Regulationsby GlyphAI laws and regulations
Regulations worldwide that deal with AI, with every phased deadline and the official source for each.
Regulations
Add to calendar
EU Consumer Credit Directive 2 (CCD2)Replaces the 2008 Consumer Credit Directive and extends it to buy-now-pay-later and small loans. Creditworthiness assessments must use relevant, accurate data and may not use special category data or social media data. Where the assessment involves automated processing, consumers get a right to human intervention and an explanation.Next: Nov 20 National rules apply · in 24 daysEU AI ActA risk-based product-safety regime for AI. It bans certain AI practices, imposes strict requirements on high-risk AI systems (risk management, data governance, documentation, human oversight, conformity assessment), sets transparency duties for chatbots, deepfakes and AI-generated content, and sets obligations for general-purpose AI model providers. The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27 July 2026) pushed the high-risk dates back to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). It also softened the AI literacy duty and added bans on non-consensual sexual deepfakes and child sexual abuse material (CSAM) generation.Next: Dec 2 New bans on sexual deepfakes and CSAM generation; Art 50(2) grace period ends · in 36 daysEU Platform Work DirectiveFirst EU law on algorithmic management at work. Digital labour platforms may not use automated systems to process emotional, psychological or certain other personal data of platform workers, must be transparent about automated monitoring and decision systems, and must ensure human oversight and human review of significant decisions. It also creates a rebuttable presumption of employment.Next: Dec 2 Transposition deadline · in 36 daysProduct Liability DirectiveModernises EU strict (no-fault) liability for defective products. Software (including AI systems and SaaS), digital manufacturing files and related digital services now count as products. Destruction or corruption of non-professional data is compensable damage, and missing security updates or cybersecurity vulnerabilities can make a product defective. Courts can order evidence disclosure and presume defectiveness in complex cases.Next: Dec 9 Transposition deadline; old PLD repealed · in 43 days
Australia Privacy ActAustralia's federal privacy law (13 Australian Privacy Principles, Notifiable Data Breaches scheme). The 2024 amendment adds a statutory tort for serious invasions of privacy, tiered civil penalties and infringement notices, a mandate for a Children's Online Privacy Code, clearer security duties, and privacy-policy transparency for substantially automated decisions from 10 December 2026. It also adds criminal doxxing offences.Next: Dec 10 Children's Online Privacy Code must be registered · in 44 days
California AI Auditor RegistryCreates a state registry for AI auditors run by the Government Operations Agency. From 2029 only registered auditors may offer, sell or conduct covered AI audits, and they must show their registration number in advertising. Registered auditors must file information and follow conduct rules.Next: Jan 1, 2027 Act takes effect · in 2 monthsCalifornia AI Transparency Act (SB 942)Covered generative AI providers must offer a free AI-content detection tool, give users the option of a visible (manifest) disclosure on AI-generated image, video or audio, and embed a latent, machine-readable provenance disclosure. Licensees must keep those disclosures intact, and providers must revoke a license within 96 hours of learning a licensee disabled them. AB 853 delayed the operative date to August 2, 2026 and extends duties to large online platforms and GenAI hosting platforms from 2027 and to capture-device makers from 2028.Next: Jan 1, 2027 Large online platform and hosting platform duties · in 2 monthsCalifornia SB 53 (TFAIA)Frontier AI developers must publish transparency reports when deploying new or substantially modified frontier models and report critical safety incidents to the Office of Emergency Services (OES). Large frontier developers must also write, implement and publish a frontier AI framework for catastrophic risk, update it annually, and send OES quarterly summaries of their catastrophic-risk assessments. The act also adds whistleblower protections and creates the CalCompute public computing consortium.Next: Jan 1, 2027 First OES anonymized incident report and CDT definition review · in 2 monthsCCPA / CPRAGives California residents (including employees and B2B contacts) rights to know, delete, correct, and opt out of sale/sharing of personal information and to limit use of sensitive personal information. CPPA regulations approved Sept 22, 2025 (effective Jan 1, 2026) add automated decisionmaking technology (ADMT) rights, mandatory risk assessments with submissions to the agency, and annual independent cybersecurity audits. AB 566 (2025) requires browsers to offer an opt-out preference signal from Jan 1, 2027.Next: Jan 1, 2027 ADMT requirements compliance date · in 2 months
