Frameworks
AI governance frameworks, by jurisdiction.
Laws, regulator guidance, standards and voluntary frameworks that shape how organisations govern AI. Each page explains what the framework asks for, who it applies to and when.
International
All International frameworksStandards and frameworks that apply across borders. Most organisations use one of these as the backbone of their AI governance, whatever their jurisdiction.
StandardISO/IEC 42001ISO/IEC 42001:2023 AI management systemsISO/IEC 42001 is the certifiable international standard for an AI management system. What it requires, how Annex A works and how to get ready to certify.StandardISO/IEC 42005ISO/IEC 42005:2025 AI system impact assessmentISO/IEC 42005 is international guidance on assessing how an AI system affects people and society, when to assess, what to record and how it links to 42001.Voluntary frameworkNIST AI RMFNIST AI Risk Management Framework (AI RMF 1.0)The NIST AI RMF is a voluntary framework for managing AI risk through four functions, Govern, Map, Measure and Manage. What it asks and who uses it worldwide.Voluntary frameworkNIST Generative AI ProfileNIST AI RMF Generative AI Profile (NIST AI 600-1)NIST AI 600-1 applies the AI Risk Management Framework to generative AI. Its 12 risks, the suggested actions behind them and who uses the profile and why.StandardISO/IEC 23894ISO/IEC 23894:2023 Guidance on AI risk managementISO/IEC 23894 adapts the ISO 31000 risk process to AI. What the guidance covers, its AI risk sources and lifecycle mapping, and how it fits with ISO 42001.StandardISO/IEC 38507ISO/IEC 38507:2022 Governance implications of the use of AI by organizationsISO/IEC 38507 is guidance for boards on governing an organisation's use of AI. What it asks of directors, how it links to ISO/IEC 38500 and who uses it.Voluntary frameworkOECD AI PrinciplesOECD Recommendation of the Council on Artificial Intelligence (OECD AI Principles)The OECD AI Principles are the intergovernmental standard for trustworthy AI, adopted 2019 and revised 2024. The five principles and how to apply them.Voluntary frameworkHUDERIAHUDERIA: Risk and impact assessment of AI systems for human rights, democracy and the rule of lawHUDERIA is the Council of Europe's method for assessing AI risks to human rights, democracy and the rule of law. Its four elements, scoring and who uses it.LawCouncil of Europe AI ConventionCouncil of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225)The Council of Europe AI Convention is the first binding international treaty on AI. Who has signed and ratified, what it asks of parties and when it applies.Voluntary frameworkG7 Hiroshima Code of ConductHiroshima Process International Code of Conduct for Organizations Developing Advanced AI SystemsThe G7 Hiroshima Code of Conduct sets 11 voluntary actions for advanced AI developers, with OECD HAIP reporting. What it asks and who reports under HAIP 2.0.Voluntary frameworkUNESCO AI Ethics RecommendationUNESCO Recommendation on the Ethics of Artificial IntelligenceUNESCO's Recommendation on the Ethics of AI is the global standard its member states adopted in 2021. Its values, principles and Ethical Impact Assessment.
European Union
All European Union frameworksThe EU AI Act sets risk-based obligations for AI placed on the EU market or used in the EU, alongside the GDPR's rules on automated decisions.
LawEU AI ActEU AI Act (Regulation (EU) 2024/1689)The EU AI Act sets risk-based rules for AI used in the EU. What it requires of providers and deployers, and the dates as amended by the 2026 Digital Omnibus.LawGDPR Article 22GDPR Article 22 and automated decision-makingGDPR Article 22 limits solely automated decisions with legal or similarly significant effects. Who it applies to, the exceptions, safeguards and AI duties.Voluntary frameworkGPAI Code of PracticeGeneral-Purpose AI Code of PracticeThe EU GPAI Code of Practice is how model providers show they meet AI Act duties on transparency, copyright and systemic risk. What it covers and who signs.Voluntary frameworkTrustworthy AI and ALTAIEthics Guidelines for Trustworthy AI and the Assessment List (ALTAI)The EU's Ethics Guidelines for Trustworthy AI set seven requirements, and ALTAI turns them into a self-assessment checklist. What they cover and who uses it.
United Kingdom
All United Kingdom frameworksThe UK regulates AI through existing regulators applying shared principles, with specific rules for automated decisions under UK data protection law.
Regulator guidanceUK AI regulationUK AI regulation: the pro-innovation approach and its five principlesThe UK regulates AI through five cross-sector principles applied by existing regulators, with no AI Act. What the principles ask and who has to apply them.LawUK GDPR Articles 22A to 22DUK GDPR automated decision-making: Articles 22A to 22DSince 5 February 2026, UK GDPR Articles 22A to 22D allow significant automated decisions about people only with four safeguards. What they require, of whom.Regulator guidanceICO AI guidanceICO guidance on AI and data protectionThe ICO's guidance on AI and data protection and on explaining decisions made with AI shows how UK GDPR applies to AI. Who it is for and what it expects.Public sector policyATRSAlgorithmic Transparency Recording Standard (ATRS)UK central government must publish ATRS records of algorithmic tools that shape decisions or face the public. Who is in scope and what a record holds.Public sector policyUK AI PlaybookAI Playbook for the UK GovernmentThe AI Playbook for the UK Government sets ten principles for using AI safely and responsibly in government. Who it covers and what each principle asks.
