AI laws and regulations

Data (Use and Access) ActUnited Kingdom

ICO abolished; Information Commission takes over

Sections 118-119 commence: office of Information Commissioner abolished and functions transferred to the Information Commission (Commencement No. 9 Regulations 2026).

Connecticut Data Privacy Act (CTDPA)Connecticut

PA 26-64 (SB 4) amendments take effect

Prohibits controllers and third parties from selling precise geolocation data and enacts data broker and other consumer protection provisions.

New bans on sexual deepfakes and CSAM generation; Art 50(2) grace period ends

New Art 5(1)(ba)/(bb) prohibitions on AI systems that generate non-consensual intimate imagery of identifiable persons or child sexual abuse material apply. Generative AI systems placed on the market before 2 Aug 2026 must comply with the Art 50(2) marking duty by this date (new Art 111(4)).

Transposition deadline; old PLD repealed

Member States must transpose by 9 Dec 2026 (Art 22). Directive 85/374/EEC is repealed from that date but still applies to products placed on the market before it (Art 21).

Australia Privacy ActAustralia

Children's Online Privacy Code must be registered

OAIC must develop and register the Children's Online Privacy Code within 24 months of Royal Assent.

Australia Privacy ActAustralia

Automated decision-making transparency applies

Privacy policies must disclose the kinds of personal information used in substantially automated decisions that significantly affect individuals (24 months after assent).

California AI Transparency Act (SB 942)California

Large online platform and hosting platform duties

Large online platforms and GenAI hosting platforms must meet the provenance duties added by AB 853.

California SB 53 (TFAIA)California

First OES anonymized incident report and CDT definition review

OES begins publishing annual anonymized incident summaries and the Department of Technology begins annual review of the act's definitions; the CalCompute framework report is due to the Legislature.

CCPA / CPRACalifornia

ADMT requirements compliance date

Businesses using ADMT for significant decisions must comply with Article 11 (pre-use notice, opt-out, access rights) by this date (11 CCR 7200(b)).

CCPA / CPRACalifornia

Browsers must support opt-out preference signal (AB 566)

Businesses that develop or maintain a browser must include consumer-configurable functionality to send an opt-out preference signal (Civ. Code 1798.136, operative Jan 1, 2027).

Colorado AI ActColorado

ADMT obligations apply

Developer documentation, consumer notices, post-adverse-outcome disclosure, correction and human-review rights take effect.

Colorado AI ActColorado

AG rules due

Attorney General must adopt rules clarifying the post-adverse-outcome disclosure requirements.

Connecticut Data Privacy Act (CTDPA)Connecticut

Data broker registration required

Data brokers may not sell or license brokered personal data in Connecticut unless registered with the Department of Consumer Protection ($2,500 initial fee).

NY RAISE ActNew York

RAISE Act takes effect

Transparency reports, frontier AI frameworks, incident reporting and DFS disclosure filings apply.

Vietnam AI LawVietnam

Transition ends for existing AI systems (general)

Existing AI systems in most sectors must comply (12-month transition).

California SB 243 (companion chatbots)California

First annual report to Office of Suicide Prevention

Operators begin annual reporting on crisis referrals and detection protocols.

Utah AI Policy ActUtah

Scheduled repeal of Title 13, Ch. 72

SB 332 extends the AI Policy Act repeal date from May 1, 2025 to July 1, 2027.

Legacy GPAI models must comply; national AI sandboxes operational

Providers of GPAI models placed on the market before 2 Aug 2025 must comply (Art 111(3)). Each Member State must have at least one national AI regulatory sandbox operational (Art 57(1) as amended by the Omnibus).

Vietnam AI LawVietnam

Transition ends for existing AI systems in health, education and finance

Existing AI systems in healthcare, education and finance must comply (18-month transition).

High-risk obligations apply to Annex III systems

Chapter III Sections 1-3 (high-risk requirements and provider/deployer obligations) apply to AI systems classified high-risk under Art 6(2) and Annex III (employment, credit scoring, education, biometrics, essential services and similar). Deferred from 2 Aug 2026 by Regulation (EU) 2026/1744.

CCPA / CPRACalifornia

Risk assessments for pre-existing processing due

Risk assessments must be completed and documented for high-risk processing that began before Jan 1, 2026 and continues after (11 CCR 7155(b)).

California AI Transparency Act (SB 942)California

Capture device manufacturer duties

Capture device manufacturer provenance requirements become operative.

Vermont VDPOSAVermont

Vermont Data Privacy and Online Surveillance Act takes effect

All obligations under Act 145 apply (sec. 4).

CCPA / CPRACalifornia

First risk assessment submission to CPPA

Businesses must submit required risk assessment information and attestation for assessments conducted in 2026 and 2027 (11 CCR 7157(a)(1)); annually by April 1 thereafter.

CCPA / CPRACalifornia

Cybersecurity audit due: revenue over $100M

First cybersecurity audit report (covering Jan 1, 2027 - Jan 1, 2028) and certification due for businesses with 2026 annual gross revenue over $100M (11 CCR 7121(a)(1)).

High-risk obligations apply to Annex I product-embedded systems

Chapter III Sections 1-3 apply to AI systems classified high-risk under Art 6(1) and Annex I (safety components of products covered by EU harmonisation legislation). Deferred from 2 Aug 2027 by Regulation (EU) 2026/1744.

Connecticut Data Privacy Act (CTDPA)Connecticut

Data brokers must process state deletion mechanism requests

Registered data brokers must access the DCP accessible deletion mechanism at least every 45 days and process deletion requests.

CCPA / CPRACalifornia

Cybersecurity audit due: revenue $50M-$100M

First cybersecurity audit report (covering 2028) due for businesses with 2027 annual gross revenue between $50M and $100M (11 CCR 7121(a)(2)).

Vermont VDPOSAVermont

Mandatory 60-day cure period expires

The AG's duty to issue a cure notice before enforcement ends June 30, 2029 (Act 145 sec. 3).

Colorado AI ActColorado

Mandatory cure period ends

The AG's obligation to offer a 60-day notice-and-cure period expires.

CCPA / CPRACalifornia

Cybersecurity audit due: revenue under $50M

First cybersecurity audit report (covering 2029) due for covered businesses with 2028 annual gross revenue under $50M (11 CCR 7121(a)(3)); annual by April 1 thereafter.

Public-authority high-risk systems must comply

Providers and deployers of high-risk AI systems intended for use by public authorities that were placed on the market before the Chapter III application date must comply (Art 111(2), as replaced by the Omnibus).

Large-scale EU IT systems must comply

AI systems that are components of the large-scale IT systems in Annex X (e.g. SIS, VIS, Eurodac, EES, ETIAS) placed on the market before 2 Aug 2027 must be brought into compliance (Art 111(1)).