Every framework Kapālins maps or tracks, from first draft to in force and each amendment since, with the official source for every date.
DPDP Act 2023IndiaIn force Rule 4 on registration and obligations of Consent Managers comes into force one year after the Gazette publication of the DPDP Rules 2025.
Privacy Act 1988AustraliaIn force Automated decision-making transparency obligations in privacy policies (APP 1) take effect.
California CPPA regulations on automated decision-making technology, risk assessments and cybersecurity auditsUnited States · tracked here, not mapped in the platformIn force Businesses that use ADMT to make significant decisions must comply with the ADMT requirements.
Colorado AI Act (SB 24-205)United States · on the platform roadmapIn force Developer documentation duties under SB 26-189 begin; Attorney General disclosure rules are due by this date.
EU Data Act (Regulation (EU) 2023/2854)European Union · tracked here, not mapped in the platformIn force Switching charges for data processing services must be removed entirely.
Personal Data Protection Law (Law No. 27 of 2022)Indonesia · on the platform roadmapIn force Government Regulation No. 33 of 2026 takes effect, six months after enactment.
APPIJapanIn force Strengthened criminal penalties under the 2026 APPI amendments commence; the main reforms follow by 17 July 2028.
DPDP Act 2023IndiaIn force Rules 3, 5 to 16, 22 and 23, covering notice, security, breach reporting and most Data Fiduciary duties, come into force eighteen months after Gazette publication.
Pick a jurisdiction, or read them all. Each date links to where it was published.
ACSC Secure AIAustraliaLatest: guidance 15 Apr 2024UK NCSC and US CISA published the Guidelines for Secure AI System Development, co-sealed by ASD’s ACSC. UK National Cyber Security Centre
NSA-led joint guidance Deploying AI Systems Securely published with ASD’s ACSC as a co-author. US National Security Agency
APRA CPS 230 Operational Risk ManagementAustralia · on the platform roadmapLatest: in force 1 Jul 2026APRA released draft CPS 230 for consultation, with submissions due by 21 October 2022. APRA
APRA released the final cross-industry Prudential Standard CPS 230 Operational Risk Management. APRA
APRA released the final Prudential Practice Guide CPG 230 to support implementation of CPS 230. APRA
CPS 230 commenced for APRA-regulated entities. APRA
APRA released final targeted amendments to CPS 230 and CPG 230, following a December 2025 proposal letter. APRA
The updated CPS 230 and CPG 230 commenced. APRA
APRA CPS 234AustraliaLatest: in force 1 Jul 2020APRA released draft CPS 234 and a discussion paper for consultation. APRA
APRA released the final Prudential Standard CPS 234 Information Security. APRA
APRA finalised updated Prudential Practice Guide CPG 234 Information Security. APRA
CPS 234 commenced for all APRA-regulated entities. APRA
Latest date for CPS 234 to apply to information assets managed by third parties, unless contracts renewed earlier. APRA
APS responsible AIAustraliaLatest: amended 15 Dec 2025The Australian Government published Australia’s AI Ethics Principles, a voluntary framework of eight principles. Department of Industry, Science and Resources
The Digital Transformation Agency released the Policy for the responsible use of AI in government. Digital Transformation Agency
The Policy for the responsible use of AI in government (version 1.1) took effect for Australian Government agencies. Digital Transformation Agency
Version 2.0 of the Policy for the responsible use of AI in government came into effect. Digital Transformation Agency
ASIC RG 271AustraliaLatest: in force 5 Oct 2021ASIC released Consultation Paper 311 proposing updates to its internal dispute resolution guidance (RG 165). ASIC
ASIC released Regulatory Guide 271 Internal dispute resolution, replacing the IDR guidance in RG 165. ASIC
ASIC issued the current version of RG 271. ASIC
Financial firms had to comply with RG 271’s internal dispute resolution standards from this date. ASIC
ASX PrinciplesAustraliaLatest: proposed 21 Jul 2026ASX Corporate Governance Council released the first edition of the Principles of Good Corporate Governance. ASX
Second edition of the Corporate Governance Principles and Recommendations released. ASX
Corporate Governance Principles and Recommendations with 2010 amendments released. ASX
Third edition of the Corporate Governance Principles and Recommendations released. ASX
Fourth edition released; ASX says it remains in effect until notified otherwise. ASX
ASX opened an eight-week public consultation on a draft fifth edition, closing 14 September 2026. ASX
Cyber Security Act 2024Australia · tracked here, not mapped in the platformLatest: in force 4 Mar 2026The Cyber Security Act 2024 (No. 98, 2024) received Royal Assent. Federal Register of Legislation
The Cyber Security (Ransomware Payment Reporting) Rules 2025 were registered. Federal Register of Legislation
