Businesses
AI Global Regulations Atlas: Mapping the Law of Intelligence
04 Nov 2026
Executive White Paper for C-Suite and Enterprise Risk Officers
1,170 instruments · 109 jurisdictions · By Dinis Guarda · Businessabc.net · November 2026
| AI governance has shifted from soft-law ethics to binding, multi-jurisdictional enforcement in less than a decade. Operating globally without a cross-border compliance mapping framework exposes enterprises to fines of up to 7% of global annual turnover and to sudden regional product suspensions. Reading AI-specific statutes alone creates a false sense of compliance: most obligations still reach AI systems through data protection, consumer, product-safety and sector law. |
1,170 Total AI regulatory instruments | 109 Jurisdictions mapped | €35M or 7% Maximum EU AI Act fine (share of global turnover) | 78% of Global South AI frameworks remain non-binding |
Executive Summary and Business Impact
Regulatory sprawl now creates material compliance liabilities and operational gridlock for enterprise AI deployment. A single AI product released worldwide can fall under risk tiers in Brussels, compute thresholds in California, use-case rules in Colorado, targeted service rules in Beijing and penalty-free promotion law in Tokyo, all at once and on different timetables.
This white paper consolidates the leading public measurement systems into one executive view. It combines regulatory trackers (regulations.ai and CASRAI), the Global Index on Responsible AI (GIRAI), the International Monetary Fund (IMF) AI Preparedness Index, the Stanford HAI AI Index 2026 and primary legislative records. Together they describe some 1,170 AI regulatory instruments across 109 countries and jurisdictions: about 670 in force, 391 in the legislative pipeline and 109 with other statuses. . Live trackers had already moved to roughly 1,180 instruments (683 in force, 388 in the pipeline) by 4 November 2026.
Five findings define the operating reality for leadership teams:
- Compliance extends beyond AI statutes. The corpus spans 259 acts, 170 bills, 87 regulations, 70 decrees, 187 guidelines and 375 policies and national strategies, with 22 more in other categories. A jurisdiction without an AI statute can still regulate AI heavily through data protection, consumer protection, product liability and sector supervision.
- Instrument count is not a legal force. The United States (296 instruments, federal and state), the United Kingdom (43), the European Union (35), China (30) and Argentina (28) lead by count. Yet the EU applies one horizontal statute to every sector, while the US has no binding federal AI statute and relies on executive orders, sector regulators and a fast-growing body of state law.
- Implementation lags adoption. GIRAI assesses 135 countries on 38 indicators and finds a global average of about 35 out of 100 (Europe 54, Global South 27). Only 55% of active frameworks show evidence of implementation, and 78% of Global South frameworks are non-binding, against 42% in the Global North.
- The pace topped one new or amended instrument per working day in 2025. The corpus holds 275 instruments dated 2024, 277 dated 2025 and 171 dated 2026. South Korea's AI Basic Act took effect in January 2026, Vietnam's Law on Artificial Intelligence in March 2026, and the EU amended its AI Act through the Digital Omnibus, Regulation (EU) 2026/1744.
- Regulation is accelerating without converging. Definitions, triggers and deadlines differ by jurisdiction. Organisations that map exposure once, classify against the strictest applicable regime and monitor the pipeline continuously will carry lower compliance cost and fewer launch delays.
Interactive resource: the companion AI Global Regulations Atlas provides a world map, model filters, an exposure checker and a sortable directory of all 109 jurisdictions.
