AI transparency & disclosure

Operators of conversational AI services available to Georgia end users — systems that primarily simulate human conversation through text, visual, or aural communication.

Law · Pending

A private entity collects, captures, purchases, receives through trade, otherwise obtains, stores, discloses, or profits from a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry — or information derived from one and used to identify an individual — concerning an Illinois individual. Photographs, writing samples, written signatures, demographic data, physical descriptions, health-care-setting and HIPAA data, and Genetic Information Privacy Act materials are excluded by 740 ILCS 14/10; financial institutions subject to Title V of the Gramm-Leach-Bliley Act, Private Detective Act licensees, and State or local government contractors are excluded by 740 ILCS 14/25.

Law · In Force

Frontier developers training or deploying frontier AI models in Illinois; large frontier developers with more than $500 million in annual gross revenue.

Law · Pending

Developers and deployers of Automated Decision-Making Technology making consequential decisions about Colorado consumers.

Law · Pending

Frontier developers training or deploying foundation models meeting the 10^26 FLOP threshold; large frontier developers with >$500M annual gross revenue (with affiliates).

Law · In Force

Operators of companion chatbot platforms available to users in California — AI systems with human-like adaptive responses that meet users' social needs.

Law · In Force

Developers of generative AI systems made available to Californians.

Law · In Force

Covered providers (a person that creates, codes, or otherwise produces a GenAI system publicly accessible in California — no user threshold since September 30, 2026); large online platforms (more than 2,000,000 unique monthly users); GenAI hosting platforms; capture device manufacturers.

Law · Partially In Force

CTDPA-covered controllers that train LLMs on personal data of Connecticut residents.

Law · In Force

Connecticut footprint with employment AEDTs, AI companions, AI subscriptions, generative-media provenance, frontier-developer duties, or CFEPA-covered employment decisions under PA 26-15 — distinct from CTDPA privacy assessments.

Law · Partially In Force

Law · Superseded

Operators of conversational AI services available to the general public in Iowa — AI systems with the primary purpose of simulating human conversation (statutory business-tool and voice-assistant exceptions apply).

Law · Pending

Operators making conversational AI services available to the general public in Idaho — AI systems primarily simulating human conversation (with statutory exceptions for specialized/business tools).

Law · Pending

Employers using AI to analyse video interviews of candidates for Illinois-based positions.

Law · In Force

Indiana health insurers and health maintenance organizations — may not use automated systems or artificial intelligence as the sole basis to downcode a health claim based on medical necessity without a human reviewing the beneficiary medical record; healthcare providers may not use automated tools to submit claims without review by the provider or billing professional.

Law · In Force

Controllers or processors conducting business in Iowa, or targeting products/services to Iowa residents, that meet the § 715D.2(1) consumer-volume/revenue thresholds (100,000 consumers, or 25,000 consumers with 50%+ revenue from data sales).

Law · In Force

Use of an artificial intelligence chatbot or other computer technology to engage in trade and commerce with Maine consumers where a reasonable consumer could be misled into believing they interact with a human — requires clear and conspicuous AI disclosure.

Law · In Force

Developers and deployers of covered AI systems in New York, with overlays for frontier model developers and consequential decisions.

Law · Pending

Insurers regulated under a state that has adopted the NAIC bulletin and that use AI in underwriting, rating, claims, marketing, or customer service.

Guidance · In Force

A conversational artificial intelligence service (§ 13(2)(a)) is made available to the public in Nebraska by any person (§ 13(6)); no threshold. A program within the seven § 13(2)(b) exclusions is outside. The § 14 duties engage for a minor account holder — actual knowledge or reasonable certainty that the account holder is under eighteen (§ 13(4)–(5)); the parental limb of § 14(5) has an under-thirteen sub-trigger. Duties operative July 1, 2027.

Law · Pending

An artificial intelligence companion (§ 1(1)(a)(A)) or companion platform (§ 1(1)(b)) is made available to users in Oregon by any person (§ 1(1)(d)); no threshold. Software within the § 1(1)(a)(B) exclusions is outside. The § 1(4) duties engage where the operator knows or has reason to believe a user is a minor. Duties attach January 1, 2027.

Law · Pending

Law · In Force

Operators of AI companions in Rhode Island — generative or emotional-recognition systems simulating social human interaction (excluding pure customer-service bots) — must implement crisis protocols for suicidal ideation, self-harm, and harm-to-others expressions and provide bold 16-point AI-not-human disclosures at session start and every three hours.

