AI compliance starter pack. Free, in your browser.
Pick the ways your business uses AI and the markets you serve. You get a finished pack: an AI register, the obligations for each use by market with the law, article, status and date, ready-to-paste AI notices and labels, a staff AI-use policy, questions for your AI vendors and a 30/60/90-day plan.
Nothing you enter leaves your browser. There is no AI model behind this page: a fixed set of rules, each with its source, builds the pack on your device. Nothing is sent unless you choose to send us the contact form.
General information as of 4 October 2026. Not legal advice. Origin Pi accepts no liability for decisions made using this tool. Verify with your counsel.
JavaScript is off, so the generator cannot build your pack. Every rule it uses is listed below, by AI use and by market.
1. Your business
Markets are where your customers, users or candidates are. The company name only fills in the templates.
2. Your AI uses
Tick every use. For each one, answer the questions that appear: who approves its output, whether personal data is involved, whether it reaches people in the EU, whether you built it, and a few use-specific questions.
The review button only fills in our contact form with a short summary of your uses and markets. Nothing is sent until you submit it.
How it works
A rules engine, not a chatbot.
The generator applies 71 rules, each taken from a primary text we have read and cite: EU and Singapore law, regulator guidance, and official statements. Each rule carries its status as of 4 October 2026, so you can see what is law, what is voluntary and what is still a proposal. The tool does not decide whether you are in scope of a law, and a rule not shown does not mean you are clear.
What you get
- An AI register with owners to fill in
- Obligations per use and market, with article, status, date and source
- An AI disclosure notice, content labels and a one-page staff AI-use policy
- An email of questions for your AI vendors
- A 30/60/90-day plan ordered by legal deadline and risk
- Links to the posts and services behind each topic
How the answers are decided
Each rule names the AI uses it covers and the facts that switch it on: a market, personal data, whether a person approves the output, EU reach, Singapore phone numbers, building the AI yourself, or MAS regulation. Same answers in, same pack out.
Status labels
Binding law applies or will apply as law. Guidance (not binding) regulator or industry guidance. Proposal (not law yet) a draft or consultation. Platform terms (contract, not law) a platform's rules. Your vendor's legal duty (check it is met) a law addressed to your vendor. Law passed, not yet in force passed but not yet in force. Scope note (likely does not apply) probably does not apply, shown so you can confirm.
Rules
Obligations by AI use.
Every rule the generator can apply, as of 4 October 2026. A rule applies when all of its conditions are true for that use.
- Website, WhatsApp or internal chatbot
- Staff using ChatGPT, Claude or Copilot
- AI drafting marketing copy or ads
- AI-generated images or video
- AI sales agent sending messages or quotes
- AI screening CVs or hiring
- AI credit, insurance or eligibility decisions
- AI customer-data analytics or personalisation
- Coding assistants
- Meeting transcription
- Other: describe
- Company-wide
Website, WhatsApp or internal chatbot
An AI assistant that answers customers or staff on your website, app, WhatsApp or intranet.
European Union
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| EU AI Act Art. 50(1): AI disclosure (you are the provider)EU AI Act, Regulation (EU) 2024/1689Art. 50(1), 50(5); Art. 99(4)(g) | Binding law | Applies now (since 2 Aug 2026; not deferred by Reg (EU) 2026/1744) |
| AI systems that interact directly with people must be designed so that people are informed they are interacting with an AI system, in a clear and distinguishable manner at the latest at the first interaction. This is a provider duty: a company that builds a chatbot in-house and puts it into service under its own name is the provider (Commission guidelines C(2026) 5054, para 11). Fines up to EUR 15,000,000 or 3% (Art. 99(4)(g)).Note: The "obvious" exception "should be interpreted restrictively" (guidelines para 45); helpdesk bots are named as not obvious.Do: Show an "AI assistant" notice in the first message and when asked. If you rent the bot, configure the notice and require it in the contract. A line in your terms, or "Services on this website use AI", is not enough on its own (guidelines para 38).Source: eur-lex.europa.eu/eli/reg/2024/1689/oj/eng#art_50 |
| EU AI Act Art. 50(1): AI disclosure (your vendor is the provider)EU AI Act, Regulation (EU) 2024/1689Art. 50(1), 50(5); Art. 99(4)(g) | Your vendor's legal duty (check it is met) | Applies now (since 2 Aug 2026; not deferred by Reg (EU) 2026/1744) |
| Art. 50(1) binds the provider of a chatbot or agent that interacts directly with people: it must be designed so people are informed they are interacting with an AI system, clearly and at the latest at the first interaction (Art. 50(5)). If you rent the system, the provider is usually your vendor, but you control the persona and the channel, and if you modify it and put it into service under your own name you can become the provider (Commission guidelines C(2026) 5054, para 11).Note: The "obvious" exception "should be interpreted restrictively" (guidelines para 45); helpdesk bots are named as not obvious.Do: Check that the vendor's system shows the AI notice from the first message, configure it in your deployment, and require it in the contract.Source: eur-lex.europa.eu/eli/reg/2024/1689/oj/eng#art_50 |
| EU AI Act Art. 50(2): machine-readable marking (you are the provider)EU AI Act, Regulation (EU) 2024/1689, as amended by Reg (EU) 2026/1744Art. 50(2); Art. 111(4) | Binding law | Since 2 Aug 2026; systems already on the market before then: by 2 Dec 2026 |
| Providers of AI systems generating synthetic audio, image, video or text must ensure outputs are "marked in a machine-readable format and detectable as artificially generated or manipulated". Providers whose systems were placed on the market before 2 August 2026 "shall take the necessary steps in order to comply with Article 50(2) by 2 December 2026". The duty does not apply to the extent the system performs an assistive function for standard editing or does not substantially alter the input data or its semantics.Do: If you offer a generator under your own name, or modified one and put it into service under your name, make sure its outputs carry machine-readable marks by the date that applies to you.Source: eur-lex.europa.eu/eli/reg/2024/1689/oj/eng#art_50 |
| GDPR lawful basis and privacy noticeGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 6(1); Art. 13 | Binding law | In force (since 25 May 2018) |
| Processing is lawful only on one of the Art. 6(1) bases (for example consent, contract, legal obligation or legitimate interests). When you collect personal data from the person, for example in a chatbot conversation, you must tell them at that time who you are, how to contact you, the purposes and the legal basis, the recipients, any transfer outside the EU and the other Art. 13 items.Do: Record the lawful basis for this AI use, and link a privacy notice covering it from the point of collection (for example a chatbot's first message or a meeting invite).Source: eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_13 |
| GDPR Art. 22: solely automated decisionsGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 22 | Binding law | In force (since 25 May 2018) |
| People have "the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her". Exceptions (contract, law, explicit consent) need safeguards, "at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision". A human approver does not take a decision outside Art. 22 automatically: the Court of Justice held in SCHUFA (C-634/21, 7 December 2023) that an automatically established score constitutes "automated individual decision-making" where a third party, to which it is transmitted, "draws strongly on that probability value to establish, implement or terminate a contractual relationship with that person".Note: Many routine automated outputs, such as a standard price quote, do not have legal or similarly significant effects; check with counsel.Do: If the AI's output decides or effectively decides outcomes with legal or similarly significant effects (for example rejecting an applicant or a loan), make the human review real (able and willing to change the result, and recorded), or rely on an Art. 22 exception with its safeguards.Source: eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ063 |
| GDPR Art. 35: DPIA for automated evaluationGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 35(1), 35(3)(a) | Binding law | In force (since 25 May 2018) |
| A data protection impact assessment is required before processing likely to result in a high risk, in particular "a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person" (Art. 35(3)(a)).Note: likely required where AI shapes hiring or credit decisions; check with counselDo: Run a DPIA for this use before relying on it for decisions about people in the EU.Source: eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_35 |
| GDPR Art. 9: health and other special-category dataGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 9; Art. 35(3)(b) | Binding law | In force (since 25 May 2018) |
| Art. 9(1): processing of "genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited" (with the other special categories it lists) unless an Art. 9(2) condition applies, such as explicit consent. Large-scale processing of special categories requires a DPIA (Art. 35(3)(b)).Note: check with counselDo: Identify the Art. 9 condition for this use before it processes health or other special-category data, and run a DPIA where the processing is large-scale.Source: eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_9 |
| ePrivacy Art. 13: consent for e-mail, SMS and automated-call marketingePrivacy Directive 2002/58/EC (as transposed in each EU country)Art. 13 | Binding law | In force (through national laws) |
| Direct marketing by automated calling systems, fax or electronic mail "may only be allowed in respect of subscribers who have given their prior consent" (Art. 13(1)). A business may e-mail its own customers about its own similar products if they were given a free and easy way to object when their details were collected and in each message (Art. 13(2)).Note: Each EU country transposes this differently; check with counsel.Do: Before an AI tool sends marketing e-mails, SMS or automated calls to people in the EU, check you hold prior consent or meet the existing-customer exception, and include an opt-out in every message.Source: eur-lex.europa.eu/eli/dir/2002/58/oj/eng#art_13 |
| EU AI Act Annex III 3: AI in educationEU AI Act, as amended by Regulation (EU) 2026/1744Annex III point 3; Art. 5(1)(f) | Binding law | From 2 Dec 2027 (Annex III); Art. 5(1)(f) since 2 Feb 2025 |
| AI used to decide admission to education or training, to evaluate learning outcomes, to assess the level of education a person will receive, or to monitor students during tests is listed as high-risk (Annex III point 3). Inferring students' emotions in education institutions is prohibited (Art. 5(1)(f)).Note: likely high-risk if it decides or assesses learners; check with counselDo: Check whether this use admits, grades, assesses or proctors learners; if so, treat it as likely high-risk and plan for 2 December 2027.Source: eur-lex.europa.eu/eli/reg/2024/1689/oj/eng#anx_III |
Singapore
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| PDPA consent and purpose (s13 to s20)Personal Data Protection Act 2012 (Singapore)s13, s14(2)(a), s14(3), s18, s20(1) | Binding law | In force |
| Collect, use or disclose personal data only with consent or an exception, for purposes a reasonable person would consider appropriate and that you have notified (s13, s18, s20). Consent required as a condition of a product or service beyond what is reasonable is not validly given (s14(2)(a), s14(3)).Do: Check each AI use fits a purpose you told people about; do not bundle AI-training consent into your terms of service.Source: sso.agc.gov.sg/Act/PDPA2012?ProvIds=pr13- |
| PDPC GenAI guidelines: deployer responsibilityPDPC Advisory Guidelines on Use of Personal Data in Generative AIParas 1.5, 7.5, 8.3, 9.1, 9.3 | Guidance (not binding) | Issued 20 Jul 2026 |
| Where the tool uses generative AI: "System Deployers bear primary responsibility for ensuring that the Generative AI Systems they have chosen to use can meet their obligations under the PDPA" (para 9.1). Deployers should safeguard new data sources such as end-user prompts, inputs, generated outputs and agent or tool activity data (para 9.3). The guidelines are advisory and not legally binding (para 1.5); the PDPA itself is.Do: Get your vendor's safeguards in writing (access controls, data residency, retention, input and output filters, incident and breach timelines: paras 7.5, 8.3) and tell staff what personal data may go into prompts.Source: files.app.optical.gov.sg/pdpc/production/assets/143cb9d4-532 |
| PDPC GenAI guidelines: AI-Specific Notifications for trainingPDPC Advisory Guidelines on Use of Personal Data in Generative AIParas 4.2, 4.4, 4.6, footnote 11 | Guidance (not binding) | Issued 20 Jul 2026 |
| You said a model is trained or fine-tuned on this data: "General Notifications are an insufficient means of obtaining consent to use User Data for Generative AI development, specifically, for large-scale Generative AI Model training and/or fine-tuning. Organisations must provide AI-Specific Notifications for this purpose" (para 4.4). This refers only to activities that develop or modify a model's parameters (footnote 11). Check exceptions such as business improvement first (para 4.2).Do: Find out whether you or any vendor trains on your customer data. If so, use an AI-Specific Notification and, where practicable, a way to decline (para 4.6).Source: files.app.optical.gov.sg/pdpc/production/assets/143cb9d4-532 |
| PDPA Do Not Call check before marketing sendsPDPA Part 9 (Do Not Call) and PDP (Do Not Call Registry) Regulationss36(1), s43(1), s43(4), s44, s48J(4); Regs 15 to 17 (S 67/2021) | Binding law | In force (current rules since 1 Feb 2021) |
| "A person must not send a specified message addressed to a Singapore telephone number unless the person has, at the time the person sends the specified message, valid confirmation that the Singapore telephone number is not listed in the relevant register" (s43(1)). Register results are valid for 21 days. Clear and unambiguous consent, evidenced in written or other accessible form, removes the check (s43(4)). The rules cover WhatsApp, iMessage and Viber messages using a Singapore number (PDPC Advisory Guidelines on the Do Not Call Provisions), and a voice call includes a recorded or synthetic voice (s36(1)). Penalty cap: S$1 million for organisations, S$200,000 for individuals (s48J(4)).Note: The business-to-business exclusion (Eighth Schedule 1(1)(g)) is lost once a message pitches something for the person's own use.Do: Gate every marketing send: a DNC result from the last 21 days or evidenced consent, sender identified (s44), opt-outs honoured within 21 days (reg 17). Keep the gate log.Source: sso.agc.gov.sg/Act/PDPA2012?ProvIds=pr43- |
| IMDA chatbot info card (voluntary)IMDA Transparency Guidelines for Generative AI ChatbotsChatbot info card; first-use safety statement | Guidance (not binding) | Published 20 Jul 2026 (voluntary) | You serve Singapore | "These guidelines are voluntary and do not impose obligations." They suggest a chatbot info card answering what the bot can and cannot do, how reliable and safe it is, how data is handled and how to report issues, plus a high-level safety statement at first use, substantive rather than generic, with a link to the card.Do: Publish a one-page info card and link it from the bot's first message.Source: www.imda.gov.sg/resources/press-releases-factsheets-and-spee |
| Spam Control Act: bulk commercial e-mail and SMSSpam Control Act 2007 (Singapore)s6, s11, Second Schedule | Binding law | In force |
| Unsolicited commercial electronic messages sent in bulk (more than 100 with the same or similar subject matter in 24 hours, 1,000 in 30 days or 10,000 in a year) must follow the Second Schedule: an unsubscribe facility, and for e-mail the label "<ADV>" before the subject. Unsubscribe requests must be honoured within 10 business days.Note: Our reading: personalised AI messages on the same pitch may still count toward the bulk thresholds.Do: If an AI tool sends bulk commercial e-mail or SMS with a Singapore link, add <ADV> labels and a working unsubscribe, and stop within 10 business days of a request.Source: sso.agc.gov.sg/Act/SCA2007?ProvIds=pr6- |
Malaysia
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| Malaysia ADMP guideline: DPIA for significant automated decisionsPDP Commissioner Guidelines on Automated Decision-Making and Profiling, and on DPIAADMP 6.1, 7.1, 9.3, 10.2.6; DPIA 7.1 | Guidance (not binding) | Regulator guidelines published April 2026 |
| "ADMP is one of the qualitative factors that triggers the requirement to carry out a DPIA, regardless of the nature or extent of its intended use" (ADMP 6.1), where automated decisions or profiling have legal or similarly significant effects, such as credit, employment or different prices for different people (7.1). Notices should disclose automated decision-making (9.3). Not relying on AI as the sole factor is listed as a best practice (10.2.6). These are regulator guidelines, not statute.Do: Decide with your DPO (or privacy lead) whether this use has significant effects on people; if so, run a DPIA before relying on it and tell people in your notice.Source: www.pdp.gov.my/ppdpv1/wp-content/uploads/2026/04/Automated-D |
| Malaysia PDPA s43: stop direct marketing on requestPersonal Data Protection Act 2010 (Act 709, Malaysia), as amended by Act A1727s43 | Binding law | In force |
| A person may, by written notice, require you "to cease or not to begin processing his personal data for purposes of direct marketing" (s43(1)); "direct marketing" means "the communication by whatever means of any advertising or marketing material which is directed to particular individuals" (s43(5)). Failing to comply with the Commissioner's requirement is an offence (s43(4)). Malaysia has no Do Not Call register like Singapore's.Do: Keep a suppression list that every AI-sent marketing message checks, and honour opt-outs from any channel.Source: www.pdp.gov.my/ppdpv1/wp-content/uploads/2024/07/UNDANG-UNDA |
Australia
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| Australian Consumer Law s18: no misleading conductAustralian Consumer Law (Competition and Consumer Act 2010, Schedule 2)s18 | Binding law | In force | You serve Australia | "A person must not, in trade or commerce, engage in conduct that is misleading or deceptive or is likely to mislead or deceive." A bot that passes as a person, or AI content that misleads about a product, can fall foul of it.Do: Disclose the bot, and check AI-written claims and images before they reach Australian customers.Source: www.legislation.gov.au/C2004A00109/2026-09-16/2026-09-16/tex |
| Australia Guidance for AI adoption (voluntary)Australian Government, Guidance for AI adoption: implementation guidancePractice 4: Share essential information | Guidance (not binding) | Published 5 May 2026 (voluntary) | You serve Australia | "When a customer is receiving services and guidance from a chatbot, they should know this is not a human specialist." The guidance is voluntary.Do: Use the same first-message AI notice you use for the EU.Source: www.industry.gov.au/publications/guidance-for-ai-adoption |
| Australian Privacy Act APP 1.7: automated decisions in your privacy policyPrivacy Act 1988 (Australia), as amended by the Privacy and Other Legislation Amendment Act 2024APP 1.7 to 1.9 | Binding law | From 10 Dec 2026 |
| From 10 December 2026, an APP entity that has arranged for a computer program to make, or do a thing "substantially and directly related to making", a decision that "could reasonably be expected to significantly affect the rights or interests of an individual", using personal information, must say in its APP privacy policy which kinds of personal information are used and which kinds of decisions are made by, or substantially and directly involve, such programs (APP 1.7, 1.8).Note: Applies to APP entities; check the small business exemption.Do: If this use makes or substantially shapes decisions that significantly affect people, add the required description to your privacy policy before 10 December 2026.Source: www.legislation.gov.au/C2024A00128/asmade/2024-12-10/text/or |
| Spam Act 2003: consent, identify, unsubscribeSpam Act 2003 (Australia)ss 16, 17, 18 | Binding law | In force |
| A person must not send, or cause to be sent, a commercial electronic message with an Australian link unless the recipient consented (s16); commercial electronic messages must include accurate sender information (s17) and a functional unsubscribe facility (s18).Do: Before an AI tool sends commercial e-mail, SMS or messaging-app messages with an Australian link, check consent, identify your business and include an unsubscribe.Source: www.legislation.gov.au/C2004A01214/2016-03-10/2016-03-10/tex |
| Do Not Call Register Act 2006Do Not Call Register Act 2006 (Australia)s11 | Binding law | In force |
| "A person must not make, or cause to be made, a telemarketing call to an Australian number" registered on the Do Not Call Register unless it is a designated telemarketing call or the account-holder or their nominee consented (s11).Do: Wash call lists against the Register before an AI agent makes telemarketing calls to Australian numbers, or hold consent.Source: www.legislation.gov.au/C2006A00088/2021-09-01/2021-09-01/tex |
United States (federal law only)
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| US FCC: AI voice calls need prior consentUS FCC Declaratory Ruling FCC 24-17 (TCPA; US federal law)TCPA "artificial or prerecorded voice" | Binding law | In effect (released 8 Feb 2024) |
| If your agent places voice calls to US numbers: the TCPA's restrictions on "artificial or prerecorded voice" "encompass current AI technologies that generate human voices", so such calls "require the prior express consent of the called party" (written consent for telemarketing, unless an exemption applies).Do: Do not let an AI voice agent call US numbers without prior express consent you can prove (written consent for telemarketing).Source: docs.fcc.gov/public/attachments/FCC-24-17A1.pdf#page=1 |
United States: Colorado
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| Colorado SB 26-189: deployer notice and human reviewColorado SB 26-189 (ADMT in consequential decisions), C.R.S. 6-1-1701 to 17086-1-1703, 6-1-1704, 6-1-1705, 6-1-1706 | Binding law | From 1 Jan 2027 (decisions made on or after that date) |
| Deployers using covered automated decision-making technology that materially influences consequential decisions (education, employment, residential real estate, financial or lending services, insurance, health-care services, essential government services and public benefits) must give notice before use and, after an adverse outcome, a plain-language explanation within 30 days with a way to request the system's name, version and developer. Consumers get correction and "an opportunity for meaningful human review and reconsideration of the consequential decision, to the extent commercially reasonable." Records are kept for three years. The Attorney General enforces it as a deceptive trade practice, up to $20,000 per violation, with a 60-day cure until 1 January 2030 and no new private right of action.Note: A 27 April 2026 court order in X.AI LLC v. Weiser bars the Attorney General from starting enforcement of SB 24-205 or legislation replacing or amending it (which includes SB 26-189) until 14 days after the court rules on xAI's preliminary-injunction motion, due 28 days after the Attorney General's rules are finally adopted (the rules were still at the proposal stage when this rule was last reviewed and may change). The 1 January 2027 date itself has not moved. Check with counsel. We found no employee-count exemption in the signed act (the earlier SB 24-205 small-deployer carve-out is not in it). Section 6-1-1708 treats certain insurers, HIPAA covered entities (except for employment decisions), FDA-regulated devices and GLBA matters differently; check with counsel.Do: Prepare the pre-use notice, the 30-day adverse-outcome explanation and a human review route; ask your vendor for the developer documentation.Source: leg.colorado.gov/bill_files/116489/download#page=11 |
| Colorado SB 26-189: developer documentationColorado SB 26-189, C.R.S. 6-1-1702, 6-1-17076-1-1702(1)-(5); 6-1-1707(7) | Binding law | From 1 Jan 2027 |
| A developer doing business in Colorado whose system is marketed, contracted or configured to materially influence consequential decisions must give each deployer its intended and known harmful uses, training-data categories, known limitations, instructions for use and human review, and the information the deployer needs for its notices; notify material updates; and keep records, including version identifiers and changelogs, for at least three years. The off-label liability carve-out protects a developer only if it "complied with section 6-1-1702".Note: "Doing business in Colorado" is not defined in the Act. If you build a system only for your own decisions, check with counsel whether you are also a developer.Do: State intended and prohibited uses precisely in your contracts and product pages, and build the documentation pack before 1 January 2027.Source: leg.colorado.gov/bill_files/116489/download#page=19 |
| Colorado HB 26-1263: conversational AI disclosureColorado HB 26-1263 (conversational AI services)6-1-1701(3.5)(b)(II) exclusion; 6-1-1708(3) disclosures (on and after 1 January 2027) | Scope note (likely does not apply) | From 1 Jan 2027 | You serve United States: Colorado | Colorado's conversational AI law (approved by the Governor on 29 May 2026, per the signed act) requires operators, on and after 1 January 2027, to disclose clearly that the service is artificial intelligence, but the definition excludes services "primarily designed to provide commerce-related or transactional assistance ... customer support, or customer service". A customer-service chatbot or a sales assistant for your own products is likely excluded; a general conversational companion is not.Note: likely excluded if it is primarily customer service or commerce-related; check with counselDo: Keep the bot focused on customer service and use your standard AI notice anyway.Source: leg.colorado.gov/bill_files/116851/download#page=7 |
| Colorado SB 26-189: likely out of scopeColorado SB 26-189, C.R.S. 6-1-17016-1-1701(2)(b), 6-1-1701(3)(b) | Scope note (likely does not apply) | Definitions apply from 1 Jan 2027 |
| Consequential decisions exclude customer service triage, advertising, marketing, product recommendations and fraud prevention. The Attorney General's notice of hearing on the proposed rules also states that, under section 6-1-1701(2)(b)(II), "tools used by individuals solely to summarize, organize, translate, draft, route, or present information for human review of administrative processing [sic] are excluded from the definition of ADMT" (wording as in the signed act and the notice). This use is likely outside SB 26-189 unless it makes or shapes a decision about education, employment, residential real estate, financial or lending services, insurance, health-care services, or essential government services and public benefits.Note: likely outsideDo: Write down why the use is out of scope, and ban decision use in your acceptable use policy.Source: leg.colorado.gov/bill_files/116489/download#page=3 |
Any market (platform)
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| WhatsApp Business terms for AI botsMeta WhatsApp Business Solution Terms and Business Messaging PolicyTerms s4.7 (AI Providers); Policy (escalation paths) | Platform terms (contract, not law) | If it runs on WhatsApp: terms s4.7 as last modified 23 September 2026 |
| If your bot runs on WhatsApp: the Business Solution Terms (s4.7) prohibit AI Providers from using the platform where general-purpose AI is the primary (rather than incidental or ancillary) functionality; customer-service and sales bots for your own business remain possible. You may automate replies but "must also have available prompt, clear, and direct escalation paths", including transfer to a human agent. Meta charges per message for service messages from 1 October 2026.Note: Platform terms change often and can differ by market; check Meta's current terms for yours.Do: Keep the bot on your own products and services, give customers a visible way to reach a person, and budget per-message costs.Source: www.whatsapp.com/legal/business-solution-terms |
| WhatsApp opt-in before business-initiated messagesMeta WhatsApp Business Messaging PolicyOpt-in requirement | Platform terms (contract, not law) | If you message customers on WhatsApp: current policy (last updated 23 Sep 2026) |
| Before you message someone on WhatsApp you need "opt-in permission from the recipient confirming that they wish to receive subsequent messages or calls from you", and "You are solely responsible for determining the method of opt-in" and that it complies with applicable law. A WhatsApp opt-in is not automatically marketing consent under data protection or Do Not Call rules.Note: Platform terms change often; check Meta's current policy.Do: Record a WhatsApp opt-in per contact (when, how, wording) before any business-initiated message, alongside DNC or suppression checks.Source: business.whatsapp.com/policy |
Staff using ChatGPT, Claude or Copilot
Employees using general AI assistants for drafting, research or analysis.