The Cyber Security (Security Standards for Smart Devices) Rules 2025 were registered, with the standards to start 12 months later. Federal Register of Legislation
Mandatory ransomware payment reporting began for entities with annual turnover of at least $3 million, and Cyber Incident Review Board provisions took effect. Governance Institute of Australia
Mandatory security standards for consumer-grade smart devices took effect under Part 2 of the Smart Devices Rules. Federal Register of Legislation
Essential EightAustraliaLatest: proposed 12 Jul 2026ASD published the Essential Eight within its updated Strategies to Mitigate Cyber Security Incidents. Australian Signals Directorate
ASD published Essential Eight Maturity Model changes, including tighter patching, MFA and privileged access requirements. Australian Signals Directorate
Partner consultation closed on Essentials for enterprise IT, ASD’s planned successor to the Essential Eight. iTnews
Privacy Act 1988AustraliaLatest: in force 10 Jun 2025The Privacy Act 1988 received Royal Assent. Federal Register of Legislation
Private sector amendments commenced, extending the Privacy Act to many private sector organisations. OAIC
The Privacy Amendment (Enhancing Privacy Protection) Act 2012 commenced, introducing the Australian Privacy Principles. OAIC
The Notifiable Data Breaches scheme commenced under the Privacy Act. OAIC
The Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022 commenced, strengthening enforcement and penalties. OAIC
Most Privacy and Other Legislation Amendment Act 2024 changes within the Information Commissioner’s remit commenced. OAIC
The statutory tort for serious invasions of privacy (Schedule 2 of the Privacy Act) commenced. OAIC
Automated decision-making transparency obligations in privacy policies (APP 1) take effect. OAIC
SOCI ActAustraliaLatest: amended 29 Nov 2024The Security of Critical Infrastructure Act 2018 received Royal Assent. Federal Register of Legislation
The Security of Critical Infrastructure Act 2018 came into force. Department of Home Affairs
The Security Legislation Amendment (Critical Infrastructure) Act 2021 (Act No. 124, 2021) was enacted. Federal Register of Legislation
The Security Legislation Amendment (Critical Infrastructure Protection) Act 2022 received Royal Assent. Federal Register of Legislation
SOCI and Other Legislation Amendment (Enhanced Response and Prevention) Act 2024 received Royal Assent. Federal Register of Legislation
Voluntary AI Safety Standard and Australian Standards for AIAustralia · tracked here, not mapped in the platformLatest: proposed 15 Jul 2026The Government released the Voluntary AI Safety Standard, with ten voluntary guardrails. Minister for Industry and Science
A proposals paper on mandatory guardrails for AI in high-risk settings opened for consultation until 4 October 2024. Minister for Industry and Science
The National AI Centre published the Guidance for AI Adoption, six practices that evolve the Voluntary AI Safety Standard. Department of Industry, Science and Resources
The National AI Plan set aside mandatory guardrails in favour of existing technology-neutral laws and an AI Safety Institute. Piper Alderman
The Prime Minister announced Australian Standards for AI, expected to be legislated early 2027, and established the Office of AI. Prime Minister of Australia
Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225)Global standards · tracked here, not mapped in the platformLatest: adopted 15 May 2026The Committee of Ministers of the Council of Europe adopted the Framework Convention. Center for AI and Digital Policy
The Convention opened for signature in Vilnius, and the European Commission signed it for the EU on the same day. EUR-Lex
The Council of the EU adopted Decision (EU) 2026/1080 concluding the Convention on behalf of the Union, after European Parliament consent on 11 March 2026. EUR-Lex
The European Union deposited its instrument of ratification and became the first Party to the Convention. Law and Technology
ISO/IEC 27001Global standardsLatest: amended Feb 2024ISO/IEC 27001:2005 published as the first edition of the information security management system standard. ISO
ISO/IEC 27001:2013 published as the second edition, replacing the 2005 edition. ISO
ISO/IEC 27001:2022 published as the third edition, the version currently in force. ISO
ISO/IEC 27001:2022/Amd 1:2024 published, adding climate action changes to the standard. ISO
ISO/IEC 42001Global standardsLatest: guidance Jul 2025MITRE ATLASGlobal standardsLatest: amended 14 Sep 2026MITRE released version 1.0.0 of the ATLAS data. MITRE ATLAS (GitHub)
ATLAS 5.0.0 added a technique maturity field and new AI agent techniques. MITRE ATLAS (GitHub)
ATLAS moved to monthly content releases and a new v6 data format with platform tags. MITRE ATLAS (GitHub)
MITRE released ATLAS content version 2026.09, the latest at the time of compiling. MITRE ATLAS (GitHub)
OWASP LLM Top 10Global standardsLatest: amended 3 Aug 2026OWASP published version 1.0 of the Top 10 for Large Language Model Applications. OWASP Foundation
