Updated 15 June 2026 · refreshed monthly

The AI Governance Index

Every major AI law, framework and standard in one place — what each one actually asks of you, and which apply where you operate. From the EU AI Act to NIST and ISO/IEC 42001.

35frameworks16jurisdictions4framework types

⚠️ This explorer is for general orientation only and is not legal advice. AI law is changing fast and several entries note pending or recently changed status. Verify against the official source before relying on it, and consult qualified counsel for your specific situation.

The global picture

The deeper the colour, the more binding AI laws are in force. Hover a country to see its stack — or click it to jump straight to the detail below.

What applies in your country?

Pick a jurisdiction to see the stack of binding laws, plus the standards and voluntary frameworks you can adopt anywhere.

Europe
Americas
Asia-Pacific
🇪🇺

European Union

The EU AI Act (risk-based, extraterritorial) + GDPR set the baseline for all 27 member states; the Council of Europe AI Convention adds a human-rights treaty layer. Member states add national implementing laws and supervisory authorities.

Binding / national rules 3

EU AI Act The world's first comprehensive, horizontal AI law. It classifies AI systems by risk and scales obligations accordingly — from outright bans on 'unacceptable' uses to full conformity requirements for 'high-risk' systems, lighter transparency duties for limited-risk systems, and a separate regime for general-purpose AI (GPAI) models. In force (phased) GDPR The EU's data-protection law. Where AI processes personal data, GDPR governs automated decision-making, profiling and the duty to assess and mitigate privacy risk — operating in parallel with the AI Act. In force CoE AI Convention The first legally binding international treaty on AI. A high-level framework requiring signatory states to ensure AI activities are consistent with human rights, democracy and the rule of law, implemented through their own national laws. In force

Standards & voluntary frameworks adoptable anywhere

ISO/IEC 42001ISO/IEC 23894ISO/IEC 42005ISO/IEC 27001NIST AI RMFUNESCO AI EthicsOECD AI PrinciplesG7 Hiroshima Code
🇪🇸

Spain

Spain = EU AI Act + GDPR, enforced nationally by AESIA (the EU's first dedicated AI agency), plus a draft Organic Law adding strong AI-content labelling and a ban on non-consensual sexual deepfakes.

Binding / national rules 4

EU AI Act The world's first comprehensive, horizontal AI law. It classifies AI systems by risk and scales obligations accordingly — from outright bans on 'unacceptable' uses to full conformity requirements for 'high-risk' systems, lighter transparency duties for limited-risk systems, and a separate regime for general-purpose AI (GPAI) models. In force (phased) GDPR The EU's data-protection law. Where AI processes personal data, GDPR governs automated decision-making, profiling and the duty to assess and mitigate privacy risk — operating in parallel with the AI Act. In force CoE AI Convention The first legally binding international treaty on AI. A high-level framework requiring signatory states to ensure AI activities are consistent with human rights, democracy and the rule of law, implemented through their own national laws. In force Spain national AI law Spain created the EU's first dedicated national AI supervisor (AESIA) and ran the EU's first AI regulatory sandbox. In 2026 it advanced an Organic Law to enforce the EU AI Act domestically, with strong AI-content labelling rules and a ban on non-consensual sexual deepfakes. Partly in force (agency live; law in draft)

Standards & voluntary frameworks adoptable anywhere

ISO/IEC 42001ISO/IEC 23894ISO/IEC 42005ISO/IEC 27001NIST AI RMFUNESCO AI EthicsOECD AI Principles
🇮🇹

Italy

Italy = EU AI Act + GDPR + the first national EU AI law (132/2025), adding criminal deepfake provisions, a human-oversight principle and sector rules (health, work, minors), supervised by AgID + ACN.

