The AI rules and official guidance that may affect how organisations use AI, by region: what each one is, when it applies and what to consider.
BuildAIPolicy Research · 13 entries · Last checked 27 October 2026
Organisations covered by the Privacy Act must describe in their privacy policy when computer programs, including AI, make or help make decisions that could significantly affect people, using their personal information.
The Australian Government's National AI Plan confirmed there will be no standalone AI Act and that the proposed mandatory guardrails for high-risk AI won't be introduced. AI is regulated through existing laws, such as privacy, consumer, workplace and online safety law, with changes considered where gaps appear. A national AI Safety Institute is being set up.
The National AI Centre's Guidance for AI Adoption sets out six governance practices for organisations using AI. It effectively replaces the earlier Voluntary AI Safety Standard and its ten guardrails. It is voluntary.
The UK GDPR's rules on automated decisions changed. The general prohibition now applies only to significant decisions based entirely or partly on special category data. For other significant automated decisions using personal data, safeguards apply, such as telling people and letting them contest the decision. Organisations must also be able to handle data protection complaints directly, from 19 June 2026.
High-risk AI systems listed in Annex III, such as those used in employment, credit, education and access to essential services, will have to meet requirements including risk management, human oversight and documentation. Deployers have their own duties, such as following instructions for use and monitoring the system.
People must be told when they interact with an AI system such as a chatbot, unless it's obvious, and AI-generated content such as deepfakes must be disclosed. Providers of generative AI already on the market before 2 August 2026 have until 2 December 2026 to mark its outputs.
Regulation (EU) 2026/1744 amended the AI Act. Obligations for high-risk AI listed in Annex III (such as AI in hiring or credit) now apply from 2 December 2027, and for AI in regulated products (Annex I) from 2 August 2028. It also adds a ban on AI that creates non-consensual intimate images or child sexual abuse material, from 2 December 2026.
Certain AI practices, such as manipulative techniques and some uses of biometric categorisation, have been banned since 2 February 2025. Providers and deployers of AI systems must also take measures to support AI literacy among their staff (Article 4, as amended by the 2026 Digital Omnibus).
SB 26-189, signed on 14 May 2026, repeals and replaces the Colorado AI Act before it took effect. Deployers will have to tell people before automated decision-making technology materially influences a consequential decision, explain adverse outcomes on request, allow data correction and offer human review. Enforcement depends on the Attorney General's rulemaking.
The California Privacy Protection Agency's regulations took effect on 1 January 2026. Businesses that use automated decisionmaking technology to make significant decisions about consumers must meet the ADMT requirements from 1 January 2027. Risk assessment requirements began on 1 January 2026.
TRAIGA bans certain uses of AI by anyone, such as AI intended to encourage self-harm or crime, or to unlawfully discriminate. Government agencies must tell people when they interact with AI, and health care providers must disclose AI use in treatment. The Texas Attorney General enforces it; there's no private right of action.
Executive Order 14365 directs federal agencies to challenge state AI laws and to prepare a federal framework that would override them. No federal law overriding state AI laws has been passed, so state laws remain in force unless a court, Congress or the state changes them.
Organisations must tell users in advance when a product or service uses generative or high-impact AI, and label AI-generated content. High-impact AI, such as AI used in hiring or healthcare, carries extra duties including explanation, human oversight and documentation. The government has said fines won't be imposed for the first year.
A general summary of public information, checked against the sources listed on the date shown. It isn't legal advice and may not cover every rule that applies to you. Check the sources, and get professional advice for your situation.
