AI Regulation Tracker
The 100 most recent verified regulatory updates, grouped by framework. Browse all activity for a framework on its hub page.
EU AI Act
AI Act Guidelines Implementation Update
The Commission says it is preparing additional AI Act guidelines, including on high-risk systems, the AI value chain, substantial modification, post-market monitoring and interplay with other EU laws.
AI Act Fact Page
The fact page presents the AI Act’s risk-based structure, GPAI transparency and systemic-risk obligations, and the AI governance architecture.
EU AI Act: draft implementing act for AI regulatory sandboxes
The Commission opened feedback on a draft implementing act that would set common rules for establishing and operating AI regulatory sandboxes under the AI Act.
EU AI Act: draft guidelines on classification of high-risk AI systems
The Commission opened a consultation on draft guidelines to help providers, deployers, and market surveillance authorities assess whether an AI system is high-risk.
European AI Office and AI Act governance framework
The European AI Office is established within the European Commission to support, enforce, and coordinate AI Act governance, especially for general-purpose AI.
DORA
ISO 27001
ISO/IEC 42001
Clear 2022 comprehensive governance of algorithms special action
The Cyberspace Administration of China launched a special action in April 2022 to push implementation of the algorithm recommendation provisions through self-inspection, inspections, filing, and rectification.
AI Guidelines for Business Ver. 1.0
METI and MIC compiled AI Guidelines for Business Ver. 1.0 by integrating and updating prior AI guidelines for a broad range of AI business operators.
Singapore updates agentic AI governance framework and PDPC personal-data guidance
Singapore has updated its model AI governance framework for agentic AI and already has advisory guidelines for personal-data use in AI recommendation and decision systems, so organizations should refresh governance, human oversight, and data-use controls now.
ICO AI and data protection guidance remains active but under review
The ICO says its AI guidance supports audit and enforcement activity and is under review following the Data (Use and Access) Act 2025, so UK organizations should keep using it as the current baseline while planning for revisions.
NIST AI RMF
OECD AI Law Radar tool
The OECDs AI Law Radar is a daily refreshed tracker of AI laws, regulations, and obligations across jurisdictions for compliance and governance teams.
HTI-5 proposed rule advances AI-enabled interoperability and deregulatory health IT changes
HHS says the HTI-5 proposed rule would streamline the ONC certification program, update information blocking regulations, and promote FHIR-based AI-enabled interoperability, with public comment open for 60 days after publication.
FTC action against IntelliVision over AI facial-recognition bias claims
The FTC finalized an order against IntelliVision Technologies after allegations that it made false or unsubstantiated claims that its AI facial-recognition software was free of gender or racial bias.
FTC finalizes order against accessiBe over AI accessibility claims
The FTC finalized an order requiring accessiBe to pay $1 million after allegations that it misrepresented its AI web accessibility tool as making any website WCAG-compliant.
FTC final order against Workado requires substantiation for AI content detection claims
The FTC approved a final order barring Workado from advertising the accuracy or efficacy of its AI content detection products unless it has competent and reliable evidence supporting the claims.
FTC AI and algorithms guidance references in AEPD materials
The source cites FTC materials as background on AI and data protection risk, but does not describe a new FTC rule or enforcement action in the supplied text.
Basic Online Safety Expectations
eSafety’s Basic Online Safety Expectations state that online service providers should take reasonable steps to keep Australians safe, including by making services safer, more transparent, and responsive to complaints and reporting obligations.
Your privacy and AI chatbots
The OPC advises users of AI chatbots to limit personal information shared because chatbot platforms may collect, store, reuse, or disclose what users enter.
Principles for responsible, trustworthy and privacy-protective generative AI technologies
The OPC issued privacy principles for generative AI that set out how organizations developing, providing, or using such systems should handle personal information, transparency, accountability, access, accuracy, and safeguards.