OWASP released the 2025 edition of the Top 10 for LLM Applications. OWASP GenAI Security Project
OWASP GenAI Security Project published the 2026 edition of the Top 10 for LLM Applications. OWASP GenAI Security Project
California CPPA regulations on automated decision-making technology, risk assessments and cybersecurity auditsUnited States · tracked here, not mapped in the platformLatest: in force 1 Jan 2026The California Privacy Protection Agency published its notice of proposed rulemaking, opening public comment. California Privacy Protection Agency
The CPPA Board adopted the regulations on ADMT, risk assessments, cybersecurity audits and CCPA updates. California Privacy Protection Agency
The Office of Administrative Law approved the regulations and filed them with the Secretary of State. California Privacy Protection Agency
The regulations took effect, and businesses subject to risk-assessment requirements had to begin complying. California Privacy Protection Agency
Businesses that use ADMT to make significant decisions must comply with the ADMT requirements. California Privacy Protection Agency
Risk-assessment attestations and summaries are due to the CPPA, and businesses with revenue over $100 million must submit cybersecurity audit certifications. California Privacy Protection Agency
Cybersecurity audit certifications are due from businesses with revenue between $50 million and $100 million. California Privacy Protection Agency
Cybersecurity audit certifications are due from businesses with revenue under $50 million. California Privacy Protection Agency
Colorado AI Act (SB 24-205)United States · on the platform roadmapLatest: amended 14 May 2026SB 24-205, Consumer Protections for Artificial Intelligence, was introduced in the Colorado Senate. Colorado General Assembly
The Governor signed SB 24-205 into law (Chapter 198, 2024 Session Laws). Colorado General Assembly
The Governor signed SB 25B-004, extending the effective date of SB 24-205’s requirements to 30 June 2026. Colorado General Assembly
The Governor signed SB 26-189, repealing and re-enacting the Act around automated decision-making technology in consequential decisions. Colorado General Assembly
Developer documentation duties under SB 26-189 begin; Attorney General disclosure rules are due by this date. Colorado General Assembly
Illinois HB 3773 (AI in employment, Illinois Human Rights Act)United States · tracked here, not mapped in the platformLatest: proposed 15 May 2026The Governor signed HB 3773 (Public Act 103-0804), amending the Illinois Human Rights Act on employers’ use of artificial intelligence. Epstein Becker Green
The amendments took effect, making discriminatory AI use, ZIP codes used as a proxy, and AI use without notice in employment decisions civil rights violations. Epstein Becker Green
The Department of Human Rights published proposed rules (56 Ill. Adm. Code 2520, Subpart J) setting the AI notice requirements in the Illinois Register. Illinois Register, Vol. 50, Issue 20
NIST AI RMFUnited StatesLatest: proposed 7 Apr 2026NIST issued a Request for Information to inform development of the AI Risk Management Framework. NIST
NIST released the initial draft of the AI Risk Management Framework for public comment. NIST
NIST released the second draft of the AI Risk Management Framework. NIST
NIST released AI Risk Management Framework 1.0 (NIST AI 100-1). NIST
NIST released NIST AI 600-1, the Generative AI Profile of the AI RMF. NIST
NIST released a concept note for an AI RMF Profile on Trustworthy AI in Critical Infrastructure. NIST
NIST SSDFUnited StatesLatest: proposed 17 Dec 2025NIST released the draft of SP 800-218, the Secure Software Development Framework. NIST CSRC
NIST published final SP 800-218, Secure Software Development Framework version 1.1. NIST CSRC
NIST released draft SP 800-218A, an SSDF community profile for generative AI and dual-use foundation models. NIST CSRC
NIST published final SP 800-218A, the SSDF profile for generative AI and dual-use foundation models. NIST CSRC
NIST released the initial public draft of SP 800-218 Revision 1; comments closed 30 January 2026. NIST CSRC
NYC Local Law 144 of 2021 (Automated Employment Decision Tools)United States · tracked here, not mapped in the platformLatest: guidance 2 Dec 2025Int. 1894-2020 was enacted as Local Law 144 of 2021, requiring bias audits and candidate notices for automated employment decision tools. New York City Council
The Department of Consumer and Worker Protection published its first proposed rules implementing Local Law 144. NYC Department of Consumer and Worker Protection
DCWP’s final rule took effect and DCWP began enforcing Local Law 144. NYC Department of Consumer and Worker Protection
The New York State Comptroller found that DCWP’s enforcement was ineffective: DCWP found one possible non-compliance among 32 companies where auditors found at least 17. Office of the New York State Comptroller
SOC 2United StatesLatest: guidance 15 Oct 2022The AICPA issued the Trust Services Criteria in their current form. EY To the Point
