Topics
Eight governance topics, from frameworks to the White House Accord
| Topic | What it covers | Registry incidents |
|---|---|---|
| Regulatory Frameworks | How the EU, China, the US and others regulate AI. | 4 |
| Liability and Product Law | Who pays when AI causes harm, and under which law. | 5 |
| Criminal Law | Crimes committed with AI, and who is liable when an agent acts. | 3 |
| Personal Data Law | Privacy law as it applies to AI models and agents. | 3 |
| International Coordination | Summits, UN bodies, treaties and safety institute networks. | 2 |
| Standards Bodies | Who writes the technical standards AI laws depend on. | 0 |
| Critical Infrastructure Policy | Rules for AI in grids, water, transport and the data centers AI runs on. | 1 |
| White House Accord | The September 2026 industry pledge on frontier AI controls, and what followed. | 1 |
| Incident Reporting Rules | Who must report AI incidents, to whom and how fast. | - |
Rules tracker
245 rules tracked; the most cited is China agent Implementation Opinions (CAC, NDRC, MIIT), on 15 pages
| Jurisdiction | In force | Phasing in | Voluntary | Draft or pending | Withdrawn | Total |
|---|---|---|---|---|---|---|
| China | 47 | 2 | 9 | 4 | 0 | 62 |
| EU | 23 | 30 | 4 | 2 | 1 | 60 |
| US federal | 29 | 1 | 11 | 8 | 1 | 50 |
| US states | 15 | 6 | 0 | 0 | 0 | 21 |
| UK | 1 | 1 | 1 | 2 | 0 | 5 |
| International | 5 | 3 | 30 | 6 | 0 | 44 |
| Company policy | 0 | 0 | 3 | 0 | 0 | 3 |
| Rule | Jurisdiction | What it requires | Status | Cited on |
|---|---|---|---|---|
| China agent Implementation Opinions (CAC, NDRC, MIIT) | China | Filing, pre-release testing and recall for agents in high-risk sectors; defined agent boundaries | Effective Jul 15, 2026 | Coding research agents Workflow agents Transaction commerce agents Enterprise agents Software agents Behavioral envelopes Agent access control permissions Human oversight Controls Risks Agentic misbehavior Risk tiers Convenience as attack surface Governance Human oversight |
| California SB 53 | California | Frontier safety frameworks and incident reporting | In force Jan 1, 2026 | Risks Weaponization Agentic misbehavior Risk tiers Trust Red teaming Alignment Transparency Compliance Third party audits Penalties fines |
| CAC and MPS face recognition measures | China | Alternatives to face ID; registration above 100,000 people | Effective Jun 1, 2025 | Mobile device agents Wearable agents Agent vehicle cabin ai Smart home agents Agent public infrastructure Ambient sensor systems Personal ambient agents Consent and capture controls Surveillance |
| EU AI Act Article 5 prohibitions | EU | Bans manipulative AI, untargeted face scraping and workplace emotion recognition | In force Feb 2, 2025 | Mobile device agents Wearable agents Smart home agents Agent public infrastructure Ambient sensor systems Personal ambient agents Consent and capture controls Human risks Surveillance |
| California DMV AV regulations | California | Notices of noncompliance for moving violations; first-responder link answered in 30 seconds; leave an emergency geofence within two minutes; licensed remote operators | Adopted Apr 28, 2026, phasing in | Robotaxi Robotrucks platoons Physical agents Behavioral envelopes Human oversight Controls Physical agents regulatory category Ul 4600 standard |
| China amended Cybersecurity Law | China | Higher fines; AI safety oversight | Effective Jan 1, 2026 | Coding research agents Monitoring and anomaly detection Critical infrastructure compromise Data risks Ot ics telemetry deception Penalties fines |
| China AI content labeling measures and GB 45438-2025 | China | Visible and metadata labels identifying AI-generated content | Effective Sep 1, 2025 | Identity and cryptographic attestation Human risks Impersonation Cybersecurity Standards bodies |
| EU Machinery Regulation 2023/1230 | EU | Covers machines with self-evolving behavior; replaces the Machinery Directive | Applies from Jan 20, 2027 | Humanoid Industrial cobots Physical agents Physical safety Physical agents regulatory category |
| AI Safety Governance Framework 2.0 (TC260) | China | Lifecycle risk grading on five levels | Sep 15, 2025 | Risks Agentic misbehavior Risk management Cybersecurity |
| Colorado SB 26-189 | Colorado | Plain-language explanation within 30 days of an adverse outcome | Effective Jan 1, 2027 | Explainability Bias fairness Liability and product law Human oversight |
| DoD Directive 3000.09 | US military | Appropriate levels of human judgment over autonomous weapons | In force; adequacy questioned in 2026 | Multi agent fleets Physical agents Human oversight Weaponization |
| EU Cyber Resilience Act | EU | Security by design and vulnerability reporting for digital products | Reporting from Sep 11, 2026; full Dec 11, 2027 | Ot ics integration controls Cyber physical compromise Model update integrity Supply chain security |
| EU GPAI Code of Practice | EU | Transparency, copyright and safety duties for general-purpose models | Published Jul 10, 2025 | Trust Red teaming Failure modes Eu conformity |
| Interim Measures for Generative AI Services | China | Lawful training data and security assessment | Aug 15, 2023 | Data risks Trust Model safety Accountability |
| Korea AI Basic Act | South Korea | High-impact AI duties and labeling | Effective Jan 22, 2026 | Regulatory frameworks Compliance Human oversight Penalties fines |
| NIST CAISI AI Agent Standards Initiative | US | Voluntary standards for agent security and identity | Announced Feb 17, 2026 | Coding research agents Software agents Controls Standards bodies |