FDA regulatory evaluation of new AI uses in medical practices
FDA says novel AI clinical uses may require new assessment paradigms, especially for rule-out, triage, prognosis, treatment response, risk assessment, and large language model applications.
eSafety AI transparency statement
eSafety says it uses AI under an internal policy with human oversight, risk assessment, staff training, and periodic review, and will not use AI in ways inconsistent with its legal obligations or to make final regulatory decisions without accountable human judgment.
US AI Roadmap terminology alignment reference
The CNIL topic page references an EU-U.S. terminology and taxonomy effort for AI, but does not identify a binding US executive action in the supplied text.
Proposed Guide to Synthetic Data Generation now available
The PDPC announced that the proposed guide to synthetic data generation is now available.
Singapore’s Approach to AI Governance
The PDPC published Singapore’s Approach to AI Governance as a guidance resource on AI governance.
PDPC consults on advisory guidelines for personal data in AI recommendation and decision systems
The PDPC launched a public consultation on proposed advisory guidelines for the use of personal data in AI recommendation and decision systems.
FDA cites IMDRF Good Machine Learning Practice guiding principles
The FDA notes that IMDRF released 10 guiding principles in January 2025 that can inform the development of Good Machine Learning Practice for AI/ML medical devices.
FCA confirms no new AI-specific rules for financial services
The FCA says it is not planning AI-specific regulation and will rely on existing frameworks such as Consumer Duty and SM&CR, so firms should focus on fitting AI governance into current control regimes rather than waiting for a new rulebook.
California AI bills advancing on healthcare and employment automation
California’s 2026 AI bills on healthcare services and automated decision systems advanced late in session, so employers and health providers should continue tracking whether they become enacted obligations.
SEC announces internal AI task force
The SEC announced an internal AI task force on 1 August 2025 to coordinate responsible AI adoption across the agency; the announcement does not introduce a new external compliance obligation.
FTC AI enforcement actions on deceptive claims and substantiation
These records cover separate FTC proceedings concerning AI claims, an AI companion chatbot inquiry, and the later setting aside of the Rytr order; they do not establish a common new compliance deadline.
SOC 2 + AI
FINMA
Swiss data protection impact assessment guidance
The FDPIC explains when a DPIA is required for Swiss processing likely to create a high risk and when a consultation with the FDPIC is needed.
FINMA supervisory expectations for AI use in supervised institutions
FINMA says it has set out its supervisory expectations for the use of AI in supervised institutions, focusing on risks that arise when AI is used in business processes.
Swiss FDPIC guidance on AI and data protection, plus legislative roadmap
The FDPIC has made clear that Switzerland’s data protection law already applies to AI-supported processing and that the federal government is targeting an AI bill by the end of 2026, so organizations should harden transparency and automated-decision controls now.
AIUC-1
Basic Online Safety Expectations and transparency reporting guidance
eSafety says that social media, messaging and gaming service providers and other apps and websites will take reasonable steps to keep Australians safe, and that it can require providers to report on how they are meeting the Expectations.
Age-Restricted Material Codes fully commence in Australia
Australia's Age-Restricted Material Codes fully commenced, introducing age-assurance and content-access controls across online services used by children, including AI companions and social platforms.
GDPR
OPC guidance on AI and your business
The OPC says organizations using or developing generative AI should label AI-generated content or decisions, establish legal authority, be transparent, explain tools, limit data sharing, and embed privacy by design.
FDPIC Data Protection Impact Assessment Guidance
The FDPIC explains that private- and public-sector controllers must carry out a DPIA when processing is likely to create a high risk to personality or fundamental rights, and must seek an opinion if residual risk remains high.
AP fine for Uber automated driver blocking
The AP fined Uber nearly 825 million euros for fully automated driver deactivations without human review and for insufficient transparency about automated decision-making.
OPC leadership on AI and privacy
The OPC says it collaborates with domestic and international partners on statements, resolutions and toolkits to promote responsible, trustworthy and privacy-protective AI.
Office of the Privacy Commissioner of Canada AI and privacy resources
The OPC’s AI and privacy hub points to guidance, principles, news and collaboration on responsible, trustworthy and privacy-protective AI in Canada.
