AI laws worldwide — global coverage beyond the United States
The EU AI Act, UK, Canada, China, Japan, South Korea, Australia, Singapore, and Brazil — penalties, deadlines, and compliance notes for multi-jurisdictional teams.
The United States is only one piece of the AI-regulation map, and for most enterprises it is not even the strictest piece. The European Union now operates under the world's first comprehensive AI statute. The United Kingdom is rolling out a pro-innovation, sector-by-sector framework anchored by its AI Security Institute. South Korea's AI Basic Act took effect in January 2026, and Japan passed its AI Promotion Act in 2025. China already enforces a stack of generative-AI and content-labeling rules. Canada's federal AIDA bill lapsed in early 2025, while Australia, Singapore, and Brazil each sit at a different point between voluntary frameworks and pending legislation. Any business serving customers across borders eventually has to track three or four jurisdictions in parallel, not just one.
This page covers the major non-US jurisdictions — the EU AI Act, the UK, Canada, China, Japan, South Korea, Australia, Singapore, and Brazil — with deep links into each region. All 27 EU member states are listed individually, with a national AI-specific instrument tracked for 21 of them; each non-EU country with a published profile has its own national page.
By AI Law Tracker Editorial Team · Last verified
Global AI law news
Updated September 29, 2026Recent coverage of international AI governance — the UN, OECD, G7, and cross-border regulation. Aggregated automatically; follow each link for the full story.
Coverage from Anadolu Ajansı on AI legislation and regulation relevant to jurisdictions worldwide.
Coverage from Global Times on AI legislation and regulation relevant to jurisdictions worldwide.
Coverage from Yeni Şafak English on AI legislation and regulation relevant to jurisdictions worldwide.
Coverage from GZERO Media on AI legislation and regulation relevant to jurisdictions worldwide.
Coverage from Digital Watch Observatory on AI legislation and regulation relevant to jurisdictions worldwide.
European Union — the EU AI Act
The EU AI Act is the first horizontal AI statute anywhere in the world. It came into force in August 2024 with phased deadlines: prohibitions on unacceptable-risk AI took effect February 2025, general-purpose-AI obligations kicked in August 2025, and the headline high-risk regime activates August 2, 2026. Penalties climb to €35 million or 7% of global annual turnover — whichever is higher. Any provider, deployer, importer, or distributor putting an AI system on the EU market is in scope, regardless of where the company is headquartered. National regulators in each member state coordinate enforcement: BfDI in Germany, CNIL in France, AESIA in Spain, DPC in Ireland, and so on. We list all 27 member states, and publish country-specific enforcement notes, sector overlays and intent pages for the 27 with a national profile.
Per-country pages cover the national supervisory authority, AI Act sandboxing programmes, and the GDPR overlay each member state applies. Plus checklist, fines, requirements, and deadline intent pages for every country.
United Kingdom — pro-innovation, sector-by-sector
Post-Brexit, the UK deliberately rejected a single AI Act in favour of a context-specific approach: existing regulators (the ICO for data protection, the FCA for financial services, the MHRA for medical devices, Ofcom for online safety) apply AI principles within their own remit. The AI Safety Institute, established in 2023, oversees frontier-model risk — the UK's de-facto equivalent of the EU's general-purpose-AI tier. The Data Protection and Digital Information Bill extends accountability requirements around automated decision-making. ICO fines for AI-related GDPR breaches reach £17.5 million or 4% of global turnover. There is no single deadline calendar; obligations roll in as sector regulators publish guidance.
Pro-innovation AI regulation framework (2023 White Paper), Data (Use and Access) Act 2025, UK GDPR & Data Protection Act 2018, Online Safety Act 2023. Penalty exposure: Up to GBP £17.5M or 4% of global turnover (ICO, under UK GDPR/DPA 2018).