1. The Executive Problem: Regulatory Speed, Concentration and Fragmentation
AI regulation has moved faster than any previous area of technology law. Data protection took roughly half a century to move from the first national statutes of the 1970s to the global reach of the EU General Data Protection Regulation (GDPR) in 2018. AI regulation moved from ethics principles to binding statute in under a decade.
| Date | Milestone | Business significance |
|---|---|---|
| May 2019 | OECD AI Principles adopted | First intergovernmental AI standard; soft law |
| Aug 2023 | China's Generative AI Interim Measures in force | First binding rules for public generative AI services |
| 1 Aug 2024 | EU AI Act enters into force | First horizontal, cross-sector AI statute |
| 2 Feb 2025 | EU prohibited practices and AI-literacy duty apply | First enforceable AI bans in a major market |
| 2 Aug 2025 | EU general-purpose AI (GPAI) obligations apply | Duties for foundation-model providers |
| 22 Jan 2026 | South Korea AI Basic Act in force | First comprehensive AI law in East Asia |
| 1 Mar 2026 | Vietnam Law on AI in force | Risk-tiered AI law in South-East Asia |
| 27 Jul 2026 | EU Digital Omnibus, Reg. (EU) 2026/1744, in force | High-risk deadlines deferred; AI-literacy duty softened; new prohibitions from 2 Dec 2026 |
The executive problem is the mismatch between this pace and global product cycles. A product roadmap of 18 to 24 months will now cross at least one major enforcement date in most markets. Teams that plan only against laws already in force are planning against last year's map: roughly one instrument in three is written but not yet in force.
Anatomy of the global corpus
Non-binding policies, strategies and guidelines still outnumber binding acts, regulations and decrees, but compliance risk is rising quickly. Strategies signal funding and policy direction; binding statutes attach deadlines, executive accountability and turnover-based fines.
| Instrument category | Global volume | Business and operational impact |
|---|---|---|
| Binding acts, regulations and decrees | 416 | Immediate statutory duties, mandatory risk assessments, transparency disclosures; fines of up to 7% of global turnover |
| Pipeline bills and draft proposals | 170 bills; 391 instruments in the pipeline | Upcoming mandates requiring architecture review and pre-market alignment before deadlines apply |
| Policies and national strategies | 375 | State compute funding, public procurement standards, research infrastructure and grant opportunities |
| Guidelines and soft frameworks | 187 | Voluntary testing and benchmarking (e.g. Singapore's AI Verify) and baseline governance guidance |
Key risk metrics
4,500+ Defined legal terms, many with competing definitions across laws | 296 Documented AI enforcement actions and court decisions | 581 Research papers on AI law and governance |
Fragmented definitions across jurisdictions sharply increase multi-region audit and engineering overhead. The same idea travels under different names: “high-risk AI system” in the EU, “high-impact AI” in South Korea and, since Colorado’s May 2026 rewrite, “automated decision-making technology” in Colorado. Each divergence means a separate classification decision, a separate documentation set and, often, a separate product configuration.
2. Navigating the Three Core Regulatory Grammars
Three regulatory models, or "grammars", run through the global corpus. Most national approaches are variants of one of them. Knowing which grammar applies tells a compliance team what kind of obligation to expect.
| Grammar | Jurisdictions | How it works | Strength | Business challenge |
|---|---|---|---|---|
| Horizontal, risk-tiered | EU, South Korea, Vietnam, Kazakhstan (Brazil pending) | One statute covers all sectors and sorts systems into prohibited, high-risk, transparency and general-purpose tiers | Legal predictability | Broad definitions can capture legacy software; enterprise-wide compliance overhead |
| Distributed, sector-led | UK, US federal, Switzerland, Australia | No central AI statute; existing regulators apply cross-sector principles (in the UK: safety, transparency, fairness, accountability, contestability) | Requirements tailored to each sector | Overlapping regulators; inconsistent cross-sector obligations |
| Targeted application | China, US states | Separate measures for specific uses: recommendation algorithms, deep synthesis, generative AI, content labelling, hiring tools, companion chatbots | Fast response to new capabilities | Constant patchwork updates; continuous monitoring required |
Regional variants and hybrid models
- Promotion law (Japan, Taiwan). Binding statutes that organise national strategy and industrial policy without monetary penalties. Japan's AI Promotion Act (in force 4 June 2025) relies on administrative guidance.
- Voluntary assurance (Singapore). The Infocomm Media Development Authority (IMDA) publishes Model AI Governance Frameworks for generative and agentic AI, backed by the open-source AI Verify testing toolkit.
