AI transparency & disclosure

Operators of conversational AI services available to Georgia end users — systems that primarily simulate human conversation through text, visual, or aural communication.

Law · In Force

Washington health carriers and health plans using artificial intelligence for prior authorization — may not use AI as the sole means to deny, delay, or modify medically necessary healthcare services; licensed physicians or health professionals must review AI-aided denials; carriers must report AI-related denial metrics to the Insurance Commissioner.

Law · In Force

Covered generative AI providers with 1M+ monthly Washington users; government agencies offering consumer-facing AI interaction systems.

Law · In Force

Operators making AI companion chatbots available to Washington users — disclosure, minor protections, and suicidal-ideation/self-harm protocols required.

Law · In Force

A private entity collects, captures, purchases, receives through trade, otherwise obtains, stores, discloses, or profits from a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry — or information derived from one and used to identify an individual — concerning an Illinois individual. Photographs, writing samples, written signatures, demographic data, physical descriptions, health-care-setting and HIPAA data, and Genetic Information Privacy Act materials are excluded by 740 ILCS 14/10; financial institutions subject to Title V of the Gramm-Leach-Bliley Act, Private Detective Act licensees, and State or local government contractors are excluded by 740 ILCS 14/25.

Law · In Force

Frontier developers training or deploying frontier AI models in Illinois; large frontier developers with more than $500 million in annual gross revenue.

Law · In Force

Developers and deployers of Automated Decision-Making Technology making consequential decisions about Colorado consumers.

Law · Pending

Frontier developers training or deploying foundation models meeting the 10^26 FLOP threshold; large frontier developers with >$500M annual gross revenue (with affiliates).

Law · In Force

Operators of companion chatbot platforms available to users in California — AI systems with human-like adaptive responses that meet users' social needs.

Law · In Force

Developers of generative AI systems made available to Californians.

Law · In Force

Covered GenAI providers (>1M monthly users in CA); large online platforms (>2M monthly users); GenAI hosting platforms; capture device manufacturers.

Law · In Force

CTDPA-covered controllers that train LLMs on personal data of Connecticut residents.

Law · Pending

Connecticut footprint with employment AEDTs, AI companions, generative-media provenance, or frontier-developer duties under PA 26-15 — distinct from CTDPA privacy assessments.

Law · Partially In Force

Operators of conversational AI services available to the general public in Iowa — AI systems with the primary purpose of simulating human conversation (statutory business-tool and voice-assistant exceptions apply).

Law · In Force

Operators of conversational artificial intelligence services available to Nebraska users — disclosure to all users, heightened minor safeguards, self-harm protocols, and prohibition on claiming professional mental/behavioral health care.

Law · In Force

Operators making conversational AI services available to the general public in Idaho — AI systems primarily simulating human conversation (with statutory exceptions for specialized/business tools).

Law · In Force

Employers using AI to analyse video interviews of candidates for Illinois-based positions.

Law · In Force

Indiana health insurers and health maintenance organizations — may not use automated systems or artificial intelligence as the sole basis to downcode a health claim based on medical necessity without a human reviewing the beneficiary medical record; healthcare providers may not use automated tools to submit claims without review by the provider or billing professional.

Law · In Force

Use of an artificial intelligence chatbot or other computer technology to engage in trade and commerce with Maine consumers where a reasonable consumer could be misled into believing they interact with a human — requires clear and conspicuous AI disclosure.

Law · In Force

Developers and deployers of covered AI systems in New York, with overlays for frontier model developers and consequential decisions.

Law · Pending

Insurers regulated under a state that has adopted the NAIC bulletin and that use AI in underwriting, rating, claims, marketing, or customer service.

Guidance · In Force

Operators of AI companion models in New York — systems that simulate human conversation, relationships, or emotional support for users — must implement suicidal-ideation/self-harm detection with crisis referrals and clear periodic disclosure that users interact with AI, not a human.

Law · In Force

Operators of AI companions or AI companion platforms serving Oregon users — disclosure when users could believe they interact with a human, suicidal/self-harm protocols, and minor protections required.

Law · In Force

Law · Pending

Operators of AI companions in Rhode Island — generative or emotional-recognition systems simulating social human interaction (excluding pure customer-service bots) — must implement crisis protocols for suicidal ideation, self-harm, and harm-to-others expressions and provide bold 16-point AI-not-human disclosures at session start and every three hours.

