AI Regulation Tracker: What Applies, When, and to Whom
Last reviewed 19 October 2026. 35 rules tracked, 4 withdrawn or revoked. Each row shows when it was last checked against its source.
In October 2026 we fact-checked the six regulation posts on this site against the official texts. Every one had been carefully researched when it was written. Several were wrong anyway. One described reporting duties from a US executive order that had been revoked twenty-one months earlier. One listed Colorado's AI law as enforceable when it had never taken effect. One told smaller generative AI providers they were outside California's transparency law, weeks after California removed the threshold that had let them out.
None of those were research failures. They were format failures. A dated post is right on the day it is published, and regulation keeps moving: the EU pushed its main high-risk deadline back sixteen months in 2026, and California amended its AI transparency law in 2025 and again in 2026. A post can't tell you it has gone stale.
So this page works differently. Each rule gets one row: what it requires in plain English, when it applies, its status, a link to the primary source, and the date we last checked that row against the source. Rows we haven't re-checked in 90 days get flagged for review. When a rule changes, we change the row and note it in the change log at the bottom.
This is a working reference for teams planning AI delivery, not legal advice. When a date or duty decides a real commitment, read the source and talk to counsel.
How to read the tracker
Applies means the duty is in force now. Coming means it is law with a future start date. Draft means an official document exists but isn't final.
Applies from is the date the duty starts, not the date the law was passed.
Last checked is the date we last compared the row with its source. Rows marked secondary rest on a reputable secondary source because the official text couldn't be opened; treat them with more care.
Rules that were withdrawn or revoked are listed separately, because the posts and vendor decks that still cite them haven't gone away.
What changes next
Date | Where | What starts |
2 December 2026 | EU | New AI Act bans: generated non-consensual intimate imagery and child sexual abuse material |
2 December 2026 | EU | AI Act content marking for generative systems already on the market |
9 December 2026 | EU | EU product liability covers software, including AI |
1 January 2027 | California | California provenance display and anti-stripping rules (AB 2713) |
1 January 2027 | Colorado | Colorado automated-decision duties (SB 26-189) |
1 July 2027 | California | California rules on automated decisions in employment (SB 947) |
2 August 2027 | EU | AI regulatory sandbox in every EU Member State |
2 December 2027 | EU | AI Act high-risk duties for Annex III uses (employment, credit, education and others) |
2 December 2027 | EU | AI Act Annex III exemption assessment and registration |
2 December 2027 | EU | AI Act fundamental-rights impact assessments |
2 August 2028 | EU | AI Act high-risk duties for AI in regulated products |
2 August 2030 | EU | Deadline for existing high-risk systems used by public authorities |
EU AI Act
The AI Act is Regulation (EU) 2024/1689, as amended by the Digital Omnibus, Regulation (EU) 2026/1744. Dates below are the amended ones.
Rule | What it requires | Applies from | Status | Last checked |
AI Act, Regulation (EU) 2024/1689: entry into force | In force, with obligations applying in stages under Art. 113. | 1 August 2024 | Applies | 19 October 2026 |
AI Act Art. 5: prohibited practices | Bans include social scoring, manipulative techniques that cause significant harm, and most real-time remote biometric identification in public spaces for law enforcement. | 2 February 2025 | Applies | 19 October 2026 |
AI Act Art. 4: AI literacy | Providers and deployers must take measures to support the AI literacy of their staff. Since the Omnibus rewrite (27 July 2026) no specific level of literacy is required. | 2 February 2025 | Applies | 19 October 2026 |
General-Purpose AI Code of Practice | A voluntary code that general-purpose model providers can sign to show they meet their AI Act duties. The Commission confirmed it as adequate on 1 August 2025. | 1 August 2025 | Applies | 19 October 2026 |
AI Act Arts 53-55: general-purpose AI models | Providers of general-purpose models must keep technical documentation, publish a training-content summary and have a copyright policy; models with systemic risk carry extra evaluation and incident-reporting duties. Models on the market before 2 August 2025 have until 2 August 2027. | 2 August 2025 | Applies | 19 October 2026 |