- Strategy-first governance (most of Africa, the Gulf and much of Central Asia) . National strategies drive public investment, while data protection and cybersecurity laws carry the binding obligations.
China's targeted stack in detail. The Cyberspace Administration of China (CAC) has issued rules on algorithmic recommendation (2022), deep synthesis (2023), generative AI services (in force 15 August 2023) and labelling of AI-generated content (2025). These sit on top of the Cybersecurity Law, the Data Security Law and the Personal Information Protection Law (PIPL). China has also listed a draft comprehensive AI law in its State Council legislative work plans.
Convergence at the edges. The EU is adding sector guidance, the UK is debating statutory duties for frontier developers, and many US states are adopting targeted rules. For enterprises, this means controls designed for the strictest regime will increasingly satisfy the others.
3. Jurisdictional Overview
The EU, South Korea, Vietnam and, in lighter form, Kazakhstan hold the world’s binding horizontal AI statutes. The United States produces the most AI law by count but still has no binding federal AI statute.
| Jurisdiction | Flagship instrument | Model | Status (4 Nov 2026) |
|---|---|---|---|
| European Union | EU AI Act, Reg. (EU) 2024/1689, amended by Reg. (EU) 2026/1744 | Horizontal, risk-tiered | In force in stages; high-risk duties 2 Dec 2027 (Annex III) and 2 Aug 2028 (Annex I) |
| United Kingdom | AI White Paper principles and regulator guidance | Sector-led | No AI statute |
| United States | Executive orders (incl. 11 Dec 2025 AI Litigation Task Force); 109 state AI laws enacted in 2026 to 1 July | Executive and targeted state laws | 29 states enacted AI laws in the first half of 2026 |
| China | Generative AI Interim Measures; AI Content Labelling Measures | Targeted measures | In force since Aug 2023 and 2025 |
| South Korea | AI Basic Act | Horizontal (high-impact and generative tiers) | In force 22 Jan 2026 |
| Japan | AI Promotion Act | Promotion law | In force 4 Jun 2025 |
| Vietnam | Law on Artificial Intelligence No. 134/2025/QH15 | Horizontal, three risk tiers | In force 1 Mar 2026 |
| Brazil | PL 2338/2023 | Horizontal bill | Senate-approved Dec 2024; awaiting Chamber of Deputies |
| India | India AI Governance Guidelines (MeitY, Nov 2025) | Principles plus existing law | Guidance; binding duties via IT Act and DPDP Act; AI-content labelling rules in force since 20 Feb 2026 |
European Union: a phased horizontal regime
The EU AI Act entered into force on 1 August 2024. Prohibited practices applied from 2 February 2025 and general-purpose AI obligations from 2 August 2025. The Digital Omnibus, Regulation (EU) 2026/1744 (in force 27 July 2026), moved high-risk obligations to 2 December 2027 for stand-alone Annex III systems and 2 August 2028 for systems embedded in regulated products. Under Article 2(1)(c), the Act applies to any provider worldwide whose AI system output is used in the Union.
United States: state-led regulation
With no binding federal AI statute, state legislatures lead. According to the NYU Center on Technology Policy, states enacted 109 AI laws in the first half of 2026 alone, across 29 states (159 in all of 2025), despite a December 2025 executive order directing the Department of Justice to challenge state laws. Triggers differ by state: compute thresholds in California (SB 53) and New York (RAISE Act), consequential decisions in Colorado (enforcement from 1 January 2027), intent-based bans in Texas (TRAIGA, in force 1 January 2026) and disclosure duties in Utah. Federal oversight relies on executive orders and sector enforcement by the Federal Trade Commission (FTC), the Securities and Exchange Commission (SEC) and the Consumer Financial Protection Bureau (CFPB).
