From regulation clause to the test that proves it.

The first broad AI law. It bans some practices, puts strict duties on "high-risk" uses (credit, hiring, health, education…) and requires telling people when they talk to AI. Phasing in from 2025 to 2027.

The industry checklist of the ten biggest security risks in LLM apps, such as prompt injection, sensitive-data disclosure, excessive agency and system-prompt leakage.

Voluntary US framework (Govern, Map, Measure, Manage) for trustworthy AI. The GenAI profile lists risks like confabulation, harmful content and data privacy.

Certifiable standard for running an AI management system: policies, risk assessment, impact assessment and lifecycle controls for AI.

Guidance on identifying, assessing and treating AI-specific risks; often used alongside ISO 42001.

A knowledge base of real attacker tactics against AI systems (like MITRE ATT&CK, but for ML and LLMs). Used for red-teaming.

First US state law on "high-risk" AI that makes consequential decisions (lending, jobs, housing, insurance, health). Requires care against algorithmic discrimination; effective mid-2026.

Requires businesses to disclose generative-AI interactions when asked, and up front in regulated occupations.

Rules for public generative-AI services in China: content controls, training-data legality, labelling of AI-generated content and security assessments.

South Korea’s AI law (in force 2026): transparency for generative AI, and safety and risk duties for "high-impact" AI.

Singapore’s voluntary governance framework and testing toolkit covering transparency, fairness, robustness and accountability.

EU law on personal data: lawful basis, data minimisation and user rights, plus limits on decisions made solely by automated means (Art. 22).

The UK’s post-Brexit version of GDPR, enforced by the ICO, which also publishes AI and data-protection guidance.

California privacy law: rights to know, delete, correct and opt out of sale or sharing, plus rules on automated decision-making technology.

A growing patchwork of state laws similar to CCPA, several with opt-outs from profiling that drives significant decisions.

India’s privacy law: consent-based processing, purpose limitation, data-principal rights and extra care for children’s data. Rules are phasing in.

Brazil’s GDPR-style law, including a right to request review of automated decisions.

Canadian federal privacy law; Quebec adds duties to inform people about decisions made exclusively by automated processing.

China’s privacy law with strict consent, cross-border transfer rules and a right to refuse decisions made solely by automated means.

Japan’s privacy law covering use, sharing and cross-border transfer of personal information.

Singapore’s privacy law; the PDPC has advisory guidelines on personal data in AI recommendation and decision systems.

Australian privacy principles, with recent amendments adding transparency about automated decisions that affect individuals.

Gulf privacy laws modelled on GDPR, with consent and data-transfer restrictions.

Audit report on security, availability, confidentiality, processing integrity and privacy controls. Commonly asked for by enterprise customers.

Certifiable information-security management standard; AI systems fall inside its risk and control scope.

Adds privacy controls on top of ISO 27001, mapping well to GDPR-style obligations.

EU cybersecurity law for essential and important entities: risk management, incident reporting and supply-chain security.

US government security authorisation for cloud services, including AI services sold to federal agencies.

Required wherever card data is stored, processed or transmitted. A bot that sees card numbers is in scope.

The bank standard for model risk: independent validation, ongoing monitoring and documentation. Regulators apply it to AI and LLMs.

Bans credit discrimination and requires specific reasons when credit is denied, even when an AI model made the call.

US rules for how financial institutions protect and share customers’ non-public personal information.

Controls over financial reporting for US-listed companies. AI in finance workflows needs tested, auditable controls.

Cybersecurity rules for New York-regulated financial firms; DFS has issued guidance on AI-specific cyber risks.

Applies since January 2025 to EU financial entities: ICT risk management, resilience testing and third-party (including AI vendor) oversight.

UK rules requiring good customer outcomes and fair communications (FCA), and model-risk management for banks (PRA).

Indian regulators’ expectations for responsible AI in banks and markets: governance, fairness, explainability and consumer protection.

Protects patients’ health information (PHI) held by US providers, plans and their vendors.

Certifiable security framework popular in US healthcare, with an add-on for AI systems.

AI that diagnoses, treats or guides clinical decisions can be a regulated medical device needing validation and change-control plans.

EU device rules; medical AI is usually also "high-risk" under the EU AI Act.

AI used to screen candidates or employees in NYC needs an annual independent bias audit and candidate notices.

Employers stay liable if an AI hiring or HR tool discriminates, whoever built it.

Parental consent and data limits for services directed at children under 13 in the US.

Design standards for online services likely to be used by children: high-privacy defaults and no harmful nudges.

Protects student education records at US schools and universities, including those handled by AI tutors and assistants.

The accessibility standard most laws point to. Chat widgets and voice bots must work with screen readers and keyboards.

Since June 2025, consumer services such as e-commerce, banking and e-books must be accessible in the EU, including their chat channels.

US accessibility duties for public-facing services (ADA) and federal technology (508).

Bans unfair or deceptive practices. The FTC uses it against misleading AI claims and harmful AI outputs.

Duties for online platforms on illegal content, transparency and systemic risks, relevant when AI generates or moderates content.

Rules for US agencies using AI, with extra risk practices for "high-impact" AI that affects rights or safety.