Law · In Force

Capture of a biometric identifier of an individual for a commercial purpose in Texas, or possession of one so captured. “Biometric identifier” is defined at Tex. Bus. & Com. Code § 503.001(a)(2) as a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry — a closed list that does not reach derived “biometric information” or behavioural patterns, and “commercial purpose” is undefined. Since January 1, 2026 § 503.001(e)(2) excludes developing, training, evaluating, disseminating or otherwise offering AI models or systems unless a system is used or deployed for the purpose of uniquely identifying a specific individual, and § 503.001(e)(1) and (e)(3) exclude financial-institution voiceprint data and enumerated security, fraud and abuse-investigation purposes.

Law · In Force

Developers and deployers of AI systems used in Texas, with sector-specific obligations for healthcare practitioners and government.

Law · In Force

Practitioners using AI for diagnostic or treatment purposes in Texas.

Law · In Force

Use of generative AI in consumer transactions and regulated professional contexts in Utah.

Law · In Force

Suppliers of mental health chatbots using AI technology that engage Utah users in interactive conversations similar to confidential communications with a licensed mental health therapist — excludes scripted outputs and human-therapist routing tools.

Law · In Force

Providers of high-risk artificial intelligence systems or generative artificial intelligence that interact with Utah consumers — disclosure when a reasonable person could believe they interact with a human; applies alongside the Utah AI Policy Act (SB 149).

Law · In Force

Generation services distributing intimate AI imagery; large online covered platforms distributing GenAI content to Utah users; capture device manufacturers — provenance data, consent verification for counterfeit intimate images, and disclosure obligations under HB 276.

Law · In Force

Providers using algorithmic recommendation technology to deliver information to users in China.

Regulation · In Force

Generative AI service providers and content propagation platforms implementing explicit and implicit AI synthetic content labels under China's labeling measures.

Standard · In Force

Providers offering generative AI services to the public in China.

Regulation · In Force

Network information service providers subject to China's algorithm, deep synthesis, and GenAI measures when generating or propagating AI synthetic content.

Regulation · In Force

Organisations using personal data in AI recommendation or decision systems in Singapore.

Guidance · In Force

Providers offering deep synthesis services including deepfakes, voice cloning, and synthetic media in China.

Regulation · In Force

Developers, deployers, and providers of AI systems offered or used in South Korea, including extraterritorial operators serving Korean users.

Law · In Force

Tasmanian public-sector personal information processing including AI.

Law · In Force

Telecommunications service providers — written-consent disclosure limits, communication confidentiality, purpose-limited collection/use of customer information, and security safeguards; sectoral only, not economy-wide DPA.

Law · In Force

Telecommunications service providers — consent-based collection/use/disclosure of user information, confidentiality of communications, and TCSI oversight; sectoral only, not economy-wide DPA.

Law · In Force

Federal Canadian institutions using automated decision-making systems including AI.

Regulation · In Force

CSA-regulated securities dealers, advisers, or fund managers using AI.

Guidance · In Force

Developers and deployers of AI systems in Peru's public administration, state companies, and private sector (excluding personal use and national defence/security).

Law · In Force

Ontario municipalities and local boards processing personal information including AI.

Law · In Force

Processing personal health information by health information custodians in Ontario including AI.

Law · In Force

Section 4(1): the Act applies to every organization and in respect of all personal information — there is no commercial-activity threshold, which is the principal contrast with PIPEDA. "Organization" under s. 1(1)(i) includes corporations, unincorporated associations, trade unions, partnerships and individuals acting in a commercial capacity, but not an individual acting in a personal or domestic capacity. Personal employee information is squarely in scope under ss. 15, 18 and 21, so workforce and hiring AI is covered without any federal-work limb. Excluded: public bodies (s. 4(2)); personal or domestic, artistic or literary, and journalistic purposes (s. 4(3)(a)-(c)); business contact information used to contact an individual about their business responsibilities (s. 4(3)(d)); information subject to the Protection of Privacy Act (s. 4(3)(e)) or to the Health Information Act (s. 4(3)(f)); and the further exclusions in s. 4(3)(g)-(o). Non-profit organizations are outside the Act under s. 56(2) except for personal information handled in connection with a commercial activity (s. 56(3)). Federal works, undertakings and businesses remain under PIPEDA, and PIPEDA continues to govern interprovincial and international flows; SOR/2004-219 exempts everything else occurring within Alberta.

