Global AI law: 8 common threads

About this documentUpdated 2026-09-18ShowHide

Sean McDermott, Co-Founder and CEO, UnGovr

Written by Sean McDermott (with AI assistance) using the LexLint law library, which supplied every legal instrument, status and date on these pages.

Every law named here links to its summary page on lexlint.org, translated to English (if needed) and restructured to a standard format for human and code use. Every case links to the court's or the regulator's own record where one could be reached.

© 2026 UnGovr, publishing as LexLint. The text, the figures and the theme-register file are licensed under Creative Commons Attribution-NonCommercial 4.0: share and adapt them for noncommercial purposes with credit to LexLint (UnGovr). Please contact LexLint at hello@ungovr.org to discuss commercial use. Logos and wordmarks belong to their owners.

Corpus figures as of 2026-09-18.

What the AI laws in force around the world have in common, the unusual provisions that trip an agent, the older privacy, security and scraping law that already binds one, where the new law restates the old, and why an EU-compliant system still has twenty-seven national layers to read.

1Why this paper, and who it is for

Three readers are in mind. A governance working group mapping regulatory alignment across jurisdictions, which needs a baseline of binding law to map against. Anyone who has to decide what "compliant" should mean for an AGENT, and who might reasonably assume it boils down to the EU AI Act and a handful of other acts, when the LexLint software-law corpus holds 295 AI instruments in force or enacted across 130 jurisdictions, and far more law that binds an AGENT without naming AI at all. And the engineer writing agentic software today, who wants to know which of the things the AGENT does are legal events, and where.

The paper is a summary, not an analysis of any system. It states the law as the LexLint software-law corpus held it on 2026-09-18, and it analyses only law in force or enacted with a commencement date; a proposal is named, if at all, as something coming. The larger the reach of an instrument, the more room it gets, so the EU and the United States lead most sections and a city ordinance appears once. The vocabulary is the one in Introduction: The 6 parties in AI law: the parties around a piece of software, each with a location, and an AGENT in the middle acting on most of them at once. This paper attaches the statutes to that picture.

A word on the source. LexLint is a law library first, indexed by jurisdiction and dated on every row, and it is also a tool: a lint that takes a description of what a piece of software does and where it runs and returns the obligations that apply, cited and dated, so the library can be used as background when a system is examined for legal risk. For a project that provides deep infrastructure to an application, an AGENT proxy or a runtime, that examination is harder, because the project cannot know what its USERs will do with it. What such a project can do is support the legal questions of its USERs, by giving its logs and its controls some awareness of the facts the law turns on. The fourth document in this section is about that.

2The map: what "AI law" is, by shape and by place

AI law is not one shape. Read across the LexLint software-law corpus, the instruments in force that name AI as their subject fall into six kinds, and an AGENT meets each kind differently.

By place, the LexLint software-law corpus holds AI instruments in the regions below. The count is of instruments the corpus holds in force or enacted, which is a measure of law rather than of any one country's attention; the largest single share is the American states' own statute books, and the largest single instrument is the EU's.

Every AI instrument the LexLint software-law corpus holds in force or enacted is listed in the appendix at the end of this page, by region, each linked to its summary page.

The zero on the United States' federal row is a finding rather than a gap. Congress has enacted no horizontal AI act, and the two federal AI instruments the corpus holds are both proposals, so neither is counted here. It does not mean no federal law reaches generated content: the TAKE IT DOWN Act criminalises publishing intimate images a system generated, and people have been prosecuted under it. The corpus files that statute under privacy rather than AI, which is why it is absent from this table and present in Does legal action really happen?. Read the row as "no federal AI statute", never as "no federal law".

3What the laws have in common

Eight threads run through most of the AI law in force. An engineer who builds for the threads rather than for any one statute will find that most statutes are then a matter of parameters.

Tell the person they are dealing with a machine

The most widely shared duty, and the oldest of the new ones. AI Act Article 50 requires it of any system that interacts with people unless it is obvious from context; Korea's Article 31 requires prior notice that a service runs on generative AI; Texas, Utah and California's 2019 bot-disclosure act each say it in their own terms, and California's companion chatbot act adds a duty to repeat the reminder to a minor. The differences are in the trigger (always, on request, at first use, on a schedule) and in who owes it (provider, deployer, OPERATOR).

Mark what the machine made

A second duty attaches to the output rather than the interaction: machine-readable marking of synthetic audio, image, video and text. It is in Article 50(2), in India's rules, which require permanent metadata with a unique identifier, in Vietnam's transparency article, and in California's AI Transparency Act. For an AGENT the consequence is architectural: the mark has to be applied where the output is produced and preserved by every layer that carries it.

Tier by risk, with a prohibited top

The horizontal acts share a shape: a list of prohibited practices, a class of high-risk or high-impact uses with the heaviest duties, and a lighter regime for the rest. Vietnam and Peru both open with prohibitions; Texas's TRAIGA is almost entirely a list of them, binding any person. Prohibition is how the law tiers: the LexLint software-law corpus's AI instruments carry more prohibition lines than any other class.

Keep a person able to intervene, and give affected people a way to one

Human oversight appears in two forms: a duty on the OPERATOR to keep a person able to stop or override the system, and a right for the person affected by a decision to reach a human and contest it. The second form is older than AI law and arrives mostly through privacy statutes (section 5). The first is the AI Act's Article 14, Vietnam's rule that oversight mechanisms must not be disabled, and Peru's bar on autonomous lethal capability without supervision.

Keep records, and be able to explain

Record-keeping comes in three registers: automatic event logs for high-risk systems (the AI Act's Article 12, with a six-month retention floor on deployers in Article 26), an explanation to the person affected by a decision (Peru, California's regulations), and documentation kept for a regulator (Article 53, California's frontier act). The logging and record-keeping questions a governance framework asks are these three duties, seen from the OPERATOR's side.

Assign duties by role along a chain

The AI Act names a provider, a deployer, an importer, a DISTRIBUTOR, an authorised representative and a product manufacturer for one system, a seventh role for general-purpose model providers, and a rule in Article 25 under which a deployer, DISTRIBUTOR or importer becomes the provider by putting its name on a high-risk system, substantially modifying it, or changing a system's purpose so that it becomes high-risk. Korea's act keys on the "AI business operator"; the United States state acts on the "deployer" and the "developer". One company usually holds three of these roles at once, and the role, not the code, decides the duty.