AI Act Art. 99: penalties | Prohibited practices: up to EUR 35 million or 7% of turnover. Most other obligations, including deployer and transparency duties: up to EUR 15 million or 3%. Incorrect information: up to EUR 7.5 million or 1%. Whichever is higher, except for SMEs and small mid-caps, where it is whichever is lower. | 2 August 2025 | Applies | 19 October 2026 |
Digital Omnibus on AI, Regulation (EU) 2026/1744 | Amends the AI Act: moves the high-risk dates, adds two prohibitions, softens the AI literacy duty, extends SME penalty relief to small mid-caps. Published in the Official Journal on 24 July 2026. | 27 July 2026 | Applies | 19 October 2026 |
AI Act Art. 6(1a), added by the Omnibus | AI used only for non-safety functions of a product (user assistance, performance optimisation, efficiency, convenience, quality control) is not a safety component. | 27 July 2026 | Applies | 19 October 2026 |
AI Act Art. 101: Commission fines on GPAI providers | The Commission can fine general-purpose model providers up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher. | 2 August 2026 | Applies | 19 October 2026 |
AI Act Art. 50: transparency | Tell people when they are interacting with an AI system; mark synthetic content in a machine-readable way; disclose deepfakes and emotion recognition. Not moved by the Omnibus. | 2 August 2026 | Applies | 19 October 2026 |
AI Act Art. 5(1)(ba)-(bb), added by the Omnibus | New bans on AI systems that generate non-consensual intimate imagery of identifiable people or child sexual abuse material, where that is the intended purpose or a foreseeable outcome without adequate safeguards. | 2 December 2026 | Coming | 19 October 2026 |
AI Act Art. 111(4): marking for generative systems already on the market | Generative systems placed on the market before 2 August 2026 get until 2 December 2026 to meet the Art. 50(2) marking duty. | 2 December 2026 | Coming | 19 October 2026 |
AI Act Art. 57: regulatory sandboxes | Each Member State must have at least one AI regulatory sandbox operating. Moved from 2 August 2026 by the Omnibus. | 2 August 2027 | Coming | 19 October 2026 |
AI Act high-risk, Annex III (Art. 6(2)) | Risk management, data governance, documentation, logging, human oversight, accuracy and conformity duties for AI used in biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration and justice. Moved from 2 August 2026 by the Omnibus. | 2 December 2027 | Coming | 19 October 2026 |
AI Act Art. 6(3)-(4): the Annex III exemption | An Annex III system is not high-risk if it poses no significant risk and only performs a narrow procedural task, improves a completed human activity, detects patterns without replacing human review, or does preparatory work. A system that profiles people is always high-risk. Document the assessment and register the system. | 2 December 2027 | Coming | 19 October 2026 |
AI Act Art. 27: fundamental-rights impact assessment | Public bodies, private providers of public services, and deployers using AI for credit scoring or life and health insurance pricing must assess fundamental-rights impact before use. The Omnibus lets the assessment reference an existing data-protection impact assessment. | 2 December 2027 | Coming | 19 October 2026 |
AI Act high-risk, Annex I (Art. 6(1)) | The same duties for AI that is, or is a safety component of, a product needing third-party conformity assessment (machinery, medical devices, toys and others). Moved from 2 August 2027 by the Omnibus. | 2 August 2028 | Coming | 19 October 2026 |
AI Act Art. 111(2): high-risk systems already on the market | From the high-risk dates, systems already on the market are covered only if their design changes significantly afterwards. The exception ends for systems used by public authorities, which must comply by 2 August 2030 regardless. | 2 August 2030 | Coming | 19 October 2026 |
Commission guidelines on high-risk classification (Art. 6(5)) | Draft published for consultation on 19 May 2026. No final version yet. | n/a | Draft | 19 October 2026 |
EU: liability and data protection
Rule | What it requires | Applies from | Status | Last checked |
GDPR Art. 22: automated decisions | People have the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects, with limited exceptions and safeguards. A November 2025 Digital Omnibus proposal (COM(2025) 837) would loosen one exception; it is still at committee stage in the European Parliament. | 25 May 2018 | Applies | 19 October 2026 |
Product Liability Directive (EU) 2024/2853 | Software, including AI and software-as-a-service, is a product under no-fault liability. Covers death, personal injury, damage to non-professional property and loss of non-professional data. Courts can order disclosure and presume defect. Member States must transpose by 9 December 2026; applies to products placed on the market after that date. | 9 December 2026 | Coming | 19 October 2026 |
US federal
There is no federal AI statute. Federal policy runs through executive orders and agency enforcement choices, and both have reversed since 2023.