Law · In Force

Private organizations that collect, use, or disclose personal information in British Columbia; applies regardless of commercial character (contrast with PIPEDA).

Law · In Force

Processing of personal data in Peru or of Peruvian data subjects by public or private controllers, including automated processing and cross-border transfers.

Law · In Force

Enterprise in Quebec collecting, holding, using, or communicating personal information of Quebec residents — provincial overlay in addition to PIPEDA.

Law · In Force

Federally assisted programs that hold themselves out as providing SUD diagnosis, treatment, or referral.

Regulation · In Force

Physicians and healthcare organisations deploying AI in clinical practice; referenced in medical board examinations and liability analysis.

Guidance · In Force

Operators of websites or online services directed to children under 13, or that have actual knowledge they are collecting personal information from children under 13.

Law · In Force

Educational agencies and institutions receiving US Department of Education funds, and vendors acting as school officials with legitimate educational interest.

Law · In Force

Entities making outbound calls using AI-generated or cloned voices to US telephone numbers.

Regulation · In Force

Software providing clinical decision support including AI tools that may or may not meet the Cures Act device exemption.

Guidance · In Force

Seller-servicers using AI/ML tools in connection with loans sold to or serviced for Freddie Mac.

Guidance · In Force

SEC-registered advisers, broker-dealers, and reporting issuers using AI in investment recommendations, marketing, or operational decisions.

Guidance · In Force

Organisations self-assessing AI trustworthiness in the EU; especially relevant for high-risk and limited-risk AI under the EU AI Act.

Framework · In Force

Manufacturers placing software and AI-enabled products on the EU market; victims seeking compensation for defective AI outputs.

Regulation · Pending

Intermediary services offered in the EU, especially VLOPs and VLOSEs using recommender systems and content moderation AI.

Regulation · In Force

Providers of general-purpose AI models placing models on the EU market; downstream deployers relying on GPAI provider documentation.

Framework · In Force

Any organisation that offers goods or services to, or monitors the behaviour of, individuals in the EU/EEA — regardless of where the controller or processor is established.

Regulation · In Force

Providers placing AI on the EU market, deployers in the EU, and providers or deployers established in third countries whose AI system output is used in the EU.

Regulation · Partially In Force

Manufacturers placing products with digital elements on the EU market, including standalone AI software.

Regulation · Partially In Force

Processing of personal data in Gibraltar or by controllers established in Gibraltar targeting Gibraltar data subjects.

Law · In Force

Processing of personal data in Jersey or by controllers established in Jersey targeting Jersey data subjects.

Law · In Force

Processing by public and private bodies in Kosovo; limited extraterritorial reach for equipment in Kosovo.

Law · In Force

Personal data processing in Spain including AI under Organic Law 3/2018.

Law · In Force

UK public bodies using algorithmic or AI tools in decision-making subject to ATRS.

Guidance · In Force

Developers of advanced AI systems operating in or serving G7 jurisdictions where Hiroshima Process commitments apply.

Guidance · In Force

AI governance programs referencing Rome Call or algorethics commitments in healthcare, education, or multistakeholder ethics frameworks.

Guidance · In Force

AI systems developed or deployed where UNESCO ethics recommendation is cited in policy, procurement, or human-rights due diligence.

Guidance · In Force

Organisations deploying AI in the UK subject to sector regulator oversight under the cross-sector principles.

Framework · In Force

CITRA-licensed telecommunications and IT service providers collecting, processing, or storing personal data and user content in Kuwait.

Regulation · In Force

Law · In Force

Organisations that collect, use, or disclose personal data in Singapore, regardless of where established.

Law · In Force

Collection, use or disclosure of personal information in the course of commercial activities in Canada (s. 4(1)(a)), or of employee or job-applicant information in connection with the operation of a federal work, undertaking or business (s. 4(1)(b)). Excluded: government institutions under the Privacy Act, personal or domestic handling by an individual, and handling exclusively for journalistic, artistic or literary purposes (s. 4(2)); business contact information used solely for work-related communication (s. 4.01). Under s. 26(2)(b) intra-provincial commercial activity in Quebec, Alberta and British Columbia is exempted where the substantially similar provincial statute applies (SOR/2003-374, SOR/2004-219, SOR/2004-220), leaving interprovincial and international flows and federal works, undertakings and businesses federally governed.

Law · In Force