Ireland
All Ireland frameworksIreland applies the EU AI Act through its own implementing law and sector regulators, with guidelines for AI use across the public service.
Public sector policyIreland public service AI guidelinesGuidelines for the Responsible Use of AI in the Public Service (Ireland)Ireland's guidelines for the responsible use of AI in the public service set seven principles and planning tools for public bodies. What they ask of a body.LawIreland AI Act 2026Regulation of Artificial Intelligence Act 2026 (Ireland)Ireland's Regulation of Artificial Intelligence Act 2026 sets up the AI Office of Ireland and how the EU AI Act is supervised and enforced. Who regulates what.
Germany
All Germany frameworksGermany applies the EU AI Act through the KI-MIG, with the Bundesnetzagentur as central authority and BaFin for financial firms, and adds national rules on credit and behaviour scoring.
LawKI-MIGKI-MIG, Germany's AI Act implementation lawThe KI-MIG names Germany's EU AI Act authorities, from the Bundesnetzagentur to BaFin, and sets their powers, the AI sandbox and national fines.LawBDSG section 37aBDSG section 37a and scoring in GermanyFrom 20 November 2026, BDSG section 37a governs credit and behaviour scores in Germany. Banned data, explanations and the right to a human decision.Regulator guidanceBaFin AI ICT guidanceBaFin guidance on ICT risks in the use of AI at financial entitiesBaFin's guidance on ICT risks of AI explains how DORA applies to AI at German banks and insurers, from governance and testing to cloud and incidents.
Netherlands
All Netherlands frameworksThe Netherlands is preparing a law naming existing supervisors for the EU AI Act, adds a GDPR rule on automated decisions, and guides public bodies through the Algoritmekader and Algoritmeregister.
LawDutch AI Act implementation billUitvoeringswet AI-verordening, the Dutch AI Act implementation billThe draft Uitvoeringswet AI-verordening names ten Dutch AI Act supervisors, with the AP and RDI coordinating. What it proposes and where it stands.LawUAVG Article 40UAVG Article 40 and automated decisions in the NetherlandsArticle 40 of the Dutch GDPR Implementation Act allows some automated decisions without profiling. When it applies, the safeguards and what it means for AI.Public sector policyAlgoritmekaderAlgoritmekader and Algoritmeregister (Netherlands)The Dutch government's Algoritmekader sets out the rules and tools for responsible public sector algorithms, and the Algoritmeregister publishes them.
Belgium
All Belgium frameworksBelgium applies the EU AI Act and the GDPR directly, with guidance on AI from its Data Protection Authority while the law naming its AI Act supervisors is prepared.
Luxembourg
All Luxembourg frameworksLuxembourg applies the EU AI Act directly, with a bill before Parliament that would make the CNPD the default authority and the CSSF and CAA supervisors for financial firms.
Switzerland
All Switzerland frameworksSwitzerland governs AI through its technology-neutral data protection law and FINMA guidance for financial institutions, with targeted amendments planned to ratify the Council of Europe AI Convention.
LawFADP Article 21Swiss FADP Article 21 and automated individual decisionsArticle 21 of the Swiss Federal Act on Data Protection requires notice, a hearing and human review for automated decisions. What it means for AI.Regulator guidanceFINMA Guidance 08/2024FINMA Guidance 08/2024: governance and risk management when using AIFINMA Guidance 08/2024 sets out what FINMA expects of Swiss banks, insurers and other supervised firms using AI, from an AI inventory to independent review.
Norway
All Norway frameworksNorway applies the GDPR through its Personal Data Act, with the EU AI Act to follow through the EEA Agreement and a national AI Act still before government.
United States
All United States frameworksThe US has no comprehensive federal AI law. Obligations come from federal frameworks and policy, and from a growing set of state and city laws.