Rule | What it requires | Applies from | Status | Last checked |
Executive Order 14281, disparate impact (April 2025) | Directs federal agencies to deprioritise enforcement of disparate-impact liability, including under Title VII. The statutes themselves are unchanged and private suits continue. | 23 April 2025 | Applies | 19 October 2026 |
Executive Order 14365, national policy framework for AI (December 2025) | Directs a Justice Department task force to challenge state AI laws, a Commerce review of burdensome state laws, funding conditions, and a legislative proposal for federal preemption. The United States joined xAI's challenge to Colorado's law in April 2026. No preemption statute has been enacted. | 11 December 2025 | Applies | 19 October 2026 |
US states and cities
Rule | What it requires | Applies from | Status | Last checked |
California: SB 53 (2025, Ch. 138), Transparency in Frontier AI Act | Frontier model developers must publish transparency reports and report critical safety incidents within 15 days, or 24 hours where there is imminent danger. Large frontier developers (over $500 million in revenue) must also publish a safety framework. Penalties up to $1 million per violation. | 1 January 2026 | Applies | 19 October 2026 |
California: AI Transparency Act (SB 942), as amended by AB 853 (2025) | Generative AI providers must embed latent provenance disclosures in generated content and offer a free tool to check them. Large online platforms and generative AI hosting platforms follow from 1 January 2027, capture-device makers from 1 January 2028. | 2 August 2026 | Applies | 19 October 2026 |
California: SB 1000 (2026), amending the AI Transparency Act | Urgency statute, effective on signature. Removes the one-million-user threshold, so it covers any publicly accessible generative AI provider; renames the detection tool a disclosure verification tool; removes the visible-label option. Assistive-technology carve-out until 1 January 2029. | 30 September 2026 | Applies | 19 October 2026 |
California: AB 2713 (2026, Ch. 856): provenance on platforms | Platforms must, to the extent technically feasible, show provenance data that meets widely adopted standards, including on content downloaded from the platform, and must not knowingly strip it. | 1 January 2027 | Coming | 19 October 2026 |
California: SB 947 (2026, Ch. 859): automated decision systems in employment | General limits on employers' use of automated decision systems. For discipline and termination decisions, a human must corroborate the system's output, and the worker gets notice afterwards and a right to see the data used. Up to $500 per violation. | 1 July 2027 | Coming | 19 October 2026 |
Colorado: x.AI LLC v. Weiser, No. 1:26-cv-01515 (D. Colo.): order of 27 April 2026 | On a stipulation, the court ordered the Attorney General not to start enforcement of SB 24-205 or any replacement enacted that session (which includes SB 26-189) until 14 days after it rules on xAI's preliminary-injunction motion. xAI files that motion within 28 days after the Attorney General's rules are final. No ruling on the merits. The law's duties still start on 1 January 2027. | 27 April 2026 | Applies | 19 October 2026 |
Colorado: SB 26-189: automated decisions in consequential decisions | Covers consequential decisions, including employment and job applications, where the system materially influences the outcome. Developers document systems for deployers. Deployers give notice at the point of interaction, explain an adverse outcome within 30 days, allow data access and correction, offer human review where commercially reasonable, and keep records for 3 years. Attorney General enforcement only, with a 60-day cure period. Enforcement is currently barred by a court order (see the x.AI LLC v. Weiser row). | 1 January 2027 | Coming | 19 October 2026 |
Colorado: Attorney General rules under SB 26-189 | Proposed rules filed 11 August 2026; interim draft published 6 October 2026; comment deadline 26 October 2026. Not final. The rules can refine what counts as materially influencing a decision. | n/a | Draft | 19 October 2026 |
Illinois: AI Video Interview Act (820 ILCS 42) | Notice, explanation and consent before AI analyses a video interview; demographic reporting if AI alone decides who advances. | 1 January 2020 | Applies | 19 October 2026 |
Illinois: Human Rights Act s. 2-102(L), as amended by P.A. 103-0804 | Employers may not use AI that has a discriminatory effect in employment decisions, or use zip codes as a proxy for protected classes, and must give notice of AI use. | 1 January 2026 | Applies | 19 October 2026 |
New York City: Local Law 144 (automated employment decision tools) | An annual independent bias audit of automated hiring and promotion tools, a public summary of results, and notice to candidates. A December 2025 New York State Comptroller audit found the city's enforcement weak. | 5 July 2023 | Applies | 19 October 2026 |
Texas: Texas Responsible AI Governance Act (HB 149) | Prohibits a set of intent-based harmful AI practices; disclosure duties for government agencies and healthcare; Attorney General enforcement with a 60-day cure period; a regulatory sandbox. | 1 January 2026 | Applies | 19 October 2026 |
No longer coming
These were real proposals or rules, and they still turn up in articles, vendor material and policy documents. None of them applies.