Law · Pending

An organisation that develops or deploys an artificial intelligence system reaching Tennessee, where any representation made to the public — website copy, an app store listing, advertising delivered into Tennessee, an onboarding screen, or the assistant's own persona — says or implies that the system is or is able to act as a qualified mental health professional.

Law · In Force

Capture of a biometric identifier of an individual for a commercial purpose in Texas, or possession of one so captured. “Biometric identifier” is defined at Tex. Bus. & Com. Code § 503.001(a)(2) as a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry — a closed list that does not reach derived “biometric information” or behavioural patterns, and “commercial purpose” is undefined. Since January 1, 2026 § 503.001(e)(2) excludes developing, training, evaluating, disseminating or otherwise offering AI models or systems unless a system is used or deployed for the purpose of uniquely identifying a specific individual, and § 503.001(e)(1) and (e)(3) exclude financial-institution voiceprint data and enumerated security, fraud and abuse-investigation purposes.

Law · In Force

Applies to a person who promotes, advertises or conducts business in Texas, produces a product or service used by Texas residents, or develops or deploys an artificial intelligence system in Texas (sec. 551.002). There is no revenue, headcount, data-volume or consumer-count threshold anywhere in the Act. Three duties are narrower than the Act: sec. 552.051(b) binds a governmental agency, and secs. 552.053 and 552.054(b) bind a governmental entity as sec. 552.001(3) defines it. One is narrower the other way: sec. 552.051(f) binds the provider of a health care service or treatment.

Law · In Force

Practitioners using AI for diagnostic or treatment purposes in Texas.

Law · In Force

Use of generative AI in consumer transactions and regulated professional contexts in Utah.

Law · In Force

Suppliers of mental health chatbots using AI technology that engage Utah users in interactive conversations similar to confidential communications with a licensed mental health therapist — excludes scripted outputs and human-therapist routing tools.

Law · In Force

Providers of high-risk artificial intelligence systems or generative artificial intelligence that interact with Utah consumers — disclosure when a reasonable person could believe they interact with a human; applies alongside the Utah AI Policy Act (SB 149).

Law · In Force

Generation services distributing intimate AI imagery; large online covered platforms distributing GenAI content to Utah users; capture device manufacturers — provenance data, consent verification for counterfeit intimate images, and disclosure obligations under HB 276.

Law · Pending

Covered generative AI providers with 1M+ monthly Washington users; government agencies offering consumer-facing AI interaction systems.

Law · Pending

Operators making AI companion chatbots available to Washington users — disclosure, minor protections, and suicidal-ideation/self-harm protocols required.

Law · Pending

Australian Privacy Principle entities including most businesses with turnover above the small-business threshold, health service providers, and federal agencies.

Law · Partially In Force

Section 1(2): processing of personal data by or about a Bangladeshi citizen, resident or person working or temporarily present in Bangladesh; processing carried on inside Bangladesh other than in transit; or processing outside Bangladesh in connection with offering goods or services to, or monitoring or profiling, a data subject located in Bangladesh. No entity, revenue or record-count threshold.

Law · Partially In Force

Generative-AI content-generation/synthesis service providers and content-propagation service providers in mainland China carrying out AI-generated-and-synthesized-content labeling activities (clause 1). No revenue, headcount, or sector threshold — reaches any provider of covered content types (text, image, audio, video, virtual scenes) or any platform propagating such content.

Standard · In Force

Providing a generative artificial intelligence service in mainland China (clause 1). No revenue, headcount or sector threshold. Adoption is voluntary: the standard is a recommended national standard and creates no legal duty of its own.

Standard · In Force

HKMA-regulated authorized institutions using AI or GenAI in banking operations.

Guidance · In Force

Data users controlling the collection, holding, processing, or use of personal data in or from Hong Kong, including AI-driven profiling and automated processing.

Ordinance · Partially In Force

Providers offering generative AI services to the public in China.

Regulation · In Force

Network information service providers subject to China's algorithm, deep synthesis, and GenAI measures when generating or propagating AI synthetic content.

Regulation · In Force

Organisations using personal data in AI recommendation or decision systems in Singapore.

Guidance · In Force

Section 403 applies the Chapter to core Government ministries and agencies of the Republic of the Marshall Islands that may collect, use, store, process, disclose or transfer personal data of natural persons in the Republic. Section 405(c) excludes national State-Owned Enterprises and any agency the President determines. Sections 405(d) and 405(e) bring in any third party acting on behalf of such a ministry or agency as a data controller or data processor. There is no private-sector limb and no revenue, headcount or record-count threshold. Not in effect before 7 October 2026.