LawColorado ADMT law (SB 26-189)Colorado SB 26-189, Automated Decision-Making TechnologyColorado's SB 26-189 replaced the Colorado AI Act before it took effect. What developers and deployers of decision technology must do from 1 January 2027.LawCalifornia CCPA ADMT regulationsCCPA Regulations on Automated Decisionmaking Technology, Risk Assessments and Cybersecurity AuditsCalifornia's CCPA regulations on automated decisionmaking technology and risk assessments. Who they cover, what they require, and the 2027 and 2028 deadlines.LawConnecticut AI in employment (PA 26-15)Connecticut Public Act 26-15, automated employment-related decision technologyConnecticut's Public Act 26-15 sets notice duties for AI used in hiring and other employment decisions from 1 October 2027. Who it covers and what it requires.LawNYC Local Law 144NYC Local Law 144 of 2021, Automated Employment Decision ToolsNYC Local Law 144 requires a yearly independent bias audit and candidate notice before employers use automated employment decision tools. What it requires.Public sector policyExecutive Order 14365Executive Order 14365, Ensuring a National Policy Framework for Artificial IntelligenceExecutive Order 14365 directs US agencies to challenge state AI laws and seek a federal standard. What it does, what it does not do and what it means for you.LawTexas TRAIGATexas Responsible Artificial Intelligence Governance Act (HB 149)The Texas Responsible AI Governance Act has been in force since 1 January 2026. Its prohibited uses, disclosure duties, penalties and the NIST-linked defence.LawIllinois AI in employment lawIllinois Human Rights Act amendments on AI in employment (HB 3773, Public Act 103-0804)Illinois HB 3773 makes discriminatory AI use and missing AI notice civil rights violations for employers. What it requires, who it covers and the rule status.LawCalifornia ADS employment regulationsCalifornia Civil Rights Council Employment Regulations Regarding Automated-Decision SystemsCalifornia's Civil Rights Council regulations apply anti-discrimination law to automated-decision systems at work. Scope, agent liability, records, testing.Public sector policyOMB M-25-21OMB Memorandum M-25-21, Accelerating Federal Use of AI through Innovation, Governance, and Public TrustOMB M-25-21 sets how US federal agencies govern AI, with minimum practices for high-impact AI. What it requires, its deadlines and what it means for vendors.LawUtah AI Policy ActUtah Artificial Intelligence Policy Act and AI consumer protection disclosuresUtah requires disclosure of generative AI in consumer dealings and regulated occupations. What SB 149 and SB 226 require, the penalties and the 2027 repeal.LawCalifornia SB 53Transparency in Frontier Artificial Intelligence Act (California SB 53)California's SB 53 requires frontier AI developers to publish safety frameworks and transparency reports and to report critical safety incidents to Cal OES.LawUS state privacy laws on profilingUS state consumer privacy laws, profiling opt-outs and assessmentsMost US state privacy laws let consumers opt out of profiling for significant decisions and require assessments of risky profiling. How the model works now.Regulator guidanceNAIC AI Model BulletinNAIC Model Bulletin on the Use of Artificial Intelligence Systems by InsurersThe NAIC Model Bulletin sets regulators' expectations for insurers using AI, centred on a written AIS Program. What it asks for and how states adopt it.Regulator guidanceUS bank model risk guidance (SR 26-2)Supervisory Guidance on Model Risk Management (SR 26-2, replacing SR 11-7)SR 26-2 replaced SR 11-7 as US banking agencies' model risk guidance in April 2026. What it expects, who it targets and why generative and agentic AI are out.
Canada
All Canada frameworksCanada governs automated decisions in the federal public sector through a binding directive and impact assessment, with sector regulators setting expectations for industry.
LawPIPEDA and AIPIPEDA and the privacy commissioners' principles for generative AIHow PIPEDA and the privacy commissioners' generative AI principles apply to AI in Canada today, and what Bill C-36 would add for automated decision systems.Public sector policyCanada Directive on Automated Decision-MakingDirective on Automated Decision-Making and the Algorithmic Impact AssessmentCanada's Directive on Automated Decision-Making binds federal institutions using automated decision systems, with a four-level Algorithmic Impact Assessment.Regulator guidanceOSFI Guideline E-23OSFI Guideline E-23, Model Risk Management (2027)OSFI Guideline E-23 sets model risk expectations for Canadian federally regulated financial institutions, including AI and ML models, from 1 May 2027.LawQuebec Law 25 automated decisionsQuebec private sector privacy act, section 12.1 on decisions based exclusively on automated processing (Law 25)Section 12.1 of Quebec's private sector privacy act, added by Law 25, requires notice of fully automated decisions, reasons on request and a chance of review.Voluntary frameworkCanada generative AI code of conductVoluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI SystemsCanada's voluntary code for advanced generative AI sets six principles with measures for developers and managers. What it asks of them and who has signed it.Public sector policyOntario Responsible AI DirectiveOntario Responsible Use of Artificial Intelligence DirectiveOntario's Responsible Use of Artificial Intelligence Directive sets AI risk management, disclosure and reporting rules for ministries and provincial agencies.LawOntario AI disclosure in job postingsOntario Employment Standards Act, AI disclosure in publicly advertised job postingsSince 1 January 2026, Ontario employers with 25 or more employees must state in public job postings when AI is used to screen, assess or select applicants.
Australia
All Australia frameworksAustralia combines Privacy Act obligations on automated decisions with national guidance on AI adoption, government policy and state frameworks.