EU: AI Liability Directive, proposal COM(2022) 496. Withdrawn. The Commission listed it for withdrawal in February 2025; the withdrawal was published in the Official Journal on 6 October 2025. Fault-based AI claims stay with national law. (Last checked 19 October 2026.)
US federal: Executive Order 14110 (October 2023). Revoked on 20 January 2025 by Executive Order 14148. Its reporting duties for large model training no longer apply. (Last checked 19 October 2026.)
US federal: CFPB Circulars 2022-03 and 2023-03 (adverse action and complex algorithms). Withdrawn in May 2025. Regulation B still requires creditors to give the specific principal reasons for an adverse action. (Last checked 19 October 2026.)
Colorado: SB 24-205, the 2024 Colorado AI Act. Never took effect. Delayed to 30 June 2026, then repealed and reenacted by SB 26-189. (Last checked 19 October 2026.)
Example: an AI résumé screener sold into the EU, Colorado and New York City
A team is building a screening tool that ranks job applicants for its customers' recruiters. Customers are in Germany, Colorado and New York City. Here is how the tracker turns that sentence into a delivery plan.
EU. Employment is an Annex III area, so the screener is high-risk under the AI Act, with the duties starting on 2 December 2027. The Art. 6(3) exemption won't rescue it: a system that ranks applicants profiles people, and profiling is always high-risk. If applicants interact with any part of the system directly, the Art. 50 transparency duty has applied since 2 August 2026. Customers who deploy it carry the Art. 4 AI literacy duty now. From 9 December 2026, the revised Product Liability Directive treats the software as a product, though its scope is death, injury, property and data loss, not a rejected application.
Colorado. SB 26-189 applies from 1 January 2027, and employment is a covered decision when the tool materially influences it, which ranking does. The customer, as deployer, has to give notice at the point of interaction and explain an adverse outcome within 30 days; the team, as developer, has to give the customer the documentation that makes that possible. Enforcement is by the Attorney General only, and a federal court order currently bars it while xAI's challenge to the law proceeds. That is a reason to watch the docket, not to skip the work: the bar lifts 14 days after the court rules.
New York City. Local Law 144 already applies: before a customer uses the tool on New York City candidates, it needs an independent bias audit from the past year, a published summary and candidate notice. That is the first deadline, and it is today.
The plan that falls out has three dates: the bias audit before the first New York customer goes live, the Colorado documentation pack before 1 January 2027, and the EU high-risk work (risk management, data governance, logging, human oversight) scheduled against 2 December 2027. None of that is visible from the product spec. It only shows up when someone asks, during discovery, where the users are and what decisions the system touches.
How to use this in discovery
The cheapest point to find a regulatory duty is before anyone builds. At intake, list the jurisdictions where the system's users and affected people are, and the decisions the system influences. Then pull the matching rows from this page and put each Applies from date into the delivery plan as a dependency, with an owner. Re-check the rows at each phase gate; the Last checked column tells you how fresh they are.
