Artificial Intelligence Regulation in 2026: A Country-by-Country Tracker

The Brief Script AI Regulation Tracker, October 2026 edition. Original research by The Brief Script.

Two years ago, “AI regulation” mostly meant one law: the EU AI Act. That’s no longer true.

By late October 2026, South Korea, Vietnam, Kazakhstan, Taiwan and Peru had all brought national AI frameworks into force. China added an AI article to its Cybersecurity Law. Of the US states we track, four have binding AI laws in effect and three more have passed laws that start in 2027. Meanwhile the EU delayed its own toughest rules, Washington is trying to stop the states, and the UK, Australia, Singapore and the Gulf states still have no AI-specific law at all.

So we built a tracker. We checked artificial intelligence regulation in 25 jurisdictions (19 national or supranational, plus six US states) against official sources: statute books, government gazettes, legislature bill pages and regulators’ own announcements, all read on October 27, 2026. For each one we recorded the law, its status, its approach, the deadlines, the maximum penalty and who enforces it. Then we scored every jurisdiction on one transparent scale, the Brief Script AI Regulation Strictness Index, and tried to break our own result.

This is a reference page, not a news feed. For the week-to-week developments, see our AI policy news tracker.

Key takeaways

• The EU is still the strictest AI regime in the world. It scores 100 out of 100 on our index and comes first under every weighting we tried, including 10,000 random ones. China (78.5), Italy’s national AI law (76.5), Kazakhstan (70) and New York (67) follow.
• AI regulation by country is now a three-way split. 12 of 25 jurisdictions have binding AI rules with real obligations in force today, 5 have passed or proposed laws that aren’t in force yet, and 8 rely on voluntary guidance or promotion-only laws.
• Six major economies score just 3 out of 100: the United States (federal), the United Kingdom, Australia, Singapore, the UAE and Saudi Arabia. None has an AI-specific law with binding duties.
• The US is regulated by its states. The six states we tracked average 55.9 on our index, versus 3 for the federal government. No federal law overriding them has passed, despite a December 2025 executive order aimed at “onerous” state laws.
• The EU blinked. The Digital Omnibus pushed high-risk AI obligations back from August 2, 2026 to December 2, 2027 (16 months), and product-embedded AI to August 2, 2028.
• January 1, 2027 is the busiest day on the calendar. Five obligations start that day in Colorado, New York, Illinois, Connecticut and California. In total we count 16 dated AI compliance deadlines between now and the end of 2027.
• Fines span four orders of magnitude, from Utah’s $2,500 per violation to the EU’s €35 million or 7% of global turnover.

The short answer: is AI regulated, and where?

Yes, but unevenly. There’s no global AI law. What exists is a patchwork of four models:

1. Comprehensive, risk-based laws that cover AI across the economy and put the heaviest duties on “high-risk” uses: the EU, South Korea, Vietnam, Kazakhstan and Peru, with Brazil’s bill waiting.
2. Targeted rules for particular technologies or uses: China’s generative AI and labelling rules, India’s deepfake-labelling rules, and US state laws on frontier models, hiring tools, chatbots and consumer disclosure.
3. Promotion laws that set up a national AI strategy without binding duties on companies: Japan and Taiwan.
4. Voluntary frameworks and existing law only: the UK, the US federal government, Australia, Singapore, the UAE and Saudi Arabia.

AI regulation by country: the 2026 tracker

Each row is sourced to the official page linked in the last column, as read on October 27, 2026; figures we could confirm only from secondary reporting are marked †. “In force” means binding rules apply today; “passed” means the law is enacted but its main duties start later; “proposed” means a bill is pending; “voluntary” means guidance or policy only. Penalties are the statutory maximum for a single violation.