European Union
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| GDPR lawful basis and privacy noticeGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 6(1); Art. 13 | Binding law | In force (since 25 May 2018) |
| Processing is lawful only on one of the Art. 6(1) bases (for example consent, contract, legal obligation or legitimate interests). When you collect personal data from the person, for example in a chatbot conversation, you must tell them at that time who you are, how to contact you, the purposes and the legal basis, the recipients, any transfer outside the EU and the other Art. 13 items.Do: Record the lawful basis for this AI use, and link a privacy notice covering it from the point of collection (for example a chatbot's first message or a meeting invite).Source: eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_13 |
| GDPR Art. 22: solely automated decisionsGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 22 | Binding law | In force (since 25 May 2018) |
| People have "the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her". Exceptions (contract, law, explicit consent) need safeguards, "at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision". A human approver does not take a decision outside Art. 22 automatically: the Court of Justice held in SCHUFA (C-634/21, 7 December 2023) that an automatically established score constitutes "automated individual decision-making" where a third party, to which it is transmitted, "draws strongly on that probability value to establish, implement or terminate a contractual relationship with that person".Note: Many routine automated outputs, such as a standard price quote, do not have legal or similarly significant effects; check with counsel.Do: If the AI's output decides or effectively decides outcomes with legal or similarly significant effects (for example rejecting an applicant or a loan), make the human review real (able and willing to change the result, and recorded), or rely on an Art. 22 exception with its safeguards.Source: eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ063 |
| GDPR Art. 35: DPIA for automated evaluationGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 35(1), 35(3)(a) | Binding law | In force (since 25 May 2018) |
| A data protection impact assessment is required before processing likely to result in a high risk, in particular "a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person" (Art. 35(3)(a)).Note: likely required where AI shapes hiring or credit decisions; check with counselDo: Run a DPIA for this use before relying on it for decisions about people in the EU.Source: eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_35 |
| GDPR Art. 9: health and other special-category dataGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 9; Art. 35(3)(b) | Binding law | In force (since 25 May 2018) |
| Art. 9(1): processing of "genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited" (with the other special categories it lists) unless an Art. 9(2) condition applies, such as explicit consent. Large-scale processing of special categories requires a DPIA (Art. 35(3)(b)).Note: check with counselDo: Identify the Art. 9 condition for this use before it processes health or other special-category data, and run a DPIA where the processing is large-scale.Source: eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_9 |
Singapore
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| PDPA consent and purpose (s13 to s20)Personal Data Protection Act 2012 (Singapore)s13, s14(2)(a), s14(3), s18, s20(1) | Binding law | In force |
| Collect, use or disclose personal data only with consent or an exception, for purposes a reasonable person would consider appropriate and that you have notified (s13, s18, s20). Consent required as a condition of a product or service beyond what is reasonable is not validly given (s14(2)(a), s14(3)).Do: Check each AI use fits a purpose you told people about; do not bundle AI-training consent into your terms of service.Source: sso.agc.gov.sg/Act/PDPA2012?ProvIds=pr13- |
| PDPC GenAI guidelines: deployer responsibilityPDPC Advisory Guidelines on Use of Personal Data in Generative AIParas 1.5, 7.5, 8.3, 9.1, 9.3 | Guidance (not binding) | Issued 20 Jul 2026 |
| Where the tool uses generative AI: "System Deployers bear primary responsibility for ensuring that the Generative AI Systems they have chosen to use can meet their obligations under the PDPA" (para 9.1). Deployers should safeguard new data sources such as end-user prompts, inputs, generated outputs and agent or tool activity data (para 9.3). The guidelines are advisory and not legally binding (para 1.5); the PDPA itself is.Do: Get your vendor's safeguards in writing (access controls, data residency, retention, input and output filters, incident and breach timelines: paras 7.5, 8.3) and tell staff what personal data may go into prompts.Source: files.app.optical.gov.sg/pdpc/production/assets/143cb9d4-532 |
| PDPC GenAI guidelines: AI-Specific Notifications for trainingPDPC Advisory Guidelines on Use of Personal Data in Generative AIParas 4.2, 4.4, 4.6, footnote 11 | Guidance (not binding) | Issued 20 Jul 2026 |
| You said a model is trained or fine-tuned on this data: "General Notifications are an insufficient means of obtaining consent to use User Data for Generative AI development, specifically, for large-scale Generative AI Model training and/or fine-tuning. Organisations must provide AI-Specific Notifications for this purpose" (para 4.4). This refers only to activities that develop or modify a model's parameters (footnote 11). Check exceptions such as business improvement first (para 4.2).Do: Find out whether you or any vendor trains on your customer data. If so, use an AI-Specific Notification and, where practicable, a way to decline (para 4.6).Source: files.app.optical.gov.sg/pdpc/production/assets/143cb9d4-532 |
Malaysia
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| Malaysia ADMP guideline: DPIA for significant automated decisionsPDP Commissioner Guidelines on Automated Decision-Making and Profiling, and on DPIAADMP 6.1, 7.1, 9.3, 10.2.6; DPIA 7.1 | Guidance (not binding) | Regulator guidelines published April 2026 |
| "ADMP is one of the qualitative factors that triggers the requirement to carry out a DPIA, regardless of the nature or extent of its intended use" (ADMP 6.1), where automated decisions or profiling have legal or similarly significant effects, such as credit, employment or different prices for different people (7.1). Notices should disclose automated decision-making (9.3). Not relying on AI as the sole factor is listed as a best practice (10.2.6). These are regulator guidelines, not statute.Do: Decide with your DPO (or privacy lead) whether this use has significant effects on people; if so, run a DPIA before relying on it and tell people in your notice.Source: www.pdp.gov.my/ppdpv1/wp-content/uploads/2026/04/Automated-D |
Australia
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| Australian Privacy Act APP 1.7: automated decisions in your privacy policyPrivacy Act 1988 (Australia), as amended by the Privacy and Other Legislation Amendment Act 2024APP 1.7 to 1.9 | Binding law | From 10 Dec 2026 |
| From 10 December 2026, an APP entity that has arranged for a computer program to make, or do a thing "substantially and directly related to making", a decision that "could reasonably be expected to significantly affect the rights or interests of an individual", using personal information, must say in its APP privacy policy which kinds of personal information are used and which kinds of decisions are made by, or substantially and directly involve, such programs (APP 1.7, 1.8).Note: Applies to APP entities; check the small business exemption.Do: If this use makes or substantially shapes decisions that significantly affect people, add the required description to your privacy policy before 10 December 2026.Source: www.legislation.gov.au/C2024A00128/asmade/2024-12-10/text/or |
United States: Colorado
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| Colorado SB 26-189: deployer notice and human reviewColorado SB 26-189 (ADMT in consequential decisions), C.R.S. 6-1-1701 to 17086-1-1703, 6-1-1704, 6-1-1705, 6-1-1706 | Binding law | From 1 Jan 2027 (decisions made on or after that date) |
| Deployers using covered automated decision-making technology that materially influences consequential decisions (education, employment, residential real estate, financial or lending services, insurance, health-care services, essential government services and public benefits) must give notice before use and, after an adverse outcome, a plain-language explanation within 30 days with a way to request the system's name, version and developer. Consumers get correction and "an opportunity for meaningful human review and reconsideration of the consequential decision, to the extent commercially reasonable." Records are kept for three years. The Attorney General enforces it as a deceptive trade practice, up to $20,000 per violation, with a 60-day cure until 1 January 2030 and no new private right of action.Note: A 27 April 2026 court order in X.AI LLC v. Weiser bars the Attorney General from starting enforcement of SB 24-205 or legislation replacing or amending it (which includes SB 26-189) until 14 days after the court rules on xAI's preliminary-injunction motion, due 28 days after the Attorney General's rules are finally adopted (the rules were still at the proposal stage when this rule was last reviewed and may change). The 1 January 2027 date itself has not moved. Check with counsel. We found no employee-count exemption in the signed act (the earlier SB 24-205 small-deployer carve-out is not in it). Section 6-1-1708 treats certain insurers, HIPAA covered entities (except for employment decisions), FDA-regulated devices and GLBA matters differently; check with counsel.Do: Prepare the pre-use notice, the 30-day adverse-outcome explanation and a human review route; ask your vendor for the developer documentation.Source: leg.colorado.gov/bill_files/116489/download#page=11 |
| Colorado SB 26-189: developer documentationColorado SB 26-189, C.R.S. 6-1-1702, 6-1-17076-1-1702(1)-(5); 6-1-1707(7) | Binding law | From 1 Jan 2027 |
| A developer doing business in Colorado whose system is marketed, contracted or configured to materially influence consequential decisions must give each deployer its intended and known harmful uses, training-data categories, known limitations, instructions for use and human review, and the information the deployer needs for its notices; notify material updates; and keep records, including version identifiers and changelogs, for at least three years. The off-label liability carve-out protects a developer only if it "complied with section 6-1-1702".Note: "Doing business in Colorado" is not defined in the Act. If you build a system only for your own decisions, check with counsel whether you are also a developer.Do: State intended and prohibited uses precisely in your contracts and product pages, and build the documentation pack before 1 January 2027.Source: leg.colorado.gov/bill_files/116489/download#page=19 |
| Colorado SB 26-189: likely out of scopeColorado SB 26-189, C.R.S. 6-1-17016-1-1701(2)(b), 6-1-1701(3)(b) | Scope note (likely does not apply) | Definitions apply from 1 Jan 2027 |
| Consequential decisions exclude customer service triage, advertising, marketing, product recommendations and fraud prevention. The Attorney General's notice of hearing on the proposed rules also states that, under section 6-1-1701(2)(b)(II), "tools used by individuals solely to summarize, organize, translate, draft, route, or present information for human review of administrative processing [sic] are excluded from the definition of ADMT" (wording as in the signed act and the notice). This use is likely outside SB 26-189 unless it makes or shapes a decision about education, employment, residential real estate, financial or lending services, insurance, health-care services, or essential government services and public benefits.Note: likely outsideDo: Write down why the use is out of scope, and ban decision use in your acceptable use policy.Source: leg.colorado.gov/bill_files/116489/download#page=3 |
AI drafting marketing copy or ads
AI that writes ads, emails, social posts or product descriptions.
European Union
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| EU AI Act Art. 50(2): machine-readable marking (you are the provider)EU AI Act, Regulation (EU) 2024/1689, as amended by Reg (EU) 2026/1744Art. 50(2); Art. 111(4) | Binding law | Since 2 Aug 2026; systems already on the market before then: by 2 Dec 2026 |
| Providers of AI systems generating synthetic audio, image, video or text must ensure outputs are "marked in a machine-readable format and detectable as artificially generated or manipulated". Providers whose systems were placed on the market before 2 August 2026 "shall take the necessary steps in order to comply with Article 50(2) by 2 December 2026". The duty does not apply to the extent the system performs an assistive function for standard editing or does not substantially alter the input data or its semantics.Do: If you offer a generator under your own name, or modified one and put it into service under your name, make sure its outputs carry machine-readable marks by the date that applies to you.Source: eur-lex.europa.eu/eli/reg/2024/1689/oj/eng#art_50 |
| EU AI Act Art. 50(2): your vendor marks outputsEU AI Act, Regulation (EU) 2024/1689; Commission Q&A on Article 50Art. 50(2) (provider duty on your tool vendor) | Your vendor's legal duty (check it is met) | Since 2 Aug 2026; vendors' older systems: by 2 Dec 2026 |
| Machine-readable marking is your tool vendor's duty, not yours, unless you modify a system and put it into service under your own name (guidelines para 11). The Commission says "deployers cannot simply rely on the machine-readable marking embedded in the content by the provider under Article 50(2) of the AI Act to fulfil their disclosure obligation."Do: Ask each AI content vendor how its outputs are marked, and keep signed metadata intact when you resize or optimise images.Source: digital-strategy.ec.europa.eu/en/faqs/transparency-obligatio |
| EU AI Act Art. 50(4): public-interest AI textEU AI Act, Regulation (EU) 2024/1689Art. 50(4) second subpara | Binding law | Applies now (since 2 Aug 2026) |
| AI-generated or manipulated text "published with the purpose of informing the public on matters of public interest" must be disclosed, unless it "has undergone a process of human review or editorial control" and someone holds editorial responsibility. The Commission's guidelines place ordinary ad copy and product descriptions outside this, except claims on, for example, health, consumer safety or sustainability.Do: Name an editor responsible for AI-assisted public-interest text, or label it as AI-generated.Source: eur-lex.europa.eu/eli/reg/2024/1689/oj/eng#art_50 |
| GDPR lawful basis and privacy noticeGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 6(1); Art. 13 | Binding law | In force (since 25 May 2018) |
| Processing is lawful only on one of the Art. 6(1) bases (for example consent, contract, legal obligation or legitimate interests). When you collect personal data from the person, for example in a chatbot conversation, you must tell them at that time who you are, how to contact you, the purposes and the legal basis, the recipients, any transfer outside the EU and the other Art. 13 items.Do: Record the lawful basis for this AI use, and link a privacy notice covering it from the point of collection (for example a chatbot's first message or a meeting invite).Source: eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_13 |
| GDPR Art. 22: solely automated decisionsGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 22 | Binding law | In force (since 25 May 2018) |
| People have "the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her". Exceptions (contract, law, explicit consent) need safeguards, "at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision". A human approver does not take a decision outside Art. 22 automatically: the Court of Justice held in SCHUFA (C-634/21, 7 December 2023) that an automatically established score constitutes "automated individual decision-making" where a third party, to which it is transmitted, "draws strongly on that probability value to establish, implement or terminate a contractual relationship with that person".Note: Many routine automated outputs, such as a standard price quote, do not have legal or similarly significant effects; check with counsel.Do: If the AI's output decides or effectively decides outcomes with legal or similarly significant effects (for example rejecting an applicant or a loan), make the human review real (able and willing to change the result, and recorded), or rely on an Art. 22 exception with its safeguards.Source: eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ063 |
| GDPR Art. 35: DPIA for automated evaluationGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 35(1), 35(3)(a) | Binding law | In force (since 25 May 2018) |
| A data protection impact assessment is required before processing likely to result in a high risk, in particular "a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person" (Art. 35(3)(a)).Note: likely required where AI shapes hiring or credit decisions; check with counselDo: Run a DPIA for this use before relying on it for decisions about people in the EU.Source: eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_35 |
| GDPR Art. 9: health and other special-category dataGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 9; Art. 35(3)(b) | Binding law | In force (since 25 May 2018) |
| Art. 9(1): processing of "genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited" (with the other special categories it lists) unless an Art. 9(2) condition applies, such as explicit consent. Large-scale processing of special categories requires a DPIA (Art. 35(3)(b)).Note: check with counselDo: Identify the Art. 9 condition for this use before it processes health or other special-category data, and run a DPIA where the processing is large-scale.Source: eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_9 |
| ePrivacy Art. 13: consent for e-mail, SMS and automated-call marketingePrivacy Directive 2002/58/EC (as transposed in each EU country)Art. 13 | Binding law | In force (through national laws) |
| Direct marketing by automated calling systems, fax or electronic mail "may only be allowed in respect of subscribers who have given their prior consent" (Art. 13(1)). A business may e-mail its own customers about its own similar products if they were given a free and easy way to object when their details were collected and in each message (Art. 13(2)).Note: Each EU country transposes this differently; check with counsel.Do: Before an AI tool sends marketing e-mails, SMS or automated calls to people in the EU, check you hold prior consent or meet the existing-customer exception, and include an opt-out in every message.Source: eur-lex.europa.eu/eli/dir/2002/58/oj/eng#art_13 |
Singapore
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| PDPA consent and purpose (s13 to s20)Personal Data Protection Act 2012 (Singapore)s13, s14(2)(a), s14(3), s18, s20(1) | Binding law | In force |
| Collect, use or disclose personal data only with consent or an exception, for purposes a reasonable person would consider appropriate and that you have notified (s13, s18, s20). Consent required as a condition of a product or service beyond what is reasonable is not validly given (s14(2)(a), s14(3)).Do: Check each AI use fits a purpose you told people about; do not bundle AI-training consent into your terms of service.Source: sso.agc.gov.sg/Act/PDPA2012?ProvIds=pr13- |
| PDPC GenAI guidelines: deployer responsibilityPDPC Advisory Guidelines on Use of Personal Data in Generative AIParas 1.5, 7.5, 8.3, 9.1, 9.3 | Guidance (not binding) | Issued 20 Jul 2026 |
| Where the tool uses generative AI: "System Deployers bear primary responsibility for ensuring that the Generative AI Systems they have chosen to use can meet their obligations under the PDPA" (para 9.1). Deployers should safeguard new data sources such as end-user prompts, inputs, generated outputs and agent or tool activity data (para 9.3). The guidelines are advisory and not legally binding (para 1.5); the PDPA itself is.Do: Get your vendor's safeguards in writing (access controls, data residency, retention, input and output filters, incident and breach timelines: paras 7.5, 8.3) and tell staff what personal data may go into prompts.Source: files.app.optical.gov.sg/pdpc/production/assets/143cb9d4-532 |
| PDPC GenAI guidelines: AI-Specific Notifications for trainingPDPC Advisory Guidelines on Use of Personal Data in Generative AIParas 4.2, 4.4, 4.6, footnote 11 | Guidance (not binding) | Issued 20 Jul 2026 |
| You said a model is trained or fine-tuned on this data: "General Notifications are an insufficient means of obtaining consent to use User Data for Generative AI development, specifically, for large-scale Generative AI Model training and/or fine-tuning. Organisations must provide AI-Specific Notifications for this purpose" (para 4.4). This refers only to activities that develop or modify a model's parameters (footnote 11). Check exceptions such as business improvement first (para 4.2).Do: Find out whether you or any vendor trains on your customer data. If so, use an AI-Specific Notification and, where practicable, a way to decline (para 4.6).Source: files.app.optical.gov.sg/pdpc/production/assets/143cb9d4-532 |
| PDPA Do Not Call check before marketing sendsPDPA Part 9 (Do Not Call) and PDP (Do Not Call Registry) Regulationss36(1), s43(1), s43(4), s44, s48J(4); Regs 15 to 17 (S 67/2021) | Binding law | In force (current rules since 1 Feb 2021) |
| "A person must not send a specified message addressed to a Singapore telephone number unless the person has, at the time the person sends the specified message, valid confirmation that the Singapore telephone number is not listed in the relevant register" (s43(1)). Register results are valid for 21 days. Clear and unambiguous consent, evidenced in written or other accessible form, removes the check (s43(4)). The rules cover WhatsApp, iMessage and Viber messages using a Singapore number (PDPC Advisory Guidelines on the Do Not Call Provisions), and a voice call includes a recorded or synthetic voice (s36(1)). Penalty cap: S$1 million for organisations, S$200,000 for individuals (s48J(4)).Note: The business-to-business exclusion (Eighth Schedule 1(1)(g)) is lost once a message pitches something for the person's own use.Do: Gate every marketing send: a DNC result from the last 21 days or evidenced consent, sender identified (s44), opt-outs honoured within 21 days (reg 17). Keep the gate log.Source: sso.agc.gov.sg/Act/PDPA2012?ProvIds=pr43- |
| CPFTA s4(a): no misleading AI claimsConsumer Protection (Fair Trading) Act 2003 (Singapore); ASAS Code (voluntary)CPFTA s4(a); SCAP Part I 3.2, Part III 1.1 | Binding law | In force |
| It is an unfair practice for a supplier "to do or say anything, or omit to do or say anything, if as a result a consumer might reasonably be deceived or misled" (s4(a)). The advertising self-regulator ASAS said on 23 March 2026: "False and misleading advertisement content is unacceptable, regardless of the tools used or the disclosures added." The ASAS code itself is voluntary self-regulation. The CPFTA protects consumers, so it applies to your dealings with consumers, not purely business-to-business sales.Do: Fact-check every AI-written claim before it runs and keep the substantiation ready to produce.Source: sso.agc.gov.sg/Act/CPFTA2003?ProvIds=pr4- |
| Spam Control Act: bulk commercial e-mail and SMSSpam Control Act 2007 (Singapore)s6, s11, Second Schedule | Binding law | In force |
| Unsolicited commercial electronic messages sent in bulk (more than 100 with the same or similar subject matter in 24 hours, 1,000 in 30 days or 10,000 in a year) must follow the Second Schedule: an unsubscribe facility, and for e-mail the label "<ADV>" before the subject. Unsubscribe requests must be honoured within 10 business days.Note: Our reading: personalised AI messages on the same pitch may still count toward the bulk thresholds.Do: If an AI tool sends bulk commercial e-mail or SMS with a Singapore link, add <ADV> labels and a working unsubscribe, and stop within 10 business days of a request.Source: sso.agc.gov.sg/Act/SCA2007?ProvIds=pr6- |
Malaysia
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| Malaysia ADMP guideline: DPIA for significant automated decisionsPDP Commissioner Guidelines on Automated Decision-Making and Profiling, and on DPIAADMP 6.1, 7.1, 9.3, 10.2.6; DPIA 7.1 | Guidance (not binding) | Regulator guidelines published April 2026 |
| "ADMP is one of the qualitative factors that triggers the requirement to carry out a DPIA, regardless of the nature or extent of its intended use" (ADMP 6.1), where automated decisions or profiling have legal or similarly significant effects, such as credit, employment or different prices for different people (7.1). Notices should disclose automated decision-making (9.3). Not relying on AI as the sole factor is listed as a best practice (10.2.6). These are regulator guidelines, not statute.Do: Decide with your DPO (or privacy lead) whether this use has significant effects on people; if so, run a DPIA before relying on it and tell people in your notice.Source: www.pdp.gov.my/ppdpv1/wp-content/uploads/2026/04/Automated-D |
| Malaysia PDPA s43: stop direct marketing on requestPersonal Data Protection Act 2010 (Act 709, Malaysia), as amended by Act A1727s43 | Binding law | In force |
| A person may, by written notice, require you "to cease or not to begin processing his personal data for purposes of direct marketing" (s43(1)); "direct marketing" means "the communication by whatever means of any advertising or marketing material which is directed to particular individuals" (s43(5)). Failing to comply with the Commissioner's requirement is an offence (s43(4)). Malaysia has no Do Not Call register like Singapore's.Do: Keep a suppression list that every AI-sent marketing message checks, and honour opt-outs from any channel.Source: www.pdp.gov.my/ppdpv1/wp-content/uploads/2024/07/UNDANG-UNDA |
Australia
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| Australian Consumer Law s18: no misleading conductAustralian Consumer Law (Competition and Consumer Act 2010, Schedule 2)s18 | Binding law | In force | You serve Australia | "A person must not, in trade or commerce, engage in conduct that is misleading or deceptive or is likely to mislead or deceive." A bot that passes as a person, or AI content that misleads about a product, can fall foul of it.Do: Disclose the bot, and check AI-written claims and images before they reach Australian customers.Source: www.legislation.gov.au/C2004A00109/2026-09-16/2026-09-16/tex |
| Australian Privacy Act APP 1.7: automated decisions in your privacy policyPrivacy Act 1988 (Australia), as amended by the Privacy and Other Legislation Amendment Act 2024APP 1.7 to 1.9 | Binding law | From 10 Dec 2026 |
| From 10 December 2026, an APP entity that has arranged for a computer program to make, or do a thing "substantially and directly related to making", a decision that "could reasonably be expected to significantly affect the rights or interests of an individual", using personal information, must say in its APP privacy policy which kinds of personal information are used and which kinds of decisions are made by, or substantially and directly involve, such programs (APP 1.7, 1.8).Note: Applies to APP entities; check the small business exemption.Do: If this use makes or substantially shapes decisions that significantly affect people, add the required description to your privacy policy before 10 December 2026.Source: www.legislation.gov.au/C2024A00128/asmade/2024-12-10/text/or |
| Spam Act 2003: consent, identify, unsubscribeSpam Act 2003 (Australia)ss 16, 17, 18 | Binding law | In force |
| A person must not send, or cause to be sent, a commercial electronic message with an Australian link unless the recipient consented (s16); commercial electronic messages must include accurate sender information (s17) and a functional unsubscribe facility (s18).Do: Before an AI tool sends commercial e-mail, SMS or messaging-app messages with an Australian link, check consent, identify your business and include an unsubscribe.Source: www.legislation.gov.au/C2004A01214/2016-03-10/2016-03-10/tex |
United States: Colorado
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| Colorado SB 26-189: deployer notice and human reviewColorado SB 26-189 (ADMT in consequential decisions), C.R.S. 6-1-1701 to 17086-1-1703, 6-1-1704, 6-1-1705, 6-1-1706 | Binding law | From 1 Jan 2027 (decisions made on or after that date) |
| Deployers using covered automated decision-making technology that materially influences consequential decisions (education, employment, residential real estate, financial or lending services, insurance, health-care services, essential government services and public benefits) must give notice before use and, after an adverse outcome, a plain-language explanation within 30 days with a way to request the system's name, version and developer. Consumers get correction and "an opportunity for meaningful human review and reconsideration of the consequential decision, to the extent commercially reasonable." Records are kept for three years. The Attorney General enforces it as a deceptive trade practice, up to $20,000 per violation, with a 60-day cure until 1 January 2030 and no new private right of action.Note: A 27 April 2026 court order in X.AI LLC v. Weiser bars the Attorney General from starting enforcement of SB 24-205 or legislation replacing or amending it (which includes SB 26-189) until 14 days after the court rules on xAI's preliminary-injunction motion, due 28 days after the Attorney General's rules are finally adopted (the rules were still at the proposal stage when this rule was last reviewed and may change). The 1 January 2027 date itself has not moved. Check with counsel. We found no employee-count exemption in the signed act (the earlier SB 24-205 small-deployer carve-out is not in it). Section 6-1-1708 treats certain insurers, HIPAA covered entities (except for employment decisions), FDA-regulated devices and GLBA matters differently; check with counsel.Do: Prepare the pre-use notice, the 30-day adverse-outcome explanation and a human review route; ask your vendor for the developer documentation.Source: leg.colorado.gov/bill_files/116489/download#page=11 |
| Colorado SB 26-189: developer documentationColorado SB 26-189, C.R.S. 6-1-1702, 6-1-17076-1-1702(1)-(5); 6-1-1707(7) | Binding law | From 1 Jan 2027 |
| A developer doing business in Colorado whose system is marketed, contracted or configured to materially influence consequential decisions must give each deployer its intended and known harmful uses, training-data categories, known limitations, instructions for use and human review, and the information the deployer needs for its notices; notify material updates; and keep records, including version identifiers and changelogs, for at least three years. The off-label liability carve-out protects a developer only if it "complied with section 6-1-1702".Note: "Doing business in Colorado" is not defined in the Act. If you build a system only for your own decisions, check with counsel whether you are also a developer.Do: State intended and prohibited uses precisely in your contracts and product pages, and build the documentation pack before 1 January 2027.Source: leg.colorado.gov/bill_files/116489/download#page=19 |
| Colorado SB 26-189: likely out of scopeColorado SB 26-189, C.R.S. 6-1-17016-1-1701(2)(b), 6-1-1701(3)(b) | Scope note (likely does not apply) | Definitions apply from 1 Jan 2027 |
| Consequential decisions exclude customer service triage, advertising, marketing, product recommendations and fraud prevention. The Attorney General's notice of hearing on the proposed rules also states that, under section 6-1-1701(2)(b)(II), "tools used by individuals solely to summarize, organize, translate, draft, route, or present information for human review of administrative processing [sic] are excluded from the definition of ADMT" (wording as in the signed act and the notice). This use is likely outside SB 26-189 unless it makes or shapes a decision about education, employment, residential real estate, financial or lending services, insurance, health-care services, or essential government services and public benefits.Note: likely outsideDo: Write down why the use is out of scope, and ban decision use in your acceptable use policy.Source: leg.colorado.gov/bill_files/116489/download#page=3 |
Any market (platform)
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| WhatsApp opt-in before business-initiated messagesMeta WhatsApp Business Messaging PolicyOpt-in requirement | Platform terms (contract, not law) | If you message customers on WhatsApp: current policy (last updated 23 Sep 2026) |
| Before you message someone on WhatsApp you need "opt-in permission from the recipient confirming that they wish to receive subsequent messages or calls from you", and "You are solely responsible for determining the method of opt-in" and that it complies with applicable law. A WhatsApp opt-in is not automatically marketing consent under data protection or Do Not Call rules.Note: Platform terms change often; check Meta's current policy.Do: Record a WhatsApp opt-in per contact (when, how, wording) before any business-initiated message, alongside DNC or suppression checks.Source: business.whatsapp.com/policy |
AI-generated images or video
AI images, video, voice or avatars used in marketing or content.
