One question,
every jurisdiction.
Who answers when an AI agent acts is being decided in many places at once. We follow the statutes, the frameworks and the dates that bind, from Washington to Seoul.
- European Union. The Article 50(2) marking relief ends for systems on the market before 2 August 2026, and the Omnibus prohibitions take effect.
- European Union. The revised Product Liability Directive applies, including to vendors selling in from outside the Union.
- Colorado. Developer and deployer duties begin under SB26-189.
- European Union. The Annex III high-risk obligations apply, including the deployer duties in Article 26.
The jurisdictions, read one line at a time.
Each line names the instrument that carries the duty and where it stands today. Follow a line to the full guide for that jurisdiction, with the sources it rests on.
- EuropeEuropean UnionRegulation (EU) 2024/1689, the AI Act. In force and reaching operators outside the Union; high-risk duties from 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
- AmericasUnited States, federalNo federal AI statute. NIST AI RMF 1.0 and Executive Order 14179; Executive Order 14110 was revoked on 20 January 2025.
- AmericasColoradoSB 24-205, postponed to 30 June 2026 and then narrowed by SB26-189. Developer and deployer duties from 1 January 2027.
- AmericasTexas and CaliforniaTexas TRAIGA (HB 149) and California SB 53, both in force since 1 January 2026.
- AmericasCanadaNo AI statute. The Artificial Intelligence and Data Act lapsed when Parliament was prorogued in January 2025.
- AmericasBrazilPL 2338/2023, approved by the Federal Senate and before the Chamber of Deputies. Not yet law.
- EuropeUnited KingdomNo AI statute. Sectoral regulators apply existing law; UK GDPR Articles 22A to 22D on automated decisions in force since 5 February 2026.
- Asia PacificRepublic of KoreaAI Basic Act, in force since 22 January 2026, with a duty for foreign operators to name a domestic representative.
- Asia PacificJapanAI Promotion Act, Law No. 53 of 2025, fully in force since 1 September 2025. Principles based, without penalties.
- Asia PacificSingaporeModel AI Governance Framework and the AI Verify toolkit. Voluntary, read alongside the PDPA and the MAS FEAT Principles.
- Asia PacificChinaGenerative AI Interim Measures since August 2023, and labelling measures for AI generated content since 1 September 2025.
- Asia PacificTaiwanAI Basic Act, in force since 14 January 2026.
- Asia PacificVietnamLaw on Artificial Intelligence, No. 134/2025/QH15, in force since 1 March 2026.
- Asia PacificAustraliaVoluntary AI Safety Standard (2024) and sector supervision. Privacy Act duties on automated decisions from December 2026.
- InternationalCouncil of EuropeFramework Convention on AI, CETS 225, open for signature since September 2024. Not yet in force.
Each guide rests on the sources it names.
The trackers and the risk index.
Working references for counsel, compliance teams and the assistants they use. Each one dates its entries and names its sources.
Regulatory tracker
Seventeen jurisdictions in one table: instrument, status, activation, authority, extraterritorial reach and penalty exposure. Filter it, sort it, cite it.
Open the trackerEU AI Act timeline
Every application date of the AI Act as the Digital Omnibus left it, with who each one binds and the article behind it.
See what applies whenEuropean AI Risk Index
Obligations, deadlines, decided cases, a seven dimension agent risk taxonomy and the insurance gap, with a citable dataset behind it.
Read the indexRecent writing from the desk.
Long form analysis of the statutes, frameworks and standards that decide how operators of AI agents are held to account, revised when the law moves.
- Article 50 reaches operators outside the Union: the marking duty and the 2 December 2026 date
- Selling AI into the EU from outside it: who answers for a defective product after 9 December 2026
- Your AI vendor's insurance is not your insurance
- AI obligations arrive on rails that were built before AI
- Required assurance and available assurance are not the same thing
- You cannot over-comply your way into compliance
When the law moves, one short email.
What changed, in which jurisdiction, and the source it rests on. Your address is used for nothing else, and it is never shared or sold.