Asia-Pacific: a first generation of statutes in under a year
Japan enacted its penalty-free AI Promotion Act (June 2025). South Korea's AI Basic Act (January 2026) established a presidential AI committee and set duties for high-impact and generative systems. Vietnam's risk-tiered Law on AI (March 2026) gives systems already in operation 12 months to comply, or 18 months in healthcare, education and finance. China continues its application-specific approach, and Singapore leads voluntary assurance through IMDA's frameworks and AI Verify.
Latin America, the Gulf and Africa
Brazil's PL 2338/2023 is the regional reference text for horizontal risk regulation, but it remains a bill awaiting the Chamber of Deputies. Argentina ranks among the five most active jurisdictions by count (28 instruments), largely bills and resolutions. Across Africa and the Gulf Cooperation Council (GCC), governance is led by national strategies, such as the African Union Continental AI Strategy (2024), backed by data protection and cybersecurity statutes.
4. Compliance Risk Matrix: Penalties and Enforcement Timelines
Maximum penalties differ by a factor of more than a thousand between South Korea’s ceiling and the EU’s . South Korea is sequencing deliberately (build institutions, educate the market, then enforce); the EU set a high ceiling first and extended deadlines later.
| Jurisdiction | Maximum penalty | Enforcement body | Key enforcement dates |
|---|---|---|---|
| European Union | €35m or 7% of global turnover (prohibited practices); lower tiers for other breaches | European AI Office and national market-surveillance authorities | 2 Feb 2025 prohibitions · 2 Aug 2025 GPAI · 2 Dec 2027 Annex III · 2 Aug 2028 Annex I |
| United Kingdom | UK GDPR: £17.5m or 4% of turnover | Information Commissioner's Office (ICO), Financial Conduct Authority (FCA), Medicines and Healthcare products Regulatory Agency (MHRA), Ofcom | No AI-specific dates; existing regimes apply now |
| United States | State statutory damages and Attorney General (AG) enforcement; federal sector fines | State AGs; FTC, SEC, CFPB | Texas 1 Jan 2026 · California SB 53 in effect · Colorado 1 Jan 2027 |
| China | Service suspension, licence revocation; PIPL fines up to RMB 50m or 5% of prior-year turnover | Cyberspace Administration of China (CAC) | Generative AI rules since 15 Aug 2023 · labelling rules 2025 |
| South Korea | Up to KRW 30m (fines paused until at least January 2027) | Ministry of Science and ICT (MSIT) | In force 22 Jan 2026 |
| Vietnam | Administrative penalties; criminal liability in serious cases | Ministry of Science and Technology | In force 1 Mar 2026; existing systems within 12 months (18 in healthcare, education, finance) |
| Japan | None; administrative guidance | AI Strategy Headquarters | In force 4 Jun 2025 |
| Brazil (bill) | Proposed BRL 50m per infraction or 2% of revenue | To be designated | Pending Chamber of Deputies vote |
| Singapore | Personal Data Protection Act (PDPA): SGD 1m or 10% of local turnover | Personal Data Protection Commission (PDPC); IMDA (voluntary AI frameworks) | Data duties apply now |
Liability structures executives must assign
- Provider liability: pre-market conformity assessment, technical documentation and systemic-risk mitigation for foundation-model developers and AI platform providers.
- Deployer liability: human oversight, fundamental rights impact assessments (FRIAs) and continuous monitoring for organisations that use AI systems in their operations.
- Extraterritorial jurisdiction: obligations triggered by where users are or where outputs are used, regardless of where a model is trained or hosted.
Most of the 296 recorded enforcement actions were brought under privacy, consumer, anti-discrimination and copyright law rather than AI statutes. Public procurement is a further enforcement route: government tender requirements often reach vendors before any statute does.
