United KingdomA bill to Make provision, including provision amending the Network and Information Systems Regulations 2018, about the security and resilience of network and information systems used or relied on in connection with the carrying on of essential activities.
PennsylvaniaPennsylvania lawmakers passed legislation requiring advertisers to disclose the use of artificial intelligence in certain advertisements.
MassachusettsWould create a comprehensive consumer data privacy law with data minimization rules and limits on selling sensitive data such as location data; the Senate passed S.2619, the engrossed version of S.2516 and S.2608, and the House passed its own amended text.
New YorkWould bar operators from offering AI companions with features deemed unsafe for minors, such as simulated emotional relationships or encouragement of self-harm, with a private right of action.
New YorkWould require conspicuous disclosure when news content is substantially created with generative AI, enforced by the Attorney General.
New YorkWould require developers of generative AI systems offered in New York to post documentation about the data used to train them.
New YorkWould impose a one-year moratorium on permits for data centers with peak demand of 20 megawatts or more and require utility rate classes, efficiency standards and community benefits for large data centers.
New YorkWould require providers of synthetic content creation systems to attach provenance data to AI-generated or modified content.
New YorkWould ban using algorithms and consumers' personal data to charge different customers different prices for the same goods or services, with exceptions such as loyalty programs.
AustraliaThe bill requires online services to protect children from digital harms including those involving artificial intelligence.
AustraliaThe bill imposes a digital duty of care on online services that generate material using artificial intelligence.
PennsylvaniaThe bill requires advertisers to disclose when artificial intelligence is used in advertisements.
European UnionThe Council of the European Union agreed on its negotiating position regarding updates to data protection, cookie, data sharing, and incident reporting rules.
United States (federal)The bill would require state utility regulators to consider whether large electricity users, including data centers, are driving up costs for other ratepayers.
PennsylvaniaThis bill prohibits applications that use artificial intelligence to generate fake nude images of real people.
United States (federal)A Senate bill in Congress, passed by one chamber. Latest step: Message on Senate action sent to the House.
United States (federal)Would limit liability for vendors that provide cloud storage to law enforcement for child sexual abuse material held as evidence.
United States (federal)Would direct the Department of Energy to assess using AI and high performance computing to improve the capacity and reliability of the bulk power system.
United States (federal)Would set a regulatory framework for digital asset markets, giving the CFTC primary oversight of digital commodities and defining the SEC's role.
United KingdomAmends the Network and Information Systems Regulations 2018 to bring managed service providers, data centres and large load controllers into scope, strengthen incident reporting, and expand regulators' enforcement powers.
BrazilSets rules for the development, promotion and ethical and responsible use of artificial intelligence in Brazil, with risk-based obligations and a national AI regulation and governance system.
ChileGovernment bill to regulate artificial intelligence systems in Chile using a risk-based approach.
MassachusettsWould restrict addictive social media feeds for minors.
United States (federal)Would require online platforms to add safeguards for minors, including limits on sexual material, parental controls on social media and games, and disclosures by AI chatbots.
DelawareWould create a pilot program for artificial intelligence and extended reality technology in Delaware schools.
European UnionProposed regulation that would set obligations for online service providers to assess and reduce the risk of child sexual abuse on their services, allow detection orders, and create an EU Centre on child sexual abuse.
PennsylvaniaWould create a comprehensive consumer data privacy law giving Pennsylvanians rights to access, correct, delete and opt out of the sale of their personal data.
United States (federal)Would require the Small Business Administration to report annually on its use of artificial intelligence and machine learning.
PennsylvaniaWould require advertisements that use AI-generated synthetic content to disclose it, enforced as an unfair trade practice.
CanadaGovernment bill giving law enforcement new tools to obtain subscriber information and other data from electronic service providers in investigations.
PennsylvaniaWould treat distributing AI-generated content without a required disclosure as an unfair method of competition enforceable by the Attorney General.
OhioWould create a Data Center Study Commission to study the effects of data centers in Ohio.
United States (federal)House passed vehicle that would reauthorize FISA Title VII until April 30, 2029 with added Section 702 protections and bar a central bank digital currency.
OhioWould address AI-generated images, including simulated child sexual abuse material, and identity fraud using replicas of a person.
United States (federal)Would create a whistleblower incentive and protection program for reporting export control violations to the Bureau of Industry and Security.
United States (federal)Senate bill to limit liability for vendors that provide cloud storage to law enforcement for child sexual abuse material held as evidence.
United States (federal)The bill restricts the export of advanced semiconductor technology.