Law · Pending

South Australia public-sector personal information handling including AI.

Law · In Force

Developers, deployers, and providers of AI systems offered or used in South Korea, including extraterritorial operators serving Korean users.

Law · In Force

Recorded for footprint mapping only. Section 2, which supplies the Act’s application, is not in operation until 1 January 2027. From that date it reaches processing wholly or partly in Sri Lanka, and a controller or processor domiciled or ordinarily resident in Sri Lanka, incorporated under Sri Lankan law, offering goods or services to data subjects in Sri Lanka, or specifically monitoring their behaviour in Sri Lanka including profiling with the intention of making decisions about it.

Law · Partially In Force

Tasmanian public-sector personal information processing including AI.

Law · In Force

Telecommunications service providers — written-consent disclosure limits, communication confidentiality, purpose-limited collection/use of customer information, and security safeguards; sectoral only, not economy-wide DPA.

Law · In Force

Telecommunications service providers — consent-based collection/use/disclosure of user information, confidentiality of communications, and TCSI oversight; sectoral only, not economy-wide DPA.

Law · In Force

A data controller or data processor located in Thailand, whatever the location of the processing; or a controller or processor located outside Thailand that offers goods or services to data subjects in Thailand, whether or not payment is made, or that monitors their behaviour taking place in Thailand (s. 5).

Law · In Force

An organization, as defined in s. 1(1)(i), that collects, uses or discloses personal information about an individual in Alberta (s. 4(1)). There is no commercial-activity threshold and no size threshold. The Act does not apply to a public body (s. 4(2)) or to the purpose-based exclusions in s. 4(3), each of which applies only where the stated purpose is the sole purpose.

Law · In Force

The organization is a data controller established in The Bahamas and the data are processed in the context of that establishment (s. 4 (1) (a)), or it is not so established but uses equipment in The Bahamas to process personal data otherwise than for transit (s. 4 (1) (b)), in which case s. 4 (2) additionally requires nomination of a representative established in The Bahamas. Section 4 (3) deems four categories to be established in The Bahamas: an individual ordinarily resident there; a body incorporated or registered under Bahamian law; a partnership or unincorporated association formed under Bahamian law; and any person maintaining an office, branch or agency there through which he carries on a business activity or a regular practice. Section 3 binds the Crown, with the head of a government agency deemed to be the controller. There is no revenue, headcount or sector threshold. Section 5 excludes five categories of data, not classes of organization.

Law · In Force

Private organizations that collect, use, or disclose personal information in British Columbia; applies regardless of commercial character (contrast with PIPEDA).

Law · In Force

An organisation that uses personal information in Bermuda, where the information is used wholly or partly by automated means or forms, or is intended to form, part of a structured filing system (s. 3). An organisation is any individual, entity or public authority that uses personal information (s. 2), and the Act binds the Crown (s. 50).

Law · In Force

A market participant regulated under Canadian securities legislation — a registered dealer, adviser or investment fund manager; a non-investment fund reporting issuer; a marketplace or marketplace participant; a clearing agency or matching service utility; a trade repository; a designated rating organization; or a designated benchmark administrator — using, or planning to use, an artificial intelligence system in its regulated business activities, including derivatives firms through the parallel provisions of NI 93-101 (Notice, Introduction and footnotes 4 and 23).

Guidance · In Force

The organization is a public sector entity within EDSTA s. 1 (1): an institution within the meaning of s. 2 (1) of the Freedom of Information and Protection of Privacy Act other than the Assembly, an institution within the meaning of s. 2 (1) of the Municipal Freedom of Information and Protection of Privacy Act, a children aid society, or a school board. The cyber duties in O. Reg. 51/26 attach only to the narrower class prescribed by its s. 2: FIPPA educational institutions, Group A, B and C public hospitals, the University of Ottawa Heart Institute, children aid societies and school boards. The under-18 notice duties in O. Reg. 52/26 attach to every school board. The artificial-intelligence duties in ss. 5 and 6 attach only to entities and circumstances prescribed under s. 7, and none is prescribed.

Law · In Force

Developers and deployers of AI systems in Peru's public administration, state companies, and private sector (excluding personal use and national defence/security).

Law · Partially In Force

Law · Pending

Ontario municipalities and local boards processing personal information including AI.

Law · Partially In Force

Processing personal health information by health information custodians in Ontario including AI.

Law · Partially In Force

Enterprise in Quebec collecting, holding, using, or communicating personal information of Quebec residents — provincial overlay in addition to PIPEDA.