Colorado AI ActColorado's 2024 high-risk AI law (risk-management programs, impact assessments) never took effect: it was delayed to June 30, 2026 and then repealed and reenacted by SB 26-189, signed May 14, 2026, as a narrower automated decision-making technology (ADMT) law. From January 1, 2027, developers must give deployers technical documentation (intended uses, training data categories, limitations) and deployers must notify consumers at the point of interaction, explain ADMT's role within 30 days after an adverse outcome, and offer data correction and meaningful human review. Impact-assessment and risk-management-program mandates were dropped; 3-year record retention remains.Next: Jan 1, 2027 ADMT obligations apply · in 2 months
Connecticut Data Privacy Act (CTDPA)Comprehensive privacy law with access, correction, deletion, portability and opt-out rights. PA 25-113 (effective July 1, 2026) sharply lowered applicability thresholds, broadened sensitive data, added profiling impact assessments, and requires disclosure of whether personal data is used to train large language models. PA 26-64 (effective Oct 1, 2026) bans the sale of precise geolocation data and creates a data broker registry (registration required from Jan 1, 2027) and a state deletion mechanism brokers must honor from Oct 1, 2028.Next: Jan 1, 2027 Data broker registration required · in 2 months
NY RAISE ActFrontier AI developers must publish transparency reports when they deploy models and report critical safety incidents to a new DFS oversight office within 72 hours, or within 24 hours to authorities where there is imminent risk of death or injury. Large frontier developers must also publish and annually update a Frontier AI Framework, submit catastrophic-risk assessments, file disclosure statements with DFS every two years, and pay a share of the office's costs. The March 2026 chapter amendment realigned the law closely with California SB 53.Next: Jan 1, 2027 RAISE Act takes effect · in 2 months
Vietnam AI LawVietnam's first standalone AI law (35 articles). It classifies AI systems as high, medium or low risk based on their impact on life, health, rights and public order, requires human oversight, and requires disclosure when users interact with AI and labeling of AI-generated audio, image and video content. It applies to domestic and foreign actors in AI activities in Vietnam, with transition periods for existing systems.Next: Mar 1, 2027 Transition ends for existing AI systems (general) · in 4 monthsCalifornia SB 243 (companion chatbots)Operators of companion chatbot platforms must clearly disclose that the chatbot is AI where a user could reasonably think they are talking to a human. They must keep and publish protocols that prevent suicidal-ideation and self-harm content and refer users to crisis services. For known minors, operators must disclose AI use, remind them every three hours to take a break, and block sexually explicit content. Annual reports to the Office of Suicide Prevention begin July 1, 2027.Next: Jul 1, 2027 First annual report to Office of Suicide Prevention · in 8 months
Utah AI Policy ActMakes businesses liable under Utah consumer protection law for deceptive acts committed through generative AI. Businesses must disclose generative AI use when a consumer clearly and unequivocally asks, and must disclose it proactively in high-risk interactions and regulated-occupation services. The act created the Office of Artificial Intelligence Policy and a regulatory learning lab. In 2025, SB 226 narrowed the disclosure duties and added a safe harbor, and SB 332 moved the act's repeal date to July 1, 2027.Next: Jul 1, 2027 Scheduled repeal of Title 13, Ch. 72 · in 8 monthsPeru AI Law and RegulationPeru's AI law and its 2025 regulation set a risk-based framework with prohibited uses and high-risk uses (for example in credit, employment, health and education access). Developers and deployers of high-risk systems must run impact assessments, keep human oversight and give transparency. Obligations phase in by sector and company size over one to four years.Next: Sep 10, 2027 Private sector: transport, commerce, labour · in 10 months
Vermont VDPOSANew comprehensive privacy law with low applicability thresholds, broad consumer health data provisions that apply to all businesses, an expanded sensitive data definition, profiling and automated-decision transparency, and a disclosure requirement for using personal data to train AI models. Consumers get the usual access, correction, deletion, portability and opt-out rights.Next: Jan 1, 2028 Vermont Data Privacy and Online Surveillance Act takes effect · in 14 monthsTaiwan AI Basic ActTaiwan's framework law for AI. It sets seven principles (including privacy, security, transparency, fairness and accountability), names the National Science and Technology Council as the lead authority, and has the Ministry of Digital Affairs build a risk classification framework that sector regulators use for risk-based rules. High-risk AI must carry warnings, and the government must set liability and remedy rules for high-risk AI.Next: Jan 14, 2028 Agencies must align laws with the Act · in 15 months