The AICPA revised the points of focus for the 2017 Trust Services Criteria; the criteria themselves were unchanged. EY To the Point
AICPA SOC 2 guide updated as of this date for the revised points of focus and SSAE 20 and 21. AICPA & CIMA
Texas Responsible Artificial Intelligence Governance Act (HB 149)United States · tracked here, not mapped in the platformLatest: in force 1 Jan 2026HB 149, relating to regulation of the use of artificial intelligence systems, was filed in the Texas House. Texas Legislature Online
The Governor signed HB 149 after both chambers passed it. Texas Legislature Online
HB 149 took effect. Texas Legislature Online
Transparency in Frontier Artificial Intelligence Act (SB 53)United States · tracked here, not mapped in the platformLatest: in force 1 Jan 2026Governor Newsom signed SB 53, the Transparency in Frontier Artificial Intelligence Act (Chapter 138, Statutes of 2025). Office of the Governor of California
SB 53 took effect. Hunton Andrews Kurth
US federal AI executive ordersUnited States · tracked here, not mapped in the platformLatest: adopted 2 Jun 2026President Biden signed Executive Order 14110 on safe, secure and trustworthy development and use of AI. Federal Register
President Trump signed Executive Order 14148, which revoked Executive Order 14110. Federal Register
Executive Order 14179, Removing Barriers to American Leadership in Artificial Intelligence, was signed. Federal Register
The White House released Winning the AI Race: America’s AI Action Plan. The White House
Executive Order 14365, Ensuring a National Policy Framework for Artificial Intelligence, targeted conflicting state AI laws. Federal Register
Executive Order 14409 directed agencies to harden federal and critical systems for advanced AI. Federal Register
Utah Artificial Intelligence Policy Act (SB 149)United States · tracked here, not mapped in the platformLatest: amended 7 May 2025The Utah Legislature passed SB 149, the Artificial Intelligence Policy Act. IAPP
SB 149 took effect, requiring disclosure of generative AI use in consumer interactions and creating the Office of Artificial Intelligence Policy. Manatt
SB 226 and SB 332 took effect, narrowing disclosure duties to clear consumer requests and high-risk interactions and extending the Act to 1 July 2027. Perkins Coie
HB 452 took effect, adding disclosure, advertising and data-sale limits for mental health chatbots. National Law Review
Under SB 332, the Act is due to be repealed on 1 July 2027 unless the Legislature extends it. Perkins Coie
Cyber Resilience ActEuropean UnionLatest: in force 11 Sep 2026The Commission proposed the Cyber Resilience Act. European Commission
Regulation (EU) 2024/2847 adopted; published in the Official Journal on 20 November 2024. EUR-Lex
The Cyber Resilience Act entered into force. EUR-Lex
Chapter IV on notification of conformity assessment bodies applies. EUR-Lex
Article 14 reporting obligations for actively exploited vulnerabilities and severe incidents apply. EUR-Lex
The Cyber Resilience Act applies in full. EUR-Lex
DORAEuropean UnionLatest: in force 17 Jan 2025The Commission proposed the Digital Operational Resilience Act in its Digital Finance Package. European Commission
Regulation (EU) 2022/2554 adopted; published in the Official Journal on 27 December 2022. EUR-Lex
DORA entered into force. EUR-Lex
DORA began to apply to EU financial entities. EUR-Lex
EU AI ActEuropean UnionLatest: in force 2 Aug 2026The European Commission proposed the Artificial Intelligence Act, COM(2021) 206. EUR-Lex
Regulation (EU) 2024/1689 published in the Official Journal. EUR-Lex
The AI Act entered into force. EUR-Lex
Chapters I and II apply, including prohibited AI practices and AI literacy. EUR-Lex
Rules on general-purpose AI models, governance, notified bodies and penalties apply. EUR-Lex
Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force, delaying high-risk obligations. EUR-Lex
General date of application of the AI Act. EUR-Lex
High-risk requirements apply to Annex III systems, as amended by Regulation (EU) 2026/1744. EUR-Lex
High-risk requirements apply to Annex I product-related systems, as amended by Regulation (EU) 2026/1744. EUR-Lex
EU Data Act (Regulation (EU) 2023/2854)European Union · tracked here, not mapped in the platformLatest: in force 12 Sep 2026The Data Act was published in the Official Journal of the EU. European Commission
The Data Act entered into force. European Commission
Most Data Act obligations began to apply, including business-to-business data sharing and unfair-terms rules for new contracts. European Commission
The access-by-design obligation began to apply to connected products and related services placed on the market after this date. BIPT (Belgian Institute for Postal Services and Telecommunications)
Switching charges for data processing services must be removed entirely. European Commission
