AI and data laws

Moving311Enacted704

311 moving · 704 enacted

The brief · Wed Nov 11

The UN Human Rights Council adopted the UN Human Rights Council Resolution on Public-Sector AI Procurement, signaling new compliance criteria for vendors selling AI to government entities. In Congress, the Securing Global Telecommunications Act passed one chamber, while committees received the Algorithmic Accountability Act of 2025 and To direct the Secretary of Commerce to promulgate regulations related to certain artificial intelligence models, and for other purposes.. Meanwhile, organizations operating internationally face an impending compliance effective date for the Chile Personal Data Protection Law (Ley 21.719) on December 1, 2026.

Read more

What to do

  1. Comply with data subject rights under the Chile Personal Data Protection Law (Ley 21.719) by December 1, 2026.
  2. Meet consumer protection standards under Consumer protections for digital access transaction kiosks by December 16, 2026.

Yesterday3 moved

United States (federal)
United States (federal)H.R. 10981

To direct the Secretary of Commerce to promulgate regulations related to certain artificial intelligence models, and for other purposes.

A House bill in Congress, now in committee. Latest step: Referred to the Committee on Energy and Commerce, and in addition to the Committee on Intelligence (Permanent Select), for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.

In committee

Mon Nov 91 moved

Sat Nov 73 moved

New York
New Yorkunverified

RAISE Act 2.0

The proposed legislation would give regulators expanded authority to scrutinize artificial intelligence model development and require independent audits.

Proposed

Fri Nov 62 moved

Thu Nov 51 moved

Nov 41 moved

Nov 32 moved

China
Chinaunverified

AI Legislation

China proposed rules governing artificial intelligence that span data, computing, algorithms, deepfakes, and privacy.

Proposed

Nov 21 moved

Australia
Australiaunverified

Digital Duty of Care Bill

The bill requires online services to protect children from digital harms including those involving artificial intelligence.

Passed one chamber

Oct 311 moved

Canada
Canadaunverified

EU-Canada Digital Trade Agreement

The agreement facilitates cross border data flows and strengthens regulatory cooperation between Canada and the European Union.

Adopted

Oct 302 moved

European Union
European Unionunverified

KIDS Act

The European Commission published a proposal for the KIDS Act to enhance online safety for children.

Proposed

Oct 297 moved

United Kingdom
United Kingdomunverified

British Data Centre Covenant

The UK government unveiled a covenant setting local job, community investment, and water protection standards for data centers seeking faster grid connections.

Proposed
New York
New Yorkunverified

Child AI Chatbot Protection Bills

New York enacted legislation to protect children from risks associated with artificial intelligence chatbots and internet-connected baby monitors.

Enacted
United States (federal)
United States (federal)H.Res. 1642

Expressing the sense of the House of Representatives that Congress must refuse to provide any additional funds or exceptional regulatory support to companies or financial institutions facing insolvency or financial collapse due to exposures to acute stress within the artificial intelligence market a

A House resolution in Congress, now in committee. Latest step: Referred to the Committee on Financial Services, and in addition to the Committees on the Judiciary, and Education and Workforce, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.

In committee

Oct 282 moved

Oct 271 moved

United Kingdom
United KingdomBill 4295

Personal Data (Digital Twins) Bill

A bill to make provision about the regulation of software or algorithms which use or hold personal data for the purpose of modelling the preferences or behaviours of a person; to make provision about the rights of individuals in respect of the holding and use of their personal data by such software

In committee

Oct 262 moved

United States (federal)
United States (federal)H.R. 10915

To require the Director of the National Institute of Standards and Technology to develop new standards, methodologies, and recommendations with respect to the cybersecurity of cloud-based infrastructure, and for other purposes.

A House bill in Congress, now in committee. Latest step: Referred to the Committee on Science, Space, and Technology, and in addition to the Committee on Oversight and Government Reform, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.

In committee

Oct 241 moved

Oct 234 moved

European Union
European Unionunverified

Digital Legislation Overhaul Package

The Council of the European Union agreed on its negotiating position regarding updates to data protection, cookie, data sharing, and incident reporting rules.

Passed one chamber

Oct 224 moved

Georgia
Georgiaunverified

Georgia Social Media Law

A federal appeals court lifted a stay blocking Georgia from enforcing its law restricting children from accessing social media.

Ruled
United States (federal)
United States (federal)unverified

GSA LLM Clause

The General Services Administration issued a procurement clause barring language models from training on government data.

In force

Oct 212 moved

United Kingdom
United KingdomBill 4310

Artificial Intelligence (Consent and Misuse) Bill

A bill to make provision about a requirement for consent to generate a likeness of a person using, or with the assistance of, artificial intelligence; to make further provision relating to that requirement; to make provision about civil action in circumstances where that requirement is not met; to m

In committee
South Korea
South Koreaunverified

Digital Asset Basic Act

South Korea established capital and reserve requirements for stablecoin issuers under new digital asset legislation.

