Global Ai Legislation Tracker

Global AI Legislation Tracker
By IAPP Research and Insights

C ountries worldwide are designing and implementing AI governance legislation
commensurate to the velocity and variety of proliferating AI-powered technologies.
Legislative efforts include the development of comprehensive legislation, focused legislation
for specific use cases, and voluntary guidelines and standards.
This tracker identifies legislative policy and related developments in a subset of jurisdictions.
It is not globally comprehensive, nor does it include all AI initiatives within each jurisdiction,
given the rapid and widespread policymaking in this space. This tracker offers brief commentary
on the wider AI context in specific jurisdictions, and lists index rankings provided by Tortoise
Media, the first index to benchmark nations on their levels of investment, innovation and
implementation of AI.
As individual jurisdictions press ahead with their own frameworks and approaches, they
have also doubled down on multilateral efforts to coordinate and cohere different approaches.
The Organisation for Economic Co-operation and Development’s AI principles have been
reaffirmed in many different contexts, including by digital and technology ministers of the
G7 countries during the 2023 Hiroshima Summit. UNESCO, the International Organization for
Standardization, the African Union and the Council of Europe are all working on multilateral
AI governance frameworks. The U.K. government is organizing the first AI Safety Summit
for government and industry stakeholders to agree upon, evaluate and monitor the most
significant risks from AI.
Tracking, unpacking and governing the complex field of global AI governance law and policy
has quickly become a top tier strategic issue for organizations. The IAPP AI Governance Center
will provide AI governance professionals with the content, resources, networking, training
and certification needed to respond to the field’s complex risks. We welcome feedback and
insights from the community of AI governance professionals.
Last updated 25 Aug. 2023.

Global AI Legislation Tracker
This map shows which

jurisdictions are in focus
and covered by this tracker.
It does not represent the
extent to which jurisdictions
around the world are active
on AI governance legislation.
Jurisdictions in focus
Australia | Brazil | Canada | China | EU | India | Israel | Japan | New Zealand
Saudi Arabia | Singapore | South Korea | United Arab Emirates | U.K. | U.S.
*Click on the country names above to navigate to its location in the tracker.
Global AI Legislation Tracker • International Association of Privacy Professionals • iapp.org 3

Navigate to: Australia | Brazil | Canada | China | EU | India | Israel | Japan | New Zealand | Saudi Arabia | Singapore | South Korea | United Arab Emirates | U.K. | U.S.
Country Other relevant laws

Specific AI governance law and policy Relevant authorities Wider AI context
(A-Z) and policies
Australia There are no laws and policies specific to AI • Department of Industry, • Patents Act (in force) • Ranked No. 15 on Tortoise's Global AI Index.
governance in Australia, but the government Science and Resources • Copyright Act • The Human Technology Institute at the
highlighted the application of existing • Commonwealth Scientific (in force) University of Technology Sydney recently
regulatory frameworks for AI. The Human and Industrial Research released The State of AI Governance
• Privacy Act (in force)
Technology Institute at the University of Organisation in Australia.
Technology Sydney recently released The State • Data Availability and
• Office of the eSafety Transparency Act
of AI Governance in Australia. See Australia’s
Commissioner (in force)
discussion paper on safe and responsible AI and
its AI Roadmap. The roadmap sets out the focus • Office of the Victorian • Consumer Data Right
on AI development in high potential areas, such Information Commissioner (in force)
as natural resources and infrastructure. • Competition and • Competition and
Consumer Commission Consumer Act
(in force)
Brazil Brazil has a proposed comprehensive AI Bill, • Ministry of Science, • General Data • Ranked No. 35 on Tortoise's Global AI Index.
which emphasizes human rights and creates Technology and Innovation Protection Act • Brazil's AI Strategy proposes to finance
a civil liability regime for AI developers. The • National Data Protection (in force) research projects that apply ethical
proposed AI Bill would: Authority, Autoridade • Civil Rights solutions, establish technical requirements
• Prohibit certain "excessive risk" systems. Nacional de Proteção Framework for the which advance ethical applications,
• Establish a regulatory body to enforce de Dados Internet (in force) develop techniques to mitigate algorithmic
the law. • Consumer Protection bias, create parameters around human
Code (in force) intervention where automated decisions
• Create civil liability for AI providers.
may create high-risk situations, and
• Require reporting obligations for significant implement codes of conduct to encourage
security incidents. traceability and safeguard legal rights.
• Guarantee various individual rights, such Brazil also strives to encourage data
as explanation of AI-based decisions, sharing per its data protection law, the
nondiscrimination, rectification of identified LGPD, create an AI observatory for
biases and due process mechanisms. measuring impact, as well as disseminate
open-source codes for identifying
discriminatory trends.