Binding / national rules 4

EU AI Act The world's first comprehensive, horizontal AI law. It classifies AI systems by risk and scales obligations accordingly — from outright bans on 'unacceptable' uses to full conformity requirements for 'high-risk' systems, lighter transparency duties for limited-risk systems, and a separate regime for general-purpose AI (GPAI) models. In force (phased) GDPR The EU's data-protection law. Where AI processes personal data, GDPR governs automated decision-making, profiling and the duty to assess and mitigate privacy risk — operating in parallel with the AI Act. In force CoE AI Convention The first legally binding international treaty on AI. A high-level framework requiring signatory states to ensure AI activities are consistent with human rights, democracy and the rule of law, implemented through their own national laws. In force Italy AI Law (132/2025) The first EU member-state comprehensive national AI law. It complements (not duplicates) the EU AI Act, layering on national governance, sector rules (health, work, justice), child-protection rules and criminal provisions for harmful deepfakes. In force

Standards & voluntary frameworks adoptable anywhere

ISO/IEC 42001ISO/IEC 23894ISO/IEC 42005ISO/IEC 27001NIST AI RMFUNESCO AI EthicsOECD AI PrinciplesG7 Hiroshima Code
🇫🇷

France

France = EU AI Act + GDPR enforced through a distributed sector model (CNIL, DGCCRF, ARCOM, ACPR, HAS); formal national authority designation was still pending in mid-2026.

Binding / national rules 4

EU AI Act The world's first comprehensive, horizontal AI law. It classifies AI systems by risk and scales obligations accordingly — from outright bans on 'unacceptable' uses to full conformity requirements for 'high-risk' systems, lighter transparency duties for limited-risk systems, and a separate regime for general-purpose AI (GPAI) models. In force (phased) GDPR The EU's data-protection law. Where AI processes personal data, GDPR governs automated decision-making, profiling and the duty to assess and mitigate privacy risk — operating in parallel with the AI Act. In force CoE AI Convention The first legally binding international treaty on AI. A high-level framework requiring signatory states to ensure AI activities are consistent with human rights, democracy and the rule of law, implemented through their own national laws. In force France AI framework France enforces the EU AI Act through a distributed, sector-based model rather than one dedicated AI agency. CNIL has been the most visible body, issuing AI guidance under GDPR, but formal national authority designations were still pending parliamentary adoption in mid-2026. Designation pending

Standards & voluntary frameworks adoptable anywhere

ISO/IEC 42001ISO/IEC 23894ISO/IEC 42005ISO/IEC 27001NIST AI RMFUNESCO AI EthicsOECD AI PrinciplesG7 Hiroshima Code
🇩🇪

Germany

Germany = EU AI Act + GDPR implemented via the draft KI-MIG, making the Bundesnetzagentur the central AI supervisor in a hybrid model with BfDI, BaFin and BSI (cabinet-adopted Feb 2026).

Binding / national rules 4

EU AI Act The world's first comprehensive, horizontal AI law. It classifies AI systems by risk and scales obligations accordingly — from outright bans on 'unacceptable' uses to full conformity requirements for 'high-risk' systems, lighter transparency duties for limited-risk systems, and a separate regime for general-purpose AI (GPAI) models. In force (phased) GDPR The EU's data-protection law. Where AI processes personal data, GDPR governs automated decision-making, profiling and the duty to assess and mitigate privacy risk — operating in parallel with the AI Act. In force CoE AI Convention The first legally binding international treaty on AI. A high-level framework requiring signatory states to ensure AI activities are consistent with human rights, democracy and the rule of law, implemented through their own national laws. In force Germany AI framework (KI-MIG) Germany is implementing the EU AI Act via the draft KI-MIG, making the Bundesnetzagentur the central coordinator and market-surveillance authority in a hybrid model with sectoral regulators. Cabinet-adopted in February 2026; parliamentary passage pending. Draft (cabinet-adopted)

Standards & voluntary frameworks adoptable anywhere

ISO/IEC 42001ISO/IEC 23894ISO/IEC 42005ISO/IEC 27001NIST AI RMFUNESCO AI EthicsOECD AI PrinciplesG7 Hiroshima Code
🇳🇱

Netherlands

Netherlands = EU AI Act + GDPR baseline; national supervision is being arranged through existing regulators (e.g., the Dutch DPA's algorithm-oversight unit). No separate national AI statute.