European Union
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| EU AI Act: new image prohibitions from 2 Dec 2026EU AI Act, as amended by Regulation (EU) 2026/1744Art. 5(1)(ba), (bb); Art. 113(a) | Binding law | From 2 Dec 2026 |
| New prohibitions added by the Digital Omnibus cover AI generation of non-consensual intimate imagery of identifiable persons and of child sexual abuse material. They apply from 2 December 2026.Do: Check that your image and video tools' settings and your own use rules exclude these outputs.Source: eur-lex.europa.eu/eli/reg/2026/1744/oj/eng#art_1 |
| EU AI Act Art. 50(2): machine-readable marking (you are the provider)EU AI Act, Regulation (EU) 2024/1689, as amended by Reg (EU) 2026/1744Art. 50(2); Art. 111(4) | Binding law | Since 2 Aug 2026; systems already on the market before then: by 2 Dec 2026 |
| Providers of AI systems generating synthetic audio, image, video or text must ensure outputs are "marked in a machine-readable format and detectable as artificially generated or manipulated". Providers whose systems were placed on the market before 2 August 2026 "shall take the necessary steps in order to comply with Article 50(2) by 2 December 2026". The duty does not apply to the extent the system performs an assistive function for standard editing or does not substantially alter the input data or its semantics.Do: If you offer a generator under your own name, or modified one and put it into service under your name, make sure its outputs carry machine-readable marks by the date that applies to you.Source: eur-lex.europa.eu/eli/reg/2024/1689/oj/eng#art_50 |
| EU AI Act Art. 50(2): your vendor marks outputsEU AI Act, Regulation (EU) 2024/1689; Commission Q&A on Article 50Art. 50(2) (provider duty on your tool vendor) | Your vendor's legal duty (check it is met) | Since 2 Aug 2026; vendors' older systems: by 2 Dec 2026 |
| Machine-readable marking is your tool vendor's duty, not yours, unless you modify a system and put it into service under your own name (guidelines para 11). The Commission says "deployers cannot simply rely on the machine-readable marking embedded in the content by the provider under Article 50(2) of the AI Act to fulfil their disclosure obligation."Do: Ask each AI content vendor how its outputs are marked, and keep signed metadata intact when you resize or optimise images.Source: digital-strategy.ec.europa.eu/en/faqs/transparency-obligatio |
| EU AI Act Art. 50(4): label deep fakesEU AI Act, Regulation (EU) 2024/1689Art. 50(4) first subpara; Art. 3(60); Art. 50(5) | Binding law | Applies now (since 2 Aug 2026; no grace period for deployers) |
| Deployers of AI that generates or manipulates image, audio or video content constituting a deep fake, that is content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful (Art. 3(60)), "shall disclose that the content has been artificially generated or manipulated", at the latest at first exposure. Evidently artistic, creative, satirical or fictional works get a lighter regime. The Commission's guidelines treat an AI product image in an advertisement that can mislead as to the product's appearance as a deep fake.Do: Label realistic AI images, video and voice shown to EU audiences, visibly and at first exposure.Source: eur-lex.europa.eu/eli/reg/2024/1689/oj/eng#art_50 |
| GDPR lawful basis and privacy noticeGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 6(1); Art. 13 | Binding law | In force (since 25 May 2018) |
| Processing is lawful only on one of the Art. 6(1) bases (for example consent, contract, legal obligation or legitimate interests). When you collect personal data from the person, for example in a chatbot conversation, you must tell them at that time who you are, how to contact you, the purposes and the legal basis, the recipients, any transfer outside the EU and the other Art. 13 items.Do: Record the lawful basis for this AI use, and link a privacy notice covering it from the point of collection (for example a chatbot's first message or a meeting invite).Source: eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_13 |
| GDPR Art. 22: solely automated decisionsGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 22 | Binding law | In force (since 25 May 2018) |
| People have "the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her". Exceptions (contract, law, explicit consent) need safeguards, "at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision". A human approver does not take a decision outside Art. 22 automatically: the Court of Justice held in SCHUFA (C-634/21, 7 December 2023) that an automatically established score constitutes "automated individual decision-making" where a third party, to which it is transmitted, "draws strongly on that probability value to establish, implement or terminate a contractual relationship with that person".Note: Many routine automated outputs, such as a standard price quote, do not have legal or similarly significant effects; check with counsel.Do: If the AI's output decides or effectively decides outcomes with legal or similarly significant effects (for example rejecting an applicant or a loan), make the human review real (able and willing to change the result, and recorded), or rely on an Art. 22 exception with its safeguards.Source: eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ063 |
| GDPR Art. 35: DPIA for automated evaluationGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 35(1), 35(3)(a) | Binding law | In force (since 25 May 2018) |
| A data protection impact assessment is required before processing likely to result in a high risk, in particular "a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person" (Art. 35(3)(a)).Note: likely required where AI shapes hiring or credit decisions; check with counselDo: Run a DPIA for this use before relying on it for decisions about people in the EU.Source: eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_35 |
| GDPR Art. 9: health and other special-category dataGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 9; Art. 35(3)(b) | Binding law | In force (since 25 May 2018) |
| Art. 9(1): processing of "genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited" (with the other special categories it lists) unless an Art. 9(2) condition applies, such as explicit consent. Large-scale processing of special categories requires a DPIA (Art. 35(3)(b)).Note: check with counselDo: Identify the Art. 9 condition for this use before it processes health or other special-category data, and run a DPIA where the processing is large-scale.Source: eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_9 |
Singapore
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| PDPA consent and purpose (s13 to s20)Personal Data Protection Act 2012 (Singapore)s13, s14(2)(a), s14(3), s18, s20(1) | Binding law | In force |
| Collect, use or disclose personal data only with consent or an exception, for purposes a reasonable person would consider appropriate and that you have notified (s13, s18, s20). Consent required as a condition of a product or service beyond what is reasonable is not validly given (s14(2)(a), s14(3)).Do: Check each AI use fits a purpose you told people about; do not bundle AI-training consent into your terms of service.Source: sso.agc.gov.sg/Act/PDPA2012?ProvIds=pr13- |
| PDPC GenAI guidelines: deployer responsibilityPDPC Advisory Guidelines on Use of Personal Data in Generative AIParas 1.5, 7.5, 8.3, 9.1, 9.3 | Guidance (not binding) | Issued 20 Jul 2026 |
| Where the tool uses generative AI: "System Deployers bear primary responsibility for ensuring that the Generative AI Systems they have chosen to use can meet their obligations under the PDPA" (para 9.1). Deployers should safeguard new data sources such as end-user prompts, inputs, generated outputs and agent or tool activity data (para 9.3). The guidelines are advisory and not legally binding (para 1.5); the PDPA itself is.Do: Get your vendor's safeguards in writing (access controls, data residency, retention, input and output filters, incident and breach timelines: paras 7.5, 8.3) and tell staff what personal data may go into prompts.Source: files.app.optical.gov.sg/pdpc/production/assets/143cb9d4-532 |
| PDPC GenAI guidelines: AI-Specific Notifications for trainingPDPC Advisory Guidelines on Use of Personal Data in Generative AIParas 4.2, 4.4, 4.6, footnote 11 | Guidance (not binding) | Issued 20 Jul 2026 |
| You said a model is trained or fine-tuned on this data: "General Notifications are an insufficient means of obtaining consent to use User Data for Generative AI development, specifically, for large-scale Generative AI Model training and/or fine-tuning. Organisations must provide AI-Specific Notifications for this purpose" (para 4.4). This refers only to activities that develop or modify a model's parameters (footnote 11). Check exceptions such as business improvement first (para 4.2).Do: Find out whether you or any vendor trains on your customer data. If so, use an AI-Specific Notification and, where practicable, a way to decline (para 4.6).Source: files.app.optical.gov.sg/pdpc/production/assets/143cb9d4-532 |
| CPFTA s4(a): no misleading AI claimsConsumer Protection (Fair Trading) Act 2003 (Singapore); ASAS Code (voluntary)CPFTA s4(a); SCAP Part I 3.2, Part III 1.1 | Binding law | In force |
| It is an unfair practice for a supplier "to do or say anything, or omit to do or say anything, if as a result a consumer might reasonably be deceived or misled" (s4(a)). The advertising self-regulator ASAS said on 23 March 2026: "False and misleading advertisement content is unacceptable, regardless of the tools used or the disclosures added." The ASAS code itself is voluntary self-regulation. The CPFTA protects consumers, so it applies to your dealings with consumers, not purely business-to-business sales.Do: Fact-check every AI-written claim before it runs and keep the substantiation ready to produce.Source: sso.agc.gov.sg/Act/CPFTA2003?ProvIds=pr4- |
Malaysia
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| Malaysia ADMP guideline: DPIA for significant automated decisionsPDP Commissioner Guidelines on Automated Decision-Making and Profiling, and on DPIAADMP 6.1, 7.1, 9.3, 10.2.6; DPIA 7.1 | Guidance (not binding) | Regulator guidelines published April 2026 |
| "ADMP is one of the qualitative factors that triggers the requirement to carry out a DPIA, regardless of the nature or extent of its intended use" (ADMP 6.1), where automated decisions or profiling have legal or similarly significant effects, such as credit, employment or different prices for different people (7.1). Notices should disclose automated decision-making (9.3). Not relying on AI as the sole factor is listed as a best practice (10.2.6). These are regulator guidelines, not statute.Do: Decide with your DPO (or privacy lead) whether this use has significant effects on people; if so, run a DPIA before relying on it and tell people in your notice.Source: www.pdp.gov.my/ppdpv1/wp-content/uploads/2026/04/Automated-D |
Australia
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| Australian Consumer Law s18: no misleading conductAustralian Consumer Law (Competition and Consumer Act 2010, Schedule 2)s18 | Binding law | In force | You serve Australia | "A person must not, in trade or commerce, engage in conduct that is misleading or deceptive or is likely to mislead or deceive." A bot that passes as a person, or AI content that misleads about a product, can fall foul of it.Do: Disclose the bot, and check AI-written claims and images before they reach Australian customers.Source: www.legislation.gov.au/C2004A00109/2026-09-16/2026-09-16/tex |
| Australian Privacy Act APP 1.7: automated decisions in your privacy policyPrivacy Act 1988 (Australia), as amended by the Privacy and Other Legislation Amendment Act 2024APP 1.7 to 1.9 | Binding law | From 10 Dec 2026 |
| From 10 December 2026, an APP entity that has arranged for a computer program to make, or do a thing "substantially and directly related to making", a decision that "could reasonably be expected to significantly affect the rights or interests of an individual", using personal information, must say in its APP privacy policy which kinds of personal information are used and which kinds of decisions are made by, or substantially and directly involve, such programs (APP 1.7, 1.8).Note: Applies to APP entities; check the small business exemption.Do: If this use makes or substantially shapes decisions that significantly affect people, add the required description to your privacy policy before 10 December 2026.Source: www.legislation.gov.au/C2024A00128/asmade/2024-12-10/text/or |
United States: Colorado
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| Colorado SB 26-189: deployer notice and human reviewColorado SB 26-189 (ADMT in consequential decisions), C.R.S. 6-1-1701 to 17086-1-1703, 6-1-1704, 6-1-1705, 6-1-1706 | Binding law | From 1 Jan 2027 (decisions made on or after that date) |
| Deployers using covered automated decision-making technology that materially influences consequential decisions (education, employment, residential real estate, financial or lending services, insurance, health-care services, essential government services and public benefits) must give notice before use and, after an adverse outcome, a plain-language explanation within 30 days with a way to request the system's name, version and developer. Consumers get correction and "an opportunity for meaningful human review and reconsideration of the consequential decision, to the extent commercially reasonable." Records are kept for three years. The Attorney General enforces it as a deceptive trade practice, up to $20,000 per violation, with a 60-day cure until 1 January 2030 and no new private right of action.Note: A 27 April 2026 court order in X.AI LLC v. Weiser bars the Attorney General from starting enforcement of SB 24-205 or legislation replacing or amending it (which includes SB 26-189) until 14 days after the court rules on xAI's preliminary-injunction motion, due 28 days after the Attorney General's rules are finally adopted (the rules were still at the proposal stage when this rule was last reviewed and may change). The 1 January 2027 date itself has not moved. Check with counsel. We found no employee-count exemption in the signed act (the earlier SB 24-205 small-deployer carve-out is not in it). Section 6-1-1708 treats certain insurers, HIPAA covered entities (except for employment decisions), FDA-regulated devices and GLBA matters differently; check with counsel.Do: Prepare the pre-use notice, the 30-day adverse-outcome explanation and a human review route; ask your vendor for the developer documentation.Source: leg.colorado.gov/bill_files/116489/download#page=11 |
| Colorado SB 26-189: developer documentationColorado SB 26-189, C.R.S. 6-1-1702, 6-1-17076-1-1702(1)-(5); 6-1-1707(7) | Binding law | From 1 Jan 2027 |
| A developer doing business in Colorado whose system is marketed, contracted or configured to materially influence consequential decisions must give each deployer its intended and known harmful uses, training-data categories, known limitations, instructions for use and human review, and the information the deployer needs for its notices; notify material updates; and keep records, including version identifiers and changelogs, for at least three years. The off-label liability carve-out protects a developer only if it "complied with section 6-1-1702".Note: "Doing business in Colorado" is not defined in the Act. If you build a system only for your own decisions, check with counsel whether you are also a developer.Do: State intended and prohibited uses precisely in your contracts and product pages, and build the documentation pack before 1 January 2027.Source: leg.colorado.gov/bill_files/116489/download#page=19 |
| Colorado SB 26-189: likely out of scopeColorado SB 26-189, C.R.S. 6-1-17016-1-1701(2)(b), 6-1-1701(3)(b) | Scope note (likely does not apply) | Definitions apply from 1 Jan 2027 |
| Consequential decisions exclude customer service triage, advertising, marketing, product recommendations and fraud prevention. The Attorney General's notice of hearing on the proposed rules also states that, under section 6-1-1701(2)(b)(II), "tools used by individuals solely to summarize, organize, translate, draft, route, or present information for human review of administrative processing [sic] are excluded from the definition of ADMT" (wording as in the signed act and the notice). This use is likely outside SB 26-189 unless it makes or shapes a decision about education, employment, residential real estate, financial or lending services, insurance, health-care services, or essential government services and public benefits.Note: likely outsideDo: Write down why the use is out of scope, and ban decision use in your acceptable use policy.Source: leg.colorado.gov/bill_files/116489/download#page=3 |
AI sales agent sending messages or quotes
An agent that prospects, follows up or sends quotes by email, SMS, WhatsApp or calls.