(A-Z) and policies
Canada Canada's anticipated AI and Data Act, part of • Ministry of Innovation, • Personal Information • Ranked No. 5 on Tortoise's Global AI Index.
Bill C-27, is intended to protect Canadians from Science and Economic Protection and • According to its AI Strategy, by 2030
high-risk systems, ensure the development of Development Electronic Documents Canada plans to achieve an AI ecosystem
responsible AI, and position Canadian firms and • Canadian Institute for Act (in force) founded on scientific excellence,
values for adoption in global AI development. Advanced Research • Privacy Act (in force) exceptional training and talent pools,
The AIDA would: public-private collaboration, and
• Office of the Privacy • Consumer Product
• Ensure high-impact AI systems meet existing Commissioner of Canada Safety Act (in force) commitment to AI technologies which
safety and human rights expectations. produce positive social, economic and
• Food and Drugs Act
• Prohibit reckless and malicious uses of AI. environmental change for people and the
(in force)
planet. In achieving these goals, Canada
• Empower the Minister of Innovation, Science, • Motor Vehicle Safety has established three AI institutes: Amii
and Industry to enforce the act. Act (in force) in Edmonton, Mila in Montreal, and the
Canada also issued a Directive on Automated • Bank Act (in force) Vector Institute in Toronto. These institutes
Decision-Making, which imposes several • Canadian Human are involved in initiatives to address the
requirements on the federal government's use Rights Act (in force) climate crisis, to develop responsible use
of automated decision-making systems. of AI, and to promote leadership and
• Criminal Code
(in force) excellence in AI. Beyond research, Canada
is working to revolutionize the health care
system with AI.
China China is one of the first countries to implement • Cyberspace Administration • Cybersecurity Law • Ranked No. 2 on Tortoise's Global AI Index.
AI regulations. Chinese lawmakers are in of China (in force) • See China's AI development plan.
the process of drafting a comprehensive AI • Ministry of Industry and • Data Security Law
regulation. Various regulations and policies Information Technology (in force)
apply to specific AI uses. These include:
• Ministry of Public Security • Personal Information
• Algorithmic Recommendation Management Protection Law
• State Administration for
Provisions (in force) (in force)
Market Regulation
• Interim Measures for the Management of
Generative AI Services (in force)
• Deep Synthesis Management Provisions
(draft)


(A-Z) and policies
EU The EU AI Act moved to the trilogue stage, • Proposed future EU • General Data • Some EU member states have national
where a final version will be debated, June 2023. AI Board Protection Regulation AI strategies, many of which emphasize
Passage of the act is expected by the end of • European Data Protection (in force) research, training and labor preparedness,
2023 or in early 2024. The three positions in Board • Digital Services Act as well as multistakeholder and
the trilogue discussions are put forward by the (in force) international collaboration. For example:
• Member state AI
commission, council and European Parliament. - France's national AI strategy lays out
authorities, for example: • Digital Markets Act
In brief, some of the proposals being debated in three main objectives: improve the
- Spain's AI supervision (in force)
trilogue include measures that: AI education and training ecosystem,
agency, the Agencia • AI Liability Directive
• Prohibit certain types of AI systems, i.e., establish an open data policy for
Española de Supervisión (draft)
those that are manipulative, exploitative, implementing AI applications and pooling
de la Inteligencia Artificial
perform social scoring or use "real-time" assets, and develop an ethical framework
biometric ID systems. • Member state data for fair and transparent use of AI.
protection authorities,
• Classify high-risk AI systems and set out
for example:
requirements with which these systems and
their providers must comply. - France's Commission
nationale de
• Delegate regulatory and enforcement
l'informatique et des
authorities.
libertés
• Prescribe standards of conformity which - Germany's Federal
may be applied by high-risk systems. Commissioner for Data
• Ensure transparency obligations for AI Protection and Freedom
systems which interact with natural persons. of Information
• Provide innovation measures. - Italy's Garante
• Set out a governance framework divided - Spain's Agencia Española
between the EU AI Board and national de Protección de Datos
authorities. - Belgium's Data Protection
• Create a database for high-risk systems. Authority
• Requires an iterative process of review - Poland's Urząd Ochrony
after-market deployment. Danych Osobowych
• Prompt the formation of codes of conduct for - Austria's Data Protection
AI systems which are not high-risk. Authority
• Stipulate confidentiality requirements for - Hungary's National
authorities dealing with proprietary data. Authority for Data
Protection and Freedom
• Afford the power to adopt delegated acts to
of Information
the European Commission.