AI state-law preemption EODirects federal agencies to push back on state AI laws seen as onerous. It orders a DOJ AI Litigation Task Force, a Commerce list of conflicting state laws, BEAD and grant funding conditions, an FCC disclosure-standard proceeding and an FTC policy statement on AI outputs. It does not itself preempt any state law; that needs Congress or court rulings.In effect since Dec 11, 2025Alberta POPAReplaces the privacy part of Alberta's FOIP Act for public bodies. It adds mandatory breach notification where there is a real risk of significant harm, privacy management programs, privacy impact assessments, rules for creating and using non-personal data, and notice when personal information will be fed into automated systems. It also bans selling personal information and adds large offence fines.In effect since Jun 11, 2025
Brazil AI Bill (PL 2338/2023)Risk-based AI framework inspired by the EU AI Act: prohibited (excessive-risk) uses, high-risk system obligations, algorithmic impact assessments, rights for affected persons and copyright remuneration provisions, coordinated by a national AI regulation system (SIA) led by the ANPD.No date setCalifornia AB 2013 (AI training data transparency)Developers of generative AI systems made publicly available to Californians must post documentation of the training data on their websites. It must cover a high-level summary of the datasets, their sources and owners, the number of data points, the types of data, whether the data includes copyrighted material or personal information, whether it was licensed or purchased, cleaning and processing steps, collection periods, and whether synthetic data was used.In effect since Jan 1, 2026California ADS employment regulationsClarifies that using an automated-decision system in hiring or other employment decisions can violate the Fair Employment and Housing Act if it discriminates on protected traits. Employers must keep automated-decision data and employment records for at least four years. AI assessments that elicit disability information can be unlawful medical inquiries.In effect since Oct 1, 2025California AI autonomous-harm defense banA defendant that developed, modified or used AI cannot argue in a civil case that the AI acted autonomously and so caused the harm on its own. Other defenses such as causation and comparative fault remain.In effect since Jan 1, 2026California Senate Bill 813Establishes a framework for independent verification organizations to assess AI systems and models for compliance with state law.No date setChina AI Content Labeling MeasuresRequires generative AI service providers to add explicit (visible) labels to AI-generated text, images, audio, video and virtual scenes, and implicit labels (metadata) to generated files. Content distribution platforms must detect and label AI-generated content, and app stores must check labeling functions when apps are listed. A mandatory national standard (GB 45438-2025) takes effect on the same date.In effect since Sep 1, 2025China Algorithmic Recommendation ProvisionsRegulates recommendation, ranking, personalization, generation and dispatch algorithms used in internet services in China. Users must be able to switch off personalized recommendations and manage tags, and providers may not use algorithms for price discrimination or to induce addiction. Providers with public opinion attributes or social mobilization capacity must file their algorithms with the CAC within 10 working days of launching a service.In effect since Mar 1, 2022China Anthropomorphic AI MeasuresRegulates AI companion and emotional interaction services that simulate human personality. Providers must tell users they are talking to AI, remind users after every 2 hours of use, intervene in crises such as self-harm, offer easy exit, and may not offer virtual partner or relative services to minors. Users' interaction data may not be shared or used for training on sensitive data without consent, and services with 1 million registered or 100,000 monthly active users need a security assessment filed with the provincial CAC.In effect since Jul 15, 2026China Cybersecurity LawChina's base cybersecurity statute: multi-level protection scheme duties for network operators, localization and security review duties for critical information infrastructure (CII) operators, and content controls. The 2025 amendment, in force from 1 January 2026, adds AI governance support, ties PI processing to PIPL, allows fines on first violations and sharply raises maximum fines.In effect since Jun 1, 2017China Deep Synthesis ProvisionsRegulates deepfakes and other deep synthesis services such as synthetic text, voice cloning, face swapping and immersive scenes. Providers must verify user identity, review content, add technical marks to generated content, and add prominent labels where content could confuse the public. Providers with public opinion attributes must file algorithms, and app stores must check filings and security assessments.In effect since Jan 10, 2023China Generative AI MeasuresChina's main rule for generative AI services offered to the public in China. Providers must use lawfully sourced training data, respect IP and personal information rights, label generated content, handle illegal content, and protect minors. Services with public opinion attributes or social mobilization capacity need a security assessment and algorithm filing.In effect since Aug 15, 2023CoE AI Framework ConventionFirst binding international treaty on AI. Parties must ensure AI activities across the lifecycle respect human rights, democracy and the rule of law, with risk and impact assessments, transparency, oversight and remedies. Each party chooses how to apply it to private actors.No date set