Law · In Force

Federally assisted programs that hold themselves out as providing SUD diagnosis, treatment, or referral.

Regulation · In Force

Emergency departments deploying AI for triage, diagnosis, documentation, or operational decision support.

Guidance · In Force

Physicians and healthcare organisations deploying AI in clinical practice; referenced in medical board examinations and liability analysis.

Guidance · In Force

Operators of websites or online services directed to children under 13, or that have actual knowledge they are collecting personal information from children under 13.

Law · In Force

Educational agencies and institutions receiving US Department of Education funds, and vendors acting as school officials with legitimate educational interest.

Law · In Force

Entities making outbound calls using AI-generated or cloned voices to US telephone numbers.

Regulation · In Force

Software providing clinical decision support including AI tools that may or may not meet the Cures Act device exemption.

Guidance · In Force

Seller-servicers using AI/ML tools in connection with loans sold to or serviced for Freddie Mac.

Guidance · In Force

SEC-registered advisers, broker-dealers, and reporting issuers using AI in investment recommendations, marketing, or operational decisions.

Guidance · In Force

Surfaced wherever an AI system is designed, developed, deployed or used, in any sector, for civilian purposes: para. 4 scopes the Compact to the non-military domain and it names no sector, size or entity class. It creates no duty on anyone — its commitments are what Governments will do; its paragraphs addressed to companies, developers and platforms (22, 25, 32, 36) are calls; and endorsement (66) is voluntary. Two rows are conditioned on hosting user-generated content (32 (d), 36 (b)) and one on generating synthetic content (36 (c)), because those paragraphs are addressed to platforms and to content generators respectively.

Guidance · In Force

Surfaced as international supervisory context where a market intermediary or asset manager deploys AI or machine learning. The instrument creates no duty of its own; the binding requirement, if any, is the national securities rule that carries the substance of the measure.

Guidance · In Force

Surfaced for AI deployments at U.S. healthcare organisations (hospitals, critical access hospitals, ambulatory care, behavioral health) -- RUAIH's own stated audience -- regardless of Joint Commission accreditation status, since the guidance addresses "healthcare organisations" generally rather than only accredited ones.

Standard · In Force

Surfaced where the declared AI system is generative — the profile's own scope is generative AI as defined in Executive Order 14110, being the class of models that emulate the structure and characteristics of input data to generate derived synthetic content. Every one of the 49 covered subcategories applies to any organisation that adopts the profile; it draws no distinction by sector, size, use case or data type.

Framework · In Force

Surfaced for any AI deployment as a voluntary international reference. The Recommendation draws no distinction by sector, size, use case or data type; paragraph I defines an AI system broadly enough to cover generative systems, a clarification made expressly in the 2023 amendment, and defines AI actors to include organisations that deploy or operate AI. Section 1 is what reaches a deployer; Section 2 is addressed to Adherent governments.

Framework · In Force

Surfaced where the declared AI system is generative: the catalogue's scope is applications powered by large language models, across the development, deployment and management lifecycle. All ten entries apply to any organisation that applies the list; it draws no distinction by sector, size, use case or data type. Where the model acts rather than answers, the 2026 Preface directs the reader to the companion agentic publication, which is a separate instrument.

Framework · In Force

Surfaced wherever an AI system is designed, produced or used, which is the whole of what the Call addresses — it names no sector, no size and no entity class. It creates no duty; where an organisation is bound to it, it is bound because it signed, or because a contract, a procurement condition or an internal policy adopted it, and that document is the citation.

Guidance · In Force

Surfaced wherever an AI system is designed, developed, deployed or used, in any sector and for any purpose: para. 2 (b) defines AI actors as any natural or legal person involved in any stage of the life cycle, para. 4 offers ethical guidance to all AI actors including the private sector, and the Recommendation carves out no domain. It creates no duty on anyone — Member States apply it voluntarily and AI actors receive guidance. Three rows carry the condition their paragraph turns on: decisions about people (para. 38, decision limb) and the provider role (paras. 51, last sentence, and 120, last sentence).

Guidance · In Force

Surfaced for any AI system used in health-care delivery, diagnostics, health research, or population/public health, consistent with the guidance's own stated scope (Executive Summary; §5, chapeau).

Guidance · In Force

Processing of personal data in Albania or targeting Albanian data subjects by controllers and processors.