Chapter IV unfair-terms rules extend to contracts concluded on or before 12 September 2025 that are of indefinite duration or expire at least ten years from 11 January 2024. BIPT (Belgian Institute for Postal Services and Telecommunications)
GDPREuropean UnionLatest: proposed 19 Nov 2025The European Commission proposed the General Data Protection Regulation, COM(2012) 11. EUR-Lex
Regulation (EU) 2016/679 adopted; published in the Official Journal on 4 May 2016. EUR-Lex
The GDPR entered into force. EUR-Lex
The GDPR began to apply across the EU. EUR-Lex
The Commission proposed GDPR amendments in the Digital Omnibus, COM(2025) 837. European Commission (copy hosted by Table.Media)
NIS2European UnionLatest: proposed 20 Jan 2026The Commission proposed a revised Network and Information Security Directive (NIS2). European Commission
Directive (EU) 2022/2555 adopted; published in the Official Journal on 27 December 2022. EUR-Lex
NIS2 entered into force. EUR-Lex
Member States’ NIS2 measures apply and NIS1 is repealed; transposition was due 17 October 2024. EUR-Lex
The Commission proposed targeted amendments to NIS2 as part of a new cybersecurity package. European Commission
MAS TRM · FEATSingaporeLatest: proposed 13 Nov 2025MAS issued the Technology Risk Management Guidelines to financial institutions. Monetary Authority of Singapore
MAS released the FEAT Principles on fairness, ethics, accountability and transparency in AI and data analytics. Monetary Authority of Singapore
MAS consulted on proposed revisions to the Technology Risk Management Guidelines until 8 April 2019. Monetary Authority of Singapore
MAS published the revised Technology Risk Management Guidelines. Monetary Authority of Singapore
MAS issued a consultation paper proposing Guidelines on AI Risk Management for financial institutions. Monetary Authority of Singapore
PDPA · IMDASingaporeLatest: in force 1 Oct 2022The PDPA’s data protection obligations for private organisations took effect. PDPC
Singapore issued the first edition of the Model AI Governance Framework. IMDA
The second edition of the Model AI Governance Framework was published. IMDA
Parliament passed the Personal Data Protection (Amendment) Act 2020. Singapore Statutes Online
Most provisions of the Personal Data Protection (Amendment) Act 2020 commenced. Singapore Statutes Online
Section 24 of the 2020 Amendment Act commenced, raising the maximum financial penalty. Singapore Statutes Online
BNM RMiTMalaysiaLatest: amended 25 Sep 2026Bank Negara Malaysia issued a Policy Document on Risk Management in Technology. Allen & Gledhill
BNM issued a revised RMiT policy document, later superseded by the November 2025 version. Bank Negara Malaysia
BNM issued a revised RMiT policy document, effective 28 November 2025 unless stated otherwise. Bank Negara Malaysia
BNM issued an updated RMiT policy document; the effective date remains 28 November 2025. Bank Negara Malaysia
DPDP Act 2023IndiaLatest: adopted 14 Nov 2025The Digital Personal Data Protection Act 2023 (No. 22 of 2023) received Presidential assent. Gazette of India (via MeitY)
MeitY released draft Digital Personal Data Protection Rules 2025 for public consultation until 18 February 2025. Press Information Bureau
The Government notified the DPDP Rules 2025, starting an eighteen-month phased compliance period. Press Information Bureau
Rule 4 on registration and obligations of Consent Managers comes into force one year after the Gazette publication of the DPDP Rules 2025. Gazette of India (via MeitY)
Rules 3, 5 to 16, 22 and 23, covering notice, security, breach reporting and most Data Fiduciary duties, come into force eighteen months after Gazette publication. Gazette of India (via MeitY)
India AI Governance GuidelinesIndia · tracked here, not mapped in the platformLatest: in force 20 Feb 2026MeitY published draft IT Rules amendments on labelling synthetically generated information for consultation. MeitY
MeitY unveiled the India AI Governance Guidelines under the IndiaAI Mission. Press Information Bureau
IT Rules amendments (G.S.R. 120(E)) were notified, adding duties for synthetically generated information. MeitY
The IT Rules amendments on synthetically generated information came into force. Khaitan & Co
AI Promotion ActJapanLatest: guidance 14 Jul 2026The Cabinet’s AI Promotion Bill was received by the House of Representatives. House of Representatives, Japan
The House of Councillors passed the AI Promotion Act. House of Representatives, Japan
The AI Promotion Act (Act No. 53 of 2025) was promulgated and partly took effect. Cabinet Office, Japan
The Act took full effect, including provisions establishing the AI Strategy Headquarters. Cabinet Office, Japan
The Cabinet approved Japan’s first Artificial Intelligence Basic Plan under the Act. Cabinet Office, Japan
The Cabinet approved a revised Artificial Intelligence Basic Plan. Cabinet Office, Japan
APPIJapanLatest: amended 17 Jul 2026The amended Act on the Protection of Personal Information took full effect. Personal Information Protection Commission
The Diet approved the 2020 APPI amendment bill; it was promulgated on 12 June 2020. Personal Information Protection Commission