Binding / national rules 3

EU AI Act The world's first comprehensive, horizontal AI law. It classifies AI systems by risk and scales obligations accordingly — from outright bans on 'unacceptable' uses to full conformity requirements for 'high-risk' systems, lighter transparency duties for limited-risk systems, and a separate regime for general-purpose AI (GPAI) models. In force (phased) GDPR The EU's data-protection law. Where AI processes personal data, GDPR governs automated decision-making, profiling and the duty to assess and mitigate privacy risk — operating in parallel with the AI Act. In force CoE AI Convention The first legally binding international treaty on AI. A high-level framework requiring signatory states to ensure AI activities are consistent with human rights, democracy and the rule of law, implemented through their own national laws. In force

Standards & voluntary frameworks adoptable anywhere

ISO/IEC 42001ISO/IEC 23894ISO/IEC 42005ISO/IEC 27001NIST AI RMFUNESCO AI EthicsOECD AI Principles
🇮🇪

Ireland

Ireland = EU AI Act + GDPR baseline, enforced via a distributed model of existing regulators. As host to many AI/tech firms' EU HQs, its data-protection authority is especially significant.

Binding / national rules 3

EU AI Act The world's first comprehensive, horizontal AI law. It classifies AI systems by risk and scales obligations accordingly — from outright bans on 'unacceptable' uses to full conformity requirements for 'high-risk' systems, lighter transparency duties for limited-risk systems, and a separate regime for general-purpose AI (GPAI) models. In force (phased) GDPR The EU's data-protection law. Where AI processes personal data, GDPR governs automated decision-making, profiling and the duty to assess and mitigate privacy risk — operating in parallel with the AI Act. In force CoE AI Convention The first legally binding international treaty on AI. A high-level framework requiring signatory states to ensure AI activities are consistent with human rights, democracy and the rule of law, implemented through their own national laws. In force

Standards & voluntary frameworks adoptable anywhere

ISO/IEC 42001ISO/IEC 23894ISO/IEC 42005ISO/IEC 27001NIST AI RMFUNESCO AI EthicsOECD AI Principles
🇬🇧

United Kingdom

UK = no comprehensive AI Act; a pro-innovation, principles-based approach run by sector regulators (ICO, Ofcom, CMA, FCA) plus the AI Security Institute. Note the EU AI Act may still apply to UK firms selling into the EU.

Binding / national rules 2

UK AI approach The UK has deliberately avoided a single horizontal AI law, instead asking existing regulators to apply five cross-sector principles within their remits. A growth-focused bill was signalled in 2026 but no comprehensive AI Act is enacted; the rebranded AI Security Institute handles frontier-model risk. In force (non-statutory) CoE AI Convention The first legally binding international treaty on AI. A high-level framework requiring signatory states to ensure AI activities are consistent with human rights, democracy and the rule of law, implemented through their own national laws. In force

Standards & voluntary frameworks adoptable anywhere

ISO/IEC 42001ISO/IEC 23894ISO/IEC 42005ISO/IEC 27001NIST AI RMFUNESCO AI EthicsOECD AI PrinciplesG7 Hiroshima Code
🇺🇸

United States

US = no comprehensive federal AI statute — a patchwork of deregulatory federal executive orders + the voluntary NIST AI RMF, with binding obligations coming chiefly from state/city laws that stack by where you operate. As of Dec 2025 the federal government is trying to preempt state AI laws.

