AI and data laws

311 moving · 704 enacted

Everything on file

Brazil
BrazilLei 15.352/2026 (conversion of Medida Provisoria 1.317/2025)

Law restructuring the ANPD as the National Data Protection Agency

Amends the LGPD to establish the Agencia Nacional de Protecao de Dados (ANPD) as a special autonomous federal agency, creates a data protection regulation and enforcement career, and sets the ECA Digital's entry into force for 2026-03-17.

In force
Kenya
KenyaSenate Bills No. 4 of 2026

The Artificial Intelligence Bill, 2026

Would create a framework to regulate artificial intelligence in Kenya, including risk classification, obligations and a public register for high-risk systems, regulatory sandboxes and a dedicated AI office.

Introduced
United Kingdom
United Kingdom2025 c. 18

Data (Use and Access) Act 2025

Reforms UK data protection law, creates frameworks for digital verification services and smart data, restructures the Information Commissioner's Office, adds an offence of creating or requesting intimate images of adults without consent, and requires government reports on copyright and AI.

In force
Utah
UtahSB 142

App Store Accountability Act

Requires app stores to verify users' ages and obtain parental consent before minors download apps or make purchases, and to share age category data with developers.

In force
Texas

Ban on Chinese AI and social media apps on state devices

Governor directive banning AI and social media apps affiliated with the People's Republic of China and the Chinese Communist Party, including DeepSeek, RedNote and Lemon8, from government-issued devices and adding them to the state prohibited technologies list.

In force
United States (federal)

AI-WISE Act

Would require the Small Business Administration to offer educational resources on artificial intelligence tools for small businesses.

Passed one chamber
California

Water Resources: Data Centers

Would have required data center operators to give their water supplier an estimate of expected water use before applying for a local business license.

Vetoed
United States (federal)

AI OVERWATCH Act

Would require export licenses and congressional review for sales of advanced AI chips to countries of concern.

In committee
Kazakhstan
KazakhstanLaw No. 230-VIIIunverified

Law on Artificial Intelligence

Sets principles, a three-level risk classification, prohibited practices and machine-readable labeling of synthetic content for AI systems in Kazakhstan, and addresses copyright in AI-generated works.

In force
Taiwan
TaiwanPresidential Order Hua-Zong-Yi-Yi-Zi No. 11500001671

Artificial Intelligence Basic Act

Sets Taiwan's basic AI governance framework with the National Science and Technology Council as competent authority, seven governance principles, a risk classification framework coordinated by the Ministry of Digital Affairs, and labeling and accountability rules for high-risk AI.

In force
United States (federal)

DEFIANCE Act of 2025

Would create a federal civil remedy for people depicted in sexually explicit deepfakes made or shared without consent.

Passed one chamber
China
ChinaPresidential Order No. 61

Decision Amending the Cybersecurity Law

Amends the Cybersecurity Law to add a provision supporting AI research, infrastructure, ethics and risk monitoring, raise fines for network security violations, and align liability with the Data Security Law and Personal Information Protection Law.

In force
Vietnam
VietnamLaw No. 91/2025/QH15

Law on Personal Data Protection

Sets a statutory framework for collecting, processing and transferring personal data in Viet Nam, replacing Decree 13/2023/ND-CP as the main personal data protection rule.

In force
Malaysia
MalaysiaAct 866

Online Safety Act 2025

Requires licensed application, content and network service providers to mitigate harmful content, provide reporting mechanisms and protect child users, with enforcement by the Malaysian Communications and Multimedia Commission.

In force
Texas
TexasHB 149

Texas Responsible Artificial Intelligence Governance Act (TRAIGA)

Bans developing or deploying AI systems for certain intentional harms such as behavioral manipulation toward self-harm, unlawful discrimination, government social scoring and sexual deepfakes of minors, requires state agencies to disclose AI use to consumers, and creates an AI regulatory sandbox and the Texas Artificial Intelligence Council, enforced by the attorney general.

In force
United Arab Emirates
United Arab EmiratesFederal Decree-Law No. 26 of 2025unverified

Child Digital Safety Law

Requires digital platforms and internet service providers operating in or targeting the UAE to protect users under 18, including age verification, parental consent for data collection from children under 13, privacy-by-default settings and blocking children's access to online gambling.

In force