Global AI Regulatory Watch

SDAIA's draft amendments, posted on the Istitlaa consultation platform with comments closing 5 November 2026, would require controllers to store personal data inside Saudi Arabia while still allowing compliant transfers abroad, add safeguards for automated processing that affects individuals' rights, expand DPIA triggers, refine DPO appointment rules, lengthen record retention to the processing period plus five years, and move the national register of controllers into the regulation.

Why it matters. The storage-in-Kingdom proposal would change where datasets and client systems holding Saudi personal data can be hosted.

Notified on 14 November 2025, the rules phase in over eighteen months: the Data Protection Board provisions took effect immediately, consent-manager registration applies from November 2026, and the core duties on notice, security safeguards, breach notification and retention apply from May 2027. The Act allows cross-border transfers except to countries the government restricts.

Why it matters. Indian personal data in datasets or deployed systems will need DPDP-grade notices and breach procedures by May 2027.

Regulation (EU) 2026/1744 moved the Annex III high-risk obligations to a fixed 2 December 2027 and the Annex I product-embedded obligations to 2 August 2028, without deferring Article 50 transparency or the Commission's GPAI enforcement powers, which have applied since 2 August 2026. It adds two new prohibited practices from 2 December 2026, recasts the AI literacy duty as one of supporting literacy, opens a route to use special-category data for bias detection, and lets deployers reuse a GDPR DPIA inside the fundamental-rights impact assessment.

Why it matters. Any system in an Annex III area (employment, credit, essential services, education) now has a firm 2027 build date, and anything already on the market that generates text, audio or images must carry machine-readable marking by 2 December 2026.

The Commission's final voluntary code, published 10 June 2026, sets out how providers mark AI-generated content in machine-readable form and how deployers label deepfakes and AI-written text on matters of public interest. After the Omnibus, signing gives no presumption of conformity, but the code is the yardstick the AI Office will use when it reads Article 50.

Why it matters. Watermarking and disclosure patterns in generative deployments will be measured against this code once the 2 December 2026 transition for legacy systems ends.

SB 26-189 repeals and re-enacts Colorado's 2024 AI Act as a narrower, notice-based law after a federal court paused enforcement of the original by stipulated order on 27 April 2026. From 1 January 2027 developers must give deployers documentation on intended uses, training-data categories and known limitations; deployers must notify consumers before an ADMT materially influences a consequential decision and explain adverse outcomes within 30 days. The Attorney General enforces exclusively, after a 60-day cure period that sunsets in 2030.

Why it matters. Both developer and deployer duties reach systems used in consequential decisions affecting Colorado residents; the pending xAI/DOJ litigation could still narrow them.

The California Privacy Protection Agency's regulations, effective 1 January 2026, require pre-use notices, opt-out and access rights for automated decision-making technology used in significant decisions from 1 January 2027, risk assessments for high-risk processing (including training ADMT on personal data) with a 31 December 2027 completion deadline, and phased cybersecurity audits with the first certificates due 1 April 2028 for businesses over $100 million in revenue.

Why it matters. Systems that process Californians' data for significant decisions must support notices, opt-outs and access requests, and using personal data to train ADMT triggers a risk assessment.

As amended by Chapter 96 of 2026 (signed 27 March 2026), the RAISE Act takes effect 1 January 2027. Frontier developers (models trained with more than 10^26 operations) must publish transparency reports before deployment; large frontier developers (over $500 million in revenue) must publish a safety framework, report critical safety incidents to a new DFS oversight office within 72 hours and file quarterly catastrophic-risk summaries. The Attorney General enforces, with penalties up to $3 million.

Why it matters. The duties fall on frontier model providers, but their published frameworks, transparency reports and incident notices become inputs to downstream due diligence.

The Framework Act on the Development of AI and Establishment of a Foundation for Trust and its Enforcement Decree took effect on 22 January 2026. They require advance notice of AI use, disclosure of AI-generated outputs, safety and risk measures for high-impact AI, and a domestic representative for foreign operators above revenue or user thresholds. MSIT is running a grace period of at least a year in which investigations and fines are generally deferred.

Why it matters. Korean deployments need labelling and a high-impact assessment; the grace period can end from January 2027.

The ANPD's draft agenda for 2027–2028 keeps a narrowed action on generative AI and personal data (legitimate interest for AI training, sensitive data, transparency) and adds actions on AI-generated intimate content, children's use of generative AI and the review of automated decisions. The call for input ran from 1 September to 16 October 2026; the agenda is due to be approved by 1 February 2027.

Why it matters. These are the likely subjects of LGPD rules on AI training and automated decisions in Brazil over the next two years.

Passed on 10 December 2025 and in force since 1 March 2026, the law sorts AI systems into high, medium and low risk, subjects high-risk systems to audits and in some cases pre-market certification, and requires machine-readable marking of AI-generated audio, images and video. Systems already in operation have until 1 March 2027, or 1 September 2027 in health, education and finance.