European Union
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| EU AI Act Art. 50(1): AI disclosure (you are the provider)EU AI Act, Regulation (EU) 2024/1689Art. 50(1), 50(5); Art. 99(4)(g) | Binding law | Applies now (since 2 Aug 2026; not deferred by Reg (EU) 2026/1744) |
| AI systems that interact directly with people must be designed so that people are informed they are interacting with an AI system, in a clear and distinguishable manner at the latest at the first interaction. This is a provider duty: a company that builds a chatbot in-house and puts it into service under its own name is the provider (Commission guidelines C(2026) 5054, para 11). Fines up to EUR 15,000,000 or 3% (Art. 99(4)(g)).Note: The "obvious" exception "should be interpreted restrictively" (guidelines para 45); helpdesk bots are named as not obvious.Do: Show an "AI assistant" notice in the first message and when asked. If you rent the bot, configure the notice and require it in the contract. A line in your terms, or "Services on this website use AI", is not enough on its own (guidelines para 38).Source: eur-lex.europa.eu/eli/reg/2024/1689/oj/eng#art_50 |
| EU AI Act Art. 50(1): AI disclosure (your vendor is the provider)EU AI Act, Regulation (EU) 2024/1689Art. 50(1), 50(5); Art. 99(4)(g) | Your vendor's legal duty (check it is met) | Applies now (since 2 Aug 2026; not deferred by Reg (EU) 2026/1744) |
| Art. 50(1) binds the provider of a chatbot or agent that interacts directly with people: it must be designed so people are informed they are interacting with an AI system, clearly and at the latest at the first interaction (Art. 50(5)). If you rent the system, the provider is usually your vendor, but you control the persona and the channel, and if you modify it and put it into service under your own name you can become the provider (Commission guidelines C(2026) 5054, para 11).Note: The "obvious" exception "should be interpreted restrictively" (guidelines para 45); helpdesk bots are named as not obvious.Do: Check that the vendor's system shows the AI notice from the first message, configure it in your deployment, and require it in the contract.Source: eur-lex.europa.eu/eli/reg/2024/1689/oj/eng#art_50 |
| EU Art. 50 guidelines: human-sent AI draftsEuropean Commission Guidelines on Article 50, C(2026) 5054Guidelines para 30(iii) (interpreting Art. 50(1)) | Guidance (not binding) | Published 20 Jul 2026 |
| AI drafts that are properly reviewed and sent by a human as the main interlocutor fall outside Art. 50(1) direct interaction. But "the mere possibility for humans to intervene or review the AI system's outputs should not be used to circumvent the application of the disclosure requirement", and blended AI and human outputs need disclosure for the AI-generated parts.Do: Keep the approval real: a named person reads and sends each message. If the agent starts sending on its own, apply the Art. 50(1) notice.Source: digital-strategy.ec.europa.eu/en/library/guidelines-transpar |
| EU AI Act Art. 50(2): machine-readable marking (you are the provider)EU AI Act, Regulation (EU) 2024/1689, as amended by Reg (EU) 2026/1744Art. 50(2); Art. 111(4) | Binding law | Since 2 Aug 2026; systems already on the market before then: by 2 Dec 2026 |
| Providers of AI systems generating synthetic audio, image, video or text must ensure outputs are "marked in a machine-readable format and detectable as artificially generated or manipulated". Providers whose systems were placed on the market before 2 August 2026 "shall take the necessary steps in order to comply with Article 50(2) by 2 December 2026". The duty does not apply to the extent the system performs an assistive function for standard editing or does not substantially alter the input data or its semantics.Do: If you offer a generator under your own name, or modified one and put it into service under your name, make sure its outputs carry machine-readable marks by the date that applies to you.Source: eur-lex.europa.eu/eli/reg/2024/1689/oj/eng#art_50 |
| GDPR lawful basis and privacy noticeGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 6(1); Art. 13 | Binding law | In force (since 25 May 2018) |
| Processing is lawful only on one of the Art. 6(1) bases (for example consent, contract, legal obligation or legitimate interests). When you collect personal data from the person, for example in a chatbot conversation, you must tell them at that time who you are, how to contact you, the purposes and the legal basis, the recipients, any transfer outside the EU and the other Art. 13 items.Do: Record the lawful basis for this AI use, and link a privacy notice covering it from the point of collection (for example a chatbot's first message or a meeting invite).Source: eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_13 |
| GDPR Art. 22: solely automated decisionsGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 22 | Binding law | In force (since 25 May 2018) |
| People have "the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her". Exceptions (contract, law, explicit consent) need safeguards, "at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision". A human approver does not take a decision outside Art. 22 automatically: the Court of Justice held in SCHUFA (C-634/21, 7 December 2023) that an automatically established score constitutes "automated individual decision-making" where a third party, to which it is transmitted, "draws strongly on that probability value to establish, implement or terminate a contractual relationship with that person".Note: Many routine automated outputs, such as a standard price quote, do not have legal or similarly significant effects; check with counsel.Do: If the AI's output decides or effectively decides outcomes with legal or similarly significant effects (for example rejecting an applicant or a loan), make the human review real (able and willing to change the result, and recorded), or rely on an Art. 22 exception with its safeguards.Source: eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ063 |
| GDPR Art. 35: DPIA for automated evaluationGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 35(1), 35(3)(a) | Binding law | In force (since 25 May 2018) |
| A data protection impact assessment is required before processing likely to result in a high risk, in particular "a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person" (Art. 35(3)(a)).Note: likely required where AI shapes hiring or credit decisions; check with counselDo: Run a DPIA for this use before relying on it for decisions about people in the EU.Source: eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_35 |
| GDPR Art. 9: health and other special-category dataGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 9; Art. 35(3)(b) | Binding law | In force (since 25 May 2018) |
| Art. 9(1): processing of "genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited" (with the other special categories it lists) unless an Art. 9(2) condition applies, such as explicit consent. Large-scale processing of special categories requires a DPIA (Art. 35(3)(b)).Note: check with counselDo: Identify the Art. 9 condition for this use before it processes health or other special-category data, and run a DPIA where the processing is large-scale.Source: eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_9 |
| ePrivacy Art. 13: consent for e-mail, SMS and automated-call marketingePrivacy Directive 2002/58/EC (as transposed in each EU country)Art. 13 | Binding law | In force (through national laws) |
| Direct marketing by automated calling systems, fax or electronic mail "may only be allowed in respect of subscribers who have given their prior consent" (Art. 13(1)). A business may e-mail its own customers about its own similar products if they were given a free and easy way to object when their details were collected and in each message (Art. 13(2)).Note: Each EU country transposes this differently; check with counsel.Do: Before an AI tool sends marketing e-mails, SMS or automated calls to people in the EU, check you hold prior consent or meet the existing-customer exception, and include an opt-out in every message.Source: eur-lex.europa.eu/eli/dir/2002/58/oj/eng#art_13 |
Singapore
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| PDPA consent and purpose (s13 to s20)Personal Data Protection Act 2012 (Singapore)s13, s14(2)(a), s14(3), s18, s20(1) | Binding law | In force |
| Collect, use or disclose personal data only with consent or an exception, for purposes a reasonable person would consider appropriate and that you have notified (s13, s18, s20). Consent required as a condition of a product or service beyond what is reasonable is not validly given (s14(2)(a), s14(3)).Do: Check each AI use fits a purpose you told people about; do not bundle AI-training consent into your terms of service.Source: sso.agc.gov.sg/Act/PDPA2012?ProvIds=pr13- |
| PDPC GenAI guidelines: deployer responsibilityPDPC Advisory Guidelines on Use of Personal Data in Generative AIParas 1.5, 7.5, 8.3, 9.1, 9.3 | Guidance (not binding) | Issued 20 Jul 2026 |
| Where the tool uses generative AI: "System Deployers bear primary responsibility for ensuring that the Generative AI Systems they have chosen to use can meet their obligations under the PDPA" (para 9.1). Deployers should safeguard new data sources such as end-user prompts, inputs, generated outputs and agent or tool activity data (para 9.3). The guidelines are advisory and not legally binding (para 1.5); the PDPA itself is.Do: Get your vendor's safeguards in writing (access controls, data residency, retention, input and output filters, incident and breach timelines: paras 7.5, 8.3) and tell staff what personal data may go into prompts.Source: files.app.optical.gov.sg/pdpc/production/assets/143cb9d4-532 |
| PDPC GenAI guidelines: AI-Specific Notifications for trainingPDPC Advisory Guidelines on Use of Personal Data in Generative AIParas 4.2, 4.4, 4.6, footnote 11 | Guidance (not binding) | Issued 20 Jul 2026 |
| You said a model is trained or fine-tuned on this data: "General Notifications are an insufficient means of obtaining consent to use User Data for Generative AI development, specifically, for large-scale Generative AI Model training and/or fine-tuning. Organisations must provide AI-Specific Notifications for this purpose" (para 4.4). This refers only to activities that develop or modify a model's parameters (footnote 11). Check exceptions such as business improvement first (para 4.2).Do: Find out whether you or any vendor trains on your customer data. If so, use an AI-Specific Notification and, where practicable, a way to decline (para 4.6).Source: files.app.optical.gov.sg/pdpc/production/assets/143cb9d4-532 |
| PDPA Do Not Call check before marketing sendsPDPA Part 9 (Do Not Call) and PDP (Do Not Call Registry) Regulationss36(1), s43(1), s43(4), s44, s48J(4); Regs 15 to 17 (S 67/2021) | Binding law | In force (current rules since 1 Feb 2021) |
| "A person must not send a specified message addressed to a Singapore telephone number unless the person has, at the time the person sends the specified message, valid confirmation that the Singapore telephone number is not listed in the relevant register" (s43(1)). Register results are valid for 21 days. Clear and unambiguous consent, evidenced in written or other accessible form, removes the check (s43(4)). The rules cover WhatsApp, iMessage and Viber messages using a Singapore number (PDPC Advisory Guidelines on the Do Not Call Provisions), and a voice call includes a recorded or synthetic voice (s36(1)). Penalty cap: S$1 million for organisations, S$200,000 for individuals (s48J(4)).Note: The business-to-business exclusion (Eighth Schedule 1(1)(g)) is lost once a message pitches something for the person's own use.Do: Gate every marketing send: a DNC result from the last 21 days or evidenced consent, sender identified (s44), opt-outs honoured within 21 days (reg 17). Keep the gate log.Source: sso.agc.gov.sg/Act/PDPA2012?ProvIds=pr43- |
| IMDA agentic AI framework v1.5 (voluntary)IMDA Model AI Governance Framework for Agentic AI, Version 1.5Section 2.2 (accountability, human checkpoints); agent identity | Guidance (not binding) | Version 1.5 published 20 May 2026, updated 5 Jun 2026 (voluntary) |
| "As deployers, organisations and humans remain accountable for the decisions and actions of agents" (2.2.1). The framework recommends human approval at significant checkpoints and auditing whether those approvals are effective, and says that "all agent identities (and their attendant permissions) should be issued from and tracked by a centralised system". It is voluntary guidance, not law.Do: Give each agent its own identity and the narrowest permissions, define which actions need human approval, and test that you can stop it.Source: www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-r |
| CPFTA s4(a): no misleading AI claimsConsumer Protection (Fair Trading) Act 2003 (Singapore); ASAS Code (voluntary)CPFTA s4(a); SCAP Part I 3.2, Part III 1.1 | Binding law | In force |
| It is an unfair practice for a supplier "to do or say anything, or omit to do or say anything, if as a result a consumer might reasonably be deceived or misled" (s4(a)). The advertising self-regulator ASAS said on 23 March 2026: "False and misleading advertisement content is unacceptable, regardless of the tools used or the disclosures added." The ASAS code itself is voluntary self-regulation. The CPFTA protects consumers, so it applies to your dealings with consumers, not purely business-to-business sales.Do: Fact-check every AI-written claim before it runs and keep the substantiation ready to produce.Source: sso.agc.gov.sg/Act/CPFTA2003?ProvIds=pr4- |
| MAS SAFR runtime safeguards (industry reference)SAFR (Safeguards for Agentic Finance at Runtime) white paper, BuildFin.ai with MASVersion 1.0, July 2026 | Guidance (not binding) | Published 3 Jul 2026 (industry reference, not regulatory guidance) |
| SAFR "does not constitute regulatory guidance or supervisory expectations". It describes a runtime layer that checks each agent action before execution (Deny, Escalate, Auto-Execute or Observe) and keeps a tamper-evident audit log, with controls owned by risk and compliance leadership.Do: Use it as a design reference for limits, escalation and logging on any agent that acts on its own.Source: www.mas.gov.sg/-/media/mas-media-library/development/fintech |
| Spam Control Act: bulk commercial e-mail and SMSSpam Control Act 2007 (Singapore)s6, s11, Second Schedule | Binding law | In force |
| Unsolicited commercial electronic messages sent in bulk (more than 100 with the same or similar subject matter in 24 hours, 1,000 in 30 days or 10,000 in a year) must follow the Second Schedule: an unsubscribe facility, and for e-mail the label "<ADV>" before the subject. Unsubscribe requests must be honoured within 10 business days.Note: Our reading: personalised AI messages on the same pitch may still count toward the bulk thresholds.Do: If an AI tool sends bulk commercial e-mail or SMS with a Singapore link, add <ADV> labels and a working unsubscribe, and stop within 10 business days of a request.Source: sso.agc.gov.sg/Act/SCA2007?ProvIds=pr6- |
Malaysia
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| Malaysia ADMP guideline: DPIA for significant automated decisionsPDP Commissioner Guidelines on Automated Decision-Making and Profiling, and on DPIAADMP 6.1, 7.1, 9.3, 10.2.6; DPIA 7.1 | Guidance (not binding) | Regulator guidelines published April 2026 |
| "ADMP is one of the qualitative factors that triggers the requirement to carry out a DPIA, regardless of the nature or extent of its intended use" (ADMP 6.1), where automated decisions or profiling have legal or similarly significant effects, such as credit, employment or different prices for different people (7.1). Notices should disclose automated decision-making (9.3). Not relying on AI as the sole factor is listed as a best practice (10.2.6). These are regulator guidelines, not statute.Do: Decide with your DPO (or privacy lead) whether this use has significant effects on people; if so, run a DPIA before relying on it and tell people in your notice.Source: www.pdp.gov.my/ppdpv1/wp-content/uploads/2026/04/Automated-D |
| Malaysia PDPA s43: stop direct marketing on requestPersonal Data Protection Act 2010 (Act 709, Malaysia), as amended by Act A1727s43 | Binding law | In force |
| A person may, by written notice, require you "to cease or not to begin processing his personal data for purposes of direct marketing" (s43(1)); "direct marketing" means "the communication by whatever means of any advertising or marketing material which is directed to particular individuals" (s43(5)). Failing to comply with the Commissioner's requirement is an offence (s43(4)). Malaysia has no Do Not Call register like Singapore's.Do: Keep a suppression list that every AI-sent marketing message checks, and honour opt-outs from any channel.Source: www.pdp.gov.my/ppdpv1/wp-content/uploads/2024/07/UNDANG-UNDA |
Australia
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| Australian Consumer Law s18: no misleading conductAustralian Consumer Law (Competition and Consumer Act 2010, Schedule 2)s18 | Binding law | In force | You serve Australia | "A person must not, in trade or commerce, engage in conduct that is misleading or deceptive or is likely to mislead or deceive." A bot that passes as a person, or AI content that misleads about a product, can fall foul of it.Do: Disclose the bot, and check AI-written claims and images before they reach Australian customers.Source: www.legislation.gov.au/C2004A00109/2026-09-16/2026-09-16/tex |
| Australia Guidance for AI adoption (voluntary)Australian Government, Guidance for AI adoption: implementation guidancePractice 4: Share essential information | Guidance (not binding) | Published 5 May 2026 (voluntary) | You serve Australia | "When a customer is receiving services and guidance from a chatbot, they should know this is not a human specialist." The guidance is voluntary.Do: Use the same first-message AI notice you use for the EU.Source: www.industry.gov.au/publications/guidance-for-ai-adoption |
| Australian Privacy Act APP 1.7: automated decisions in your privacy policyPrivacy Act 1988 (Australia), as amended by the Privacy and Other Legislation Amendment Act 2024APP 1.7 to 1.9 | Binding law | From 10 Dec 2026 |
| From 10 December 2026, an APP entity that has arranged for a computer program to make, or do a thing "substantially and directly related to making", a decision that "could reasonably be expected to significantly affect the rights or interests of an individual", using personal information, must say in its APP privacy policy which kinds of personal information are used and which kinds of decisions are made by, or substantially and directly involve, such programs (APP 1.7, 1.8).Note: Applies to APP entities; check the small business exemption.Do: If this use makes or substantially shapes decisions that significantly affect people, add the required description to your privacy policy before 10 December 2026.Source: www.legislation.gov.au/C2024A00128/asmade/2024-12-10/text/or |
| Spam Act 2003: consent, identify, unsubscribeSpam Act 2003 (Australia)ss 16, 17, 18 | Binding law | In force |
| A person must not send, or cause to be sent, a commercial electronic message with an Australian link unless the recipient consented (s16); commercial electronic messages must include accurate sender information (s17) and a functional unsubscribe facility (s18).Do: Before an AI tool sends commercial e-mail, SMS or messaging-app messages with an Australian link, check consent, identify your business and include an unsubscribe.Source: www.legislation.gov.au/C2004A01214/2016-03-10/2016-03-10/tex |
| Do Not Call Register Act 2006Do Not Call Register Act 2006 (Australia)s11 | Binding law | In force |
| "A person must not make, or cause to be made, a telemarketing call to an Australian number" registered on the Do Not Call Register unless it is a designated telemarketing call or the account-holder or their nominee consented (s11).Do: Wash call lists against the Register before an AI agent makes telemarketing calls to Australian numbers, or hold consent.Source: www.legislation.gov.au/C2006A00088/2021-09-01/2021-09-01/tex |
United States (federal law only)
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| US FCC: AI voice calls need prior consentUS FCC Declaratory Ruling FCC 24-17 (TCPA; US federal law)TCPA "artificial or prerecorded voice" | Binding law | In effect (released 8 Feb 2024) |
| If your agent places voice calls to US numbers: the TCPA's restrictions on "artificial or prerecorded voice" "encompass current AI technologies that generate human voices", so such calls "require the prior express consent of the called party" (written consent for telemarketing, unless an exemption applies).Do: Do not let an AI voice agent call US numbers without prior express consent you can prove (written consent for telemarketing).Source: docs.fcc.gov/public/attachments/FCC-24-17A1.pdf#page=1 |
United States: Colorado
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| Colorado SB 26-189: deployer notice and human reviewColorado SB 26-189 (ADMT in consequential decisions), C.R.S. 6-1-1701 to 17086-1-1703, 6-1-1704, 6-1-1705, 6-1-1706 | Binding law | From 1 Jan 2027 (decisions made on or after that date) |
| Deployers using covered automated decision-making technology that materially influences consequential decisions (education, employment, residential real estate, financial or lending services, insurance, health-care services, essential government services and public benefits) must give notice before use and, after an adverse outcome, a plain-language explanation within 30 days with a way to request the system's name, version and developer. Consumers get correction and "an opportunity for meaningful human review and reconsideration of the consequential decision, to the extent commercially reasonable." Records are kept for three years. The Attorney General enforces it as a deceptive trade practice, up to $20,000 per violation, with a 60-day cure until 1 January 2030 and no new private right of action.Note: A 27 April 2026 court order in X.AI LLC v. Weiser bars the Attorney General from starting enforcement of SB 24-205 or legislation replacing or amending it (which includes SB 26-189) until 14 days after the court rules on xAI's preliminary-injunction motion, due 28 days after the Attorney General's rules are finally adopted (the rules were still at the proposal stage when this rule was last reviewed and may change). The 1 January 2027 date itself has not moved. Check with counsel. We found no employee-count exemption in the signed act (the earlier SB 24-205 small-deployer carve-out is not in it). Section 6-1-1708 treats certain insurers, HIPAA covered entities (except for employment decisions), FDA-regulated devices and GLBA matters differently; check with counsel.Do: Prepare the pre-use notice, the 30-day adverse-outcome explanation and a human review route; ask your vendor for the developer documentation.Source: leg.colorado.gov/bill_files/116489/download#page=11 |
| Colorado SB 26-189: developer documentationColorado SB 26-189, C.R.S. 6-1-1702, 6-1-17076-1-1702(1)-(5); 6-1-1707(7) | Binding law | From 1 Jan 2027 |
| A developer doing business in Colorado whose system is marketed, contracted or configured to materially influence consequential decisions must give each deployer its intended and known harmful uses, training-data categories, known limitations, instructions for use and human review, and the information the deployer needs for its notices; notify material updates; and keep records, including version identifiers and changelogs, for at least three years. The off-label liability carve-out protects a developer only if it "complied with section 6-1-1702".Note: "Doing business in Colorado" is not defined in the Act. If you build a system only for your own decisions, check with counsel whether you are also a developer.Do: State intended and prohibited uses precisely in your contracts and product pages, and build the documentation pack before 1 January 2027.Source: leg.colorado.gov/bill_files/116489/download#page=19 |
| Colorado HB 26-1263: conversational AI disclosureColorado HB 26-1263 (conversational AI services)6-1-1701(3.5)(b)(II) exclusion; 6-1-1708(3) disclosures (on and after 1 January 2027) | Scope note (likely does not apply) | From 1 Jan 2027 | You serve United States: Colorado | Colorado's conversational AI law (approved by the Governor on 29 May 2026, per the signed act) requires operators, on and after 1 January 2027, to disclose clearly that the service is artificial intelligence, but the definition excludes services "primarily designed to provide commerce-related or transactional assistance ... customer support, or customer service". A customer-service chatbot or a sales assistant for your own products is likely excluded; a general conversational companion is not.Note: likely excluded if it is primarily customer service or commerce-related; check with counselDo: Keep the bot focused on customer service and use your standard AI notice anyway.Source: leg.colorado.gov/bill_files/116851/download#page=7 |
| Colorado SB 26-189: likely out of scopeColorado SB 26-189, C.R.S. 6-1-17016-1-1701(2)(b), 6-1-1701(3)(b) | Scope note (likely does not apply) | Definitions apply from 1 Jan 2027 |
| Consequential decisions exclude customer service triage, advertising, marketing, product recommendations and fraud prevention. The Attorney General's notice of hearing on the proposed rules also states that, under section 6-1-1701(2)(b)(II), "tools used by individuals solely to summarize, organize, translate, draft, route, or present information for human review of administrative processing [sic] are excluded from the definition of ADMT" (wording as in the signed act and the notice). This use is likely outside SB 26-189 unless it makes or shapes a decision about education, employment, residential real estate, financial or lending services, insurance, health-care services, or essential government services and public benefits.Note: likely outsideDo: Write down why the use is out of scope, and ban decision use in your acceptable use policy.Source: leg.colorado.gov/bill_files/116489/download#page=3 |
Any market (platform)
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| WhatsApp Business terms for AI botsMeta WhatsApp Business Solution Terms and Business Messaging PolicyTerms s4.7 (AI Providers); Policy (escalation paths) | Platform terms (contract, not law) | If it runs on WhatsApp: terms s4.7 as last modified 23 September 2026 |
| If your bot runs on WhatsApp: the Business Solution Terms (s4.7) prohibit AI Providers from using the platform where general-purpose AI is the primary (rather than incidental or ancillary) functionality; customer-service and sales bots for your own business remain possible. You may automate replies but "must also have available prompt, clear, and direct escalation paths", including transfer to a human agent. Meta charges per message for service messages from 1 October 2026.Note: Platform terms change often and can differ by market; check Meta's current terms for yours.Do: Keep the bot on your own products and services, give customers a visible way to reach a person, and budget per-message costs.Source: www.whatsapp.com/legal/business-solution-terms |
| WhatsApp opt-in before business-initiated messagesMeta WhatsApp Business Messaging PolicyOpt-in requirement | Platform terms (contract, not law) | If you message customers on WhatsApp: current policy (last updated 23 Sep 2026) |
| Before you message someone on WhatsApp you need "opt-in permission from the recipient confirming that they wish to receive subsequent messages or calls from you", and "You are solely responsible for determining the method of opt-in" and that it complies with applicable law. A WhatsApp opt-in is not automatically marketing consent under data protection or Do Not Call rules.Note: Platform terms change often; check Meta's current policy.Do: Record a WhatsApp opt-in per contact (when, how, wording) before any business-initiated message, alongside DNC or suppression checks.Source: business.whatsapp.com/policy |
AI screening CVs or hiring
AI that screens, ranks or filters job applicants.
