Risk & impact assessments
Obligations to assess an AI or data-processing system's risks before or during deployment — impact assessments, DPIAs, conformity assessments, and formal risk-management programs.
Europe & Central Asia13 laws
Albania Law 124/2024
Republic of Albania
Processing of personal data in Albania or targeting Albanian data subjects by controllers and processors.
Law · In Force
Datenschutzgesetz (DSG), LGBl. 2018 Nr. 272 (Liechtenstein) — EEA GDPR implementation
Principality of Liechtenstein
Processing of personal data in Liechtenstein; EEA GDPR applies directly with DSG as national implementing law.
Law · In Force
Guernsey DP Law 2017
Bailiwick of Guernsey
Processing of personal data in the Bailiwick of Guernsey or by controllers established in the Bailiwick.
Law · In Force
Law No. 06/L-082 on Protection of Personal Data
Republic of Kosovo
Processing by public and private bodies in Kosovo; limited extraterritorial reach for equipment in Kosovo.
Law · In Force
Law of Georgia on Personal Data Protection
Georgia
Processing of personal data in Georgia or using technical means in Georgia; extraterritorial reach for Georgian data subjects.
Law · In Force
Law on Personal Data Protection (Official Gazette MK 42/20, 294/21)
Republic of North Macedonia
Processing of personal data in North Macedonia or targeting North Macedonian data subjects.
Law · In Force
Law on Personal Data Protection (Serbia) (Zakon o zaštiti podataka o ličnosti)
Republic of Serbia
Processing of personal data in Serbia or targeting Serbian data subjects; GDPR-aligned controller and processor obligations.
Law · In Force
Law on the Protection of Personal Data (Bosnia and Herzegovina)
Bosnia and Herzegovina
Processing of personal data in BiH or of BiH data subjects; foreign controllers must appoint local representative where required.
Law · In Force
LDSG RP
Rhineland-Palatinate, Germany
Public-sector personal data processing in Rhineland-Palatinate including AI.
Law · In Force
Llei 29/2021, del 28 d'octubre, qualificada de protecció de dades personals (Andorra)
Principality of Andorra
Processing of personal data in Andorra or by controllers/processors subject to Andorran law, including extraterritorial targeting of Andorran data subjects.
Law · In Force
Moldova Law 195/2024
Republic of Moldova
Processing of personal data in Moldova or by controllers subject to Moldovan law after August 23, 2026.
Law · In Force
Monaco Law 1.565
Principality of Monaco
Processing by controllers/processors in Monaco or targeting data subjects in Monaco (GDPR-style territorial and extraterritorial scope).
Law · In Force
San Marino Law 171/2018
Republic of San Marino
Processing of personal data in San Marino or by controllers established in San Marino, including automated and filing-system processing.
Law · In Force
EU & EEA5 laws
Assessment List for Trustworthy Artificial Intelligence (ALTAI) — EU High-Level Expert Group on AI
European Union
Organisations self-assessing AI trustworthiness in the EU; especially relevant for high-risk and limited-risk AI under the EU AI Act.
Framework · In Force
EU Digital Services Act
European Union & EEA
Intermediary services offered in the EU, especially VLOPs and VLOSEs using recommender systems and content moderation AI.
Regulation · In Force
Regulation (EU) 2016/679 (General Data Protection Regulation)
European Union & EEA
Any organisation that offers goods or services to, or monitors the behaviour of, individuals in the EU/EEA — regardless of where the controller or processor is established.
Regulation · In Force
Regulation (EU) 2024/1689 (Artificial Intelligence Act)
European Union & EEA
Providers placing AI on the EU market, deployers in the EU, and providers or deployers established in third countries whose AI system output is used in the EU.
Regulation · Partially In Force
Regulation (EU) 2024/2847
European Union & EEA
Manufacturers placing products with digital elements on the EU market, including standalone AI software.
Regulation · Partially In Force
US States5 laws
Cal. Bus. & Prof. Code Ch. 25.1 (Transparency in Frontier Artificial Intelligence Act)
State of California
Frontier developers training or deploying foundation models meeting the 10^26 FLOP threshold; large frontier developers with >$500M annual gross revenue (with affiliates).
Law · In Force
Cal. Code Regs. tit. 11 (CPPA — automated decisionmaking technology and risk assessments)
State of California
CCPA-covered businesses that use ADMT to make significant decisions about California consumers.
Regulation · Partially In Force
California Age-Appropriate Design Code Act (Cal. Civ. Code Tit. 1.81.47)
State of California
Online products or services likely to be accessed by children and offered to California consumers.
Law · In Force
Ind. Code § 24-15
United States — Indiana
Law · In Force
Ky. Rev. Stat. § 367.3611 et seq.
United States — Kentucky
Law · In Force
Americas4 laws
Canada ADM Directive
Canada (Federal)
Federal Canadian institutions using automated decision-making systems including AI.
Regulation · In Force
Data Protection Act, 2021 (Act No. 45 of 2021) (Belize)
Belize
Processing of personal data in Belize by public or private controllers subject to the Act.
Law · Partially In Force
EDSTA (Ontario) — AI provisions
Province of Ontario, Canada
Ontario public-sector entities (FIPPA/MFIPPA institutions, CAS, school boards) using AI systems.
Law · In Force
Ley Orgánica de Protección de Datos Personales (Ecuador)
Republic of Ecuador
Processing of personal data in Ecuador or targeting Ecuadorian data subjects.
Law · In Force
Asia Pacific2 laws
Data Protection Act 2025 (Kiribati)
Republic of Kiribati
Processing of personal data by controllers and processors in Kiribati — lawful basis, consent, data-subject rights, security and breach notification, data protection impact assessments, cross-border transfer standards; phased application for non–major-importance controllers.
Law · Pending
Law No. 91/2025/QH15 on Personal Data Protection (Viet Nam)
Socialist Republic of Viet Nam
Vietnamese and foreign agencies, organisations, and individuals processing personal data in Vietnam or related to Vietnamese citizens.
Law · In Force
Middle East & Africa2 laws
Data Protection Act, 2012 (Act 843) (Ghana)
Republic of Ghana
Controllers and processors collecting or processing personal data in Ghana.
Law · In Force
Loi n° 1/03 du 10 mars 2026 (Burundi)
Burundi
{"scope_basis":"jurisdiction","jurisdictions":["BI"],"regions":["Middle East & Africa"],"requires_ai":false}
Regulation · In Force
Global & Voluntary2 laws
IEEE 7010
International
Organizations assessing human well-being impacts of autonomous or intelligent systems.
Standard · In Force
ISO/IEC 42005
International (voluntary)
Organisations conducting AI system impact assessments, especially for high-risk AI under the EU AI Act.
Standard · In Force
United Kingdom1 law
UK GDPR (assimilated Regulation (EU) 2016/679)
United Kingdom
Organisations established in the UK and those that offer goods or services to, or monitor, individuals in the UK from outside.
Regulation · In Force
Sourced from the LegisGate™ intelligence library — our single source of truth (SSOT). Theme membership is computed deterministically from curated library text; run a LegisGate™ report to see how these obligations apply to your specific AI tool.