Jurisdiction	Main law or framework	Status	Approach	Key 2026–27 dates	Max penalty	Enforcer	Source
European Union	EU AI Act + Digital Omnibus (Reg. 2026/1744)	In force	Risk-based	Dec 2, 2026; Dec 2, 2027; Aug 2, 2028	€35M or 7% of turnover	AI Office + national authorities	Official source
China	GenAI Measures, labelling rules, amended Cybersecurity Law	In force	Technology-specific	In force (CSL amendment Jan 1, 2026)	RMB 10M	Cyberspace Administration of China	Official source
Italy	Law 132/2025 on AI	In force	Principles + sector rules	In force Oct 10, 2025	Prison 1–5 yrs (deepfakes); up to €6M fine	AgID, ACN	Official source
Kazakhstan	Law “On Artificial Intelligence”	In force	Risk-based	In force Jan 18, 2026	Admin fines†	Ministry of AI and Digital Development	Official source
New York	RAISE Act	Passed	Frontier models	Registration Nov 2026; Jan 1, 2027	$1M; $3M repeat	Attorney General; DIGIT (DFS)	Official source
California	SB 53 (Transparency in Frontier AI Act)	In force	Frontier models	In force Jan 1, 2026	$1M per violation	Attorney General	Official source
Vietnam	Law on AI (134/2025/QH15)	In force	Risk-based	In force Mar 1, 2026; legacy systems Mar 1 / Sep 1, 2027	Set by decree	Ministry of Science and Technology	Official source
Illinois	SB 315 (AI Safety Measures Act)	Passed	Frontier models	Jan 1, 2027; audits Jan 1, 2028	$1M; $3M repeat	Attorney General; IEMA-OHS	Official source
South Korea	AI Basic Act	In force	Risk-based (high-impact)	In force Jan 22, 2026; fines deferred 1 yr+	KRW 30M	Ministry of Science and ICT	Official source
Texas	HB 149 (TRAIGA)	In force	Prohibited uses	In force Jan 1, 2026	$200k per violation; $40k/day	Attorney General	Official source
Peru	Law 31814 + DS 115-2025-PCM	In force	Risk-based	In force Jan 2026; public-sector phases to 2028	None AI-specific	Presidency of the Council of Ministers	Official source
Colorado	SB 26-189 (ADMT Act)	Passed	Consequential decisions	Jan 1, 2027	Consumer Protection Act penalties†	Attorney General	Official source
Connecticut	Public Act 26-15 (SB 5)	In force	Sector/use-specific	Oct 1, 2026; Jan 1, 2027	Unfair-trade-practice penalties†	Attorney General	Official source
Utah	AI Policy Act (SB 149/SB 226)	In force	Disclosure	Sunset Jul 1, 2027	$2,500 per violation	Division of Consumer Protection	Official source
India	IT Rules amendments on synthetic content	In force	Content labelling	In force Feb 20, 2026	Loss of safe harbour	MeitY	Official source
Brazil	PL 2338/2023 (bill)	Proposed	Risk-based (proposed)	Chamber vote pending	In bill	Proposed national system	Official source
Canada	None; Bills C-36 and C-34 pending	Proposed	Privacy-law ADM rules (proposed)	Bills pending	Proposed C$25M or 5%	Proposed new Commission	Official source
Japan	AI Promotion Act	In force	Promotion	In force Sep 1, 2025	None	AI Strategy HQ	Official source
Taiwan	AI Basic Act	In force	Promotion	In force Jan 14, 2026; sector rules by Jan 2028	None	NSTC; MODA	Official source
Australia	National AI Plan (no AI law)	Voluntary	Voluntary	Legislation planned 2027	None AI-specific	Existing regulators	Official source
Saudi Arabia	SDAIA principles and risk framework (no AI law)	Voluntary	Voluntary	None	None AI-specific	SDAIA (guidance)	Official source
Singapore	Model AI Governance Frameworks (voluntary)	Voluntary	Voluntary	None	None	IMDA (guidance)	Official source
United Arab Emirates	UAE AI Charter (policy)	Voluntary	Voluntary	None	None AI-specific	—	Official source
United Kingdom	None (non-statutory principles)	Voluntary	Principles (sector regulators)	None	None AI-specific	Existing regulators	Official source
United States (federal)	None (executive orders, voluntary framework)	Voluntary	State-led	None binding	None AI-specific	—	Official source

† Amount not verified on the primary text; see the data download.

US states are scored on state law only. Italy is scored on its national law only; the EU AI Act applies there too. Canada’s and Brazil’s penalties are in bills, so they don’t count in the index.