European Union
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| EU AI Act Annex III 4(a): hiring AI is high-riskEU AI Act, as amended by Regulation (EU) 2026/1744Art. 6(2), Annex III point 4(a); Art. 14; Art. 26; Art. 113 | Binding law | From 2 Dec 2027 (deferred by Reg (EU) 2026/1744); Annex I product-embedded systems from 2 Aug 2028 |
| AI used for recruitment or selection is listed as high-risk (Annex III point 4(a)). The high-risk duties in Chapter III, Sections 1 to 3, apply from 2 December 2027 for Annex III systems (2 August 2028 for product-embedded Annex I systems). For deployers they include using the system according to the provider's instructions with competent human oversight (Art. 26), informing workers' representatives and affected workers before using it at the workplace (Art. 26(7)), and informing people that they are subject to the system where it makes or assists decisions about them (Art. 26(11)).Note: likely high-risk; check with counselDo: Plan now: trained human oversight, logs kept for at least six months (Art. 26(6)), and your vendor's written plan to meet the provider duties.Source: eur-lex.europa.eu/eli/reg/2024/1689/oj/eng#anx_III |
| GDPR lawful basis and privacy noticeGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 6(1); Art. 13 | Binding law | In force (since 25 May 2018) |
| Processing is lawful only on one of the Art. 6(1) bases (for example consent, contract, legal obligation or legitimate interests). When you collect personal data from the person, for example in a chatbot conversation, you must tell them at that time who you are, how to contact you, the purposes and the legal basis, the recipients, any transfer outside the EU and the other Art. 13 items.Do: Record the lawful basis for this AI use, and link a privacy notice covering it from the point of collection (for example a chatbot's first message or a meeting invite).Source: eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_13 |
| GDPR Art. 22: solely automated decisionsGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 22 | Binding law | In force (since 25 May 2018) |
| People have "the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her". Exceptions (contract, law, explicit consent) need safeguards, "at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision". A human approver does not take a decision outside Art. 22 automatically: the Court of Justice held in SCHUFA (C-634/21, 7 December 2023) that an automatically established score constitutes "automated individual decision-making" where a third party, to which it is transmitted, "draws strongly on that probability value to establish, implement or terminate a contractual relationship with that person".Note: Many routine automated outputs, such as a standard price quote, do not have legal or similarly significant effects; check with counsel.Do: If the AI's output decides or effectively decides outcomes with legal or similarly significant effects (for example rejecting an applicant or a loan), make the human review real (able and willing to change the result, and recorded), or rely on an Art. 22 exception with its safeguards.Source: eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ063 |
| GDPR Art. 35: DPIA for automated evaluationGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 35(1), 35(3)(a) | Binding law | In force (since 25 May 2018) |
| A data protection impact assessment is required before processing likely to result in a high risk, in particular "a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person" (Art. 35(3)(a)).Note: likely required where AI shapes hiring or credit decisions; check with counselDo: Run a DPIA for this use before relying on it for decisions about people in the EU.Source: eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_35 |
| GDPR Art. 9: health and other special-category dataGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 9; Art. 35(3)(b) | Binding law | In force (since 25 May 2018) |
| Art. 9(1): processing of "genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited" (with the other special categories it lists) unless an Art. 9(2) condition applies, such as explicit consent. Large-scale processing of special categories requires a DPIA (Art. 35(3)(b)).Note: check with counselDo: Identify the Art. 9 condition for this use before it processes health or other special-category data, and run a DPIA where the processing is large-scale.Source: eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_9 |
| EU AI Act Art. 16: provider duties for high-risk AI you buildEU AI Act, as amended by Regulation (EU) 2026/1744Art. 16 (with Arts 9, 17, 43, 47, 48, 49) | Binding law | From 2 Dec 2027 (Annex III systems) |
| If you provide a high-risk system, you must among other things meet the Section 2 requirements (including the Art. 9 risk management system), have a quality management system (Art. 17), keep documentation and logs, run the conformity assessment (Art. 43), draw up an EU declaration of conformity (Art. 47), affix the CE marking (Art. 48) and register the system (Art. 49(1)).Note: likely high-risk; check with counselDo: Plan the provider workstream now: risk management, data governance, technical documentation, quality management system and conformity assessment before 2 December 2027.Source: eur-lex.europa.eu/eli/reg/2024/1689/oj/eng#art_16 |
Singapore
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| PDPA consent and purpose (s13 to s20)Personal Data Protection Act 2012 (Singapore)s13, s14(2)(a), s14(3), s18, s20(1) | Binding law | In force |
| Collect, use or disclose personal data only with consent or an exception, for purposes a reasonable person would consider appropriate and that you have notified (s13, s18, s20). Consent required as a condition of a product or service beyond what is reasonable is not validly given (s14(2)(a), s14(3)).Do: Check each AI use fits a purpose you told people about; do not bundle AI-training consent into your terms of service.Source: sso.agc.gov.sg/Act/PDPA2012?ProvIds=pr13- |
| PDPC GenAI guidelines: deployer responsibilityPDPC Advisory Guidelines on Use of Personal Data in Generative AIParas 1.5, 7.5, 8.3, 9.1, 9.3 | Guidance (not binding) | Issued 20 Jul 2026 |
| Where the tool uses generative AI: "System Deployers bear primary responsibility for ensuring that the Generative AI Systems they have chosen to use can meet their obligations under the PDPA" (para 9.1). Deployers should safeguard new data sources such as end-user prompts, inputs, generated outputs and agent or tool activity data (para 9.3). The guidelines are advisory and not legally binding (para 1.5); the PDPA itself is.Do: Get your vendor's safeguards in writing (access controls, data residency, retention, input and output filters, incident and breach timelines: paras 7.5, 8.3) and tell staff what personal data may go into prompts.Source: files.app.optical.gov.sg/pdpc/production/assets/143cb9d4-532 |
| PDPC GenAI guidelines: AI-Specific Notifications for trainingPDPC Advisory Guidelines on Use of Personal Data in Generative AIParas 4.2, 4.4, 4.6, footnote 11 | Guidance (not binding) | Issued 20 Jul 2026 |
| You said a model is trained or fine-tuned on this data: "General Notifications are an insufficient means of obtaining consent to use User Data for Generative AI development, specifically, for large-scale Generative AI Model training and/or fine-tuning. Organisations must provide AI-Specific Notifications for this purpose" (para 4.4). This refers only to activities that develop or modify a model's parameters (footnote 11). Check exceptions such as business improvement first (para 4.2).Do: Find out whether you or any vendor trains on your customer data. If so, use an AI-Specific Notification and, where practicable, a way to decline (para 4.6).Source: files.app.optical.gov.sg/pdpc/production/assets/143cb9d4-532 |
| IMDA agentic AI framework v1.5 (voluntary)IMDA Model AI Governance Framework for Agentic AI, Version 1.5Section 2.2 (accountability, human checkpoints); agent identity | Guidance (not binding) | Version 1.5 published 20 May 2026, updated 5 Jun 2026 (voluntary) |
| "As deployers, organisations and humans remain accountable for the decisions and actions of agents" (2.2.1). The framework recommends human approval at significant checkpoints and auditing whether those approvals are effective, and says that "all agent identities (and their attendant permissions) should be issued from and tracked by a centralised system". It is voluntary guidance, not law.Do: Give each agent its own identity and the narrowest permissions, define which actions need human approval, and test that you can stop it.Source: www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-r |
| Singapore fair hiring: TGFEPTripartite Guidelines on Fair Employment Practices (TGFEP)Merit-based selection | Guidance (not binding) | In effect (tripartite guidelines) | You serve Singapore | "Employers are expected to abide by the Tripartite Guidelines on Fair Employment Practices (TGFEP) and ensure that employment decisions are based on objective, job-relevant considerations" (MOM, 9 September 2026). An AI screening tool does not change that expectation: the criteria it applies must be job-relevant.Do: Write down the job-relevant criteria the tool scores, remove proxies for age, race, gender, religion, marital status, family responsibilities or disability, and keep a person responsible for every rejection.Source: www.mom.gov.sg/newsroom/parliament-questions-and-replies/202 |
| Singapore Workplace Fairness Act 2025 (not yet in force)Workplace Fairness Act 2025 (Singapore)Prohibition of adverse employment decisions on protected characteristics | Law passed, not yet in force | Not yet in force; MOM said on 9 September 2026 it is coming into force in 2027 (check current status) | You serve Singapore | MOM told Parliament on 9 September 2026: "With the Workplace Fairness Act coming into force in 2027, this will strengthen protections against workplace discrimination by prohibiting adverse employment decisions based on mental health conditions." That answer names one protected ground and fixes no commencement date; check the Act for the full list of protected characteristics and the date before relying on either.Note: check current status, and check with your adviser whether a small-employer exemption applies to youDo: Plan now: make sure AI screening criteria cannot act as a proxy for protected characteristics, and keep records that show why each candidate was rejected.Source: www.mom.gov.sg/newsroom/parliament-questions-and-replies/202 |
| PDPC guidelines on AI recommendation and decision systemsPDPC Advisory Guidelines on use of Personal Data in AI Recommendation and Decision SystemsConsent notices; data intermediaries; best practices | Guidance (not binding) | Published 1 Mar 2024 (advisory) |
| PDPC's guidelines for AI that recommends or decides (not only generative AI) explain when personal data can be used to develop and deploy such systems, what to tell consumers when seeking consent, and the obligations of third-party developers acting as data intermediaries. They are advisory guidelines read with the PDPA.Do: Use the guidelines to word your consent notice for this use and to set your vendor's data intermediary terms.Source: www.pdpc.gov.sg/organisations/regulations-decisions/regulato |
Malaysia
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| Malaysia ADMP guideline: DPIA for significant automated decisionsPDP Commissioner Guidelines on Automated Decision-Making and Profiling, and on DPIAADMP 6.1, 7.1, 9.3, 10.2.6; DPIA 7.1 | Guidance (not binding) | Regulator guidelines published April 2026 |
| "ADMP is one of the qualitative factors that triggers the requirement to carry out a DPIA, regardless of the nature or extent of its intended use" (ADMP 6.1), where automated decisions or profiling have legal or similarly significant effects, such as credit, employment or different prices for different people (7.1). Notices should disclose automated decision-making (9.3). Not relying on AI as the sole factor is listed as a best practice (10.2.6). These are regulator guidelines, not statute.Do: Decide with your DPO (or privacy lead) whether this use has significant effects on people; if so, run a DPIA before relying on it and tell people in your notice.Source: www.pdp.gov.my/ppdpv1/wp-content/uploads/2026/04/Automated-D |
Australia
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| Australian Privacy Act APP 1.7: automated decisions in your privacy policyPrivacy Act 1988 (Australia), as amended by the Privacy and Other Legislation Amendment Act 2024APP 1.7 to 1.9 | Binding law | From 10 Dec 2026 |
| From 10 December 2026, an APP entity that has arranged for a computer program to make, or do a thing "substantially and directly related to making", a decision that "could reasonably be expected to significantly affect the rights or interests of an individual", using personal information, must say in its APP privacy policy which kinds of personal information are used and which kinds of decisions are made by, or substantially and directly involve, such programs (APP 1.7, 1.8).Note: Applies to APP entities; check the small business exemption.Do: If this use makes or substantially shapes decisions that significantly affect people, add the required description to your privacy policy before 10 December 2026.Source: www.legislation.gov.au/C2024A00128/asmade/2024-12-10/text/or |
United States: Colorado
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| Colorado SB 26-189: deployer notice and human reviewColorado SB 26-189 (ADMT in consequential decisions), C.R.S. 6-1-1701 to 17086-1-1703, 6-1-1704, 6-1-1705, 6-1-1706 | Binding law | From 1 Jan 2027 (decisions made on or after that date) |
| Deployers using covered automated decision-making technology that materially influences consequential decisions (education, employment, residential real estate, financial or lending services, insurance, health-care services, essential government services and public benefits) must give notice before use and, after an adverse outcome, a plain-language explanation within 30 days with a way to request the system's name, version and developer. Consumers get correction and "an opportunity for meaningful human review and reconsideration of the consequential decision, to the extent commercially reasonable." Records are kept for three years. The Attorney General enforces it as a deceptive trade practice, up to $20,000 per violation, with a 60-day cure until 1 January 2030 and no new private right of action.Note: A 27 April 2026 court order in X.AI LLC v. Weiser bars the Attorney General from starting enforcement of SB 24-205 or legislation replacing or amending it (which includes SB 26-189) until 14 days after the court rules on xAI's preliminary-injunction motion, due 28 days after the Attorney General's rules are finally adopted (the rules were still at the proposal stage when this rule was last reviewed and may change). The 1 January 2027 date itself has not moved. Check with counsel. We found no employee-count exemption in the signed act (the earlier SB 24-205 small-deployer carve-out is not in it). Section 6-1-1708 treats certain insurers, HIPAA covered entities (except for employment decisions), FDA-regulated devices and GLBA matters differently; check with counsel.Do: Prepare the pre-use notice, the 30-day adverse-outcome explanation and a human review route; ask your vendor for the developer documentation.Source: leg.colorado.gov/bill_files/116489/download#page=11 |
| Colorado SB 26-189: developer documentationColorado SB 26-189, C.R.S. 6-1-1702, 6-1-17076-1-1702(1)-(5); 6-1-1707(7) | Binding law | From 1 Jan 2027 |
| A developer doing business in Colorado whose system is marketed, contracted or configured to materially influence consequential decisions must give each deployer its intended and known harmful uses, training-data categories, known limitations, instructions for use and human review, and the information the deployer needs for its notices; notify material updates; and keep records, including version identifiers and changelogs, for at least three years. The off-label liability carve-out protects a developer only if it "complied with section 6-1-1702".Note: "Doing business in Colorado" is not defined in the Act. If you build a system only for your own decisions, check with counsel whether you are also a developer.Do: State intended and prohibited uses precisely in your contracts and product pages, and build the documentation pack before 1 January 2027.Source: leg.colorado.gov/bill_files/116489/download#page=19 |
| Colorado SB 26-189: likely out of scopeColorado SB 26-189, C.R.S. 6-1-17016-1-1701(2)(b), 6-1-1701(3)(b) | Scope note (likely does not apply) | Definitions apply from 1 Jan 2027 |
| Consequential decisions exclude customer service triage, advertising, marketing, product recommendations and fraud prevention. The Attorney General's notice of hearing on the proposed rules also states that, under section 6-1-1701(2)(b)(II), "tools used by individuals solely to summarize, organize, translate, draft, route, or present information for human review of administrative processing [sic] are excluded from the definition of ADMT" (wording as in the signed act and the notice). This use is likely outside SB 26-189 unless it makes or shapes a decision about education, employment, residential real estate, financial or lending services, insurance, health-care services, or essential government services and public benefits.Note: likely outsideDo: Write down why the use is out of scope, and ban decision use in your acceptable use policy.Source: leg.colorado.gov/bill_files/116489/download#page=3 |
AI credit, insurance or eligibility decisions
AI that scores, prices or decides who gets credit, cover or access.
European Union
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| EU AI Act Annex III 5(b), 5(c): credit and insurance AI is high-riskEU AI Act, as amended by Regulation (EU) 2026/1744Art. 6(2), Annex III points 5(b), 5(c); Art. 27; Art. 113 | Binding law | From 2 Dec 2027 (deferred by Reg (EU) 2026/1744); Annex I product-embedded systems from 2 Aug 2028 |
| Only two credit and insurance uses are listed as high-risk: evaluating the creditworthiness or establishing the credit score of natural persons (Annex III 5(b); AI for detecting financial fraud is excluded) and risk assessment and pricing for natural persons in life and health insurance (5(c)). Other eligibility or insurance decisions are not in these two points. Deployers of 5(b) and 5(c) systems must carry out a fundamental rights impact assessment (Art. 27) and inform people that they are subject to the system (Art. 26(11)). The Chapter III duties apply from 2 December 2027.Note: likely high-risk; check with counselDo: Map which decisions the AI makes or shapes, plan the fundamental rights impact assessment, and ask your vendor for its conformity plan.Source: eur-lex.europa.eu/eli/reg/2024/1689/oj/eng#anx_III |
| GDPR lawful basis and privacy noticeGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 6(1); Art. 13 | Binding law | In force (since 25 May 2018) |
| Processing is lawful only on one of the Art. 6(1) bases (for example consent, contract, legal obligation or legitimate interests). When you collect personal data from the person, for example in a chatbot conversation, you must tell them at that time who you are, how to contact you, the purposes and the legal basis, the recipients, any transfer outside the EU and the other Art. 13 items.Do: Record the lawful basis for this AI use, and link a privacy notice covering it from the point of collection (for example a chatbot's first message or a meeting invite).Source: eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_13 |
| GDPR Art. 22: solely automated decisionsGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 22 | Binding law | In force (since 25 May 2018) |
| People have "the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her". Exceptions (contract, law, explicit consent) need safeguards, "at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision". A human approver does not take a decision outside Art. 22 automatically: the Court of Justice held in SCHUFA (C-634/21, 7 December 2023) that an automatically established score constitutes "automated individual decision-making" where a third party, to which it is transmitted, "draws strongly on that probability value to establish, implement or terminate a contractual relationship with that person".Note: Many routine automated outputs, such as a standard price quote, do not have legal or similarly significant effects; check with counsel.Do: If the AI's output decides or effectively decides outcomes with legal or similarly significant effects (for example rejecting an applicant or a loan), make the human review real (able and willing to change the result, and recorded), or rely on an Art. 22 exception with its safeguards.Source: eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ063 |
| GDPR Art. 35: DPIA for automated evaluationGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 35(1), 35(3)(a) | Binding law | In force (since 25 May 2018) |
| A data protection impact assessment is required before processing likely to result in a high risk, in particular "a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person" (Art. 35(3)(a)).Note: likely required where AI shapes hiring or credit decisions; check with counselDo: Run a DPIA for this use before relying on it for decisions about people in the EU.Source: eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_35 |
| GDPR Art. 9: health and other special-category dataGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 9; Art. 35(3)(b) | Binding law | In force (since 25 May 2018) |
| Art. 9(1): processing of "genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited" (with the other special categories it lists) unless an Art. 9(2) condition applies, such as explicit consent. Large-scale processing of special categories requires a DPIA (Art. 35(3)(b)).Note: check with counselDo: Identify the Art. 9 condition for this use before it processes health or other special-category data, and run a DPIA where the processing is large-scale.Source: eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_9 |
| EU AI Act Art. 16: provider duties for high-risk AI you buildEU AI Act, as amended by Regulation (EU) 2026/1744Art. 16 (with Arts 9, 17, 43, 47, 48, 49) | Binding law | From 2 Dec 2027 (Annex III systems) |
| If you provide a high-risk system, you must among other things meet the Section 2 requirements (including the Art. 9 risk management system), have a quality management system (Art. 17), keep documentation and logs, run the conformity assessment (Art. 43), draw up an EU declaration of conformity (Art. 47), affix the CE marking (Art. 48) and register the system (Art. 49(1)).Note: likely high-risk; check with counselDo: Plan the provider workstream now: risk management, data governance, technical documentation, quality management system and conformity assessment before 2 December 2027.Source: eur-lex.europa.eu/eli/reg/2024/1689/oj/eng#art_16 |
Singapore
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| PDPA consent and purpose (s13 to s20)Personal Data Protection Act 2012 (Singapore)s13, s14(2)(a), s14(3), s18, s20(1) | Binding law | In force |
| Collect, use or disclose personal data only with consent or an exception, for purposes a reasonable person would consider appropriate and that you have notified (s13, s18, s20). Consent required as a condition of a product or service beyond what is reasonable is not validly given (s14(2)(a), s14(3)).Do: Check each AI use fits a purpose you told people about; do not bundle AI-training consent into your terms of service.Source: sso.agc.gov.sg/Act/PDPA2012?ProvIds=pr13- |
| PDPC GenAI guidelines: deployer responsibilityPDPC Advisory Guidelines on Use of Personal Data in Generative AIParas 1.5, 7.5, 8.3, 9.1, 9.3 | Guidance (not binding) | Issued 20 Jul 2026 |
| Where the tool uses generative AI: "System Deployers bear primary responsibility for ensuring that the Generative AI Systems they have chosen to use can meet their obligations under the PDPA" (para 9.1). Deployers should safeguard new data sources such as end-user prompts, inputs, generated outputs and agent or tool activity data (para 9.3). The guidelines are advisory and not legally binding (para 1.5); the PDPA itself is.Do: Get your vendor's safeguards in writing (access controls, data residency, retention, input and output filters, incident and breach timelines: paras 7.5, 8.3) and tell staff what personal data may go into prompts.Source: files.app.optical.gov.sg/pdpc/production/assets/143cb9d4-532 |
| PDPC GenAI guidelines: AI-Specific Notifications for trainingPDPC Advisory Guidelines on Use of Personal Data in Generative AIParas 4.2, 4.4, 4.6, footnote 11 | Guidance (not binding) | Issued 20 Jul 2026 |
| You said a model is trained or fine-tuned on this data: "General Notifications are an insufficient means of obtaining consent to use User Data for Generative AI development, specifically, for large-scale Generative AI Model training and/or fine-tuning. Organisations must provide AI-Specific Notifications for this purpose" (para 4.4). This refers only to activities that develop or modify a model's parameters (footnote 11). Check exceptions such as business improvement first (para 4.2).Do: Find out whether you or any vendor trains on your customer data. If so, use an AI-Specific Notification and, where practicable, a way to decline (para 4.6).Source: files.app.optical.gov.sg/pdpc/production/assets/143cb9d4-532 |
| IMDA agentic AI framework v1.5 (voluntary)IMDA Model AI Governance Framework for Agentic AI, Version 1.5Section 2.2 (accountability, human checkpoints); agent identity | Guidance (not binding) | Version 1.5 published 20 May 2026, updated 5 Jun 2026 (voluntary) |
| "As deployers, organisations and humans remain accountable for the decisions and actions of agents" (2.2.1). The framework recommends human approval at significant checkpoints and auditing whether those approvals are effective, and says that "all agent identities (and their attendant permissions) should be issued from and tracked by a centralised system". It is voluntary guidance, not law.Do: Give each agent its own identity and the narrowest permissions, define which actions need human approval, and test that you can stop it.Source: www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-r |
| MAS SAFR runtime safeguards (industry reference)SAFR (Safeguards for Agentic Finance at Runtime) white paper, BuildFin.ai with MASVersion 1.0, July 2026 | Guidance (not binding) | Published 3 Jul 2026 (industry reference, not regulatory guidance) |
| SAFR "does not constitute regulatory guidance or supervisory expectations". It describes a runtime layer that checks each agent action before execution (Deny, Escalate, Auto-Execute or Observe) and keeps a tamper-evident audit log, with controls owned by risk and compliance leadership.Do: Use it as a design reference for limits, escalation and logging on any agent that acts on its own.Source: www.mas.gov.sg/-/media/mas-media-library/development/fintech |
| PDPC guidelines on AI recommendation and decision systemsPDPC Advisory Guidelines on use of Personal Data in AI Recommendation and Decision SystemsConsent notices; data intermediaries; best practices | Guidance (not binding) | Published 1 Mar 2024 (advisory) |
| PDPC's guidelines for AI that recommends or decides (not only generative AI) explain when personal data can be used to develop and deploy such systems, what to tell consumers when seeking consent, and the obligations of third-party developers acting as data intermediaries. They are advisory guidelines read with the PDPA.Do: Use the guidelines to word your consent notice for this use and to set your vendor's data intermediary terms.Source: www.pdpc.gov.sg/organisations/regulations-decisions/regulato |
Malaysia
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| Malaysia ADMP guideline: DPIA for significant automated decisionsPDP Commissioner Guidelines on Automated Decision-Making and Profiling, and on DPIAADMP 6.1, 7.1, 9.3, 10.2.6; DPIA 7.1 | Guidance (not binding) | Regulator guidelines published April 2026 |
| "ADMP is one of the qualitative factors that triggers the requirement to carry out a DPIA, regardless of the nature or extent of its intended use" (ADMP 6.1), where automated decisions or profiling have legal or similarly significant effects, such as credit, employment or different prices for different people (7.1). Notices should disclose automated decision-making (9.3). Not relying on AI as the sole factor is listed as a best practice (10.2.6). These are regulator guidelines, not statute.Do: Decide with your DPO (or privacy lead) whether this use has significant effects on people; if so, run a DPIA before relying on it and tell people in your notice.Source: www.pdp.gov.my/ppdpv1/wp-content/uploads/2026/04/Automated-D |
Australia
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| Australian Privacy Act APP 1.7: automated decisions in your privacy policyPrivacy Act 1988 (Australia), as amended by the Privacy and Other Legislation Amendment Act 2024APP 1.7 to 1.9 | Binding law | From 10 Dec 2026 |
| From 10 December 2026, an APP entity that has arranged for a computer program to make, or do a thing "substantially and directly related to making", a decision that "could reasonably be expected to significantly affect the rights or interests of an individual", using personal information, must say in its APP privacy policy which kinds of personal information are used and which kinds of decisions are made by, or substantially and directly involve, such programs (APP 1.7, 1.8).Note: Applies to APP entities; check the small business exemption.Do: If this use makes or substantially shapes decisions that significantly affect people, add the required description to your privacy policy before 10 December 2026.Source: www.legislation.gov.au/C2024A00128/asmade/2024-12-10/text/or |
United States: Colorado
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| Colorado SB 26-189: deployer notice and human reviewColorado SB 26-189 (ADMT in consequential decisions), C.R.S. 6-1-1701 to 17086-1-1703, 6-1-1704, 6-1-1705, 6-1-1706 | Binding law | From 1 Jan 2027 (decisions made on or after that date) |
| Deployers using covered automated decision-making technology that materially influences consequential decisions (education, employment, residential real estate, financial or lending services, insurance, health-care services, essential government services and public benefits) must give notice before use and, after an adverse outcome, a plain-language explanation within 30 days with a way to request the system's name, version and developer. Consumers get correction and "an opportunity for meaningful human review and reconsideration of the consequential decision, to the extent commercially reasonable." Records are kept for three years. The Attorney General enforces it as a deceptive trade practice, up to $20,000 per violation, with a 60-day cure until 1 January 2030 and no new private right of action.Note: A 27 April 2026 court order in X.AI LLC v. Weiser bars the Attorney General from starting enforcement of SB 24-205 or legislation replacing or amending it (which includes SB 26-189) until 14 days after the court rules on xAI's preliminary-injunction motion, due 28 days after the Attorney General's rules are finally adopted (the rules were still at the proposal stage when this rule was last reviewed and may change). The 1 January 2027 date itself has not moved. Check with counsel. We found no employee-count exemption in the signed act (the earlier SB 24-205 small-deployer carve-out is not in it). Section 6-1-1708 treats certain insurers, HIPAA covered entities (except for employment decisions), FDA-regulated devices and GLBA matters differently; check with counsel.Do: Prepare the pre-use notice, the 30-day adverse-outcome explanation and a human review route; ask your vendor for the developer documentation.Source: leg.colorado.gov/bill_files/116489/download#page=11 |
| Colorado SB 26-189: developer documentationColorado SB 26-189, C.R.S. 6-1-1702, 6-1-17076-1-1702(1)-(5); 6-1-1707(7) | Binding law | From 1 Jan 2027 |
| A developer doing business in Colorado whose system is marketed, contracted or configured to materially influence consequential decisions must give each deployer its intended and known harmful uses, training-data categories, known limitations, instructions for use and human review, and the information the deployer needs for its notices; notify material updates; and keep records, including version identifiers and changelogs, for at least three years. The off-label liability carve-out protects a developer only if it "complied with section 6-1-1702".Note: "Doing business in Colorado" is not defined in the Act. If you build a system only for your own decisions, check with counsel whether you are also a developer.Do: State intended and prohibited uses precisely in your contracts and product pages, and build the documentation pack before 1 January 2027.Source: leg.colorado.gov/bill_files/116489/download#page=19 |
| Colorado SB 26-189: likely out of scopeColorado SB 26-189, C.R.S. 6-1-17016-1-1701(2)(b), 6-1-1701(3)(b) | Scope note (likely does not apply) | Definitions apply from 1 Jan 2027 |
| Consequential decisions exclude customer service triage, advertising, marketing, product recommendations and fraud prevention. The Attorney General's notice of hearing on the proposed rules also states that, under section 6-1-1701(2)(b)(II), "tools used by individuals solely to summarize, organize, translate, draft, route, or present information for human review of administrative processing [sic] are excluded from the definition of ADMT" (wording as in the signed act and the notice). This use is likely outside SB 26-189 unless it makes or shapes a decision about education, employment, residential real estate, financial or lending services, insurance, health-care services, or essential government services and public benefits.Note: likely outsideDo: Write down why the use is out of scope, and ban decision use in your acceptable use policy.Source: leg.colorado.gov/bill_files/116489/download#page=3 |
AI customer-data analytics or personalisation
AI that segments, predicts or personalises using customer data.