Canada — no federal AI Act (AIDA lapsed)
Contrary to common reporting, Canada has no enacted federal AI statute. The Artificial Intelligence and Data Act (AIDA), part of Bill C-27, died when Parliament was prorogued in January 2025 and has no successor as of 2026. AI is instead governed indirectly: PIPEDA (the federal private-sector privacy law) covers personal data used in AI; the Treasury Board Directive on Automated Decision-Making requires federal agencies to run algorithmic impact assessments; and provincial laws — most notably Quebec's Law 25 — require businesses to disclose automated decisions, explain the logic, and offer a right to human review. The strongest enforceable penalty today is Quebec's: up to C$25 million or 4% of global turnover.
PIPEDA — Personal Information Protection and Electronic Documents Act, Treasury Board Directive on Automated Decision-Making, Quebec Law 25 (Loi 25), Bill C-27 / AIDA — lapsed at prorogation, Jan 2025. Penalty exposure: No federal AI-specific penalty; Quebec Law 25 up to CAD $25M or 4% of global turnover.
Asia-Pacific & Latin America
Beyond Europe and North America, the regulatory picture varies sharply. China already enforces binding generative-AI and content-labeling rules. South Korea's AI Basic Act took effect in January 2026, and Japan's AI Promotion Act became law in 2025. Australia and Singapore rely on voluntary frameworks for now, while Brazil's risk-based AI bill is pending in its Chamber of Deputies. Each has its own dedicated page with the applicable laws, penalties, and official sources.
قانون رقم (30) لسنة 2018 بإصدار قانون حماية البيانات الشخصية — Personal Data Protection Law No. 30 of 2018. Penalty: No AI-specific penalty exists in Bahraini law. Penalty amounts under Law 30/2018 are deliberately NOT quoted here: the operative penal articles were not read at source in this pass, and an unsourced fine figure is not something this product publishes..
Федеральный закон от 26.07.2026 № 243-ФЗ «О поддержке развития технологий искусственного интеллекта в Российской Федерации» — in force from 1 September 2026. Penalty: Penalty provisions are deliberately NOT quoted. 243-ФЗ is framed as a support-and-development statute rather than a sanctioning one, and the operative penalty articles of the Кодекс об административных правонарушениях that a Russian AI matter would actually be decided under were not read at source in this pass. An unsourced fine figure is not something this product publishes..
(ร่าง) พระราชบัญญัติว่าด้วยปัญญาประดิษฐ์ พ.ศ. .... — draft Artificial Intelligence Act (public consultation closed 14 August 2026). Penalty: No AI-specific penalty exists in Thai law, because no AI statute has been enacted. Penalty provisions of the draft bill are deliberately NOT quoted: a bill that has only completed consultation can change in committee, and quoting its fines as though they were law would be the most misleading thing this page could do..
Australia's AI Ethics Principles (2019, voluntary). Penalty: No AI-specific penalty; Privacy Act 1988 up to A$50M, 3× benefit, or 30% of adjusted turnover for serious breaches.
AI Promotion Act — Act on the Promotion of R&D and Utilization of AI-Related Technologies (2025). Penalty: No AI-specific penalty (promotion statute); APPI up to ¥100M for corporations on a PPC-order breach.
Interim Measures for the Management of Generative AI Services (effective Aug 15, 2023). Penalty: No fixed fine in the Generative AI Measures; violations enforced via Cybersecurity Law, Data Security Law and PIPL (warnings, rectification, service suspension).
Basic Act on the Development of AI and Establishment of Trust (AI Basic Act, effective Jan 22, 2026). Penalty: Administrative fines up to KRW 30 million.
Model AI Governance Framework, 2nd ed. (IMDA/PDPC, 2020). Penalty: Frameworks voluntary; PDPA up to S$1M or 10% of Singapore annual turnover (whichever is higher).
PL 2338/2023 — Marco Legal da IA (Senate-approved Dec 2024, pending in the Chamber of Deputies). Penalty: PL 2338 (if enacted) up to 2% of Brazilian revenue, capped at BRL 50M per infraction; the LGPD already applies the same cap.
Digital Personal Data Protection Act, 2023 (DPDP Act) — enacted; rules pending. Penalty: DPDP Act: data-protection penalties up to ₹250 crore (~US$30M) per instance.