(A-Z) and policies
India There are no laws and policies specific to AI • NITI Aayog • Information • Ranked No. 14 on Tortoise's Global AI Index.
governance in India. A proposed Digital India Act • Ministry of Electronics and Technology Act • According to its National Strategy for AI,
would replace the IT Act of 2000 and regulate Information Technology (in force) India hopes to become what it calls an
high-risk AI systems. The Indian government • Information "AI garage" for emerging and developing
• Ministry of Commerce
has advocated for a robust, citizen-centric and Technology Rules economies, where scalable solutions can
and Industry
inclusive "AI for all" environment. A task force (in force) be easily implemented and designed for
has been established to make recommendations • AI Task Force
• Competition Act global deployment.
on ethical, legal and societal issues related to AI,
(in force)
and to establish an AI regulatory authority.
• Motor Vehicles Act
(in force)
• Digital Personal Data
Protection Act
(in force)
Israel There is no comprehensive AI regulation in • Ministry of Innovation, • Basic Law: Human • Ranked No. 7 on Tortoise's Global AI Index.
Israel. Based on a draft policy for regulation Science and Technology Dignity and Liberty
and ethics in AI, the country wants to form • Ministry of Justice (in force)
a uniform risk management tool, establish a • Privacy Protection
• Privacy Protection
governmental knowledge and coordination Law (in force)
Authority
center, and maintain involvement in
• Data Security
international regulation and standardization.
Regulation (in force)
In general, voluntary standardization,
sector-based self-regulation and modular • Credit Data Law
experimentation tools, e.g., sandboxes, will be (in force)
favored over a lateral framework. The following • Copyright Act
resources are available for policy guidance: (in force)
• Israeli AI Regulation and Policy White Paper:
A First Glance
• Harnessing Innovation: Israeli Perspectives
on AI Ethics and Governance


(A-Z) and policies
Japan There is no comprehensive AI regulation in • Ministry of Economy, • Improving • Ranked No. 12 on Tortoise's Global AI Index.
Japan. Japan promotes the notion of "agile Trade and Industry Transparency and • The Social Principles of Human-Centric AI,
governance," whereby the government provides • Council for Science, Fairness of Digital drafted by the Council for Social Principles
nonbinding guidance and defers to the private Technology and Platforms Act of Human-Centric AI, describe AI's role in
sector's voluntary efforts to self-regulate. The Innovation (in force) Japan's "Society 5.0" and advocates that
following white papers have been issued for • Financial Instruments AI should be human-centric; promote
• Personal Information
policy guidance: and Exchange Act education/literacy; protect privacy; ensure
Protection Commission
• AI Governance in Japan Ver. 1.1 (in force) security; maintain fair competition; ensure
• Governance Guidelines for Implementation • Protection of Personal fairness, accountability and transparency;
of AI Principles Information Act and promote collaborative innovation.
(in force) • Japan's technology minister Keiko Nagaoka
• Antimonopoly Act declared the country's copyright laws
(in force) cannot be enforced on materials used in
AI training data sets.
• Product Liability Act
(in force)
• Copyright Law
(in force)
New There is no comprehensive AI regulation in New • Ministry of Business, • Privacy Act (in force) • Rated No. 36 on Tortoise's Global AI Index.
Zealand Zealand. Government agencies are beholden Innovation and • Bill of Rights Act • The New Zealand government released
to the Algorithm Charter which provides a risk Employment (in force) AI cornerstones which will inform an
matrix to assess the likelihood and impact of • Statistics New Zealand eventual national AI strategy.
• Treaty of Waitangi
algorithmic applications. The New Zealand
• Office of the Privacy (in force) • The Law, Society and Ethics Working
government generally prioritizes trustworthy
Commissioner • Māori Data Group published a set of guiding principles
and human-centric AI development.
Sovereignty Principles designed to provide direction for AI
stakeholders.