What we built: the Brief Script AI Regulation Strictness Index

The index asks one question: how much does this jurisdiction’s AI-specific law demand of a company, and how hard can it bite? It scores five pillars out of 100:

Pillar	Points	What goes in it
Legal force	25	25 = binding and enforceable today; 20 = in force but fines deferred or phased in; 18 = enacted, applies later; 8 = promotion law with no enforceable duties; 5 = bill pending; 3 = voluntary guidance; 0 = nothing
Scope	20	20 = economy-wide; 15 = cross-sector “consequential decisions” or all generative AI; 10 = frontier models only; 8 = one sector or use; 6 = content labelling only (+2 if several separate regimes)
Obligations	20	2.5 points each for eight duty types: risk assessment, transparency to users, AI-content labelling, incident reporting, registration or filing, prohibited practices, human oversight or review rights, third-party audit or conformity assessment
Penalties	20	Highest fine per violation: 20 = turnover-based or ≥$10M; 14 = $1M–$10M; 9 = $100k–$1M; 5 = under $100k; 0 = no AI-specific fine
Oversight and reach	15	5 each: a dedicated AI regulator or office; AI-specific enforcement powers; reach over providers based outside the jurisdiction

We score only AI-specific instruments we verified on a primary source. General privacy, consumer or cyber law matters, but it’s the same in every comparison, so it isn’t scored. Proposed bills get half credit for scope and obligations and nothing for penalties or oversight, because they aren’t law. The full coding for every jurisdiction is in the data download.

Rank	Jurisdiction	Score	Band	Legal force	Scope	Obligations	Penalties	Oversight
1	European Union	100	Strict	25	20	20	20	15
2	China	78.5	Strict	25	17	12.5	14	10
3	Italy	76.5	Strict	25	20	7.5	14	10
4	Kazakhstan	70	Strict	25	20	10	5	10
5	New York	67	Substantial	18	10	10	14	15
6	California	66.5	Substantial	25	10	7.5	14	10
7	Vietnam	65	Substantial	25	20	15	0	5
8	Illinois	64.5	Substantial	18	10	12.5	14	10
9	South Korea	62.5	Substantial	20	20	7.5	5	10
10	Texas	52	Substantial	25	8	5	9	5
11	Peru	50	Substantial	20	20	5	0	5
12	Colorado	48	Substantial	18	15	5	5	5
13	Connecticut	47.5	Substantial	25	10	2.5	5	5
14	Utah	45.5	Substantial	25	8	2.5	5	5
15	India	41	Light	25	6	5	0	5
16	Brazil	17.5	Light	5	10	2.5	0	0
17	Canada	13.8	Minimal	5	7.5	1.25	0	0
18	Japan	8	Minimal	8	0	0	0	0
18	Taiwan	8	Minimal	8	0	0	0	0
20	Australia	3	Minimal	3	0	0	0	0
20	Saudi Arabia	3	Minimal	3	0	0	0	0
20	Singapore	3	Minimal	3	0	0	0	0
20	United Arab Emirates	3	Minimal	3	0	0	0	0
20	United Kingdom	3	Minimal	3	0	0	0	0
20	United States (federal)	3	Minimal	3	0	0	0	0

Finding 1: The EU is still the high-water mark, even after its retreat

The EU AI Act is the only regime in our tracker that maxes out every pillar: economy-wide scope, all eight duty types, fines of up to €35 million or 7% of global turnover, a dedicated regulator (the European AI Office) and rules that reach providers outside the EU.

It’s also the regime that just moved its own goalposts. The AI Act entered into force on August 1, 2024. Bans on “unacceptable” AI and an AI-literacy duty applied from February 2, 2025, and duties for general-purpose AI models from August 2, 2025. Most of the Act became applicable on August 2, 2026.

But the high-risk rules, the heaviest part, were delayed. The Digital Omnibus on AI (Regulation (EU) 2026/1744) was agreed on May 7, adopted by the Council on June 29, published on July 24 and entered into force on July 27, 2026. It moves:

• High-risk AI in areas like hiring, credit, education and law enforcement (Annex III) from August 2, 2026 to December 2, 2027.
• High-risk AI built into regulated products (Annex I), such as machinery and medical devices, from August 2, 2027 to August 2, 2028.
• AI-content marking for systems already on the market before August 2, 2026, to December 2, 2026.

It also added a rule: a ban on AI systems that generate non-consensual intimate images or child sexual abuse material, from December 2, 2026. And it extended small-business simplifications to “small mid-caps”.

The EU wins under every alternative weighting we tested, and in all 10,000 random ones. Even if you drop the penalties pillar entirely, it stays first.