UAE National Strategy for Artificial Intelligence 2031. Penalty: PDPL administrative fines set by Cabinet decision; DIFC fines up to US$100,000+ per contravention.
Personal Data Protection Law (PDPL) — Royal Decree M/19 of 2021, amended 2023. Penalty: PDPL: fines up to SAR 5M (doubling for repeat offences) and up to 2 years' imprisonment for unlawful sensitive-data disclosure.
Luật số 134/2025/QH15 — Luật Trí tuệ nhân tạo (Law on Artificial Intelligence). Penalty: The Act sets no fine amount. Article 29 makes violations subject to administrative penalty or criminal liability, with civil compensation for damage, and Article 29(5) delegates the administrative fine schedule to a Government decree that has not yet been issued..
Ley 25.326 — Protección de los Datos Personales (Habeas Data), Boletín Oficial 29517, 2 de noviembre de 2000. Penalty: No AI-specific penalty exists in Argentine federal law. Penalty amounts under Ley 25.326 are deliberately NOT quoted here: the operative articles were not read at source in this pass, and an unsourced fine figure is not something this product publishes..
Decreto de 20 de marzo de 2025 — expide la Ley Federal de Protección de Datos Personales en Posesión de los Particulares, la Ley General de Protección de Datos Personales en Posesión de Sujetos Obligados y la Ley General de Transparencia. Penalty: No AI-specific penalty exists in Mexican federal law. Penalty amounts under the data-protection statutes are deliberately NOT quoted here: the operative articles were not read at source in this pass, and quoting a figure from a pre-2025 source would be doubly wrong, because the statute it belonged to was replaced..
Surat Edaran Menteri Komunikasi dan Informatika Nomor 9 Tahun 2023 — ETIKA - KECERDASAN ARTIFISIAL (AI ethics circular). Penalty: The AI instrument carries no penalty, because it is a circular and not a statute. Penalty provisions under the ITE Law (UU 19/2016 as amended by UU 1/2024) are deliberately NOT quoted here — the operative articles were not read at source in this pass, and an unsourced fine figure is not something this product publishes..
Bundesgesetz vom 25. September 2020 über den Datenschutz (DSG, SR 235.1). Penalty: No AI-specific penalty exists in Swiss federal law. Penalty amounts under the DSG and the Kartellgesetz are deliberately NOT quoted here: the operative penal articles were not read at source in this pass, and a fine figure taken from a secondary source is not something this product publishes..
Kişisel Verilerin Korunması Kanunu No. 6698 (Personal Data Protection Law). Penalty: No AI-specific penalty exists in Turkish law. Penalty amounts under Laws 6698, 4054 and 6502 are deliberately NOT quoted here: the operative penalty articles were not read at source in this pass, and Turkish administrative fines are revalued annually, so a figure carried from a secondary source would be both unsourced and out of date. The enforcement corpus holds 8 Turkish matters decided under these statutes..
Protection of Privacy Law, 5741-1981 (חוק הגנת הפרטיות). Penalty: No AI-specific penalty. Searched 2026-09-02 against the Knesset's own national legislation register: no primary statute in force carries בינה מלאכותית (artificial intelligence) in its title, so there is no Israeli AI offence to state. Amounts under the Protection of Privacy Law are deliberately NOT quoted here: the operative sections were not read at source in this pass, and a fine figure taken from anywhere but the statute is exactly the kind of number this product does not publish..
Artificial Intelligence Basic Act (人工智慧基本法) — promulgated 14 January 2026. Penalty: None. The Basic Act creates no offence and imposes no fine — verified against all 20 articles, which contain no penalty, sanction or criminal provision. Exposure runs through the Personal Data Protection Act and sector rules instead..