(A-Z) and policies
Saudi There are no laws and policies specific to AI in • Saudi Data and AI • Personal Data • Ranked No. 31 on Tortoise's Global AI Index.
Arabia Saudi Arabia. The primary legislative agenda Authority Protection Law • According to the national strategy for
is to enact a welcoming, flexible and stable • National Data (in force) data and AI, Saudi Arabia aspires to be
regulatory framework, including incentive Management Office • Data Management one of the leading economies utilizing
schemes, to attract AI companies, investors and Personal Data and exporting data and AI after 2030. It is
• Ministry of
and talents. Protection Standards ready to leverage its "young and vibrant
Communications and
Information Technology (in force) population" and "unique centralized
• Children and ecosystem." Saudi Arabia hopes to attract
Incompetents' Data outside investment by hosting global AI
Protection Policy events and applying its influence as a tech
(in force) hub within the Middle East.
• Data Classification
Policy (in force)
• General Rules for the
Transfer of Personal
Data outside the
Geographical Borders
of the Kingdom
(in force)
• Data Sharing Policy
(in force)
• Freedom of
Information Policy
(in force)
• Open Data Policy
(in force)


(A-Z) and policies
Singapore There is no comprehensive AI regulation, but • Smart Nation Digital • Personal Data • Ranked No. 3 on Tortoise's Global AI Index.
Singapore developed voluntary governance Government Group Protection Act • Based on Singapore's National AI Strategy,
frameworks and initiatives for ethical AI • National AI Office (in force) the city-state aims to be a global hub for
deployment, data management and sectoral • Computer Misuse Act AI, thereby generating economic gains and
• AI Ethics and Governance
implementation, including: (in force) improving lives. A key tenet in Singapore's
Steering Committee
• Model AI Governance Framework • Copyright Act AI policy is that its citizens understand
• Personal Data Protection
• Trusted Data Sharing Framework (in force) AI tech and its workforce attains the
Commission
necessary competencies to participate in
• National AI Programmes in Government • Patents Act (in force)
an AI economy.
and Finance • Competition Act
• Veritas Initiative, an implementation (in force)
framework for AI governance in the • Cybersecurity Act
financial sector (in force)
• AI Verify Foundation, a governance • Protection from
testing toolkit Online Falsehoods
• IPOS International, part of the Intellectual and Manipulation Act
Property Office of Singapore that realizes (in force)
customized IP solutions • Road Traffic Act
• Proposed Advisory Guidelines on Use of (in force)
Personal Data in AI Recommendation and
Decision Systems


(A-Z) and policies
South There are no laws and policies specific • Ministry of Science and ICT • Personal Information • Ranked No. 6 on Tortoise's Global AI Index.
Korea to AI in South Korea, but the nation has • Personal Information Protection Act • South Korea has numerous policy
a comprehensive AI Act in the works to Protection Commission (in force) initiatives regarding AI and technology
ensure accessibility to AI technology for all • Monopoly Regulation under its National Strategy for AI, including
• Communications
developers without government approval but and Fair Trade Act the AI Research and Development
Commission
this requires reliability measures. South Korea (in force) Strategy, the Data Industry Activation
is also setting new standards on copyrights • Internet and Security
• Copyright Act Strategy and the System Semiconductor
of AI-generated content. Agency
(in force) Strategy. The nation intends to leverage
• Financial Services its high education level, widespread
Commission • Protection and Use of
acceptance of new technology and
Location Information
• Fair Trade Commission preeminent IT infrastructure to implement
Act (in force)
these initiatives.
• Consumer Protection
in Electronic
Commerce Act
(in force)
• Promotion and
Communications
Network Utilization
and Information
Protection Act
(in force)
• Credit Information
Use and Protection
Act (in force)
• Product Liability Act
(in force)