| UN R155 and R156 | UNECE / EU | Cybersecurity and software update management for type approval | All new EU vehicles from Jul 1, 2024 | Telemetry integrity controls Model update integrity Fleet attacks Ota loop attack surface |
| Anthropomorphic AI interaction measures | China | Companion AI safeguards against dependence | Effective Jul 15, 2026 | Human risks Personal manipulation Regulations |
| BIS connected vehicle rule | US | Bans China- or Russia-linked connected vehicle software and hardware | MY2027 software, MY2030 hardware | Cyber physical compromise Data transit security Fleet attacks |
| EU AI Act Article 50 transparency | EU | Disclose AI interaction; machine-readable marking of synthetic content | In force Aug 2, 2026 | Consent and capture controls Impersonation Regulations |
| EU AI Act Digital Omnibus | EU | Medical-device AI high-risk duties moved to Aug 2, 2028 | Political deal May 2026 | Medical devices Coding research agents Software agents |
| EU AI Act systemic-risk model duties | EU | Evaluate and mitigate risks including cyber offense | From Aug 2, 2025 | Autonomous crime economy Agentic misbehavior Compliance |
| FAA Part 108 (BVLOS) | US federal | Operating permits or certificates; named supervisor and flight coordinator; yield to ADS-B aircraft | Proposed Aug 2025; at OIRA since Jul 10, 2026 | Drones public safety Physical agents Physical agents regulatory category |
| FMCSA warning-device exemption (49 CFR 392.22) | US federal | Cab beacons on within five minutes of a stop; ODD only; no hazmat; crash report within five days | Granted Oct 7, 2026 for five years | Robotrucks platoons Physical agents Behavioral envelopes |
| FTC v. GM and OnStar, final order | US | Five-year ban on sharing with consumer reporting agencies; consent for 20 years | Finalized Jan 2026 | Agent vehicle cabin ai Personal ambient agents Telemetry capture integrity |
| GB 44495-2024 vehicle cybersecurity | China | Cybersecurity management plus interface, update and data tests | Effective Jan 1, 2026 | Telemetry integrity controls Cyber physical compromise Fleet attacks |
| Home Office police biometrics consultation | UK | Proposes one regulator for police biometrics | Closed Feb 12, 2026 | Agent public infrastructure Ambient sensor systems Surveillance |
| ISO/IEC 42001 | International | Certifiable AI management system | Published 2023 | Risk management Standards bodies Compliance |
| MCP specification 2026-07-28 | Open standard | Authorization aligned with OAuth and OpenID Connect | Released Jul 28, 2026 | Workflow agents Software agents Agent access control permissions |
| MIIT, MPS and MOT ICV supervision measures | China | Tighter supervision of intelligent connected vehicle road testing and demonstration | Issued Apr 14, 2026 | Robotaxi Multi agent fleets Physical agents |
| NERC CIP-015-1 | North America | Internal network security monitoring for the grid | Effective Sep 2, 2025, phased | Ot ics integration controls Ot ics telemetry deception Critical infrastructure policy |
| NHTSA Standing General Order, third amendment | US | ADS and Level 2 crash reporting within five days for the most severe | Effective Jun 16, 2025 | Telemetry integrity controls Monitoring and anomaly detection Autonomous human safety |
| NIS2 Directive | EU | Security and incident duties for essential entities | Deadline was Oct 17, 2024 | Critical infrastructure compromise Data transit security Ot ics telemetry deception |
| NYC Local Law 144 | New York City | Annual bias audit and candidate notice | In force since Jul 2023 | Bias fairness Regulations Third party audits |
| Product Liability Directive 2024/2853 | EU | Strict liability for software and AI; defect presumption | Transposition by Dec 9, 2026 | Accountability Liability and product law Insurance underwriting |
| Take It Down Act | US | Criminalizes nonconsensual AI intimate images | Signed May 2025 | Autonomous crime economy Impersonation Criminal law categories |
| Texas TRAIGA | Texas | Bans AI built to incite harm or discriminate; 60-day cure | Effective Jan 1, 2026 | Regulatory frameworks Regulations Nist rmf application |
| AI Liability Directive | EU | Fault-based AI claims | Withdrawn Feb 2025 | Accountability Liability and product law |
| ANSI/A3 R15.06-2025 | US | Industrial robot and system safety, harmonized with ISO 10218 | Published 2025 | Humanoid Industrial cobots |
| Anthropic Responsible Scaling Policy v3 | Company policy | Capability thresholds tied to required safeguards | Feb 24, 2026 | Behavioral envelopes Model safety |
| CNCERT OpenClaw security guideline | China | No admin privileges; isolated hosts | Mar 2026 | Agent access control permissions Convenience as attack surface |
| California AB 2013 | California | Training-data documentation on 12 topics | In force Jan 1, 2026 | Transparency Compliance documentation |
| CoSAI Agentic Identity and Access Management | Industry | Treat agents as non-human identities | Mar 2026 | Enterprise agents Agent access control permissions |
| Draft Road Traffic Safety Law revision | China | Manufacturer handles violations while the autonomous function is active | First reading Aug 2026 | Robotaxi Robotrucks platoons |
| EU AI Act | EU | Risk-tiered duties; general-purpose model duties live | High-risk duties delayed to Dec 2027 and Aug 2028 | Risks Data risks |
| EU AI Act Annex III high-risk | EU | Covers HR and employment systems | Dec 2, 2027 | Enterprise agents Regulations |
| EU AI Act Article 10 | EU | Data quality controls for high-risk AI | Dec 2, 2027 | Training data poisoning Bias fairness |