Reach by market and by output, not by where the server is

The AI Act reaches a provider anywhere that places a system on the EU market and a provider or deployer anywhere whose output is used in the Union. State acts reach a company that does business in the state when the consumer is a resident. Korea's act reaches acts abroad that affect its market. The server's location is the one fact none of them turns on.

Commence in stages, and change while in flight

The AI Act applies in dated stages from 2025-02-02 to 2028-08-02, and the omnibus regulation of July 2026 moved the high-risk stages back by more than a year while leaving the transparency duties on their August 2026 date. Colorado enacted an AI act in 2024, delayed it in 2025, and repealed and re-enacted it in 2026 before a line of it applied, as an automated-decision act that applies from 2027-01-01. A map of AI law is a dated artefact, and a system that reads the map once is out of date the month after. More is coming: Brazil's framework bill has passed its Senate, and several EU member states have implementing acts in draft (section 7).

4Provisions that are unusual, and awkward for an AGENT

The common threads are what a framework captures. The provisions below are the ones a framework does not, because each is one jurisdiction's own idea, and each lands on something an AGENT does routinely. The EU comes first, then the United States by state, then the rest of the world by name.

5The law that was already there

Most attention is on the AI statutes, and above all on the EU AI Act. But the LexLint software-law corpus holds far more law that binds an AGENT without naming AI at all. Privacy law is the largest topic in it, scraping and access law the second, and both are older than any AI act. The table under each heading gives the duty family, an instrument in the corpus, and what the duty asks of an AGENT in particular.

5.1 Privacy law: the AGENT as a processor of people

787 instruments in force or enacted, across 235 jurisdictions. Every one of them keys on a person whose data is in the payload, which for an AGENT is nearly every payload.

5.2 Cybersecurity law: the AGENT as a product and as an incident

5.3 Scraping, access and content law: the AGENT as a visitor on other people's machines

498 instruments in force or enacted, across 245 jurisdictions. This is the body of law an AGENT meets every time it fetches a page, calls an interface it was not invited to, or reuses what it found.

5.4 Consumer, contract and outreach law: the AGENT as a contracting party's instrument and as a caller

5.5 Sector and people-specific law

6Where the AI laws restate what was already required

Read against section 5, a large share of the new AI law is a restatement or a refinement of a duty the same jurisdiction already had, aimed at a new class of system. That is good news for an engineering team, because a control built for the old duty is usually most of the new one. The table pairs them.

7The EU: "AI Act compliant" is not "compliant in the EU"

The AI Act is a regulation, directly applicable in every member state, and that has led to a habit of treating it as the whole of EU AI law. It is not, for two reasons the LexLint software-law corpus makes visible.

First, the Act leaves to each member state the designation of its market surveillance and notifying authorities, the procedure they follow, the penalties within the Act's ranges, and the treatment of public bodies. Those choices are national statutes, and they differ: which authority a provider answers to, what powers it has, whether a public body can be fined and by how much, and how the prohibitions in Article 5 are enforced. A system that is compliant with the Act has to be compliant with it in front of a named authority under a named procedure, and there are twenty-seven of those.

Implementing acts are in draft in Spain, Luxembourg, Netherlands, Sweden, Slovakia; they are not analysed here.

Second, member states keep their own law on what AI systems produce and how they are used at work, and that law is not displaced by the Act. Italy's Law 132 of 2025 requires parental consent for under-fourteens, sets sector rules for oversight and disclosure, and creates a criminal offence for disseminating harmful generated content. France, Ireland, the Netherlands and most other member states have extended their intimate-image and child-abuse offences to generated material. Spain gives works councils a right to the parameters of algorithms that affect working conditions. None of this is in the AI Act, all of it binds an AGENT operating in that country, and the omnibus regulation of July 2026 changed none of it.

The practical reading: EU compliance for an AGENT is the Act, plus the implementing act of every member state whose market it is placed on or whose residents' output it produces, plus that state's own criminal, labour and consumer law on synthetic content and automated management. The LexLint corpus documents the national layer on each member state's page rather than restating the Act there; the Act is one instrument, held once.

8How the law reaches the AGENT

Put the statutes onto the second figure of the parties document, and each line out of the AGENT's box collects a family of law. The table is the whole paper in one place.

One AGENT, six instruments

Take an AGENT operated by a company whose main establishment is in the United States, offered to consumers in Ireland and Virginia, built on a general-purpose model its provider placed on the EU market, that answers questions by fetching pages from a German publisher and stores USER prompts that sometimes include the USER's location. Six instruments reach it, each through a different party.

Swap the Irish USER for one in Seoul and the AI rows change to Korea's Article 31; swap Virginia for Texas and the privacy row becomes Texas's sensitive-data consent. Nothing about the OPERATOR changed. One field in the request did, which is why the applicability question is answered per transaction from facts the AGENT either recorded or lost.

What a control on the request path can do about it

Of the requirement lines in force that an independent classification has reached (2,286 on 2026-09-18), 47% can be prevented by a control on the request path (refuse a destination, require a claim, transform a payload), 16% can be detected there but are discharged in the application's interface or process, 8% are performed elsewhere with the control's record as the evidence, and 28% never cross the request path at all: lawful basis, conformity assessment, registration, contracts. By topic the pattern is sharp: scraping law is overwhelmingly enforceable at the edge, AI law is mostly detectable, since its disclosure and marking duties close in the interface, and the out-of-path share of privacy law is what has to be staffed rather than engineered. A control that sits in the enforceable tier is a technical measure, not a finding that the duty is met.

9What it costs

The enforcement examples this paper would otherwise carry are in their own document, Does legal action really happen?, each starting from an ordinary product feature and ending in a figure with its primary source. The LexLint corpus also records the enforcement climate of a regime where a regulator or a tracker publishes one; the figures below, read on the date shown, say the powers are used.

10What this paper does not claim

It does not say which of these instruments binds any particular system; that is decided per deployment from the roles the system's OPERATOR holds and where its parties are. It analyses law in force or enacted on the date the LexLint software-law corpus was read, and a law that moved after it may have moved the answer. The appendix is a list of what the corpus holds, not a census of the world's law. Nothing here is legal advice.

