Every jurisdiction side by side — direction, trend, approach, and tracked instruments — “who stands where,” without opening every country page.
64 of 64 jurisdictions
| Direction | Approach | |||||
|---|---|---|---|---|---|---|
| Argentina | Explicitly deregulatory; investment-first approach with no binding AI law | Loosening | Voluntary, principles-based guidance from the data-protection authority (AAIP) and Jefatura de Gabinete, paired with an explicit government policy of avoiding AI-specific regulation | 2 in force, 1 passed, 2 proposed | — | August 5, 2026 |
| Australia | Stepped back from mandatory guardrails toward a lighter-touch approach | Stable | Existing law plus sector regulators and voluntary guidance, now supplemented by a planned, targeted 'Australian Standards for AI' regime (initially focused on large data centres) and a new AI Safety Institute | 2 in force, 1 proposed | — | August 20, 2026 |
| Bangladesh | Draft national AI policy inherited across a change of government; first data-protection law now in force | Tightening | A risk-based National AI Policy 2026-2030 still in draft, sitting atop a newly enacted Personal Data Protection Act 2026 and a 2025 Cyber Security Ordinance | 2 in force, 2 proposed | — | July 2026 |
| Belgium | Hosts the EU's central AI regulator; strong chip R&D, no domestic frontier lab | Tightening | EU AI Act member state; decentralised national supervision, coordinated by FPS Economy with BIPT and the data protection authority | 3 in force | — | August 2, 2026 |
| Brazil | Comprehensive AI bill pending final passage | Tightening | Risk-based framework (PL 2338), enforcement centred on ANPD; not yet passed | 1 in force, 2 proposed | Emerging | August 20, 2026 |
| Canada | Ambitious investment, no binding AI law | Loosening | No comprehensive AI statute since AIDA died in 2025; governs via existing law, voluntary codes, and narrower targeted bills such as the deepfake-focused Bill C-16 (in force since July 2026) and the still-pending Bill C-36 privacy overhaul | 5 in force, 1 proposed | Domestic | June 18, 2026 |
| Chile | Comprehensive AI bill advancing through the Senate; no binding law yet | Tightening | Risk-tiered, EU-influenced comprehensive AI bill (Boletín 16.821-19) in second constitutional stage in the Senate, layered on a non-binding National AI Policy | 1 in force, 1 passed, 1 proposed | Emerging | August 13, 2026 |
| China | State-directed, expanding into new AI categories | Tightening | Targeted, stacked binding rules — no single comprehensive AI law | 4 in force | Domestic | September 10, 2026 |
| Colombia | Risk-based AI bill pending in Congress; no binding law yet | Tightening | Non-binding CONPES 4144 national policy roadmap, plus a stalled risk-based AI bill (prohibited/high/limited/low risk categories) | 2 in force, 1 proposed | — | August 7, 2026 |
| Costa Rica | National AI strategy and voluntary standard in place; binding law still pending | Stable | Non-binding national strategy (ENIA 2024–2027) plus a voluntary technical standard (INTE/ISO/IEC 42001:2026); three competing binding-law bills remain under Legislative Assembly review | 2 in force, 1 proposed | — | May 2026 |
| Denmark | Early regulator; foundation-funded sovereign compute; health/pharma AI strength | Tightening | EU AI Act member state; among the first with a national implementing law (May 2025); supervision led by Agency for Digital Government and Datatilsynet | 4 in force | Emerging | August 2, 2026 |
| Egypt | Ethics-charter-led governance; binding AI law still in draft | Tightening | Council-coordinated, charter-based ethical guidance (transparency, fairness, accountability) preceding a still-unadopted formal AI law | 3 in force, 1 proposed | Emerging | July 8, 2026 |
| Estonia | e-state deploying AI in government and schools; no domestic frontier lab | Tightening | EU AI Act applied via existing regulators (Data Protection Inspectorate, TTJA); no standalone national AI law | 2 in force, 1 proposed | — | August 2, 2026 |
| Ethiopia | Government-led AI development strategy, policy framework still maturing | Stable | Non-binding National AI Policy (2024) setting strategic direction, paired with a separate binding data protection law (Proclamation No. 1321/2024) | 3 in force | — | July 23, 2026 |
| European Union | Comprehensive law, timelines now loosening | Stable | Risk-tiered hard law, binding across all member states | 1 in force, 1 passed | Domestic | September 16, 2026 |
