{ "as_of": "2026-10-25", "count": 282, "licence": { "ids": "CC0 1.0", "records": "CC BY-NC 4.0; commercial use needs a licence", "terms": "https://wheresthe.ai/licence/" }, "obligations": [ { "record_id": "WTA-R-KR-0001-001", "provision": "Article 31(1)", "applies_to": [ "Developers", "Deployers" ], "duty": "Tell users in advance that a product or service runs on high-impact AI or generative AI.", "type": "Transparency to users", "status": "applies now", "applies_from": "2026-01-22", "url": "https://wheresthe.ai/id/WTA-R-KR-0001-001/", "rule": { "record_id": "WTA-R-KR-0001", "id": "kr-ai-basic-act-2025", "title": "Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act)", "jurisdiction": "KR", "jurisdiction_name": "South Korea", "url": "https://wheresthe.ai/rule/kr-ai-basic-act-2025/" }, "penalty": "Administrative fine up to KRW 30 million (Art. 43(1)(1)); Decree Annex 2 sets KRW 5m, 10m and 15m for first, second and third violations.", "scope_note": "Read in the official Korean text on law.go.kr (version in force 21 Jul 2026, Act No. 21311); no English translation used. Decree Art. 23(1) allows notice on the product, in contracts, manuals or terms, on the user's screen, or posted where the product is supplied; Decree Art. 23(4) exempts obvious cases and internal-only use.", "date_note": "MSIT has said it will not carry out fact-finding or impose fines for at least one year from 22 Jan 2026 (government policy reported by Newsis on 22 Jan 2026 and MTN on 30 Apr 2026; not written in the Act).", "source_url": "https://www.law.go.kr/법령/인공지능발전과신뢰기반조성등에관한기본법/제31조", "verified_on": "2026-10-08", "citation": "WTA-R-KR-0001-001: Article 31(1), Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-KR-0001-001/ (checked 2026-10-08)." }, { "record_id": "WTA-R-KR-0001-002", "provision": "Article 31(2)", "applies_to": [ "Developers", "Deployers" ], "duty": "Mark outputs of generative AI, or of products and services using it, as generated by generative AI.", "type": "Labelling AI content", "status": "applies now", "applies_from": "2026-01-22", "url": "https://wheresthe.ai/id/WTA-R-KR-0001-002/", "rule": { "record_id": "WTA-R-KR-0001", "id": "kr-ai-basic-act-2025", "title": "Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act)", "jurisdiction": "KR", "jurisdiction_name": "South Korea", "url": "https://wheresthe.ai/rule/kr-ai-basic-act-2025/" }, "penalty": "No direct fine; MSIT may investigate and order the violation stopped or corrected (Art. 40), and ignoring that order is fined up to KRW 30 million (Art. 43(1)(3)).", "scope_note": "Read in the official Korean text on law.go.kr (version in force 21 Jul 2026, Act No. 21311); no English translation used. Decree Art. 23(2) allows human-recognisable or machine-readable marks; Decree Art. 23(4) exempts obvious cases and internal-only use.", "date_note": "MSIT has said it will not carry out fact-finding or impose fines for at least one year from 22 Jan 2026 (government policy reported by Newsis on 22 Jan 2026 and MTN on 30 Apr 2026; not written in the Act).", "source_url": "https://www.law.go.kr/법령/인공지능발전과신뢰기반조성등에관한기본법/제31조", "verified_on": "2026-10-08", "citation": "WTA-R-KR-0001-002: Article 31(2), Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-KR-0001-002/ (checked 2026-10-08)." }, { "record_id": "WTA-R-KR-0001-003", "provision": "Article 31(3)", "applies_to": [ "Developers", "Deployers" ], "duty": "Tell users or label clearly when an AI system provides virtual sound, images or video that are hard to tell from reality, so users can clearly recognise they are AI-generated.", "type": "Labelling AI content", "status": "applies now", "applies_from": "2026-01-22", "url": "https://wheresthe.ai/id/WTA-R-KR-0001-003/", "rule": { "record_id": "WTA-R-KR-0001", "id": "kr-ai-basic-act-2025", "title": "Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act)", "jurisdiction": "KR", "jurisdiction_name": "South Korea", "url": "https://wheresthe.ai/rule/kr-ai-basic-act-2025/" }, "penalty": "No direct fine; MSIT may investigate and order the violation stopped or corrected (Art. 40), and ignoring that order is fined up to KRW 30 million (Art. 43(1)(3)).", "scope_note": "Read in the official Korean text on law.go.kr (version in force 21 Jul 2026, Act No. 21311); no English translation used. Where the output is or forms part of an artistic or creative work, the notice or label may be given in a way that does not hinder its display or enjoyment.", "date_note": "MSIT has said it will not carry out fact-finding or impose fines for at least one year from 22 Jan 2026 (government policy reported by Newsis on 22 Jan 2026 and MTN on 30 Apr 2026; not written in the Act).", "source_url": "https://www.law.go.kr/법령/인공지능발전과신뢰기반조성등에관한기본법/제31조", "verified_on": "2026-10-08", "citation": "WTA-R-KR-0001-003: Article 31(3), Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-KR-0001-003/ (checked 2026-10-08)." }, { "record_id": "WTA-R-KR-0001-004", "provision": "Article 32(1)(1)", "applies_to": [ "Developers", "Deployers" ], "duty": "Identify, assess and mitigate risks across the whole AI lifecycle for AI systems trained with cumulative compute at or above the threshold set by Presidential Decree.", "type": "Frontier model safety", "status": "applies now", "applies_from": "2026-01-22", "url": "https://wheresthe.ai/id/WTA-R-KR-0001-004/", "rule": { "record_id": "WTA-R-KR-0001", "id": "kr-ai-basic-act-2025", "title": "Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act)", "jurisdiction": "KR", "jurisdiction_name": "South Korea", "url": "https://wheresthe.ai/rule/kr-ai-basic-act-2025/" }, "penalty": "No direct fine; MSIT may investigate and order the violation stopped or corrected (Art. 40), and ignoring that order is fined up to KRW 30 million (Art. 43(1)(3)).", "scope_note": "Read in the official Korean text on law.go.kr (version in force 21 Jul 2026, Act No. 21311); no English translation used. Decree Art. 24(1) covers only systems meeting all three tests: at least 10^26 floating-point operations of cumulative training compute, state-of-the-art AI technology, and risk of broad and serious impact on life, safety and fundamental rights. The Act addresses AI business operators generally.", "date_note": "MSIT has said it will not carry out fact-finding or impose fines for at least one year from 22 Jan 2026 (government policy reported by Newsis on 22 Jan 2026 and MTN on 30 Apr 2026; not written in the Act).", "source_url": "https://www.law.go.kr/법령/인공지능발전과신뢰기반조성등에관한기본법/제32조", "verified_on": "2026-10-08", "citation": "WTA-R-KR-0001-004: Article 32(1)(1), Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-KR-0001-004/ (checked 2026-10-08)." }, { "record_id": "WTA-R-KR-0001-005", "provision": "Article 32(1)(2)", "applies_to": [ "Developers", "Deployers" ], "duty": "Build a risk management system that monitors and responds to AI safety incidents for AI systems above the decree compute threshold.", "type": "Frontier model safety", "status": "applies now", "applies_from": "2026-01-22", "url": "https://wheresthe.ai/id/WTA-R-KR-0001-005/", "rule": { "record_id": "WTA-R-KR-0001", "id": "kr-ai-basic-act-2025", "title": "Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act)", "jurisdiction": "KR", "jurisdiction_name": "South Korea", "url": "https://wheresthe.ai/rule/kr-ai-basic-act-2025/" }, "penalty": "No direct fine; MSIT may investigate and order the violation stopped or corrected (Art. 40), and ignoring that order is fined up to KRW 30 million (Art. 43(1)(3)).", "scope_note": "Read in the official Korean text on law.go.kr (version in force 21 Jul 2026, Act No. 21311); no English translation used. Decree Art. 24(1) covers only systems meeting all three tests: at least 10^26 floating-point operations of cumulative training compute, state-of-the-art AI technology, and risk of broad and serious impact on life, safety and fundamental rights. The Act addresses AI business operators generally.", "date_note": "MSIT has said it will not carry out fact-finding or impose fines for at least one year from 22 Jan 2026 (government policy reported by Newsis on 22 Jan 2026 and MTN on 30 Apr 2026; not written in the Act).", "source_url": "https://www.law.go.kr/법령/인공지능발전과신뢰기반조성등에관한기본법/제32조", "verified_on": "2026-10-08", "citation": "WTA-R-KR-0001-005: Article 32(1)(2), Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-KR-0001-005/ (checked 2026-10-08)." }, { "record_id": "WTA-R-KR-0001-006", "provision": "Article 32(2)", "applies_to": [ "Developers", "Deployers" ], "duty": "Submit the results of the lifecycle risk work and the incident risk management system to the Minister of Science and ICT.", "type": "Registration or filing", "status": "applies now", "applies_from": "2026-01-22", "url": "https://wheresthe.ai/id/WTA-R-KR-0001-006/", "rule": { "record_id": "WTA-R-KR-0001", "id": "kr-ai-basic-act-2025", "title": "Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act)", "jurisdiction": "KR", "jurisdiction_name": "South Korea", "url": "https://wheresthe.ai/rule/kr-ai-basic-act-2025/" }, "penalty": "No direct fine; MSIT may investigate and order the violation stopped or corrected (Art. 40), and ignoring that order is fined up to KRW 30 million (Art. 43(1)(3)).", "scope_note": "Read in the official Korean text on law.go.kr (version in force 21 Jul 2026, Act No. 21311); no English translation used. Implementation methods and submission details are set by MSIT public notice (Art. 32(3)). Applies to systems above the Decree Art. 24 threshold.", "date_note": "MSIT has said it will not carry out fact-finding or impose fines for at least one year from 22 Jan 2026 (government policy reported by Newsis on 22 Jan 2026 and MTN on 30 Apr 2026; not written in the Act).", "source_url": "https://www.law.go.kr/법령/인공지능발전과신뢰기반조성등에관한기본법/제32조", "verified_on": "2026-10-08", "citation": "WTA-R-KR-0001-006: Article 32(2), Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-KR-0001-006/ (checked 2026-10-08)." }, { "record_id": "WTA-R-KR-0001-007", "provision": "Article 33(1)", "applies_to": [ "Developers", "Deployers" ], "duty": "Review in advance whether an AI system, or a product or service using it, is high-impact AI; MSIT confirmation may be requested if needed.", "type": "Risk classification", "status": "applies now", "applies_from": "2026-01-22", "url": "https://wheresthe.ai/id/WTA-R-KR-0001-007/", "rule": { "record_id": "WTA-R-KR-0001", "id": "kr-ai-basic-act-2025", "title": "Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act)", "jurisdiction": "KR", "jurisdiction_name": "South Korea", "url": "https://wheresthe.ai/rule/kr-ai-basic-act-2025/" }, "penalty": "No fine for this duty in the Act.", "scope_note": "Read in the official Korean text on law.go.kr (version in force 21 Jul 2026, Act No. 21311); no English translation used. High-impact areas are listed in Art. 2(4): energy supply, drinking water, health care, medical devices, nuclear facilities, biometric analysis for criminal investigation, decisions such as hiring and loan screening, transport, public-service eligibility decisions and student assessment. Decree Art. 25 sets the confirmation procedure (MSIT replies within 30 days).", "date_note": null, "source_url": "https://www.law.go.kr/법령/인공지능발전과신뢰기반조성등에관한기본법/제33조", "verified_on": "2026-10-08", "citation": "WTA-R-KR-0001-007: Article 33(1), Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-KR-0001-007/ (checked 2026-10-08)." }, { "record_id": "WTA-R-KR-0001-008", "provision": "Article 34(1)(1)", "applies_to": [ "Developers", "Deployers" ], "duty": "Set up and run a risk management plan when providing high-impact AI or products and services that use it.", "type": "Impact assessment", "status": "applies now", "applies_from": "2026-01-22", "url": "https://wheresthe.ai/id/WTA-R-KR-0001-008/", "rule": { "record_id": "WTA-R-KR-0001", "id": "kr-ai-basic-act-2025", "title": "Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act)", "jurisdiction": "KR", "jurisdiction_name": "South Korea", "url": "https://wheresthe.ai/rule/kr-ai-basic-act-2025/" }, "penalty": "No direct fine; MSIT may investigate and order the violation stopped or corrected (Art. 40), and ignoring that order is fined up to KRW 30 million (Art. 43(1)(3)).", "scope_note": "Read in the official Korean text on law.go.kr (version in force 21 Jul 2026, Act No. 21311); no English translation used. Measures follow the Decree; measures taken under other laws that meet Decree Annex 1 count as compliance (Art. 34(3)). A deployer that does not significantly change a system whose developer already took items 1 to 3 is deemed to have taken them (Decree Art. 27(3)). The schema has no risk-management type; impact-assessment is the nearest fit.", "date_note": "MSIT has said it will not carry out fact-finding or impose fines for at least one year from 22 Jan 2026 (government policy reported by Newsis on 22 Jan 2026 and MTN on 30 Apr 2026; not written in the Act).", "source_url": "https://www.law.go.kr/법령/인공지능발전과신뢰기반조성등에관한기본법/제34조", "verified_on": "2026-10-08", "citation": "WTA-R-KR-0001-008: Article 34(1)(1), Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-KR-0001-008/ (checked 2026-10-08)." }, { "record_id": "WTA-R-KR-0001-009", "provision": "Article 34(1)(2)", "applies_to": [ "Developers", "Deployers" ], "duty": "Set up and apply a plan to explain, as far as technically possible, the AI's final outputs, the main criteria used to reach them and an outline of the training data.", "type": "Transparency to users", "status": "applies now", "applies_from": "2026-01-22", "url": "https://wheresthe.ai/id/WTA-R-KR-0001-009/", "rule": { "record_id": "WTA-R-KR-0001", "id": "kr-ai-basic-act-2025", "title": "Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act)", "jurisdiction": "KR", "jurisdiction_name": "South Korea", "url": "https://wheresthe.ai/rule/kr-ai-basic-act-2025/" }, "penalty": "No direct fine; MSIT may investigate and order the violation stopped or corrected (Art. 40), and ignoring that order is fined up to KRW 30 million (Art. 43(1)(3)).", "scope_note": "Read in the official Korean text on law.go.kr (version in force 21 Jul 2026, Act No. 21311); no English translation used. Measures follow the Decree; measures taken under other laws that meet Decree Annex 1 count as compliance (Art. 34(3)). A deployer that does not significantly change a system whose developer already took items 1 to 3 is deemed to have taken them (Decree Art. 27(3)).", "date_note": "MSIT has said it will not carry out fact-finding or impose fines for at least one year from 22 Jan 2026 (government policy reported by Newsis on 22 Jan 2026 and MTN on 30 Apr 2026; not written in the Act).", "source_url": "https://www.law.go.kr/법령/인공지능발전과신뢰기반조성등에관한기본법/제34조", "verified_on": "2026-10-08", "citation": "WTA-R-KR-0001-009: Article 34(1)(2), Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-KR-0001-009/ (checked 2026-10-08)." }, { "record_id": "WTA-R-KR-0001-010", "provision": "Article 34(1)(3)", "applies_to": [ "Developers", "Deployers" ], "duty": "Set up and run a user protection plan when providing high-impact AI or products and services that use it.", "type": "Consumer rights", "status": "applies now", "applies_from": "2026-01-22", "url": "https://wheresthe.ai/id/WTA-R-KR-0001-010/", "rule": { "record_id": "WTA-R-KR-0001", "id": "kr-ai-basic-act-2025", "title": "Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act)", "jurisdiction": "KR", "jurisdiction_name": "South Korea", "url": "https://wheresthe.ai/rule/kr-ai-basic-act-2025/" }, "penalty": "No direct fine; MSIT may investigate and order the violation stopped or corrected (Art. 40), and ignoring that order is fined up to KRW 30 million (Art. 43(1)(3)).", "scope_note": "Read in the official Korean text on law.go.kr (version in force 21 Jul 2026, Act No. 21311); no English translation used. Measures follow the Decree; measures taken under other laws that meet Decree Annex 1 count as compliance (Art. 34(3)). A deployer that does not significantly change a system whose developer already took items 1 to 3 is deemed to have taken them (Decree Art. 27(3)).", "date_note": "MSIT has said it will not carry out fact-finding or impose fines for at least one year from 22 Jan 2026 (government policy reported by Newsis on 22 Jan 2026 and MTN on 30 Apr 2026; not written in the Act).", "source_url": "https://www.law.go.kr/법령/인공지능발전과신뢰기반조성등에관한기본법/제34조", "verified_on": "2026-10-08", "citation": "WTA-R-KR-0001-010: Article 34(1)(3), Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-KR-0001-010/ (checked 2026-10-08)." }, { "record_id": "WTA-R-KR-0001-011", "provision": "Article 34(1)(4)", "applies_to": [ "Developers", "Deployers" ], "duty": "Ensure that people manage and supervise high-impact AI.", "type": "Human oversight", "status": "applies now", "applies_from": "2026-01-22", "url": "https://wheresthe.ai/id/WTA-R-KR-0001-011/", "rule": { "record_id": "WTA-R-KR-0001", "id": "kr-ai-basic-act-2025", "title": "Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act)", "jurisdiction": "KR", "jurisdiction_name": "South Korea", "url": "https://wheresthe.ai/rule/kr-ai-basic-act-2025/" }, "penalty": "No direct fine; MSIT may investigate and order the violation stopped or corrected (Art. 40), and ignoring that order is fined up to KRW 30 million (Art. 43(1)(3)).", "scope_note": "Read in the official Korean text on law.go.kr (version in force 21 Jul 2026, Act No. 21311); no English translation used. Decree Art. 27(1) requires the overseer's name and contact details to be posted.", "date_note": "MSIT has said it will not carry out fact-finding or impose fines for at least one year from 22 Jan 2026 (government policy reported by Newsis on 22 Jan 2026 and MTN on 30 Apr 2026; not written in the Act).", "source_url": "https://www.law.go.kr/법령/인공지능발전과신뢰기반조성등에관한기본법/제34조", "verified_on": "2026-10-08", "citation": "WTA-R-KR-0001-011: Article 34(1)(4), Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-KR-0001-011/ (checked 2026-10-08)." }, { "record_id": "WTA-R-KR-0001-012", "provision": "Article 34(1)(5)", "applies_to": [ "Developers", "Deployers" ], "duty": "Prepare and keep documents showing the measures taken to ensure the safety and reliability of high-impact AI.", "type": "Record-keeping", "status": "applies now", "applies_from": "2026-01-22", "url": "https://wheresthe.ai/id/WTA-R-KR-0001-012/", "rule": { "record_id": "WTA-R-KR-0001", "id": "kr-ai-basic-act-2025", "title": "Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act)", "jurisdiction": "KR", "jurisdiction_name": "South