The 2020 amendments to the APPI took full effect. Personal Information Protection Commission
An APPI amendment Act was promulgated after Diet passage on 10 July 2026, adding administrative fines. A&O Shearman
Strengthened criminal penalties under the 2026 APPI amendments commence; the main reforms follow by 17 July 2028. A&O Shearman
METI AI GuidelinesJapanLatest: amended 31 Mar 2026METI and MIC opened public comment on draft AI Guidelines for Business until 19 February 2024. METI
METI and MIC compiled AI Guidelines for Business version 1.0. METI
MIC and METI published AI Guidelines for Business version 1.1. METI
MIC and METI published version 1.2, extending the guidelines to AI agents and physical AI. METI
HKMA GenAIHong KongLatest: guidance 5 Mar 2026HKMA issued its circular High-level Principles on Artificial Intelligence to authorised institutions. HKMA
HKMA issued consumer protection guiding principles on big data analytics and AI. HKMA
HKMA issued guiding principles on consumer protection in the use of generative AI. HKMA
HKMA, SFC, IA and MPFA launched the GenA.I. Sandbox++ across financial sectors. HKMA
PCPD AI guidanceHong Kong · tracked here, not mapped in the platformLatest: guidance 31 Mar 2025The PCPD issued the Guidance on the Ethical Development and Use of Artificial Intelligence. PCPD
The PCPD issued Artificial Intelligence: Model Personal Data Protection Framework for organisations procuring and using AI. PCPD
The PCPD published the Checklist on Guidelines for the Use of Generative AI by Employees. PCPD
Interim Measures for the Management of Generative AI ServicesChina · tracked here, not mapped in the platformLatest: in force 15 Aug 2023The CAC published draft Measures for the Management of Generative AI Services for comment until 10 May 2023. Cyberspace Administration of China
The CAC and six other departments issued the Interim Measures for the Management of Generative AI Services (Order No. 15). Cyberspace Administration of China
The Interim Measures for the Management of Generative AI Services took effect. Cyberspace Administration of China
Measures for Labelling AI-Generated and Synthetic ContentChina · tracked here, not mapped in the platformLatest: in force 1 Sep 2025The CAC published draft labelling measures for AI-generated and synthetic content for comment until 14 October 2024. Cyberspace Administration of China
Mandatory national standard GB 45438-2025 on labelling methods for AI-generated content was published. State Administration for Market Regulation
The CAC, MIIT, Ministry of Public Security and NRTA issued the Measures for Labelling AI-Generated and Synthetic Content. Cyberspace Administration of China
The labelling Measures and standard GB 45438-2025 took effect, requiring explicit and implicit labels. Cyberspace Administration of China
PIPLChinaLatest: in force 1 Nov 2021The NPC Standing Committee released the first draft of the Personal Information Protection Law for comment. Covington & Burling
The NPC Standing Committee adopted the Personal Information Protection Law. National People’s Congress
The Personal Information Protection Law came into force. National People’s Congress
AI Ethics PrinciplesSaudi Arabia · available, mapped at onboardingLatest: amended May 2025SDAIA opened public consultation on draft AI Ethics Principles until 1 September 2022. Digital Policy Alert
SDAIA published the first edition of the AI Ethics Principles. SDAIA
SDAIA issued the AI Ethics Principles 2025 (document SDAIA-P114E). SDAIA
NCA Essential Cybersecurity ControlsSaudi Arabia · available, mapped at onboardingLatest: amended 2024The National Cybersecurity Authority issued the Essential Cybersecurity Controls, ECC-1:2018. National Cybersecurity Authority
NCA issued the updated Essential Cybersecurity Controls, ECC-2:2024, replacing ECC-1:2018. National Cybersecurity Authority
Personal Data Protection Law (PDPL)Saudi Arabia · available, mapped at onboardingLatest: in force 14 Sep 2024Royal Decree M/19 approved the Personal Data Protection Law. CMS Expert Guide
Royal Decree M/148 amended the PDPL and moved its effective date to 14 September 2023. CMS Expert Guide
The PDPL Implementing Regulations and the Regulation on Personal Data Transfer were issued. CMS Expert Guide
The Personal Data Protection Law came into force, with a one-year grace period. SDAIA
The compliance grace period ended and the PDPL became fully enforceable. SDAIA
SAMA Cyber Security FrameworkSaudi Arabia · available, mapped at onboardingLatest: adopted May 2017SAMA issued Cyber Security Framework version 1.0 to its regulated member organisations. SAMA Rulebook
ADGM Data Protection Regulations 2021United Arab Emirates · available, mapped at onboardingLatest: amended 4 Aug 2021DIFC Data Protection Law 2020 and Regulation 10United Arab Emirates · available, mapped at onboardingLatest: amended 2025DIFC Data Protection Law No. 5 of 2020 came into force. DIFC
DIFC Laws Amendment Law No. 2 of 2022 amended the Data Protection Law. DIFC