| Finland | Compute-rich, open-model tradition; emerging frontier via AMD Silo AI and LUMI | Tightening | EU AI Act member state; decentralised national supervision law in force from 1 January 2026, Traficom as central contact point | 3 in force | Emerging | August 2, 2026 |
| France | Large-scale, state-backed compute build-out | Stable | EU AI Act member state; sovereignty pursued mainly through infrastructure investment and certification rather than new national legislation | 3 in force, 1 proposed | Domestic | August 2, 2026 |
| Germany | EU-aligned, with new national enforcement legislation advancing | Tightening | KI-MIG implements and enforces the EU AI Act nationally; reportedly entered into force on 29 July 2026, making the Bundesnetzagentur the central national AI supervisory authority | 3 in force | Emerging | August 2, 2026 |
| Ghana | National AI Strategy launched with large compute ambitions, but no binding AI-specific law | Stable | Ethics-forward and largely non-binding: a launched National AI Strategy and a UNESCO RAM readiness process, with AI governed for now under the 2012 Data Protection Act rather than a dedicated AI statute | 2 in force, 1 proposed | — | July 31, 2026 |
| Greece | EU-aligned implementer building public AI compute; diaspora-led strategy | Tightening | EU AI Act implemented via Law 5321/2026: Hellenic DPA as principal market surveillance authority, EETT as notifying authority, national sandbox and a deepfake criminal offence | 4 in force | Emerging | August 2, 2026 |
| India | Signaling a possible shift toward binding, risk-based legislation | Tightening | Officials have signaled intent to draft a binding, risk-based AI law; IT Rules already binding for synthetic content | 2 in force, 1 proposed | Emerging | August 5, 2026 |
| Indonesia | Non-binding ethics guidance, draft AI regulation pending | Tightening | Voluntary ethics circular (SE 9/2023) plus a national strategy roadmap; a risk-tiered draft Presidential Regulation on AI ethics has been under consultation but its enactment status is unconfirmed | 3 in force, 2 proposed | — | June 2026 |
| Iran | State-directed 'AI sovereignty' push amid institutional flux and war | Tightening | Centralized strategy set by the Supreme Council of the Cultural Revolution, implemented through a national AI organization whose institutional form and authority have shifted repeatedly since 2024 | 2 in force, 1 passed | Emerging | July 2026 |
| Ireland | EU tech-HQ and data-centre hub; distributed AI-Act enforcement led in practice by the DPC | Tightening | EU AI Act member state; distributed sectoral competent authorities coordinated by a National AI Office, with the DPC as lead privacy regulator | 3 in force | — | August 2, 2026 |
| Israel | Risk-based sectoral guidance, no binding AI law | Stable | 'Responsible Innovation' policy — sectoral, risk-based, non-binding | 2 in force, 1 passed | Emerging | August 5, 2026 |
| Italy | First-mover national law, layered atop EU baseline | Tightening | National AI Law (132/2025) plus sector rules, layered atop the EU AI Act | 2 in force, 1 proposed | — | August 4, 2026 |
| Japan | State-backed investment push, still light-touch | Stable | Soft-law guidelines; no penalties under the AI Promotion Act | 3 in force, 1 passed | Emerging | August 8, 2026 |
| Jordan | Active national AI strategy, no dedicated AI law | Stable | Strategy- and project-led implementation through MoDEE and the National Council for Future Technology, with AI-relevant obligations currently addressed mainly through the general Personal Data Protection Law rather than dedicated AI legislation | 3 in force | — | July 9, 2026 |
| Kazakhstan | State-led sovereign-AI drive; regional hub ambitions | Tightening | Central Asia's first comprehensive AI law (in force Jan 2026), emphasising transparency, safety, accountability and data privacy | 3 in force | Emerging | August 2026 |
| Kenya | Strategy launched, comprehensive AI Bill and emerging-tech policy both pending | Tightening | A risk-tiered, centralized model proposed under the pending AI Bill (new AI Commissioner), alongside a broader AI & Emerging Technologies Policy still in public consultation | 2 in force, 2 proposed | — | July 28, 2026 |
| Malaysia | Voluntary guidelines transitioning toward a binding AI law | Tightening | Non-binding National Guidelines on AI Governance & Ethics (2024), with a horizontal AI Governance Bill in active public consultation as of mid-2026 | 2 in force, 1 proposed | — | July 31, 2026 |