What this means: If you sell AI in Europe, the delay buys time on high-risk systems, not on everything. Bans, AI literacy, general-purpose AI duties and transparency rules already apply. Use the extra 16 months to finish risk classification and documentation, not to pause.

Finding 2: Asia is where the new laws are being written

Of the seven national AI laws in our tracker that took effect since mid-2025, five are in Asia. They don’t copy the EU.

South Korea’s AI Basic Act took effect on January 22, 2026, four days after Kazakhstan’s comprehensive AI law. It targets “high-impact” AI in areas such as healthcare, energy, recruitment, credit and education, requires notice when people are dealing with generative AI, and makes large foreign providers appoint a local representative. But the maximum fine is only KRW 30 million (about $21,000), and the science ministry has promised a grace period of at least a year before it investigates or fines anyone. That’s why Korea scores 62.5, not higher.

Vietnam’s Law on Artificial Intelligence took effect on March 1, 2026. It sorts AI into low, medium and high risk, makes providers classify their own systems and notify them through a national portal, and requires conformity checks for high-risk AI. There’s no licence to apply for, but systems already in use must comply by March 1, 2027, or September 1, 2027 in healthcare, education and finance. Fines are left to a government decree, which is why Vietnam scores zero on penalties.

China has no single AI act. Instead it stacks targeted rules: interim measures for generative AI services (in force since August 15, 2023), mandatory labelling of AI-generated content (since September 1, 2025) and, since January 1, 2026, an amended Cybersecurity Law with its first article on AI. That amendment also raised the top fine to RMB 10 million (about $1.4 million) for the most serious breaches. China scores 78.5, second only to the EU, mainly because its rules are already enforced and cover every public-facing generative AI service.

Japan and Taiwan went the other way. Japan’s AI Promotion Act (fully in force September 1, 2025) and Taiwan’s AI Basic Act (in force January 14, 2026) set up national strategies and principles but impose no binding duties or fines on companies. Both score 8. Taiwan’s regulators have until January 2028 to write sector rules, so that could change.

India regulates AI through its platform rules. Amendments to the IT Rules in force since February 20, 2026 make platforms label “synthetically generated information” and act against unlawful deepfakes. The penalty is losing legal safe-harbour protection, not a fine.

What this means: “Comply with the EU AI Act and you’re covered” no longer works in Asia. Korea wants a local representative and AI notices; Vietnam wants portal notifications and conformity checks; China wants filings and labels. Build one inventory of your AI systems, then map it to each market.

Finding 3: In the US, the states are the regulators

The United States has no federal AI law. As of October 2026, AI is regulated in the US by its states, and Washington is pushing back.

At the federal level, December 2025’s Executive Order 14365 set up a Justice Department task force to challenge state AI laws and told the Commerce Department to list “onerous” ones. A June 2026 order created a voluntary testing framework for frontier models and explicitly ruled out licensing. Congress has not passed a law overriding the states. (For the bigger picture, see our analysis of why AI governance is lagging the technology.)

The states haven’t waited:

• California’s SB 53 has applied since January 1, 2026 to developers of the largest “frontier” models (trained with more than 10²⁶ operations). Large developers must publish a safety framework and report critical safety incidents within 15 days. Fines reach $1 million per violation.
• Texas’s TRAIGA (in force January 1, 2026) bans AI built to manipulate people into self-harm, discriminate or produce child sexual abuse material, with fines of up to $200,000 per uncurable violation.
• New York’s RAISE Act applies from January 1, 2027. Frontier developers must register with a new office inside the state’s financial regulator from November 2026, report incidents within 72 hours and face fines of $1 million, then $3 million.
• Illinois’s AI Safety Measures Act (signed July 6, 2026) applies from January 1, 2027 with the same thresholds and fines, and from 2028 adds something no other US law requires: an annual independent audit.
• Colorado repealed its 2024 AI Act before it ever took effect and replaced it with a narrower law on automated decisions (signed May 14, 2026) that applies from January 1, 2027.
• Connecticut and Utah regulate specific uses: hiring tools and AI companions in Connecticut, and generative AI disclosure in consumer dealings in Utah.

