Frameworks
Six families, and how they overlap.
This page is an orientation, not a list. The laws themselves are in the library. It describes which families exist, what each covers and where they overlap in ways that are easy to miss.
EU AI Act
The Act sorts systems into risk tiers. High-risk systems carry the heaviest obligations, and interactive and generative uses carry separate transparency obligations. Deployer obligations are separate from provider obligations and fall on organizations that use a system rather than build it.
Regulation (EU) 2024/1689The GDPR family
Impact assessment obligations, transparency obligations and limits on solely automated decisions. UK GDPR and the DPA 2018 are separate laws, and the UK is not an EU member state.
GDPR · UK GDPR · national implementationsUS state privacy
The statutes agree that a documented assessment is required. They differ on the trigger, the required contents, retention and what happens when an attorney general requests it. No single national approach matches any one of them precisely.
A dozen state statutesUS employment AI
Bias-audit expectations, candidate notice and the older anti-discrimination framework that applied to hiring decisions long before anyone described them as AI.
NYC LL 144 · Illinois · state and federal anti-discrimination lawSectoral law
These laws reach an AI use case, one tool used for one purpose, because of what the organization is, not what the software does. They can carry substantial obligations, and a review limited to AI-specific law can miss them.
HIPAA · GLBA · ECOA · FCRA · insurance codesRest of world
General privacy statutes with assessment and automated-decision provisions. They reach AI use cases that touch their residents, wherever the deploying organization is located.
LGPD · PIPEDA · PIPA · APPI · PIPL · PDPA and othersWhere the families overlap
Three overlaps that duplicate or miss work.
Duplicated or missed work tends to occur at the boundary between two families, not inside one.
Privacy assessment and AI assessment are not the same document
A data protection impact assessment (DPIA) under GDPR Art. 35 and a fundamental rights impact assessment (FRIA) under EU AI Act Art. 27 ask different questions about the same AI use case. Doing one does not take the place of the other, and merging them produces a document that follows neither structure.
Sectoral obligations survive the general ones
A healthcare AI use case does not stop being subject to health-privacy law because an AI statute also applies. The two sets of obligations apply together.
Employment law predates the AI statutes
Anti-discrimination frameworks applied to hiring decisions long before AI statutes existed, and they still apply. A review limited to the newer laws omits the ones with the longest enforcement history.
A family is an orientation, not a determination
Which of these reaches your AI use case?
The six families are an overview. Which laws within them apply to a particular AI use case is settled by the determination, the list of laws that apply to it, each cited to the provision. Add the AI use case to your inventory to see the laws and obligations that apply to it. Your first five AI use cases are free.