| EU AI Act Article 15 | EU | High-risk systems robust against manipulation | Delayed to Dec 2, 2027 | Behavioral envelopes Model update integrity |
| EU Regulation 2022/1426 | EU | Type approval for fully automated vehicles on defined routes; 1,500 per type per year | In force | Robotaxi Robotrucks platoons |
| FDA PCCP final guidance | US | Pre-authorized boundaries for AI model updates | Final Dec 4, 2024 | Medical devices Personal ambient agents |
| FTC and DOJ v. Amazon (Alexa, COPPA) | US | $25 million penalty; delete inactive child profiles; honor deletion requests | Order 2023 | Smart home agents Personal ambient agents |
| GB 44496-2024 | China | Mandatory OTA update rules | Effective Jan 1, 2026 | Model update integrity Ota loop attack surface |
| GB 44721-2026 | China | Mandatory ADS safety, driver monitoring, third-party testing | Effective Jul 1, 2027 | Physical agents regulatory category Ul 4600 standard |
| IEC 62443 series | International | Zones, conduits and security levels for industrial systems | Current | Ot ics integration controls Ot ics telemetry deception |
| ISO 10218-1 and -2 (2025) | International | Robot and robot-system safety, including collaborative operation | Published 2025 | Industrial cobots Behavioral envelopes |
| ISO generative AI liability exclusions | US insurance | Exclude generative AI injury from general liability | Jan 2026 edition | Accountability Liability and product law |
| Justice Department Data Security Program | US | Bans or restricts bulk sensitive data deals with countries of concern | Effective Apr 8, 2025 | Surveillance material harvesting Personal data and surveillance law |
| MIIT and TC08 humanoid standards system | China | Framework for humanoid safety and performance standards | 2026 | Humanoid Physical safety |
| NHTSA exemptions and AV Framework | US federal | Exemptions for vehicles without manual controls, with crash and stop reporting (Zoox: up to 2,500 a year) | Granted Jul 2026 | Robotaxi Physical agents regulatory category |
| NIST NCCoE agent identity concept paper | US | Adapt identity and authorization to agents | Comments closed Apr 2, 2026 | Enterprise agents Identity and cryptographic attestation |
| National incident reporting measures (CAC) | China | First report within one, two or four hours by operator type | Effective Nov 1, 2025 | Monitoring and anomaly detection Controls |
| OWASP Top 10 for Agentic Applications | International | Identity and privilege abuse, tool misuse and insecure agent-to-agent traffic | Dec 2025 | Agent access control permissions Controls |
| OpenAI Preparedness Framework v2 | Company | High and Critical capability thresholds | Apr 2025 | Risk tiers Model safety |
| Personal Information Protection Law, Articles 28 and 29 | China | Separate consent for sensitive data including biometrics | In force Nov 1, 2021 | Consent and capture controls Surveillance material harvesting |
| Principles for the Secure Integration of AI in OT | US and partners | No AI safety decisions; manual fallback; push-only export; AI off switch | Dec 3, 2025 | Ot ics integration controls Critical infrastructure compromise |
| Reg E and Reg Z (CFPB) | US | Unauthorized-transfer and billing-error liability; agent status unresolved | In force; no agent guidance | Transaction commerce agents Software agents |
| UNGA resolution A/RES/79/325 | UN | Creates the scientific panel and Global Dialogue on AI | Adopted Aug 26, 2025 | Governance International coordination ai |
| 49 CFR 573 | US | OTA counts as a recall remedy | In force | Ota loop attack surface |
| A2A v1.0 | Open standard | Signed Agent Cards for agent identity | Apr 2026 | Workflow agents |
| AI Act Article 70 | EU | Each state names notifying and market surveillance authorities | Due Aug 2, 2025 | Eu notified bodies |
| AI Act Articles 28 to 39 | EU | Member states notify conformity assessment bodies | Needed by Dec 2, 2027 | Eu notified bodies |
| AI Data Security information sheet | US and partners | Data provenance, signing and poisoning protection | May 22, 2025 | Cybersecurity |
| AIUC-1 with SOC 2 | US industry | Agent testing with quarterly retests | Launched Oct 2026 | Third party audits |
| ANAB and UKAS accreditation | US and UK | Accredit 42001 certifiers | Active | Iso iec 42001 |
| Algorithm recommendation provisions | China | Disclose principles; opt out of personalization | Since Mar 1, 2022 | Explainability |
| Algorithm registry and generative AI filing | China | File and publish recommendation, deep synthesis and generative algorithms | Ongoing | Transparency |
| Amazon v. Perplexity (Ninth Circuit) | US | Vacated the injunction against Perplexity's Comet shopping agent | Aug 2026 | Transaction commerce agents |
| America's AI Action Plan | US | AI-ISAC; secure-by-design AI in safety-critical uses | Jul 23, 2025 | Critical infrastructure compromise |
| America's AI Action Plan and EO 14179 | US federal | Promotion-first federal policy; Biden order revoked | Jul 2025 | Regulatory frameworks |
| Annex IV documentation and Article 17 QMS | EU | Technical file and quality management system | Dec 2027; Annex I Aug 2028 | Eu conformity |
| Annex VII notified body route | EU | Third-party QMS and documentation audit | Dec 2, 2027 | Eu conformity |
| Anti-Telecom and Online Fraud Law | China | Carrier, bank and platform anti-fraud duties | Effective Dec 1, 2022 | Autonomous crime economy |
| Article 43 and Annex VI internal control | EU | Self-assessment where harmonized standards are applied | Dec 2, 2027 | Eu conformity |