Appendix: every AI instrument in force or enacted, by region

Read from the LexLint software-law corpus on 2026-09-18. Each name links to the summary page carrying its citation, status, commencement date and source.

European Union: 5 instruments in 1 jurisdictions

Jurisdiction	Instrument	Since / from	Asks of an app
European Union	AI Act, Article 50 (transparency obligations for AI systems and synthetic content)	2026-08-02	label generated content; disclose the use of ai
European Union	AI Act, Article 53 (obligations for providers of general-purpose AI models)	2025-08-02	disclose the use of ai; govern the system: policies, roles, assessments; respect text and data mining opt-outs
European Union	AI Act, Article 73 (reporting of serious incidents)	2026-08-02
European Union	Digital Services Act, Article 35(1)(k) (systemic risk mitigation, synthetic media marking)	2023-08-25	label generated content; govern the system: policies, roles, assessments; assess the impact on personal data first
European Union	Digital Services Act, Article 37 (independent audit of very large online platforms and search engines)	2023-08-25	govern the system: policies, roles, assessments; report to a regulator

EU member states (the national layer): 34 instruments in 22 jurisdictions

Jurisdiction	Instrument	Since / from	Asks of an app
Austria	StGB Section 207a(4)(4), Computer-Generated and Altered Child Sexual Abuse Material	2023-12-01	do not do the named thing
Cyprus	Intellectual Property and Related Rights Law, Articles 49-50 (Non-Consensual Deepfake Imitation Ban)	in effect
Czech Republic	Criminal Code Section 191a, Non-Consensual Identity-Based Pornographic Depiction	in effect	do not do the named thing
Czech Republic	Criminal Code Section 192, Child Pornography Including a Depiction of a Person Who Appears to Be a Child	in effect	do not do the named thing
Germany	Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act	2026-07-29	govern the system: policies, roles, assessments; report to a regulator
Denmark	Lov nr. 467 af 14. maj 2025, National Competent Authorities and Article 5 Enforcement	2025-08-02	do not do the named thing; govern the system: policies, roles, assessments
Spain	Estatuto de los Trabajadores Article 64.4.d), Algorithmic Management Works Council Information Right	2021-09-30
Finland	Laki eraiden tekoalyjarjestelmien valvonnasta, Act on the Supervision of Certain Artificial Intelligence Systems	2026-01-01	govern the system: policies, roles, assessments
Finland	Rikoslaki Chapter 20, Distribution and Possession of an Image Depicting a Child Sexually, Including Realistic Depictions	2023-01-01	do not do the named thing
France	Code Penal Article 226-8 as Amended, Existing Offense Extended to Algorithmically Generated Content	in effect	do not do the named thing
France	Code Penal Article 226-8-1, Non-Consensual Sexual Montage and Algorithmically Generated Sexual Content	in effect	do not do the named thing
Greece	Law 5321/2026, National AI Act Implementation Law	2026-07-20	label generated content
Croatia	Kazneni zakon Article 215a, Endangering Life and Property by an Artificial Intelligence System	2025-11-13	do not do the named thing
Hungary	Act LXXV of 2025 on the Domestic Implementation of the EU AI Regulation	in effect	govern the system: policies, roles, assessments
Hungary	Büntető Törvénykönyv (Criminal Code), Section 204(8), Realistic Depiction of a Non-Existent Person as Child Pornography	in effect	do not do the named thing
Ireland	European Union (Artificial Intelligence) (Designation) Regulations 2025	2025-07-25
Ireland	Harassment, Harmful Communications and Related Offences Act 2020, Intimate Image Offences	2021-02-10
Ireland	Regulation of Artificial Intelligence Act 2026	2026-07-31
Italy	Codice Penale Art. 612-quater, Illicit Dissemination of AI-Generated or AI-Altered Content	2025-10-10
Italy	Legge 132/2025 Art. 20, National AI Authorities (AgID and ACN)	2025-10-10
Italy	Legge 132/2025, Sector Human-Oversight and Disclosure Duties (Artt. 4, 11, 13)	2025-10-10
Lithuania	Criminal Code Art. 309(2), Dealing in Child Sexual Abuse Material Including Simulated Depictions	2025-02-01	do not do the named thing
Lithuania	Lithuanian Law Amendments Designating National Competent Authorities under the AI Act	in effect
Latvia	Krimināllikums Sections 90.1 and 90.2, Criminalization of Deepfake Election and State-Appointment Disinformation	2024-05-22	do not do the named thing
Malta	Artificial Intelligence (Designation of the Information and Data Protection Commissioner for the purposes of Regulation (EU) 2024/1689) Regulations, 2025 (L.N. 227 of 2025)	2025-10-10	limits on biometric use; govern the system: policies, roles, assessments
Malta	Artificial Intelligence Regulations, 2025 (L.N. 226 of 2025)	2025-10-10	govern the system: policies, roles, assessments
Netherlands	Wetboek van Strafrecht, art. 252, Sexual Imagery of an Apparent Minor (Virtual Child Sexual Abuse Material)	2024-07-01
Poland	Kodeks karny art. 202 § 4b-4c, Fabricated Child Sexual Abuse Material	in effect	do not do the named thing
Poland	Ustawa o systemach sztucznej inteligencji, Act on Artificial Intelligence Systems	2026-08-10	govern the system: policies, roles, assessments
Romania	Cod penal, Art. 374, Pornografia infantilă (Child Pornography, Including Simulated or Computer-Generated Depictions of Minors)	2016-05-23	do not do the named thing
Sweden	Brottsbalken 16 kap. 10 a-10 b §§, Child Pornography Offence (Barnpornografibrott)	2020-05-01	do not do the named thing
Slovenia	Kazenski zakonik (KZ-1, Criminal Code), Art. 176(3), Pornographic Material Involving a Minor's Realistic Likeness	in effect	do not do the named thing
Slovenia	Zakon o izvajanju uredbe (EU) o umetni inteligenci (ZIUDHPUI), AKOS Designation as AI Act Competent Authority	in effect	govern the system: policies, roles, assessments
Slovakia	Trestny zakon, Child Pornography Including Simulated and Deepfake Depictions	2006-01-01

United Kingdom: 1 instruments in 1 jurisdictions

Jurisdiction	Instrument	Since / from	Asks of an app
United Kingdom	Creating, or Requesting the Creation of, Purported Intimate Image of Adult	2026-02-06