LawPrivacy Act ADM transparencyPrivacy Act automated decision-making transparency (APP 1.7 to 1.9)From 10 December 2026 your privacy policy must disclose automated decisions that significantly affect people. What APP 1.7 to 1.9 require and who is caught.Voluntary frameworkAI6 Guidance for AI AdoptionGuidance for AI Adoption (AI6)The Guidance for AI Adoption sets six essential practices for governing AI in Australia. It replaced the Voluntary AI Safety Standard in October 2025.Voluntary frameworkAI Ethics PrinciplesAustralia's AI Ethics PrinciplesAustralia's eight voluntary AI Ethics Principles, published in 2019, are the baseline most Australian AI policy builds on. What they say and where they apply.Public sector policyDTA AI policyPolicy for the responsible use of AI in government (v2.0)Version 2.0 of the DTA policy for the responsible use of AI in government took effect on 15 December 2025. What Commonwealth agencies must do and by when.Public sector policyNSW AIAFNSW AI Assessment Framework (AIAF)The NSW AI Assessment Framework is the mandatory AI risk self-assessment for NSW government agencies, run on the AIAF Platform since 30 September 2026.Regulator guidanceAPRA AI expectationsAPRA letter to industry on artificial intelligenceAPRA's April 2026 letter sets minimum expectations for AI governance, security, suppliers and assurance at banks, insurers and super trustees. What it asks.Regulator guidanceOAIC AI guidanceOAIC guidance on privacy and AIThe OAIC's two AI guides explain how the Privacy Act applies to using commercial AI products and to training generative AI models. What they expect of you.Public sector policyNational AI assurance frameworkNational framework for the assurance of artificial intelligence in governmentAgreed by all Australian governments in June 2024, the national framework sets five cornerstones for assuring government AI against the AI Ethics Principles.Public sector policyQueensland AI governance (FAIRA)Queensland AI governance policy and FAIRAQueensland's AI governance policy requires agencies to govern AI with regard to ISO 38507 and assess it with a FAIRA. Version 2.0.0 took effect August 2026.Public sector policyWA AI Assurance FrameworkWA Government AI Policy and AI Assurance FrameworkWA government entities must complete an AI Assurance Framework self-assessment for any AI or automated decision project. How it works and when it is reviewed.Public sector policyVictorian generative AI guidelineVictorian administrative guideline on the safe and responsible use of generative AIVictoria's administrative guideline sets minimum requirements for generative AI use across the Victorian Public Sector. What it asks of agencies and staff.
New Zealand
All New Zealand frameworksNew Zealand relies on the Privacy Act and public sector commitments to govern algorithms and AI.
Public sector policyNZ Public Service AI FrameworkNew Zealand Public Service AI FrameworkNew Zealand's Public Service AI Framework sets five principles and six pillars for AI use across public service agencies. Agencies are encouraged, not bound.Public sector policyNZ Algorithm CharterAlgorithm Charter for Aotearoa New ZealandNew Zealand's Algorithm Charter sets six commitments for government agency algorithms that affect people, applied through a likelihood and impact risk matrix.LawNZ Biometric Processing Privacy CodeBiometric Processing Privacy Code 2025 (New Zealand)New Zealand's Biometric Processing Privacy Code 2025 sets 13 rules for facial recognition and other biometric AI, with limits on inferring emotion and health.Voluntary frameworkNZ Responsible AI Guidance for BusinessesResponsible AI Guidance for Businesses (New Zealand)MBIE's voluntary Responsible AI Guidance for Businesses, published in July 2025, sets out how New Zealand businesses can use and develop AI responsibly.Regulator guidanceNZ Privacy Act and AINew Zealand Privacy Act 2020 and AIHow New Zealand's Privacy Act 2020 applies to AI. The Privacy Commissioner's expectations, the Information Privacy Principles, IPP3A and the Biometrics Code.
Singapore
All Singapore frameworksSingapore publishes voluntary model frameworks for AI, generative AI and agentic AI, with supervisory expectations for financial institutions from MAS.
Voluntary frameworkModel AI Governance FrameworkSingapore Model AI Governance FrameworkSingapore's voluntary Model AI Governance Framework from IMDA and the PDPC. Its four areas, the human involvement matrix, the ISAGO guide and who uses it.Voluntary frameworkAgentic AI frameworkSingapore Model AI Governance Framework for Agentic AIIMDA's Model AI Governance Framework for Agentic AI, version 1.5. Its four dimensions, agent identity and permissions, human checkpoints and agent monitoring.Regulator guidanceMAS AI Risk Management GuidelinesMAS Guidelines on Artificial Intelligence Risk ManagementMAS's AI Risk Management Guidelines for financial institutions, issued 7 October 2026 and in effect from 7 October 2027. Inventory, risk ratings, controls.Voluntary frameworkGenerative AI frameworkSingapore Model AI Governance Framework for Generative AISingapore's Model AI Governance Framework for Generative AI, released May 2024 by IMDA and the AI Verify Foundation. Its nine dimensions and how it is used.Voluntary frameworkAI VerifyAI Verify Testing Framework and ToolkitAI Verify is Singapore's AI governance testing framework and open-source toolkit. Its 11 principles, process checks and technical tests, and what it is not.Regulator guidanceMAS FEAT PrinciplesMAS FEAT Principles for AI and Data AnalyticsMAS's FEAT Principles for AI and data analytics in Singapore finance. The 14 principles, the Veritas assessment methodology and the link to MAS AI guidelines.Regulator guidancePDPC AI advisory guidelinesPDPC Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision SystemsSingapore PDPC advisory guidelines on personal data in AI recommendation and decision systems. Consent, exceptions, notification, accountability, vendors.
Japan
All Japan frameworksJapan takes a soft-law approach, with a principles-based AI Promotion Act and detailed guidelines for businesses that develop, provide or use AI.