| Articles 48 to 49 and 72 | EU | CE marking, EU database registration, post-market monitoring | Same dates | Eu conformity |
| Automotive data security provisions | China | Vehicle data processed in-car by default; important data kept in China | Oct 1, 2021 | Telemetry capture integrity |
| Beijing Autonomous Vehicle Regulations | Beijing, China | Monitoring platform; takeover duty on faults | Effective Apr 1, 2025 | Human oversight |
| CAAC Interim Regulations on UAV Flight Management | China | Real-name registration and airspace rules | In force | Drones public safety |
| CAC filing and sector testing | China | Filing plus testing for sector agents | Effective Jul 15, 2026 | Eu notified bodies |
| CAC generative AI filing | China | Filing before public launch | Ongoing; 988 filed | Compliance |
| CAC generative AI filing and security assessment | China | Self-assessment and algorithm filing before launch | In force | Audits |
| CAICT AI safety and trustworthy AI evaluations | China | Voluntary certificates after testing | 2026 round announced Mar 2026 | Third party audits |
| CCW Group of Governmental Experts | UN | Negotiating a rolling text | No agreement as of 2026 | Weaponization |
| CII Security Protection Regulations | China | Security duties for infrastructure operators | In force since 2021 | Risk thousand cuts cip |
| CISA and G7 AI SBOM minimum elements | US and G7 | Model lineage and dataset provenance fields | Jun 2026 | Supply chain security |
| California AB 325 | California | Bans common pricing algorithms in restraint of trade | Effective Jan 1, 2026 | Risk multi agent misuse |
| California DMV emergency geofencing | California | Whole fleet leaves a named emergency area within two minutes | Adopted Apr 28, 2026 | Multi agent fleets |
| California SB 243 | California | AI disclosure, suicide-prevention protocols, reminders for minors | Effective Jan 1, 2026 | Personal manipulation |
| China AI device grading standard | China | Graded certification including agent tasks | Introduced May 2026 | Conformance |
| China Cybersecurity Law amendments and incident rules | China | 4, 72 and 720-hour reporting; higher fines | Nov 2025 and Jan 2026 | Critical infrastructure policy |
| China Global AI Governance Action Plan | China | 13-point roadmap; proposed WAICO | Jul 26, 2025 | International coordination ai |
| China generative AI filing and registration | China | File services; apps display filed models | Since Aug 2023 | Compliance documentation |
| China national AI management system standard plan | China | National AI management system standard | Planned 2022; publication not confirmed | Iso iec 42001 |
| China's layered AI regime | China | Algorithm, deep synthesis, generative AI, labeling and agent rules | In force 2022 to 2026 | Regulatory frameworks |
| Colorado HB24-1130 | Colorado | Biometric consent, retention and deletion rules | Effective Jul 1, 2025 | Consent and capture controls |
| Council of Europe AI Convention (CETS 225) | International | Binding human rights treaty across the AI lifecycle | 17 signatories; EU ratified May 2026 | International coordination ai |
| Crime and Policing Act 2026, s.72 | UK | Offense to make or supply abuse-image tools | Royal Assent Apr 29, 2026 | Criminal law categories |
| Critical Information Infrastructure Security Protection Regulations | China | Operator security, incident reporting, procurement review | Effective Sep 1, 2021 | Ot ics integration controls |
| Cross-border data flow provisions | China | Filing, contract or assessment by volume threshold | Mar 22, 2024 | Data transit security |
| DPDP Act and Rules 2025 | India | Notice, consent, children's data, breach notice | Fully operative May 12, 2027 | Personal data and surveillance law |
| Deep synthesis provisions | China | Consent for face and voice editing; labeling; real-name users | Effective Jan 10, 2023 | Impersonation |
| EASA and IATA GNSS interference plan | EU and global | Data collection and backup navigation | Jun 2025 | Telemetry capture integrity |
| ECOA and Regulation B | US | Specific reasons for credit denial | In force; AI circulars withdrawn | Explainability |
| EMVCo agentic payments framework | Global | Industry framework for agent payments | Draft | Transaction commerce agents |
| EO 14318 data center permitting | US federal | Fast-track review and federal land for large data centers | Signed Jul 23, 2025 | Critical infrastructure policy |
| EO 14434, Inaugurating the Era of Super Intelligence | US federal | SI in federal communications; definition proposal in 60 days | Signed Sep 29, 2026; definition due ~Nov 28 | White house superintelligence accord |
| ETSI EN 304 223 | EU and international | Baseline cybersecurity for AI systems | Jan 16, 2026 | Conformance |
| EU AI Act Annex I high-risk | EU | AI in regulated products | Aug 2, 2028 | Regulations |
| EU AI Act Annex III, point 2 | EU | AI safety components in infrastructure are high-risk | Dec 2, 2027 | Critical infrastructure policy |
| EU AI Act Article 11 and Annex IV | EU | Technical file for high-risk systems | Dec 2, 2027 | Compliance documentation |
| EU AI Act Article 12 | EU | Automatic event logging over a high-risk system's lifetime | Delayed to Dec 2, 2027 | Telemetry integrity controls |
| EU AI Act Article 14 | EU | High-risk systems designed so people can monitor, override and stop them | Delayed to Dec 2027 | Human oversight |
| EU AI Act Article 5 as amended | EU | Bans AI generating intimate imagery or CSAM | Applies Dec 2, 2026 | Criminal law categories |