United States, states: 177 instruments in 48 jurisdictions

Jurisdiction	Instrument	Since / from	Asks of an app
Alabama	Alabama Child Protection Act of 2024, AI-Generated Child Sexual Abuse Material	2024-10-01	do not do the named thing
Alabama	Distribution of Materially Deceptive Media to Influence an Upcoming Election	2024-10-01	label generated content; disclose the use of ai
Alabama	SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization	2026-10-01	govern the system: policies, roles, assessments; disclose the use of ai; report to a regulator
Arkansas	Act 159 of 2025 (HB 1071), AI-Generated Replicas Amendment to Publicity Rights Act	in effect	do not do the named thing
Arkansas	Act 827 of 2025 (HB 1529), Unlawful Creation or Distribution of Deepfake Visual Material	in effect	do not do the named thing
Arkansas	Act 927 of 2025 (HB 1876), Generative AI Ownership of Model Training and Content	in effect
Arkansas	Act 977 of 2025 (HB 1877), AI-Generated Child Sexual Abuse Material Amendments	in effect	do not do the named thing
Arizona	AI-generated and indistinguishable depictions included in child-exploitation definitions (HB 2678)	in effect	do not do the named thing
Arizona	Deepfakes; candidate disclosure requirement and civil penalty	in effect
Arizona	Denial of claims; individualized review requirement	2026-07-01
Arizona	Digital impersonation of a candidate or other person (civil action)	2024-05-21
Arizona	Unlawful disclosure extended to AI-generated 'realistic pictorial representation' intimate images (SB 1462)	in effect	do not do the named thing
California	AB 730, as extended by AB 972, election deepfake disclosure law	2020-01-01	label generated content; do not do the named thing
California	AI Auditor Registry Act (AB 1405)	2029-01-01	hold a licence or registration; keep records for a set time; disclose the use of ai
California	Bolstering Online Transparency Act (SB 1001)	2019-07-01
California	CCPA Automated Decisionmaking Technology Regulations	2026-01-01	honour the person's rights over their data; assess the impact on personal data first; disclose the use of ai
California	California AI Transparency Act (SB 942, as amended by AB 853)	2026-08-02	label generated content; disclose the use of ai
California	Companion Chatbot Safety and Accountability Act (SB 243)	2026-01-01	disclose the use of ai; report to a regulator
California	Generative AI Training Data Transparency Act (AB 2013)	2026-01-01	disclose the use of ai
California	Healthcare AI Patient-Communication Disclosure Act (AB 3030)	2025-01-01	disclose the use of ai
California	Independent Verification Organizations Act (SB 813)	2027-01-01	govern the system: policies, roles, assessments; report to a regulator; hold a licence or registration; disclose the use of ai
California	Transparency in Frontier Artificial Intelligence Act (SB 53)	2026-01-01	disclose the use of ai; govern the system: policies, roles, assessments; report to a regulator
Colorado	HB 24-1147, Candidate Election Deepfake Disclosures	2024-07-01
Colorado	HB 26-1263 (2026), Conversational AI Service Operator Requirements	2027-01-01	label generated content; meet a design code; report to a regulator
Colorado	SB 26-189 (2026), Automated Decision-Making Technology Act	2027-01-01
Connecticut	AI Companion Chatbot Disclosure and Minor Safety Duties	2027-01-01
Connecticut	Automated Employment-Related Decision Technology Act	2026-10-01
Connecticut	Civil Action and Platform Takedown Duty for Synthetically Created Intimate Images	2026-10-01
Connecticut	Computer-Generated Child Sexual Abuse Material	2024-10-01
Connecticut	Employer AI-Related Layoff Disclosure to the Labor Department	2026-10-01
Connecticut	Frontier Developer Catastrophic-Risk Whistleblower Protections	2026-10-01
Connecticut	Generative AI Content Provenance Duty for Large Providers	2026-10-01
Connecticut	Subscription-Based AI Provider Disclosure Duty	2026-10-01
Connecticut	Unlawful Dissemination of an Intimate Synthetically Created Image	2025-10-01
Delaware	Child sexual abuse material offenses, computer-generated depictions	in effect	do not do the named thing
Delaware	House Bill 191 (2026), medical professional title protection against nonhuman and AI entities	in effect	do not do the named thing
Delaware	House Bill 316 (2024), use of deep fake technology to influence an election	in effect	do not do the named thing; label generated content
Delaware	House Bill 353 (2024), deep fake intimate images (The Amelia Kramer Act)	in effect	do not do the named thing
Florida	AI Use in Political Advertising Disclosure Requirement (HB 919, 2024)	2024-07-01
Florida	Child Sexual Abuse Material Including AI-Altered Images of a Minor	2022-10-01
Florida	Promotion of an Altered Sexual Depiction; Brooke's Law platform takedown duty	2022-10-01
Georgia	AI Companion Chatbot Safety Act (SB 540)	2027-07-01
Georgia	Private Review Agent Artificial Intelligence Coverage Determinations Act (SB 444)	2027-01-01	govern the system: policies, roles, assessments
Hawaii	Artificial Intelligence Disclosure and Safety Act (2026 Haw. Sess. Laws Act 248, S.B. 3001 CD1)	2026-07-14
Hawaii	Promoting Child Abuse, computer-generated child pornography	in effect
Hawaii	Violation of Privacy in the First Degree, deepfake and composite intimate images	in effect
Iowa	Conversational AI Services Act (Senate File 2417)	2027-07-01	label generated content; meet a design code
Iowa	Harassment, nonconsensual and synthetic intimate images	in effect	do not do the named thing
Iowa	Sexual exploitation of a minor, AI-generated and manipulated depictions	in effect	do not do the named thing
Idaho	Conversational AI Safety Act	2027-07-01	label generated content; meet a design code
Idaho	Disclosing explicit synthetic media	in effect	do not do the named thing
Idaho	FAIR Elections Act, disclosure duty for synthetic media in electioneering communications	2024-03-25	label generated content
Idaho	Generative Artificial Intelligence in Education Act, vendor disclosure duty	2026-07-01	disclose the use of ai
Illinois	Artificial Intelligence Safety Measures Act	2027-01-01	govern the system: policies, roles, assessments; report to a regulator; disclose the use of ai
Illinois	Artificial Intelligence Video Interview Act	2020-01-01	disclose the use of ai; get consent first; keep records for a set time; report to a regulator
Illinois	Child sexual abuse material, computer-generated and digitally altered depictions	2026-01-01	do not do the named thing
Illinois	Civil Remedies for Nonconsensual Dissemination of Private Sexual Images Act, digitally altered images	2024-01-01	do not do the named thing
Illinois	Illinois Human Rights Act, use of artificial intelligence in employment decisions	2026-01-01	do not do the named thing; disclose the use of ai