Binding / national rules 9

US Federal AI Policy There is no comprehensive US federal AI statute. Federal policy is set by executive orders and voluntary frameworks. The Trump administration's EO 14179 (Jan 2025) rescinded Biden's EO 14110, the AI Action Plan (Jul 2025) is in implementation, and EO 14365 (Dec 2025) pushes to preempt state AI laws. Active (no federal statute) Colorado AI Act The first US comprehensive 'high-risk AI' law (2024) never took effect: before its delayed start it was repealed and replaced by SB 26-189 (signed May 2026), a narrower automated-decision-making (ADMT) disclosure/rights framework effective Jan 1, 2027. The original risk-management, impact-assessment and reasonable-care duties were dropped. Replaced — new law effective 2027 California AI Laws California regulates AI through targeted laws rather than one statute: AB 2013 (training-data transparency), SB 942 (AI content labelling + detection tools), and SB 53 (first US frontier-AI safety law). The broader SB 1047 was vetoed in 2024; SB 53 is its lighter successor. In force TRAIGA Texas is the third state with a comprehensive AI law, but the enacted version is narrow — it mainly governs state-agency AI use and bans a short list of harmful uses, with a first-in-nation AI regulatory sandbox. In force Utah AI Policy Act Utah was the first state with a broadly applicable generative-AI consumer-disclosure law. 2025 amendments narrowed it so proactive disclosure is generally required only in 'high-risk' interactions (health, finance, biometric, regulated-occupation advice), with a safe harbour if the AI clearly discloses it is non-human. In force Illinois HB 3773 + BIPA Illinois pairs the nation's strictest biometric-privacy law (BIPA) with a new AI-in-employment anti-discrimination rule. HB 3773 (effective Jan 1, 2026) bars employers from using AI that has a discriminatory effect on protected classes and from using ZIP code as a proxy, and requires notice when AI is used in employment decisions. In force NYC Local Law 144 The first US law mandating independent bias audits of AI hiring tools. Employers and agencies using an automated employment decision tool in NYC must obtain an annual independent bias audit, publish the results, and notify candidates. A Dec 2025 state audit found enforcement weak, signalling tighter scrutiny. In force FDA AI Medical Devices The FDA regulates AI/ML-enabled medical devices through its existing device pathways plus AI-specific tools. The headline mechanism is the Predetermined Change Control Plan (PCCP, finalised Dec 2024), letting manufacturers pre-authorise specified future model changes, reinforced by Good Machine Learning Practice and a total-product-lifecycle approach. In force US Model Risk Management Model risk management is the US supervisory backbone for risks from quantitative models, and its broad 'model' definition has long covered AI/ML and credit models. The original SR 11-7 (2011) was rescinded on April 17, 2026 and replaced by modernised, principles-based interagency guidance (OCC Bulletin 2026-13), with an AI-specific request for information signalled. In force (revised 2026)

Standards & voluntary frameworks adoptable anywhere

NIST AI RMFISO/IEC 42001ISO/IEC 23894ISO/IEC 42005ISO/IEC 27001UNESCO AI EthicsOECD AI PrinciplesG7 Hiroshima Code
🇨🇦

Canada

Canada = no binding general AI law after AIDA died on prorogation (Jan 2025); governed by a voluntary GenAI code, a mandatory federal-government Directive (algorithmic impact assessments) and existing privacy law. A replacement is awaited.

Binding / national rules 2

Canada AI (AIDA) Canada's flagship AI bill (AIDA, in Bill C-27) died when Parliament was prorogued in January 2025 and the government has said it will be replaced, not revived. With no successor enacted, Canada relies on a voluntary generative-AI code and a binding-on-government Directive applying algorithmic impact assessments. No binding general AI law CoE AI Convention The first legally binding international treaty on AI. A high-level framework requiring signatory states to ensure AI activities are consistent with human rights, democracy and the rule of law, implemented through their own national laws. In force

Standards & voluntary frameworks adoptable anywhere

ISO/IEC 42001ISO/IEC 23894ISO/IEC 42005ISO/IEC 27001NIST AI RMFUNESCO AI EthicsOECD AI PrinciplesG7 Hiroshima Code
🇧🇷

Brazil

Brazil = no AI law in force yet; the EU-style risk-based bill PL 2338/2023 passed the Senate (Dec 2024) but remains pending in the Chamber of Deputies. Current governance rests on the LGPD and consumer/sector law.

Binding / national rules 1

Brazil AI Bill (PL 2338) Brazil's comprehensive, EU-inspired AI bill establishes a risk-based framework that bans 'excessive-risk' systems and imposes governance, impact-assessment and transparency duties on high-risk systems. The Senate approved it in December 2024; it remains under review in the Chamber of Deputies as of mid-2026. Pending (not yet law)

Standards & voluntary frameworks adoptable anywhere

ISO/IEC 42001ISO/IEC 23894ISO/IEC 42005ISO/IEC 27001NIST AI RMFUNESCO AI EthicsOECD AI Principles
🇨🇳

China

China has the world's most developed binding AI-content regime — a layered CAC framework (algorithms → deep synthesis → generative AI → mandatory labelling) emphasising content control, security filings and transparency rather than an EU-style risk taxonomy.