| Mexico | No binding AI law yet; voluntary guidance plus competing bills in Congress | Tightening | Voluntary ethics declaration (Secihti/ATDT) alongside at least two distinct AI-specific bills under Senate discussion | 3 in force, 2 proposed | — | July 20, 2026 |
| Morocco | National AI roadmap launched, no binding AI-specific law yet | Tightening | Strategic roadmap ('Maroc IA 2030', launched January 2026) rather than binding regulation; existing data-processing rules run through the 2009 data protection law (09-08) | 1 in force, 2 proposed | Emerging | June 16, 2026 |
| Netherlands | Active AI diplomacy, limited domestic commercial AI industry | Tightening | EU AI Act member state; national Implementation Act in public consultation | 1 in force, 1 proposed | Emerging | August 2, 2026 |
| New Zealand | Adoption-first and light-touch; no standalone AI law or regulator | Stable | Principles-based; relies on existing law (Privacy Act 2020) plus voluntary guidance rather than a dedicated AI statute or regulator | 4 in force | — | August 7, 2026 |
| Nigeria | National strategy published, binding AI law still pending | Tightening | A non-binding National AI Strategy plus general data-protection law, with several competing risk-based AI bills still in the legislative pipeline | 2 in force, 2 proposed | Emerging | August 2026 |
| Norway | EEA fast-follower on EU rules; compute- and deployment-led momentum | Tightening | EU AI Act to be implemented via a national KI-loven once incorporated into the EEA Agreement (bill expected spring 2027); Nkom designated coordinating supervisory authority; GDPR plus Datatilsynet's AI sandbox govern in the interim | 3 in force, 1 proposed | — | August 25, 2026 |
| Pakistan | Ambitious, adoption-led policy; thin enabling infrastructure | Stable | Non-binding national policy and skills targets; no comprehensive AI law or data-protection statute in force | 2 in force, 1 proposed | — | June 2026 |
| Peru | Binding AI law in force, with phased sectoral compliance through 2028 | Tightening | Framework law (Ley 31814) plus implementing regulation (DS 115-2025-PCM), with risk classification and a sector-by-sector obligation timeline | 3 in force | — | May 20, 2026 |
| Philippines | National strategy approved, binding legislation still pending | Tightening | A national strategy (NAIS-PH) plus sectoral privacy guidance from the National Privacy Commission; several AI-specific bills remain pending in Congress without enactment | 3 in force, 5 proposed | — | July 14, 2026 |
| Poland | Ambitious CEE hub; transposing the EU AI Act with a dedicated supervisor | Tightening | EU AI Act member state; national Act on AI Systems adopted by government, creating the KRiBSI supervisory commission | 2 in force, 1 passed | Emerging | August 2, 2026 |
| Portugal | EU-aligned adopter betting on language sovereignty, compute partnerships and AI-led state reform | Tightening | EU AI Act applied via existing regulators with ANACOM as single point of contact and market surveillance authority; no standalone national AI law | 3 in force, 1 proposed | Emerging | August 2, 2026 |
| Qatar | Strategy and sectoral guidance; comprehensive AI regulation still pending | Loosening | Phased, strategy-led approach built on the 2019 National AI Strategy and 2021 AI Committee, with sector-specific guidance (cybersecurity, ethics, judicial AI use) rather than a single binding AI law so far | 4 in force | — | August 2026 |
| Russia | State-directed AI sovereignty under heavy sanctions | Tightening | Light, enabling framework law plus regulatory sandboxes; a separate 'traditional values' alignment strand | 2 in force, 1 passed, 1 proposed | Emerging | July 27, 2026 |
| Rwanda | State-led AI development strategy, no binding AI-specific law | Tightening | Non-binding National AI Policy (2023) covering skills, infrastructure, data, public- and private-sector adoption and ethics, layered with a newly approved National AI Agency | 2 in force, 1 passed | — | August 3, 2026 |
| Saudi Arabia | 2026 declared 'Year of AI'; execution over strategy | Stable | SDAIA-led National Strategy for Data and AI; no binding AI-specific statute, though the binding Personal Data Protection Law (PDPL) — supervised by SDAIA and enforceable since September 2024 — governs data processing relevant to AI systems | 3 in force | Emerging | August 2026 |