European Union
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| GDPR lawful basis and privacy noticeGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 6(1); Art. 13 | Binding law | In force (since 25 May 2018) |
| Processing is lawful only on one of the Art. 6(1) bases (for example consent, contract, legal obligation or legitimate interests). When you collect personal data from the person, for example in a chatbot conversation, you must tell them at that time who you are, how to contact you, the purposes and the legal basis, the recipients, any transfer outside the EU and the other Art. 13 items.Do: Record the lawful basis for this AI use, and link a privacy notice covering it from the point of collection (for example a chatbot's first message or a meeting invite).Source: eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_13 |
| GDPR Art. 22: solely automated decisionsGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 22 | Binding law | In force (since 25 May 2018) |
| People have "the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her". Exceptions (contract, law, explicit consent) need safeguards, "at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision". A human approver does not take a decision outside Art. 22 automatically: the Court of Justice held in SCHUFA (C-634/21, 7 December 2023) that an automatically established score constitutes "automated individual decision-making" where a third party, to which it is transmitted, "draws strongly on that probability value to establish, implement or terminate a contractual relationship with that person".Note: Many routine automated outputs, such as a standard price quote, do not have legal or similarly significant effects; check with counsel.Do: If the AI's output decides or effectively decides outcomes with legal or similarly significant effects (for example rejecting an applicant or a loan), make the human review real (able and willing to change the result, and recorded), or rely on an Art. 22 exception with its safeguards.Source: eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ063 |
| GDPR Art. 35: DPIA for automated evaluationGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 35(1), 35(3)(a) | Binding law | In force (since 25 May 2018) |
| A data protection impact assessment is required before processing likely to result in a high risk, in particular "a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person" (Art. 35(3)(a)).Note: likely required where AI shapes hiring or credit decisions; check with counselDo: Run a DPIA for this use before relying on it for decisions about people in the EU.Source: eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_35 |
| GDPR Art. 9: health and other special-category dataGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 9; Art. 35(3)(b) | Binding law | In force (since 25 May 2018) |
| Art. 9(1): processing of "genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited" (with the other special categories it lists) unless an Art. 9(2) condition applies, such as explicit consent. Large-scale processing of special categories requires a DPIA (Art. 35(3)(b)).Note: check with counselDo: Identify the Art. 9 condition for this use before it processes health or other special-category data, and run a DPIA where the processing is large-scale.Source: eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_9 |
| EU AI Act: emotion recognition and biometricsEU AI Act, Regulation (EU) 2024/1689Art. 5(1)(f), 5(1)(g); Annex III point 1; Art. 50(3) | Binding law | Art. 5 since 2 Feb 2025; Art. 50(3) since 2 Aug 2026; Annex III from 2 Dec 2027 |
| Your description mentions emotion recognition or biometrics. AI that infers emotions of people at work or in education is prohibited unless for medical or safety reasons (Art. 5(1)(f)), and so is biometric categorisation that deduces or infers race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation (Art. 5(1)(g)). Remote biometric identification, other biometric categorisation by sensitive attributes and emotion recognition are listed as high-risk (Annex III point 1, from 2 December 2027), and deployers of emotion recognition or biometric categorisation systems must inform the people exposed (Art. 50(3)).Note: check with counselDo: Stop any workplace or education emotion-recognition use and any prohibited biometric categorisation now, and get legal advice before using biometric systems on people in the EU.Source: eur-lex.europa.eu/eli/reg/2024/1689/oj/eng#art_5 |
| EU AI Act Annex III 3: AI in educationEU AI Act, as amended by Regulation (EU) 2026/1744Annex III point 3; Art. 5(1)(f) | Binding law | From 2 Dec 2027 (Annex III); Art. 5(1)(f) since 2 Feb 2025 |
| AI used to decide admission to education or training, to evaluate learning outcomes, to assess the level of education a person will receive, or to monitor students during tests is listed as high-risk (Annex III point 3). Inferring students' emotions in education institutions is prohibited (Art. 5(1)(f)).Note: likely high-risk if it decides or assesses learners; check with counselDo: Check whether this use admits, grades, assesses or proctors learners; if so, treat it as likely high-risk and plan for 2 December 2027.Source: eur-lex.europa.eu/eli/reg/2024/1689/oj/eng#anx_III |
Singapore
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| PDPA consent and purpose (s13 to s20)Personal Data Protection Act 2012 (Singapore)s13, s14(2)(a), s14(3), s18, s20(1) | Binding law | In force |
| Collect, use or disclose personal data only with consent or an exception, for purposes a reasonable person would consider appropriate and that you have notified (s13, s18, s20). Consent required as a condition of a product or service beyond what is reasonable is not validly given (s14(2)(a), s14(3)).Do: Check each AI use fits a purpose you told people about; do not bundle AI-training consent into your terms of service.Source: sso.agc.gov.sg/Act/PDPA2012?ProvIds=pr13- |
| PDPC GenAI guidelines: deployer responsibilityPDPC Advisory Guidelines on Use of Personal Data in Generative AIParas 1.5, 7.5, 8.3, 9.1, 9.3 | Guidance (not binding) | Issued 20 Jul 2026 |
| Where the tool uses generative AI: "System Deployers bear primary responsibility for ensuring that the Generative AI Systems they have chosen to use can meet their obligations under the PDPA" (para 9.1). Deployers should safeguard new data sources such as end-user prompts, inputs, generated outputs and agent or tool activity data (para 9.3). The guidelines are advisory and not legally binding (para 1.5); the PDPA itself is.Do: Get your vendor's safeguards in writing (access controls, data residency, retention, input and output filters, incident and breach timelines: paras 7.5, 8.3) and tell staff what personal data may go into prompts.Source: files.app.optical.gov.sg/pdpc/production/assets/143cb9d4-532 |
| PDPC GenAI guidelines: AI-Specific Notifications for trainingPDPC Advisory Guidelines on Use of Personal Data in Generative AIParas 4.2, 4.4, 4.6, footnote 11 | Guidance (not binding) | Issued 20 Jul 2026 |
| You said a model is trained or fine-tuned on this data: "General Notifications are an insufficient means of obtaining consent to use User Data for Generative AI development, specifically, for large-scale Generative AI Model training and/or fine-tuning. Organisations must provide AI-Specific Notifications for this purpose" (para 4.4). This refers only to activities that develop or modify a model's parameters (footnote 11). Check exceptions such as business improvement first (para 4.2).Do: Find out whether you or any vendor trains on your customer data. If so, use an AI-Specific Notification and, where practicable, a way to decline (para 4.6).Source: files.app.optical.gov.sg/pdpc/production/assets/143cb9d4-532 |
| IMDA agentic AI framework v1.5 (voluntary)IMDA Model AI Governance Framework for Agentic AI, Version 1.5Section 2.2 (accountability, human checkpoints); agent identity | Guidance (not binding) | Version 1.5 published 20 May 2026, updated 5 Jun 2026 (voluntary) |
| "As deployers, organisations and humans remain accountable for the decisions and actions of agents" (2.2.1). The framework recommends human approval at significant checkpoints and auditing whether those approvals are effective, and says that "all agent identities (and their attendant permissions) should be issued from and tracked by a centralised system". It is voluntary guidance, not law.Do: Give each agent its own identity and the narrowest permissions, define which actions need human approval, and test that you can stop it.Source: www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-r |
| MAS SAFR runtime safeguards (industry reference)SAFR (Safeguards for Agentic Finance at Runtime) white paper, BuildFin.ai with MASVersion 1.0, July 2026 | Guidance (not binding) | Published 3 Jul 2026 (industry reference, not regulatory guidance) |
| SAFR "does not constitute regulatory guidance or supervisory expectations". It describes a runtime layer that checks each agent action before execution (Deny, Escalate, Auto-Execute or Observe) and keeps a tamper-evident audit log, with controls owned by risk and compliance leadership.Do: Use it as a design reference for limits, escalation and logging on any agent that acts on its own.Source: www.mas.gov.sg/-/media/mas-media-library/development/fintech |
| PDPC guidelines on AI recommendation and decision systemsPDPC Advisory Guidelines on use of Personal Data in AI Recommendation and Decision SystemsConsent notices; data intermediaries; best practices | Guidance (not binding) | Published 1 Mar 2024 (advisory) |
| PDPC's guidelines for AI that recommends or decides (not only generative AI) explain when personal data can be used to develop and deploy such systems, what to tell consumers when seeking consent, and the obligations of third-party developers acting as data intermediaries. They are advisory guidelines read with the PDPA.Do: Use the guidelines to word your consent notice for this use and to set your vendor's data intermediary terms.Source: www.pdpc.gov.sg/organisations/regulations-decisions/regulato |
Malaysia
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| Malaysia ADMP guideline: DPIA for significant automated decisionsPDP Commissioner Guidelines on Automated Decision-Making and Profiling, and on DPIAADMP 6.1, 7.1, 9.3, 10.2.6; DPIA 7.1 | Guidance (not binding) | Regulator guidelines published April 2026 |
| "ADMP is one of the qualitative factors that triggers the requirement to carry out a DPIA, regardless of the nature or extent of its intended use" (ADMP 6.1), where automated decisions or profiling have legal or similarly significant effects, such as credit, employment or different prices for different people (7.1). Notices should disclose automated decision-making (9.3). Not relying on AI as the sole factor is listed as a best practice (10.2.6). These are regulator guidelines, not statute.Do: Decide with your DPO (or privacy lead) whether this use has significant effects on people; if so, run a DPIA before relying on it and tell people in your notice.Source: www.pdp.gov.my/ppdpv1/wp-content/uploads/2026/04/Automated-D |
Australia
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| Australian Privacy Act APP 1.7: automated decisions in your privacy policyPrivacy Act 1988 (Australia), as amended by the Privacy and Other Legislation Amendment Act 2024APP 1.7 to 1.9 | Binding law | From 10 Dec 2026 |
| From 10 December 2026, an APP entity that has arranged for a computer program to make, or do a thing "substantially and directly related to making", a decision that "could reasonably be expected to significantly affect the rights or interests of an individual", using personal information, must say in its APP privacy policy which kinds of personal information are used and which kinds of decisions are made by, or substantially and directly involve, such programs (APP 1.7, 1.8).Note: Applies to APP entities; check the small business exemption.Do: If this use makes or substantially shapes decisions that significantly affect people, add the required description to your privacy policy before 10 December 2026.Source: www.legislation.gov.au/C2024A00128/asmade/2024-12-10/text/or |
United States: Colorado
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| Colorado SB 26-189: deployer notice and human reviewColorado SB 26-189 (ADMT in consequential decisions), C.R.S. 6-1-1701 to 17086-1-1703, 6-1-1704, 6-1-1705, 6-1-1706 | Binding law | From 1 Jan 2027 (decisions made on or after that date) |
| Deployers using covered automated decision-making technology that materially influences consequential decisions (education, employment, residential real estate, financial or lending services, insurance, health-care services, essential government services and public benefits) must give notice before use and, after an adverse outcome, a plain-language explanation within 30 days with a way to request the system's name, version and developer. Consumers get correction and "an opportunity for meaningful human review and reconsideration of the consequential decision, to the extent commercially reasonable." Records are kept for three years. The Attorney General enforces it as a deceptive trade practice, up to $20,000 per violation, with a 60-day cure until 1 January 2030 and no new private right of action.Note: A 27 April 2026 court order in X.AI LLC v. Weiser bars the Attorney General from starting enforcement of SB 24-205 or legislation replacing or amending it (which includes SB 26-189) until 14 days after the court rules on xAI's preliminary-injunction motion, due 28 days after the Attorney General's rules are finally adopted (the rules were still at the proposal stage when this rule was last reviewed and may change). The 1 January 2027 date itself has not moved. Check with counsel. We found no employee-count exemption in the signed act (the earlier SB 24-205 small-deployer carve-out is not in it). Section 6-1-1708 treats certain insurers, HIPAA covered entities (except for employment decisions), FDA-regulated devices and GLBA matters differently; check with counsel.Do: Prepare the pre-use notice, the 30-day adverse-outcome explanation and a human review route; ask your vendor for the developer documentation.Source: leg.colorado.gov/bill_files/116489/download#page=11 |
| Colorado SB 26-189: developer documentationColorado SB 26-189, C.R.S. 6-1-1702, 6-1-17076-1-1702(1)-(5); 6-1-1707(7) | Binding law | From 1 Jan 2027 |
| A developer doing business in Colorado whose system is marketed, contracted or configured to materially influence consequential decisions must give each deployer its intended and known harmful uses, training-data categories, known limitations, instructions for use and human review, and the information the deployer needs for its notices; notify material updates; and keep records, including version identifiers and changelogs, for at least three years. The off-label liability carve-out protects a developer only if it "complied with section 6-1-1702".Note: "Doing business in Colorado" is not defined in the Act. If you build a system only for your own decisions, check with counsel whether you are also a developer.Do: State intended and prohibited uses precisely in your contracts and product pages, and build the documentation pack before 1 January 2027.Source: leg.colorado.gov/bill_files/116489/download#page=19 |
| Colorado SB 26-189: likely out of scopeColorado SB 26-189, C.R.S. 6-1-17016-1-1701(2)(b), 6-1-1701(3)(b) | Scope note (likely does not apply) | Definitions apply from 1 Jan 2027 |
| Consequential decisions exclude customer service triage, advertising, marketing, product recommendations and fraud prevention. The Attorney General's notice of hearing on the proposed rules also states that, under section 6-1-1701(2)(b)(II), "tools used by individuals solely to summarize, organize, translate, draft, route, or present information for human review of administrative processing [sic] are excluded from the definition of ADMT" (wording as in the signed act and the notice). This use is likely outside SB 26-189 unless it makes or shapes a decision about education, employment, residential real estate, financial or lending services, insurance, health-care services, or essential government services and public benefits.Note: likely outsideDo: Write down why the use is out of scope, and ban decision use in your acceptable use policy.Source: leg.colorado.gov/bill_files/116489/download#page=3 |
Coding assistants
AI that writes or reviews code and scripts.
European Union
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| EU AI Act Art. 50(2): machine-readable marking (you are the provider)EU AI Act, Regulation (EU) 2024/1689, as amended by Reg (EU) 2026/1744Art. 50(2); Art. 111(4) | Binding law | Since 2 Aug 2026; systems already on the market before then: by 2 Dec 2026 |
| Providers of AI systems generating synthetic audio, image, video or text must ensure outputs are "marked in a machine-readable format and detectable as artificially generated or manipulated". Providers whose systems were placed on the market before 2 August 2026 "shall take the necessary steps in order to comply with Article 50(2) by 2 December 2026". The duty does not apply to the extent the system performs an assistive function for standard editing or does not substantially alter the input data or its semantics.Do: If you offer a generator under your own name, or modified one and put it into service under your name, make sure its outputs carry machine-readable marks by the date that applies to you.Source: eur-lex.europa.eu/eli/reg/2024/1689/oj/eng#art_50 |
| GDPR lawful basis and privacy noticeGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 6(1); Art. 13 | Binding law | In force (since 25 May 2018) |
| Processing is lawful only on one of the Art. 6(1) bases (for example consent, contract, legal obligation or legitimate interests). When you collect personal data from the person, for example in a chatbot conversation, you must tell them at that time who you are, how to contact you, the purposes and the legal basis, the recipients, any transfer outside the EU and the other Art. 13 items.Do: Record the lawful basis for this AI use, and link a privacy notice covering it from the point of collection (for example a chatbot's first message or a meeting invite).Source: eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_13 |
| GDPR Art. 22: solely automated decisionsGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 22 | Binding law | In force (since 25 May 2018) |
| People have "the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her". Exceptions (contract, law, explicit consent) need safeguards, "at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision". A human approver does not take a decision outside Art. 22 automatically: the Court of Justice held in SCHUFA (C-634/21, 7 December 2023) that an automatically established score constitutes "automated individual decision-making" where a third party, to which it is transmitted, "draws strongly on that probability value to establish, implement or terminate a contractual relationship with that person".Note: Many routine automated outputs, such as a standard price quote, do not have legal or similarly significant effects; check with counsel.Do: If the AI's output decides or effectively decides outcomes with legal or similarly significant effects (for example rejecting an applicant or a loan), make the human review real (able and willing to change the result, and recorded), or rely on an Art. 22 exception with its safeguards.Source: eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ063 |
| GDPR Art. 35: DPIA for automated evaluationGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 35(1), 35(3)(a) | Binding law | In force (since 25 May 2018) |
| A data protection impact assessment is required before processing likely to result in a high risk, in particular "a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person" (Art. 35(3)(a)).Note: likely required where AI shapes hiring or credit decisions; check with counselDo: Run a DPIA for this use before relying on it for decisions about people in the EU.Source: eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_35 |
| GDPR Art. 9: health and other special-category dataGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 9; Art. 35(3)(b) | Binding law | In force (since 25 May 2018) |
| Art. 9(1): processing of "genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited" (with the other special categories it lists) unless an Art. 9(2) condition applies, such as explicit consent. Large-scale processing of special categories requires a DPIA (Art. 35(3)(b)).Note: check with counselDo: Identify the Art. 9 condition for this use before it processes health or other special-category data, and run a DPIA where the processing is large-scale.Source: eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_9 |
Singapore
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| PDPA consent and purpose (s13 to s20)Personal Data Protection Act 2012 (Singapore)s13, s14(2)(a), s14(3), s18, s20(1) | Binding law | In force |
| Collect, use or disclose personal data only with consent or an exception, for purposes a reasonable person would consider appropriate and that you have notified (s13, s18, s20). Consent required as a condition of a product or service beyond what is reasonable is not validly given (s14(2)(a), s14(3)).Do: Check each AI use fits a purpose you told people about; do not bundle AI-training consent into your terms of service.Source: sso.agc.gov.sg/Act/PDPA2012?ProvIds=pr13- |
| PDPC GenAI guidelines: deployer responsibilityPDPC Advisory Guidelines on Use of Personal Data in Generative AIParas 1.5, 7.5, 8.3, 9.1, 9.3 | Guidance (not binding) | Issued 20 Jul 2026 |
| Where the tool uses generative AI: "System Deployers bear primary responsibility for ensuring that the Generative AI Systems they have chosen to use can meet their obligations under the PDPA" (para 9.1). Deployers should safeguard new data sources such as end-user prompts, inputs, generated outputs and agent or tool activity data (para 9.3). The guidelines are advisory and not legally binding (para 1.5); the PDPA itself is.Do: Get your vendor's safeguards in writing (access controls, data residency, retention, input and output filters, incident and breach timelines: paras 7.5, 8.3) and tell staff what personal data may go into prompts.Source: files.app.optical.gov.sg/pdpc/production/assets/143cb9d4-532 |
| PDPC GenAI guidelines: AI-Specific Notifications for trainingPDPC Advisory Guidelines on Use of Personal Data in Generative AIParas 4.2, 4.4, 4.6, footnote 11 | Guidance (not binding) | Issued 20 Jul 2026 |
| You said a model is trained or fine-tuned on this data: "General Notifications are an insufficient means of obtaining consent to use User Data for Generative AI development, specifically, for large-scale Generative AI Model training and/or fine-tuning. Organisations must provide AI-Specific Notifications for this purpose" (para 4.4). This refers only to activities that develop or modify a model's parameters (footnote 11). Check exceptions such as business improvement first (para 4.2).Do: Find out whether you or any vendor trains on your customer data. If so, use an AI-Specific Notification and, where practicable, a way to decline (para 4.6).Source: files.app.optical.gov.sg/pdpc/production/assets/143cb9d4-532 |
| PDPC advisory on unauthorised AI toolsPDPC Advisory for Data Protection Risks When Using Unauthorised AI Tools for the Development of Software or ScriptsShadow AI, human in the loop, testing (linked to PDPA s24) | Guidance (not binding) | Published 30 Sep 2026 (advisory) | You serve Singapore | PDPC groups its recommended measures under three concerns: shadow AI, no human in the loop and inadequate testing, tied to the PDPA section 24 duty to make reasonable security arrangements. Its example: a script built with a public AI tool on a personal account and deployed "without conducting any testing, human review, or approval". It is an advisory recommending measures, not a mandate.Do: Keep a list of approved AI tools and accounts, and require human review and testing before any AI-built script touches customer data.Source: www.pdpc.gov.sg/media-events/advisory-for-data-protection-ri |
Malaysia
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| Malaysia ADMP guideline: DPIA for significant automated decisionsPDP Commissioner Guidelines on Automated Decision-Making and Profiling, and on DPIAADMP 6.1, 7.1, 9.3, 10.2.6; DPIA 7.1 | Guidance (not binding) | Regulator guidelines published April 2026 |
| "ADMP is one of the qualitative factors that triggers the requirement to carry out a DPIA, regardless of the nature or extent of its intended use" (ADMP 6.1), where automated decisions or profiling have legal or similarly significant effects, such as credit, employment or different prices for different people (7.1). Notices should disclose automated decision-making (9.3). Not relying on AI as the sole factor is listed as a best practice (10.2.6). These are regulator guidelines, not statute.Do: Decide with your DPO (or privacy lead) whether this use has significant effects on people; if so, run a DPIA before relying on it and tell people in your notice.Source: www.pdp.gov.my/ppdpv1/wp-content/uploads/2026/04/Automated-D |
Australia
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| Australian Privacy Act APP 1.7: automated decisions in your privacy policyPrivacy Act 1988 (Australia), as amended by the Privacy and Other Legislation Amendment Act 2024APP 1.7 to 1.9 | Binding law | From 10 Dec 2026 |
| From 10 December 2026, an APP entity that has arranged for a computer program to make, or do a thing "substantially and directly related to making", a decision that "could reasonably be expected to significantly affect the rights or interests of an individual", using personal information, must say in its APP privacy policy which kinds of personal information are used and which kinds of decisions are made by, or substantially and directly involve, such programs (APP 1.7, 1.8).Note: Applies to APP entities; check the small business exemption.Do: If this use makes or substantially shapes decisions that significantly affect people, add the required description to your privacy policy before 10 December 2026.Source: www.legislation.gov.au/C2024A00128/asmade/2024-12-10/text/or |
United States: Colorado
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| Colorado SB 26-189: deployer notice and human reviewColorado SB 26-189 (ADMT in consequential decisions), C.R.S. 6-1-1701 to 17086-1-1703, 6-1-1704, 6-1-1705, 6-1-1706 | Binding law | From 1 Jan 2027 (decisions made on or after that date) |
| Deployers using covered automated decision-making technology that materially influences consequential decisions (education, employment, residential real estate, financial or lending services, insurance, health-care services, essential government services and public benefits) must give notice before use and, after an adverse outcome, a plain-language explanation within 30 days with a way to request the system's name, version and developer. Consumers get correction and "an opportunity for meaningful human review and reconsideration of the consequential decision, to the extent commercially reasonable." Records are kept for three years. The Attorney General enforces it as a deceptive trade practice, up to $20,000 per violation, with a 60-day cure until 1 January 2030 and no new private right of action.Note: A 27 April 2026 court order in X.AI LLC v. Weiser bars the Attorney General from starting enforcement of SB 24-205 or legislation replacing or amending it (which includes SB 26-189) until 14 days after the court rules on xAI's preliminary-injunction motion, due 28 days after the Attorney General's rules are finally adopted (the rules were still at the proposal stage when this rule was last reviewed and may change). The 1 January 2027 date itself has not moved. Check with counsel. We found no employee-count exemption in the signed act (the earlier SB 24-205 small-deployer carve-out is not in it). Section 6-1-1708 treats certain insurers, HIPAA covered entities (except for employment decisions), FDA-regulated devices and GLBA matters differently; check with counsel.Do: Prepare the pre-use notice, the 30-day adverse-outcome explanation and a human review route; ask your vendor for the developer documentation.Source: leg.colorado.gov/bill_files/116489/download#page=11 |
| Colorado SB 26-189: developer documentationColorado SB 26-189, C.R.S. 6-1-1702, 6-1-17076-1-1702(1)-(5); 6-1-1707(7) | Binding law | From 1 Jan 2027 |
| A developer doing business in Colorado whose system is marketed, contracted or configured to materially influence consequential decisions must give each deployer its intended and known harmful uses, training-data categories, known limitations, instructions for use and human review, and the information the deployer needs for its notices; notify material updates; and keep records, including version identifiers and changelogs, for at least three years. The off-label liability carve-out protects a developer only if it "complied with section 6-1-1702".Note: "Doing business in Colorado" is not defined in the Act. If you build a system only for your own decisions, check with counsel whether you are also a developer.Do: State intended and prohibited uses precisely in your contracts and product pages, and build the documentation pack before 1 January 2027.Source: leg.colorado.gov/bill_files/116489/download#page=19 |
| Colorado SB 26-189: likely out of scopeColorado SB 26-189, C.R.S. 6-1-17016-1-1701(2)(b), 6-1-1701(3)(b) | Scope note (likely does not apply) | Definitions apply from 1 Jan 2027 |
| Consequential decisions exclude customer service triage, advertising, marketing, product recommendations and fraud prevention. The Attorney General's notice of hearing on the proposed rules also states that, under section 6-1-1701(2)(b)(II), "tools used by individuals solely to summarize, organize, translate, draft, route, or present information for human review of administrative processing [sic] are excluded from the definition of ADMT" (wording as in the signed act and the notice). This use is likely outside SB 26-189 unless it makes or shapes a decision about education, employment, residential real estate, financial or lending services, insurance, health-care services, or essential government services and public benefits.Note: likely outsideDo: Write down why the use is out of scope, and ban decision use in your acceptable use policy.Source: leg.colorado.gov/bill_files/116489/download#page=3 |
Meeting transcription
AI note-takers that record and summarise calls and meetings.