Korea", "url": "https://wheresthe.ai/rule/kr-ai-basic-act-2025/" }, "penalty": "No direct fine; MSIT may investigate and order the violation stopped or corrected (Art. 40), and ignoring that order is fined up to KRW 30 million (Art. 43(1)(3)).", "scope_note": "Read in the official Korean text on law.go.kr (version in force 21 Jul 2026, Act No. 21311); no English translation used. Decree Art. 27(2) sets a five-year retention period.", "date_note": "MSIT has said it will not carry out fact-finding or impose fines for at least one year from 22 Jan 2026 (government policy reported by Newsis on 22 Jan 2026 and MTN on 30 Apr 2026; not written in the Act).", "source_url": "https://www.law.go.kr/법령/인공지능발전과신뢰기반조성등에관한기본법/제34조", "verified_on": "2026-10-08", "citation": "WTA-R-KR-0001-012: Article 34(1)(5), Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-KR-0001-012/ (checked 2026-10-08)." }, { "record_id": "WTA-R-KR-0001-013", "provision": "Article 35(1)", "applies_to": [ "Developers", "Deployers" ], "duty": "Try to assess in advance the impact on people's fundamental rights before providing products or services that use high-impact AI, reflecting the traits of AI-vulnerable groups.", "type": "Impact assessment", "status": "applies now", "applies_from": "2026-01-22", "url": "https://wheresthe.ai/id/WTA-R-KR-0001-013/", "rule": { "record_id": "WTA-R-KR-0001", "id": "kr-ai-basic-act-2025", "title": "Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act)", "jurisdiction": "KR", "jurisdiction_name": "South Korea", "url": "https://wheresthe.ai/rule/kr-ai-basic-act-2025/" }, "penalty": "No fine for this duty in the Act.", "scope_note": "Read in the official Korean text on law.go.kr (version in force 21 Jul 2026, Act No. 21311); no English translation used. Effort duty ('shall endeavour'); not covered by Art. 40 fact-finding or Art. 43 fines. Public bodies must give priority to assessed products and services when using high-impact AI (Art. 35(2)). Decree Art. 28 sets the contents.", "date_note": "The sentence on AI-vulnerable groups was added by Act No. 21311 and applies from 21 Jul 2026.", "source_url": "https://www.law.go.kr/법령/인공지능발전과신뢰기반조성등에관한기본법/제35조", "verified_on": "2026-10-08", "citation": "WTA-R-KR-0001-013: Article 35(1), Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-KR-0001-013/ (checked 2026-10-08)." }, { "record_id": "WTA-R-KR-0001-014", "provision": "Article 36(1)", "applies_to": [ "Developers", "Deployers" ], "duty": "Appoint in writing a domestic representative with a Korean address or office and report it to MSIT, if you have no Korean address or office and meet the decree thresholds.", "type": "Registration or filing", "status": "applies now", "applies_from": "2026-01-22", "url": "https://wheresthe.ai/id/WTA-R-KR-0001-014/", "rule": { "record_id": "WTA-R-KR-0001", "id": "kr-ai-basic-act-2025", "title": "Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act)", "jurisdiction": "KR", "jurisdiction_name": "South Korea", "url": "https://wheresthe.ai/rule/kr-ai-basic-act-2025/" }, "penalty": "Administrative fine up to KRW 30 million (Art. 43(1)(2)); Decree Annex 2 sets KRW 20m for each violation.", "scope_note": "Read in the official Korean text on law.go.kr (version in force 21 Jul 2026, Act No. 21311); no English translation used. Decree Art. 29(1) thresholds (any one): prior-year revenue of KRW 1 trillion or more; prior-year AI-service revenue of KRW 10 billion or more; an average of 1 million or more daily Korean users over the last three months of the prior year; or a prior fine for ignoring a corrective order. The representative handles Art. 32(2) submissions, Art. 33(1) confirmation requests and Art. 34 support; its violations are attributed to the appointing business (Art. 36(3)).", "date_note": "MSIT has said it will not carry out fact-finding or impose fines for at least one year from 22 Jan 2026 (government policy reported by Newsis on 22 Jan 2026 and MTN on 30 Apr 2026; not written in the Act).", "source_url": "https://www.law.go.kr/법령/인공지능발전과신뢰기반조성등에관한기본법/제36조", "verified_on": "2026-10-08", "citation": "WTA-R-KR-0001-014: Article 36(1), Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-KR-0001-014/ (checked 2026-10-08)." }, { "record_id": "WTA-R-KR-0001-015", "provision": "Article 40(3)", "applies_to": [ "Developers", "Deployers" ], "duty": "Comply with any MSIT order to stop or correct a violation of the Act found through fact-finding.", "type": "Conformity assessment", "status": "applies now", "applies_from": "2026-01-22", "url": "https://wheresthe.ai/id/WTA-R-KR-0001-015/", "rule": { "record_id": "WTA-R-KR-0001", "id": "kr-ai-basic-act-2025", "title": "Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act)", "jurisdiction": "KR", "jurisdiction_name": "South Korea", "url": "https://wheresthe.ai/rule/kr-ai-basic-act-2025/" }, "penalty": "Administrative fine up to KRW 30 million (Art. 43(1)(3)); Decree Annex 2 sets KRW 10m, 20m and 30m for first, second and third violations.", "scope_note": "Read in the official Korean text on law.go.kr (version in force 21 Jul 2026, Act No. 21311); no English translation used. Fact-finding may start when MSIT finds or receives a report of a suspected breach of Art. 31(2)-(3), 32(1)-(2) or 34(1) (Art. 40(1)). The schema has no enforcement-compliance type; conformity-assessment is the nearest fit.", "date_note": "MSIT has said it will not carry out fact-finding or impose fines for at least one year from 22 Jan 2026 (government policy reported by Newsis on 22 Jan 2026 and MTN on 30 Apr 2026; not written in the Act).", "source_url": "https://www.law.go.kr/법령/인공지능발전과신뢰기반조성등에관한기본법/제40조", "verified_on": "2026-10-08", "citation": "WTA-R-KR-0001-015: Article 40(3), Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-KR-0001-015/ (checked 2026-10-08)." }, { "record_id": "WTA-R-KR-0002-001", "provision": "Article 23(2)", "applies_to": [ "Developers", "Deployers" ], "duty": "Mark generative AI outputs in a human-recognisable or machine-readable way; if machine-readable, also tell users at least once, by text or voice, that the output was generated by generative AI.", "type": "Labelling AI content", "status": "applies now", "applies_from": "2026-01-22", "url": "https://wheresthe.ai/id/WTA-R-KR-0002-001/", "rule": { "record_id": "WTA-R-KR-0002", "id": "kr-ai-basic-act-enforcement-decree-2026", "title": "Enforcement Decree of the Framework Act on the Development of AI and Establishment of a Foundation for Trust", "jurisdiction": "KR", "jurisdiction_name": "South Korea", "url": "https://wheresthe.ai/rule/kr-ai-basic-act-enforcement-decree-2026/" }, "penalty": "No direct fine; MSIT may investigate and order the violation stopped or corrected (Art. 40), and ignoring that order is fined up to KRW 30 million (Art. 43(1)(3)).", "scope_note": "Read in the official Korean text on law.go.kr (version in force 20 Aug 2026, Presidential Decree No. 36580); no English translation used. Implements Act Art. 31(2). Art. 23(4) exempts cases where AI use is obvious, internal-only use and cases MSIT exempts by notice.", "date_note": "MSIT has said it will not carry out fact-finding or impose fines for at least one year from 22 Jan 2026 (government policy reported by Newsis on 22 Jan 2026 and MTN on 30 Apr 2026; not written in the Act).", "source_url": "https://www.law.go.kr/법령/인공지능발전과신뢰기반조성등에관한기본법시행령/제23조", "verified_on": "2026-10-08", "citation": "WTA-R-KR-0002-001: Article 23(2), Enforcement Decree of the Framework Act on the Development of AI and Establishment of a Foundation for Trust. wheresthe.ai, https://wheresthe.ai/id/WTA-R-KR-0002-001/ (checked 2026-10-08)." }, { "record_id": "WTA-R-KR-0002-002", "provision": "Article 23(3)", "applies_to": [ "Developers", "Deployers" ], "duty": "Give deepfake notices or labels in a way users can easily check by sight, hearing or software, taking account of the main users' age and physical and social conditions.", "type": "Labelling AI content", "status": "applies now", "applies_from": "2026-01-22", "url": "https://wheresthe.ai/id/WTA-R-KR-0002-002/", "rule": { "record_id": "WTA-R-KR-0002", "id": "kr-ai-basic-act-enforcement-decree-2026", "title": "Enforcement Decree of the Framework Act on the Development of AI and Establishment of a Foundation for Trust", "jurisdiction": "KR", "jurisdiction_name": "South Korea", "url": "https://wheresthe.ai/rule/kr-ai-basic-act-enforcement-decree-2026/" }, "penalty": "No direct fine; MSIT may investigate and order the violation stopped or corrected (Art. 40), and ignoring that order is fined up to KRW 30 million (Art. 43(1)(3)).", "scope_note": "Read in the official Korean text on law.go.kr (version in force 20 Aug 2026, Presidential Decree No. 36580); no English translation used. Implements Act Art. 31(3) (virtual sound, images or video hard to tell from reality). Art. 23(4) exemptions apply.", "date_note": "MSIT has said it will not carry out fact-finding or impose fines for at least one year from 22 Jan 2026 (government policy reported by Newsis on 22 Jan 2026 and MTN on 30 Apr 2026; not written in the Act).", "source_url": "https://www.law.go.kr/법령/인공지능발전과신뢰기반조성등에관한기본법시행령/제23조", "verified_on": "2026-10-08", "citation": "WTA-R-KR-0002-002: Article 23(3), Enforcement Decree of the Framework Act on the Development of AI and Establishment of a Foundation for Trust. wheresthe.ai, https://wheresthe.ai/id/WTA-R-KR-0002-002/ (checked 2026-10-08)." }, { "record_id": "WTA-R-KR-0002-003", "provision": "Article 27(1)", "applies_to": [ "Developers", "Deployers" ], "duty": "Post the main points of the risk management plan, explanation plan and user protection plan, and the name and contact of the human overseer of high-impact AI, at your office or website.", "type": "Transparency to users", "status": "applies now", "applies_from": "2026-01-22", "url": "https://wheresthe.ai/id/WTA-R-KR-0002-003/", "rule": { "record_id": "WTA-R-KR-0002", "id": "kr-ai-basic-act-enforcement-decree-2026", "title": "Enforcement Decree of the Framework Act on the Development of AI and Establishment of a Foundation for Trust", "jurisdiction": "KR", "jurisdiction_name": "South Korea", "url": "https://wheresthe.ai/rule/kr-ai-basic-act-enforcement-decree-2026/" }, "penalty": "No direct fine; MSIT may investigate and order the violation stopped or corrected (Art. 40), and ignoring that order is fined up to KRW 30 million (Art. 43(1)(3)).", "scope_note": "Read in the official Korean text on law.go.kr (version in force 20 Aug 2026, Presidential Decree No. 36580); no English translation used. Trade secrets may be left out.", "date_note": "MSIT has said it will not carry out fact-finding or impose fines for at least one year from 22 Jan 2026 (government policy reported by Newsis on 22 Jan 2026 and MTN on 30 Apr 2026; not written in the Act).", "source_url": "https://www.law.go.kr/법령/인공지능발전과신뢰기반조성등에관한기본법시행령/제27조", "verified_on": "2026-10-08", "citation": "WTA-R-KR-0002-003: Article 27(1), Enforcement Decree of the Framework Act on the Development of AI and Establishment of a Foundation for Trust. wheresthe.ai, https://wheresthe.ai/id/WTA-R-KR-0002-003/ (checked 2026-10-08)." }, { "record_id": "WTA-R-KR-0002-004", "provision": "Article 27(2)", "applies_to": [ "Developers", "Deployers" ], "duty": "Keep written evidence of the high-impact AI measures taken under Act Article 34(1) for five years, electronic storage included.", "type": "Record-keeping", "status": "applies now", "applies_from": "2026-01-22", "url": "https://wheresthe.ai/id/WTA-R-KR-0002-004/", "rule": { "record_id": "WTA-R-KR-0002", "id": "kr-ai-basic-act-enforcement-decree-2026", "title": "Enforcement Decree of the Framework Act on the Development of AI and Establishment of a Foundation for Trust", "jurisdiction": "KR", "jurisdiction_name": "South Korea", "url": "https://wheresthe.ai/rule/kr-ai-basic-act-enforcement-decree-2026/" }, "penalty": "No direct fine; MSIT may investigate and order the violation stopped or corrected (Art. 40), and ignoring that order is fined up to KRW 30 million (Art. 43(1)(3)).", "scope_note": "Read in the official Korean text on law.go.kr (version in force 20 Aug 2026, Presidential Decree No. 36580); no English translation used.", "date_note": "MSIT has said it will not carry out fact-finding or impose fines for at least one year from 22 Jan 2026 (government policy reported by Newsis on 22 Jan 2026 and MTN on 30 Apr 2026; not written in the Act).", "source_url": "https://www.law.go.kr/법령/인공지능발전과신뢰기반조성등에관한기본법시행령/제27조", "verified_on": "2026-10-08", "citation": "WTA-R-KR-0002-004: Article 27(2), Enforcement Decree of the Framework Act on the Development of AI and Establishment of a Foundation for Trust. wheresthe.ai, https://wheresthe.ai/id/WTA-R-KR-0002-004/ (checked 2026-10-08)." }, { "record_id": "WTA-R-KR-0002-005", "provision": "Article 28(1)", "applies_to": [ "Developers", "Deployers" ], "duty": "Include in a high-impact AI impact assessment the people and groups affected, the rights at stake, social and economic impacts, usage patterns, metrics used, risk prevention and recovery, and any improvement plan.", "type": "Impact assessment", "status": "applies now", "applies_from": "2026-01-22", "url": "https://wheresthe.ai/id/WTA-R-KR-0002-005/", "rule": { "record_id": "WTA-R-KR-0002", "id": "kr-ai-basic-act-enforcement-decree-2026", "title": "Enforcement Decree of the Framework Act on the Development of AI and Establishment of a Foundation for Trust", "jurisdiction": "KR", "jurisdiction_name": "South Korea", "url": "https://wheresthe.ai/rule/kr-ai-basic-act-enforcement-decree-2026/" }, "penalty": "No fine for this duty in the Act.", "scope_note": "Read in the official Korean text on law.go.kr (version in force 20 Aug 2026, Presidential Decree No. 36580); no English translation used. Applies when an assessment is done under Act Art. 35(1), itself an effort duty. The assessment may be done in-house or by a third party (Art. 28(2)).", "date_note": "Item 1 was amended by Presidential Decree No. 36506, in force 21 Jul 2026, to require reflecting AI-vulnerable groups.", "source_url": "https://www.law.go.kr/법령/인공지능발전과신뢰기반조성등에관한기본법시행령/제28조", "verified_on": "2026-10-08", "citation": "WTA-R-KR-0002-005: Article 28(1), Enforcement Decree of the Framework Act on the Development of AI and Establishment of a Foundation for Trust. wheresthe.ai, https://wheresthe.ai/id/WTA-R-KR-0002-005/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0003-001", "provision": "Article 4(2)", "applies_to": [ "Providers" ], "duty": "Take effective measures to prevent discrimination by ethnicity, belief, country, region, sex, age, occupation or health in algorithm design, training data selection, model generation and optimisation, and service provision.", "type": "Bias and non-discrimination", "status": "applies now", "applies_from": "2023-08-15", "url": "https://wheresthe.ai/id/WTA-R-CN-0003-001/", "rule": { "record_id": "WTA-R-CN-0003", "id": "cn-cac-generative-ai-interim-measures-2023", "title": "Interim Measures for the Management of Generative Artificial Intelligence Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-generative-ai-interim-measures-2023/" }, "penalty": "Penalties under the Cybersecurity, Data Security, Personal Information Protection and Science and Technology Progress Laws; where they are silent, warnings, public criticism and orders to correct, then suspension of the service for refusal or serious cases (Art. 21).", "scope_note": "Read via China Law Translate translation, checked against the Chinese text on cac.gov.cn. Applies to generative AI services offered to the public in mainland China, including via programmable interfaces (Arts. 2 and 22). Article 4 binds both the provision and the use of services.", "date_note": null, "source_url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0003-001: Article 4(2), Interim Measures for the Management of Generative Artificial Intelligence Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0003-001/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0003-002", "provision": "Article 7(1) and (2)", "applies_to": [ "Providers" ], "duty": "Use training data and foundation models from lawful sources, and do not infringe others' intellectual property rights in pre-training and optimisation training.", "type": "Copyright and training data", "status": "applies now", "applies_from": "2023-08-15", "url": "https://wheresthe.ai/id/WTA-R-CN-0003-002/", "rule": { "record_id": "WTA-R-CN-0003", "id": "cn-cac-generative-ai-interim-measures-2023", "title": "Interim Measures for the Management of Generative Artificial Intelligence Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-generative-ai-interim-measures-2023/" }, "penalty": "Penalties under the Cybersecurity, Data Security, Personal Information Protection and Science and Technology Progress Laws; where they are silent, warnings, public criticism and orders to correct, then suspension of the service for refusal or serious cases (Art. 21).", "scope_note": "Read via China Law Translate translation, checked against the Chinese text on cac.gov.cn. Applies to generative AI services offered to the public in mainland China, including via programmable interfaces (Arts. 2 and 22).", "date_note": null, "source_url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0003-002: Article 7(1) and (2), Interim Measures for the Management of Generative Artificial Intelligence Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0003-002/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0003-003", "provision": "Article 7(3)", "applies_to": [ "Providers" ], "duty": "Get individuals' consent, or rely on another legal basis, where training data involves personal information.", "type": "Data governance", "status": "applies now", "applies_from": "2023-08-15", "url": "https://wheresthe.ai/id/WTA-R-CN-0003-003/", "rule": { "record_id": "WTA-R-CN-0003", "id": "cn-cac-generative-ai-interim-measures-2023", "title": "Interim Measures for the Management of Generative Artificial Intelligence Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-generative-ai-interim-measures-2023/" }, "penalty": "Penalties under the Cybersecurity, Data Security, Personal Information Protection and Science and Technology Progress Laws; where they are silent, warnings, public criticism and orders to correct, then suspension of the service for refusal or serious cases (Art. 21).", "scope_note": "Read via China Law Translate translation, checked against the Chinese text on cac.gov.cn. Applies to generative AI services offered to the public in mainland China, including via programmable interfaces (Arts. 2 and 22). Art. 7(4) also requires effective measures to improve training data quality, accuracy, objectivity and diversity.", "date_note": null, "source_url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0003-003: Article 7(3), Interim Measures for the Management of Generative Artificial Intelligence Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0003-003/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0003-004", "provision": "Article 8", "applies_to": [ "Providers" ], "duty": "Set clear, specific and workable data annotation rules, check annotation quality by sampling, and train and supervise annotators.", "type": "Data governance", "status": "applies now", "applies_from": "2023-08-15", "url": "https://wheresthe.ai/id/WTA-R-CN-0003-004/", "rule": { "record_id": "WTA-R-CN-0003", "id": "cn-cac-generative-ai-interim-measures-2023", "title": "Interim Measures for the Management of Generative Artificial Intelligence Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-generative-ai-interim-measures-2023/" }, "penalty": "Penalties under the Cybersecurity, Data Security, Personal Information Protection and Science and Technology Progress Laws; where they are silent, warnings, public criticism and orders to correct, then suspension of the service for refusal or serious cases (Art. 21).", "scope_note": "Read via China Law Translate translation, checked against the Chinese text on cac.gov.cn. Applies to generative AI services offered to the public in mainland China, including via programmable interfaces (Arts. 2 and 22).", "date_note": null, "source_url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0003-004: Article 8, Interim Measures for the Management of Generative Artificial Intelligence Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0003-004/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0003-005", "provision": "Article 10", "applies_to": [ "Providers" ], "duty": "Publish the service's intended users, settings and uses, and take effective measures to stop minors over-relying on or becoming addicted to generative AI services.", "type": "Consumer rights", "status": "applies now", "applies_from": "2023-08-15", "url": "https://wheresthe.ai/id/WTA-R-CN-0003-005/", "rule": { "record_id": "WTA-R-CN-0003", "id": "cn-cac-generative-ai-interim-measures-2023", "title": "Interim Measures for the Management of Generative Artificial Intelligence Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-generative-ai-interim-measures-2023/" }, "penalty": "Penalties under the Cybersecurity, Data Security, Personal Information Protection and Science and Technology Progress Laws; where they are silent, warnings, public criticism and orders to correct, then suspension of the service for refusal or serious cases (Art. 21).", "scope_note": "Read via China Law Translate translation, checked against the Chinese text on cac.gov.cn. Applies to generative AI services offered to the public in mainland China, including via programmable interfaces (Arts. 2 and 22).", "date_note": null, "source_url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0003-005: Article 10, Interim Measures for the Management of Generative Artificial Intelligence Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0003-005/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0003-006", "provision": "Article 11(2)", "applies_to": [ "Providers" ], "duty": "Accept and promptly handle individuals' requests to access, copy, correct, supplement or delete their personal information.", "type": "Consumer rights", "status": "applies now", "applies_from": "2023-08-15", "url": "https://wheresthe.ai/id/WTA-R-CN-0003-006/", "rule": { "record_id": "WTA-R-CN-0003", "id": "cn-cac-generative-ai-interim-measures-2023", "title": "Interim Measures for the Management of Generative Artificial Intelligence Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-generative-ai-interim-measures-2023/" }, "penalty": "Penalties under the Cybersecurity, Data Security, Personal Information Protection and Science and Technology Progress Laws; where they are silent, warnings, public criticism and orders to correct, then suspension of the service for refusal or serious cases (Art. 21).", "scope_note": "Read via China Law Translate translation, checked against the Chinese text on cac.gov.cn. Applies to generative AI services offered to the public in mainland China, including via programmable interfaces (Arts. 2 and 22). Art. 11(1) also bars collecting unnecessary personal data and unlawfully keeping or sharing identifiable inputs and usage records.", "date_note": null, "source_url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0003-006: Article 11(2), Interim Measures for the Management of Generative Artificial Intelligence Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0003-006/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0003-007", "provision": "Article 12", "applies_to": [ "Providers" ], "duty": "Label generated content such as images and video in line with the Deep Synthesis Provisions.", "type": "Labelling AI content", "status": "applies now", "applies_from": "2023-08-15", "url": "https://wheresthe.ai/id/WTA-R-CN-0003-007/", "rule": { "record_id": "WTA-R-CN-0003", "id": "cn-cac-generative-ai-interim-measures-2023", "title": "Interim Measures for the Management of Generative Artificial Intelligence Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-generative-ai-interim-measures-2023/" }, "penalty": "Penalties under the Cybersecurity, Data Security, Personal Information Protection and Science and Technology Progress Laws; where they are silent, warnings, public criticism and orders to correct, then suspension of the service for refusal or serious cases (Art. 21).", "scope_note": "Read via China Law Translate translation, checked against the Chinese text on cac.gov.cn. Applies to generative AI services offered to the public in mainland China, including via programmable interfaces (Arts. 2 and 22). From 1 Sep 2025 the labelling method is detailed by the AI-Generated Content Labelling Measures.", "date_note": null, "source_url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0003-007: Article 12, Interim Measures for the Management of Generative Artificial Intelligence Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0003-007/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0003-008", "provision": "Article 15", "applies_to": [ "Providers" ], "duty": "Set up a complaint and reporting mechanism with easy entry points, publish the handling process and response time limits, and promptly handle complaints and report back.", "type": "Consumer rights", "status": "applies now", "applies_from": "2023-08-15", "url": "https://wheresthe.ai/id/WTA-R-CN-0003-008/", "rule": { "record_id": "WTA-R-CN-0003", "id": "cn-cac-generative-ai-interim-measures-2023", "title": "Interim Measures for the Management of Generative Artificial Intelligence Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-generative-ai-interim-measures-2023/" }, "penalty": "Penalties under the Cybersecurity, Data Security, Personal Information Protection and Science and Technology Progress Laws; where they are silent, warnings, public criticism and orders to correct, then suspension of the service for refusal or serious cases (Art. 21).", "scope_note": "Read via China Law Translate translation, checked against the Chinese text on cac.gov.cn. Applies to generative AI services offered to the public in mainland China, including via programmable interfaces (Arts. 2 and 22).", "date_note": null, "source_url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0003-008: Article 15, Interim Measures for the Management of Generative Artificial Intelligence Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0003-008/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0003-009", "provision": "Article 17", "applies_to": [ "Providers" ], "duty": "Carry out a security assessment under state rules if your generative AI service has public opinion attributes or social mobilisation capacity.", "type": "Security testing", "status": "applies now", "applies_from": "2023-08-15", "url": "https://wheresthe.ai/id/WTA-R-CN-0003-009/", "rule": { "record_id": "WTA-R-CN-0003", "id": "cn-cac-generative-ai-interim-measures-2023", "title": "Interim Measures for the Management of Generative Artificial Intelligence Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-generative-ai-interim-measures-2023/" }, "penalty": "Penalties under the Cybersecurity, Data Security, Personal Information Protection and Science and Technology Progress Laws; where they are silent, warnings, public criticism and orders to correct, then suspension of the service for refusal or serious cases (Art. 21).", "scope_note": "Read via China Law Translate translation, checked against the Chinese text on cac.gov.cn. Applies to generative AI services offered to the public in mainland China, including via programmable interfaces (Arts. 2 and 22). The Measures do not define 'public opinion attributes or social mobilisation capacity'.", "date_note": null, "source_url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0003-009: Article 17, Interim Measures for the Management of Generative Artificial Intelligence Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0003-009/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0003-010", "provision": "Article 17", "applies_to": [ "Providers" ], "duty": "Complete algorithm filing, and filing changes and cancellations, under the Algorithm Recommendation Provisions if your generative AI service has public opinion attributes or social mobilisation capacity.", "type": "Registration or filing", "status": "applies now", "applies_from": "2023-08-15", "url": "https://wheresthe.ai/id/WTA-R-CN-0003-010/", "rule": { "record_id": "WTA-R-CN-0003", "id": "cn-cac-generative-ai-interim-measures-2023", "title": "Interim Measures for the Management of Generative Artificial Intelligence Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-generative-ai-interim-measures-2023/" }, "penalty": "Penalties under the Cybersecurity, Data Security, Personal Information Protection and Science and Technology Progress Laws; where they are silent, warnings, public criticism and orders to correct, then suspension of the service for refusal or serious cases (Art. 21).", "scope_note": "Read via China Law Translate translation, checked against the Chinese text on cac.gov.cn. Applies to generative AI services offered to the public in mainland China, including via programmable interfaces (Arts. 2 and 22). The Measures do not define 'public opinion attributes or social mobilisation capacity'.", "date_note": null, "source_url": "https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0003-010: Article 17, Interim Measures for the Management of Generative Artificial Intelligence Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0003-010/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0002-001", "provision": "Article 12", "applies_to": [ "Providers" ], "duty": "Set up easy channels for user appeals and public complaints and reports, publish the handling process and response time limits, and promptly handle them and report back.", "type": "Consumer rights", "status": "applies now", "applies_from": "2023-01-10", "url": "https://wheresthe.ai/id/WTA-R-CN-0002-001/", "rule": { "record_id": "WTA-R-CN-0002", "id": "cn-cac-deep-synthesis-provisions-2022", "title": "Provisions on the Administration of Deep Synthesis Internet Information Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-deep-synthesis-provisions-2022/" }, "penalty": "Penalties under relevant laws and administrative regulations, heavier where serious consequences result (Art. 22).", "scope_note": "Read via China Law Translate translation, checked against the Chinese text on cac.gov.cn.", "date_note": null, "source_url": "https://www.cac.gov.cn/2022-12/11/c_1672221949354811.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0002-001: Article 12, Provisions on the Administration of Deep Synthesis Internet Information Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0002-001/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0002-002", "provision": "Article 14(2)", "applies_to": [ "Providers", "Developers" ], "duty": "Prompt users of face or voice editing features to inform the person being edited and obtain that person's separate consent.", "type": "Consumer rights", "status": "applies now", "applies_from": "2023-01-10", "url": "https://wheresthe.ai/id/WTA-R-CN-0002-002/", "rule": { "record_id": "WTA-R-CN-0002", "id": "cn-cac-deep-synthesis-provisions-2022", "title": "Provisions on the Administration of Deep Synthesis Internet Information Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-deep-synthesis-provisions-2022/" }, "penalty": "Penalties under relevant laws and administrative regulations, heavier where serious consequences result (Art. 22).", "scope_note": "Read via China Law Translate translation, checked against the Chinese text on cac.gov.cn. 'Technical supporters' (providers of technical support to deep synthesis services) are mapped to developer.", "date_note": null, "source_url": "https://www.cac.gov.cn/2022-12/11/c_1672221949354811.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0002-002: Article 14(2), Provisions on the Administration of Deep Synthesis Internet Information Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0002-002/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0002-003", "provision": "Article 15(2)", "applies_to": [ "Providers", "Developers" ], "duty": "Carry out a security assessment, in-house or through a professional body, of models and templates that generate or edit biometric data such as faces and voices, or sensitive objects and scenes.", "type": "Security testing", "status": "applies now", "applies_from": "2023-01-10", "url": "https://wheresthe.ai/id/WTA-R-CN-0002-003/", "rule": { "record_id": "WTA-R-CN-0002", "id": "cn-cac-deep-synthesis-provisions-2022", "title": "Provisions on the Administration of Deep Synthesis Internet Information Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-deep-synthesis-provisions-2022/" }, "penalty": "Penalties under relevant laws and administrative regulations, heavier where serious consequences result (Art. 22).", "scope_note": "Read via China Law Translate translation, checked against the Chinese text on cac.gov.cn. 'Technical supporters' (providers of technical support to deep synthesis services) are mapped to developer. 'Sensitive' means non-biometric objects or scenes that may involve national security, national image, national interests or the public interest.", "date_note": null, "source_url": "https://www.cac.gov.cn/2022-12/11/c_1672221949354811.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0002-003: Article 15(2), Provisions on the Administration of Deep Synthesis Internet Information Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0002-003/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0002-004", "provision": "Article 16", "applies_to": [ "Providers" ], "duty": "Add technical marks that do not affect use to content generated or edited with your service, and keep logs as required by law.", "type": "Labelling AI content", "status": "applies now", "applies_from": "2023-01-10", "url": "https://wheresthe.ai/id/WTA-R-CN-0002-004/", "rule": { "record_id": "WTA-R-CN-0002", "id": "cn-cac-deep-synthesis-provisions-2022", "title": "Provisions on the Administration of Deep Synthesis Internet Information Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-deep-synthesis-provisions-2022/" }, "penalty": "Penalties under relevant laws and administrative regulations, heavier where serious consequences result (Art. 22).", "scope_note": "Read via China Law Translate translation, checked against the Chinese text on cac.gov.cn. This is the basis for implicit (metadata) labels detailed in Art. 5 of the AI-Generated Content Labelling Measures.", "date_note": null, "source_url": "https://www.cac.gov.cn/2022-12/11/c_1672221949354811.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0002-004: Article 16, Provisions on the Administration of Deep Synthesis Internet Information Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0002-004/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0002-005", "provision": "Article 17(1)", "applies_to": [ "Providers" ], "duty": "Add a conspicuous label in a reasonable place on generated or edited content that may confuse or mislead the public, covering chatbots and writing, voice synthesis, face generation or swapping, and immersive scenes.", "type": "Labelling AI content", "status": "applies now", "applies_from": "2023-01-10", "url": "https://wheresthe.ai/id/WTA-R-CN-0002-005/", "rule": { "record_id": "WTA-R-CN-0002", "id": "cn-cac-deep-synthesis-provisions-2022", "title": "Provisions on the Administration of Deep Synthesis Internet Information Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-deep-synthesis-provisions-2022/" }, "penalty": "Penalties under relevant laws and administrative regulations, heavier where serious consequences result (Art. 22).", "scope_note": "Read via China Law Translate translation, checked against the Chinese text on cac.gov.cn. Art. 17(2) requires providers of other deep synthesis services to offer a conspicuous labelling function and tell users they may use it.", "date_note": null, "source_url": "https://www.cac.gov.cn/2022-12/11/c_1672221949354811.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0002-005: Article 17(1), Provisions on the Administration of Deep Synthesis Internet Information Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0002-005/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0002-006", "provision": "Article 18", "applies_to": [ "Anyone" ], "duty": "Do not use technical means to delete, alter or hide deep synthesis labels added under Articles 16 and 17.", "type": "Labelling AI content", "status": "applies now", "applies_from": "2023-01-10", "url": "https://wheresthe.ai/id/WTA-R-CN-0002-006/", "rule": { "record_id": "WTA-R-CN-0002", "id": "cn-cac-deep-synthesis-provisions-2022", "title": "Provisions on the Administration of Deep Synthesis Internet Information Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-deep-synthesis-provisions-2022/" }, "penalty": "Penalties under relevant laws and administrative regulations, heavier where serious consequences result (Art. 22).", "scope_note": "Read via China Law Translate translation, checked against the Chinese text on cac.gov.cn.", "date_note": null, "source_url": "https://www.cac.gov.cn/2022-12/11/c_1672221949354811.