قانون رقم (13) لسنة 2016 بشأن حماية خصوصية البيانات الشخصية — Law No. 13 of 2016 on the Protection of Personal Data Privacy. Penalty: No AI-specific penalty exists. The binding exposure is the PDPPL's Chapter Seven, read from the register's own text of the Act: Article 23 sets a fine of up to QAR 1,000,000 for breaching Articles 4, 8–12, 14, 15 or 22; Article 24 up to QAR 5,000,000 for Articles 13, 16 (third paragraph) or 17; Article 25 fines a legal person up to QAR 1,000,000 where an offence is committed in its name and for its account, without prejudice to the criminal liability of the natural person responsible..
Republic Act No. 10173 — Data Privacy Act of 2012. Penalty: No AI-specific penalty exists. The binding exposure is the Data Privacy Act's Chapter VIII, read from the Act's own text: unauthorised processing of personal information carries one to three years’ imprisonment and a fine of PHP 500,000 to PHP 2,000,000, and of SENSITIVE personal information three to six years and PHP 500,000 to PHP 4,000,000 (s.25). Section 35 imposes the maximum of the applicable scale whenever the personal information of at least 100 people is harmed, affected or involved..
Proposed Artificial Intelligence (AI) Governance Bill (pre-drafting consultation closed 1 August 2026 - not tabled). Penalty: No AI-specific penalty exists. NO SINGLE CURRENT PDPA FIGURE IS PRINTED HERE, AND THAT IS DELIBERATE: both official consolidations this project can read are pre-amendment. The Attorney General's Chambers' own updated reprint of Act 709 is stated 'As At 01-07-2023', and the Personal Data Protection Department's consolidated PDF is the 2022 version - in which section 5(2) makes contravention of the seven Personal Data Protection Principles an offence carrying a fine not exceeding RM 300,000 or imprisonment not exceeding two years, or both. The Personal Data Protection (Amendment) Act 2024 (Act A1727) is recorded in the register's own Amendment series and revised those penalties; no consolidated official text reflecting it is machine-readable from either portal today, so the amended figure is not asserted here. Check the gazetted amendment directly before relying on an amount..
Privacy Act 2020 (2020 No 31), as amended by the Privacy Amendment Act 2025. Penalty: No AI-specific penalty exists. Enforcement runs through the Privacy Commissioner, who may issue compliance notices, and through the Human Rights Review Tribunal, which awards damages for an interference with privacy. ⚠️ NO FINE AMOUNT IS PRINTED HERE. legislation.govt.nz answers every request from this project’s egress with an AWS WAF JS-challenge (HTTP 202, empty body), so the Act’s own offence provisions cannot be read directly by this pipeline, and a YMYL figure is not taken from a secondary source. Read the Act at the source link for the current amounts..
Artificial Intelligence Framework for the Banking and Financial Sectors in Jordan (Central Bank of Jordan, v1.0, July 2025). Penalty: No standalone AI-specific fine is stated by the framework. Supervisory consequences arise through the Central Bank's existing powers, while personal-data violations are handled under the Personal Data Protection Law..
Personal Data Act (personopplysningsloven) and the GDPR. Penalty: No AI-specific Norwegian penalty applies until the implementing act is enacted. Existing data-protection, criminal and copyright rules remain enforceable when AI is used..
Protection of Personal Information Act 4 of 2013 (POPIA). Penalty: No AI-specific penalty exists. Regulatory exposure comes through POPIA, consumer, competition and electronic-transactions law rather than a standalone AI offence..
If a jurisdiction critical to your operations isn't yet covered, our feedback page is the fastest way to flag a request.
How we track non-US AI law
Each non-US entry links back to the relevant statute or official guidance — EUR-Lex for EU AI Act articles, the European Commission's digital strategy portal for delegated acts, national data protection authority sites for enforcement, the ICO and AI Security Institute for the UK, the CAC for China, METI for Japan, and the originating parliament or regulator for each other jurisdiction. We re-verify country pages whenever an authority issues new guidance or a legislature passes implementation legislation. This page is not legal advice; it is a navigational reference for multi-jurisdictional compliance teams.
US-based?
Most US businesses still need to track state-by-state AI rules first. EU coverage is mainly for companies with European customers or operations; UK and Canada matter if you serve those markets or run distributed teams.