Voluntary frameworkJapan AI Guidelines for BusinessAI Guidelines for Business (Japan)Japan's AI Guidelines for Business Ver 1.2 from METI and MIC. Ten guiding principles and duties for AI developers, providers and business users, explained.LawJapan AI Promotion ActAct on Promotion of Research and Development, and Utilization of AI-related Technology (Japan)Japan's AI Promotion Act (Act No. 53 of 2025), in force since September 2025. What it asks of businesses, the AI Basic Plan and the Article 13 guideline.Regulator guidanceAPPI and AI (Japan)Act on the Protection of Personal Information and AI (Japan)How Japan's APPI applies to AI. The PPC's 2023 generative AI caution and the 2026 amendment allowing AI development as statistical work without consent.
South Korea
All South Korea frameworksSouth Korea's AI Basic Act sets obligations for high-impact and generative AI, in force since January 2026.
LawKorea AI Basic ActFramework Act on the Development of Artificial Intelligence and Establishment of Trust (South Korea)South Korea's AI Basic Act, in force 22 January 2026. High-impact AI duties, generative AI notices and labels, domestic representatives and the grace period.LawKorea PIPA automated decision rightsPersonal Information Protection Act, Article 37-2: rights over automated decisions (South Korea)South Korea's PIPA Article 37-2, in force 15 March 2024. Rights to refuse or seek explanation of fully automated decisions, and what organisations publish.
India
All India frameworksIndia governs AI through voluntary national guidelines and its data protection law, with sector guidance from regulators.
Voluntary frameworkIndia AI Governance GuidelinesMeitY's India AI Governance Guidelines, released 5 November 2025. Seven sutras, six pillars, action plan and practical guidance for industry and regulators.LawDPDP Act and RulesDigital Personal Data Protection Act 2023 and DPDP Rules 2025India's DPDP Act 2023 and DPDP Rules 2025 as they apply to AI. Phased commencement to 13 May 2027, and DPIA, audit and algorithmic due diligence for SDFs.LawIT Rules on synthetic contentIT Rules amendments on synthetically generated informationIndia's February 2026 IT Rules amendments on synthetically generated information. Labels, metadata, SSMI declarations, three-hour takedowns and who it covers.Regulator guidanceRBI FREE-AIFramework for Responsible and Ethical Enablement of Artificial Intelligence (FREE-AI) in the Financial SectorReserve Bank of India's FREE-AI committee report of 13 August 2025. Seven sutras and 26 recommendations on AI for banks, NBFCs and other regulated entities.
Pakistan
All Pakistan frameworksPakistan governs AI through a national AI policy approved in 2025, with a draft data governance policy that would set AI rules for federal public bodies and no data protection law yet in force.
Public sector policyNational AI Policy 2025Pakistan National Artificial Intelligence Policy 2025Pakistan's National AI Policy 2025, approved by the cabinet on 30 July 2025. Its six pillars, human oversight, a public AI register and impact assessments.Public sector policyNational Data Governance Policy (draft)Pakistan National Data Governance Policy 2026 (draft) and AIPakistan's draft National Data Governance Policy 2026 sets risk-tiered AI rules for federal bodies. Human review, ADM registry, residency and contractors.
Bangladesh
All Bangladesh frameworksBangladesh governs AI through its Personal Data Protection Act 2026, which lets people withdraw consent to automated decisions, and a Cyber Security Act that names AI agents and tools, with a National AI Policy in draft.
LawBangladesh PDPA 2026Bangladesh Personal Data Protection Act 2026 and automated decisionsBangladesh's Personal Data Protection Act 2026 as it applies to AI. Consent to automated decisions, notice, audits, breach reporting and transfers.Public sector policyBangladesh National AI PolicyBangladesh National Artificial Intelligence Policy 2026-2030 (draft)Bangladesh's draft National AI Policy 2026-2030. Risk tiers, banned uses, algorithmic impact assessments, human review and what it means.LawBangladesh Cyber Security Act 2026Bangladesh Cyber Security Act 2026 and AIBangladesh's Cyber Security Act 2026 names AI agents, AI tools and AI-generated content. Incident reporting, infrastructure duties and offences.
Sri Lanka
All Sri Lanka frameworksSri Lanka governs AI through its Personal Data Protection Act, whose processing and controller duties apply from 1 January 2027, with a right to review automated decisions to follow.
LawSri Lanka PDPASri Lanka Personal Data Protection Act No. 9 of 2022, as amended in 2025Sri Lanka's PDPA as amended by Act No. 22 of 2025. Processing and controller duties apply from 1 January 2027, with DPIAs for profiling and transfer rules.LawPDPA section 18Sri Lanka PDPA section 18 and automated decision-makingSection 18 of Sri Lanka's PDPA gives a right to request review of solely automated decisions. Scope, exceptions, notice duty and what it means for AI.
Hong Kong
All Hong Kong frameworksHong Kong publishes an ethical AI framework for government and a generative AI guideline for developers, providers and users, with privacy guidance for organisations from the PCPD.