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0002-006: Article 18, Provisions on the Administration of Deep Synthesis Internet Information Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0002-006/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0002-007", "provision": "Article 19(1)", "applies_to": [ "Providers" ], "duty": "Complete algorithm filing, changes and cancellations under the Algorithm Recommendation Provisions if your deep synthesis service has public opinion attributes or social mobilisation capacity.", "type": "Registration or filing", "status": "applies now", "applies_from": "2023-01-10", "url": "https://wheresthe.ai/id/WTA-R-CN-0002-007/", "rule": { "record_id": "WTA-R-CN-0002", "id": "cn-cac-deep-synthesis-provisions-2022", "title": "Provisions on the Administration of Deep Synthesis Internet Information Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-deep-synthesis-provisions-2022/" }, "penalty": "Penalties under relevant laws and administrative regulations, heavier where serious consequences result (Art. 22).", "scope_note": "Read via China Law Translate translation, checked against the Chinese text on cac.gov.cn. Filers must show their filing number and a link to the public filing information on their website or app (Art. 19(3)).", "date_note": null, "source_url": "https://www.cac.gov.cn/2022-12/11/c_1672221949354811.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0002-007: Article 19(1), Provisions on the Administration of Deep Synthesis Internet Information Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0002-007/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0002-008", "provision": "Article 19(2)", "applies_to": [ "Developers" ], "duty": "Complete algorithm filing, changes and cancellations by reference to the provider filing rules if you give technical support to deep synthesis services.", "type": "Registration or filing", "status": "applies now", "applies_from": "2023-01-10", "url": "https://wheresthe.ai/id/WTA-R-CN-0002-008/", "rule": { "record_id": "WTA-R-CN-0002", "id": "cn-cac-deep-synthesis-provisions-2022", "title": "Provisions on the Administration of Deep Synthesis Internet Information Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-deep-synthesis-provisions-2022/" }, "penalty": "Penalties under relevant laws and administrative regulations, heavier where serious consequences result (Art. 22).", "scope_note": "Read via China Law Translate translation, checked against the Chinese text on cac.gov.cn. 'Technical supporters' (providers of technical support to deep synthesis services) are mapped to developer.", "date_note": null, "source_url": "https://www.cac.gov.cn/2022-12/11/c_1672221949354811.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0002-008: Article 19(2), Provisions on the Administration of Deep Synthesis Internet Information Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0002-008/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0002-009", "provision": "Article 20", "applies_to": [ "Providers" ], "duty": "Carry out a security assessment under state rules when developing and launching new products, applications or features with public opinion attributes or social mobilisation capacity.", "type": "Security testing", "status": "applies now", "applies_from": "2023-01-10", "url": "https://wheresthe.ai/id/WTA-R-CN-0002-009/", "rule": { "record_id": "WTA-R-CN-0002", "id": "cn-cac-deep-synthesis-provisions-2022", "title": "Provisions on the Administration of Deep Synthesis Internet Information Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-deep-synthesis-provisions-2022/" }, "penalty": "Penalties under relevant laws and administrative regulations, heavier where serious consequences result (Art. 22).", "scope_note": "Read via China Law Translate translation, checked against the Chinese text on cac.gov.cn.", "date_note": null, "source_url": "https://www.cac.gov.cn/2022-12/11/c_1672221949354811.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0002-009: Article 20, Provisions on the Administration of Deep Synthesis Internet Information Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0002-009/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0001-001", "provision": "Article 16", "applies_to": [ "Providers" ], "duty": "Tell users conspicuously that you provide algorithmic recommendation services, and publish the basic principles, purposes and main operating mechanisms of the service.", "type": "Transparency to users", "status": "applies now", "applies_from": "2022-03-01", "url": "https://wheresthe.ai/id/WTA-R-CN-0001-001/", "rule": { "record_id": "WTA-R-CN-0001", "id": "cn-cac-algorithm-recommendation-provisions-2021", "title": "Provisions on the Administration of Algorithm Recommendation for Internet Information Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-algorithm-recommendation-provisions-2021/" }, "penalty": "Where other laws are silent: warning, public criticism and order to correct; for refusal or serious cases, suspension of information updates and a fine of RMB 10,000 to 100,000 (Art. 31).", "scope_note": "Read via China Law Translate translation, checked against the Chinese text on cac.gov.cn. Algorithmic recommendation includes generation and synthesis, personalised push, ranking and selection, search and filtering, and dispatch and decision algorithms (Art. 2).", "date_note": null, "source_url": "https://www.cac.gov.cn/2022-01/04/c_1642894606364259.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0001-001: Article 16, Provisions on the Administration of Algorithm Recommendation for Internet Information Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0001-001/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0001-002", "provision": "Article 17(1)", "applies_to": [ "Providers" ], "duty": "Give users an option not tailored to their personal characteristics, or an easy way to switch off algorithmic recommendation, and stop immediately when they switch it off.", "type": "Consumer rights", "status": "applies now", "applies_from": "2022-03-01", "url": "https://wheresthe.ai/id/WTA-R-CN-0001-002/", "rule": { "record_id": "WTA-R-CN-0001", "id": "cn-cac-algorithm-recommendation-provisions-2021", "title": "Provisions on the Administration of Algorithm Recommendation for Internet Information Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-algorithm-recommendation-provisions-2021/" }, "penalty": "Where other laws are silent: warning, public criticism and order to correct; for refusal or serious cases, suspension of information updates and a fine of RMB 10,000 to 100,000 (Art. 31).", "scope_note": "Read via China Law Translate translation, checked against the Chinese text on cac.gov.cn. Algorithmic recommendation includes generation and synthesis, personalised push, ranking and selection, search and filtering, and dispatch and decision algorithms (Art. 2).", "date_note": null, "source_url": "https://www.cac.gov.cn/2022-01/04/c_1642894606364259.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0001-002: Article 17(1), Provisions on the Administration of Algorithm Recommendation for Internet Information Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0001-002/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0001-003", "provision": "Article 17(2)", "applies_to": [ "Providers" ], "duty": "Let users select or delete the user tags based on their personal characteristics that are used for algorithmic recommendation.", "type": "Consumer rights", "status": "applies now", "applies_from": "2022-03-01", "url": "https://wheresthe.ai/id/WTA-R-CN-0001-003/", "rule": { "record_id": "WTA-R-CN-0001", "id": "cn-cac-algorithm-recommendation-provisions-2021", "title": "Provisions on the Administration of Algorithm Recommendation for Internet Information Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-algorithm-recommendation-provisions-2021/" }, "penalty": "Where other laws are silent: warning, public criticism and order to correct; for refusal or serious cases, suspension of information updates and a fine of RMB 10,000 to 100,000 (Art. 31).", "scope_note": "Read via China Law Translate translation, checked against the Chinese text on cac.gov.cn. Algorithmic recommendation includes generation and synthesis, personalised push, ranking and selection, search and filtering, and dispatch and decision algorithms (Art. 2).", "date_note": null, "source_url": "https://www.cac.gov.cn/2022-01/04/c_1642894606364259.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0001-003: Article 17(2), Provisions on the Administration of Algorithm Recommendation for Internet Information Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0001-003/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0001-004", "provision": "Article 18", "applies_to": [ "Providers" ], "duty": "Provide modes suited to minors, do not push information harmful to minors' physical or mental health, and do not use algorithms to induce minors' internet addiction.", "type": "Consumer rights", "status": "applies now", "applies_from": "2022-03-01", "url": "https://wheresthe.ai/id/WTA-R-CN-0001-004/", "rule": { "record_id": "WTA-R-CN-0001", "id": "cn-cac-algorithm-recommendation-provisions-2021", "title": "Provisions on the Administration of Algorithm Recommendation for Internet Information Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-algorithm-recommendation-provisions-2021/" }, "penalty": "Handled under relevant laws, administrative regulations and departmental rules (Art. 32); the Provisions set no fine for this duty.", "scope_note": "Read via China Law Translate translation, checked against the Chinese text on cac.gov.cn. Algorithmic recommendation includes generation and synthesis, personalised push, ranking and selection, search and filtering, and dispatch and decision algorithms (Art. 2).", "date_note": null, "source_url": "https://www.cac.gov.cn/2022-01/04/c_1642894606364259.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0001-004: Article 18, Provisions on the Administration of Algorithm Recommendation for Internet Information Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0001-004/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0001-005", "provision": "Article 21", "applies_to": [ "Providers" ], "duty": "Do not use algorithms to apply unreasonable differential treatment in prices or other trading terms based on consumers' preferences or trading habits.", "type": "Bias and non-discrimination", "status": "applies now", "applies_from": "2022-03-01", "url": "https://wheresthe.ai/id/WTA-R-CN-0001-005/", "rule": { "record_id": "WTA-R-CN-0001", "id": "cn-cac-algorithm-recommendation-provisions-2021", "title": "Provisions on the Administration of Algorithm Recommendation for Internet Information Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-algorithm-recommendation-provisions-2021/" }, "penalty": "Handled under relevant laws, administrative regulations and departmental rules (Art. 32); the Provisions set no fine for this duty.", "scope_note": "Read via China Law Translate translation, checked against the Chinese text on cac.gov.cn. Algorithmic recommendation includes generation and synthesis, personalised push, ranking and selection, search and filtering, and dispatch and decision algorithms (Art. 2).", "date_note": null, "source_url": "https://www.cac.gov.cn/2022-01/04/c_1642894606364259.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0001-005: Article 21, Provisions on the Administration of Algorithm Recommendation for Internet Information Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0001-005/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0001-006", "provision": "Article 22", "applies_to": [ "Providers" ], "duty": "Set up easy and effective channels for user appeals and public complaints and reports, set the handling process and response time limits, and promptly handle them and report back.", "type": "Consumer rights", "status": "applies now", "applies_from": "2022-03-01", "url": "https://wheresthe.ai/id/WTA-R-CN-0001-006/", "rule": { "record_id": "WTA-R-CN-0001", "id": "cn-cac-algorithm-recommendation-provisions-2021", "title": "Provisions on the Administration of Algorithm Recommendation for Internet Information Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-algorithm-recommendation-provisions-2021/" }, "penalty": "Where other laws are silent: warning, public criticism and order to correct; for refusal or serious cases, suspension of information updates and a fine of RMB 10,000 to 100,000 (Art. 31).", "scope_note": "Read via China Law Translate translation, checked against the Chinese text on cac.gov.cn. Algorithmic recommendation includes generation and synthesis, personalised push, ranking and selection, search and filtering, and dispatch and decision algorithms (Art. 2).", "date_note": null, "source_url": "https://www.cac.gov.cn/2022-01/04/c_1642894606364259.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0001-006: Article 22, Provisions on the Administration of Algorithm Recommendation for Internet Information Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0001-006/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0001-007", "provision": "Article 24(1)", "applies_to": [ "Providers" ], "duty": "File the provider name, service form, field, algorithm type, algorithm self-assessment report and planned public information in the algorithm filing system within 10 working days of starting service.", "type": "Registration or filing", "status": "applies now", "applies_from": "2022-03-01", "url": "https://wheresthe.ai/id/WTA-R-CN-0001-007/", "rule": { "record_id": "WTA-R-CN-0001", "id": "cn-cac-algorithm-recommendation-provisions-2021", "title": "Provisions on the Administration of Algorithm Recommendation for Internet Information Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-algorithm-recommendation-provisions-2021/" }, "penalty": "Where other laws are silent: warning, public criticism and order to correct; for refusal or serious cases, suspension of information updates and a fine of RMB 10,000 to 100,000 (Art. 31). Filing obtained by deception can be revoked, with fines of RMB 10,000 to 100,000 in serious cases (Art. 33).", "scope_note": "Read via China Law Translate translation, checked against the Chinese text on cac.gov.cn. Algorithmic recommendation includes generation and synthesis, personalised push, ranking and selection, search and filtering, and dispatch and decision algorithms (Art. 2). Applies to providers with public opinion attributes or social mobilisation capacity. Changes must be filed within 10 working days and cancellation within 20 working days of ending service (Art. 24(2)-(3)); filing numbers must be displayed (Art. 26).", "date_note": null, "source_url": "https://www.cac.gov.cn/2022-01/04/c_1642894606364259.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0001-007: Article 24(1), Provisions on the Administration of Algorithm Recommendation for Internet Information Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0001-007/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0001-008", "provision": "Article 27", "applies_to": [ "Providers" ], "duty": "Carry out a security assessment under state rules if your algorithmic recommendation service has public opinion attributes or social mobilisation capacity.", "type": "Security testing", "status": "applies now", "applies_from": "2022-03-01", "url": "https://wheresthe.ai/id/WTA-R-CN-0001-008/", "rule": { "record_id": "WTA-R-CN-0001", "id": "cn-cac-algorithm-recommendation-provisions-2021", "title": "Provisions on the Administration of Algorithm Recommendation for Internet Information Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-algorithm-recommendation-provisions-2021/" }, "penalty": "Handled under relevant laws, administrative regulations and departmental rules (Art. 32); the Provisions set no fine for this duty.", "scope_note": "Read via China Law Translate translation, checked against the Chinese text on cac.gov.cn. Algorithmic recommendation includes generation and synthesis, personalised push, ranking and selection, search and filtering, and dispatch and decision algorithms (Art. 2).", "date_note": null, "source_url": "https://www.cac.gov.cn/2022-01/04/c_1642894606364259.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0001-008: Article 27, Provisions on the Administration of Algorithm Recommendation for Internet Information Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0001-008/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0005-001", "provision": "Article 4(1)", "applies_to": [ "Providers" ], "duty": "Add explicit labels to AI-generated text, audio, images, video and virtual scenes from services covered by Deep Synthesis Article 17(1), placed as each media type requires.", "type": "Labelling AI content", "status": "applies now", "applies_from": "2025-09-01", "url": "https://wheresthe.ai/id/WTA-R-CN-0005-001/", "rule": { "record_id": "WTA-R-CN-0005", "id": "cn-cac-ai-generated-content-labelling-measures-2025", "title": "Measures for Labelling Artificial Intelligence-Generated and Synthesised Content", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-ai-generated-content-labelling-measures-2025/" }, "penalty": "Handled by the cyberspace, telecom, public security and radio and television authorities under relevant laws, administrative regulations and departmental rules (Art. 13); the Measures set no fine.", "scope_note": "Read via China Law Translate translation, checked against the Chinese text on cac.gov.cn. Art. 4(2) requires downloaded, copied or exported files to carry the explicit label. Detailed methods are in the mandatory national standard on labelling methods that took effect with the Measures (GB 45438-2025; standard number taken from secondary sources, standard text not opened).", "date_note": null, "source_url": "https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0005-001: Article 4(1), Measures for Labelling Artificial Intelligence-Generated and Synthesised Content. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0005-001/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0005-002", "provision": "Article 5", "applies_to": [ "Providers" ], "duty": "Add implicit labels to the metadata of generated content files, including content attributes, the provider's name or code and a content number.", "type": "Labelling AI content", "status": "applies now", "applies_from": "2025-09-01", "url": "https://wheresthe.ai/id/WTA-R-CN-0005-002/", "rule": { "record_id": "WTA-R-CN-0005", "id": "cn-cac-ai-generated-content-labelling-measures-2025", "title": "Measures for Labelling Artificial Intelligence-Generated and Synthesised Content", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-ai-generated-content-labelling-measures-2025/" }, "penalty": "Handled by the cyberspace, telecom, public security and radio and television authorities under relevant laws, administrative regulations and departmental rules (Art. 13); the Measures set no fine.", "scope_note": "Read via China Law Translate translation, checked against the Chinese text on cac.gov.cn. Digital watermarks are encouraged, not required. Detailed methods are in the mandatory national standard on labelling methods that took effect with the Measures (GB 45438-2025; standard number taken from secondary sources, standard text not opened).", "date_note": null, "source_url": "https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0005-002: Article 5, Measures for Labelling Artificial Intelligence-Generated and Synthesised Content. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0005-002/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0005-003", "provision": "Article 6(1)", "applies_to": [ "Platforms" ], "duty": "Check file metadata for implicit labels, add conspicuous labels next to published content that is confirmed, declared or suspected to be AI-generated, and give users a way to declare it.", "type": "Labelling AI content", "status": "applies now", "applies_from": "2025-09-01", "url": "https://wheresthe.ai/id/WTA-R-CN-0005-003/", "rule": { "record_id": "WTA-R-CN-0005", "id": "cn-cac-ai-generated-content-labelling-measures-2025", "title": "Measures for Labelling Artificial Intelligence-Generated and Synthesised Content", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-ai-generated-content-labelling-measures-2025/" }, "penalty": "Handled by the cyberspace, telecom, public security and radio and television authorities under relevant laws, administrative regulations and departmental rules (Art. 13); the Measures set no fine.", "scope_note": "Read via China Law Translate translation, checked against the Chinese text on cac.gov.cn. Applies to providers of online content distribution services. Where items 1 to 3 apply, Art. 6(2) also requires adding distribution details (platform name or code, content number) to the metadata.", "date_note": null, "source_url": "https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0005-003: Article 6(1), Measures for Labelling Artificial Intelligence-Generated and Synthesised Content. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0005-003/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0005-004", "provision": "Article 7", "applies_to": [ "Platforms" ], "duty": "Require apps to state at listing or review whether they offer AI generation services, and check the labelling materials of those that do.", "type": "Labelling AI content", "status": "applies now", "applies_from": "2025-09-01", "url": "https://wheresthe.ai/id/WTA-R-CN-0005-004/", "rule": { "record_id": "WTA-R-CN-0005", "id": "cn-cac-ai-generated-content-labelling-measures-2025", "title": "Measures for Labelling Artificial Intelligence-Generated and Synthesised Content", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-ai-generated-content-labelling-measures-2025/" }, "penalty": "Handled by the cyberspace, telecom, public security and radio and television authorities under relevant laws, administrative regulations and departmental rules (Art. 13); the Measures set no fine.", "scope_note": "Read via China Law Translate translation, checked against the Chinese text on cac.gov.cn. Applies to internet application distribution platforms (app stores).", "date_note": null, "source_url": "https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0005-004: Article 7, Measures for Labelling Artificial Intelligence-Generated and Synthesised Content. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0005-004/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0005-005", "provision": "Article 8", "applies_to": [ "Providers" ], "duty": "Explain the methods and styles of AI content labels in the user service agreement and prompt users to read and understand the labelling rules.", "type": "Transparency to users", "status": "applies now", "applies_from": "2025-09-01", "url": "https://wheresthe.ai/id/WTA-R-CN-0005-005/", "rule": { "record_id": "WTA-R-CN-0005", "id": "cn-cac-ai-generated-content-labelling-measures-2025", "title": "Measures for Labelling Artificial Intelligence-Generated and Synthesised Content", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-ai-generated-content-labelling-measures-2025/" }, "penalty": "Handled by the cyberspace, telecom, public security and radio and television authorities under relevant laws, administrative regulations and departmental rules (Art. 13); the Measures set no fine.", "scope_note": "Read via China Law Translate translation, checked against the Chinese text on cac.gov.cn.", "date_note": null, "source_url": "https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0005-005: Article 8, Measures for Labelling Artificial Intelligence-Generated and Synthesised Content. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0005-005/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0005-006", "provision": "Article 9", "applies_to": [ "Providers" ], "duty": "Provide generated content without explicit labels only after the user agreement sets out the user's labelling duties, and keep logs on recipients for at least six months.", "type": "Record-keeping", "status": "applies now", "applies_from": "2025-09-01", "url": "https://wheresthe.ai/id/WTA-R-CN-0005-006/", "rule": { "record_id": "WTA-R-CN-0005", "id": "cn-cac-ai-generated-content-labelling-measures-2025", "title": "Measures for Labelling Artificial Intelligence-Generated and Synthesised Content", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-ai-generated-content-labelling-measures-2025/" }, "penalty": "Handled by the cyberspace, telecom, public security and radio and television authorities under relevant laws, administrative regulations and departmental rules (Art. 13); the Measures set no fine.", "scope_note": "Read via China Law Translate translation, checked against the Chinese text on cac.gov.cn. Applies when a user asks for content without explicit labels; providing it is optional.", "date_note": null, "source_url": "https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0005-006: Article 9, Measures for Labelling Artificial Intelligence-Generated and Synthesised Content. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0005-006/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0005-007", "provision": "Article 10(1)", "applies_to": [ "Anyone" ], "duty": "Declare AI-generated content when publishing it on content distribution services and use the labelling function provided.", "type": "Labelling AI content", "status": "applies now", "applies_from": "2025-09-01", "url": "https://wheresthe.ai/id/WTA-R-CN-0005-007/", "rule": { "record_id": "WTA-R-CN-0005", "id": "cn-cac-ai-generated-content-labelling-measures-2025", "title": "Measures for Labelling Artificial Intelligence-Generated and Synthesised Content", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-ai-generated-content-labelling-measures-2025/" }, "penalty": "Handled by the cyberspace, telecom, public security and radio and television authorities under relevant laws, administrative regulations and departmental rules (Art. 13); the Measures set no fine.", "scope_note": "Read via China Law Translate translation, checked against the Chinese text on cac.gov.cn. Addressed to users of content distribution services.", "date_note": null, "source_url": "https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0005-007: Article 10(1), Measures for Labelling Artificial Intelligence-Generated and Synthesised Content. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0005-007/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0005-008", "provision": "Article 10(2)", "applies_to": [ "Anyone" ], "duty": "Do not maliciously delete, alter, forge or hide AI content labels, provide tools or services for others to do so, or use improper labelling to harm others.", "type": "Labelling AI content", "status": "applies now", "applies_from": "2025-09-01", "url": "https://wheresthe.ai/id/WTA-R-CN-0005-008/", "rule": { "record_id": "WTA-R-CN-0005", "id": "cn-cac-ai-generated-content-labelling-measures-2025", "title": "Measures for Labelling Artificial Intelligence-Generated and Synthesised Content", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-ai-generated-content-labelling-measures-2025/" }, "penalty": "Handled by the cyberspace, telecom, public security and radio and television authorities under relevant laws, administrative regulations and departmental rules (Art. 13); the Measures set no fine.", "scope_note": "Read via China Law Translate translation, checked against the Chinese text on cac.gov.cn.", "date_note": null, "source_url": "https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0005-008: Article 10(2), Measures for Labelling Artificial Intelligence-Generated and Synthesised Content. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0005-008/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0005-009", "provision": "Article 11", "applies_to": [ "Providers", "Platforms" ], "duty": "Meet the relevant laws, regulations, departmental rules and mandatory national standards when labelling AI-generated content.", "type": "Labelling AI content", "status": "applies now", "applies_from": "2025-09-01", "url": "https://wheresthe.ai/id/WTA-R-CN-0005-009/", "rule": { "record_id": "WTA-R-CN-0005", "id": "cn-cac-ai-generated-content-labelling-measures-2025", "title": "Measures for Labelling Artificial Intelligence-Generated and Synthesised Content", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-ai-generated-content-labelling-measures-2025/" }, "penalty": "Handled by the cyberspace, telecom, public security and radio and television authorities under relevant laws, administrative regulations and departmental rules (Art. 13); the Measures set no fine.", "scope_note": "Read via China Law Translate translation, checked against the Chinese text on cac.gov.cn. A CAC Q&A of 14 Mar 2025 says the companion mandatory national standard takes effect with the Measures after a transition of about six months. Detailed methods are in the mandatory national standard on labelling methods that took effect with the Measures (GB 45438-2025; standard number taken from secondary sources, standard text not opened).", "date_note": null, "source_url": "https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0005-009: Article 11, Measures for Labelling Artificial Intelligence-Generated and Synthesised Content. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0005-009/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0007-001", "provision": "Article 8(2)", "applies_to": [ "Providers" ], "duty": "Do not generate content that encourages, glorifies or hints at self-harm or suicide, or verbal abuse that harms users' dignity or mental health.", "type": "Prohibited uses", "status": "applies now", "applies_from": "2026-07-15", "url": "https://wheresthe.ai/id/WTA-R-CN-0007-001/", "rule": { "record_id": "WTA-R-CN-0007", "id": "cn-cac-anthropomorphic-ai-interim-measures-2026", "title": "Interim Measures for the Administration of Artificial Intelligence Anthropomorphic Interaction Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-anthropomorphic-ai-interim-measures-2026/" }, "penalty": "Where other laws are silent: warnings, public criticism, orders to correct and possible suspension of new registrations or other services; for refusal or serious cases, service shutdown and a fine of RMB 10,000 to 100,000, or RMB 100,000 to 200,000 where users' life or health is harmed (Art. 30).", "scope_note": "Read via China Law Translate translation of the final text ('human-like interactive AI services'), checked against the Chinese text on cac.gov.cn. Covers public services simulating human personality, thinking and communication for sustained emotional interaction; customer service, Q&A, work and study assistants are excluded (Art. 2).", "date_note": null, "source_url": "https://www.cac.gov.cn/2026-04/10/c_1777558395078289.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0007-001: Article 8(2), Interim Measures for the Administration of Artificial Intelligence Anthropomorphic Interaction Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0007-001/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0007-002", "provision": "Article 8(5)", "applies_to": [ "Providers" ], "duty": "Do not excessively cater to users or induce emotional dependence or addiction that harms users' real relationships.", "type": "Prohibited uses", "status": "applies now", "applies_from": "2026-07-15", "url": "https://wheresthe.ai/id/WTA-R-CN-0007-002/", "rule": { "record_id": "WTA-R-CN-0007", "id": "cn-cac-anthropomorphic-ai-interim-measures-2026", "title": "Interim Measures for the Administration of Artificial Intelligence Anthropomorphic Interaction Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-anthropomorphic-ai-interim-measures-2026/" }, "penalty": "Where other laws are silent: warnings, public criticism, orders to correct and possible suspension of new registrations or other services; for refusal or serious cases, service shutdown and a fine of RMB 10,000 to 100,000, or RMB 100,000 to 200,000 where users' life or health is harmed (Art. 30).", "scope_note": "Read via China Law Translate translation of the final text ('human-like interactive AI services'), checked against the Chinese text on cac.gov.cn. Covers public services simulating human personality, thinking and communication for sustained emotional interaction; customer service, Q&A, work and study assistants are excluded (Art. 2). Art. 8(6) separately bars emotional manipulation that induces unreasonable decisions harming users' rights.", "date_note": null, "source_url": "https://www.cac.gov.cn/2026-04/10/c_1777558395078289.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0007-002: Article 8(5), Interim Measures for the Administration of Artificial Intelligence Anthropomorphic Interaction Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0007-002/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0007-003", "provision": "Article 11", "applies_to": [ "Providers" ], "duty": "Use lawfully sourced training data, clean and annotate it, guard against data poisoning, assess the safety of synthetic training data, and check and update data regularly.", "type": "Data governance", "status": "applies now", "applies_from": "2026-07-15", "url": "https://wheresthe.ai/id/WTA-R-CN-0007-003/", "rule": { "record_id": "WTA-R-CN-0007", "id": "cn-cac-anthropomorphic-ai-interim-measures-2026", "title": "Interim Measures for the Administration of Artificial Intelligence Anthropomorphic Interaction Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-anthropomorphic-ai-interim-measures-2026/" }, "penalty": "Where other laws are silent: warnings, public criticism, orders to correct and possible suspension of new registrations or other services; for refusal or serious cases, service shutdown and a fine of RMB 10,000 to 100,000, or RMB 100,000 to 200,000 where users' life or health is harmed (Art. 30).", "scope_note": "Read via China Law Translate translation of the final text ('human-like interactive AI services'), checked against the Chinese text on cac.gov.cn. Covers public services simulating human personality, thinking and communication for sustained emotional interaction; customer service, Q&A, work and study assistants are excluded (Art. 2).", "date_note": null, "source_url": "https://www.cac.gov.cn/2026-04/10/c_1777558395078289.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0007-003: Article 11, Interim Measures for the Administration of Artificial Intelligence Anthropomorphic Interaction Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0007-003/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0007-004", "provision": "Article 13(2)", "applies_to": [ "Providers" ], "duty": "Generate calming content urging users in extreme emotional states to seek help, and intervene and contact the guardian or emergency contact when users threaten self-harm or suicide or face major property loss.", "type": "Consumer rights", "status": "applies now", "applies_from": "2026-07-15", "url": "https://wheresthe.ai/id/WTA-R-CN-0007-004/", "rule": { "record_id": "WTA-R-CN-0007", "id": "cn-cac-anthropomorphic-ai-interim-measures-2026", "title": "Interim Measures for the Administration of Artificial Intelligence Anthropomorphic Interaction Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-anthropomorphic-ai-interim-measures-2026/" }, "penalty": "Where other laws are silent: warnings, public criticism, orders to correct and possible suspension of new registrations or other services; for refusal or serious cases, service shutdown and a fine of RMB 10,000 to 100,000, or RMB 100,000 to 200,000 where users' life or health is harmed (Art. 30).", "scope_note": "Read via China Law Translate translation of the final text ('human-like interactive AI services'), checked against the Chinese text on cac.gov.cn. Covers public services simulating human personality, thinking and communication for sustained emotional interaction; customer service, Q&A, work and study assistants are excluded (Art. 2). Art. 12 requires users to give age and guardian or emergency contact details at registration.", "date_note": null, "source_url": "https://www.cac.gov.cn/2026-04/10/c_1777558395078289.