Notice the copy-paste. California, New York and Illinois use the same definitions: a frontier model is one trained with more than 10²⁶ operations, and a “large” developer has more than $500 million in annual revenue. That’s good news for compliance teams: one frontier safety program can cover all three.

What this means: Is AI regulated in the US? Yes, through the states. If you build or deploy AI for US customers, track at least California, Texas, New York, Illinois and Colorado, and assume more states will follow. Don’t plan around federal preemption until Congress actually passes it.

Finding 4: Six big economies are betting on voluntary rules

At the bottom of our index are six economies that together account for a large share of global AI investment: the US (federal), UK, Australia, Singapore, the UAE and Saudi Arabia, all on 3 points.

They aren’t ignoring AI. The UK still applies non-binding principles through existing regulators; the House of Commons Library noted on October 14, 2026 that the UK “does not have any AI-specific regulation or legislation”, and May’s King’s Speech contained no AI bill. Australia dropped its plan for mandatory “guardrails” in its December 2025 National AI Plan, chose existing laws plus a new AI Safety Institute, and has signalled frontier-AI legislation for 2027. Singapore published the world’s first governance framework for agentic AI in January 2026, but it’s voluntary. The UAE has an AI charter, and approved a new AI and Data Authority in June 2026. Saudi Arabia’s data and AI authority published a national AI risk framework in July 2026. Neither Gulf state has an AI statute.

Two more are in the pipeline. Canada’s federal AI bill died in January 2025; in June 2026 it tabled a privacy bill (C-36) with rules on automated decisions and fines of up to C$25 million or 5% of global revenue, plus an online safety bill covering AI chatbots. Brazil’s AI bill passed the Senate in December 2024 and is still waiting for a committee report in the Chamber of Deputies.

What this means: “No AI law” doesn’t mean “no rules.” Privacy, consumer protection, discrimination and product safety laws still apply to AI in all six. Sector regulators, especially in finance, are often stricter than the headline. (See how banking regulators are approaching AI.)

Finding 5: The penalty gap is enormous

Maximum fines for AI-specific breaches range from $2,500 per violation in Utah to €35 million or 7% of worldwide turnover in the EU.

The middle of the range is crowded with frontier-model laws: $1 million in California, $1 million rising to $3 million in New York and Illinois, and RMB 10 million in China. Italy goes further than fines: since October 10, 2025, spreading harmful AI deepfakes there is a crime carrying one to five years in prison.

At the low end, South Korea’s KRW 30 million cap and Kazakhstan’s administrative fines are small for a large company. Vietnam has set no cap in the law at all. Fines are left to a decree.

What this means: Penalty size tells you where enforcers will focus first. The EU, US frontier-model laws and China can produce fines that matter to large companies. Elsewhere, the bigger risk is an order to stop using a system, or reputational damage.

Finding 6: The AI compliance calendar, 2026–2028

We logged every dated obligation in our tracker. Between now and the end of 2027 there are 16; three more fall in 2028.

Date	Jurisdiction	What happens
November 2026	New York	frontier developers begin registering with DIGIT (month announced, no day)
December 2, 2026	European Union	nudification/CSAM AI ban; content marking for pre-Aug 2026 systems
December 10, 2026 (unconfirmed)	Australia	Privacy Act automated-decision transparency (secondary source)
January 1, 2027	Colorado	ADMT Act applies (notices, explanations, human review)
January 1, 2027	New York	RAISE Act compliance; first disclosure statements
January 1, 2027	Illinois	frontier disclosure statement + fee required
January 1, 2027	Connecticut	AI companion safeguards take effect
January 1, 2027	California	first OES/AG annual reports under SB 53
January 22, 2027 (earliest)	South Korea	earliest end of the >=1-year fine grace period
March 1, 2027	Vietnam	AI systems in use before 1 Mar 2026 must comply
July 1, 2027	Utah	AI Policy Act sunset unless renewed
August 2, 2027	European Union	national AI regulatory sandboxes deadline
September 1, 2027	Vietnam	legacy AI systems in health, education and finance must comply
September 2027	Peru	regional governments, EsSalud, public universities (2-year phase)
October 1, 2027 (unconfirmed)	Connecticut	workplace AI employee-notice requirement (secondary source)
December 2, 2027	European Union	Annex III high-risk AI obligations apply (was 2 Aug 2026)
January 1, 2028	Illinois	frontier AI framework + annual third-party audit
January 2028	Taiwan	regulators must finish adapting laws (2-year mandate)
August 2, 2028	European Union	Annex I high-risk AI in regulated products (was 2 Aug 2027)

What this means: Plan around three dates: December 2, 2026 (EU content marking and new ban), January 1, 2027 (five US state obligations) and December 2, 2027 (EU high-risk rules). Most organisations will need their AI inventory, risk classification and incident process working before the first.