CNIL recommendations on AI system development under the GDPR
CNIL published recommendations explaining how the GDPR applies to the development of AI systems that process personal data, including purpose definition, lawful basis, data minimization, transparency, security, rights handling, and DPIA expectations.
Cheng v. Stoler
A Hawaii appellate court affirmed a five-year order of protection after finding substantial evidence of extreme psychological abuse and domestic abuse.
Johnson v. Durrani
An Ohio appellate court affirmed a negligence verdict while reversing an attorney-fee award, holding that the jury’s award stood despite harmless trial errors and that fees were unauthorized on the surviving negligence claim.
AEPD repository page for AI and age-assurance resources
The AEPD’s resource repository surfaces multiple AI, children-safety, and age-assurance materials, including guidance on chatbots and verification of age, but the page itself is only an index of documents.
AEPD innovation and technology resources page updated with AI/privacy materials
The AEPD’s innovation-and-technology portal lists updated resources on AI, risk management, privacy by design, and age assurance, signaling where the agency is directing compliance attention.
ICO guidance on when penalty notices may be issued
The ICO explains that penalty notices are assessed case by case and will be considered with reference to seriousness, mitigating or aggravating factors, and whether a fine would be effective, proportionate and dissuasive.
ICO opens formal investigation into Grok
The ICO has opened formal investigations into XIUC and X.AI over Grok’s processing of personal data and potential generation of harmful sexualised image and video content.
ICO and Turing guidance on explaining decisions made with AI
The ICO and Alan Turing Institute say organisations should provide practical explanations of AI-assisted decisions to affected individuals and to internal decision-makers.
CNIL AI and GDPR guidance on transparency for training data
The CNIL states that organisations building or reusing AI training datasets with personal data must inform data subjects, with detailed requirements depending on whether data was collected directly, indirectly, or reused.
Irish DPC guidance on automated decision-making and profiling
The Irish DPC explains that individuals have a right not to be subject to decisions based solely on automated processing, subject to limited exceptions and safeguards.
AP coordination and guidance for algorithm oversight
The AP's coordination directorate focuses on algorithm and AI risk analysis, cooperation with other supervisors, and guidance to clarify expectations for organizations.
AEPD explains the right not to be subject to solely automated decisions
The AEPD states that individuals have a right not to be subject to decisions based solely on automated processing, subject to limited exceptions and safeguards including human intervention and contestability.
CNIL topic page on artificial intelligence
The CNIL’s AI topic page points readers to its AI compliance materials and states that it has an action plan for deploying privacy-respecting AI systems.
AP guidance on generative AI and the GDPR
The Dutch DPA published initial guidance on the lawful development and deployment of generative AI models under the GDPR for organisations that develop or deploy such models.
AEPD blog on how algorithms influence automated systems using AI
The AEPD explains that meaningful transparency under the GDPR requires understanding how algorithms influence automated decisions, not just receiving generic statements that AI was used.
HIPAA
HIPAA Enforcement Data Dashboard and Complaint Outcomes
HHS publishes enforcement data showing how OCR closes cases, including technical assistance, corrective action, and other resolution categories, and notes that most investigations can take multiple years.
HIPAA Regulatory Initiatives on Reproductive Health and Security Rule
HHS says remaining Notice of Privacy Practices modifications from the reproductive health privacy rule remain in effect and must be complied with by February 16, 2026, while the agency also has a proposed Security Rule overhaul pending.
FDA AI-enabled medical device public list and transparency resource
The FDA’s AI-enabled medical device list is a periodically updated transparency resource that identifies authorized devices and encourages sponsors to include enough information in public summaries to support future tagging of foundation-model-based functionality.
FDA AI-enabled medical devices overview and resource list
The FDA describes its risk-based oversight of AI-enabled medical devices and provides a periodically updated public list for transparency and regulatory expectations.
HHS points HIPAA-covered entities and business associates to periodic risk analysis guidance
HHS says OCR issues periodic guidance on the HIPAA Security Rule and that risk analysis is the first step in identifying and implementing safeguards for e-PHI.