5. Readiness and Responsibility: The Global Divide
Readiness and responsible-governance indices show a structural divide between the Global North and the Global South. For enterprises, this divide predicts where regulation will tighten next and where governance gaps create reputational risk.
| Benchmark index | Coverage | Key findings |
|---|---|---|
| Global Index on Responsible AI (GIRAI) 2026 | 135 countries, 38 indicators | Global average 35/100; Europe 54, Global South 27. Top: Norway 74.2 , Italy 72.7, Ireland 71.4. 58% of countries have transparency frameworks but only 18% require disclosure of government AI systems. |
| IMF AI Preparedness Index (AIPI) | 174 economies | Scores track national income: Singapore 0.80, Denmark 0.78, United States 0.77 lead; China 0.63 (31st), India 0.49 (72nd). |
| Stanford HAI AI Index 2026 | Global investment, incidents and public opinion | US AI investment about $285.9bn in 2025, against about $20.9bn in Europe and $12.4bn in China. Record 362 documented AI incidents. Trust in government AI regulation: Singapore 81%, United States 31%. |
6. International Coordination
- Council of Europe Framework Convention on AI (CETS No. 225): the first legally binding international AI treaty, covering human rights, democracy and the rule of law. 21 signatories, including every G7 member ; the EU ratified on 15 May 2026.
- G7 Hiroshima AI Process: international guiding principles and a voluntary code of conduct for developers of advanced AI systems.
- AI summit series: Bletchley (Nov 2023), Seoul (May 2024), Paris (Feb 2025) and the India AI Impact Summit (Feb 2026), the first hosted in the Global South.
- Standards: ISO/IEC 42001:2023, the first certifiable AI management-system standard, maps onto the EU AI Act, the US NIST AI Risk Management Framework and Singapore's frameworks, giving enterprises a common control language.
7. Executive Action Plan: Four Steps to Risk Mitigation
- Map exposure beyond statutes. Audit data protection, consumer law and sector guidance, not only AI-specific acts.
- Prepare for extraterritorial reach. Ensure models whose outputs are used in the EU, or that meet US state thresholds, comply regardless of where they are deployed from.
- Unify enterprise definitions. Establish internal governance terminology that reconciles conflicting global terms such as the EU’s “high-risk AI system” and South Korea’s “high-impact AI”
- Use live regulatory tracking. Monitor pipeline legislation continuously so engineering teams are ready before enforcement dates apply.
Executive Action Checklist and Next Steps
A seven-point governance roadmap aligned with ISO/IEC 42001 (AI Management System):
- Inventory: maintain a register of all AI systems, models and data pipelines by jurisdiction of operation and deployment.
- Classify: align each system with the strictest applicable regional tier (for example, EU high-risk obligations).
- Assign accountability: name an executive owner (Chief AI Officer or risk committee) for model monitoring and compliance audits.
- Control data and bias: apply training-data hygiene, algorithmic audit logs and fairness evaluations.
- Label outputs: embed content labelling and provenance metadata for generative AI; labelling duties now exist in the EU, China, South Korea, India and Vietnam.
- Certify: adopt ISO/IEC 42001 controls as the integrated framework for continuous AI risk management.
- Monitor: track the 391 pipeline instruments, including the EU's December 2027 high-risk date and Colorado's January 2027 enforcement date.
| Next step: Run your markets and use cases through the exposure checker in the interactive Atlas to see which instruments apply to your AI systems today and which are coming. |
8. Explore the Interactive Atlas
The AI Global Regulations Atlas turns this white paper into a working tool for compliance, legal, product and investment teams:
- World map of 109 jurisdictions by regulatory model, maturity score and status, with a profile for each.
- Exposure checker listing the instruments that apply to an AI system by market and use case, with dates.
- Timeline of milestones and deadlines from 2019 to 2028.
- Penalty comparison and side-by-side readiness and responsible-AI rankings.
- Sortable directory of all 109 jurisdictions, each with a source-confidence rating.
Why Businessabc publishes the Atlas
Businessabc.net and the Ztudium group built the Atlas as an open-access intelligence resource for compliance leaders, investors and policymakers. It consolidates independent trackers, legislative records and economic readiness indices into one view, so that organisations can deploy AI across borders with fewer surprises.
Appendix: Methodology
The dataset combines four input types, verified through a hybrid human and AI workflow across 109 jurisdictions:
- Regulatory trackers: regulations.ai and CASRAI, capturing instruments by type, year, status and jurisdiction.