Law · Partially In Force

Personal data processed by an authority or other public body of the Land Berlin or of a Land corporation, institution or foundation of public law (§ 2 Abs. 1), by a private-law association performing public-administration tasks in which Berlin holds an absolute majority or by a non-public body performing sovereign tasks (§ 2 Abs. 2), or by a processor acting for one of them. Teil 3 applies instead of Teil 2 where the processing serves the prevention, investigation, detection, prosecution or punishment of criminal or administrative offences (§ 2 Abs. 4, § 30). § 19 additionally reaches non-public bodies processing for journalistic, artistic or literary purposes (§ 2 Abs. 7).

Law · In Force

Processing of personal data in Gibraltar or by controllers established in Gibraltar targeting Gibraltar data subjects.

Law · In Force

A relevant information society service (DPA 2018 s. 123(7): provided for remuneration, at a distance, by electronic means, at the individual request of a recipient, excluding preventive or counselling services) likely to be accessed by children under 18 in the United Kingdom.

Guidance · In Force

Processing of personal data in Jersey or by controllers established in Jersey targeting Jersey data subjects.

Law · In Force

Processing by public and private bodies in Kosovo; limited extraterritorial reach for equipment in Kosovo.

Law · In Force

Personal data processing in Spain including AI under Organic Law 3/2018.

Law · In Force

UK public bodies using algorithmic or AI tools in decision-making subject to ATRS.

Guidance · In Force

Organisations self-assessing AI trustworthiness in the EU; especially relevant for high-risk and limited-risk AI under the EU AI Act.

Framework · In Force

Manufacturers placing software and AI-enabled products on the EU market; victims seeking compensation for defective AI outputs.

Regulation · Pending

Intermediary services offered in the EU, especially VLOPs and VLOSEs using recommender systems and content moderation AI.

Regulation · In Force

Providers of general-purpose AI models placing models on the EU market; downstream deployers relying on GPAI provider documentation.

Framework · In Force

Any organisation that offers goods or services to, or monitors the behaviour of, individuals in the EU/EEA — regardless of where the controller or processor is established.

Regulation · In Force

Providers placing AI on the EU market, deployers in the EU, and providers or deployers established in third countries whose AI system output is used in the EU.

Regulation · Partially In Force

Manufacturers placing products with digital elements on the EU market, including standalone AI software.

Regulation · Partially In Force

Processing of personal data in the DRC or targeting Congolese data subjects.

Law · In Force

Processing of personal data in the context of the activities of a controller or processor on Beninese territory, or of persons who are in Benin where the activities relate to offering them goods or services or to monitoring their behaviour in Benin (art. 381).

Law · In Force

CITRA-licensed telecommunications and IT service providers collecting, processing, or storing personal data and user content in Kuwait.

Regulation · In Force

Automated or non-automated filing-system processing by a controller or processor established in Botswana; or, where not established there, processing where the activities of an establishment are in Botswana, or the activities relate to offering goods or services to data subjects in Botswana or to monitoring their behaviour there (s. 4).

Law · In Force

Organisations deploying AI in the UK subject to sector regulator oversight under the cross-sector principles.

Framework · In Force

Law · In Force

Any one of the three alternative tests in art. 3º is met: the processing operation is carried out in the national territory (I); the processing activity has as its object the offer or supply of goods or services, or the processing of data, of individuals located in the national territory (II); or the personal data being processed were collected in the national territory (III), § 1º deeming data collected there where the titular was in Brazil at the moment of collection. The tests apply irrespective of the medium, of the country of the controller seat and of the country where the data are located. Art. 1º parágrafo único makes the general rules a matter of national interest binding the Union, the States, the Federal District and the Municipalities. There is no revenue, headcount or record-count threshold. Art. 4º excludes four categories of processing, not classes of organization, and the academic limb preserves arts. 7º and 11 in full.

Law · In Force

Organisations that collect, use, or disclose personal data in Singapore, regardless of where established.

Law · In Force

Collection, use or disclosure of personal information in the course of commercial activities in Canada (s. 4(1)(a)), or of employee or job-applicant information in connection with the operation of a federal work, undertaking or business (s. 4(1)(b)). Excluded: government institutions under the Privacy Act, personal or domestic handling by an individual, and handling exclusively for journalistic, artistic or literary purposes (s. 4(2)); business contact information used solely for work-related communication (s. 4.01). Under s. 26(2)(b) intra-provincial commercial activity in Quebec, Alberta and British Columbia is exempted where the substantially similar provincial statute applies (SOR/2003-374, SOR/2004-219, SOR/2004-220), leaving interprovincial and international flows and federal works, undertakings and businesses federally governed.

Law · In Force

Processing of personal data of individuals in Switzerland, regardless of where the controller is established.

Law · In Force