South Africa — Draft National AI Policy
Cabinet approved the draft National AI Policy for public comment at a post-Cabinet briefing in Pretoria. Sector-specific multi-regulator model reported. 60-day public comment window opens on gazette publication. Sector regulations targeted for the 2027/2028 financial year. Live tracker + POPIA and King V baseline + what organisations should do now.
Read the tracker →EU — Artificial Intelligence Act
The EU AI Act is Regula's primary detection target. 419 risk patterns mapped to Articles 5, 6, 9–15 and Annex III. High-risk Annex III obligations now apply from 2 December 2027 (Digital Omnibus provisional agreement, 7 May 2026; approved by European Parliament on 16 June 2026; approved by Council on 29 June 2026; pending OJ publication). Article 50 transparency obligations apply from 2 August 2026. Use regula check, regula gap, regula conform, and regula register (Annex VIII) against any codebase today.
UAE & GCC — EU AI Act extraterritorial exposure
If a UAE-licensed company ships AI features that touch EU users, Article 2(1)(c) of Regulation (EU) 2024/1689 applies. Art 50 transparency obligations apply from 2 August 2026. Annex III high-risk obligations are deferred to 2 December 2027 (Omnibus; EP approved 16 Jun 2026, Council approved 29 Jun 2026; pending OJ publication). Fines reach €35M or 7% of global turnover. Dedicated landing page for GCC general counsel, heads of AI, and founders evaluating their EU market exposure.
Read the UAE brief →United Kingdom — AI regulation framework
The UK has taken a principles-based, sector-specific approach distinct from the EU AI Act. ICO leads on data protection and automated decision-making (UK GDPR Art. 22), DSIT on cross-cutting policy, with FCA, MHRA, Ofcom and CMA applying their own mandates. Live tracker plus ICO/DSIT baseline plus what UK organisations should do today.
Read the tracker →Brazil — Marco Legal da IA & LGPD
PL 2338/2023 (Marco Legal da IA) passed the Senate on 10 December 2024 and is in a Special Commission at the Chamber of Deputies. LGPD already applies to AI via Article 20 (automated decisions), Article 38 (impact reports), and Article 11 (sensitive data). Regula's framework crosswalk covers both LGPD and Marco Legal. Penalties if enacted: up to R$50M or 2% annual revenue.
Read the tracker →Colorado — SB 205 Repealed, Replaced by SB 189
SB 24-205 (the Colorado Artificial Intelligence Act) was repealed in May 2026 before taking effect. It was replaced by SB 26-189, a narrower disclosure-focused regime whose duties apply from 1 January 2027 — developer documentation, consumer notice, and correction and human-review rights, enforced by the AG. The original SB 24-205 duties (developer reasonable-care, deployer impact assessments) were not reenacted. This page documents the legislative history and what SB 189 requires.
Read the tracker →South Korea — AI Basic Act
The second major horizontal AI statute after the EU AI Act. Took effect on 22 January 2026 with its Enforcement Decree. Defines high-impact AI (use-based) and high-performance AI (≥ 10²⁶ training FLOPs — distinct from the EU's 10²⁵ threshold), with generative AI disclosure and watermarking already required. Extraterritorial reach to foreign providers. Live tracker plus EU-vs-Korea comparison plus MSIT watchlist.
Read the tracker →United States — federal & other state laws
Beyond Colorado, the US approach remains a patchwork: federal NIST AI RMF 1.0 and the 2024 GenAI Profile (NIST AI 600-1) serve as voluntary frameworks, while Texas, California, Connecticut and New York have passed or proposed state-level AI laws. Regula's framework crosswalk maps findings to NIST AI 600-1's 12 GenAI risks. Additional state pages will land as statutes are enacted.
Coming soonAfrican Union — Continental AI Strategy
The AU Continental AI Strategy (2024) sets the continental direction and several SADC member states are developing national responses. A regional tracker page is on the roadmap once the South Africa gazette clarifies the baseline.
Coming soonOur coverage principles
Every claim on this site about regulation is either (a) checkable against the actual legislation or an official government source, or (b) explicitly labelled as secondary reporting with the secondary source named. Where a jurisdiction's text is not in the public domain, we say so, label the claim, and commit to verifying it against the primary source as soon as it publishes. We would rather publish a short page with clear provenance than a long page with silent assumptions.
If a jurisdiction matters to you and it is not yet on this list, open an issue. We prioritise coverage by reader demand and by the quality of the primary source we can cite.