- Readiness and governance indices: GIRAI 2026, the IMF AIPI and the Stanford HAI AI Index 2026.
- Primary legislative records: the EU Official Journal, the US Federal Register and state legislative portals, CAC announcements and national gazettes in Asia, Latin America, Africa and the Middle East.
- Legal and policy analysis: law-firm and policy-institute briefings, used to confirm dates and penalty ceilings.
Regulatory model, maturity score (1 to 5) and confidence ratings are editorial classifications as of 4 November 2026. Instrument totals vary slightly between trackers and change daily. This paper is not legal advice; always check the official text of an instrument before relying on it.
Sources and References
- Global Index on Responsible AI, 2026 edition
- IMF AI Preparedness Index (World Bank Data360)
- Stanford HAI, AI Index Report 2026
- EUR-Lex, Regulation (EU) 2024/1689 (AI Act)
- Cooley, Digital AI Omnibus delays key deadlines, introduces new rules
- Mondaq / K&L Gates, EU Digital Omnibus on AI enters into force
- Council of Europe, EU ratifies the Framework Convention on AI
- Tech Policy Press (NYU Center on Technology Policy), Where state AI legislation stands half way into 2026
- Cloud Security Alliance, State AI laws take hold as federal preemption stalls
- PPC Land, Asia's AI laws are finally here
- CASRAI, AI regulations around the world: a jurisdiction map
- CASRAI, Brazil's PL 2338/2023: approved by the Senate, stalled in the Chamber
- Mondaq / LexCounsel, India's AI Governance Guidelines
- ComplyJet, AI regulations by country: the global compliance map for 2026
- Comparitech, AI legislation: 178 countries ranked
- regulations.ai, global AI regulation tracker
- Citiesabc, Why AI literacy is no longer optional: the business impact of the EU AI Act
- Stanford HAI, AI Index Report 2026: Public Opinion (Singapore 81%, US 31%)
- Rest of World, Asia’s AI optimism (Singapore 81%, global average 54%)
- CASRAI, Kazakhstan’s AI Law No. 230-VIII: What It Actually Requires
- CASRAI, Vietnam’s Law on Artificial Intelligence No. 134/2025/QH15
- Viet An Law, Vietnam’s first AI Law 2025 (No. 134/2025) (12- and 18-month transition periods)
- CASRAI, Taiwan’s AI Basic Act explained
- CASRAI, The Colorado AI Act: What It Requires (SB 26-189)
- Osborne Clarke, Digital Omnibus package (AI-literacy change, new prohibitions)
- Council of Europe, Albania signs the Framework Convention on Artificial Intelligence (21st signatory, 15 June 2026)
- Hogan Lovells, India introduces mandatory labelling for AI and 3-hour takedown for illegal content
- DLA Piper, GDPR Fines and Data Breach Survey: January 2026
- regulations.ai, Japan AI Promotion Act (AI Strategic Headquarters)
- regulations.ai, Vietnam Law on Artificial Intelligence (Ministry of Science and Technology as regulator)
Share
Dinis Guarda
Dinis Guarda is an author, entrepreneur, founder CEO of ztudium, Businessabc, citiesabc.com and Wisdomia.ai. Dinis is an AI leader, researcher and creator who has been building proprietary solutions based on technologies like digital twins, 3D, spatial computing, AR/VR/MR. Dinis is also an author of multiple books, including "4IR AI Blockchain Fintech IoT Reinventing a Nation" and others. Dinis has been collaborating with the likes of UN / UNITAR, UNESCO, European Space Agency, IBM, Siemens, Mastercard, and governments like USAID, and Malaysia Government to mention a few. He has been a guest lecturer at business schools such as Copenhagen Business School. Dinis is ranked as one of the most influential people and thought leaders in Thinkers360 / Rise Global’s The Artificial Intelligence Power 100, Top 10 Thought leaders in AI, smart cities, metaverse, blockchain, fintech.