Binding / national rules 3

China GenAI Measures China's first dedicated rules for public-facing generative AI. They impose content, data and transparency duties on providers offering generative AI to the Chinese public, including alignment with 'core socialist values' and security assessments / algorithm filings. In force China AI Labelling Measures A comprehensive labelling regime requiring both visible ('explicit') and metadata/watermark ('implicit') labels on AI-generated text, images, audio, video and virtual scenes — widely described as the world's most comprehensive AI transparency-labelling framework. In force China Deep Synthesis / Algorithm rules Two earlier pillars of China's AI rulebook: the Deep Synthesis Provisions (deepfakes/synthetic media labelling and consent) and the Algorithm Recommendation Provisions (transparency, opt-out, anti-manipulation, and an algorithm registry). In force

Standards & voluntary frameworks adoptable anywhere

ISO/IEC 42001ISO/IEC 23894ISO/IEC 42005ISO/IEC 27001UNESCO AI Ethics
🇰🇷

South Korea

South Korea = the AI Basic Act (Asia's first comprehensive horizontal AI law), effective Jan 2026 with a risk-based 'high-impact AI' approach, generative-AI transparency and a domestic-representative duty — but modest penalties and a ~1-year grace period.

Binding / national rules 1

Korea AI Basic Act Asia's first comprehensive horizontal AI law, combining industry promotion with risk-based trust obligations. It introduces categories for 'high-impact AI' and generative AI, with transparency, safety and human-oversight duties and a domestic-representative requirement for large foreign providers. Effective Jan 2026 with a ~1-year enforcement grace period. In force (grace period to ~2027)

Standards & voluntary frameworks adoptable anywhere

ISO/IEC 42001ISO/IEC 23894ISO/IEC 42005ISO/IEC 27001NIST AI RMFUNESCO AI EthicsOECD AI PrinciplesG7 Hiroshima Code
🇯🇵

Japan

Japan = the AI Promotion Act, an innovation-first, penalty-free framework (in force mid-2025) coordinating policy via a PM-led AI Strategy Headquarters while managing risk through guidance and existing sectoral laws.

Binding / national rules 1

Japan AI Promotion Act Japan's first AI-specific statute, deliberately non-punitive. It sets national objectives and coordination structures, relying on guidance, cooperation and existing sectoral laws rather than fines — a soft-law-plus framework to spur AI adoption. In force (no penalties)

Standards & voluntary frameworks adoptable anywhere

ISO/IEC 42001ISO/IEC 23894ISO/IEC 42005ISO/IEC 27001NIST AI RMFUNESCO AI EthicsOECD AI PrinciplesG7 Hiroshima Code
🇦🇺

Australia

Australia = no standalone AI Act; the Dec 2025 National AI Plan relies on existing laws, sector regulators, the Voluntary AI Safety Standard and a new AI Safety Institute, having declined immediate mandatory guardrails.

Binding / national rules 1

Australia AI Safety Standard A voluntary standard of 10 'guardrails' of good-practice AI governance. The Dec 2025 National AI Plan confirmed Australia will rely on existing laws, sector regulators, voluntary guidance and a new AI Safety Institute — declining a standalone AI Act and immediate mandatory guardrails. In effect (voluntary)

Standards & voluntary frameworks adoptable anywhere

ISO/IEC 42001ISO/IEC 23894ISO/IEC 42005ISO/IEC 27001NIST AI RMFUNESCO AI EthicsOECD AI Principles
🇸🇬

Singapore

Singapore = a pro-innovation, voluntary, testing-and-assurance-led model (the Model AI Governance Framework for GenAI + AI Verify), with no binding AI statute but growing de facto influence through procurement and assurance pilots.