MichiganWould prohibit making companion AI chatbots available to minors.
MichiganWould create the Michigan Kids Code Act setting privacy and design requirements for online services used by minors.
PennsylvaniaWould require disclosures and safeguards for AI companion chatbots, including protections for minors, with Attorney General enforcement.
ChileOverhauls Chile's personal data protection regime by amending Law 19.628, adding data subject rights such as portability, and creating an independent Personal Data Protection Agency.
New HampshireEstablishes consumer protections for digital asset transaction kiosks such as cryptocurrency ATMs.
GreeceGreece's parliament passed legislation that bans children under the age of 15 from using social media platforms.
DelawareAmends the Delaware Personal Data Privacy Act to align it with other states' laws, including lowering the applicability threshold to entities processing data of at least 15,000 consumers.
CaliforniaBars CEQA categorical exemptions for data center projects and lets the governor certify qualifying data center projects as environmental leadership development projects.
CaliforniaRequires the Public Utilities Commission to assess rate structures so that data centers pay a reasonable share of transmission, distribution and procurement costs tied to their loads.
CaliforniaRequires data center owners or operators to report information such as location, size, power usage effectiveness and onsite generator fuel use to the California Energy Commission.
CaliforniaBars cities and counties from approving permits for new or expanded data centers unless the applicant provides prescribed water use information and other conditions are met.
CaliforniaRequires each electrical corporation to file transmission, distribution and generation service tariffs for participating data center customers.
CaliforniaRequires data center operators to give their water supplier a good faith estimate of expected water use and water source before applying for a local business license or permit.
CaliforniaMakes it an unlawful advertising practice to publish an ad that prominently includes a synthetic performer without a clear and conspicuous disclosure.
CaliforniaRequires companion chatbot operators, beginning July 1, 2027, to perform and document child safety risk assessments and meet other child safety duties before offering new or substantially modified chatbots in California.
CaliforniaBars covered platforms from providing addictive features to users under 16, with Attorney General enforcement, and creates an e-Safety Advisory Commission in the Department of Justice.
CaliforniaRepeals the enjoined Age-Appropriate Design Code Act and replaces it with similar duties requiring online services likely to be accessed by children to take reasonable steps to prevent specified risks of harm.
CaliforniaAmends the Digital Age Assurance Act to revise how operating systems collect age information and send age signals to app stores and app developers.
CaliforniaExpands social media platform reporting duties for child sexual abuse material to cover intimate depictions of identifiable minors and makes noncompliant platforms liable to depicted individuals.
CaliforniaBans the manufacture or sale in California of toys that include a companion chatbot until January 1, 2031.
CaliforniaRequires the Government Operations Agency to create an AI Auditor Registry by January 1, 2029 and bars unregistered AI auditors from conducting covered AI audits.
IllinoisBars teachers from using AI tools to generate evidence of professional practice used in their evaluations and limits AI use in the teacher evaluation process.
IllinoisRequires large frontier AI developers to publish and follow safety frameworks, undergo annual independent third-party audits, and report critical safety incidents.
United KingdomA bill to make provision about the regulation of software or algorithms which use or hold personal data for the purpose of modelling the preferences or behaviours of a person; to make provision about the rights of individuals in respect of the holding and use of their personal data by such software
IndiaSets rules for processing digital personal data, including consent, duties of data fiduciaries, rights of data principals and a Data Protection Board with power to impose penalties.
IndiaImplements the DPDP Act 2023 with rules on notice, consent managers, security safeguards, breach intimation, children's data and the Data Protection Board, phased in over 18 months.
United KingdomA bill to make provision about the regulation of software or algorithms which use or hold personal data for the purpose of modelling the preferences or behaviours of a person; to make provision about the rights of individuals in respect of the holding and use of their personal data by such software
United KingdomA bill to make provision about a requirement for consent to generate a likeness of a person using, or with the assistance of, artificial intelligence; to make further provision relating to that requirement; to make provision about civil action in circumstances where that requirement is not met; to m
ChileOverhauls Chile's personal data protection regime by amending Law 19.628, adding data subject rights such as portability, and creating an independent Personal Data Protection Agency.
European UnionSets EU-wide risk-based rules for AI systems, banning certain practices, imposing requirements on high-risk systems, transparency duties for some AI, and obligations for general-purpose AI model providers.
European UnionCreates a legal presumption of employment for people working through digital labour platforms and sets the first EU rules on algorithmic management, including human oversight of automated decisions and limits on processing workers' personal data.
