Who answers for an agent, country by country.

Regulation (EU) 2024/1689, the AI Act, is the first horizontal statute on AI. It classifies systems by risk, places the main operational duties on deployers of high-risk systems, and applies in stages.

The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026. It moved the Annex III high-risk obligations, including the Article 26 deployer provisions, to 2 December 2027, and the high-risk obligations for AI embedded in Annex I products to 2 August 2028. The prohibitions in Article 5, the transparency duties in Article 50 and the general purpose AI obligations were not deferred. The revised Product Liability Directive (2024/2853) treats AI software as a product subject to strict liability, with rebuttable presumptions of defect, for products placed on the market after 9 December 2026.

For agents: deployers in the Union, and deployers outside it whose outputs are used in the Union, carry the operator duty set. Extraterritorial reach is explicit in Article 2. National supervisors enforce alongside the European AI Office.

Instrument

Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744

Companion

Directive (EU) 2024/2853, the revised Product Liability Directive

Applies

Article 50 from 2 August 2026; product liability from 9 December 2026; Annex III from 2 December 2027; Annex I from 2 August 2028

Authority

European AI Office and national supervisors

Read further

When the EU AI Act applies to US and UK companies and agentliability.eu

There is no comprehensive federal AI statute. The operative federal instruments are the NIST AI Risk Management Framework 1.0, its Generative AI Profile (NIST AI 600-1), Executive Order 14179, OMB guidance for federal procurement, and sector rules from the FTC, CFPB, SEC, EEOC, FDA and HHS. Executive Order 14110 was revoked by Executive Order 14148 on 20 January 2025 and should not be relied on. Existing bodies of law, among them tort, consumer protection, products liability, civil rights and securities, apply to AI systems as they would to any other operational decision.

For agents: the legal risk is defined by the sector, the use case and the standard of care a court adopts. The NIST AI RMF is the reference cited most often.

Instruments

NIST AI RMF 1.0, Executive Order 14179, sector rules

Applies

Continuously, as existing law

Authority

NIST, FTC, CFPB, SEC and sector regulators

Read further

AI liability and operator duties in the United States and NIST AI RMF and reasonable care

The Colorado AI Act (SB 24-205) was the first comprehensive US state AI statute. It puts a duty of care on developers and deployers of high-risk AI systems to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination, and requires risk management programmes, impact assessments, public disclosures and consumer notices. Complying with those duties creates a rebuttable presumption of reasonable care; adopting a recognised framework such as the NIST AI RMF is a separate affirmative defence. The Attorney General holds exclusive enforcement authority.

SB 25B-004 postponed Colorado's start date from 1 February 2026 to 30 June 2026. SB26-189, signed on 14 May 2026, then moved Colorado to a narrower disclosure model, with developer and deployer duties from 1 January 2027.

Texas enacted the Responsible AI Governance Act (TRAIGA, HB 149), in force since 1 January 2026. Its discrimination standard is intent based, it has no revenue threshold, and it gives a liability defence for substantial compliance with the NIST AI RMF. California's SB 53 has also been in force since 1 January 2026; SB 1047 was vetoed in September 2024.

Instruments

Colorado SB 24-205 as amended; Texas HB 149; California SB 53

Applies

Texas and California since 1 January 2026; Colorado duties from 1 January 2027

Authority

The state Attorneys General

Read further

The Colorado AI Act and the global status tracker

The UK government published its AI Regulation White Paper in 2023 and chose a sectoral approach led by existing regulators, among them the ICO, FCA, CMA, Ofcom and MHRA. Five cross-sector principles frame their work: safety and robustness, transparency and explainability, fairness, accountability and governance, contestability and redress. The AI Security Institute, renamed from the AI Safety Institute on 14 February 2025, evaluates advanced models and is not a regulator.

For agents: there is no single statute. Duties sit in existing law, among it data protection, consumer rights, equality, financial conduct and online safety, as applied by the sector regulator. The rules on solely automated decisions now sit in UK GDPR Articles 22A to 22D, in force since 5 February 2026.

Instruments

White Paper (2023), UK GDPR as amended, regulator guidance

Applies

Rolling, with no single activation date

Authority

ICO, FCA, CMA, Ofcom, MHRA

Read further

UK AI regulation: the sectoral approach explained

The Artificial Intelligence and Data Act was Part 3 of Bill C-27, introduced on 16 June 2022. It died when Parliament was prorogued on 6 January 2025 and had not been reintroduced as of May 2026.

For agents: in the absence of an AI statute, federal privacy law (PIPEDA), Quebec's Law 25, provincial consumer protection statutes and sector guidance are what apply.

Instruments

PIPEDA, Quebec Law 25, sector guidance

Applies

As existing law; no AI statute pending

Authority

ISED for policy; privacy regulators under PIPEDA and Law 25

Read further

Canada AI regulation in 2026

The Marco Legal da Inteligência Artificial, PL 2338/2023, has been approved by the Federal Senate and is before the Chamber of Deputies. It draws on the EU AI Act and the OECD Principles, proposes a risk based regime and rights for affected individuals, and allocates supervision among existing regulators including the ANPD. The Senate text sets fines of up to BRL 50 million per infraction or 2 per cent of Brazilian gross revenue. It is not yet law.