Illinois	Right of Publicity Act, unauthorized AI digital replica prohibition	2025-01-01	do not do the named thing; get consent first
Illinois	Wellness and Oversight for Psychological Resources Act	2025-08-01	do not do the named thing; disclose the use of ai; get consent first
Indiana	Child Exploitation and Possession of Child Pornography, obscene simulated or computer-generated images	in effect	do not do the named thing
Indiana	Distribution of an Intimate Image and Civil Action for Nonconsensual Pornography, extended to AI-generated images (House Enrolled Act 1047, 2024)	2024-07-01	do not do the named thing; get consent first
Indiana	Downcoding of Health Benefits Claims, automated and AI decision-making (House Enrolled Act 1271, 2026)	2026-07-01	disclose the use of ai; govern the system: policies, roles, assessments
Indiana	Use of Digitally Altered Media in Elections (House Enrolled Act 1133, 2024)	2024-03-12	label generated content; disclose the use of ai
Kansas	AI-generated and AI-altered images in child exploitation and non-consensual dissemination offenses	2026-07-01
Kentucky	Synthetic Media Disclosure in Electioneering Communications	2025-03-24	label generated content; disclose the use of ai
Louisiana	Act 250 (HB 178), attorney duty to verify and disclose AI-generated evidence	2025-08-01	disclose the use of ai
Louisiana	Act 559 (HB 639), AI-generated voice telephone campaign communication disclosure	2026-08-01	label generated content
Louisiana	Act 806 (HB 459), AI-manipulated electioneering communication disclosure	2026-08-01	label generated content
Maryland	Computer-Generated Child Sexual Abuse Material	in effect
Maryland	HB 820 / Ch. 747 (2025), Artificial Intelligence in Health Insurance Utilization Review	2025-10-01
Maryland	HB 895 / Ch. 154 (2026), Surveillance Pricing and Algorithmic Price Disclosure (Protection from Predatory Pricing Act)	2026-10-01
Maryland	SB 141 / Ch. 444 (2026), Election Deepfake Prohibition	2026-06-01
Maryland	SB 360 / Ch. 219 (2025), AI-Generated Deepfakes in Nonconsensual Intimate Imagery	2025-07-01
Maryland	SB 8 / Ch. 445 (2026), AI and Deepfake Identity Fraud	2026-10-01
Maine	Maine Chatbot Disclosure Act	in effect
Maine	Synthetic media disclosure in campaign advertising	in effect	label generated content
Maine	Unauthorized dissemination of certain private images (AI-generated image amendment)	in effect	do not do the named thing
Maine	Use of artificial intelligence in therapy or psychotherapy services	in effect	do not do the named thing; get consent first; govern the system: policies, roles, assessments
Michigan	AI-Generated Political Advertisement and Robocall Disclosure (Public Act 263 of 2023)	2024-02-13	label generated content; disclose the use of ai
Michigan	Distribution of Materially Deceptive Election Media (Public Act 265 of 2023)	2024-02-13	label generated content; do not do the named thing
Michigan	Protection from Intimate Deep Fakes Act (Public Act 11 of 2025)	2025-08-26	do not do the named thing
Minnesota	AI-Generated Child Sexual Abuse Material	2025-08-01
Minnesota	Election Deepfake Prohibition and Candidate Forfeiture	2023-08-01
Minnesota	Nonconsensual Deepfake Sexual Imagery, Civil and Criminal Liability	2023-08-01
Minnesota	Nudification Technology Prohibition	2026-08-01
Minnesota	Utilization Review, AI-Only Adverse Determination Prohibition	2027-01-01	govern the system: policies, roles, assessments
Missouri	Child sexual abuse material offenses, computer-generated and AI-indistinguishable images included	2026-08-28
Missouri	Disclosure of an intimate digital depiction	2026-08-28
Mississippi	HB 1308 (2025), Morphed-Image Child Exploitation Amendments	2025-07-01	do not do the named thing
Mississippi	SB 2577 (2024), Wrongful Dissemination of Digitizations (Election Deepfakes)	2024-07-01	do not do the named thing; label generated content
Montana	Deepfake Regulation Act (SB 25, 2025), election deepfake disclosure	in effect	do not do the named thing; disclose the use of ai
Montana	Digital Likeness and Voice Rights Act (HB 513, 2025), unauthorized AI depiction liability	2026-01-01	do not do the named thing
Montana	Privacy in communications, digitally fabricated intimate images	in effect	do not do the named thing
Montana	Right to Compute Act (SB 212, 2025), critical AI infrastructure risk management duty	in effect	govern the system: policies, roles, assessments
Montana	Sexual abuse of children, computer-generated child pornography	in effect	do not do the named thing
North Carolina	AI-Generated Intimate Images and Child Sexual Abuse Material (Session Law 2024-37, HB 591)	2024-12-01	do not do the named thing
North Dakota	House Bill 1167 (2025), AI-generated political content disclosure	2025-08-01	disclose the use of ai; label generated content
North Dakota	House Bill 1351 (2025), sexually expressive images including AI-generated or altered deepfakes	2025-08-01	do not do the named thing
North Dakota	House Bill 1429 (2025), harassment and stalking with a robot	in effect	do not do the named thing
Nebraska	Child Sexual Abuse Material Prevention Act, computer-generated and artificial-intelligence depictions	in effect	do not do the named thing
Nebraska	Conversational Artificial Intelligence Safety Act (LB 525, §§ 12-18)	2027-07-01	disclose the use of ai; label generated content
Nebraska	Ensuring Transparency in Prior Authorization Act, artificial-intelligence utilization review restriction	2026-01-01	do not do the named thing; disclose the use of ai
New Hampshire	AI Chatbot Solicitation of Children	2026-01-01
New Hampshire	Creation of Child Intimate Visual Representations	2026-01-01
New Hampshire	Fraudulent Use of Deepfakes	2025-01-01
New Hampshire	Synthetic Media and Deceptive and Fraudulent Deepfakes in Elections	2024-08-01
New Jersey	Deceptive Audio or Visual Media (Deepfake) Criminalization Act	2025-04-02	do not do the named thing
New Jersey	Forbidding the Algorithmic Inflation of Rent (FAIR) Act	2027-07-01
New Jersey	New Jersey Disparate Impact Discrimination Rules, Automated Employment Decision Tools	2025-12-15
New Mexico	HB 182 (2024), AI-generated and manipulated media disclosure and disclaimer requirements in campaign advertising	in effect	label generated content; disclose the use of ai; do not do the named thing
New Mexico	Sexual Exploitation of Children Act, morphed and computer-generated image provisions	in effect	do not do the named thing
Nevada	AB 406 (2025), AI mental and behavioral health care provider and marketing prohibitions	2025-07-01	do not do the named thing
Nevada	AB 406 (2025), licensed provider restriction on direct clinical use of AI	2025-07-01	do not do the named thing; govern the system: policies, roles, assessments
Nevada	AB 73 (2025), AI-manipulated media disclosure in paid political communications	2026-01-01	disclose the use of ai; label generated content