Binding / national rules 1

Singapore Model AI Framework A pro-innovation, voluntary governance framework. The 2024 generative-AI edition sets nine dimensions (accountability, data, trusted development, incident reporting, testing/assurance, security, content provenance, safety, AI for public good); AI Verify provides a testing/governance toolkit. No binding AI statute. Active (voluntary)

Standards & voluntary frameworks adoptable anywhere

ISO/IEC 42001ISO/IEC 23894ISO/IEC 42005ISO/IEC 27001NIST AI RMFUNESCO AI Ethics
🇮🇳

India

India = no dedicated AI statute; the AI Governance Guidelines (Nov 2025) set a phased, institution-led, pro-innovation approach using existing laws (IT Act, DPDP Act 2023) and 'techno-legal' tools.

Binding / national rules 1

India AI Governance Guidelines India's first comprehensive AI governance framework — deliberately pro-innovation and non-legislative, relying on existing laws (IT Act, DPDP Act 2023), new institutions and 'techno-legal' tools. Structured around six pillars and seven 'AI Sutras'. In effect (non-binding)

Standards & voluntary frameworks adoptable anywhere

ISO/IEC 42001ISO/IEC 23894ISO/IEC 42005ISO/IEC 27001UNESCO AI Ethics

The framework catalog

Every law, framework and standard in the index. Filter by type or region and search by name, or open the full set in one click.

Standards vs legislation — how they differ

Legislation sets the legal obligation and the penalties; standards and voluntary frameworks supply the auditable method to meet them. ISO/IEC 42001 and the NIST AI RMF are increasingly the practical route to demonstrate EU AI Act compliance and serve as recognised safe-harbour frameworks in US state laws.

Framework TypeLegally bindingCertifiableRisk modelGeographic scopePenalties
EU AI Act Law (regulation)YesNo (conformity assessment)4-tier risk pyramid + GPAIEU + extraterritorialUp to €35M / 7% turnover
Colorado AI Act State lawYes (from 2027)NoNarrowed ADMT disclosureColoradoAG enforcement, no private action
Korea AI Basic Act LawYesNoHigh-impact AI + GenAISouth Korea + extraterritorialUp to ~KRW 30M
NIST AI RMF Voluntary frameworkNoNoGovern/Map/Measure/ManageGlobal (US-origin)None
ISO/IEC 42001 StandardNoYes (accredited)Lifecycle AIMS (PDCA)GlobalNone (loss of certification)
ISO/IEC 23894 Standard (guidance)NoNoISO 31000-aligned AI riskGlobalNone
OECD AI Principles Intergovt. recommendationNoNoValues-based principles47 adherentsNone

How this is built. Each entry is curated from official primary sources (EUR-Lex, national regulators, ISO/IEC, NIST, FDA and others) and re-checked monthly, with a per-entry "last change" date so you can see what moved. It is general orientation, not legal advice — always confirm against the official source and qualified counsel.

Common questions

AI governance — frequently asked questions

What is the AI Governance Index?

The AI Governance Index is an interactive map of 35 AI laws, frameworks and standards across 16 jurisdictions. For each one it shows what the rule actually asks of you and where it applies, from the EU AI Act to NIST and ISO/IEC 42001. It is curated from official primary sources and refreshed monthly (last updated 15 June 2026).

Which AI regulations and frameworks does it cover?

It tracks binding national and regional laws (such as the EU AI Act), plus voluntary standards and frameworks adoptable anywhere (such as the NIST AI Risk Management Framework and ISO/IEC 42001), across Europe, the Americas, Asia-Pacific, and international bodies.

What is the difference between a binding AI law and a voluntary framework?

Binding laws carry legal obligations and penalties within their jurisdiction — the EU AI Act is the clearest example. Standards and frameworks like NIST AI RMF and ISO/IEC 42001 are voluntary: you adopt them anywhere to organise your governance and to demonstrate it to customers, auditors, and regulators.

How often is the AI Governance Index updated?

Every entry is re-checked monthly against official primary sources — EUR-Lex, national regulators, ISO/IEC, NIST, the FDA and others — and each carries its own "last change" date so you can see what moved. The index was last updated 15 June 2026.

Is the AI Governance Index legal advice?

No. It is general orientation to help you see what applies and what each rule asks. Always confirm against the official source and qualified legal counsel before acting.

Governing AI agents, not just AI models?

Take the readiness assessment →