Data (Use and Access) ActAmends the UK GDPR, DPA 2018 and PECR (recognised legitimate interests, relaxed automated decision-making rules, reasonable-and-proportionate DSAR searches, new transfer test, cookie exemptions, PECR fines raised to UK GDPR levels), creates Smart Data schemes and digital verification services, and replaces the ICO with an Information Commission. Commenced in stages from August 2025 to 2026.In effect since Aug 20, 2025Digital Omnibus (data/GDPR)Commission proposal to simplify EU digital rules. It would amend the GDPR (personal data definition, processing for AI, a new cookie/terminal-equipment consent regime in Art 88a/88b, breach notification only for high-risk breaches within 96 hours) and the ePrivacy Directive, NIS2, CER Directive and Data Act. A single-entry point would handle incident reporting, and the Data Governance Act, Free Flow Regulation, Platform-to-Business Regulation and Open Data Directive would be repealed and merged into the Data Act. The AI Act part was split out and adopted separately as Regulation (EU) 2026/1744.No date set
Illinois AI in Employment Law (HB 3773)Makes it a civil-rights violation for an employer to use AI that has the effect of discriminating against employees or applicants on the basis of a protected class in recruitment, hiring, promotion, discipline, discharge or the terms of employment. It also bars using ZIP codes as a proxy for a protected class. Employers must notify employees when they use AI for these decisions; IDHR is to set the notice rules.In effect since Jan 1, 2026
India IT Rules amendment on synthetic contentAmends India's IT Rules 2021 to regulate synthetically generated information (AI-made or AI-altered audio, images and video). Intermediaries that enable such content must label it prominently, keep labels and metadata from being removed, and significant social media intermediaries must get a user declaration and verify it. Takedown clocks are cut sharply: 3 hours after a court or government order, 36 hours for certain grievances, and 2 hours for intimate or morphed images.In effect since Feb 20, 2026
Japan AI Promotion ActA framework law to promote AI R&D and use, not to restrict it. It sets up the AI Strategy Headquarters under the Prime Minister and an AI Basic Plan. The government can investigate cases where AI causes harm to rights and publish guidance and names. It sets no direct compliance obligations or fines for businesses, beyond a duty to cooperate with government measures.In effect since Jun 4, 2025Japan APPIJapan's general privacy law covering purpose specification, security, third-party transfer consent (with an opt-out scheme), cross-border transfer rules, mandatory breach reporting, and pseudonymized data. The 2026 amendment (promulgated 17 July 2026) adds Japan's first administrative fine (disgorgement of gains from serious violations), guardian consent for children under 16, stricter rules on facial-feature data, relaxed breach notification to individuals, and a consent exemption for statistics and AI development.In effect since Apr 1, 2005Kazakhstan AI LawKazakhstan's first AI statute. Owners sort their AI systems into minimal, medium or high risk and must run yearly risk management, keep documentation and inform users when AI is used. Some AI functions are banned outright, including manipulation, exploiting vulnerable people, social scoring, biometric categorisation for discrimination and emotion recognition without consent. AI-generated synthetic content must carry machine-readable marking and a visible warning.In effect since Jan 18, 2026NY Algorithmic Pricing Disclosure ActAny business that sets a price using personalized algorithmic pricing must show the disclosure 'THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA' next to the price. Insurers, GLBA financial institutions and certain subscription prices are exempt.In effect since Nov 10, 2025NYC Local Law 144 (AEDT)Employers and employment agencies may not use an automated employment decision tool (AEDT) to screen candidates or employees for hiring or promotion unless the tool has had an independent bias audit within the past year. They must publish a summary of the audit results and give candidates at least 10 business days' notice that an AEDT will be used.In effect since Jul 5, 2023Ontario Bill 194Enacts the Enhancing Digital Security and Trust Act, 2024, which lets Ontario set cyber security program, incident reporting and AI governance rules for public sector entities, and rules on digital information about minors held by school boards and children's aid societies. It also amends FIPPA to require privacy impact assessments, reasonable safeguards and breach notification to the IPC and affected people where there is a real risk of significant harm.In effect since Jan 29, 2025