| EU AI Act Article 53 and template | EU | Public summary of training data | From Aug 2, 2025; enforcement Aug 2026 | Transparency |
| EU AI Act Article 72 | EU | Post-market monitoring plan for high-risk systems | Delayed to Dec 2027 | Monitoring and anomaly detection |
| EU AI Act Article 73 | EU | Serious incident reports in two, 10 or 15 days | Draft guidance Sep 2025 | Monitoring and anomaly detection |
| EU AI Act Article 86 | EU | Explanation of AI's role in high-risk decisions | With high-risk timeline, Dec 2027 | Explainability |
| EU AI Act Article 9 | EU | Lifecycle risk management for high-risk systems | Dec 2, 2027 | Risk management |
| EU AI Act Article 99 | EU | €35M or 7% for prohibited practices; €15M or 3% for most duties | Sanctions active Aug 2, 2026 | Penalties fines |
| EU AI Act Articles 12 and 18 | EU | Event logging; 10-year document retention | Dec 2, 2027 | Compliance documentation |
| EU AI Act Articles 12 and 19 | EU | Automatic logging; keep logs at least six months | Dec 2027 | Audits |
| EU AI Act Articles 12, 14, 15, 72 and 73 | EU | Logging, human oversight, robustness, monitoring and incident reports for high-risk systems | Mostly delayed to Dec 2027 | Controls |
| EU AI Act Articles 14 and 26 | EU | Oversight by design; trained deployer staff with authority | Dec 2027 | Human oversight |
| EU AI Act as amended by 2026/1744 | EU | Prohibitions and general-purpose duties live; high-risk delayed | In force | Regulatory frameworks |
| EU AI Act conformity assessment and CE marking | EU | Conformity assessment and CE mark for high-risk AI | Dec 2027; Annex I Aug 2028 | Conformance |
| EU AI Act emotion recognition ban | EU | No emotion inference at work or school | In force Feb 2, 2025 | Workforce |
| EU AI Act harmonized standards (CEN-CENELEC JTC 21) | EU | Presumption of conformity for high-risk AI | Late 2026 at the earliest | Standards bodies |
| EU AI Act notified bodies | EU | Third-party conformity assessment for some high-risk AI | Dec 2027 | Third party audits |
| EU AI Act tiers | EU | Unacceptable, high, limited and minimal risk | High-risk delayed to 2027 and 2028 | Risk tiers |
| EU DORA | EU | ICT risk and third-party resilience; AI only as ICT | From Jan 17, 2025 | Sector specific compliance gaps |
| EU Data Act | EU | User access to connected-product data | From Sep 12, 2025 | Telemetry capture integrity |
| EU Digital Omnibus 2026/1744 | EU | Delays high-risk duties to Dec 2027 and Aug 2028 | In force Jul 27, 2026 | Governance |
| EU General Safety Regulation 2019/2144 (ADDW) | EU | Driver distraction warning on all new vehicles | All new vehicles from Jul 7, 2026 | Agent vehicle cabin ai |
| EU Regulation 2019/947 | EU | Operational authorization for beyond-line-of-sight flights in the specific category | In force | Drones public safety |
| Employee Technological Displacement Act (SB 951) | California | AI and automation disclosed in mass layoff notices | Effective Jan 1, 2027 | Workforce |
| Euro NCAP 2026 protocols | Europe | Eye and head tracking; impairment detection | 2026 | Agent vehicle cabin ai |
| Executive order on state AI laws | US federal | DOJ to challenge state AI laws that are not minimally burdensome | In effect since Dec 11, 2025 | Governance |
| FAA Part 108 flight coordinator | US federal | One coordinator may oversee several aircraft | Proposed | Multi agent fleets |
| FCC Covered List, foreign-made UAS | US federal | No new equipment authorizations for foreign-made drones and critical parts; existing models stay legal | Effective Dec 22, 2025 | Drones public safety |
| FCC ruling on AI voices | US | AI voices count as artificial under the TCPA | Feb 8, 2024 | Impersonation |
| FDA AI-enabled device lifecycle guidance | US | Lifecycle and submission recommendations | Draft Jan 6, 2025 | Medical devices |
| FDA CDS and general wellness guidances | US | Enforcement discretion for some decision support; wider wellness scope | Jan 2026 | Medical devices |
| FDA general wellness guidance (revised) | US | Wearables estimating values like blood pressure can be wellness products | Jan 2026 | Wearable agents |
| FIDO agentic authentication program | International | User authorization of agents and trusted delegation for commerce | Working groups formed Apr 28, 2026 | Identity and cryptographic attestation |
| FMCSA ADS motor-carrier rulemaking | US federal | Operating rules for ADS-equipped commercial vehicles | On the Unified Agenda, no date | Robotrucks platoons |
| FTC 6(b) inquiry | US | Information orders to seven companies | Issued Sep 11, 2025 | Personal manipulation |
| Frontier AI Safety Commitments (Seoul) | International | Publish safety frameworks with risk thresholds | May 2024; Zhipu the only Chinese signer | Trust |
| G7 Hiroshima process reporting framework | G7 / OECD | Voluntary developer reports | 19 reports in round one | International coordination ai |
| GB 11291 industrial robot safety | China | National robot safety standard aligned with ISO 10218 | In force | Industrial cobots |
| GB 44497-2024 automated-driving data recording | China | Mandatory event data recording for automated driving | Effective Jan 1, 2026 | Telemetry integrity controls |
| GB 45652-2025 training data security | China | Screening of training data sources | Effective Nov 1, 2025 | Training data poisoning |
| GB 47955-2026 combined driving assistance | China | Three Level 2 tiers, driver monitoring, data logging | Effective Jan 1, 2027 | Autonomous human safety |
| GB/T 45654-2025 | China | Question-bank testing with refusal thresholds before filing | In force Nov 1, 2025 | Red teaming |