European UnionCommission guidelines on Article 50 of the AI Act clarifying who must disclose AI interactions, mark AI-generated content in machine-readable form, and label deepfakes and certain AI-generated text.
European UnionAmends the AI Act to delay high-risk obligations to 2 December 2027 and 2 August 2028, extend SME relief to small mid-caps, simplify AI literacy and registration duties, widen AI Office oversight, and ban AI nudification and CSAM generation.
European UnionReplaces the 1985 product liability rules and extends no-fault liability for defective products to software, including AI systems, digital manufacturing files and related digital services.
AustraliaAmends the Privacy Act 1988 to require a Children's Online Privacy Code, add transparency duties for automated decisions, create a statutory tort for serious invasions of privacy and a criminal offence for doxxing.
AustraliaA binding privacy code being developed by the OAIC under the Privacy Act, as required by the 2024 amendments, to set how online services likely to be accessed by children handle their personal information.
United NationsA global treaty requiring parties to criminalize certain offences committed through information and communications technology systems and to cooperate on sharing electronic evidence of serious crimes, which enters into force 90 days after the 40th ratification.
JapanAmends Japan's personal information law to allow data sharing without consent for statistics and AI development, strengthen protections for children under 16 and facial feature data, and introduce administrative surcharges for serious violations.
VietnamRegulates the research, development, provision, deployment and use of AI systems in Viet Nam with risk-based obligations, human oversight, an AI sandbox and a national AI development fund.
European UnionGives people control over and cross-border access to their electronic health data and sets a framework for the secondary use of health data for research, innovation and policy making.
European UnionAdds harmonised procedural rules for how national data protection authorities cooperate and handle complaints in cross-border GDPR cases.
United NationsSets the terms of reference for a 40-member Independent International Scientific Panel on Artificial Intelligence that issues an annual assessment report, and establishes an annual Global Dialogue on AI Governance alternating between Geneva and New York.
European UnionSets common rules to protect media pluralism and editorial independence, including safeguards against spyware use on journalists, transparency of media ownership and state advertising, and treatment of media content by very large online platforms.
New YorkNew York enacts restrictions on specific chatbot features and behaviors to protect children.
European UnionThe European Commission preliminarily found TikTok in breach of the Digital Services Act over harmful algorithmic rabbit hole effects in its recommender system.
New JerseyThe law requires data centers to report their water and energy use to state energy regulators every six months.
CanadaThe agreement facilitates cross border data flows and strengthens regulatory cooperation between Canada and the European Union.
United NationsThe WHO European Region adopted a roadmap to guide the integration and governance of artificial intelligence in health care.
New YorkNew York enacted legislation to protect children from risks associated with artificial intelligence chatbots and internet-connected baby monitors.
West VirginiaA federal appeals court invalidated a West Virginia privacy law.
New YorkThe law requires safety features on baby monitors and bans unsafe artificial intelligence chatbots targeted at minors.
GreeceGreece's parliament passed legislation that bans children under the age of 15 from using social media platforms.
IndiaIndia notified rules establishing terms for testing telecommunications technologies in a regulatory sandbox.
GeorgiaA federal appeals court lifted a stay blocking Georgia from enforcing its law restricting children from accessing social media.
United States (federal)The General Services Administration issued a procurement clause barring language models from training on government data.
New MexicoA New Mexico judge fined Meta over its user data privacy practices.
South KoreaSouth Korea established capital and reserve requirements for stablecoin issuers under new digital asset legislation.
United States (federal)Would require online dating services to notify users who received messages from accounts banned for fraud.
FloridaA federal appeals court upheld a Florida law barring children under 14 from opening social media accounts and requiring parental consent for older minors.
GeorgiaA federal appeals court lifted an injunction, allowing Georgia to enforce its law requiring social media platforms to verify user ages and obtain parental consent for minors.
United NationsThe resolution calls for practical guidance on public-sector artificial intelligence procurement.
DelawareAmends the Delaware Personal Data Privacy Act to align it with other states' laws, including lowering the applicability threshold to entities processing data of at least 15,000 consumers.
CaliforniaWould require employers to give notice about automated decision systems used in employment decisions and bar retaliation against workers who assert their rights, enforced by the Labor Commissioner.
CaliforniaThis bill would have protected nurses from disciplinary action when overriding unsafe artificial intelligence clinical recommendations.
CaliforniaThis bill would have prohibited artificial intelligence algorithms from providing or advertising therapy services.
CaliforniaThe executive order increases safety oversight and requires independent verification of artificial intelligence systems.
Legislationsby Glyph