Enacted

Oct 201 moved

Oct 191 moved

Oct 181 moved

Oct 163 moved

Georgia
Georgiaunverified

Georgia Social Media Age Verification Law

A federal appeals court lifted an injunction, allowing Georgia to enforce its law requiring social media platforms to verify user ages and obtain parental consent for minors.

Ruled

Oct 152 moved

Oct 132 moved

Oct 61 moved

Sep 251 moved

United Nations
United NationsA/RES/79/243

UN Convention against Cybercrime

A global treaty requiring parties to criminalize certain offences committed through information and communications technology systems and to cooperate on sharing electronic evidence of serious crimes, which enters into force 90 days after the 40th ratification.

Adopted

Sep 211 moved

Sep 161 moved

Japan
JapanAct No. 56 of 2026

Act on the Protection of Personal Information Amendment

Amends Japan's personal information law to allow data sharing without consent for statistics and AI development, strengthen protections for children under 16 and facial feature data, and introduce administrative surcharges for serious violations.

In force

Sep 21 moved

Sep 11 moved

Chile
ChileBoletin 16821-19 (merged with 15869-19)

Chile AI Systems Bill

Government bill to regulate artificial intelligence systems in Chile using a risk-based approach.

Passed one chamber

Aug 311 moved

Jul 111 moved

Jul 22 moved

Kenya
KenyaAct No. 17 of 2025

Computer Misuse and Cybercrimes (Amendment) Act, 2025

Amends Kenya's Computer Misuse and Cybercrimes Act of 2018, including new offences and powers for the National Computer and Cybercrimes Coordination Committee to act against unlawful websites and applications.

In force

Jun 182 moved

Canada
CanadaBill C-22 (45th Parliament, 1st Session)

Lawful Access Act, 2026

Government bill giving law enforcement new tools to obtain subscriber information and other data from electronic service providers in investigations.

Passed one chamber
Canada
CanadaBill C-16 (45th Parliament, 1st Session), S.C. 2026, c. 19

Protecting Victims Act

Criminal law bill that among other measures extends the offence of non-consensual distribution of intimate images to realistic fabricated depictions of an identifiable person, covering sexual deepfakes.

Enacted

Jun 171 moved

Brazil
BrazilRE 1037396 (Tema 987) and RE 1057258 (Tema 533)

STF ruling on Marco Civil da Internet article 19 platform liability

Declares article 19 of the Marco Civil da Internet partially unconstitutional and holds internet application providers civilly liable for certain third-party content after notice, and without notice for paid ads, bot networks and a list of serious crimes, until Congress legislates.

Ruled

Jun 152 moved

Canada
CanadaBill C-36 (45th Parliament, 1st Session)

Protecting Privacy and Consumer Data Act (Bill C-36)

Government bill that would enact the Protecting Privacy and Consumer Data Act and amend PIPEDA to modernize federal private sector privacy law, including protections for children's data.

Introduced

Jun 81 moved

Israel
IsraelGovernment Bill No. 1955 (National Cyber Defense Bill, 5786-

Israel National Cyber Defense Bill

Government bill to set a permanent statutory framework for national cyber defense in Israel.

In committee

Feb 191 moved

Kenya
KenyaSenate Bills No. 4 of 2026

The Artificial Intelligence Bill, 2026

Would create a framework to regulate artificial intelligence in Kenya, including risk classification, obligations and a public register for high-risk systems, regulatory sandboxes and a dedicated AI office.

Introduced

Jan 271 moved

Jan 11 moved

United Arab Emirates
United Arab EmiratesFederal Decree-Law No. 26 of 2025unverified

Child Digital Safety Law

Requires digital platforms and internet service providers operating in or targeting the UAE to protect users under 18, including age verification, parental consent for data collection from children under 13, privacy-by-default settings and blocking children's access to online gambling.

In force

Dec 181 moved

Dec 172 moved

United Nations
United NationsA/RES/79/1 (annex I)

Global Digital Compact (Pact for the Future)

The Global Digital Compact, annexed to the Pact for the Future, sets shared objectives on closing digital divides, an inclusive and safe digital space, data governance and international AI governance, including the decision to create a scientific panel and global dialogue on AI.

Adopted
United Nations
United NationsA/RES/80/173

WSIS+20 review outcome document

Outcome of the General Assembly's 20-year review of the World Summit on the Information Society, which makes the Internet Governance Forum a permanent UN forum and schedules the next overall review for 2035.

Adopted

Nov 21 moved

Egypt
EgyptMinisterial Decision No. 816 of 2025unverified

Executive Regulations of the Personal Data Protection Law

Implementing rules for Law No. 151 of 2020 that set out licensing and permit procedures, controls and standards for processing personal data, and breach notification to the Personal Data Protection Center within 72 hours.

In force
Every bill and law, going back: all 1,232 →