Vendor & deployer accountability

Frontier developers training or deploying frontier AI models in Illinois; large frontier developers with more than $500 million in annual gross revenue.

Law · In Force

Developers and deployers of Automated Decision-Making Technology making consequential decisions about Colorado consumers.

Law · Pending

CTDPA-covered controllers that train LLMs on personal data of Connecticut residents.

Law · Pending

An employer covered by the Illinois Human Rights Act — generally any person employing one or more employees within Illinois during 20 or more calendar weeks within the calendar year of or preceding the alleged violation, 775 ILCS 5/2-101(B)(1)(a) — uses artificial intelligence as defined at 775 ILCS 5/2-101(N), which expressly includes generative artificial intelligence, with respect to recruitment, hiring, promotion, renewal of employment, selection for training or apprenticeship, discharge, discipline, tenure, or the terms, privileges or conditions of employment.

Law · In Force

Developers and deployers of covered AI systems in New York, with overlays for frontier model developers and consequential decisions.

Law · Pending

Insurers regulated under a state that has adopted the NAIC bulletin and that use AI in underwriting, rating, claims, marketing, or customer service.

Guidance · In Force

Developers or deployers of artificial intelligence systems in Tennessee — may not advertise or represent to the public that the system is or can act as a qualified mental health professional; violations are unfair/deceptive practices under the Tennessee Consumer Protection Act with $5,000 per violation civil penalty and private right of action.

Law · In Force

Controllers and processors conducting business in Texas or targeting Texas residents, excluding small-business and certain entity exemptions.

Law · In Force

Developers and deployers of AI systems used in Texas, with sector-specific obligations for healthcare practitioners and government.

Law · In Force

Suppliers of mental health chatbots using AI technology that engage Utah users in interactive conversations similar to confidential communications with a licensed mental health therapist — excludes scripted outputs and human-therapist routing tools.

Law · In Force

DoD contractors handling Federal Contract Information or Controlled Unclassified Information.

Program · In Force

Enterprise customers requiring vendor assurance attestation for cloud and AI services.

Standard · In Force

Employers and vendors using AI for hiring, promotion, compensation, or other employment decisions subject to federal anti-discrimination laws.

Guidance · In Force

Educational agencies and institutions receiving US Department of Education funds, and vendors acting as school officials with legitimate educational interest.

Law · In Force

Same covered entities and business associates as HIPAA; HITECH layered direct enforcement on business associates and increased penalties.

Law · In Force

AI or cloud vendors undergoing higher-education institutional security assessment.

Framework · In Force

Processing of personal data by controllers and processors in Kiribati — lawful basis, consent, data-subject rights, security and breach notification, data protection impact assessments, cross-border transfer standards; phased application for non–major-importance controllers.

Law · Pending

Any controller or processor handling personal data of individuals in Indonesia, including extraterritorially.

Law · In Force

Core Government ministries and agencies processing personal data of natural persons in the Marshall Islands — six data-protection principles, EPPSO competent authority, private right of action (non-compensatory); does not apply to private-sector controllers as of 2026.

Law · In Force

Processing of personal data of Bangladeshi citizens, residents, or data subjects connected to Bangladesh; extraterritorial reach for controllers/processors outside Bangladesh.

Law · In Force

Developers, deployers, and providers of AI systems offered or used in South Korea, including extraterritorial operators serving Korean users.

Law · In Force

Processing of personal information by data controllers and processors in Tonga — lawful basis, consent, data-subject rights including portability, cross-border transfer standards, Privacy Commission supervision.

Law · Pending

Frontier or advanced AI systems where Bletchley Summit commitments or successor summit declarations apply.

Guidance · In Force

Organisations certifying or maintaining an ISMS; prerequisite layer for AI governance, SOC 2, and EU AI Act technical measures.

Standard · In Force

Organisations building, deploying, or procuring LLM-powered applications, agents, or RAG systems.

Framework · In Force

Transfers of Swiss personal data to U.S. organizations under Swiss-U.S. DPF certification.

Framework · In Force

Essential and important entities in covered sectors using AI in critical digital services or supply chains.

Regulation · In Force

Providers of general-purpose AI models placing models on the EU market; downstream deployers relying on GPAI provider documentation.

Framework · In Force

EU-regulated financial entities and the ICT third-party service providers (including AI vendors) they rely on.

Regulation · In Force

Providers placing AI on the EU market, deployers in the EU, and providers or deployers established in third countries whose AI system output is used in the EU.

Regulation · Partially In Force

Processing of personal data in Bahrain or of Bahraini residents by controllers established inside or outside the Kingdom.

Law · In Force

Processing of personal data of Jordanian citizens and residents, including data collected before enactment; cross-border transfers subject to Council adequacy rules.

Law · In Force

Processing of personal data in Serbia or targeting Serbian data subjects; GDPR-aligned controller and processor obligations.

Law · In Force

Developers and deployers of AI systems in Peru's public administration, state companies, and private sector (excluding personal use and national defence/security).

Law · In Force

Owns or licenses computerized data including private information of a New York resident.

Statute · In Force

Collection, use or disclosure of personal information in the course of commercial activities in Canada (s. 4(1)(a)), or of employee or job-applicant information in connection with the operation of a federal work, undertaking or business (s. 4(1)(b)). Excluded: government institutions under the Privacy Act, personal or domestic handling by an individual, and handling exclusively for journalistic, artistic or literary purposes (s. 4(2)); business contact information used solely for work-related communication (s. 4.01). Under s. 26(2)(b) intra-provincial commercial activity in Quebec, Alberta and British Columbia is exempted where the substantially similar provincial statute applies (SOR/2003-374, SOR/2004-219, SOR/2004-220), leaving interprovincial and international flows and federal works, undertakings and businesses federally governed.

Law · In Force