly outdated.[1][2][3] - The strongest factual qualification is California: the CPPA ADMT regime is real but narrower and more staggered than broad summaries imply.[4][5][6] - A second important qualification is South Korea: the regime is more concrete than the report suggests because the Enforcement Decree is already in effect.[7][8] - A third important qualification is EU implementation: the architecture is real, but stakeholder evidence shows that parts of it

The Global AI Regulation Patchwork Sakana Marlin

remain contested and were accompanied by missed-guidance deadlines and timing uncertainty.[12][13][15][16]

Sources mapping: [1] Colorado General Assembly SB26-189 bill page; [2] Hunton Andrews Kurth analysis of signed SB 189; [3] Holland & Knight analysis of SB 189; [4] CPPA official announcement; [5] Hunton summary of final California deadlines; [6] Coblentz summary of narrowed ADMT rule; [7] U.S. International Trade Administration on Korea AI Basic Act; [8] Kim & Chang on draft Enforcement Decree; [9] UK House of Lords Library briefing; [10] Demarest on PL 2338/2023 in Chamber; [11] SIDI summary of Senate approval and Chamber progression; [12] CCIA Europe statement; [13] ITI reaction; [14] Wharton summary of GPAI code effects; [15] IAPP report on missed EU guidance deadline; [16] Inside Global Tech on mid-2025 delay debate; [17] Bird & Bird UAE AI regulatory horizon tracker; [18] UAE legislation portal policy page.

Sources:

[1] SB26-189 Automated Decision-Making Technology (2026) https://leg.colorado.gov/bills/sb26-189 [2] Colorado AI Act Amended and Effective Date Delayed (2026) https://www.hunton.com/privacy-and-cybersecurity-law-blog/colorado-ai-act- amended-and-effective-date-delayed [3] Colorado Governor Signs SB 189, Significantly Amending the State's AI Law (2026) https://www.hklaw.com/en/insights/publications/2026/05/colorado- governor-signs-sb-189 [4] California Finalizes Regulations to Strengthen Consumers' Privacy (2025) https://cppa.ca.gov/announcements/2025/20250923.html [5] Newly Approved CCPA Regulations Have Staggered Deadlines for Compliance (2025) https://www.hunton.com/privacy-and-cybersecurity-law-blog/newly- approved-ccpa-regulations-have-staggered-deadlines-for-compliance [6] California Finalizes CCPA Regulations on Automated Decision-Making Technology, Risk Assessments, and Cybersecurity Audits (2025) https://www.coblentzlaw.com/news/california-finalizes-ccpa-regulations-on- automated-decision-making-technology-risk-assessments-and-cybersecurity- audits [7] South Korea AI Basic Act (2026) https://www.trade.gov/market- intelligence/south-korea-ai-basic-act [8] The MSIT Releases Draft Enforcement Decree of the AI Basic Act (2025) https://www.kimchang.com/en/insights/detail.kc?sch_section=4&idx=32909 [9] AI regulation in the UK: Debate on the need for cross-sector legislation (2026) https://lordslibrary.parliament.uk/ai-regulation-in-the-uk-debate-on-the-need-for-

cross-sector-legislation

[10] Artificial intelligence reignites debates in the Brazilian House of Representatives (2025) https://www.demarest.com.br/en/inteligencia-artificialreacende-debates-na-camara-dos-deputados

[11] PL 2338/2023: the impacts of regulating Artificial Intelligence in Brazil (2026) https://www.sidi.org.br/en/blog/the-impacts-of-regulating-artificial-intelligencein-brazil

[12] AI Act: EU’s Final GPAI Code Imposes Disproportionate Burden, Improvements Required (2025) https://ccianet.org/news/2025/07/ai-act-eus-final-gpai-codeimposes-disproportionate-burden-improvements-required

[13] ITI Reacts to Publication of AI Act GPAI Code of Practice (2025) https://www.itic.org/news-events/news-releases/iti-reacts-to-publication-of-aiact-gpai-code-of-practice

[14] EU AI Act Update: What the New Code of Practice Means for Business (2025) https://ai-analytics.wharton.upenn.edu/wharton-accountable-ai-lab/eu-ai-actupdate-what-the-new-code-of-practice-means-for-business

[15] European Commission misses deadline for AI Act guidance on high-risk systems (2025) https://iapp.org/news/a/european-commission-misses-deadlinefor-ai-act-guidance-on-high-risk-systems

[16] European Commission hints at delaying the AI Act (2025) https://www.insideglobaltech.com/2025/06/12/european-commission-hints-atdelaying-the-ai-act

[17] AI Regulatory Horizon Tracker - United Arab Emirates (2026) https://www.twobirds.com/en/capabilities/artificial-intelligence/ai-legalservices/ai-regulatory-horizon-tracker/uae

[18] UAE's International Stance on Artificial Intelligence Policy (N/A) https://uaelegislation.gov.ae/en/policy/details/uae-s-international-stance-onartificial-intelligence-policy