⚖️ AI Policy Tracker

Risk-based rules for AI systems: bans on unacceptable-risk uses (live), GPAI/foundation-model duties (live since Aug 2025), high-risk system requirements next.

Who must care: Anyone selling AI products/features into the EU, model providers above compute thresholds.

Next: High-risk system obligations — August 2026

No comprehensive federal AI law; policy moves through executive orders, NIST AI RMF, and agency enforcement (FTC on deceptive AI claims).

Who must care: Federal contractors, companies making AI marketing claims.

Next: Watch FTC enforcement actions and NIST framework updates

Colorado: duties for high-risk AI in consequential decisions (effective 2026). California: transparency and training-data disclosure laws. More states following.

Who must care: AI used in hiring, lending, housing, insurance decisions for US consumers.

Next: Colorado AI Act effective June 2026

Digital Personal Data Protection Act governs training/usage data; MeitY advisories ask platforms to label under-tested models and prevent unlawful content.

Who must care: Anyone processing Indian users’ personal data; consumer AI deployments in India.

Next: DPDP rules implementation milestones through 2026

Generative AI services need security assessment and filing; synthetic content must be labeled (explicit + implicit watermarks since Sept 2025).

Who must care: Any generative AI service reachable from mainland China.

Next: Ongoing enforcement; algorithm filing requirements

No AI statute; sector regulators apply principles, AI Security Institute evaluates frontier models. Copyright/AI consultation ongoing.

Who must care: Frontier labs (AISI evals), AI products in regulated UK sectors.

Next: Copyright & AI legislation outcome

First binding international AI treaty (human rights, democracy, rule of law) — signed by EU, US, UK and others; ratifications pending.

Who must care: Signal of where national law converges next.

Next: National ratifications