| Senegal | State-led digital sovereignty push; AI strategy without a binding AI law | Stable | Non-binding 2023 AI strategy (SNDIA) plus the New Deal Technologique; the 2008 data-protection law (CDP) is the only binding instrument touching AI, and its modernization has stalled | 4 in force | — | August 2026 |
| Singapore | Voluntary, first-mover on agentic AI | Stable | Voluntary, testable frameworks — no binding AI-specific law | 4 in force, 1 proposed | — | August 23, 2026 |
| South Africa | National AI policy withdrawn and under independent redraft | Stable | Decentralized, sector-based oversight (POPIA/Information Regulator, FSCA, SAHPRA) rather than a single AI-specific regulator, per the withdrawn draft's four-tier risk model | 2 in force | — | July 29, 2026 |
| South Korea | First comprehensive AI law now in force | Tightening | Binding cross-sector AI Basic Act, enforced by MSIT | 1 in force | Emerging | August 24, 2026 |
| Spain | First EU national AI authority, measured on new law | Tightening | AESIA-led national market surveillance under the EU AI Act; Organic Law would formally implement it in Spanish law | 2 in force, 1 proposed | Emerging | August 2, 2026 |
| Sweden | Strong applied AI; national AI-Act implementation still being finalised | Tightening | EU AI Act member state; national law (SOU 2025:101) proposes PTS as lead market-surveillance authority, not yet adopted | 2 in force, 1 proposed | Emerging | August 2, 2026 |
| Switzerland | Light-touch and sector-specific, with strong academic and open-model strengths | Stable | Principles-based; ratifying the Council of Europe AI Convention rather than adopting an EU-style horizontal AI act | 2 proposed | Emerging | August 2, 2026 |
| Taiwan | New AI Basic Act; ecosystem widely described as chip-centric | Tightening | AI Basic Act aligned with EU AI Act definitions and seven core principles | 2 in force, 1 proposed | Emerging | August 7, 2026 |
| Thailand | Risk-based draft AI Act moving toward enactment | Tightening | Non-binding National AI Strategy (2022–2027) plus a draft, EU-AI-Act-influenced risk-based AI Act in public consultation as of July 2026 | 3 in force, 1 proposed | — | July 9, 2026 |
| Tunisia | Strong applied-AI heritage; national AI strategy long-announced but reportedly not yet formally promulgated | Stable | No dedicated binding AI law identified; governance rests on the 2004 data-protection regime (INPDP) while a national AI strategy remains, on most Tunisian accounts, in development rather than in force | 2 in force, 1 proposed | — | August 5, 2026 |
| Turkey | Large infrastructure push, stalled comprehensive AI law | Tightening | Sectoral guidance from the data protection authority (KVKK) layered on a draft comprehensive AI law that has stalled in parliamentary committee since mid-2024 | 3 in force, 1 passed, 2 proposed | Emerging | August 18, 2026 |
| Ukraine | Innovation-first, EU-aligned in transition, defence-AI heavy | Stable | Bottom-up: voluntary code and White Paper now, EU AI Act-aligned law later | 2 in force, 1 proposed | — | June 30, 2026 |
| United Arab Emirates | State-directed, consolidating under one Authority | Tightening | State-directed strategy via a unified AI Authority; no binding AI-specific statute | 1 in force | Domestic | August 2026 |
| United Kingdom | Regulator-led, advisory pilot over statute | Stable | Existing regulators plus an advisory AI Growth Lab pilot (legal services first, not yet a rule-relaxing sandbox) | 3 in force, 1 proposed | Domestic | September 2, 2026 |
| United States | Deregulatory, infrastructure-first | Loosening | Sectoral, executive-led — no binding federal frontier-model law | 4 in force, 2 passed, 1 proposed | Domestic | September 22, 2026 |
| Uruguay | Non-binding national AI strategy, active regional ethics leadership | Stable | Principle-based, non-binding National AI Strategy 2024–2030 coordinated by AGESIC; no AI-specific law | 1 in force, 1 proposed | — | July 2026 |
| Uzbekistan | State-led AI catch-up: strategy decrees, first AI rules, inward compute investment | Tightening | First AI rules via amendments to existing laws (signed January 2026): mandatory AI-content labeling, no solely-AI decisions affecting rights, penalties for AI-based data misuse | 5 in force | — | July 17, 2026 |
| Vietnam | Binding, risk-tiered AI law now in force | Tightening | Law No. 134/2025/QH15 on Artificial Intelligence — a binding, three-tier risk-based framework in force since March 1, 2026 | 5 in force | Emerging | June 2026 |