What this means for businesses: an AI compliance playbook

The details differ by country, but the work is surprisingly similar. Here’s what we’d do, in order.

1. Build an AI inventory. List every AI system you build, buy or embed, where it’s used, and which countries and US states its users are in. Every regime in our tracker starts here, and you can’t classify what you can’t see.
2. Classify by risk, once. Map each system to the EU’s categories (prohibited, high-risk, transparency-only, minimal), then translate: Korea’s “high-impact”, Vietnam’s three risk tiers, Colorado’s “consequential decisions”. One classification, many labels.
3. Find your frontier exposure. If you train models above 10²⁶ operations, or have more than $500 million in revenue and train large models, California applies now, and New York and Illinois from January 2027. Publish one safety framework that meets all three.
4. Label AI content. The EU (December 2026 for older systems), China, India, Kazakhstan and Korea all require some form of AI-content disclosure or machine-readable marking. Pick a provenance standard and apply it everywhere.
5. Set up incident reporting. Deadlines range from 72 hours (New York, Illinois) to 15 days (California). Build one process with the shortest clock.
6. Tell people when they’re dealing with AI. Transparency to users is the most common obligation in our tracker (13 of 25 jurisdictions), from Utah to Korea to the EU.
7. Keep humans in consequential decisions. Hiring, credit, housing, insurance and healthcare decisions draw human-review and explanation duties in the EU, Colorado and Italy, and Vietnam requires a human to make the final call.
8. Appoint local representatives where required. Korea requires them for large foreign providers; the EU for non-EU providers of general-purpose and high-risk AI.
9. Watch the pipeline. Brazil’s bill, Canada’s C-36, Australia’s 2027 plans and any federal US move could change your obligations within a year.
10. Make governance someone’s job. Assign an owner, a board-level report and an audit trail. Our AI audit checklist and enterprise AI governance guide are good starting points.

The bottom line

Artificial intelligence regulation in 2026 is no longer a story about Brussels alone. The EU remains the strictest regime by a wide margin, but its toughest rules are now 16 months further away. The real momentum is in Asia, where Korea, Vietnam and Kazakhstan put comprehensive laws into force this year, and in US state capitals, where frontier-model rules are converging on the same thresholds and penalties.

The biggest unknown is Washington. If Congress pre-empts state AI laws, the US column of this tracker could be wiped out overnight. If it doesn’t, January 1, 2027 will be the day AI compliance became a national issue in the US.

We’ll update this tracker as laws change.

Methodology

Scope. 25 jurisdictions: the EU and 18 countries chosen for economic weight in AI, regional coverage and legislative activity, plus six US states with the most significant enacted AI laws (California, Colorado, Texas, New York, Illinois, Connecticut) and Utah as the earliest disclosure law. Italy is included as the first EU member state with its own national AI law.

Verification. Every row was checked on October 27, 2026 against at least one primary or official source: the EU’s Official Journal and Commission pages, national gazettes and statute databases (Gazzetta Ufficiale, Korea’s National Law Information Center, Japan’s Cabinet Office, Taiwan’s NSTC law database, Kazakhstan’s government portal, Peru’s gob.pe), legislature bill pages (California, Texas, New York, Illinois, Colorado, Connecticut, Utah, Brazil’s Chamber of Deputies), and official ministry or regulator announcements (MSIT, MeitY/PIB, CAC, Vietnam’s Ministry of Science and Technology, IMDA, SDAIA via the Saudi Press Agency, ISED Canada, NY DFS). For a few rows (Singapore, the UAE, Saudi Arabia, Australia, Utah, Peru and parts of Japan and Taiwan) we relied on official pages as indexed by search rather than a full read, because the sites blocked or timed out our requests. Where a figure came only from a secondary source, it’s marked in the data and excluded from scoring or scored conservatively.