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0007-004: Article 13(2), Interim Measures for the Administration of Artificial Intelligence Anthropomorphic Interaction Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0007-004/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0007-005", "provision": "Article 14(1)", "applies_to": [ "Providers" ], "duty": "Do not offer virtual relative, virtual partner or other virtual intimate relationship services to minors, and get parent or guardian consent to offer other services to children under 14.", "type": "Consumer rights", "status": "applies now", "applies_from": "2026-07-15", "url": "https://wheresthe.ai/id/WTA-R-CN-0007-005/", "rule": { "record_id": "WTA-R-CN-0007", "id": "cn-cac-anthropomorphic-ai-interim-measures-2026", "title": "Interim Measures for the Administration of Artificial Intelligence Anthropomorphic Interaction Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-anthropomorphic-ai-interim-measures-2026/" }, "penalty": "Where other laws are silent: warnings, public criticism, orders to correct and possible suspension of new registrations or other services; for refusal or serious cases, service shutdown and a fine of RMB 10,000 to 100,000, or RMB 100,000 to 200,000 where users' life or health is harmed (Art. 30).", "scope_note": "Read via China Law Translate translation of the final text ('human-like interactive AI services'), checked against the Chinese text on cac.gov.cn. Covers public services simulating human personality, thinking and communication for sustained emotional interaction; customer service, Q&A, work and study assistants are excluded (Art. 2).", "date_note": null, "source_url": "https://www.cac.gov.cn/2026-04/10/c_1777558395078289.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0007-005: Article 14(1), Interim Measures for the Administration of Artificial Intelligence Anthropomorphic Interaction Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0007-005/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0007-006", "provision": "Article 14(2)", "applies_to": [ "Providers" ], "duty": "Set up a minors' mode with mode switching, reality reminders and time limits, and let guardians receive risk alerts, see usage, block characters and limit spending.", "type": "Consumer rights", "status": "applies now", "applies_from": "2026-07-15", "url": "https://wheresthe.ai/id/WTA-R-CN-0007-006/", "rule": { "record_id": "WTA-R-CN-0007", "id": "cn-cac-anthropomorphic-ai-interim-measures-2026", "title": "Interim Measures for the Administration of Artificial Intelligence Anthropomorphic Interaction Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-anthropomorphic-ai-interim-measures-2026/" }, "penalty": "Where other laws are silent: warnings, public criticism, orders to correct and possible suspension of new registrations or other services; for refusal or serious cases, service shutdown and a fine of RMB 10,000 to 100,000, or RMB 100,000 to 200,000 where users' life or health is harmed (Art. 30).", "scope_note": "Read via China Law Translate translation of the final text ('human-like interactive AI services'), checked against the Chinese text on cac.gov.cn. Covers public services simulating human personality, thinking and communication for sustained emotional interaction; customer service, Q&A, work and study assistants are excluded (Art. 2). Art. 14(3) requires effective measures to identify minors, switch them to minors' mode and offer an appeal channel.", "date_note": null, "source_url": "https://www.cac.gov.cn/2026-04/10/c_1777558395078289.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0007-006: Article 14(2), Interim Measures for the Administration of Artificial Intelligence Anthropomorphic Interaction Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0007-006/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0007-007", "provision": "Article 16(4)", "applies_to": [ "Providers" ], "duty": "Do not use interaction data that is sensitive personal information to train models without the user's separate consent, unless laws or administrative regulations provide otherwise.", "type": "Data governance", "status": "applies now", "applies_from": "2026-07-15", "url": "https://wheresthe.ai/id/WTA-R-CN-0007-007/", "rule": { "record_id": "WTA-R-CN-0007", "id": "cn-cac-anthropomorphic-ai-interim-measures-2026", "title": "Interim Measures for the Administration of Artificial Intelligence Anthropomorphic Interaction Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-anthropomorphic-ai-interim-measures-2026/" }, "penalty": "Where other laws are silent: warnings, public criticism, orders to correct and possible suspension of new registrations or other services; for refusal or serious cases, service shutdown and a fine of RMB 10,000 to 100,000, or RMB 100,000 to 200,000 where users' life or health is harmed (Art. 30).", "scope_note": "Read via China Law Translate translation of the final text ('human-like interactive AI services'), checked against the Chinese text on cac.gov.cn. Covers public services simulating human personality, thinking and communication for sustained emotional interaction; customer service, Q&A, work and study assistants are excluded (Art. 2). Art. 16(2)-(3) also bar sharing interaction data with third parties without consent and require options to copy and delete chat history.", "date_note": null, "source_url": "https://www.cac.gov.cn/2026-04/10/c_1777558395078289.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0007-007: Article 16(4), Interim Measures for the Administration of Artificial Intelligence Anthropomorphic Interaction Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0007-007/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0007-008", "provision": "Article 18(1)", "applies_to": [ "Providers" ], "duty": "Label AI-generated content and take effective measures to tell users they are interacting with an AI service, not a natural person.", "type": "Transparency to users", "status": "applies now", "applies_from": "2026-07-15", "url": "https://wheresthe.ai/id/WTA-R-CN-0007-008/", "rule": { "record_id": "WTA-R-CN-0007", "id": "cn-cac-anthropomorphic-ai-interim-measures-2026", "title": "Interim Measures for the Administration of Artificial Intelligence Anthropomorphic Interaction Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-anthropomorphic-ai-interim-measures-2026/" }, "penalty": "Where other laws are silent: warnings, public criticism, orders to correct and possible suspension of new registrations or other services; for refusal or serious cases, service shutdown and a fine of RMB 10,000 to 100,000, or RMB 100,000 to 200,000 where users' life or health is harmed (Art. 30).", "scope_note": "Read via China Law Translate translation of the final text ('human-like interactive AI services'), checked against the Chinese text on cac.gov.cn. Covers public services simulating human personality, thinking and communication for sustained emotional interaction; customer service, Q&A, work and study assistants are excluded (Art. 2).", "date_note": null, "source_url": "https://www.cac.gov.cn/2026-04/10/c_1777558395078289.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0007-008: Article 18(1), Interim Measures for the Administration of Artificial Intelligence Anthropomorphic Interaction Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0007-008/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0007-009", "provision": "Article 18(2)", "applies_to": [ "Providers" ], "duty": "Remind users by pop-up or other conspicuous means that content is AI-generated when they show signs of over-reliance, and remind them of usage time after every two hours of continuous use.", "type": "Consumer rights", "status": "applies now", "applies_from": "2026-07-15", "url": "https://wheresthe.ai/id/WTA-R-CN-0007-009/", "rule": { "record_id": "WTA-R-CN-0007", "id": "cn-cac-anthropomorphic-ai-interim-measures-2026", "title": "Interim Measures for the Administration of Artificial Intelligence Anthropomorphic Interaction Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-anthropomorphic-ai-interim-measures-2026/" }, "penalty": "Where other laws are silent: warnings, public criticism, orders to correct and possible suspension of new registrations or other services; for refusal or serious cases, service shutdown and a fine of RMB 10,000 to 100,000, or RMB 100,000 to 200,000 where users' life or health is harmed (Art. 30).", "scope_note": "Read via China Law Translate translation of the final text ('human-like interactive AI services'), checked against the Chinese text on cac.gov.cn. Covers public services simulating human personality, thinking and communication for sustained emotional interaction; customer service, Q&A, work and study assistants are excluded (Art. 2).", "date_note": null, "source_url": "https://www.cac.gov.cn/2026-04/10/c_1777558395078289.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0007-009: Article 18(2), Interim Measures for the Administration of Artificial Intelligence Anthropomorphic Interaction Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0007-009/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0007-010", "provision": "Article 21", "applies_to": [ "Providers" ], "duty": "Set up easy and effective channels for user appeals and public complaints and reports, set the handling process and response time limits, and promptly handle them and report back.", "type": "Consumer rights", "status": "applies now", "applies_from": "2026-07-15", "url": "https://wheresthe.ai/id/WTA-R-CN-0007-010/", "rule": { "record_id": "WTA-R-CN-0007", "id": "cn-cac-anthropomorphic-ai-interim-measures-2026", "title": "Interim Measures for the Administration of Artificial Intelligence Anthropomorphic Interaction Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-anthropomorphic-ai-interim-measures-2026/" }, "penalty": "Where other laws are silent: warnings, public criticism, orders to correct and possible suspension of new registrations or other services; for refusal or serious cases, service shutdown and a fine of RMB 10,000 to 100,000, or RMB 100,000 to 200,000 where users' life or health is harmed (Art. 30).", "scope_note": "Read via China Law Translate translation of the final text ('human-like interactive AI services'), checked against the Chinese text on cac.gov.cn. Covers public services simulating human personality, thinking and communication for sustained emotional interaction; customer service, Q&A, work and study assistants are excluded (Art. 2).", "date_note": null, "source_url": "https://www.cac.gov.cn/2026-04/10/c_1777558395078289.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0007-010: Article 21, Interim Measures for the Administration of Artificial Intelligence Anthropomorphic Interaction Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0007-010/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0007-011", "provision": "Article 22", "applies_to": [ "Providers" ], "duty": "Carry out a security assessment and report to the provincial CAC when launching or adding features, making major changes, reaching 1 million registered or 100,000 monthly active users, or facing risks to national security or the public interest.", "type": "Security testing", "status": "applies now", "applies_from": "2026-07-15", "url": "https://wheresthe.ai/id/WTA-R-CN-0007-011/", "rule": { "record_id": "WTA-R-CN-0007", "id": "cn-cac-anthropomorphic-ai-interim-measures-2026", "title": "Interim Measures for the Administration of Artificial Intelligence Anthropomorphic Interaction Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-anthropomorphic-ai-interim-measures-2026/" }, "penalty": "Where other laws are silent: warnings, public criticism, orders to correct and possible suspension of new registrations or other services; for refusal or serious cases, service shutdown and a fine of RMB 10,000 to 100,000, or RMB 100,000 to 200,000 where users' life or health is harmed (Art. 30).", "scope_note": "Read via China Law Translate translation of the final text ('human-like interactive AI services'), checked against the Chinese text on cac.gov.cn. Covers public services simulating human personality, thinking and communication for sustained emotional interaction; customer service, Q&A, work and study assistants are excluded (Art. 2). Art. 23 lists what the assessment must cover; provincial CAC reviews reports annually (Art. 27).", "date_note": null, "source_url": "https://www.cac.gov.cn/2026-04/10/c_1777558395078289.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0007-011: Article 22, Interim Measures for the Administration of Artificial Intelligence Anthropomorphic Interaction Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0007-011/ (checked 2026-10-08)." }, { "record_id": "WTA-R-CN-0007-012", "provision": "Article 26", "applies_to": [ "Providers" ], "duty": "Complete algorithm filing, changes and cancellations under the Algorithm Recommendation Provisions for human-like interactive services.", "type": "Registration or filing", "status": "applies now", "applies_from": "2026-07-15", "url": "https://wheresthe.ai/id/WTA-R-CN-0007-012/", "rule": { "record_id": "WTA-R-CN-0007", "id": "cn-cac-anthropomorphic-ai-interim-measures-2026", "title": "Interim Measures for the Administration of Artificial Intelligence Anthropomorphic Interaction Services", "jurisdiction": "CN", "jurisdiction_name": "China", "url": "https://wheresthe.ai/rule/cn-cac-anthropomorphic-ai-interim-measures-2026/" }, "penalty": "Where other laws are silent: warnings, public criticism, orders to correct and possible suspension of new registrations or other services; for refusal or serious cases, service shutdown and a fine of RMB 10,000 to 100,000, or RMB 100,000 to 200,000 where users' life or health is harmed (Art. 30).", "scope_note": "Read via China Law Translate translation of the final text ('human-like interactive AI services'), checked against the Chinese text on cac.gov.cn. Covers public services simulating human personality, thinking and communication for sustained emotional interaction; customer service, Q&A, work and study assistants are excluded (Art. 2). Filing materials are checked annually. Unlike the filing duties in the Algorithm Recommendation Provisions, Deep Synthesis Provisions and Generative AI Interim Measures, this duty is not limited to services with public opinion attributes.", "date_note": null, "source_url": "https://www.cac.gov.cn/2026-04/10/c_1777558395078289.htm", "verified_on": "2026-10-08", "citation": "WTA-R-CN-0007-012: Article 26, Interim Measures for the Administration of Artificial Intelligence Anthropomorphic Interaction Services. wheresthe.ai, https://wheresthe.ai/id/WTA-R-CN-0007-012/ (checked 2026-10-08)." }, { "record_id": "WTA-R-JP-0001-001", "provision": "Article 7", "applies_to": [ "Developers", "Providers", "Deployers" ], "duty": "Cooperate with AI measures carried out by the national government and local governments.", "type": "Government use of AI", "status": "applies now", "applies_from": "2025-06-04", "url": "https://wheresthe.ai/id/WTA-R-JP-0001-001/", "rule": { "record_id": "WTA-R-JP-0001", "id": "jp-ai-promotion-act-2025", "title": "Act on the Promotion of Research, Development and Utilization of Artificial Intelligence-Related Technologies", "jurisdiction": "JP", "jurisdiction_name": "Japan", "url": "https://wheresthe.ai/rule/jp-ai-promotion-act-2025/" }, "penalty": "No penalty in the Act.", "scope_note": "Read in the official Japanese text on e-Gov (Act No. 53 of 2025); the Japanese Law Translation database returned HTTP 403, so the Cabinet Office provisional English overview was used as a cross-check. Applies to 'utilising businesses' that develop or provide AI-based products or services or use AI in business. The Japanese text says 'shall cooperate'; the Cabinet Office English overview says 'endeavor to cooperate'. Art. 7 also asks them to endeavour to use AI actively. The schema has no cooperation type; public-sector-use is the nearest fit.", "date_note": null, "source_url": "https://laws.e-gov.go.jp/law/507AC0000000053", "verified_on": "2026-10-08", "citation": "WTA-R-JP-0001-001: Article 7, Act on the Promotion of Research, Development and Utilization of Artificial Intelligence-Related Technologies. wheresthe.ai, https://wheresthe.ai/id/WTA-R-JP-0001-001/ (checked 2026-10-08)." }, { "record_id": "WTA-R-JP-0001-002", "provision": "Article 6(1)", "applies_to": [ "Developers" ], "duty": "Try to carry out AI research and development, spread its results, train specialist staff, and cooperate with national and local government AI measures.", "type": "Government use of AI", "status": "applies now", "applies_from": "2025-06-04", "url": "https://wheresthe.ai/id/WTA-R-JP-0001-002/", "rule": { "record_id": "WTA-R-JP-0001", "id": "jp-ai-promotion-act-2025", "title": "Act on the Promotion of Research, Development and Utilization of Artificial Intelligence-Related Technologies", "jurisdiction": "JP", "jurisdiction_name": "Japan", "url": "https://wheresthe.ai/rule/jp-ai-promotion-act-2025/" }, "penalty": "No penalty in the Act.", "scope_note": "Read in the official Japanese text on e-Gov (Act No. 53 of 2025); the Japanese Law Translation database returned HTTP 403, so the Cabinet Office provisional English overview was used as a cross-check. Effort duty for universities, national R&D agencies and other bodies doing AI R&D. The schema has no cooperation type; public-sector-use is the nearest fit.", "date_note": null, "source_url": "https://laws.e-gov.go.jp/law/507AC0000000053", "verified_on": "2026-10-08", "citation": "WTA-R-JP-0001-002: Article 6(1), Act on the Promotion of Research, Development and Utilization of Artificial Intelligence-Related Technologies. wheresthe.ai, https://wheresthe.ai/id/WTA-R-JP-0001-002/ (checked 2026-10-08)." }, { "record_id": "WTA-R-JP-0005-001", "provision": "Section 2-2 (Human in the loop)", "applies_to": [ "Public bodies" ], "duty": "Check, approve, correct or stop AI processing at the right stages of the work, and do not copy Gennai output into official documents without a staff member checking it.", "type": "Human oversight", "status": "applies now", "applies_from": "2026-10-20", "url": "https://wheresthe.ai/id/WTA-R-JP-0005-001/", "rule": { "record_id": "WTA-R-JP-0005", "id": "jp-gennai-standard-government-ai-agents-2026", "title": "Government AI Gennai governance, security and safety standard (Gennai Standard), 1st edition", "jurisdiction": "JP", "jurisdiction_name": "Japan", "url": "https://wheresthe.ai/rule/jp-gennai-standard-government-ai-agents-2026/" }, "penalty": "No penalty in the Standard.", "scope_note": "Read in the official Japanese text (Digital Agency, Gennai Standard 1st edition, October 2026). Duty of users: government staff and staff of the legislature, judiciary and independent administrative agencies who use Gennai.", "date_note": null, "source_url": "https://www.digital.go.jp/assets/contents/node/basic_page/field_ref_resources/b033337d-dad1-4493-9316-d929597e4667/9bbaf559/20261020_policies_genai_guideline_02.pdf", "verified_on": "2026-10-25", "citation": "WTA-R-JP-0005-001: Section 2-2 (Human in the loop), Government AI Gennai governance, security and safety standard (Gennai Standard), 1st edition. wheresthe.ai, https://wheresthe.ai/id/WTA-R-JP-0005-001/ (checked 2026-10-25)." }, { "record_id": "WTA-R-JP-0005-002", "provision": "Section 