AI and data laws

Moving311Enacted704

311 moving · 704 enacted

Everything on file

European Union
European UnionRegulation (EU) 2024/1689

AI Act

Sets EU-wide risk-based rules for AI systems, banning certain practices, imposing requirements on high-risk systems, transparency duties for some AI, and obligations for general-purpose AI model providers.

In force
California
CaliforniaSB 362

Delete Act

Requires data brokers to register with the California Privacy Protection Agency and to process consumer deletion requests submitted through a single state-run deletion mechanism.

In force
Minnesota
MinnesotaHF 1606

Nudification technology ban

Bars websites, apps and services from letting users nudify images or videos of identifiable people and from advertising such tools, with a private right of action and attorney general civil penalties up to $500,000 per violation.

In force
Minnesota
MinnesotaSF 3868

Virtual currency kiosk ban

Prohibits installing or operating cryptocurrency kiosks in Minnesota from August 1, 2026, requires operators to remove them and pay out customer funds by December 31, 2026, and repeals the prior kiosk regulations.

In force
European Union
European UnionCouncil Regulation (EU) 2026/150

EuroHPC AI Gigafactories amendment

Amends the EuroHPC Joint Undertaking regulation to provide a legal basis for AI Gigafactories of more than 100,000 advanced AI processors and to expand quantum computing activities.

In force
European Union
European UnionRegulation (EU) 2026/1744 (COM(2025) 836, 2025/0359(COD))

Digital Omnibus on AI

Amends the AI Act to delay high-risk obligations to 2 December 2027 and 2 August 2028, extend SME relief to small mid-caps, simplify AI literacy and registration duties, widen AI Office oversight, and ban AI nudification and CSAM generation.

In force
United States (federal)
United States (federal)H.R. 9917

AI Kill Switch Act

A House bill in Congress, now in committee. Latest step: Referred to the Subcommittee on Cybersecurity and Infrastructure Protection.

In committee
European Union
European UnionRegulation (EU) 2022/1925

Digital Markets Act

Sets obligations and prohibitions for large online platforms designated as gatekeepers, such as bans on self-preferencing and anti-steering, and requirements on interoperability and data use.

In force
European Union
European Union

DMA non-compliance decision against Google

Commission decision fining Google 890 million euros under the Digital Markets Act: 460 million for self-preferencing its own services in Google Search and 430 million for anti-steering restrictions on Google Play.

Ruled
Delaware
DelawareSB 308

Load Forecast Accountability Act

Creates the Load Forecast Accountability Act to scrutinize electricity demand forecasts driven by data centers and other large loads.

In force
South Korea
South KoreaPresidential Decree No. 36053

Enforcement Decree of the AI Basic Act

Implements the AI Basic Act with detailed rules on high-impact AI criteria and impact assessments, safety obligations for large AI systems, domestic representative thresholds and the schedule of administrative fines.

In force
European Union
European UnionRegulation (EU) 2022/2065

Digital Services Act

Sets due diligence obligations for online intermediaries and platforms on illegal content, transparency, advertising and protection of minors, with extra systemic risk duties for very large online platforms and search engines supervised by the Commission.

In force
European Union
European UnionC(2025) 8630 final

DSA non-compliance decision against X

First Digital Services Act non-compliance decision, fining X 120 million euros for deceptive design of its blue checkmark (Article 25(1)), a deficient advertising repository (Article 39) and failing to give researchers access to public data (Article 40(12)).

Ruled
United States (federal)
United States (federal)H.R. 9716

PRIVACY Act

A House bill in Congress, now in committee. Latest step: Referred to the Committee on the Judiciary, and in addition to the Committee on Oversight and Government Reform, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.

In committee
Japan
Japan

AI Basic Plan

Sets out the government's plan under the AI Promotion Act for promoting AI research, development, use and trustworthiness, revised in 2026 as a second-phase plan.

Adopted
Hawaii
HawaiiHB 1753

Relating to Social Media (account deletion)

Requires certain social media platforms to let users delete their accounts and permanently erase associated personal information, and bars deceptive practices that obstruct deletion.

Enacted
United States (federal)
United States (federal)H.R. 7757

KIDS Act

Would require online platforms to add safeguards for minors, including limits on sexual material, parental controls on social media and games, and disclosures by AI chatbots.

Passed one chamber
Illinois
IllinoisSB 2909

AI in Teacher Evaluations

Bars teachers from using AI tools to generate evidence of professional practice used in their evaluations and limits AI use in the teacher evaluation process.

Enacted
Illinois
IllinoisSB 3114

Transparency in Downcoding Act

Bars health insurers from using automated processes or algorithms that bypass review of the billing professional's information to downcode medical claims.

Enacted
European Union
European UnionDirective (EU) 2022/2555

NIS2 Directive

Sets cybersecurity risk management and incident reporting obligations for medium and large entities in critical sectors and requires member states to supervise and enforce them.

In force
Vietnam
VietnamLaw No. 134/2025/QH15

Law on Artificial Intelligence

Regulates the research, development, provision, deployment and use of AI systems in Viet Nam with risk-based obligations, human oversight, an AI sandbox and a national AI development fund.

In force