DIFC announced amended Data Protection Regulations, including Regulation 10 on autonomous and semi-autonomous systems. DIFC
DIFC Laws Amendment Law No. 1 of 2025 amended the Data Protection Law (consolidated July 2025). DIFC
Federal Decree-Law No. 45 of 2021 (PDPL)United Arab Emirates · available, mapped at onboardingLatest: in force 2 Jan 2022Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data was issued. DLA Piper Data Protection Laws of the World
The UAE Personal Data Protection Law came into force. UAE Government Portal
Personal Data Privacy Protection Law (Law No. 13 of 2016)Qatar · available, mapped at onboardingLatest: guidance Sep 2022Qatar adopted Law No. 13 of 2016 on Protecting Personal Data Privacy, the first such GCC law. DLA Piper Data Protection Laws of the World
The National Cyber Security Agency first published its PDPPL guidelines for regulated entities. National Cyber Security Agency, Qatar
NCSA updated its PDPPL guidelines for regulated entities. National Cyber Security Agency, Qatar
Personal Data Protection Law (Law No. 30 of 2018)Bahrain · available, mapped at onboardingLatest: in force 1 Aug 2019Bahrain issued Law No. 30 of 2018 with respect to Personal Data Protection. Personal Data Protection Authority, Bahrain
Bahrain’s Personal Data Protection Law came into effect. Personal Data Protection Authority, Bahrain
Personal Data Protection Law (Royal Decree 6/2022)Oman · available, mapped at onboardingLatest: in force 5 Feb 2026Royal Decree 6/2022 promulgated Oman’s Personal Data Protection Law. Ministry of Transport, Communications and IT, Oman
Royal Decree 6/2022 was published in Official Gazette issue 1429. Decree.om
Executive Regulations were issued under Ministerial Decision No. 34/2024. CMS
The extended compliance transition period ended and the PDPL became fully enforceable. CMS
AI Basic ActSouth Korea · on the platform roadmapLatest: in force 22 Jan 2026The National Assembly passed the Basic Act on the Development of Artificial Intelligence and the Establishment of Trust. Ministry of Science and ICT
The AI Basic Act was promulgated, with a one-year lead time before taking effect. Ministry of Science and ICT
MSIT gave legislative notice of the draft Enforcement Decree for comment until 22 December 2025. Ministry of Science and ICT
The AI Basic Act and its Enforcement Decree came into force, with a grace period of at least one year before fines. Ministry of Science and ICT
Personal Data Protection Law (Law No. 27 of 2022)Indonesia · on the platform roadmapLatest: adopted 16 Jul 2026The House of Representatives (DPR) approved the Personal Data Protection Bill in plenary session. Kompas
Law No. 27 of 2022 was signed and promulgated, taking effect that day with a two-year adjustment period. JDIH Kementerian Komunikasi dan Digital
The two-year period for controllers and processors to conform with the Law ended. CMS
Government Regulation No. 33 of 2026, implementing the PDP Law, was signed by the President. HLC
Government Regulation No. 33 of 2026 takes effect, six months after enactment. Nusantara DFDL
Cyber Security and Resilience (Network and Information Systems) BillUnited Kingdom · tracked here, not mapped in the platformLatest: proposed 14 Jul 2026The Bill was introduced and read a first time in the House of Commons. UK Parliament
The Commons gave the Bill a second reading and passed a carry-over motion. UK Parliament
The Bill was reintroduced in the new parliamentary session. UK Parliament
The Bill completed its Commons report stage and third reading. UK Parliament
The House of Lords gave the Bill a second reading. UK Parliament
Data (Use and Access) Act 2025United Kingdom · tracked here, not mapped in the platformLatest: in force 5 Feb 2026The government introduced the Data (Use and Access) Bill in the House of Lords. Clifford Chance
The Data (Use and Access) Act 2025 (c. 18) received Royal Assent. legislation.gov.uk
Stage 1 commencement brought in technical provisions and new statutory objectives for the ICO. Department for Science, Innovation and Technology
Most data protection and privacy provisions in Part 5, which amends UK GDPR, came into force. Department for Science, Innovation and Technology
UK pro-innovation approach to AI regulationUnited Kingdom · tracked here, not mapped in the platformLatest: proposed 21 Oct 2025The government published the AI regulation white paper, A pro-innovation approach, for consultation until 21 June 2023. Department for Science, Innovation and Technology
The government’s consultation response confirmed a context-based approach that avoids blanket rules for all AI technologies. Department for Science, Innovation and Technology
The government published the AI Opportunities Action Plan, with 50 recommendations. Department for Science, Innovation and Technology
DSIT published a blueprint for AI regulation and a call for evidence on AI Growth Lab sandboxes. Department for Science, Innovation and Technology