South Korea AI Basic ActKorea's comprehensive AI law: transparency duties (notify users in advance that AI is used, label generative AI outputs and deepfakes), risk management, explainability and human oversight for 'high-impact' AI (e.g. hiring, lending, healthcare), safety duties for very large models (10^26 FLOPs+ training compute), and a domestic representative for large foreign providers. MSIT is running a grace period of at least one year, deferring fact-finding and fines except in serious cases.In effect since Jan 22, 2026TAKE IT DOWN ActCriminalizes knowingly publishing non-consensual intimate images, including AI-generated 'digital forgeries', and threats to do so. Covered platforms must set up a notice-and-removal process and remove reported content, plus known identical copies, within 48 hours of a valid request.In effect since May 19, 2025
Tennessee ELVIS ActReplaces the Personal Rights Protection Act of 1984 and adds voice to the protected property right in name, photograph and likeness. It targets unauthorized AI voice clones and deepfakes, including liability for distributing tools whose primary purpose is producing unauthorized voice or likeness.In effect since Jul 1, 2024
TRAIGABans developing or deploying AI with the intent to incite self-harm or crime, to unlawfully discriminate against a protected class, to produce child sexual abuse material or unlawful sexual deepfakes, or to infringe constitutional rights. Government agencies must also disclose AI use and may not use it for social scoring or biometric identification without consent. Creates a Texas AI regulatory sandbox, where approved participants can test systems for up to 36 months, and a Texas AI Council. Liability generally turns on intent, not disparate impact alone.In effect since Jan 1, 2026
Upcoming deadlines
EU Consumer Credit Directive 2 (CCD2)National rules applyMember States must apply the transposing measures from this date and the 2008 Directive is repealed.European UnionEU AI ActNew bans on sexual deepfakes and CSAM generation; Art 50(2) grace period endsNew Art 5(1)(ba)/(bb) prohibitions on AI systems that generate non-consensual intimate imagery of identifiable persons or child sexual abuse material apply. Generative AI systems placed on the market before 2 Aug 2026 must comply with the Art 50(2) marking duty by this date (new Art 111(4)).European UnionEU Platform Work DirectiveTransposition deadlineMember States must bring national laws into force to comply with the Directive (Article 29).European UnionProduct Liability DirectiveTransposition deadline; old PLD repealedMember States must transpose by 9 Dec 2026 (Art 22). Directive 85/374/EEC is repealed from that date but still applies to products placed on the market before it (Art 21).European UnionAustralia Privacy ActChildren's Online Privacy Code must be registeredOAIC must develop and register the Children's Online Privacy Code within 24 months of Royal Assent.AustraliaAustralia Privacy ActAutomated decision-making transparency appliesPrivacy policies must disclose the kinds of personal information used in substantially automated decisions that significantly affect individuals (24 months after assent).AustraliaCalifornia AI Auditor RegistryAct takes effectDefault effective date for 2026 regular-session statutes.CaliforniaCalifornia AI Transparency Act (SB 942)Large online platform and hosting platform dutiesLarge online platforms and GenAI hosting platforms must meet the provenance duties added by AB 853.CaliforniaCalifornia SB 53 (TFAIA)First OES anonymized incident report and CDT definition reviewOES begins publishing annual anonymized incident summaries and the Department of Technology begins annual review of the act's definitions; the CalCompute framework report is due to the Legislature.CaliforniaCCPA / CPRAADMT requirements compliance dateBusinesses using ADMT for significant decisions must comply with Article 11 (pre-use notice, opt-out, access rights) by this date (11 CCR 7200(b)).CaliforniaCCPA / CPRABrowsers must support opt-out preference signal (AB 566)Businesses that develop or maintain a browser must include consumer-configurable functionality to send an opt-out preference signal (Civ. Code 1798.136, operative Jan 1, 2027).CaliforniaColorado AI ActADMT obligations applyDeveloper documentation, consumer notices, post-adverse-outcome disclosure, correction and human-review rights take effect.ColoradoColorado AI ActAG rules dueAttorney General must adopt rules clarifying the post-adverse-outcome disclosure requirements.ColoradoConnecticut Data Privacy Act (CTDPA)Data broker registration requiredData