Regulator guidancePCPD AI Model FrameworkArtificial Intelligence: Model Personal Data Protection FrameworkHong Kong PCPD's AI Model Personal Data Protection Framework of June 2024. Guidance for organisations buying and using AI, with risk-based human oversight.Public sector policyHong Kong GenAI Guideline and Ethical AI FrameworkHong Kong Generative AI Technical and Application Guideline and Ethical AI FrameworkThe Digital Policy Office's Generative AI Guideline and Ethical AI Framework for Hong Kong. Twelve principles, an AI impact assessment and practical guidance.Regulator guidanceHKMA ART guidanceHKMA Supervisory Guidance for Responsible Adoption of Artificial IntelligenceThe HKMA's October 2026 supervisory guidance on AI for Hong Kong banks. Nine principles across accountability, resilience and trust, and what each one asks.Regulator guidanceSFC generative AI circularSFC circular to licensed corporations on the use of generative AI language modelsThe SFC circular on generative AI language models for Hong Kong licensed corporations. Its four core principles, high-risk uses and SFC notification.
Malaysia
All Malaysia frameworksMalaysia applies its data protection law to automated decisions and profiling through the Commissioner's 2026 guidelines, alongside voluntary national AI principles, with a horizontal AI Governance Bill in preparation.
Regulator guidanceMalaysia ADMP GuidelineMalaysia Automated Decision-Making and Profiling GuidelineMalaysia's ADMP Guideline of April 2026 applies the PDPA to automated decisions and profiling. The threshold, the DPIA link, notices and the AI practices.Voluntary frameworkMalaysia AIGEMalaysia National Guidelines on AI Governance and EthicsMOSTI's National Guidelines on AI Governance and Ethics (AIGE), September 2024. The seven principles, who they speak to and the AI Code of Ethics.LawMalaysia AI Governance BillMalaysia's proposed AI Governance Bill, its first horizontal AI law. What the Ministry of Digital says it covers, its risk-based approach and the timeline.
Philippines
All Philippines frameworksThe Philippines governs AI through the Data Privacy Act and National Privacy Commission guidance, with a responsible AI framework for government agencies and voluntary AI principles for financial institutions from the BSP.
LawPhilippine Data Privacy ActPhilippine Data Privacy Act and automated processingHow the Philippine Data Privacy Act of 2012 and its rules cover automated decision-making and profiling. Rights, NPC registration and what it means for AI.Regulator guidanceNPC AI Advisory 2024-04NPC Advisory No. 2024-04 on artificial intelligenceThe National Privacy Commission's December 2024 guidelines on AI systems that process personal data. Transparency, accountability, bias and rights.
Papua New Guinea
All Papua New Guinea frameworksPapua New Guinea has no AI or data protection law in force yet. Its AI rules are being written into a draft data protection bill and a draft government framework for AI adoption.
LawPNG Data Protection Bill 2026Papua New Guinea Data Governance and Data Protection Bill 2026PNG's draft Data Governance and Data Protection Bill 2026 would add AI rules, human review of automated decisions and transfer limits. What the draft says.Public sector policyPNG Government AI Adoption FrameworkPNG Government Artificial Intelligence Adoption Framework (DG × DPI ^ AI)Papua New Guinea's draft Government AI Adoption Framework sets red lines, human review and AI registers for public bodies. What it says and who it binds.
Fiji has no AI law or general data protection statute. It relies on the constitutional right to privacy and Reserve Bank of Fiji rules, with a national AI framework promised under its digital strategy.
LawFiji Constitution section 24Fiji Constitution section 24, the right to privacySection 24 of Fiji's 2013 Constitution is the country's main legal protection for personal information. What it says and what it means for AI in Fiji.Public sector policyFiji National Digital StrategyFiji National Digital Strategy 2025-2030Fiji's National Digital Strategy 2025-2030 commits to a National AI Framework, data protection law and a cloud policy. What it says about AI and when.Regulator guidanceRBF PSPS 2 cybersecurityReserve Bank of Fiji Prudential Supervision Policy Statement No. 2: Minimum Requirements for the Management of Cybersecurity RiskThe Reserve Bank of Fiji's PSPS 2 sets binding cybersecurity rules for banks, insurers and FNPF, including third parties. What it means for AI systems.
United Arab Emirates
All United Arab Emirates frameworksThe UAE combines a national AI charter with data protection rules for autonomous systems in the Dubai International Financial Centre.
LawUAE PDPLUAE Personal Data Protection Law and automated processingThe UAE federal Personal Data Protection Law gives people a right to object to automated decisions. Who it covers, Article 18, impact assessments and AI.LawDIFC Regulation 10DIFC Regulation 10 on autonomous and semi-autonomous systemsDIFC Regulation 10 sets rules for personal data processed by AI and autonomous systems in the DIFC. Who it covers, notices, certification and the ASO role.Voluntary frameworkUAE AI CharterUAE Charter for the Development and Use of Artificial IntelligenceThe UAE Charter for the Development and Use of AI sets 12 national principles, from safety and bias to human oversight. What it covers and how to apply it.
Israel
All Israel frameworksIsrael governs AI through its Privacy Protection Law, overhauled by Amendment 13 in 2025, and a policy of sector-based, mostly soft regulation.
LawIsrael Privacy Protection LawIsrael Protection of Privacy Law and Amendment 13Amendment 13 to Israel's Protection of Privacy Law, in force since August 2025, widens definitions, notice duties and PPA enforcement. What it means for AI.Public sector policyIsrael AI policyIsrael's Policy on Artificial Intelligence Regulation and EthicsIsrael's 2023 AI policy rules out a horizontal AI law and asks sector regulators to govern AI with soft, risk-based tools. What it says and how it is applied.