Brazil AI Bill (PL 2338/2023)Brazil · tracked here, not mapped in the platformLatest: proposed 20 May 2025Senator Rodrigo Pacheco presented PL 2338/2023 on the development and use of artificial intelligence. Senado Federal
The Federal Senate approved PL 2338/2023 in plenary and sent it to the Chamber of Deputies. Senado Federal
The Chamber of Deputies installed a special committee to examine PL 2338/2023. Câmara dos Deputados
Law on Artificial Intelligence (No. 134/2025/QH15)Vietnam · tracked here, not mapped in the platformLatest: in force 1 Mar 2026The National Assembly passed the Digital Technology Industry Law (No. 71/2025/QH15), including provisions on artificial intelligence. Ministry of Science and Technology
The National Assembly passed the Law on Artificial Intelligence (No. 134/2025/QH15). Ministry of Science and Technology
The Digital Technology Industry Law took effect. Ministry of Science and Technology
The Law on Artificial Intelligence took effect, introducing risk-based management of AI systems. Ministry of Science and Technology
Artificial Intelligence and Data Act (Bill C-27)Canada · tracked here, not mapped in the platformLatest: proposed 15 Jun 2026The Government introduced Bill C-27, the Digital Charter Implementation Act, 2022, with the Artificial Intelligence and Data Act as Part 3. Innovation, Science and Economic Development Canada
The House of Commons passed Bill C-27 at second reading and referred it to the Standing Committee on Industry and Technology. DLA Piper
Parliament was prorogued, and Bill C-27, including AIDA, died on the Order Paper at committee stage without becoming law. Privy Council Office
The Minister of Artificial Intelligence and Digital Innovation tabled Bill C-36, the Protecting Privacy and Consumer Data Act, which revives private-sector privacy reform with automated decision-making transparency but does not re-enact AIDA. Innovation, Science and Economic Development Canada
Quebec Law 25 (Act to modernize legislative provisions as regards the protection of personal information)Canada · tracked here, not mapped in the platformLatest: in force 22 Sep 2024Bill 64, which became Law 25, was introduced in the National Assembly of Québec. Assemblée nationale du Québec
Bill 64 received assent as chapter 25 of the Statutes of Québec 2021, the day after its passage. Assemblée nationale du Québec
The first phase commenced, requiring private-sector organisations to notify the Commission d’accès à l’information and affected individuals of confidentiality incidents. Blakes
Most obligations commenced, including the duty in section 12.1 to inform individuals of decisions based exclusively on automated processing of their personal information. McCarthy Tétrault
The right to data portability in a structured, commonly used technological format took effect. Commission d’accès à l’information du Québec
New Zealand Privacy Act 2020 and national AI policyNew Zealand · tracked here, not mapped in the platformLatest: in force 1 May 2026The Privacy Act 2020 came into force, replacing the Privacy Act 1993. Office of the Privacy Commissioner
The Government Chief Digital Officer launched the non-binding Public Service AI Framework to guide safe AI adoption across the Public Service. Department of Internal Affairs
The Government released its first national AI strategy, "Investing with confidence", with voluntary Responsible AI Guidance for Businesses. DLA Piper
The Privacy Amendment Act 2025 received Royal Assent, adding Information Privacy Principle 3A on indirect collection. Ministry of Justice
Information Privacy Principle 3A came into force, requiring agencies that collect personal information indirectly to take reasonable steps to make the individual aware. Ministry of Justice
Artificial Intelligence Basic ActTaiwan · tracked here, not mapped in the platformLatest: in force 14 Jan 2026The Executive Yuan approved the draft Artificial Intelligence Basic Act and sent it to the Legislative Yuan. Executive Yuan
The Legislative Yuan passed the Artificial Intelligence Basic Act on third reading. Ministry of Digital Affairs
The President promulgated the Artificial Intelligence Basic Act by Presidential Order Hua-Zong-Yi-Zi No. 11500001671. Office of the President
The Act took effect on promulgation, with the National Science and Technology Council as the central competent authority. Lee and Li
Each opens the AI Hub with the question ready, answered from the platform knowledge base.
The history shows what changed. These pages show what each framework asks for and how the platform proves it.
Each milestone was read from an official source, such as the regulator, the government gazette or EUR-Lex, and every entry links to it. Where only the month or year could be confirmed, only that is shown.
The history is held with the site and published with every build. Whether a date is still upcoming is worked out in your browser on the day you open the page.
Yes. They are available and mapped to your controls at onboarding, and their milestones are listed here alongside the rest.