brokers may not sell or license brokered personal data in Connecticut unless registered with the Department of Consumer Protection ($2,500 initial fee).ConnecticutNY RAISE ActRAISE Act takes effectTransparency reports, frontier AI frameworks, incident reporting and DFS disclosure filings apply.New YorkVietnam AI LawTransition ends for existing AI systems (general)Existing AI systems in most sectors must comply (12-month transition).VietnamCalifornia SB 243 (companion chatbots)First annual report to Office of Suicide PreventionOperators begin annual reporting on crisis referrals and detection protocols.CaliforniaUtah AI Policy ActScheduled repeal of Title 13, Ch. 72SB 332 extends the AI Policy Act repeal date from May 1, 2025 to July 1, 2027.UtahEU AI ActLegacy GPAI models must comply; national AI sandboxes operationalProviders of GPAI models placed on the market before 2 Aug 2025 must comply (Art 111(3)). Each Member State must have at least one national AI regulatory sandbox operational (Art 57(1) as amended by the Omnibus).European UnionVietnam AI LawTransition ends for existing AI systems in health, education and financeExisting AI systems in healthcare, education and finance must comply (18-month transition).VietnamPeru AI Law and RegulationPrivate sector: transport, commerce, labourObligations apply two years after publication.PeruEU AI ActHigh-risk obligations apply to Annex III systemsChapter III Sections 1-3 (high-risk requirements and provider/deployer obligations) apply to AI systems classified high-risk under Art 6(2) and Annex III (employment, credit scoring, education, biometrics, essential services and similar). Deferred from 2 Aug 2026 by Regulation (EU) 2026/1744.European UnionCCPA / CPRARisk assessments for pre-existing processing dueRisk assessments must be completed and documented for high-risk processing that began before Jan 1, 2026 and continues after (11 CCR 7155(b)).CaliforniaCalifornia AI Transparency Act (SB 942)Capture device manufacturer dutiesCapture device manufacturer provenance requirements become operative.CaliforniaVermont VDPOSAVermont Data Privacy and Online Surveillance Act takes effectAll obligations under Act 145 apply (sec. 4).VermontTaiwan AI Basic ActAgencies must align laws with the ActGovernment agencies must finish amending or adopting laws and administrative measures within 2 years of entry into force (art. 18). Date is computed from the statute.TaiwanCCPA / CPRAFirst risk assessment submission to CPPABusinesses must submit required risk assessment information and attestation for assessments conducted in 2026 and 2027 (11 CCR 7157(a)(1)); annually by April 1 thereafter.CaliforniaCCPA / CPRACybersecurity audit due: revenue over $100MFirst cybersecurity audit report (covering Jan 1, 2027 - Jan 1, 2028) and certification due for businesses with 2026 annual gross revenue over $100M (11 CCR 7121(a)(1)).CaliforniaEU AI ActHigh-risk obligations apply to Annex I product-embedded systemsChapter III Sections 1-3 apply to AI systems classified high-risk under Art 6(1) and Annex I (safety components of products covered by EU harmonisation legislation). Deferred from 2 Aug 2027 by Regulation (EU) 2026/1744.European UnionPeru AI Law and RegulationPrivate sector: production, agriculture, energy, miningObligations apply three years after publication.PeruConnecticut Data Privacy Act (CTDPA)Data brokers must process state deletion mechanism requestsRegistered data brokers must access the DCP accessible deletion mechanism at least every 45 days and process deletion requests.ConnecticutCalifornia AI Auditor RegistryRegistry opens and registration requiredAgency must launch the AI Auditor Registry; unregistered persons may not offer or conduct covered AI audits.CaliforniaCCPA / CPRACybersecurity audit due: revenue $50M-$100MFirst cybersecurity audit report (covering 2028) due for businesses with 2027 annual gross revenue between $50M and $100M (11 CCR 7121(a)(2)).CaliforniaVermont VDPOSAMandatory 60-day cure period expiresThe AG's duty to issue a cure notice before enforcement ends June 30, 2029 (Act 145 sec. 3).VermontPeru AI Law and RegulationPrivate sector: all other usesObligations apply four years after publication.PeruColorado AI ActMandatory cure period endsThe AG's obligation to offer a 60-day notice-and-cure period expires.ColoradoCCPA / CPRACybersecurity audit due: revenue under $50MFirst cybersecurity audit report (covering 2029) due for covered businesses with 2028 annual gross revenue under $50M (11 CCR 7121(a)(3)); annual by April 1 thereafter.CaliforniaEU AI ActPublic-authority high-risk systems must complyProviders and deployers of high-risk AI systems intended for use by public authorities that were placed on the market before the Chapter III application date must comply (Art 111(2), as replaced by the Omnibus).European UnionEU AI ActLarge-scale EU IT systems must complyAI systems that are components of the large-scale IT systems in Annex X (e.g. SIS, VIS, Eurodac, EES, ETIAS) placed on the market before 2 Aug 2027 must be brought into compliance (Art 111(1)).European Union