HHS covered-entity and business-associate scope guidance
HHS explains that the HIPAA Rules apply to covered entities and business associates, and that covered entities must use written business associate arrangements when delegating functions to business associates.
FDA draft guidance on lifecycle management and marketing submissions for AI-enabled devices
The FDA’s draft guidance recommends documentation and lifecycle-management practices for marketing submissions covering AI-enabled device software functions.
HHS guidance on HIPAA, the FTC Act, and the Health Breach Notification Rule
HHS explains that companies collecting consumer health information may need to comply with HIPAA, the FTC Act, and the FTC’s Health Breach Notification Rule, and it summarizes the privacy, security, and breach-notification obligations that can apply.
HIPAA Security Rule risk analysis guidance
HHS OCR guidance explains that HIPAA risk analysis is the foundational, ongoing step for identifying and documenting risks to e-PHI and selecting appropriate safeguards.
FDA AI-Enabled Medical Device List and related AI/ML guidance resources
FDA maintains an AI-Enabled Medical Device List and related guidance resources that explain how AI/ML medical devices are identified, what premarket and transparency expectations apply, and how sponsors should support submissions and lifecycle management.
HIPAA Part 2 overview and 2024 final rule status
HHS explains that Part 2 protects SUD patient records and notes that the 2024 final rule was effective April 16, 2024 and compliance was required by February 16, 2026.
HIPAA and health apps guidance
HHS guidance for mobile health app developers explains that HIPAA, FTC, FDA, and other laws may apply depending on the app's functions and data handling.
HHS OCR Newsroom page listing recent HIPAA and civil-rights enforcement actions
HHS OCR's newsroom page lists recent press releases and bulletins on HIPAA, civil rights, and related enforcement activity, including multiple 2026 settlements and investigations.
Covered entities and business associates under HIPAA
HHS explains that HIPAA applies to covered entities and business associates, and that covered entities must use written business associate arrangements when delegating work involving protected health information.
HIPAA minimum necessary requirement guidance
HHS guidance explains that the HIPAA Privacy Rule generally requires covered entities to limit uses, disclosures, and requests for PHI to the minimum necessary to accomplish the intended purpose.
FDA AI-Enabled Medical Devices List updated with current authorized devices
The FDA’s AI-Enabled Medical Device List is a resource intended to identify AI-enabled medical devices authorized for marketing in the United States and is updated periodically.
FDA AI-enabled medical devices overview and guidance list
FDA states that AI-enabled medical devices are regulated under the FD&C Act through a risk-based approach and highlights guidance on lifecycle management, PCCPs, and software modifications.
FDA AI-enabled medical device and PCCP guidance baseline
FDA’s August 2025 PCCP guidance provides recommendations for planned modifications to AI-enabled devices reviewed through the 510(k), De Novo and PMA pathways.
CCPA/CPRA
Colorado became the first state to pass cross-sectoral private-sector rules for certain high-risk AI systems
Colorado is identified as the first state to pass cross-sectoral private-sector rules for certain high-risk AI systems, establishing a state-level baseline for AI governance.
U.S. state AI governance legislation tracker resource
The IAPP tracker is a reference resource on U.S. state AI governance legislation for private-sector organizations, not itself a new law or rule.
FTC reopens and sets aside Rytr AI testimonial order
The FTC reopened and set aside its 2024 final order against Rytr after concluding the complaint did not satisfy the FTC Act and the order unduly burdened AI innovation.
FTC final orders against Cox Media Group and two marketing firms over deceptive AI-powered advertising claims
The FTC finalized orders requiring Cox Media Group and two other firms to pay redress and stop misrepresenting their advertising services, voice-data use, consent, and geographic targeting capabilities.
UK GDPR
ICO AI and data protection risk toolkit
The ICO says its AI toolkit is designed to help organisations reduce risks to individuals’ rights and freedoms caused by their own AI systems.
ICO data protection fining guidance
The ICO’s fining guidance explains when the Commissioner may issue a penalty notice and how the amount of any fine is determined under UK data protection law.