Nevada	SB 213 (2025), AI-generated and digitally altered intimate images	2025-10-01	do not do the named thing
Nevada	SB 263 (2025), AI-generated and computer-generated child sexual abuse material	2025-10-01	do not do the named thing
New York	Artificial Intelligence Companion Models safeguards	2025-11-07
New York	Disclosure of materially deceptive AI-generated media in political communications	2024-05-03
New York	Private right of action for unlawful dissemination or publication of a sexually explicit depiction (digital replica)	2024-05-03
New York	Responsible AI Safety and Education Act (RAISE Act)	2026-03-19
New York	Right of publicity, digital replica of a deceased performer	2025-12-19
New York	Synthetic Performer Advertising Disclosure Law	2026-06-09
New York	Unlawful dissemination or publication of an intimate image (digitization amendment)	2023-12-01
Oklahoma	Computer-generated child sexual abuse material prohibition (SB 53, 2025 amendment)	2025-11-01
Oregon	AI Companion Chatbot Safety Act (SB 1546)	in effect	disclose the use of ai; label generated content; meet a design code; report to a regulator
Oregon	Campaign communication disclosure of synthetic media (SB 1571)	2024-03-27	disclose the use of ai; label generated content
Oregon	Unlawful dissemination of an intimate image extended to AI-generated depictions (HB 2299)	in effect	do not do the named thing
Oregon	Use of nursing titles by a nonhuman entity (HB 2748)	in effect	do not do the named thing
Pennsylvania	Act 125 of 2024, artificially generated child sexual abuse material	2024-12-28	do not do the named thing
Pennsylvania	Act 125 of 2024, artificially generated sexual depictions in the unlawful dissemination of intimate image offense	2024-12-28	do not do the named thing
Pennsylvania	Act 35 of 2025, digital forgery	2025-09-05	do not do the named thing
Puerto Rico	AI disclosure in political advertising and electoral communications	2026-06-10	label generated content; disclose the use of ai
Rhode Island	Artificial Intelligence Companion Models Act	2027-01-01
Rhode Island	Child pornography prohibited, computer-generated and digitally altered depictions	in effect
Rhode Island	Deceptive and Fraudulent Synthetic Media in Election Communications	2025-07-02
Rhode Island	Oversight of Artificial Intelligence Technology in Mental Health Care Act	in effect
Rhode Island	Unauthorized dissemination of indecent material, digitally created or altered images	2025-07-02
Rhode Island	Use of Artificial Intelligence by Healthcare Providers Notification Act	in effect
South Carolina	AI-Generated and Morphed Images of an Identifiable Minor (2025 Act No. 58, S.29)	2025-05-22	do not do the named thing
South Dakota	Computer-generated child pornography ban (SB 79, 2024)	in effect
South Dakota	Election Deepfake Disclosure Law (SB 164, 2025)	in effect
South Dakota	Nonconsensual Digitally Fabricated Intimate Image Law (SB 41, 2026)	in effect
Tennessee	AI-generated child sexual abuse material, tool possession and distribution offense	2025-07-01	do not do the named thing
Tennessee	Ensuring Likeness, Voice, and Image Security (ELVIS) Act	2024-07-01	do not do the named thing
Tennessee	Health Care AI Act, AI mental health professional representation prohibition	2026-07-01	do not do the named thing
Tennessee	Preventing Deepfake Images Act	2025-07-01	do not do the named thing
Texas	H.B. 3133 (2025), social media platform complaint system for explicit deep fake material	2025-09-01	govern the system: policies, roles, assessments
Texas	Political deep fake video ban (originally S.B. 751, 2019)	2019-09-01	do not do the named thing
Texas	S.B. 1188 (2025), AI diagnostic disclosure duty in electronic health records	2025-09-01	disclose the use of ai
Texas	S.B. 20 (2025), possession, promotion, or production of AI-generated or apparent child pornography	2025-09-01	do not do the named thing
Texas	S.B. 441 (2025), civil liability for artificial intimate visual material and nudification applications	2025-09-01	do not do the named thing
Texas	S.B. 441 (2025), unlawful production or distribution of AI deep fake sexually explicit media	2025-09-01	do not do the named thing
Texas	TRAIGA (H.B. 149, 2025), consumer AI-interaction disclosure duty	2026-01-01	disclose the use of ai
Texas	TRAIGA (H.B. 149, 2025), prohibited AI practices binding any person	2026-01-01	do not do the named thing
Utah	Digital Content Provenance Standards Act (HB 276, 2026 General Session), Utah Code Title 13 Chapter 72c	2027-01-01	label generated content; disclose the use of ai
Utah	Digital Voyeurism Prevention Act (HB 276, 2026 General Session), Utah Code Title 13 Chapter 72b	2027-01-01	do not do the named thing; get consent first
Utah	HB 452 (2025), mental health chatbot disclosure	2025-05-07
Utah	Health Insurance Preauthorization AI Disclosure (SB 319, 2026 General Session)	2027-01-01	disclose the use of ai; govern the system: policies, roles, assessments
Utah	Identity Protection Modifications, AI Defamation and Identity Replication (SB 256, 2026 General Session)	2026-05-06	get consent first; do not do the named thing
Utah	SB 226 (2025), required disclosures for generative AI in consumer transactions	2025-05-07
Virginia	Computer-Generated Child Sexual Abuse Material	in effect
Virginia	HB 2678 (2019), Deepfakes in Nonconsensual Image Dissemination	2019-07-01
Vermont	Disclosure of sexually explicit images without consent, digitized and computer-generated images	2024-06-06	do not do the named thing
Vermont	Vermont Synthetic Media in Elections Act	2026-03-05	disclose the use of ai; do not do the named thing
Washington	AI companion chatbot disclosure and safety act	2027-01-01
Washington	AI content provenance and disclosure act	2027-02-01
Washington	Disclosing fabricated intimate images	2024-06-06
Washington	Fabricated depictions of minors (sexual exploitation of children)	2024-06-06
Washington	Forged digital likeness act (Personality Rights Law amendment)	2026-06-11
Washington	Synthetic media in electioneering communications	2023-07-23
Wisconsin	2023 Wisconsin Act 123, AI-Generated Content Disclosure in Political Communications	2024-03-23	label generated content
Wisconsin	2023 Wisconsin Act 224, Possession of Virtual Child Pornography	2024-03-29	do not do the named thing
Wisconsin	2025 Wisconsin Act 34, Synthetic Intimate Representation Ban	2025-10-04	do not do the named thing
West Virginia	SB 198 (2025), computer-generated child pornography prohibition	2025-07-09	do not do the named thing
West Virginia	SB 198 (2025), fabricated intimate image disclosure prohibition	2025-07-09	do not do the named thing
Wyoming	Artificial Intelligence Offenses (2026 Wyoming House Bill 102, Enrolled Act No. 32)	2026-07-01	do not do the named thing

