ChinaImplements the Cybersecurity Law, Data Security Law and Personal Information Protection Law with detailed rules on personal information handling, important data protection, cross-border data transfers and obligations of large online platforms.
New HampshireCreates a comprehensive consumer data privacy law giving residents rights to access, correct, delete and opt out of the sale, targeted advertising and profiling uses of their personal data.
New HampshireProhibits certain uses of deepfakes and creates a private right of action for people harmed by them.
MichiganExempts data center equipment used by a qualifying enterprise data center from the use tax, tie-barred to the HB 4906 sales tax exemption.
United NationsAffirms that international law applies across the life cycle of military AI capabilities and asks the Secretary-General to seek views of States on the opportunities and challenges of AI in the military domain and report to the 80th session.
CameroonSets Cameroon's first general framework for the protection of personal data.
United States (federal)Annual defense authorization law for fiscal year 2025 that includes provisions on Department of Defense artificial intelligence programs.
New YorkRequires state agencies to apply meaningful human review to automated decision-making systems that affect benefits or individual rights, conduct impact assessments and disclose the systems they use.
United States (federal)Would establish AI standards, metrics and evaluation work at NIST, including an AI Safety Institute, and support AI testbeds and research.
United States (federal)Would set requirements for federal agency use and procurement of artificial intelligence, including inventories and transparency measures.
United States (federal)A Senate bill in Congress, now in committee. Latest step: Placed on Senate Legislative Calendar under General Orders. Calendar No. 727.
United NationsCalls on States to respect and protect the right to privacy in the digital age, including in the context of surveillance, data collection and the design, use and governance of artificial intelligence.
United States (federal)Senate version of the bill to establish the National Artificial Intelligence Research Resource for shared AI research computing and data.
ChileOverhauls Chile's personal data protection regime by amending Law 19.628, adding data subject rights such as portability, and creating an independent Personal Data Protection Agency.
European UnionReplaces the 1985 product liability rules and extends no-fault liability for defective products to software, including AI systems, digital manufacturing files and related digital services.
United States (federal)Would criminalize publishing nonconsensual intimate images, including AI generated deepfakes, and require platforms to remove them within 48 hours of a valid request.
United NationsFollows up resolution 78/241 by deciding to convene open informal consultations in New York in 2025 on lethal autonomous weapons systems, complementing the work of the Group of Governmental Experts under the Convention on Certain Conventional Weapons.
European UnionCreates a legal presumption of employment for people working through digital labour platforms and sets the first EU rules on algorithmic management, including human oversight of automated decisions and limits on processing workers' personal data.
North CarolinaUpdates sexual exploitation of minor laws to cover realistic visual depictions created or modified with algorithms or artificial intelligence, and revises related sex crime provisions.
United States (federal)A House resolution in Congress, now in committee. Latest step: Referred to the House Committee on Financial Services.
European UnionSets the technical and methodological cybersecurity risk management requirements under NIS2 for digital infrastructure and digital service providers, such as cloud, data centre and managed security providers, and defines when their incidents count as significant.
PennsylvaniaMakes AI-generated and digitally altered sexual images of children child sexual abuse material and extends the unlawful dissemination of intimate images offense to deepfakes.
BotswanaBotswana's updated data protection law governing the processing of personal data and the rights of data subjects.
United NationsWTSA-24 resolution directing the ITU Telecommunication Standardization Sector to carry out standardization work on AI technologies in support of telecommunications and ICTs.
IndonesiaSets rules on personal data types, data subject rights, processing, controller and processor obligations, cross-border transfers, administrative sanctions and a supervisory institution in Indonesia.
South KoreaAmends the Act on Special Cases Concerning the Punishment of Sexual Crimes to criminalize possessing, buying, storing or viewing sexually explicit deepfakes and to raise the maximum penalty for creating or distributing them to seven years in prison.
United NationsHuman Rights Council resolution affirming that the same rights people have offline must also be protected online, in particular freedom of expression.
DelawareMakes it a crime to distribute a deceptive deepfake of a candidate or party within 90 days of an election unless it carries a disclosure.
DelawareExtends Delaware's civil and criminal remedies for unauthorized intimate images to deepfakes depicting people nude or in sexual conduct.
CaliforniaRequires large online platforms to block or label materially deceptive AI-generated or altered content about candidates and election officials during set periods around elections.
United States (federal)Exempts certain CHIPS Act funded semiconductor manufacturing projects from National Environmental Policy Act review.
MontanaCreates a comprehensive consumer data privacy law giving Montana residents rights to access, correct, delete and opt out of the sale and targeted advertising use of their personal data.
CaliforniaWould have required developers of the largest frontier AI models to adopt safety and security protocols, assess risks of critical harms and be able to fully shut down covered models.
CaliforniaExpands state child sexual abuse material crimes to cover matter that is digitally altered or generated by artificial intelligence.
CaliforniaRequires state agencies to assess risks of generative AI use and to disclose when communications with the public about government services are generated by AI.
CaliforniaRequires developers of generative AI systems released since January 1, 2022 to post documentation on their websites summarizing the data used to train them, by January 1, 2026.
CaliforniaClarifies that personal information under the CCPA can exist in various formats, including artificial intelligence systems capable of outputting personal information.
CaliforniaAdds neural data, meaning information generated by measuring nervous system activity, to the CCPA definition of sensitive personal information.
CaliforniaRequires health facilities, clinics and physician offices that use generative AI for patient clinical communications to include a disclaimer and instructions for reaching a human provider.
CaliforniaRequires health plans and insurers that use AI, algorithms or other software for utilization review to meet specified requirements, including leaving medical necessity decisions to licensed health care professionals.
CaliforniaEstablishes a uniform definition of artificial intelligence across California statutes.
CanadaQuebec law modernizing public and private sector privacy rules in phases, adding privacy governance duties, privacy impact assessments, consent and transparency requirements and a data portability right.
CaliforniaMakes it a crime to intentionally create and distribute realistic computer-generated or digitally altered intimate images of an identifiable person that cause serious emotional distress.
CaliforniaRequires social media platforms to give California users a way to report sexually explicit digital identity theft and to temporarily block reported content while it is reviewed.
CaliforniaMakes contract terms allowing a digital replica of a performer's voice or likeness in new performances unenforceable when specified protections, such as a reasonably specific description of uses and representation, are missing.
CaliforniaMakes a person who produces or distributes a digital replica of a deceased personality's voice or likeness in audiovisual works or sound recordings without prior consent liable for at least $10,000 or actual damages.
United States (federal)Senate subcommittee hearing with former AI company employees on AI safety practices and oversight.
CaliforniaRequires committees that run political ads with AI-generated or substantially altered content to disclose that the ad was generated or altered using artificial intelligence.
Saudi ArabiaSaudi Arabia's comprehensive personal data protection law, supervised by SDAIA, governing processing and cross-border transfer of personal data with fines of up to SAR 5 million.
ZimbabweSets Zimbabwe's rules on personal data protection and cybercrime, with 2024 regulations on licensing data controllers and appointing data protection officers.
Legislationsby Glyph