Saudi Arabia
All Saudi Arabia frameworksSaudi Arabia governs AI through its Personal Data Protection Law, which requires explicit consent and impact assessments for automated decisions, and national AI guidance from SDAIA, including its AI Ethics Principles.
LawSaudi PDPLSaudi Personal Data Protection Law and automated decisionsHow Saudi Arabia's PDPL and its Implementing Regulation apply to AI. Explicit consent for automated decisions, notice, impact assessments and the 2026 draft.Regulator guidanceSDAIA AI Ethics PrinciplesSaudi Arabia's AI Ethics Principles from SDAIA. The seven principles, the four risk levels, the roles each entity designates and how to put them into practice.
Qatar
All Qatar frameworksQatar governs AI through its data protection law, the PDPPL, and the Qatar Central Bank's AI Guideline for financial institutions, with a separate GDPR-style regime in the Qatar Financial Centre.
LawQatar PDPPLQatar Personal Data Privacy Protection Law (PDPPL) and AIHow Qatar's PDPPL, Law No. 13 of 2016, applies to AI. Consent, notice, privacy reviews, DPIAs for automated decisions, breach notification and penalties.Regulator guidanceQCB AI GuidelineQatar Central Bank Artificial Intelligence GuidelineThe Qatar Central Bank's AI Guideline for licensed entities. Board accountability, the AI register, QCB approval for high-risk AI and human oversight.LawQFC Article 22QFC Data Protection Regulations 2021 and automated decisionsArticle 22 of the QFC Data Protection Regulations 2021 limits solely automated decisions by Qatar Financial Centre firms. Exceptions, safeguards and DPIAs.
South Africa
All South Africa frameworksSouth Africa regulates automated decisions through its data protection law, POPIA.
Nigeria
All Nigeria frameworksNigeria regulates automated decisions through the Nigeria Data Protection Act 2023, with conditions for deploying AI on personal data set by the Data Protection Commission's GAID 2025.
LawNDPA section 37Nigeria Data Protection Act 2023 and automated decision-makingSection 37 of the Nigeria Data Protection Act 2023 gives people a right not to be subject to solely automated decisions. Exceptions, safeguards and AI.Regulator guidanceGAID 2025NDPA General Application and Implementation Directive (GAID) 2025 and AIThe NDPC's GAID 2025 sets conditions for deploying AI on personal data in Nigeria, with mandatory DPIAs for profiling and automated decisions. What it asks.
Kenya
All Kenya frameworksKenya regulates automated decisions through the Data Protection Act 2019, with draft AI guidance from the Data Protection Commissioner and the Central Bank of Kenya, and an AI bill before the Senate.
LawKenya DPA section 35Kenya Data Protection Act 2019 and automated decision-makingSection 35 of Kenya's Data Protection Act 2019 limits solely automated decisions with significant effects. Exceptions, the notice and review duty, and AI.Regulator guidanceODPC AI Guidance NoteODPC Guidance Note on Artificial IntelligenceThe Kenya ODPC's draft Guidance Note on Artificial Intelligence applies the Data Protection Act to AI. High-risk uses, DPIA triggers and governance.Regulator guidanceCBK AI Guidance NoteCBK draft Guidance Note on Artificial Intelligence in the Banking SectorThe Central Bank of Kenya's draft Guidance Note on AI would require CBK approval before deploying AI, an annual AI register and 24-hour AI incident reports.
Ghana
All Ghana frameworksGhana regulates automated decisions through the Data Protection Act 2012, with a National AI Strategy launched in 2026 that plans a Responsible AI Authority.
LawAct 843 section 41Ghana Data Protection Act 2012 (Act 843) and automated decision-takingSection 41 of Ghana's Data Protection Act 2012 lets people require that significant decisions are not solely automated. Rights, exceptions and AI.Public sector policyGhana National AI StrategyGhana National Artificial Intelligence Strategy 2025 to 2035Ghana's National AI Strategy 2025 to 2035, launched on 24 April 2026. Its eight pillars, the planned Responsible AI Authority and what it means for governance.
China
All China frameworksChina regulates specific AI uses through targeted administrative rules. Listed here as reference for organisations with Chinese operations or suppliers.
Brazil
All Brazil frameworksBrazil regulates automated decisions under its data protection law, with a comprehensive AI bill still before Congress.
Jamaica
All Jamaica frameworksJamaica regulates automated decisions through its Data Protection Act 2020, in operation since December 2023, while national AI policy is developed.
Trinidad and Tobago
All Trinidad and Tobago frameworksTrinidad and Tobago's Data Protection Act is only partly in force, and a national AI assessment led by the Ministry of Public Administration and Artificial Intelligence is shaping AI policy.
Taiwan
All Taiwan frameworksTaiwan's AI Basic Act sets national principles, with a risk classification framework for government.
Vietnam
All Vietnam frameworksVietnam's AI law sets risk tiers with notification duties, in force since March 2026.
Sweden
All Sweden frameworksSweden applies the EU AI Act through five national authorities led by PTS, with rules for automated decisions by public authorities in the Administrative Procedure Act and national guidelines for generative AI in the public sector.