United States, cities: 12 instruments in 12 jurisdictions

Jurisdiction	Instrument	Since / from	Asks of an app
Berkeley	Prohibition on the Sale or Use of Coordinated Pricing Algorithms	2026-03-01	do not do the named thing
San Diego	Prohibition of Anti-Competitive Automated Rent Price-Fixing Ordinance (Ord. O-21955 N.S.)	2025-06-21	do not do the named thing
City and County of San Francisco	Use and Sale of Algorithmic Devices Prohibited (Rent Ordinance Sec. 37.10C), as amended by Ord. No. 169-25	2024-10-14	do not do the named thing
Santa Monica	Algorithmic Rental Price Fixing (Ord. No. 2817 (CCS))	2025-07-24	do not do the named thing
Rockville	Price Coordination and Algorithmic Devices	2027-01-01	do not do the named thing
Minneapolis	Prohibition on Use of Rent-Setting Algorithms (Ord. No. 2025-010)	2026-03-01	do not do the named thing
Hoboken	Ord. No. B-781, Algorithmic Rent Fixing in Rental Housing Market Prohibited	2025-07-29	do not do the named thing
Jersey City	Ordinance 25-057, Preventing Algorithmic Rent-Fixing in the Rental Housing Market	2025-06-11	do not do the named thing
New York City	Automated Employment Decision Tools Bias Audit and Notice Law	2023-01-01
City of Philadelphia	Bill No. 240823, Anti-Competitive Rental Practices	2025-02-11	do not do the named thing
Providence	Prohibition of Algorithmic Rent Setting Devices	2025-05-15	do not do the named thing
Seattle	Ordinance 127241 (Council Bill 121000), Algorithmic Rent Fixing	2025-07-31	do not do the named thing

Asia and the Pacific: 23 instruments in 13 jurisdictions

Jurisdiction	Instrument	Since / from	Asks of an app
Australia	Using a Carriage Service to Transmit Sexual Material Without Consent (Deepfake Offences)	2024-09-03	do not do the named thing
Bangladesh	Cyber Security Act, 2026, AI-generated sexual content and CSAM ban	2025-05-21	do not do the named thing
China	Interim Measures for the Administration of Anthropomorphic Interactive Services of Artificial Intelligence, Article 18	2026-07-15
China	Interim Measures for the Management of Generative AI Services, Article 12	2023-08-15
China	Measures for Labeling AI-Generated Synthetic Content	2025-09-01
China	Provisions on the Administration of Deep Synthesis Internet Information Services, Articles 16 and 17	2023-01-10
Indonesia	Electronic Information and Transactions Law, electronic agent liability	2008-04-21	govern the system: policies, roles, assessments
India	Synthetically Generated Information Labelling Duty for Intermediaries	2026-02-10
Kyrgyzstan	Digital Code, Chapter 23: AI interaction and deepfake disclosure duties	2026-02-06	disclose the use of ai; label generated content
Kyrgyzstan	Digital Code, Chapter 23: AI system design and risk-management obligations	2026-02-06	assess the impact on personal data first; govern the system: policies, roles, assessments
South Korea	AI Framework Act, Article 31 (transparency obligations for AI outputs)	2026-01-22
Kazakhstan	Code of Administrative Offences, artificial intelligence violations	2026-01-17
Kazakhstan	Digital Code, algorithmic decision-making rights	2026-07-10
Kazakhstan	Law on Artificial Intelligence, copyright and training data	2026-01-17
Kazakhstan	Law on Artificial Intelligence, prohibited practices	2026-01-17
Kazakhstan	Law on Artificial Intelligence, transparency and disclosure duties	2026-01-17
Philippines	Anti-OSAEC and Anti-CSAEM Act, Computer-Generated Child Sexual Abuse or Exploitation Materials	in effect
Pakistan	Prevention of Electronic Crimes Act 2016, child pornography offence	in effect
Singapore	Penal Code, Distributing or Threatening to Distribute Intimate Image or Recording	in effect
Uzbekistan	Law on Informatization, use of artificial intelligence in information resources and systems	2026-01-21
Vietnam	Law on Artificial Intelligence, prohibited practices	2026-03-01
Vietnam	Law on Artificial Intelligence, risk classification and conformity assessment	2026-03-01	govern the system: policies, roles, assessments; assess the impact on personal data first; report to a regulator
Vietnam	Law on Artificial Intelligence, transparency obligation	2026-03-01