2-2 (Hallucination)", "applies_to": [ "Public bodies" ], "duty": "Do not treat generative AI output as fact; confirm important information against original sources, laws or official government material, and recheck calculations by other means.", "type": "Human oversight", "status": "applies now", "applies_from": "2026-10-20", "url": "https://wheresthe.ai/id/WTA-R-JP-0005-002/", "rule": { "record_id": "WTA-R-JP-0005", "id": "jp-gennai-standard-government-ai-agents-2026", "title": "Government AI Gennai governance, security and safety standard (Gennai Standard), 1st edition", "jurisdiction": "JP", "jurisdiction_name": "Japan", "url": "https://wheresthe.ai/rule/jp-gennai-standard-government-ai-agents-2026/" }, "penalty": "No penalty in the Standard.", "scope_note": "Read in the official Japanese text (Digital Agency, Gennai Standard 1st edition, October 2026). Duty of users. The Standard lists figures, dates, law names, proper nouns, citations and calculations as items needing careful checks.", "date_note": null, "source_url": "https://www.digital.go.jp/assets/contents/node/basic_page/field_ref_resources/b033337d-dad1-4493-9316-d929597e4667/9bbaf559/20261020_policies_genai_guideline_02.pdf", "verified_on": "2026-10-25", "citation": "WTA-R-JP-0005-002: Section 2-2 (Hallucination), Government AI Gennai governance, security and safety standard (Gennai Standard), 1st edition. wheresthe.ai, https://wheresthe.ai/id/WTA-R-JP-0005-002/ (checked 2026-10-25)." }, { "record_id": "WTA-R-JP-0005-003", "provision": "Section 2-2 (High-risk use cases)", "applies_to": [ "Public bodies" ], "duty": "Judge the risk level of each AI use case using the high-risk test in the government AI procurement and use guideline, and report likely high-risk projects to the ministry's CAIO.", "type": "Risk classification", "status": "applies now", "applies_from": "2026-10-20", "url": "https://wheresthe.ai/id/WTA-R-JP-0005-003/", "rule": { "record_id": "WTA-R-JP-0005", "id": "jp-gennai-standard-government-ai-agents-2026", "title": "Government AI Gennai governance, security and safety standard (Gennai Standard), 1st edition", "jurisdiction": "JP", "jurisdiction_name": "Japan", "url": "https://wheresthe.ai/rule/jp-gennai-standard-government-ai-agents-2026/" }, "penalty": "No penalty in the Standard.", "scope_note": "Read in the official Japanese text (Digital Agency, Gennai Standard 1st edition, October 2026). Duty of users. The guideline is DS-920 version 2.0 of 12 June 2026. A likely high-risk project must set out its purpose, use, expected risks, mitigations and quality measures before reporting.", "date_note": null, "source_url": "https://www.digital.go.jp/assets/contents/node/basic_page/field_ref_resources/b033337d-dad1-4493-9316-d929597e4667/9bbaf559/20261020_policies_genai_guideline_02.pdf", "verified_on": "2026-10-25", "citation": "WTA-R-JP-0005-003: Section 2-2 (High-risk use cases), Government AI Gennai governance, security and safety standard (Gennai Standard), 1st edition. wheresthe.ai, https://wheresthe.ai/id/WTA-R-JP-0005-003/ (checked 2026-10-25)." }, { "record_id": "WTA-R-JP-0005-004", "provision": "Section 2-2 (Ban on shadow AI)", "applies_to": [ "Public bodies" ], "duty": "Use only generative AI services the organisation has approved, such as Gennai, for work, and do not put work material into personal AI accounts or apps.", "type": "Prohibited uses", "status": "applies now", "applies_from": "2026-10-20", "url": "https://wheresthe.ai/id/WTA-R-JP-0005-004/", "rule": { "record_id": "WTA-R-JP-0005", "id": "jp-gennai-standard-government-ai-agents-2026", "title": "Government AI Gennai governance, security and safety standard (Gennai Standard), 1st edition", "jurisdiction": "JP", "jurisdiction_name": "Japan", "url": "https://wheresthe.ai/rule/jp-gennai-standard-government-ai-agents-2026/" }, "penalty": "No penalty in the Standard.", "scope_note": "Read in the official Japanese text (Digital Agency, Gennai Standard 1st edition, October 2026). Duty of users. Examples in the text include pasting work emails into a personal chatbot and using a personal phone app for sensitive work questions.", "date_note": null, "source_url": "https://www.digital.go.jp/assets/contents/node/basic_page/field_ref_resources/b033337d-dad1-4493-9316-d929597e4667/9bbaf559/20261020_policies_genai_guideline_02.pdf", "verified_on": "2026-10-25", "citation": "WTA-R-JP-0005-004: Section 2-2 (Ban on shadow AI), Government AI Gennai governance, security and safety standard (Gennai Standard), 1st edition. wheresthe.ai, https://wheresthe.ai/id/WTA-R-JP-0005-004/ (checked 2026-10-25)." }, { "record_id": "WTA-R-JP-0005-005", "provision": "Section 2-2 (Information about people)", "applies_to": [ "Public bodies" ], "duty": "Search for individuals with AI only when the assigned work requires it, and do not use AI to infer beliefs a person has not stated or to predict their future behaviour.", "type": "Prohibited uses", "status": "applies now", "applies_from": "2026-10-20", "url": "https://wheresthe.ai/id/WTA-R-JP-0005-005/", "rule": { "record_id": "WTA-R-JP-0005", "id": "jp-gennai-standard-government-ai-agents-2026", "title": "Government AI Gennai governance, security and safety standard (Gennai Standard), 1st edition", "jurisdiction": "JP", "jurisdiction_name": "Japan", "url": "https://wheresthe.ai/rule/jp-gennai-standard-government-ai-agents-2026/" }, "penalty": "No penalty in the Standard.", "scope_note": "Read in the official Japanese text (Digital Agency, Gennai Standard 1st edition, October 2026). Duty of users. The text also bars combining several sources to build up records on individuals.", "date_note": null, "source_url": "https://www.digital.go.jp/assets/contents/node/basic_page/field_ref_resources/b033337d-dad1-4493-9316-d929597e4667/9bbaf559/20261020_policies_genai_guideline_02.pdf", "verified_on": "2026-10-25", "citation": "WTA-R-JP-0005-005: Section 2-2 (Information about people), Government AI Gennai governance, security and safety standard (Gennai Standard), 1st edition. wheresthe.ai, https://wheresthe.ai/id/WTA-R-JP-0005-005/ (checked 2026-10-25)." }, { "record_id": "WTA-R-JP-0005-006", "provision": "Section 2-2 (Information about people)", "applies_to": [ "Public bodies" ], "duty": "Put personal information into AI prompts only to the minimum needed for a set purpose, and delete or anonymise names, addresses and other identifiers the task does not need.", "type": "Data governance", "status": "applies now", "applies_from": "2026-10-20", "url": "https://wheresthe.ai/id/WTA-R-JP-0005-006/", "rule": { "record_id": "WTA-R-JP-0005", "id": "jp-gennai-standard-government-ai-agents-2026", "title": "Government AI Gennai governance, security and safety standard (Gennai Standard), 1st edition", "jurisdiction": "JP", "jurisdiction_name": "Japan", "url": "https://wheresthe.ai/rule/jp-gennai-standard-government-ai-agents-2026/" }, "penalty": "No penalty in the Standard.", "scope_note": "Read in the official Japanese text (Digital Agency, Gennai Standard 1st edition, October 2026). Duty of users. Information a ministry's own rules bar from input stays barred.", "date_note": null, "source_url": "https://www.digital.go.jp/assets/contents/node/basic_page/field_ref_resources/b033337d-dad1-4493-9316-d929597e4667/9bbaf559/20261020_policies_genai_guideline_02.pdf", "verified_on": "2026-10-25", "citation": "WTA-R-JP-0005-006: Section 2-2 (Information about people), Government AI Gennai governance, security and safety standard (Gennai Standard), 1st edition. wheresthe.ai, https://wheresthe.ai/id/WTA-R-JP-0005-006/ (checked 2026-10-25)." }, { "record_id": "WTA-R-JP-0005-007", "provision": "Section 2-3 (Agent Chat)", "applies_to": [ "Public bodies" ], "duty": "Before using Agent Chat on files, confirm the target files, the processing and its effects, and keep a backup as a rule when it edits, overwrites, moves or deletes files.", "type": "Human oversight", "status": "applies now", "applies_from": "2026-10-20", "url": "https://wheresthe.ai/id/WTA-R-JP-0005-007/", "rule": { "record_id": "WTA-R-JP-0005", "id": "jp-gennai-standard-government-ai-agents-2026", "title": "Government AI Gennai governance, security and safety standard (Gennai Standard), 1st edition", "jurisdiction": "JP", "jurisdiction_name": "Japan", "url": "https://wheresthe.ai/rule/jp-gennai-standard-government-ai-agents-2026/" }, "penalty": "No penalty in the Standard.", "scope_note": "Read in the official Japanese text (Digital Agency, Gennai Standard 1st edition, October 2026). Duty of users. Users must also check sources, figures, citations, laws and addressees in results, and get the needed approval before important decisions or external messages.", "date_note": null, "source_url": "https://www.digital.go.jp/assets/contents/node/basic_page/field_ref_resources/b033337d-dad1-4493-9316-d929597e4667/9bbaf559/20261020_policies_genai_guideline_02.pdf", "verified_on": "2026-10-25", "citation": "WTA-R-JP-0005-007: Section 2-3 (Agent Chat), Government AI Gennai governance, security and safety standard (Gennai Standard), 1st edition. wheresthe.ai, https://wheresthe.ai/id/WTA-R-JP-0005-007/ (checked 2026-10-25)." }, { "record_id": "WTA-R-JP-0005-008", "provision": "Section 2-4 (Gennai Kobo)", "applies_to": [ "Public bodies" ], "duty": "Check AI-generated code, commands, file operations and web apps before running or publishing them, and stop at once and report to the administrator on unexpected behaviour, leaks or vulnerabilities.", "type": "Security testing", "status": "applies now", "applies_from": "2026-10-20", "url": "https://wheresthe.ai/id/WTA-R-JP-0005-008/", "rule": { "record_id": "WTA-R-JP-0005", "id": "jp-gennai-standard-government-ai-agents-2026", "title": "Government AI Gennai governance, security and safety standard (Gennai Standard), 1st edition", "jurisdiction": "JP", "jurisdiction_name": "Japan", "url": "https://wheresthe.ai/rule/jp-gennai-standard-government-ai-agents-2026/" }, "penalty": "No penalty in the Standard.", "scope_note": "Read in the official Japanese text (Digital Agency, Gennai Standard 1st edition, October 2026). Duty of users of Gennai Kobo, the AI coding agent. Only staff whom the administrator has confirmed meet a set literacy level may use it.", "date_note": null, "source_url": "https://www.digital.go.jp/assets/contents/node/basic_page/field_ref_resources/b033337d-dad1-4493-9316-d929597e4667/9bbaf559/20261020_policies_genai_guideline_02.pdf", "verified_on": "2026-10-25", "citation": "WTA-R-JP-0005-008: Section 2-4 (Gennai Kobo), Government AI Gennai governance, security and safety standard (Gennai Standard), 1st edition. wheresthe.ai, https://wheresthe.ai/id/WTA-R-JP-0005-008/ (checked 2026-10-25)." }, { "record_id": "WTA-R-JP-0005-009", "provision": "Section 3-2", "applies_to": [ "Public bodies" ], "duty": "Set up internal governance for Gennai covering permitted work, functions and information, user rights, budget, user checks and approvals, and incident response, and review it regularly.", "type": "Government use of AI", "status": "applies now", "applies_from": "2026-10-20", "url": "https://wheresthe.ai/id/WTA-R-JP-0005-009/", "rule": { "record_id": "WTA-R-JP-0005", "id": "jp-gennai-standard-government-ai-agents-2026", "title": "Government AI Gennai governance, security and safety standard (Gennai Standard), 1st edition", "jurisdiction": "JP", "jurisdiction_name": "Japan", "url": "https://wheresthe.ai/rule/jp-gennai-standard-government-ai-agents-2026/" }, "penalty": "No penalty in the Standard.", "scope_note": "Read in the official Japanese text (Digital Agency, Gennai Standard 1st edition, October 2026). Duty of each ministry or agency that uses Gennai.", "date_note": null, "source_url": "https://www.digital.go.jp/assets/contents/node/basic_page/field_ref_resources/b033337d-dad1-4493-9316-d929597e4667/9bbaf559/20261020_policies_genai_guideline_02.pdf", "verified_on": "2026-10-25", "citation": "WTA-R-JP-0005-009: Section 3-2, Government AI Gennai governance, security and safety standard (Gennai Standard), 1st edition. wheresthe.ai, https://wheresthe.ai/id/WTA-R-JP-0005-009/ (checked 2026-10-25)." }, { "record_id": "WTA-R-JP-0005-010", "provision": "Section 3-2", "applies_to": [ "Public bodies" ], "duty": "Tell users the duties in Chapter 2 of the Standard and give them the education, training and advice needed to use Gennai in line with those duties.", "type": "AI literacy", "status": "applies now", "applies_from": "2026-10-20", "url": "https://wheresthe.ai/id/WTA-R-JP-0005-010/", "rule": { "record_id": "WTA-R-JP-0005", "id": "jp-gennai-standard-government-ai-agents-2026", "title": "Government AI Gennai governance, security and safety standard (Gennai Standard), 1st edition", "jurisdiction": "JP", "jurisdiction_name": "Japan", "url": "https://wheresthe.ai/rule/jp-gennai-standard-government-ai-agents-2026/" }, "penalty": "No penalty in the Standard.", "scope_note": "Read in the official Japanese text (Digital Agency, Gennai Standard 1st edition, October 2026). Duty of administrators: each ministry's chief AI officer (CAIO), portfolio management office, information system managers and similar.", "date_note": null, "source_url": "https://www.digital.go.jp/assets/contents/node/basic_page/field_ref_resources/b033337d-dad1-4493-9316-d929597e4667/9bbaf559/20261020_policies_genai_guideline_02.pdf", "verified_on": "2026-10-25", "citation": "WTA-R-JP-0005-010: Section 3-2, Government AI Gennai governance, security and safety standard (Gennai Standard), 1st edition. wheresthe.ai, https://wheresthe.ai/id/WTA-R-JP-0005-010/ (checked 2026-10-25)." }, { "record_id": "WTA-R-JP-0005-011", "provision": "Section 3-5", "applies_to": [ "Public bodies" ], "duty": "Limit staff use of Agent Chat in licensing, benefits, adverse dispositions, hiring and other work that affects people's rights, according to the work's importance, reach and how easily errors can be undone.", "type": "Government use of AI", "status": "applies now", "applies_from": "2026-10-20", "url": "https://wheresthe.ai/id/WTA-R-JP-0005-011/", "rule": { "record_id": "WTA-R-JP-0005", "id": "jp-gennai-standard-government-ai-agents-2026", "title": "Government AI Gennai governance, security and safety standard (Gennai Standard), 1st edition", "jurisdiction": "JP", "jurisdiction_name": "Japan", "url": "https://wheresthe.ai/rule/jp-gennai-standard-government-ai-agents-2026/" }, "penalty": "No penalty in the Standard.", "scope_note": "Read in the official Japanese text (Digital Agency, Gennai Standard 1st edition, October 2026). Duty of administrators. Section 3-6 applies the same limit to Gennai Kobo.", "date_note": null, "source_url": "https://www.digital.go.jp/assets/contents/node/basic_page/field_ref_resources/b033337d-dad1-4493-9316-d929597e4667/9bbaf559/20261020_policies_genai_guideline_02.pdf", "verified_on": "2026-10-25", "citation": "WTA-R-JP-0005-011: Section 3-5, Government AI Gennai governance, security and safety standard (Gennai Standard), 1st edition. wheresthe.ai, https://wheresthe.ai/id/WTA-R-JP-0005-011/ (checked 2026-10-25)." }, { "record_id": "WTA-R-JP-0005-012", "provision": "Section 3-6", "applies_to": [ "Public bodies" ], "duty": "On learning of an incident or anomaly in Gennai Kobo, suspend use quickly, check the impact, restore service, report to the departments concerned, analyse the cause and prevent a repeat.", "type": "Incident reporting", "status": "applies now", "applies_from": "2026-10-20", "url": "https://wheresthe.ai/id/WTA-R-JP-0005-012/", "rule": { "record_id": "WTA-R-JP-0005", "id": "jp-gennai-standard-government-ai-agents-2026", "title": "Government AI Gennai governance, security and safety standard (Gennai Standard), 1st edition", "jurisdiction": "JP", "jurisdiction_name": "Japan", "url": "https://wheresthe.ai/rule/jp-gennai-standard-government-ai-agents-2026/" }, "penalty": "No penalty in the Standard.", "scope_note": "Read in the official Japanese text (Digital Agency, Gennai Standard 1st edition, October 2026). Duty of administrators. Until the Digital Agency provides tenant administrator functions, the Digital Agency (Gennai developers) suspends use on the administrator's report.", "date_note": null, "source_url": "https://www.digital.go.jp/assets/contents/node/basic_page/field_ref_resources/b033337d-dad1-4493-9316-d929597e4667/9bbaf559/20261020_policies_genai_guideline_02.pdf", "verified_on": "2026-10-25", "citation": "WTA-R-JP-0005-012: Section 3-6, Government AI Gennai governance, security and safety standard (Gennai Standard), 1st edition. wheresthe.ai, https://wheresthe.ai/id/WTA-R-JP-0005-012/ (checked 2026-10-25)." }, { "record_id": "WTA-R-JP-0005-013", "provision": "Section 4-5(1)", "applies_to": [ "Developers", "Public bodies" ], "duty": "Fix known vulnerabilities in Gennai software within deadlines set by their severity, and do not release to production while a high-severity vulnerability remains.", "type": "Security testing", "status": "applies now", "applies_from": "2026-10-20", "url": "https://wheresthe.ai/id/WTA-R-JP-0005-013/", "rule": { "record_id": "WTA-R-JP-0005", "id": "jp-gennai-standard-government-ai-agents-2026", "title": "Government AI Gennai governance, security and safety standard (Gennai Standard), 1st edition", "jurisdiction": "JP", "jurisdiction_name": "Japan", "url": "https://wheresthe.ai/rule/jp-gennai-standard-government-ai-agents-2026/" }, "penalty": "No penalty in the Standard.", "scope_note": "Read in the official Japanese text (Digital Agency, Gennai Standard 1st edition, October 2026). Duty of Gennai developers: Digital Agency staff who plan, build, provide and run Gennai, and contractors doing that work for it.", "date_note": null, "source_url": "https://www.digital.go.jp/assets/contents/node/basic_page/field_ref_resources/b033337d-dad1-4493-9316-d929597e4667/9bbaf559/20261020_policies_genai_guideline_02.pdf", "verified_on": "2026-10-25", "citation": "WTA-R-JP-0005-013: Section 4-5(1), Government AI Gennai governance, security and safety standard (Gennai Standard), 1st edition. wheresthe.ai, https://wheresthe.ai/id/WTA-R-JP-0005-013/ (checked 2026-10-25)." }, { "record_id": "WTA-R-JP-0005-014", "provision": "Section 4-5(3) and (4)", "applies_to": [ "Developers", "Public bodies" ], "duty": "Record every change to the production environment so it can be traced who changed what and when, and store security logs so that no one, developers included, can alter or delete them.", "type": "Record-keeping", "status": "applies now", "applies_from": "2026-10-20", "url": "https://wheresthe.ai/id/WTA-R-JP-0005-014/", "rule": { "record_id": "WTA-R-JP-0005", "id": "jp-gennai-standard-government-ai-agents-2026", "title": "Government