Why it matters. Any deployment reaching Vietnamese users must be classified, and generative outputs marked, before the transition ends.

Issued 30 April 2026 and in force from 1 May 2026, the decree sets the three-tier risk classification (providers self-classify and re-classify with deployers when use changes), conformity assessment for high-risk systems, a national AI-system database and one-stop portal run by the Ministry of Science and Technology, and the labelling rules: deployers must visibly label AI-generated or edited audio, images and video that mimic real people or events, with carve-outs for quality edits, text processing, internal use and controlled testing.

Why it matters. The decree is where Vietnam's classification and labelling duties become operational; transitioning operators had until 30 June 2026 to notify via the portal.

The Commission's proposal would amend fourteen GDPR articles, including a relative definition of personal data (information is not personal data for an entity that cannot reasonably identify the person) and an express legitimate-interest basis for developing and operating AI. The Council agreed its negotiating mandate on 21 October 2026; Parliament's joint ITRE-LIBE committee has not yet voted, so trilogues have not begun.

Why it matters. If adopted, the relative personal-data test and the AI legitimate-interest route would change how training and evaluation datasets built on pseudonymised EU data are justified. Nothing in it is law yet.

The Data (Use and Access) Act 2025 relaxed the UK GDPR restriction on solely automated decisions, opening the full range of lawful bases outside special-category data, subject to safeguards. The ICO consulted on revised automated decision-making and profiling guidance between 31 March and 29 May 2026 and has been asked to prepare a statutory AI code of practice. Final guidance is awaited.

Why it matters. UK systems that make significant automated decisions need the new safeguards built in: information to the person, a route to human intervention and a way to contest the outcome.

With the Commission's enforcement powers over general-purpose AI model providers in application since 2 August 2026, the AI Office has issued its first formal requests for information: to providers of the most advanced models on security, external evaluation and post-market monitoring, and reportedly to more than 30 providers that had not published training-data summaries. EVP Virkkunen confirmed the requests publicly on 14 October 2026. No fines have been reported.

Why it matters. Enforcement against upstream model providers determines what documentation and assurances downstream builders can obtain and pass on to their own customers.

Consultation Paper No. 3 of 2026 proposed refining Regulation 10 of the DIFC Data Protection Regulations, which governs personal data processed through autonomous and semi-autonomous systems, with privacy-by-design and safety expectations, clarifying certification duties and the Autonomous Systems Officer role, and adding a Regulation 11 letting the Commissioner recognise certification frameworks. Comments closed 18 July 2026; the enacted text is awaited.

Why it matters. DIFC-based firms using AI on personal data will need to show these design and certification controls once the amendments are enacted.

The Senate-passed Marco Legal da Inteligência Artificial, a risk-based regime with high-risk obligations, rights for affected persons and a coordinated supervision system led by the ANPD, is before the Chamber of Deputies' special committee on AI. It carries priority status, but as of early November 2026 the rapporteur's report is still awaited and no vote date is set.

Why it matters. If enacted, it would impose impact assessments and governance duties for high-risk uses and shape training-data practices in Brazil.

Executive Order 14365 (11 December 2025) directs the Department of Justice to form an AI Litigation Task Force to challenge state AI laws it views as conflicting with federal policy, and Commerce to publish a list of onerous state laws. It does not itself preempt anything. Its first live test came on 24 April 2026, when DOJ moved to intervene in xAI's suit against Colorado's 2024 AI Act.

Why it matters. State AI laws such as Colorado's and California's remain in force unless a court or Congress says otherwise, but the litigation path is now open and could narrow them.

HB 149, signed 22 June 2025 and in force since 1 January 2026, bans developing or deploying AI to encourage self-harm or crime, to intentionally discriminate against protected classes (disparate impact alone is not enough), or to produce unlawful deepfakes or child sexual abuse material, with social-scoring and biometric limits aimed at government. The Attorney General enforces after a 60-day cure period, with penalties up to $200,000 per uncurable violation, and a 36-month regulatory sandbox is available.

Why it matters. TRAIGA carries no private-sector disclosure duty, so it operates mainly as a prohibited-uses check on systems reaching Texas.

The amendment adopted by the NPC Standing Committee on 28 October 2025 and in force since 1 January 2026 adds China's first statutory article on the safe and sound development of AI, alongside heavier penalties and wider extraterritorial reach. It sits above the existing generative AI measures and content-labelling rules administered by the Cyberspace Administration of China.

Why it matters. Relevant to anyone serving users in China or moving Chinese personal data; the AI article is a framework provision that the CAC's measures give teeth.

Adopted by Cabinet decision on 23 December 2025, the plan commits the government to prepare guidelines under Article 13 of the AI Promotion Act and to encourage voluntary measures by businesses. The Act carries no penalties and the plan is reviewed in principle annually.

Why it matters. Soft-law expectations only; the Article 13 guidelines, once published, become the reference for Japanese deployments.