(A-Z) and policies
United There is no comprehensive AI regulation in the • Minister of AI, Digital • Personal Data • Ranked No. 28 on Tortoise's Global AI Index.
Arab United Arab Emirates. In 2017, the UAE became Economy and Remote Protection Law • The UAE is poised to become a hub for
Emirates the first country to establish an AI ministry. Work Applications Office (in force) AI research, collaboration, innovation and
The nation's Council for AI and Blockchain will • AI and Blockchain Council • Central Bank education per its National Strategy for
oversee policies that promote an AI-friendly Rulebook (in force) AI. Abu Dhabi hosts a growing startup
• UAE Data Office
ecosystem, advance AI research and accelerate community, advanced machine-learning
• Federal Decree
collaboration between public and private facilities and educational institutions, like
Law on Combating
sectors. The following resources have been Mohamed bin Zayed University which
Rumours and
issued for policy guidance: teamed up with IBM to open the AI
Cybercrimes
• National Program for AI (in force) Center of Excellence, in addition to a new
• AI Ethics Principles and Guidelines supercomputing resource for complex
• Penal Code (in force)
algorithms and large data sets. With this
• Generative AI guide • Federal Law infrastructure in place, the UAE hopes
• AI coding license concerning the to deploy AI in priority sectors such as
• AI System Ethics Self-Assessment Tool Regulation of energy and transportation.
Competition (in force)
• Federal Law on
Consumer Protection
(in force)
• Federal Decree Law
on Copyrights and
Neighbouring Rights
(in force)
• Health Data Law
(in force)


(A-Z) and policies
U.K. The U.K. does not have a comprehensive AI • Office for AI • Equality Act (in force) • Ranked No. 4 on Tortoise's Global AI Index.
regulation, but the government proposed a • Information • U.K. General • According to the AI Council Roadmap and
context-based, proportionate approach to Commissioner's Office Data Protection the National AI Strategy, the U.K. aims to
regulation and will rely on existing sectoral laws Regulations and Data invest in the long-term needs of the AI
• Digital Regulation
to impose guardrails on AI systems. The following Protection Act ecosystem and support the transition to an
Cooperation Forum
resources are available for policy guidance: (in force) AI-enabled economy, emphasizing broad
• A pro-innovation approach to AI regulation • Consumer Protection public trust and the involvement of diverse
• Algorithmic Transparency Recording Act (in force) viewpoints to achieve these measures.
Standard Hub • Financial Services and • Specific action items include launching a
Markets Act (in force) national AI research and insights program,
developing a diverse AI workforce,
• Consumer Rights Act
enabling better data availability, creating
(in force)
a national strategy for AI in health
• National Security and and social care, applying AI systems to
Investment Act climate change mitigation, piloting an
(in force) AI standards hub to coordinate with
• Copyright, Designs global AI standardization, and developing
and Patents Act a cross-government standard for
(in force) algorithmic transparency.


(A-Z) and policies
U.S. The U.S. does not have a comprehensive • Office of Science and • FTC Act, Section 5 • Ranked No. 1 on Tortoise's Global AI Index.
(Federal) AI regulation, but numerous frameworks Technology Policy (in force) • In general, the U.S. approach to
and guidelines exist. Congress has passed • National AI Initiative Office • Fair Credit Reporting AI governance has been slow and
legislation to preserve U.S. leadership in AI Act (in force) incremental, seeking to preserve
• Federal Trade Commission
research and development, as well as control civil and human rights for Americans
• Consumer Financial • Equal Credit
government use of AI. In May 2023, the Biden throughout AI deployment, as well as
Protection Bureau Opportunity Act
administration updated the National AI Research mobilize international collaboration which
(in force)
and Development Strategic Plan, emphasizing • Department of Justice upholds democratic values and mutual
a principled and coordinated approach to • Title VII of the Civil
• Equal Employment advancement.
international collaboration in AI research. The Rights Act (in force)
Opportunity Commission
Office of Science and Technology Policy issued a • Americans with
request for information to obtain public input on Disabilities Act
AI's impact. The National Telecommunications (in force)
and Information Administration sought • Age Discrimination
feedback on what policies can create trust in in Employment Act
AI systems through an AI Accountability Policy (in force)
Request for Comment. Specific AI governance • Fair Housing Act
law and policy includes: (in force)
• Executive orders: • Genetic
- Maintaining American Leadership in AI Information and
- Promoting the Use of Trustworthy AI in Nondiscrimination Act
the Federal Government (in force)
• Acts and bills: • American Data
- AI Training Act Privacy and
Protection Act (draft)
- National AI Initiative Act (Division E, Sec.
5001; in force) • Health Equity and
- AI in Government Act (Division U, Sec. 101; Accountability Act
in force) (draft)
- Algorithmic Accountability Act (Draft)
- National AI Commission Act (Draft)
- Digital Platform Commission Act (Draft)
- Global Technology Leadership Act (Draft)
- Transparent Automated Governance Act
(Draft)