The Americas outside the United States: 14 instruments in 8 jurisdictions

Jurisdiction	Instrument	Since / from	Asks of an app
Brazil	TSE Resolution, AI-Generated Content Disclosure Duty	2024-03-04	label generated content
Brazil	TSE Resolution, Prohibition on Electoral Deepfakes	2024-03-04	do not do the named thing
Bahamas	Sexual Offences Act, child pornography offence	in effect	do not do the named thing
Belize	Practice Direction No. 18 of 2025, ethical use of generative AI in court proceedings	2025-08-12	disclose the use of ai; do not do the named thing
Colombia	Codigo Penal, Falsedad Personal, AI Deepfake Aggravation	2026-07-28	do not do the named thing
Jamaica	Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings	2025-09-17	disclose the use of ai; govern the system: policies, roles, assessments
Mexico	Código Penal Federal, Violación a la Intimidad Sexual (Arts. 199 Octies a 199 Decies), including manipulated or non-corresponding depictions	2021-06-02	do not do the named thing
Mexico	Reform to the Federal Labor Law and the Federal Copyright Law, AI Voice and Image Consent Regime for Performing Artists	2026-05-15	get consent first; put the terms in the contract; do not do the named thing
Peru	Reglamento de la Ley 31814, high-risk AI system duties	2026-01-22	disclose the use of ai; govern the system: policies, roles, assessments
Peru	Reglamento de la Ley 31814, prohibited AI uses	2026-01-22	do not do the named thing; limits on biometric use
El Salvador	Ley de Fomento a la Inteligencia Artificial y Tecnologías, decisiones de la IA o impulsadas por IA	2025-03-11
El Salvador	Ley de Fomento a la Inteligencia Artificial y Tecnologías, marco institucional, registro y evaluación de riesgos	2025-03-11	govern the system: policies, roles, assessments; hold a licence or registration; assess the impact on personal data first
El Salvador	Resolución ANIA 0001/2025, derecho a notificación ante decisiones automatizadas	in effect
El Salvador	Resolución ANIA 0001/2025, registro obligatorio para decisiones consecuenciales	in effect	govern the system: policies, roles, assessments; limits on biometric use; assess the impact on personal data first

Africa, the Middle East and elsewhere: 29 instruments in 25 jurisdictions

Jurisdiction	Instrument	Since / from	Asks of an app
Angola	Penal Code, Child Pornography Including a Virtual or Simulated Minor	in effect
Benin	Digital Code of the Republic of Benin, Livre VI, Article 576 (Unauthorised Image or Voice Montage / Synthetic-Media Prohibition)	2018-04-20
Bermuda	Criminal Code Act 1907, making and distributing child abusive material or child pornography	2008-05-07	do not do the named thing
Bhutan	Information, Communications and Media Act of Bhutan 2018, obscene communications depicting children	2018-01-08	do not do the named thing
Central African Republic	Code Pénal Centrafricain, article 111 (pornographie impliquant des enfants)	in effect
Switzerland	Swiss Criminal Code, Pornographic Depictions of Non-Genuine Sexual Acts with Minors	2014-07-01
Cape Verde	Cybercrime Law, Child Pornography Including Simulated Representations	in effect	do not do the named thing
Djibouti	Digital Code, Book VI: Computer-Generated Child Pornography Ban	2025-09-18
Gabon	Ordonnance n°0011/PR/2026, contenus interdits générés par intelligence artificielle	2026-04-08	do not do the named thing; label generated content
Gabon	Ordonnance n°0011/PR/2026, marquage des contenus générés par intelligence artificielle	2026-04-08	label generated content; report to a regulator
Iceland	Almenn hegningarlög nr. 19/1940, Art. 210.a, Simulated and Non-Real Child Sexual Abuse Material	2022-06-09
Jordan	Cybercrime Law, Ban on Real, Virtual, and Simulated Depictions of a Minor	in effect	do not do the named thing
Comoros	Penal Code, pornographic and manipulated image or representation offenses via an information system	2021-02-16	do not do the named thing
Saint Kitts and Nevis	Electronic Crimes Act, child pornography, including computer-generated depictions	2009-11-26	do not do the named thing
Cayman Islands	Penal Code 2019 Revision, indecent photographs and pseudo-photographs of children	in effect	do not do the named thing
Monaco	Code Penal Arts. 294-3 to 294-4, Child Sexual Abuse Material Including Realistic and AI-Generated Depictions	2007-12-28	do not do the named thing; report to a regulator
North Macedonia	Criminal Code, Production and Distribution of Child Pornography	in effect
Qatar	Qatar Central Bank Artificial Intelligence Guideline	in effect
Russia	Federal Law No. 243-FZ, Article 8, Duties of Sovereign and National Foundation Model Developers	2027-03-01	govern the system: policies, roles, assessments
Russia	Federal Law No. 243-FZ, Article 9, AI-Generated Content Notice	2027-03-01	label generated content
East Timor	Penal Code, Article 176 (Child Pornography)	2009-06-07	do not do the named thing
Turkey	Commercial Advertising Regulation, AI Deepfake Endorsement Ban	2026-08-01	do not do the named thing
Turkey	Commercial Advertising Regulation, AI Disclosure Duty	2026-08-01	disclose the use of ai; label generated content
Tanzania	Cybercrimes Act, 2015, child sexual abuse material including computer-generated content	2024-10-02
Holy See (Vatican City)	Child sexual abuse material offences (Legge N. VIII, arts. 4, 10-11)	2013-09-01	do not do the named thing
Holy See (Vatican City)	Guidelines on Artificial Intelligence of Vatican City State (Decree No. DCCII)	2025-01-01	do not do the named thing; label generated content; govern the system: policies, roles, assessments
Vanuatu	Digital Transformation Act 2025, ICT service permit for AI and AI-related data services	2025-12-17	hold a licence or registration; govern the system: policies, roles, assessments
Samoa	Crimes Act 2013, child pornography offence reaching synthetic and represented depictions	2013-05-01	do not do the named thing
Kosovo	Criminal Code of the Republic of Kosovo, Articles 225 and 232 (Child Pornography, Including Computer-Generated and Non-Existent-Child Images)	2019-04-14	do not do the named thing