Other updates
No SEC regulatory update in supplied sources
The supplied materials do not contain an SEC rule, order, or guidance update, so no SEC regulation can be distilled from the record.
Guidance by Topic
The PDPC guidance-by-topic page is a directory that groups Singapore privacy resources by topic and resource type.
FCA review of the long-term impact of AI on retail financial services
The FCA is reviewing how AI may reshape retail financial services by 2030 and beyond and is seeking views on future technology, market, consumer, and regulatory implications rather than proposing new rules now.
eSafety legal notices to AI companion providers on child safety and harmful content
eSafety issued legal notices to four AI companion providers requiring them to explain how they are protecting Australian children from sexually explicit content, suicide and self-harm risks, and child sexual exploitation and abuse material.
Basic Online Safety Expectations and reporting guidance
The Basic Online Safety Expectations outline the Australian Government’s expectations that certain online service providers take reasonable steps to keep Australians safe, and eSafety can require reporting on how they are meeting them.
eSafety publishes transparency notice responses for AI services
eSafety publishes a transparency-notice report on AI services and explains how it uses enforceable notices to assess compliance with the Basic Online Safety Expectations.
Australia Age-Restricted Material Codes fully commence
Australia's Age-Restricted Material Codes have fully commenced, requiring online services across the ecosystem to put in place age-appropriate protections for children and age assurance for access to certain adult material.
FDA final PCCP webinar for AI-enabled device software functions
On January 14, 2025, the FDA held a webinar on the final guidance for Predetermined Change Control Plans for AI-enabled device software functions, explaining how sponsors should plan iterative modifications and their validation impacts.
PDPC practical guidance on Ant International proof-of-concept and privacy-preserving AI
The PDPC published practical guidance titled Applicability of Data Protection Provisions in relation to Ant International’s Proof of Concept to Enhance Customer Engagement with Privacy Preserving AI.
PDPC consultation on advisory guidelines for personal data in AI recommendation and decision systems
The PDPC published a public consultation on proposed advisory guidelines for the use of personal data in AI recommendation and decision systems.
Register of Online Safety Codes and Standards
eSafety maintains a public register of Online Safety Codes and Standards, including unlawful material and age-restricted material codes, related standards, notices, and directions to comply.
eSafety findings on AI companion apps following October 2025 transparency notices
eSafety published findings from transparency notices issued to four AI companion service providers, identifying serious gaps in child safety, age assurance, trust and safety staffing, and model testing during the 1 July 2025 to 30 September 2025 reporting period.
Canadian Guardrails for Generative AI code of practice
Canada’s voluntary generative AI code of practice proposes guardrails for safety, fairness, transparency, human oversight, robustness and accountability before binding AIDA rules take effect.
American Catalog Mailers Association v. Director, Division of Taxation
The New Jersey Tax Court upheld regulations treating certain interactive technical support as in-state business activity for tax purposes, while declining to rule on the cookie-data provision without a clearer factual record.
Recommender systems and algorithms – position statement
eSafety’s updated position statement on recommender systems and algorithms says these systems can amplify harm, should be designed with user safety first, and should provide users more control and transparency.
Generative AI – position statement
eSafety’s generative AI position statement describes the technology, identifies risks and harms, and encourages Safety by Design, transparency, and accountability measures for services that generate content.
OECD AI Law Radar
The OECD’s AI Law Radar is an online tracker of AI laws, regulations and obligations across 79 jurisdictions for compliance, legal, privacy and AI governance teams.
Australian Search Code registered with new AI protections
eSafety will register the Search Code with added protections to reduce the risk that search services return child abuse material or use integrated AI to generate synthetic versions of it.
ESAs warn on external dependencies, cyber threats and private credit risks
The ESAs identify external dependencies, cyber threats linked to capable AI models, and private credit as key vulnerabilities for the EU financial system and call for stronger preparedness and monitoring.
Weekly digest
Leave your email to get each issue in your inbox. Free, no account required.
We use your email only for the digest. Privacy policy