| GB/Z 185-2026 AI agent interconnection | China | Unified agent identifiers with update, suspend and revoke actions | Published May 22, 2026 (guidance) | Identity and cryptographic attestation |
| GDPR Article 22 | EU | Right to human intervention in automated decisions | In force | Human oversight |
| GDPR Article 83 | EU | €20M or 4% of global turnover | In force | Penalties fines |
| GDPR Articles 15 and 22 | EU | Meaningful information about automated decision logic | In force | Explainability |
| GDPR and EDPB Opinion 28/2024 | EU | Case-by-case test of whether a model is anonymous | Dec 2024 | Personal data and surveillance law |
| General-purpose Article 53 documentation | EU | Model documentation kept 10 years | Enforceable Aug 2, 2026 | Compliance documentation |
| Google Frontier Safety Framework | Company | Critical capability levels with early warnings | v3.1, Apr 2026 | Model safety |
| HM Treasury payment services consultation | UK | Asks whether consent and liability rules need updating for agents | Closed Oct 6, 2026 | Transaction commerce agents |
| IETF draft-klrc-aiagent-auth | International | Agents as workloads: WIMSE/SPIFFE IDs, mTLS or HTTP signatures, OAuth delegation | Individual draft, Mar 30, 2026 | Identity and cryptographic attestation |
| IIA AI Auditing Framework | International | Principles-based guide and checklist | Updated Sep 13, 2024 | Audits |
| ILA-USMX master contract | US ports | Protections against port automation through 2030 | Ratified Feb 2025 | Workforce |
| ISACA AAIA | International | Advanced AI audit credential | Launched 2025 | Audits |
| ISO 10218-1 and -2:2025 | International | Industrial robot safety, with collaborative and cybersecurity rules | Published 2025 | Physical safety |
| ISO 21448 SOTIF | International | Safety of the intended functionality | Published 2022 | Ul 4600 standard |
| ISO CG 35 08 | US insurance | Generative AI exclusion for products liability | Jan 2026 edition | Insurance underwriting |
| ISO CG 40 47 | US insurance | Excludes generative AI injury from general liability | Jan 2026 edition | Insurance underwriting |
| ISO CG 40 48 | US insurance | Excludes generative AI personal and advertising injury | Jan 2026 edition | Insurance underwriting |
| ISO/CD 25785-1 | International | Safety requirements for dynamically stable legged robots | Committee draft | Humanoid |
| ISO/IEC 23894 | International | AI risk management guidance on ISO 31000 | Published 2023 | Risk management |
| ISO/IEC 42001:2023 | International | AI management system: policy, risk and impact assessment, lifecycle controls | Published Dec 2023 | Iso iec 42001 |
| ISO/IEC 42006:2025 | International | Requirements for 42001 certification bodies | Published Jul 7, 2025 | Iso iec 42001 |
| ISO/PAS 8800:2024 | International | Safety of AI elements in road vehicles | Dec 12, 2024 | Ul 4600 standard |
| Illinois BIPA | Illinois | Written consent for biometrics; private right of action | In force since 2008 | Surveillance |
| Illinois HB 3773 | Illinois | No discriminatory AI in employment decisions; notice to workers | Effective Jan 1, 2026 | Workforce |
| Internet Platform Pricing Rules | China | No algorithmic price discrimination | Effective Apr 10, 2026 | Bias fairness |
| Japan AI Promotion Act | Japan | Promotion law with guidance, no penalties | Enacted 2025 | Regulatory frameworks |
| MAST | Academic | Standard labels for multi-agent failures | NeurIPS 2025 | Failure modes |
| MDR and IVDR with AI Act Annex I | EU | Device notified bodies assess AI in devices | Aug 2, 2028 | Eu notified bodies |
| MIIT AI standardization guideline | China | 50+ national and industry AI standards by 2026 | Issued 2024 | Standards bodies |
| MIIT Guiding Opinions on humanoid robots | China | National targets for humanoid development and supply chain | Issued 2023 | Humanoid |
| MIIT Level 3 market access | China | Conditional approval with speed and zone limits | First approvals Dec 15, 2025 | Sector specific compliance gaps |
| MIIT and SAMR OTA filing notice | China | Filing before update; consent | Feb 25, 2025 | Ota loop attack surface |
| MIIT driver-assist directives | China | No "autonomous driving" marketing; OTA and beta tests need approval | Apr 16, 2025 | Autonomous human safety |
| MLPS 2.0 (GB/T 22239-2019) | China | Graded protection with an industrial control extension | Effective Dec 1, 2019 | Ot ics integration controls |
| Microsoft agentic failure taxonomy v2 | Industry | Threat-modeling categories for agents | Jun 4, 2026 | Failure modes |
| NAIC AI Model Bulletin | US states | Written AI program and third-party oversight for insurers | 29 jurisdictions | Sector specific compliance gaps |
| NDRC foreign-investment review (Manus) | China | Barred foreign investment in Manus | Apr 27, 2026 | Workflow agents |
| NERC inverter-based resource standards | North America | Bring inverter-based resources into reliability standards | 2025-26 rollout | Risk thousand cuts cip |
| NFRA guiding opinions on AI in banking and insurance | China | Lifecycle governance, risk tiers, human oversight | Jun 18, 2026 | Sector specific compliance gaps |
| NIS2 and CER directives | EU | Cyber and physical resilience for critical entities | NIS2 deadline Oct 17, 2024; incomplete | Critical infrastructure policy |
| NIST AI 100-2 E2025 | US | Terms and mitigations for poisoning attacks | Mar 2025 | Training data poisoning |
| NIST AI 600-1 Generative AI Profile | US federal | Generative AI risks and actions | Jul 26, 2024 | Nist rmf application |