Instrument

PL 2338/2023, Marco Legal da IA

Applies

Not yet; under deliberation in the Chamber

Authority

ANPD and sector regulators

Read further

Brazil's AI Bill PL 2338 explained

The AI Basic Act is Asia's first comprehensive AI statute, passed in December 2024 and in force since 22 January 2026. It defines high-impact AI across eleven categories, requires notice to users and risk management by operators, and reaches systems whose effects reach Korea. Article 36 requires certain foreign operators to name a domestic representative in Korea. Article 43 sets a single maximum fine of KRW 30 million for three specific failures.

For agents: the Korean statute sits closer to the EU model than to the US sectoral approach. Enforcement decrees and Ministry of Science and ICT guidance carry much of the operative detail.

Instrument

AI Basic Act

Applies

Since 22 January 2026

Authority

Ministry of Science and ICT

Read further

Korea AI Basic Act: a guide for operators

Japan's AI Promotion Act is Law No. 53 of 2025, promulgated on 4 June 2025 and fully in force since 1 September 2025. It is promotional in character: it sets policy principles, asks the government to adopt a basic plan, and establishes an AI Strategy Headquarters. METI and MIC have published operator guidelines. Japan's approach rests on voluntary commitments, consistent with the G7 Hiroshima AI Process.

For agents: the operative duties remain in existing law, among it the Civil Code on torts, the Act on the Protection of Personal Information, consumer contracts and sector financial rules. The voluntary guidelines work as a de facto standard for large actors.

Instruments

AI Promotion Act (Law No. 53 of 2025), METI and MIC guidelines

Applies

Fully since 1 September 2025

Authority

METI, MIC, PPC

Read further

Japan's AI Promotion Act for global operators

Singapore works through IMDA's Model AI Governance Framework (2019, with a generative AI edition in 2024), the AI Verify testing toolkit, and sector rules from the Monetary Authority of Singapore (the FEAT Principles) and the Personal Data Protection Commission. Its posture is cooperative rather than prescriptive. AI Verify produces a testing report that operators, auditors and regulators can read in common.

For agents: compliance in Singapore is largely about demonstrable governance, testing evidence and incident readiness. Regulators act under existing statutes such as the PDPA, the Banking Act and MAS regulations; no horizontal AI statute is in force.

Instruments

Model AI Governance Framework, AI Verify

Applies

Continuously, as voluntary guidance and existing law

Authority

IMDA, MAS, PDPC

Read further

Singapore AI governance for global operators

China's stack includes the Interim Measures for the Administration of Generative AI Services (2023), the Algorithmic Recommendation Regulations (2022) and the Deep Synthesis Regulations (2023), administered by the Cyberspace Administration of China with other authorities. The Measures for Labeling AI-Generated Synthetic Content, issued on 7 March 2025, have applied since 1 September 2025. Large model providers register with the CAC; deployers face content, labelling and security obligations. A comprehensive AI law has been in drafting and is expected to consolidate the existing measures.

Instruments

Generative AI Measures, Algorithm Rules, Deep Synthesis Rules, Labeling Measures

Applies

In force

Authority

Cyberspace Administration of China

Read further

China CAC Generative AI Measures

Taiwan's Artificial Intelligence Basic Act passed third reading on 23 December 2025 and was promulgated on 14 January 2026, effective the same day. It has twenty articles. The National Science and Technology Council is the central competent authority, and Article 6 establishes a National AI Strategic Committee convened by the Premier. Article 5 creates a high-risk designation route triggered sector by sector.

Instrument

Artificial Intelligence Basic Act

Applies

Since 14 January 2026

Authority

National Science and Technology Council

Read further

Taiwan AI Basic Act: a guide for operators

Vietnam's Law on Artificial Intelligence, Law No. 134/2025/QH15, passed on 10 December 2025 and has been in force since 1 March 2026. It repealed the AI chapter of the Law on Digital Technology Industry. It sets three risk tiers, requires provider self-classification and notification before service, makes conformity assessment a precondition for high-risk use, and puts compensation on the deployer even where the system was operated correctly. A foreign provider needs a contact point in Vietnam.

Instrument

Law No. 134/2025/QH15 on Artificial Intelligence

Applies

Since 1 March 2026

Authority

Ministry of Science and Technology

Read further

Vietnam AI regulation for global operators

Australia consulted on safe and responsible AI in 2023 and published a Voluntary AI Safety Standard with ten guardrails in 2024. In the meantime existing law applies: the Privacy Act 1988, which gains duties on automated decision making in December 2026, and sector supervision by APRA, ASIC and the TGA.

Instruments

Voluntary AI Safety Standard (2024), Privacy Act 1988

Applies

Voluntary nationally; sector rules as they stand

Authority

OAIC, APRA, ASIC, TGA

Read further

Australia's Voluntary AI Safety Standard

The Framework Convention on Artificial Intelligence, CETS No. 225, opened for signature at Vilnius on 5 September 2024. It is the first international legally binding treaty on AI and covers AI used by public authorities and private actors, with obligations on accountability, transparency, human rights and remedies. It is not yet in force: it needs five ratifications, including three Council of Europe member states.

Instrument

Framework Convention on AI, CETS No. 225

Applies

Not yet in force

Authority

State parties, through national law

Read further

The Council of Europe Framework Convention