(A-Z) and policies
U.S. • Nonbinding frameworks:

(Federal), - Blueprint for an AI Bill of Rights
continued
- National Institute of Standards and
Technology AI Risk Management Framework
- Guidance for Regulation of AI Applications
• Government initiatives:
- Voluntary Commitments from Leading
AI Companies to Manage the Risks
Posed by AI
- TTC Joint Roadmap on Evaluation and
Measurement Tools for Trustworthy AI and
Risk Management
- Congressional AI effort of Sen. Charles E.
Schumer, D-N.Y.
- National Security Commission on AI

Contact
Joe Jones
Research and Insights Director, IAPP
jjones@iapp.org
Müge Fazlioglu, CIPP/E, CIPP/US

Principal Researcher, Privacy Law and Policy, IAPP
muge@iapp.org
Uzma Chaudry
AI Governance Center Fellow, IAPP
uchaudhry@iapp.org
For further inquiries, please reach out to research@iapp.org.
Follow the IAPP on social media

D C Q E
Published August 2023.
The IAPP disclaims all warranties, expressed or implied, with respect to the contents of this
material, including any warranties of accuracy, merchantability or fitness for a particular purpose.
Nothing herein should be construed as legal advice.
© 2023 International Association of Privacy Professionals. All rights reserved.

Global Ai Legislation Tracker

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Global Ai Legislation Tracker

Uploaded by

Copyright:

Available Formats

Global AI Legislation Tracker

By IAPP Research and Insights

Last updated 25 Aug. 2023.

This map shows which

Global AI Legislation Tracker • International Association of Privacy Professionals • iapp.org 3

Country Other relevant laws

Global AI Legislation Tracker • International Association of Privacy Professionals • iapp.org 4

Country Other relevant laws

Global AI Legislation Tracker • International Association of Privacy Professionals • iapp.org 5

Country Other relevant laws

Global AI Legislation Tracker • International Association of Privacy Professionals • iapp.org 6

Country Other relevant laws

Global AI Legislation Tracker • International Association of Privacy Professionals • iapp.org 7

Country Other relevant laws

Global AI Legislation Tracker • International Association of Privacy Professionals • iapp.org 8

Country Other relevant laws

Global AI Legislation Tracker • International Association of Privacy Professionals • iapp.org 9

Country Other relevant laws

Global AI Legislation Tracker • International Association of Privacy Professionals • iapp.org 10

Country Other relevant laws

Global AI Legislation Tracker • International Association of Privacy Professionals • iapp.org 11

Country Other relevant laws

Global AI Legislation Tracker • International Association of Privacy Professionals • iapp.org 12

Country Other relevant laws

Global AI Legislation Tracker • International Association of Privacy Professionals • iapp.org 13

Country Other relevant laws

Global AI Legislation Tracker • International Association of Privacy Professionals • iapp.org 14

Country Other relevant laws

U.S. • Nonbinding frameworks:

Global AI Legislation Tracker • International Association of Privacy Professionals • iapp.org 15

Müge Fazlioglu, CIPP/E, CIPP/US

For further inquiries, please reach out to research@iapp.org.

Follow the IAPP on social media

Published August 2023.

© 2023 International Association of Privacy Professionals. All rights reserved.

You might also like