| NIST AI RMF 1.0 | US federal | Govern, map, measure and manage | Revision under way | Nist rmf application |
| NIST AI RMF 1.0 and AI 600-1 | US | Govern, map, measure and manage functions | Under revision 2026 | Risk management |
| NMPA Class III registration | China | Clinical trials for high-risk AI devices | In force | Medical devices |
| Network data security management regulations | China | Processing and cross-border rules | Effective Jan 1, 2025 | Data transit security |
| Network product vulnerability regulations | China | Report vulnerabilities to MIIT within two days | Sep 1, 2021 | Supply chain security |
| New Delhi Declaration on AI Impact | International | Affordable AI resources and open ecosystems | Feb 2026 | International coordination ai |
| New York AI companion law | New York | Crisis detection and disclosure | Effective Nov 2025 | Personal manipulation |
| New York RAISE Act | New York | Frontier frameworks; 72-hour incident reporting | Effective Jan 1, 2027 | Risk tiers |
| No Robo Bosses Act (SB 947) | California | No discipline or firing based only on automated output; human confirmation and notice | Effective Jul 1, 2027 | Workforce |
| OECD AI Principles | OECD | Trustworthy AI principles | Revised May 2024 | Ethics |
| OMB M-25-21 | US federal | Agency AI governance and use case inventories | Apr 2025 | Nist rmf application |
| OSHA general duty clause | US | Employer duty to keep workplaces free of recognized hazards; no robot-specific standard | In force | Industrial cobots |
| OWASP Top 10 for LLM Applications 2025 | International | Ranks prompt injection first among 10 risks | Nov 2024 | Cybersecurity |
| PI protection compliance audit measures | China | Audits every two years above 10 million people | Effective May 1, 2025 | Personal data and surveillance law |
| PRC Criminal Law applied to AI | China | AI fraud prosecuted as intrusion, data or personal-information crimes | Ongoing | Criminal law categories |
| Paris Statement on Inclusive and Sustainable AI | Global | Voluntary commitments | Feb 2025 | Ethics |
| Platform controls at WeChat, Alipay and banks | China | Private blocking of agent-driven sessions | Dec 2025 | Mobile device agents |
| Robotaxi license suspension | China | No new licenses until safety controls strengthened | Reported Apr 2026 | Risk multi agent misuse |
| SEC predictive data analytics proposal | US federal | AI conflicts rule | Withdrawn Jun 12, 2025 | Sector specific compliance gaps |
| Safe Drinking Water Act Section 1433 | US | Risk and resilience assessments with cyber elements | Enforcement alert May 2024 | Risk thousand cuts cip |
| Section 230 | US federal | No appellate ruling yet on generative AI output | Open question | Liability and product law |
| Shanghai AI Lab Frontier AI Risk Management Framework | China | Green, yellow and red zones setting safeguards | v1.0 Jul 31, 2025 | Alignment |
| State Council employment-first plan | China | Monitor AI job effects; retraining; unemployment under 5.5% | 2026 to 2030 | Workforce |
| State comprehensive privacy laws | US states | Consumer rights and opt-outs | 20 states, 2026 | Personal data and surveillance law |
| State license plate reader laws | US states | 13 states require audits; eight make misuse a crime | Aug 2026 | Agent public infrastructure |
| Super Intelligence Force | US federal | Coordinates federal AI policy | Announced Oct 4, 2026 | White house superintelligence accord |
| TC260 draft guide for OpenClaw-class agents | China | Lifecycle and supply-chain controls; shadow agents | Draft Apr 2026 | Enterprise agents |
| Texas CUBI | Texas | Notice and consent before capturing face geometry or voiceprints | In force | Consent and capture controls |
| Texas Data Privacy and Security Act | Texas | Consent for sensitive data including location | Effective Jul 1, 2024 | Surveillance material harvesting |
| The Alignment Project | UK | Grant funding for alignment and control research | £27M as of Feb 2026 | Alignment |
| Trial Measures for Ethics Review | China | Ethics committees and expert re-review | Issued Oct 8, 2023 | Ethics |
| UK PSTI Act | UK | No universal default passwords on smart devices | In force Apr 2024 | Convenience as attack surface |
| UL 3115 | International | Safety assessment of AI products | First certifications Mar 2026 | Conformance |
| UL 4600 Edition 3 | International | Safety case for autonomous products including trucks | Mar 17, 2023 | Ul 4600 standard |
| UN Regulation 171 | UNECE / EU | Level 2 performance and driver monitoring | Adopted 2024 | Autonomous human safety |
| UNESCO Recommendation on the Ethics of AI | Global | Readiness and ethical impact assessments | Adopted Nov 2021 | Ethics |
| UNGA resolution A/RES/80/57 | UN | Asks CCW states to finish elements of an instrument on autonomous weapons | First Committee vote Nov 6, 2025 | Weaponization |
| US Cyber Trust Mark | US | Voluntary IoT security label | Launched Jan 2025 | Fleet attacks |
| US v. RealPage proposed final judgment | US | Data-use and training limits on rent pricing | Agreed Nov 24, 2025 | Risk multi agent misuse |
| W. R. Berkley AI exclusion | US insurance | Excludes claims tied to any use of AI | Filed; approval not confirmed | Insurance underwriting |
| White House Accord on Super Intelligence | US industry | Internal controls, controls team, external audit, board oversight | Signed Sep 29, 2026 | White house superintelligence accord |
Cited on: each 137AI page that cites the rule. Status colors: green in force, blue voluntary, amber phasing in, gray draft or pending, red withdrawn.