Change log
19 October 2026: Before launch: California AB 853, AB 2713, SB 947 and SB 53 and Illinois P.A. 103-0804 re-checked against the enacted texts; added the federal court order pausing enforcement of Colorado's law, the Colorado Attorney General's draft rules and the GPAI Code of Practice.
19 October 2026: Tracker launched, seeded from the GOV-01 fact-check of the site's regulation posts.
Sources
Every row links to its primary source. Secondary sources are labelled.
AI Act, Regulation (EU) 2024/1689: entry into force. https://eur-lex.europa.eu/eli/reg/2024/1689/oj
Digital Omnibus on AI, Regulation (EU) 2026/1744. https://eur-lex.europa.eu/eli/reg/2026/1744/oj
General-Purpose AI Code of Practice. https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai
Commission guidelines on high-risk classification (Art. 6(5)). https://digital-strategy.ec.europa.eu/en/library/draft-commission-guidelines-classification-high-risk-ai-systems
Product Liability Directive (EU) 2024/2853. https://eur-lex.europa.eu/eli/dir/2024/2853/oj
AI Liability Directive, proposal COM(2022) 496. https://eur-lex.europa.eu/eli/C/2025/5423/oj
GDPR Art. 22: automated decisions. https://eur-lex.europa.eu/eli/reg/2016/679/oj
Executive Order 14110 (October 2023). https://www.federalregister.gov/documents/2025/01/28/2025-01901/initial-rescissions-of-harmful-executive-orders-and-actions
Executive Order 14365, national policy framework for AI (December 2025). https://www.federalregister.gov/documents/2025/12/16/2025-23092/ensuring-a-national-policy-framework-for-artificial-intelligence
Executive Order 14281, disparate impact (April 2025). https://www.federalregister.gov/documents/2025/04/28/2025-07378/restoring-equality-of-opportunity-and-meritocracy
CFPB Circulars 2022-03 and 2023-03 (adverse action and complex algorithms). https://www.federalregister.gov/documents/2025/05/12/2025-08286/interpretive-rules-policy-statements-and-advisory-opinions-withdrawal
AI Transparency Act (SB 942), as amended by AB 853 (2025). https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB853
SB 1000 (2026), amending the AI Transparency Act. https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB1000
AB 2713 (2026, Ch. 856): provenance on platforms. https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB2713
SB 947 (2026, Ch. 859): automated decision systems in employment. https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB947
SB 53 (2025, Ch. 138), Transparency in Frontier AI Act. https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB53
SB 24-205, the 2024 Colorado AI Act. https://leg.colorado.gov/bills/sb26-189
SB 26-189: automated decisions in consequential decisions. https://leg.colorado.gov/laws/session-laws/SB26-189/131/download
x.AI LLC v. Weiser, No. 1:26-cv-01515 (D. Colo.): order of 27 April 2026. https://www.courtlistener.com/docket/73171074/x-ai-llc-v-weiser/
Secondary: x.AI LLC v. Weiser, No. 1:26-cv-01515 (D. Colo.): order of 27 April 2026. https://www.justice.gov/opa/pr/justice-department-intervenes-xai-lawsuit-challenging-colorados-algorithmic-discrimination
Attorney General rules under SB 26-189. https://coag.gov/ai/
Texas Responsible AI Governance Act (HB 149). https://capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&Bill=HB149
Human Rights Act s. 2-102(L), as amended by P.A. 103-0804. https://www.ilga.gov/Legislation/publicacts/view/103-0804
AI Video Interview Act (820 ILCS 42). https://www.ilga.gov/Documents/legislation/ilcs/documents/082000420K5.htm
Local Law 144 (automated employment decision tools). https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page
Secondary: Local Law 144 (automated employment decision tools). https://www.dlapiper.com/en/insights/publications/2026/01/critical-audit-of-nyc-ai-hiring-law-signals-increased-risk-for-employers
Related reading
Keep learning. This page is part of the AI Governance & Responsible AI path in the ShiftQuality Learning Center. Ship AI you can stand behind — fair, transparent, and accountable.
