AI Regulation Reference
AI Law Tracker
35 laws tracked across the EU, US federal government, US states, UK, and international bodies — filtered and explained for small teams.
What changed this month
Dated changes from the last 31 days, each linked to the primary source.
US Federal: The FCC's revised TCPA consent-revocation rule was published in the Federal Register, effective November 25, 2026. Callers can name one exclusive opt-out method and limit an opt-out to one category of informational calls or texts.
Source: Federal Register 2026-21821
US Federal: The SEC's Division of Examinations published its fiscal 2027 priorities. The AI section now names AI-generated phishing and deepfake voice and video, and covers AI in identity theft programs.
Source: SEC press release 2026-109 · Our guide
Texas: Attorney General Ken Paxton sued OpenAI and Sam Altman under the Texas Deceptive Trade Practices Act.
Source: Texas Attorney General · Our guide
Florida: Attorney General James Uthmeier proposed the Safe Screens Act: age checks in app stores and limits on AI chatbot features for minors.
Source: Florida Attorney General · Our guide
US Federal: CISA, Canada's Cyber Centre and three other Five Eyes agencies published voluntary guidance on managing AI token consumption, including denial-of-wallet attacks and 70/80/90% quota alerts.
Source: CISA
South Korea: The Fair Trade Commission released draft guidelines on AI claims in advertising, open for comment until November 11.
Source: Korea Fair Trade Commission · Our guide
US Federal: A DHS order under the Federal Acquisition Supply Chain Security Act excluding DeepSeek products and services was published in the Federal Register.
Source: Federal Register 2026-21447 · Our guide
EU: The Commission opened feedback on the AI Act implementing act under Articles 75c and 75d: access to the file, procedural safeguards and limitation periods for penalties. Feedback until November 9.
Showing 4 of 35 laws
The world's first comprehensive AI law, classifying AI systems by risk level and imposing obligations that scale with risk. High-risk AI systems must undergo conformity assessment, maintain documentation, and implement human oversight. Under Regulation (EU) 2026/1744, obligations for Annex III high-risk systems now apply from December 2, 2027, moved back from August 2, 2026.
Effective: August 1, 2024
The EU's foundational data privacy law, governing how organizations collect, process, and store personal data of EU residents. Article 22 restricts solely automated decision-making that significantly affects individuals, with direct implications for AI-driven decisions.
Effective: May 25, 2018
The updated EU product liability framework extends liability to software and AI, allowing injured people to seek compensation when defective AI systems cause harm. National law can no longer limit liability with financial ceilings, and courts can presume defectiveness in certain cases. It applies to products placed on the market after December 9, 2026, which is also the deadline for member states to transpose it. Older products stay under the previous rules.
Effective: December 9, 2026
On September 25, 2024 the European Commission announced that more than 100 companies had signed the EU AI Pact, a voluntary programme run ahead of the AI Act's full application. Signatories commit to three core actions: an AI governance strategy, mapping of AI systems likely to be high-risk under the AI Act, and AI literacy for staff. More than half also made further pledges such as human oversight, risk mitigation and labelling of deepfakes. It is not legally binding, and companies can join at any moment until the AI Act fully applies.
Effective: September 25, 2024
Status guide
Unfamiliar terms?
Conformity assessment, GPAI model, high-risk AI — all defined in plain English.
Browse the glossary →