Evidence
States legislate, Washington preempts and China adds sector rules
| Date | Case | Country | What happened | Source |
|---|---|---|---|---|
| Dec 11, 2025 | Executive order on state AI laws | United States | Created a DOJ AI Litigation Task Force and tied broadband funds to state AI laws | Source |
| Apr 24, 2026 | DOJ intervenes in xAI v. Weiser | United States | DOJ joined the challenge to Colorado's AI Act; enforcement stayed three days later | Source |
| May 2026 | NPC Standing Committee 2026 plan | China | No comprehensive AI law among 34 scheduled bills; AI listed for research only | Source |
| Jul 6, 2026 | First UN Global Dialogue on AI Governance | UN | Held in Geneva after the 40-member scientific panel's preliminary report | Source |
| Jul 27, 2026 | EU Digital Omnibus in force | EU | Regulation 2026/1744 delays high-risk duties to Dec 2027 and Aug 2028 | Source |
| Oct 2026 | NCSL state bill count | United States | 1,539 AI bills introduced and 280 enacted in 2026, against 1,262 and 227 in 2025 | Source |
Registry
13 registry incidents link to governance pages
| Incident | Date | Regulator or court action |
|---|---|---|
| Uber Test Vehicle Kills Pedestrian in Tempe | Mar 2018 | Arizona suspended Uber's testing on March 26, 2018. Yavapai County declined to charge Uber in March 2019. NTSB adopted its findings on November 19, 2019. The backup operator pleaded guilty to endangerment in July 2023 and received three years of supervised probation. |
| Amazon Echo Sends a Private Conversation to a Contact | May 2018 | None found. |
| Tesla Staff Share Customer Car Camera Footage | 2019 to 2022 | On April 14, 2023, Senators Edward Markey and Richard Blumenthal wrote to Elon Musk demanding Tesla's access policies. An owner filed a proposed class action. No agency penalty was found. |
| Air Canada Chatbot Invents a Refund Rule | Nov 2022 | On February 14, 2024, the BC Civil Resolution Tribunal found negligent misrepresentation and ordered Air Canada to pay CA$812.02. |
| Cruise Robotaxi Drags a Pedestrian | Oct 2023 | California DMV suspended Cruise's driverless permits on October 24, 2023. NHTSA fined Cruise $1.5 million on September 30, 2024, for incomplete crash reports. On November 14, 2024, Cruise admitted filing a false report and agreed to a $500,000 deferred prosecution agreement. |
| Packing Robot Kills a Worker in Goseong | Nov 2023 | Goseong police investigated, including questioning the on-site safety manager. No ministry action was found. |
| Tesla Recalls Autopilot After NHTSA Investigation | Dec 2023 | NHTSA opened PE21-020 in August 2021, upgraded it to EA22-002 in June 2022 and closed it in April 2024 after reviewing 956 crashes, opening RQ24-009 on whether the fix worked. No penalty. |
| EchoLeak Turns Microsoft 365 Copilot Into a Data Leak | Jan 2025 | None reported. |
| Xiaomi SU7 Crashes on Assisted Driving | Mar 2025 | In April 2025 MIIT barred carmakers from calling driver assistance autonomous driving and required approval of driving-function updates. On September 19, 2025, Xiaomi recalled 116,887 SU7s through SAMR over a highway driver assistance flaw. |
| Nx Malware Turns AI Coding Tools Against Their Users | Aug 2025 | None reported. |
| Chinese State Group Runs Espionage Through Claude Code | Sep 2025 | On November 26, 2025, the House Homeland Security Committee asked Anthropic CEO Dario Amodei to testify. |
| Waymo Robotaxis Pass Stopped School Buses | Sep 2025 | NHTSA opened preliminary evaluation PE25-013 on October 17, 2025, and wrote to Waymo again on December 3. Waymo counts 12 citations tied to the behavior. |
| OpenAI Test Models Breach Hugging Face | Jul 2026 | Senator Josh Hawley wrote to OpenAI on September 9, 2026. The White House Accord on Super Intelligence, signed September 29, 2026, commits signers to controls that keep models from hacking systems in unintended ways. No enforcement action was found. |
Rules
The four instruments that moved AI governance most in 2025 and 2026
| Rule | Jurisdiction | What it requires | Status |
|---|---|---|---|
| Executive order on state AI laws | US federal | DOJ to challenge state AI laws that are not minimally burdensome | In effect since Dec 11, 2025 |
| EU Digital Omnibus 2026/1744 | EU | Delays high-risk duties to Dec 2027 and Aug 2028 | In force Jul 27, 2026 |
| China agent Implementation Opinions (CAC, NDRC, MIIT) | China | Agent boundaries, approval tiers, filing and recall | Effective Jul 15, 2026 |
| UNGA resolution A/RES/79/325 | UN | Creates the scientific panel and Global Dialogue on AI | Adopted Aug 26, 2025 |
Status colors: green in force, blue voluntary standard or framework, amber adopted and phasing in, gray draft or pending, red withdrawn.
Record
Page Record
- Datasets
- ai_governance_evidence.csv (6 rows); ai_rules.csv (245 rows); registry incidents (13 linked)
- Key sources
- Executive order on state AI laws
DOJ intervenes in xAI v. Weiser
NPC Standing Committee 2026 plan
First UN Global Dialogue on AI Governance
EU Digital Omnibus in force
NCSL state bill count - Last verified
- October 2026