AI laws, privacy rules, and cybersecurity requirements — tracked for you.

Colorado requires developers and deployers of high-risk AI systems to use risk management, impact assessments, and consumer notices tied to consequential decisions.

California requires covered generative AI providers to give users clear provenance disclosures when AI-generated or AI-altered content is created or presented. It affects providers and some licensees of large generative AI systems and gives the Attorney General and local public lawyers a civil-enforcement path.

California requires developers of generative AI systems made available to Californians to publish documentation about the data used to train those systems. It affects developers releasing public-facing generative AI systems or major modifications and is meant to improve transparency around dataset sources and composition.

Illinois amended its Human Rights Act to address the use of artificial intelligence and predictive data analytics in employment decisions. Employers cannot use AI in ways that subject employees to unlawful discrimination in recruiting, hiring, promotion, renewal, selection for training, discharge, discipline, tenure, or terms and privileges of employment. The law also requires notice when AI is used for employment decisions and bars the use of zip code as a proxy for protected classes.

Texas established a statewide AI governance framework with disclosure duties, prohibited-use rules, enforcement powers, and a regulatory sandbox. It affects government agencies, health care providers, developers, and deployers using AI in Texas, especially where biometric collection, unlawful discrimination, or constitutional harms are at issue.

Virginia now requires human decision-makers to remain responsible for major criminal justice decisions even when AI-based tools generate recommendations or predictions. It affects judicial officers and other criminal-justice decision-makers by limiting AI to an assistive role and preserving opportunities to challenge AI outputs.

The EU AI Act creates a single risk-based rulebook for AI across the bloc, ranging from outright bans on a narrow set of uses to detailed duties for high-risk systems and general-purpose AI models. It affects providers, deployers, importers, distributors, and product manufacturers that place AI systems on the EU market or use them in the EU. Core requirements include risk management, technical documentation, transparency, human oversight, post-market monitoring, and incident reporting.

Tennessee expanded its right-of-publicity law to cover voice and likeness cloning, giving creators a clearer path to challenge AI-generated impersonations.

Florida requires political ads, electioneering communications, and certain other campaign materials that use generative AI to include a disclaimer stating that the content was created in whole or in part with AI. It affects candidates, campaigns, political committees, and advertisers distributing covered communications in Florida.

China's generative AI rules apply to providers offering generative AI services to the public in China. They require lawful training data and model use, measures to prevent illegal content, user complaint handling, and certain security assessments and algorithm filing obligations. The regime affects model providers and platform operators that make text, image, audio, or video generation services publicly available.

New York City bars employers and employment agencies from using automated employment decision tools unless they complete a bias audit, publish summary results, and provide required notices. It affects hiring and promotion workflows that rely on algorithmic scoring or recommendations for candidates and employees in the city.

Canada's proposed AIDA would create a federal framework for high-impact AI systems used in interprovincial and international commerce. It would require responsible persons to assess and mitigate risks of harm and biased output, keep records, publish plain-language descriptions, and notify the government of serious incidents. The proposal also gives the minister audit and order powers and creates offences for reckless or deceptive conduct involving AI systems.

Brazil's PL 2338/2023 would create a national, risk-based AI framework centered on rights, safety, and accountability. The bill would impose governance, documentation, transparency, and impact-assessment duties on providers and deployers of high-risk AI systems, with added rules for generative AI and public-sector use. It is now under review in the Chamber of Deputies after moving out of the Senate.

The United Kingdom continues to pursue a sector-led AI model rather than a single cross-economy AI statute. Its 2024 response keeps five cross-sector principles for existing regulators and signals targeted future legislation for the most capable general-purpose AI models. This affects regulated firms that rely on AI in sectors such as finance, healthcare, telecoms, employment, and consumer platforms.