European Union
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| GDPR lawful basis and privacy noticeGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 6(1); Art. 13 | Binding law | In force (since 25 May 2018) |
| Processing is lawful only on one of the Art. 6(1) bases (for example consent, contract, legal obligation or legitimate interests). When you collect personal data from the person, for example in a chatbot conversation, you must tell them at that time who you are, how to contact you, the purposes and the legal basis, the recipients, any transfer outside the EU and the other Art. 13 items.Do: Record the lawful basis for this AI use, and link a privacy notice covering it from the point of collection (for example a chatbot's first message or a meeting invite).Source: eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_13 |
| GDPR Art. 22: solely automated decisionsGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 22 | Binding law | In force (since 25 May 2018) |
| People have "the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her". Exceptions (contract, law, explicit consent) need safeguards, "at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision". A human approver does not take a decision outside Art. 22 automatically: the Court of Justice held in SCHUFA (C-634/21, 7 December 2023) that an automatically established score constitutes "automated individual decision-making" where a third party, to which it is transmitted, "draws strongly on that probability value to establish, implement or terminate a contractual relationship with that person".Note: Many routine automated outputs, such as a standard price quote, do not have legal or similarly significant effects; check with counsel.Do: If the AI's output decides or effectively decides outcomes with legal or similarly significant effects (for example rejecting an applicant or a loan), make the human review real (able and willing to change the result, and recorded), or rely on an Art. 22 exception with its safeguards.Source: eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ063 |
| GDPR Art. 35: DPIA for automated evaluationGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 35(1), 35(3)(a) | Binding law | In force (since 25 May 2018) |
| A data protection impact assessment is required before processing likely to result in a high risk, in particular "a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person" (Art. 35(3)(a)).Note: likely required where AI shapes hiring or credit decisions; check with counselDo: Run a DPIA for this use before relying on it for decisions about people in the EU.Source: eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_35 |
| GDPR Art. 9: health and other special-category dataGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 9; Art. 35(3)(b) | Binding law | In force (since 25 May 2018) |
| Art. 9(1): processing of "genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited" (with the other special categories it lists) unless an Art. 9(2) condition applies, such as explicit consent. Large-scale processing of special categories requires a DPIA (Art. 35(3)(b)).Note: check with counselDo: Identify the Art. 9 condition for this use before it processes health or other special-category data, and run a DPIA where the processing is large-scale.Source: eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_9 |
| EU AI Act: emotion recognition and biometricsEU AI Act, Regulation (EU) 2024/1689Art. 5(1)(f), 5(1)(g); Annex III point 1; Art. 50(3) | Binding law | Art. 5 since 2 Feb 2025; Art. 50(3) since 2 Aug 2026; Annex III from 2 Dec 2027 |
| Your description mentions emotion recognition or biometrics. AI that infers emotions of people at work or in education is prohibited unless for medical or safety reasons (Art. 5(1)(f)), and so is biometric categorisation that deduces or infers race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation (Art. 5(1)(g)). Remote biometric identification, other biometric categorisation by sensitive attributes and emotion recognition are listed as high-risk (Annex III point 1, from 2 December 2027), and deployers of emotion recognition or biometric categorisation systems must inform the people exposed (Art. 50(3)).Note: check with counselDo: Stop any workplace or education emotion-recognition use and any prohibited biometric categorisation now, and get legal advice before using biometric systems on people in the EU.Source: eur-lex.europa.eu/eli/reg/2024/1689/oj/eng#art_5 |
Singapore
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| PDPA consent and purpose (s13 to s20)Personal Data Protection Act 2012 (Singapore)s13, s14(2)(a), s14(3), s18, s20(1) | Binding law | In force |
| Collect, use or disclose personal data only with consent or an exception, for purposes a reasonable person would consider appropriate and that you have notified (s13, s18, s20). Consent required as a condition of a product or service beyond what is reasonable is not validly given (s14(2)(a), s14(3)).Do: Check each AI use fits a purpose you told people about; do not bundle AI-training consent into your terms of service.Source: sso.agc.gov.sg/Act/PDPA2012?ProvIds=pr13- |
| PDPC GenAI guidelines: deployer responsibilityPDPC Advisory Guidelines on Use of Personal Data in Generative AIParas 1.5, 7.5, 8.3, 9.1, 9.3 | Guidance (not binding) | Issued 20 Jul 2026 |
| Where the tool uses generative AI: "System Deployers bear primary responsibility for ensuring that the Generative AI Systems they have chosen to use can meet their obligations under the PDPA" (para 9.1). Deployers should safeguard new data sources such as end-user prompts, inputs, generated outputs and agent or tool activity data (para 9.3). The guidelines are advisory and not legally binding (para 1.5); the PDPA itself is.Do: Get your vendor's safeguards in writing (access controls, data residency, retention, input and output filters, incident and breach timelines: paras 7.5, 8.3) and tell staff what personal data may go into prompts.Source: files.app.optical.gov.sg/pdpc/production/assets/143cb9d4-532 |
| PDPC GenAI guidelines: AI-Specific Notifications for trainingPDPC Advisory Guidelines on Use of Personal Data in Generative AIParas 4.2, 4.4, 4.6, footnote 11 | Guidance (not binding) | Issued 20 Jul 2026 |
| You said a model is trained or fine-tuned on this data: "General Notifications are an insufficient means of obtaining consent to use User Data for Generative AI development, specifically, for large-scale Generative AI Model training and/or fine-tuning. Organisations must provide AI-Specific Notifications for this purpose" (para 4.4). This refers only to activities that develop or modify a model's parameters (footnote 11). Check exceptions such as business improvement first (para 4.2).Do: Find out whether you or any vendor trains on your customer data. If so, use an AI-Specific Notification and, where practicable, a way to decline (para 4.6).Source: files.app.optical.gov.sg/pdpc/production/assets/143cb9d4-532 |
Malaysia
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| Malaysia ADMP guideline: DPIA for significant automated decisionsPDP Commissioner Guidelines on Automated Decision-Making and Profiling, and on DPIAADMP 6.1, 7.1, 9.3, 10.2.6; DPIA 7.1 | Guidance (not binding) | Regulator guidelines published April 2026 |
| "ADMP is one of the qualitative factors that triggers the requirement to carry out a DPIA, regardless of the nature or extent of its intended use" (ADMP 6.1), where automated decisions or profiling have legal or similarly significant effects, such as credit, employment or different prices for different people (7.1). Notices should disclose automated decision-making (9.3). Not relying on AI as the sole factor is listed as a best practice (10.2.6). These are regulator guidelines, not statute.Do: Decide with your DPO (or privacy lead) whether this use has significant effects on people; if so, run a DPIA before relying on it and tell people in your notice.Source: www.pdp.gov.my/ppdpv1/wp-content/uploads/2026/04/Automated-D |
Australia
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| Australian Privacy Act APP 1.7: automated decisions in your privacy policyPrivacy Act 1988 (Australia), as amended by the Privacy and Other Legislation Amendment Act 2024APP 1.7 to 1.9 | Binding law | From 10 Dec 2026 |
| From 10 December 2026, an APP entity that has arranged for a computer program to make, or do a thing "substantially and directly related to making", a decision that "could reasonably be expected to significantly affect the rights or interests of an individual", using personal information, must say in its APP privacy policy which kinds of personal information are used and which kinds of decisions are made by, or substantially and directly involve, such programs (APP 1.7, 1.8).Note: Applies to APP entities; check the small business exemption.Do: If this use makes or substantially shapes decisions that significantly affect people, add the required description to your privacy policy before 10 December 2026.Source: www.legislation.gov.au/C2024A00128/asmade/2024-12-10/text/or |
United States: Colorado
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| Colorado SB 26-189: deployer notice and human reviewColorado SB 26-189 (ADMT in consequential decisions), C.R.S. 6-1-1701 to 17086-1-1703, 6-1-1704, 6-1-1705, 6-1-1706 | Binding law | From 1 Jan 2027 (decisions made on or after that date) |
| Deployers using covered automated decision-making technology that materially influences consequential decisions (education, employment, residential real estate, financial or lending services, insurance, health-care services, essential government services and public benefits) must give notice before use and, after an adverse outcome, a plain-language explanation within 30 days with a way to request the system's name, version and developer. Consumers get correction and "an opportunity for meaningful human review and reconsideration of the consequential decision, to the extent commercially reasonable." Records are kept for three years. The Attorney General enforces it as a deceptive trade practice, up to $20,000 per violation, with a 60-day cure until 1 January 2030 and no new private right of action.Note: A 27 April 2026 court order in X.AI LLC v. Weiser bars the Attorney General from starting enforcement of SB 24-205 or legislation replacing or amending it (which includes SB 26-189) until 14 days after the court rules on xAI's preliminary-injunction motion, due 28 days after the Attorney General's rules are finally adopted (the rules were still at the proposal stage when this rule was last reviewed and may change). The 1 January 2027 date itself has not moved. Check with counsel. We found no employee-count exemption in the signed act (the earlier SB 24-205 small-deployer carve-out is not in it). Section 6-1-1708 treats certain insurers, HIPAA covered entities (except for employment decisions), FDA-regulated devices and GLBA matters differently; check with counsel.Do: Prepare the pre-use notice, the 30-day adverse-outcome explanation and a human review route; ask your vendor for the developer documentation.Source: leg.colorado.gov/bill_files/116489/download#page=11 |
| Colorado SB 26-189: developer documentationColorado SB 26-189, C.R.S. 6-1-1702, 6-1-17076-1-1702(1)-(5); 6-1-1707(7) | Binding law | From 1 Jan 2027 |
| A developer doing business in Colorado whose system is marketed, contracted or configured to materially influence consequential decisions must give each deployer its intended and known harmful uses, training-data categories, known limitations, instructions for use and human review, and the information the deployer needs for its notices; notify material updates; and keep records, including version identifiers and changelogs, for at least three years. The off-label liability carve-out protects a developer only if it "complied with section 6-1-1702".Note: "Doing business in Colorado" is not defined in the Act. If you build a system only for your own decisions, check with counsel whether you are also a developer.Do: State intended and prohibited uses precisely in your contracts and product pages, and build the documentation pack before 1 January 2027.Source: leg.colorado.gov/bill_files/116489/download#page=19 |
| Colorado SB 26-189: likely out of scopeColorado SB 26-189, C.R.S. 6-1-17016-1-1701(2)(b), 6-1-1701(3)(b) | Scope note (likely does not apply) | Definitions apply from 1 Jan 2027 |
| Consequential decisions exclude customer service triage, advertising, marketing, product recommendations and fraud prevention. The Attorney General's notice of hearing on the proposed rules also states that, under section 6-1-1701(2)(b)(II), "tools used by individuals solely to summarize, organize, translate, draft, route, or present information for human review of administrative processing [sic] are excluded from the definition of ADMT" (wording as in the signed act and the notice). This use is likely outside SB 26-189 unless it makes or shapes a decision about education, employment, residential real estate, financial or lending services, insurance, health-care services, or essential government services and public benefits.Note: likely outsideDo: Write down why the use is out of scope, and ban decision use in your acceptable use policy.Source: leg.colorado.gov/bill_files/116489/download#page=3 |
Other: describe
Any other AI use. Describe it; the general rules for your markets still apply.
European Union
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| EU AI Act Art. 50(2): machine-readable marking (you are the provider)EU AI Act, Regulation (EU) 2024/1689, as amended by Reg (EU) 2026/1744Art. 50(2); Art. 111(4) | Binding law | Since 2 Aug 2026; systems already on the market before then: by 2 Dec 2026 |
| Providers of AI systems generating synthetic audio, image, video or text must ensure outputs are "marked in a machine-readable format and detectable as artificially generated or manipulated". Providers whose systems were placed on the market before 2 August 2026 "shall take the necessary steps in order to comply with Article 50(2) by 2 December 2026". The duty does not apply to the extent the system performs an assistive function for standard editing or does not substantially alter the input data or its semantics.Do: If you offer a generator under your own name, or modified one and put it into service under your name, make sure its outputs carry machine-readable marks by the date that applies to you.Source: eur-lex.europa.eu/eli/reg/2024/1689/oj/eng#art_50 |
| EU AI Act: classify your other use by handEU AI Act, as amended by Regulation (EU) 2026/1744Art. 5; Art. 6 and Annexes I and III; Art. 50 | Binding law | Art. 5 since 2 Feb 2025 (new prohibitions from 2 Dec 2026); Art. 50 since 2 Aug 2026; Annex III from 2 Dec 2027; Annex I from 2 Aug 2028 |
| This tool cannot classify a use you describe yourself. Check it against the prohibited practices (Art. 5), the high-risk lists (Art. 6 with Annex III, from 2 December 2027, and Annex I, from 2 August 2028) and the transparency duties (Art. 50) if it talks to people or generates content.Note: check with counselDo: Classify this use by hand in your Article 6 memo.Source: eur-lex.europa.eu/eli/reg/2026/1744/oj/eng#art_1 |
| GDPR lawful basis and privacy noticeGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 6(1); Art. 13 | Binding law | In force (since 25 May 2018) |
| Processing is lawful only on one of the Art. 6(1) bases (for example consent, contract, legal obligation or legitimate interests). When you collect personal data from the person, for example in a chatbot conversation, you must tell them at that time who you are, how to contact you, the purposes and the legal basis, the recipients, any transfer outside the EU and the other Art. 13 items.Do: Record the lawful basis for this AI use, and link a privacy notice covering it from the point of collection (for example a chatbot's first message or a meeting invite).Source: eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_13 |
| GDPR Art. 22: solely automated decisionsGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 22 | Binding law | In force (since 25 May 2018) |
| People have "the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her". Exceptions (contract, law, explicit consent) need safeguards, "at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision". A human approver does not take a decision outside Art. 22 automatically: the Court of Justice held in SCHUFA (C-634/21, 7 December 2023) that an automatically established score constitutes "automated individual decision-making" where a third party, to which it is transmitted, "draws strongly on that probability value to establish, implement or terminate a contractual relationship with that person".Note: Many routine automated outputs, such as a standard price quote, do not have legal or similarly significant effects; check with counsel.Do: If the AI's output decides or effectively decides outcomes with legal or similarly significant effects (for example rejecting an applicant or a loan), make the human review real (able and willing to change the result, and recorded), or rely on an Art. 22 exception with its safeguards.Source: eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ063 |
| GDPR Art. 35: DPIA for automated evaluationGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 35(1), 35(3)(a) | Binding law | In force (since 25 May 2018) |
| A data protection impact assessment is required before processing likely to result in a high risk, in particular "a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person" (Art. 35(3)(a)).Note: likely required where AI shapes hiring or credit decisions; check with counselDo: Run a DPIA for this use before relying on it for decisions about people in the EU.Source: eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_35 |
| GDPR Art. 9: health and other special-category dataGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 9; Art. 35(3)(b) | Binding law | In force (since 25 May 2018) |
| Art. 9(1): processing of "genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited" (with the other special categories it lists) unless an Art. 9(2) condition applies, such as explicit consent. Large-scale processing of special categories requires a DPIA (Art. 35(3)(b)).Note: check with counselDo: Identify the Art. 9 condition for this use before it processes health or other special-category data, and run a DPIA where the processing is large-scale.Source: eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_9 |
| EU AI Act: emotion recognition and biometricsEU AI Act, Regulation (EU) 2024/1689Art. 5(1)(f), 5(1)(g); Annex III point 1; Art. 50(3) | Binding law | Art. 5 since 2 Feb 2025; Art. 50(3) since 2 Aug 2026; Annex III from 2 Dec 2027 |
| Your description mentions emotion recognition or biometrics. AI that infers emotions of people at work or in education is prohibited unless for medical or safety reasons (Art. 5(1)(f)), and so is biometric categorisation that deduces or infers race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation (Art. 5(1)(g)). Remote biometric identification, other biometric categorisation by sensitive attributes and emotion recognition are listed as high-risk (Annex III point 1, from 2 December 2027), and deployers of emotion recognition or biometric categorisation systems must inform the people exposed (Art. 50(3)).Note: check with counselDo: Stop any workplace or education emotion-recognition use and any prohibited biometric categorisation now, and get legal advice before using biometric systems on people in the EU.Source: eur-lex.europa.eu/eli/reg/2024/1689/oj/eng#art_5 |
| EU AI Act Annex III 3: AI in educationEU AI Act, as amended by Regulation (EU) 2026/1744Annex III point 3; Art. 5(1)(f) | Binding law | From 2 Dec 2027 (Annex III); Art. 5(1)(f) since 2 Feb 2025 |
| AI used to decide admission to education or training, to evaluate learning outcomes, to assess the level of education a person will receive, or to monitor students during tests is listed as high-risk (Annex III point 3). Inferring students' emotions in education institutions is prohibited (Art. 5(1)(f)).Note: likely high-risk if it decides or assesses learners; check with counselDo: Check whether this use admits, grades, assesses or proctors learners; if so, treat it as likely high-risk and plan for 2 December 2027.Source: eur-lex.europa.eu/eli/reg/2024/1689/oj/eng#anx_III |
| EU AI Act Art. 53: general-purpose AI model providersEU AI Act, Regulation (EU) 2024/1689Art. 53 (Chapter V) | Binding law | Chapter V applies since 2 Aug 2025 |
| Your description suggests you develop a general-purpose AI model. Providers of general-purpose AI models must keep technical documentation of the model, including its training and testing, and make information and documentation available to providers who integrate the model, among other Art. 53 duties. The Chapter V rules have applied since 2 August 2025.Note: check with counselDo: Confirm whether you place a general-purpose AI model on the EU market; if so, get specialist advice on Art. 53 (and Art. 55 for models with systemic risk).Source: eur-lex.europa.eu/eli/reg/2024/1689/oj/eng#art_53 |
Singapore
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| PDPA consent and purpose (s13 to s20)Personal Data Protection Act 2012 (Singapore)s13, s14(2)(a), s14(3), s18, s20(1) | Binding law | In force |
| Collect, use or disclose personal data only with consent or an exception, for purposes a reasonable person would consider appropriate and that you have notified (s13, s18, s20). Consent required as a condition of a product or service beyond what is reasonable is not validly given (s14(2)(a), s14(3)).Do: Check each AI use fits a purpose you told people about; do not bundle AI-training consent into your terms of service.Source: sso.agc.gov.sg/Act/PDPA2012?ProvIds=pr13- |
| PDPC GenAI guidelines: deployer responsibilityPDPC Advisory Guidelines on Use of Personal Data in Generative AIParas 1.5, 7.5, 8.3, 9.1, 9.3 | Guidance (not binding) | Issued 20 Jul 2026 |
| Where the tool uses generative AI: "System Deployers bear primary responsibility for ensuring that the Generative AI Systems they have chosen to use can meet their obligations under the PDPA" (para 9.1). Deployers should safeguard new data sources such as end-user prompts, inputs, generated outputs and agent or tool activity data (para 9.3). The guidelines are advisory and not legally binding (para 1.5); the PDPA itself is.Do: Get your vendor's safeguards in writing (access controls, data residency, retention, input and output filters, incident and breach timelines: paras 7.5, 8.3) and tell staff what personal data may go into prompts.Source: files.app.optical.gov.sg/pdpc/production/assets/143cb9d4-532 |
| PDPC GenAI guidelines: AI-Specific Notifications for trainingPDPC Advisory Guidelines on Use of Personal Data in Generative AIParas 4.2, 4.4, 4.6, footnote 11 | Guidance (not binding) | Issued 20 Jul 2026 |
| You said a model is trained or fine-tuned on this data: "General Notifications are an insufficient means of obtaining consent to use User Data for Generative AI development, specifically, for large-scale Generative AI Model training and/or fine-tuning. Organisations must provide AI-Specific Notifications for this purpose" (para 4.4). This refers only to activities that develop or modify a model's parameters (footnote 11). Check exceptions such as business improvement first (para 4.2).Do: Find out whether you or any vendor trains on your customer data. If so, use an AI-Specific Notification and, where practicable, a way to decline (para 4.6).Source: files.app.optical.gov.sg/pdpc/production/assets/143cb9d4-532 |
| IMDA agentic AI framework v1.5 (voluntary)IMDA Model AI Governance Framework for Agentic AI, Version 1.5Section 2.2 (accountability, human checkpoints); agent identity | Guidance (not binding) | Version 1.5 published 20 May 2026, updated 5 Jun 2026 (voluntary) |
| "As deployers, organisations and humans remain accountable for the decisions and actions of agents" (2.2.1). The framework recommends human approval at significant checkpoints and auditing whether those approvals are effective, and says that "all agent identities (and their attendant permissions) should be issued from and tracked by a centralised system". It is voluntary guidance, not law.Do: Give each agent its own identity and the narrowest permissions, define which actions need human approval, and test that you can stop it.Source: www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-r |
| MAS SAFR runtime safeguards (industry reference)SAFR (Safeguards for Agentic Finance at Runtime) white paper, BuildFin.ai with MASVersion 1.0, July 2026 | Guidance (not binding) | Published 3 Jul 2026 (industry reference, not regulatory guidance) |
| SAFR "does not constitute regulatory guidance or supervisory expectations". It describes a runtime layer that checks each agent action before execution (Deny, Escalate, Auto-Execute or Observe) and keeps a tamper-evident audit log, with controls owned by risk and compliance leadership.Do: Use it as a design reference for limits, escalation and logging on any agent that acts on its own.Source: www.mas.gov.sg/-/media/mas-media-library/development/fintech |
| PDPC guidelines on AI recommendation and decision systemsPDPC Advisory Guidelines on use of Personal Data in AI Recommendation and Decision SystemsConsent notices; data intermediaries; best practices | Guidance (not binding) | Published 1 Mar 2024 (advisory) |
| PDPC's guidelines for AI that recommends or decides (not only generative AI) explain when personal data can be used to develop and deploy such systems, what to tell consumers when seeking consent, and the obligations of third-party developers acting as data intermediaries. They are advisory guidelines read with the PDPA.Do: Use the guidelines to word your consent notice for this use and to set your vendor's data intermediary terms.Source: www.pdpc.gov.sg/organisations/regulations-decisions/regulato |
Malaysia
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| Malaysia ADMP guideline: DPIA for significant automated decisionsPDP Commissioner Guidelines on Automated Decision-Making and Profiling, and on DPIAADMP 6.1, 7.1, 9.3, 10.2.6; DPIA 7.1 | Guidance (not binding) | Regulator guidelines published April 2026 |
| "ADMP is one of the qualitative factors that triggers the requirement to carry out a DPIA, regardless of the nature or extent of its intended use" (ADMP 6.1), where automated decisions or profiling have legal or similarly significant effects, such as credit, employment or different prices for different people (7.1). Notices should disclose automated decision-making (9.3). Not relying on AI as the sole factor is listed as a best practice (10.2.6). These are regulator guidelines, not statute.Do: Decide with your DPO (or privacy lead) whether this use has significant effects on people; if so, run a DPIA before relying on it and tell people in your notice.Source: www.pdp.gov.my/ppdpv1/wp-content/uploads/2026/04/Automated-D |
Australia
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| Australian Privacy Act APP 1.7: automated decisions in your privacy policyPrivacy Act 1988 (Australia), as amended by the Privacy and Other Legislation Amendment Act 2024APP 1.7 to 1.9 | Binding law | From 10 Dec 2026 |
| From 10 December 2026, an APP entity that has arranged for a computer program to make, or do a thing "substantially and directly related to making", a decision that "could reasonably be expected to significantly affect the rights or interests of an individual", using personal information, must say in its APP privacy policy which kinds of personal information are used and which kinds of decisions are made by, or substantially and directly involve, such programs (APP 1.7, 1.8).Note: Applies to APP entities; check the small business exemption.Do: If this use makes or substantially shapes decisions that significantly affect people, add the required description to your privacy policy before 10 December 2026.Source: www.legislation.gov.au/C2024A00128/asmade/2024-12-10/text/or |
United States: Colorado
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| Colorado SB 26-189: deployer notice and human reviewColorado SB 26-189 (ADMT in consequential decisions), C.R.S. 6-1-1701 to 17086-1-1703, 6-1-1704, 6-1-1705, 6-1-1706 | Binding law | From 1 Jan 2027 (decisions made on or after that date) |
| Deployers using covered automated decision-making technology that materially influences consequential decisions (education, employment, residential real estate, financial or lending services, insurance, health-care services, essential government services and public benefits) must give notice before use and, after an adverse outcome, a plain-language explanation within 30 days with a way to request the system's name, version and developer. Consumers get correction and "an opportunity for meaningful human review and reconsideration of the consequential decision, to the extent commercially reasonable." Records are kept for three years. The Attorney General enforces it as a deceptive trade practice, up to $20,000 per violation, with a 60-day cure until 1 January 2030 and no new private right of action.Note: A 27 April 2026 court order in X.AI LLC v. Weiser bars the Attorney General from starting enforcement of SB 24-205 or legislation replacing or amending it (which includes SB 26-189) until 14 days after the court rules on xAI's preliminary-injunction motion, due 28 days after the Attorney General's rules are finally adopted (the rules were still at the proposal stage when this rule was last reviewed and may change). The 1 January 2027 date itself has not moved. Check with counsel. We found no employee-count exemption in the signed act (the earlier SB 24-205 small-deployer carve-out is not in it). Section 6-1-1708 treats certain insurers, HIPAA covered entities (except for employment decisions), FDA-regulated devices and GLBA matters differently; check with counsel.Do: Prepare the pre-use notice, the 30-day adverse-outcome explanation and a human review route; ask your vendor for the developer documentation.Source: leg.colorado.gov/bill_files/116489/download#page=11 |
| Colorado SB 26-189: developer documentationColorado SB 26-189, C.R.S. 6-1-1702, 6-1-17076-1-1702(1)-(5); 6-1-1707(7) | Binding law | From 1 Jan 2027 |
| A developer doing business in Colorado whose system is marketed, contracted or configured to materially influence consequential decisions must give each deployer its intended and known harmful uses, training-data categories, known limitations, instructions for use and human review, and the information the deployer needs for its notices; notify material updates; and keep records, including version identifiers and changelogs, for at least three years. The off-label liability carve-out protects a developer only if it "complied with section 6-1-1702".Note: "Doing business in Colorado" is not defined in the Act. If you build a system only for your own decisions, check with counsel whether you are also a developer.Do: State intended and prohibited uses precisely in your contracts and product pages, and build the documentation pack before 1 January 2027.Source: leg.colorado.gov/bill_files/116489/download#page=19 |
| Colorado SB 26-189: likely out of scopeColorado SB 26-189, C.R.S. 6-1-17016-1-1701(2)(b), 6-1-1701(3)(b) | Scope note (likely does not apply) | Definitions apply from 1 Jan 2027 |
| Consequential decisions exclude customer service triage, advertising, marketing, product recommendations and fraud prevention. The Attorney General's notice of hearing on the proposed rules also states that, under section 6-1-1701(2)(b)(II), "tools used by individuals solely to summarize, organize, translate, draft, route, or present information for human review of administrative processing [sic] are excluded from the definition of ADMT" (wording as in the signed act and the notice). This use is likely outside SB 26-189 unless it makes or shapes a decision about education, employment, residential real estate, financial or lending services, insurance, health-care services, or essential government services and public benefits.Note: likely outsideDo: Write down why the use is out of scope, and ban decision use in your acceptable use policy.Source: leg.colorado.gov/bill_files/116489/download#page=3 |
Company-wide obligations
These apply once to the business when at least one of your uses meets the conditions.