Scoring. See the pillar table above. A jurisdiction’s score covers its own AI-specific instruments; general privacy, consumer, cyber and sector law isn’t scored. Bills get half credit for scope and obligations and zero for penalties and oversight. Penalties are converted to US dollars at indicative rates (EUR 1.10, RMB 0.14, KRW 0.0007) for banding only. Bands: 70+ Strict, 45–69.9 Substantial, 15–44.9 Light, under 15 Minimal.

Robustness. We re-scored the index under six alternative weightings (equal weights, legal force doubled, penalties doubled, obligations doubled, no penalties pillar, no oversight pillar) and 10,000 random weightings. The EU ranks first in all of them. China and Italy finish in the top five in 98% and 93% of random weightings; Kazakhstan in 60% and New York in 52%. The middle of the table (ranks 5–12) moves more: Vietnam ranks third if penalties are ignored and ninth if they’re doubled.

Limitations.

• The index measures what the law says, not how it’s enforced. China’s rules are actively enforced; Korea has deferred fines; many US state laws have no enforcement record yet.
• Italy and US states are scored on their own layer only. A company in Milan also faces the EU AI Act; one in Austin also faces federal sector law.
• Some figures are unverified on primary text: Colorado’s per-violation penalty, Connecticut’s unfair-trade-practice penalty, Kazakhstan’s fine levels, Australia’s December 2026 automated-decision rule and Connecticut’s October 2027 employee-notice date. These are flagged in the data.
• Coverage is a snapshot. Laws are moving fast. This edition reflects sources read on October 27, 2026.

Download the data

Free to reuse with attribution (CC-BY 4.0).

• briefscript_ai_regulation_tracker.csv: all 25 jurisdictions with law, status, approach, key dates, 2026–27 deadlines, maximum penalty, enforcer and primary source URLs.
• briefscript_ai_regulation_index_coding.csv: the index coding for every jurisdiction, with a rationale for each.
• briefscript_ai_regulation_index_scores.csv: pillar scores, totals, ranks and bands.
• briefscript_ai_regulation_deadlines.csv: every dated compliance deadline, with precision flags.

Cite this report: The Brief Script, “The Brief Script AI Regulation Tracker,” October 2026. thebriefscript.com/artificial-intelligence-regulation/

FAQ

What is AI regulation?

AI regulation is law or binding rules that govern how artificial intelligence is built, sold and used. It usually covers risk assessment, transparency (telling people when they’re dealing with AI or AI-generated content), bans on harmful uses, human oversight of important decisions, incident reporting and penalties. Some countries regulate AI with one comprehensive law, like the EU AI Act; others use targeted rules or voluntary guidelines.

Which countries regulate AI?

As of October 27, 2026, binding AI-specific rules with real obligations are in force in the European Union (and Italy at national level), China, South Korea, Vietnam, Kazakhstan, Peru and India, plus US states including California, Texas, Connecticut and Utah. Japan and Taiwan have AI laws that promote AI without binding duties. The UK, Australia, Singapore, the UAE and Saudi Arabia rely on voluntary guidance and existing law.

Is AI regulated in the US?

Not by a federal AI law. As of October 2026, Congress hasn’t passed one, and federal policy relies on executive orders and voluntary frameworks. AI is regulated by the states instead: California and Texas laws took effect on January 1, 2026, and New York, Illinois and Colorado laws start on January 1, 2027. General federal laws on consumer protection, discrimination and privacy still apply to AI.

What are the EU AI Act deadlines?

The AI Act entered into force on August 1, 2024. Bans and AI-literacy duties apply from February 2, 2025; general-purpose AI model rules from August 2, 2025; and most of the Act from August 2, 2026. After the 2026 Digital Omnibus, the ban on nudification and child-abuse AI and marking rules for older systems apply from December 2, 2026; high-risk AI in Annex III areas from December 2, 2027; and high-risk AI in regulated products from August 2, 2028.

What are the penalties under the EU AI Act?

Up to €35 million or 7% of worldwide annual turnover, whichever is higher, for using prohibited AI practices, and up to €15 million or 3% for most other breaches.

Which country has the strictest AI laws?

On our index, the European Union, with a score of 100. Among individual countries, China (78.5) is the strictest, followed by Italy’s national law (76.5) and Kazakhstan (70). In the US, New York (67) and California (66.5) are the strictest states we tracked.