LawSweden AI Act authoritiesSweden's AI Act authorities and national implementationHow Sweden supervises the EU AI Act. The five authorities named in June 2026, what PTS, IMY and Finansinspektionen oversee, and the pending national act.LawFörvaltningslagen section 28Förvaltningslagen section 28 and automated decisions by Swedish authoritiesSweden's Administrative Procedure Act lets authorities decide automatically. What section 28 allows, the duties that still apply and what it means for AI.Public sector policySweden generative AI guidelinesDigg and IMY guidelines for generative AI in public administration (Sweden)Digg and IMY's 18 national guidelines for generative AI in Swedish public administration, and what they ask of agencies, municipalities and suppliers.
Denmark
All Denmark frameworksDenmark applies the EU AI Act through a national law naming its supervisors, with Datatilsynet guidance on AI in public authorities and Finanstilsynet expectations for financial firms.
LawDanish AI Act supplementary lawDenmark's Act on supplementary provisions to the EU AI ActDenmark's Act No. 467 of 2025 names who supervises the EU AI Act in Denmark and sets fines for prohibited AI. What it covers and what is still to come.Regulator guidanceDFSA AI recommendationsDanish FSA recommendations when using artificial intelligenceFinanstilsynet's 2024 good practice for AI asks Danish financial firms for an AI overview, risk tiering, independent validation and explainability.Regulator guidanceDatatilsynet AI guidance for public authoritiesDatatilsynet guidance: public authorities' use of artificial intelligenceThe Danish Data Protection Agency's guide to AI in public authorities covers purpose, legal basis, automated decisions and impact assessments.
Finland
All Finland frameworksFinland supervises the EU AI Act through existing authorities under its 2025 supervision act, with binding rules for automated decisions by public authorities and government guidance on generative AI.
LawFinland AI supervision actFinland's Act on the Supervision of Certain AI Systems (1377/2025)Finland's Act 1377/2025 names who supervises the EU AI Act in Finland, from the Data Protection Ombudsman to Traficom and FIN-FSA, and sets the sanction fees.LawFinland public sector automated decisionsAutomated decision-making in Finnish public administrationFinland's rules for authorities that decide matters automatically, in the Administrative Procedure Act and the Information Management Act. What they require.Public sector policyFinland public sector GenAI guidelinesGuidelines on using generative AI in Finnish public administrationThe Ministry of Finance's 2025 guidelines on generative AI in Finnish public administration. What they ask of officials and of the organisations they work in.
Malta
All Malta frameworksMalta applies the EU AI Act through its own implementing regulations, with the Malta Digital Innovation Authority as lead authority, the data protection commissioner covering sensitive uses, and AI expectations for financial services from the MFSA.
LawMalta AI Act implementationMalta's Artificial Intelligence Regulations (EU AI Act implementation)How Malta implements the EU AI Act. The MDIA and IDPC roles under Legal Notices 226 and 227 of 2025, national penalties and what organisations must do.Regulator guidanceMFSA AI expectationsMFSA Dear CEO letter: AI governance, risk and prudential expectationsThe MFSA's June 2026 Dear CEO letter sets AI governance, third-party, model risk and data expectations for Maltese licence holders, with a self-assessment.Voluntary frameworkMalta AI strategyMalta's national AI strategy and Ethical AI FrameworkMalta's AI strategy, its 2025 realignment and the Ethical AI Framework, Malta – Towards Trustworthy AI. What they set out and how they fit together.
Cyprus
All Cyprus frameworksCyprus applies the EU AI Act through a centralised model led by the Commissioner of Communications, with the data protection Commissioner covering high-risk uses in law enforcement, migration and justice, CySEC guidance on AI risk under DORA, and a draft National AI Strategy 2032.
LawCyprus AI Act authoritiesEU AI Act governance in CyprusHow Cyprus supervises the EU AI Act. The Commissioner of Communications, the data protection Commissioner, rights bodies and the draft AI Law of 2026.Public sector policyCyprus National AI StrategyCyprus National AI Strategy 2032Cyprus's draft National AI Strategy 2032 sets eight objectives, a National AI Authority and lifecycle controls for government AI. What it asks of you.Regulator guidanceCySEC Circular C786CySEC Circular C786: frontier AI models and cybersecurity risks under DORACySEC Circular C786 tells Cyprus investment firms, CASPs and fund managers to reassess ICT risk for frontier AI under DORA. Who it covers and what it asks.
Questions
How are the AI governance frameworks on this page organised?
By jurisdiction first. Each framework is also labelled by its type (law, regulator guidance, standard, public sector policy or voluntary framework). The filters show one type at a time, and each jurisdiction has its own page listing every framework for it.
Which AI governance framework should an organisation start with?
Most organisations use an international standard or framework, such as ISO/IEC 42001 or the NIST AI RMF, as the backbone of their AI governance, whatever their jurisdiction. They then add the laws and guidance that apply where they operate.
Are these framework pages legal advice?
No. Each page explains the framework to support your governance work. Read the official source for the authoritative text.
Start with the AI you run.
Every framework begins with knowing which AI systems and agents you have. The AI register is free to start.