European Union
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| EU AI Act reach (Art. 2)EU AI Act, Regulation (EU) 2024/1689Art. 2(1) | Binding law | Applies now (Chapters I and II since 2 Feb 2025) |
| The Act applies to providers that place AI systems on the EU market or put them into service there, to deployers established or located in the EU, and to providers and deployers outside the EU "where the output produced by the AI system is used in the Union" (Art. 2(1)). A Singapore or Malaysian company with an EU office, or whose AI output reaches people in the EU, should assume it is caught.Do: Record which AI uses produce output used in the EU, and keep a short dated note on whether any could be high-risk under Article 6 (the high-risk duties apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems).Source: eur-lex.europa.eu/eli/reg/2024/1689/oj/eng#art_2 |
| EU AI Act Art. 4: AI literacyEU AI Act, Regulation (EU) 2024/1689Art. 4 (as amended by Reg (EU) 2026/1744) | Binding law | Applies now (since 2 Feb 2025) |
| AI literacy for staff and anyone operating AI systems on your behalf has applied since 2 February 2025, for all AI systems regardless of risk level. Regulation (EU) 2026/1744 amended Article 4 to "take measures to support the development of AI literacy".Note: The wording was amended in July 2026; check with counsel how the amended duty applies to you.Do: Take and record measures that support AI literacy for the people who use or operate these AI tools; short role-based training is a common measure.Source: eur-lex.europa.eu/eli/reg/2026/1744/oj/eng#art_1 |
| EU AI Act Art. 5: prohibited practices checkEU AI Act, Regulation (EU) 2024/1689Art. 5; Art. 99 | Binding law | Applies now (since 2 Feb 2025) |
| The prohibited AI practices in Article 5 have applied since 2 February 2025. They include AI used to infer the emotions of people in the workplace or in education institutions, except for medical or safety reasons (Art. 5(1)(f)). Breaching them carries fines of up to EUR 35,000,000 or 7% of worldwide annual turnover (Article 99).Do: Confirm in writing that none of your AI uses is a prohibited practice under Article 5, and re-check when you add a use.Source: eur-lex.europa.eu/eli/reg/2024/1689/oj/eng#art_5 |
| EU AI Act Art. 99: fines and the SME capEU AI Act, Regulation (EU) 2024/1689Art. 99(3), 99(4), 99(5), 99(6), 99(6a) | Binding law | Applies now (penalty regime since 2 Aug 2025) |
| Maximum fines: EUR 35,000,000 or 7% of worldwide annual turnover for Article 5 breaches; EUR 15,000,000 or 3% for other obligations, including Article 50; EUR 7,500,000 or 1% for supplying incorrect or misleading information. For SMEs, including start-ups, each fine is capped at the lower of the two amounts (Art. 99(6)); Reg (EU) 2026/1744 adds a lower-of cap for small mid-caps (Art. 99(6a)); check its exact scope with counsel.Do: Keep the evidence (register, memo, notices, training records) that shows what you did and when.Source: eur-lex.europa.eu/eli/reg/2024/1689/oj/eng#art_99 |
| GDPR reach and EU representativeGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 3(2); Art. 27; Art. 83(5) | Binding law | In force (since 25 May 2018) |
| The GDPR applies to a controller not established in the EU that processes personal data of people in the EU where the processing relates to "the offering of goods or services" to them or "the monitoring of their behaviour" there (Art. 3(2)). Such a controller must designate in writing a representative in the Union (Art. 27), unless the processing is occasional, does not include large-scale special-category or criminal-conviction data, and is unlikely to result in a risk. The highest fines reach EUR 20,000,000 or 4% of worldwide annual turnover (Art. 83(5)).Note: Whether you "offer" to people in the EU depends on facts such as language, currency and delivery; check with counsel.Do: Decide in writing whether you offer goods or services to people in the EU; if so, record whether you need an EU representative under Art. 27.Source: eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_3 |
| GDPR Arts 33-34: breach notificationGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 33, Art. 34 | Binding law | In force (since 25 May 2018) |
| A personal data breach must be notified to the competent supervisory authority "without undue delay and, where feasible, not later than 72 hours after having become aware of it", unless it is unlikely to result in a risk (Art. 33). Where it is likely to result in a high risk, the people affected must also be told without undue delay (Art. 34).Do: Add the 72-hour EU clock and the high-risk notice to your breach runbook, including breaches at your AI vendors.Source: eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_33 |
| GDPR Art. 28 processor terms and Chapter V transfersGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 28; Arts 44, 46 | Binding law | In force (since 25 May 2018) |
| A controller may use only processors "providing sufficient guarantees", under a contract with the Art. 28 terms. Transfers of personal data to a country outside the EU, such as to an AI vendor's servers, are allowed only under Chapter V, for example an adequacy decision or appropriate safeguards such as standard contractual clauses (Arts 44, 46).Do: Sign Art. 28 processing terms with each AI vendor that handles EU personal data, and record the transfer mechanism for each one.Source: eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_28 |
| GDPR Art. 8: children's consent onlineGeneral Data Protection Regulation, Regulation (EU) 2016/679Art. 8 | Binding law | In force (since 25 May 2018) |
| Where consent is the basis for offering an online service directly to a child, processing a child's data is lawful only from age 16, or with consent given or authorised by the holder of parental responsibility; EU countries may set a lower age, not below 13.Note: Member State ages vary; check with counsel.Do: Check the age rules in each EU country you serve and design parental consent where children use the AI.Source: eur-lex.europa.eu/eli/reg/2016/679/oj/eng#art_8 |
Singapore
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| PDPA s4(3): you answer for your AI vendorsPersonal Data Protection Act 2012 (Singapore)s4(2), s4(3), s12; s48J(3) | Binding law | In force |
| An organisation "has the same obligation under this Act in respect of personal data processed on its behalf and for its purposes by a data intermediary as if the personal data were processed by the organisation itself" (s4(3)). An AI vendor acting as your data intermediary under a written contract stays bound by the protection (s24) and retention (s25) duties and the breach-notification duties (s4(2)). The maximum financial penalty is 10% of annual Singapore turnover where that turnover exceeds S$10 million, otherwise S$1 million (s48J(3)).Do: Name an owner for each AI use, put every AI vendor that handles personal data under a written contract, and keep this register current.Source: sso.agc.gov.sg/Act/PDPA2012?ProvIds=pr4- |
| PDPA breach assessment and 3-day notificationPersonal Data Protection Act 2012 (Singapore), Part 6As26B, s26C(2), s26C(3)(a), s26D(1), s26D(2) | Binding law | In force (since 1 Feb 2021) |
| Once there is reason to believe a data breach has occurred, assess it "in a reasonable and expeditious manner" (s26C(2)). A breach is notifiable if it results or is likely to result in significant harm, or is of significant scale (500 or more individuals). Notify PDPC "as soon as is practicable, but in any case no later than 3 calendar days after the day the organisation makes that assessment" (s26D(1)). You must also notify each affected individual where the breach is likely to result in significant harm, unless an exception applies (s26D(2)), and a data intermediary, such as an AI vendor processing data for you, must tell you "without undue delay" when it has reason to believe a breach has occurred (s26C(3)(a)).Do: Add AI incidents (wrong recipient, leaked prompt, agent misuse) to your breach-assessment runbook and name who decides.Source: sso.agc.gov.sg/Act/PDPA2012?ProvIds=pr26D- |
| MAS AI risk management guidelines (proposed)MAS Consultation Paper on Guidelines on AI Risk Management (P017-2025)Proposed paras 4.4, 4.7, 4.10, 4.11 | Proposal (not law yet) | Consultation 13 Nov 2025 to 31 Jan 2026; MAS said on 5 Aug 2026 the guidelines "will be finalised soon" |
| Proposed supervisory expectations for all AI used by financial institutions, including generative AI and AI agents: human oversight (4.10), third-party AI (4.11), and for high-risk AI: "For AI with 'kill switches', clear contingency activation protocols should be in place and tested regularly" (4.4). A 12-month transition after issue is proposed (4.7). MAS told Parliament on 5 August 2026 the guidelines "will be finalised soon".Do: Build the AI inventory, oversight records and third-party checks now, and track the final text.Source: www.mas.gov.sg/-/media/mas-media-library/publications/consul |
| MAS outsourcing and third-party expectationsMAS Guidelines on Outsourcing (Banks, and FIs other than Banks); MAS Third-Party Risk Management consultation (P004-2026)Outsourcing (Banks) 1.1, 3.4.2, 3.7.2(c); AIRG consultation footnote 21 | Guidance (not binding) | Banks: in effect since 11 Dec 2024 (supervisory expectations); other FIs follow the outsourcing guidelines for FIs other than banks; TPRM consultation closed 20 Apr 2026 |
| "Outsourcing does not diminish the obligations of an institution" (1.1). MAS's AI consultation says outsourcing and third-party expectations "would apply to the use of third-party AI" (footnote 21). The March 2026 third-party risk consultation would supersede the outsourcing guidelines and extend them to all third-party services (a proposal). Insurers and other non-bank FIs follow the separate Guidelines on Outsourcing (Financial Institutions other than Banks); the paragraph numbers cited here are from the banks version.Do: Assess each AI vendor's materiality; contract for audit, notice of adverse developments, termination and deletion of your data on exit.Source: www.mas.gov.sg/-/media/mas-media-library/regulation/guidelin |
| PDPA s26: transfers outside SingaporePersonal Data Protection Act 2012 (Singapore)s26; PDP Regulations 2021 Part 3 | Binding law | In force |
| "An organisation must not transfer any personal data to a country or territory outside Singapore except in accordance with requirements prescribed under this Act" to ensure a comparable standard of protection (s26(1)). Sending customer data or prompts to an AI vendor's servers overseas is a transfer.Do: For each AI vendor that processes Singapore personal data overseas, record where, and the contractual or other safeguard that meets the transfer requirements.Source: sso.agc.gov.sg/Act/PDPA2012?ProvIds=pr26- |
| PDPA s11: data protection officerPersonal Data Protection Act 2012 (Singapore)s11(3), s11(5) | Binding law | In force |
| "An organisation must designate one or more individuals to be responsible for ensuring that the organisation complies with this Act" (s11(3)), and must make the business contact information of at least one of them available to the public (s11(5)).Do: Name your data protection officer, publish their business contact, and make them the owner of AI data questions in the register.Source: sso.agc.gov.sg/Act/PDPA2012?ProvIds=pr11- |
| MAS Notices FSM-N05 (technology risk) and FSM-N06 (cyber hygiene)MAS Notice FSM-N05 Technology Risk Management; MAS Notice FSM-N06 Cyber HygieneIssued under the Financial Services and Markets Act 2022 | Binding law | In effect since 10 May 2024 (banks) |
| For banks in Singapore, FSM-N05 sets requirements for "a high level of reliability, availability and recoverability of critical IT systems" and IT controls to protect customer information, and FSM-N06 sets cyber hygiene requirements (administrative accounts, patching, security baselines, network security, anti-malware, user authentication). AI systems that run on or connect to critical systems fall within them. Other MAS-regulated institutions have their own notices.Note: These notices apply to banks; check the notices for your licence type.Do: If you are a bank, map each AI system against FSM-N05 and FSM-N06; other financial institutions should check which equivalent MAS notices apply to them.Source: www.mas.gov.sg/regulation/notices/notice-fsm-n05 |
Malaysia
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| Malaysia AI Governance Bill (draft)Malaysia AI Governance Bill (draft)Not yet tabled | Proposal (not law yet) | Draft; being submitted to Cabinet (Bernama, 10 September 2026); no commencement date announced | You serve Malaysia | Malaysia's AI bill is not law. On 10 September 2026 the Digital Minister said the draft was being submitted to Cabinet and that he hoped to table it in Parliament that quarter or, if not, in the first quarter of 2027. That report gave no penalties, reach or start date for the bill. Public consultation submissions discuss risk tiers and developer and deployer roles; these may change.Do: Do the work that serves any final text: an AI inventory, a named owner per system, and impact assessments where personal data rules already ask for them.Source: www.bernama.com/en/general/news.php?id=2605398 |
| Malaysia PDPA amendments: DPO, breach notice, processorsPersonal Data Protection Act 2010 (Malaysia), as amended by Act A1727s5(1A), s5(2), s12A, s12B; P.U.(B) 522 | Binding law | In force in stages (1 Jan, 1 Apr and 1 Jun 2025) |
| From 1 April 2025, data processors must comply with the Security Principle and the maximum penalty for breaching the principles rose to RM1 million, three years in prison, or both; biometric data became sensitive personal data. From 1 June 2025, data controllers and processors must appoint a data protection officer where the Commissioner's DPO requirements apply to them, and data controllers must notify the Commissioner of a personal data breach "as soon as practicable" (s12B); the Commissioner's data breach notification form asks whether you are submitting it "within the 72 hours after becoming aware", so treat 72 hours as the working deadline; failing to notify carries up to RM250,000 or two years.Note: This tool has not checked the thresholds in the Commissioner's DPO guidance; check them, or ask counsel.Do: Check whether the Commissioner's DPO requirements apply to you and, if so, appoint a DPO; put AI vendors that process personal data under the Security Principle in contract; add AI incidents to the breach procedure.Source: www.pdp.gov.my/ppdpv1/wp-content/uploads/2024/11/Act-A1727.p |
| Malaysia DPIA guideline: volume triggersPDP Commissioner Data Protection Impact Assessment GuidelineParas 7.1, 7.5, 11.2 | Guidance (not binding) | Regulator guideline published April 2026 |
| "A data controller shall carry out a DPIA if the data controller foresees that a processing operation is likely to result in a high risk" (7.1). Quantitative triggers include personal data of more than 20,000 data subjects, or sensitive personal data, including financial information, of more than 10,000 (7.5). A DPIA stays valid for two years (11.2). These are triggers for a DPIA, not a requirement for every business: below the thresholds and without high risk, a DPIA is a judgement for your DPO.Do: Count the people whose data each AI use processes; above the thresholds, schedule a DPIA.Source: www.pdp.gov.my/ppdpv1/wp-content/uploads/2026/04/Data-Protec |
| Malaysia AIGE principles (voluntary)MOSTI National Guidelines on AI Governance and Ethics (AIGE)Seven principles | Guidance (not binding) | Published Sep 2024 (voluntary) | You serve Malaysia | The guidelines describe themselves as voluntary. Their seven principles are fairness; reliability, safety and control; privacy and security; inclusiveness; transparency; accountability; and the pursuit of human benefit and happiness.Do: Use the seven principles as the headings of your AI policy and vendor questionnaire.Source: www.mosti.gov.my/wp-content/uploads/2024/09/NATIONAL-GUIDELI |
| Malaysia PDPA principles (notice, consent, security, retention)Personal Data Protection Act 2010 (Act 709, Malaysia), as amended by Act A1727 ("data user" is now "data controller")ss 6-12 (seven principles); s7(3); s40; s129 | Binding law | In force (s129 amended from 1 Apr 2025) |
| Personal data used in commercial transactions must follow seven principles: General (consent and a lawful, directly related, not excessive purpose, s6), Notice and Choice (a written notice, s7, "in the national and English languages", s7(3)), Disclosure (s8), Security (s9), Retention (s10), Data Integrity (s11) and Access (s12). Since 1 April 2025 a transfer outside Malaysia rests on the conditions in the amended s129 rather than a ministerial whitelist. Sensitive personal data, which includes health and, since 1 April 2025, biometric data, may be processed only with explicit consent or another s40 condition.Do: Update your written privacy notice in Malay and English to cover each AI use, set retention periods for AI inputs and outputs, and record the s129 basis for any AI vendor that processes data outside Malaysia.Source: www.pdp.gov.my/ppdpv1/wp-content/uploads/2024/07/UNDANG-UNDA |
| BNM technology risk (RMiT) and outsourcing (if you are BNM-licensed)Bank Negara Malaysia policy documents: Risk Management in Technology (RMiT); OutsourcingRMiT (BNM/RH/PD 028-98) para 4.1; Outsourcing (BNM/RH/PD 028-93) para 4.1 | Binding law | RMiT in effect from 28 Nov 2025 (except where stated); Outsourcing from 23 Oct 2019 |
| RMiT applies to licensed banks, investment banks, Islamic banks, insurers, takaful operators, prescribed development financial institutions and certain payment and e-money institutions; in BNM policy documents "S" denotes a standard, an obligation or requirement. The version published on BNM's website states: "This policy document comes into effect on 28 November 2025 except where otherwise stated explicitly in this policy document." The Outsourcing policy document (in effect since 23 October 2019) applies to licensed banks, investment banks, Islamic banks, insurers, takaful operators and prescribed development financial institutions. For those institutions, AI tools and the vendors behind them can fall within both documents.Note: If you are not one of the licensed institutions listed, these documents may still reach you through your principal's or partner's contracts; check with your compliance function or counsel.Do: If you are one of the listed BNM-licensed institutions: map each AI tool against RMiT's technology risk requirements and record AI vendors in the outsourcing register where the arrangement is outsourcing.Source: www.bnm.gov.my/documents/20124/938039/pd-rmit-sep26.pdf#page |
| BNM discussion paper on AI (non-binding)Bank Negara Malaysia, Discussion Paper on Artificial Intelligence in the Malaysian Financial SectorDiscussion paper (August 2025) | Proposal (not law yet) | Published Aug 2025; feedback closed 17 Oct 2025; non-binding |
| BNM's discussion paper sets out its "proposed approach and views relating to the development and adoption of artificial intelligence" in the financial sector. It "is a non-binding publication and may not result in an exposure draft or policy document under the same title".Note: A discussion paper, not a requirement; track it for binding rules.Do: Track whether BNM issues an exposure draft or policy document on AI.Source: www.bnm.gov.my/documents/20124/938039/DP_Artificial_Intellig |
Australia
| Law or framework | Status | Applies (as of 4 Oct 2026) | Applies when | What it says and what to do |
|---|---|---|---|---|
| Australia: planned AI legislation (announced)Australian Government, "AI in Australia's interests" frameworkAnnounced intent to legislate | Proposal (not law yet) | Announced 15 Jul 2026; legislation expected early 2027 | You serve Australia | The Prime Minister announced an Office of AI and an intent to legislate Australian Standards for AI, with legislation expected early 2027. The announced regime focuses on large data centres and copyright. It does not replace the existing privacy and marketing laws that already apply to business use of AI.Do: Monitor these proposals. They are separate from the Privacy Act, Spam Act and Do Not Call rules shown in this pack, which already apply or start on 10 December 2026.Source: www.pm.gov.au/media/ai-australias-interests |
| Australian Privacy Act: APPsPrivacy Act 1988 (Australia), Australian Privacy PrinciplesSchedule 1 (APPs); s6D | Binding law | In force |
| The 13 Australian Privacy Principles govern collection, use, disclosure, security and access for APP entities. A business whose annual turnover for the previous financial year was A$3,000,000 or less is generally a small business outside the Act (s6D), but exceptions apply, for example health service providers and businesses that trade in personal information.Note: check the small business exceptions with your adviserDo: Check whether you are an APP entity; if so, cover each AI use in your APP privacy policy and collection notices, and in your security and overseas-disclosure arrangements.Source: www.legislation.gov.au/C2004A03712/2026-06-04/2026-06-04/tex |
Not covered yet
Not covered anywhere in this pack: intellectual property and copyright in AI inputs and outputs, defamation, confidentiality and legal privilege of prompts, employment law on staff monitoring, contract and insurance terms, and any law of a market you did not select. No rule shown does not mean you are clear; this is not legal advice.
- Singapore: Not covered: sector regulators other than MAS (MAS items appear only for Singapore financial services), public-sector data rules, employment law beyond the fair-hiring items listed, and online-safety and election deepfake laws.
- Malaysia: Not covered: Bank Negara Malaysia requirements beyond any scope note shown for Malaysian financial services, the Consumer Protection Act 1999, communications and online-safety laws, and employment law. Check these with your adviser.
- European Union: Not covered: EU consumer law, product and sector laws (for example medical devices), national ePrivacy and telemarketing rules beyond the Art. 13 summary, works-council rules, and GDPR items beyond those listed.
- Australia: Not covered: OAIC and sector guidance beyond the items listed, state laws, and the Australian Consumer Law beyond s18. Check with your adviser.
- United States (federal law only): Not covered: US state laws other than Colorado (for example New York City Local Law 144, Illinois, California, Texas and Utah AI rules), state telemarketing and recording-consent laws, and the FTC Act.
- United States: Colorado: Not covered: other US state laws and Colorado's privacy law.
General information as of 4 October 2026. Not legal advice. Origin Pi accepts no liability for decisions made using this tool. Verify with your counsel.
Questions
Frequently asked questions
Is the AI compliance starter pack legal advice?
No. It is general information as of 4 October 2026, produced by a fixed set of rules, not by an AI model. Origin Pi accepts no liability for decisions made using this tool. Verify the pack with your counsel before you rely on it.
Does any of my information leave my browser?
No. The pack is built by JavaScript on this page from rules that load with the page. Nothing you select or type is sent anywhere. If you choose to ask Origin Pi to review your pack, the contact form is pre-filled with a short summary, and it is sent only when you submit it.
Which laws and frameworks does the generator cover, and how current are they?
The EU AI Act (as amended by Regulation (EU) 2026/1744), core GDPR and ePrivacy items, Singapore's PDPA including the Do Not Call rules, the Spam Control Act, PDPC and IMDA guidance and MAS texts, Malaysia's PDPA as amended, BNM documents for licensed institutions and the AI Governance Bill status, Australia's Privacy Act (including the automated-decision rule from 10 December 2026), Spam Act, Do Not Call rules and Consumer Law, the US federal rule on AI voice calls and Colorado SB 26-189. Every rule cites its source and states whether it is binding law, guidance or a proposal, as of 4 October 2026. We re-check the rules monthly.
Do I have to tell customers that my chatbot is AI?
If people in the EU use it, yes: since 2 August 2026, EU AI Act Article 50(1) requires that people are told they are interacting with an AI system, at the latest at the first interaction. Singapore and Australia have voluntary guidance that points the same way. Colorado's conversational AI law, from 1 January 2027, likely excludes customer-service bots.
When do the EU AI Act high-risk rules apply to hiring or credit AI?
From 2 December 2027. Regulation (EU) 2026/1744, in force since 27 July 2026, moved the high-risk duties for Annex III systems, which include recruitment and creditworthiness, to that date, and product-embedded (Annex I) systems to 2 August 2028. The Article 50 transparency duties were not deferred.
Is the IMDA agentic AI framework law in Singapore?
No. IMDA's Model AI Governance Framework for Agentic AI, Version 1.5 (20 May 2026), is voluntary guidance. The binding layer is the PDPA: you have the same obligation for personal data your AI vendor processes for you as if you processed it yourself (section 4(3)).
→
Want a second pair of eyes on your pack?
We turn a starter pack into working evidence: the register, the notices, the vendor terms and the controls behind them. Read how we approach AI compliance and AI governance, or browse our other free tools.
Talk to us