AI Regulation At A Glance: Binding Laws Versus Voluntary Frameworks By Region

AI rules are moving faster than cryptography rules, and they differ more between regions. Some jurisdictions have passed horizontal AI laws that apply across sectors. Others rely on voluntary frameworks, sector supervisors or targeted rules on issues such as labelling synthetic content.

This page is a short map, as of October 2026. It gives each region’s main instrument, its legal force and the next date to watch. For how the EU AI Act works, risk tiers, general-purpose AI models and frameworks such as the NIST AI RMF and ISO/IEC 42001, see AI Governance And Regulation. This is general information, not legal advice.

The Comparison Table

How To Read The Labels For AI

The word “law” covers very different things in AI. A horizontal law, such as the EU AI Act or South Korea’s AI Framework Act, applies across sectors and sets duties that regulators can enforce. A promotion law sets out national goals, plans and the role of government, and asks businesses to cooperate, but it may carry no penalties. Targeted rules deal with one issue, such as labelling content made by AI, and can be strictly binding within that narrow field.

Supervisory guidelines sit in between. A financial regulator’s AI guidelines do not create offences, but supervised firms are expected to follow them and to explain any gap. Voluntary frameworks and charters, such as a national AI governance framework or ethics principles, describe good practice and carry no direct sanction.

That is why the same kind of date means different things. A date under a horizontal law is when duties become enforceable. A date in a promotion law is when the state’s own plans start. A date in supervisory guidelines is when a regulator expects to see the practice in place, and a date in a voluntary framework is simply when it was published. The table labels each instrument so the dates can be read in that light.

What The Table Shows

Binding, cross-sector AI laws are in force in the EU and South Korea.¹² Japan’s AI Act has applied in full since 1 September 2025, but it is a promotion law, and its text contains no penalty provisions.³ The EU’s high-risk duties moved later under the Digital Omnibus on AI, which was adopted on 8 July 2026. Annex III uses such as hiring and credit scoring now apply from 2 December 2027.¹

The United States has no comprehensive federal AI statute. Executive Order 14365 tells the Justice Department to set up a task force to challenge state AI laws, but it does not override them.⁴ States have moved on their own: Texas’s AI governance act took effect on 1 January 2026,⁵ California’s frontier AI transparency law was signed in September 2025,⁶ Colorado replaced its 2024 AI law with SB 26-189, whose main duties start on 1 January 2027,⁷ and New York’s RAISE Act, rewritten by a chapter amendment, takes effect on the same day, with an oversight office inside the Department of Financial Services.⁸

Two other Asian jurisdictions regulate a narrow AI issue with binding rules. China’s labelling measures for AI-generated content have applied since 1 September 2025,⁹ and India’s amended intermediary rules have, since 20 February 2026, required intermediaries whose services create or share synthetically generated information to label it. The rules define that as realistic audio, visual or audiovisual content made or altered by computer, and they exclude routine editing and ordinary document preparation.¹⁰ India’s Ministry of Electronics and Information Technology also published AI governance guidelines in November 2025, which are guidance rather than law.¹¹ Singapore relies on supervisors and frameworks: MAS issued its AI risk management guidelines for financial institutions on 7 October 2026,¹² and the Infocomm Media Development Authority launched a model governance framework for agentic AI in January 2026.¹³

In the Gulf, the UAE has a non-binding AI Charter from 2024, and no federal AI statute was found as of October 2026.¹⁴ Saudi Arabia’s main instrument is the SDAIA AI Ethics Principles, which are guidance; AI rules in the UAE and Saudi Arabia explains both countries in detail. No binding AI law was found in Qatar, Bahrain, Oman or Kuwait as of October 2026. Qatar’s central bank has applied an AI guideline to its licensed firms since 4 September 2024,¹⁵ alongside a national AI strategy adopted in 2019.¹⁶ Bahrain’s government entities have had to follow a national AI policy since 20 May 2025,¹⁷ and Oman’s April 2025 AI policy requires compliance from government units and regulated private institutions.¹⁸ UNESCO’s November 2025 readiness assessment of Bahrain describes a standalone AI law still under parliamentary review, and no enacted AI law was found as of October 2026.¹⁹ Qatar, Bahrain, Oman And Kuwait gives the detail.

The UK, Switzerland And Canada

The UK still takes a principles-based approach, leaving AI to existing sector regulators, and the government has not introduced an AI bill. On 4 June 2026 a Lords Grand Committee debate, led by Lord Holmes of Richmond, considered the case for a cross-sector AI bill.²⁰ A debate of this kind does not change the law.

Switzerland has chosen to work sector by sector and to ratify the Council of Europe AI Convention. The Federal Office of Justice is preparing a consultation draft due by the end of 2026, which had not been published as of October 2026.²¹

Canada has no federal AI statute. Bill C-36, a federal privacy bill introduced on 15 June 2026, is a Draft.²² Ontario’s Bill 194, which received Royal Assent on 25 November 2024, gives the province binding powers over cyber security and AI use in its own public sector, much of it exercised through regulations.²³

Dates To Watch

For the security side of AI, including prompt injection and the OWASP lists, see AI Security. For cryptography rules in each region, start from the overview.