AI Gennai governance, security and safety standard (Gennai Standard), 1st edition", "jurisdiction": "JP", "jurisdiction_name": "Japan", "url": "https://wheresthe.ai/rule/jp-gennai-standard-government-ai-agents-2026/" }, "penalty": "No penalty in the Standard.", "scope_note": "Read in the official Japanese text (Digital Agency, Gennai Standard 1st edition, October 2026). Duty of Gennai developers. The text requires the immutability to be enforced by technical means, not only by operating rules.", "date_note": null, "source_url": "https://www.digital.go.jp/assets/contents/node/basic_page/field_ref_resources/b033337d-dad1-4493-9316-d929597e4667/9bbaf559/20261020_policies_genai_guideline_02.pdf", "verified_on": "2026-10-25", "citation": "WTA-R-JP-0005-014: Section 4-5(3) and (4), Government AI Gennai governance, security and safety standard (Gennai Standard), 1st edition. wheresthe.ai, https://wheresthe.ai/id/WTA-R-JP-0005-014/ (checked 2026-10-25)." }, { "record_id": "WTA-R-JP-0005-015", "provision": "Section 4-5(6)", "applies_to": [ "Developers", "Public bodies" ], "duty": "Keep credentials, API keys and encryption keys out of source code and repositories, run automatic leak detection, and revoke or rotate any secret found leaked.", "type": "Security testing", "status": "applies now", "applies_from": "2026-10-20", "url": "https://wheresthe.ai/id/WTA-R-JP-0005-015/", "rule": { "record_id": "WTA-R-JP-0005", "id": "jp-gennai-standard-government-ai-agents-2026", "title": "Government AI Gennai governance, security and safety standard (Gennai Standard), 1st edition", "jurisdiction": "JP", "jurisdiction_name": "Japan", "url": "https://wheresthe.ai/rule/jp-gennai-standard-government-ai-agents-2026/" }, "penalty": "No penalty in the Standard.", "scope_note": "Read in the official Japanese text (Digital Agency, Gennai Standard 1st edition, October 2026). Duty of Gennai developers.", "date_note": null, "source_url": "https://www.digital.go.jp/assets/contents/node/basic_page/field_ref_resources/b033337d-dad1-4493-9316-d929597e4667/9bbaf559/20261020_policies_genai_guideline_02.pdf", "verified_on": "2026-10-25", "citation": "WTA-R-JP-0005-015: Section 4-5(6), Government AI Gennai governance, security and safety standard (Gennai Standard), 1st edition. wheresthe.ai, https://wheresthe.ai/id/WTA-R-JP-0005-015/ (checked 2026-10-25)." }, { "record_id": "WTA-R-EU-0001-001", "provision": "Article 4", "applies_to": [ "Providers", "Deployers" ], "duty": "Take measures to support the AI literacy of staff and other people operating or using AI systems on your behalf, considering their knowledge, experience, training and the context of use.", "type": "AI literacy", "status": "applies now", "applies_from": "2025-02-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-001/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "No fixed fine tier: this provision is not listed in Art. 99(3) or (4), so Member States set the penalty under Art. 99(1).", "scope_note": "As replaced, the duty does not require providers or deployers to guarantee any specific level of AI literacy of any individual (Art. 4(1)).", "date_note": "Applied from 2 Feb 2025 (Art. 113(a)) with the original wording 'ensure, to their best extent, a sufficient level of AI literacy'. Digital Omnibus Art. 1(5) replaced Art. 4 with the softer 'take measures to support' wording, in force 27 Jul 2026.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_4", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-001: Article 4, Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-001/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-002", "provision": "Article 5(1)(a)", "applies_to": [ "Providers", "Deployers" ], "duty": "Do not place on the market, put into service or use AI that deploys subliminal, manipulative or deceptive techniques that materially distort behaviour and cause, or are reasonably likely to cause, significant harm.", "type": "Prohibited uses", "status": "applies now", "applies_from": "2025-02-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-002/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 35m or 7% of total worldwide annual turnover, whichever is higher (Art. 99(3)); for SMEs, whichever is lower (Art. 99(6)).", "scope_note": "Covers techniques with the objective or the effect of appreciably impairing a person's ability to make an informed decision.", "date_note": "Applies from 2 Feb 2025 (Art. 113(a): Chapters I and II). The Digital Omnibus on AI (Reg. (EU) 2026/1744) did not change this date.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_5", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-002: Article 5(1)(a), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-002/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-003", "provision": "Article 5(1)(b)", "applies_to": [ "Providers", "Deployers" ], "duty": "Do not place on the market, put into service or use AI that exploits vulnerabilities due to age, disability or social or economic situation to materially distort behaviour in a way that causes, or is likely to cause, significant harm.", "type": "Prohibited uses", "status": "applies now", "applies_from": "2025-02-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-003/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 35m or 7% of total worldwide annual turnover, whichever is higher (Art. 99(3)); for SMEs, whichever is lower (Art. 99(6)).", "scope_note": "Applies whether the distortion is the objective or the effect of the system.", "date_note": "Applies from 2 Feb 2025 (Art. 113(a): Chapters I and II). The Digital Omnibus on AI (Reg. (EU) 2026/1744) did not change this date.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_5", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-003: Article 5(1)(b), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-003/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-004", "provision": "Article 5(1)(c)", "applies_to": [ "Providers", "Deployers" ], "duty": "Do not place on the market, put into service or use AI for social scoring that leads to detrimental treatment in unrelated social contexts or treatment unjustified or disproportionate to the behaviour.", "type": "Prohibited uses", "status": "applies now", "applies_from": "2025-02-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-004/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 35m or 7% of total worldwide annual turnover, whichever is higher (Art. 99(3)); for SMEs, whichever is lower (Art. 99(6)).", "scope_note": "Covers evaluation or classification of people over time based on social behaviour or known, inferred or predicted personal or personality characteristics.", "date_note": "Applies from 2 Feb 2025 (Art. 113(a): Chapters I and II). The Digital Omnibus on AI (Reg. (EU) 2026/1744) did not change this date.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_5", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-004: Article 5(1)(c), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-004/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-005", "provision": "Article 5(1)(d)", "applies_to": [ "Providers", "Deployers" ], "duty": "Do not place on the market, put into service or use AI to assess or predict the risk of a person committing a crime based solely on profiling or on personality traits and characteristics.", "type": "Prohibited uses", "status": "applies now", "applies_from": "2025-02-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-005/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 35m or 7% of total worldwide annual turnover, whichever is higher (Art. 99(3)); for SMEs, whichever is lower (Art. 99(6)).", "scope_note": "Does not apply to AI that supports a human assessment of involvement in criminal activity already based on objective and verifiable facts directly linked to that activity.", "date_note": "Applies from 2 Feb 2025 (Art. 113(a): Chapters I and II). The Digital Omnibus on AI (Reg. (EU) 2026/1744) did not change this date.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_5", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-005: Article 5(1)(d), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-005/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-006", "provision": "Article 5(1)(e)", "applies_to": [ "Providers", "Deployers" ], "duty": "Do not place on the market, put into service or use AI that creates or expands facial recognition databases through untargeted scraping of facial images from the internet or CCTV footage.", "type": "Prohibited uses", "status": "applies now", "applies_from": "2025-02-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-006/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 35m or 7% of total worldwide annual turnover, whichever is higher (Art. 99(3)); for SMEs, whichever is lower (Art. 99(6)).", "scope_note": null, "date_note": "Applies from 2 Feb 2025 (Art. 113(a): Chapters I and II). The Digital Omnibus on AI (Reg. (EU) 2026/1744) did not change this date.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_5", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-006: Article 5(1)(e), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-006/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-007", "provision": "Article 5(1)(f)", "applies_to": [ "Providers", "Deployers" ], "duty": "Do not place on the market, put into service or use AI to infer the emotions of people in workplaces or education institutions, except for medical or safety reasons.", "type": "Prohibited uses", "status": "applies now", "applies_from": "2025-02-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-007/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 35m or 7% of total worldwide annual turnover, whichever is higher (Art. 99(3)); for SMEs, whichever is lower (Art. 99(6)).", "scope_note": "Exception only where the system is intended to be put in place or on the market for medical or safety reasons.", "date_note": "Applies from 2 Feb 2025 (Art. 113(a): Chapters I and II). The Digital Omnibus on AI (Reg. (EU) 2026/1744) did not change this date.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_5", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-007: Article 5(1)(f), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-007/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-008", "provision": "Article 5(1)(g)", "applies_to": [ "Providers", "Deployers" ], "duty": "Do not place on the market, put into service or use biometric categorisation systems that infer a person's race, political opinions, union membership, religious or philosophical beliefs, sex life or sexual orientation.", "type": "Prohibited uses", "status": "applies now", "applies_from": "2025-02-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-008/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 35m or 7% of total worldwide annual turnover, whichever is higher (Art. 99(3)); for SMEs, whichever is lower (Art. 99(6)).", "scope_note": "Does not cover labelling or filtering of lawfully acquired biometric datasets, or categorising biometric data in the area of law enforcement.", "date_note": "Applies from 2 Feb 2025 (Art. 113(a): Chapters I and II). The Digital Omnibus on AI (Reg. (EU) 2026/1744) did not change this date.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_5", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-008: Article 5(1)(g), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-008/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-009", "provision": "Article 5(1)(h)", "applies_to": [ "Deployers", "Public bodies" ], "duty": "Do not use real-time remote biometric identification in publicly accessible spaces for law enforcement, except where strictly necessary for a listed objective and with prior judicial or independent authorisation.", "type": "Prohibited uses", "status": "applies now", "applies_from": "2025-02-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-009/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 35m or 7% of total worldwide annual turnover, whichever is higher (Art. 99(3)); for SMEs, whichever is lower (Art. 99(6)).", "scope_note": "Listed objectives: searching for victims or missing persons, preventing specific imminent threats or terrorist attacks, and locating suspects of serious crimes in Annex II. Use also needs national law (Art. 5(5)), a fundamental rights impact assessment and EU database registration (Art. 5(2)); urgent use may start without authorisation if requested within 24 hours (Art. 5(3)).", "date_note": "Applies from 2 Feb 2025 (Art. 113(a): Chapters I and II). The Digital Omnibus on AI (Reg. (EU) 2026/1744) did not change this date.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_5", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-009: Article 5(1)(h), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-009/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0009-001", "provision": "Article 5(1)(ba)", "applies_to": [ "Providers", "Deployers" ], "duty": "Do not place on the market, put into service or use AI that generates or manipulates realistic intimate or sexually explicit images, video or audio of an identifiable person without their explicit consent.", "type": "Prohibited uses", "status": "applies later", "applies_from": "2026-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0009-001/", "rule": { "record_id": "WTA-R-EU-0009", "id": "eu-digital-omnibus-ai-2026-1744", "title": "Regulation (EU) 2026/1744 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-digital-omnibus-ai-2026-1744/" }, "penalty": "Up to EUR 35m or 7% of total worldwide annual turnover, whichever is higher (Art. 99(3)); for SMEs, whichever is lower (Art. 99(6)).", "scope_note": "Art. 5(1a): providers are caught only where such generation is the intended purpose, or is a reasonably foreseeable and reproducible outcome without adequate safeguards; deployers only where they use the system for that purpose. Art. 5(1b): edits that do not increase exposure of intimate parts or alter depicted sexual activity are not manipulation.", "date_note": "New prohibition inserted by Digital Omnibus Art. 1(7)(a). Applies from 2 Dec 2026 under Art. 113, third paragraph, point (a) as replaced by Omnibus Art. 1(40)(a). Omnibus Reg. (EU) 2026/1744 entered into force 27 Jul 2026.", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202601744#art_1", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0009-001: Article 5(1)(ba), Regulation (EU) 2026/1744 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0009-001/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0009-002", "provision": "Article 5(1)(bb)", "applies_to": [ "Providers", "Deployers" ], "duty": "Do not place on the market, put into service or use AI that generates or manipulates child sexual abuse material within the meaning of Directive 2011/93/EU.", "type": "Prohibited uses", "status": "applies later", "applies_from": "2026-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0009-002/", "rule": { "record_id": "WTA-R-EU-0009", "id": "eu-digital-omnibus-ai-2026-1744", "title": "Regulation (EU) 2026/1744 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-digital-omnibus-ai-2026-1744/" }, "penalty": "Up to EUR 35m or 7% of total worldwide annual turnover, whichever is higher (Art. 99(3)); for SMEs, whichever is lower (Art. 99(6)).", "scope_note": "Except where a 'without right' defence applies under national law. Art. 5(1a) limits provider and deployer liability as for point (ba): intended purpose, or foreseeable outcome without adequate safeguards, or deployer use for that purpose.", "date_note": "New prohibition inserted by Digital Omnibus Art. 1(7)(a). Applies from 2 Dec 2026 under Art. 113, third paragraph, point (a) as replaced by Omnibus Art. 1(40)(a). Omnibus Reg. (EU) 2026/1744 entered into force 27 Jul 2026.", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202601744#art_1", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0009-002: Article 5(1)(bb), Regulation (EU) 2026/1744 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0009-002/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-010", "provision": "Article 6(4)", "applies_to": [ "Providers" ], "duty": "Document your assessment before placing on the market an Annex III system you consider not high-risk, and give that documentation to national competent authorities on request.", "type": "Risk classification", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-010/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "No fixed fine tier: this provision is not listed in Art. 99(3) or (4), so Member States set the penalty under Art. 99(1).", "scope_note": "Applies where a provider relies on the Art. 6(3) derogation. An Annex III system that profiles natural persons is always high-risk (Art. 6(3), third subparagraph).", "date_note": "Originally 2 Aug 2026 (Annex III) and 2 Aug 2027 (Annex I) under Art. 113. Digital Omnibus Art. 1(40)(b) moved Chapter III Sections 1 to 3 to 2 Dec 2027 for Annex III systems and 2 Aug 2028 for Annex I systems. Amended Art. 111(2): systems already placed on the market before then are covered only if significantly changed in design; public-authority systems must comply by 2 Aug 2030.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_6", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-010: Article 6(4), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-010/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-011", "provision": "Article 49(2)", "applies_to": [ "Providers" ], "duty": "Register yourself and the system in the EU database before placing on the market an Annex III system you have concluded is not high-risk under Article 6(3).", "type": "Registration or filing", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-011/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "No fixed fine tier: this provision is not listed in Art. 99(3) or (4), so Member States set the penalty under Art. 99(1).", "scope_note": "Ambiguous start: the article's own Art. 113 date is 2 Aug 2026, but no system is classified high-risk until Chapter III Section 1 applies (2 Dec 2027 for Annex III, 2 Aug 2028 for Annex I). applies_from uses the Annex III date. Digital Omnibus Art. 1(42) deleted points 7 and 9 of Annex VIII Section B, so less information must be registered. Art. 49 itself was not amended. The authorised representative may register instead.", "date_note": "This article is outside Chapter III Sections 1 to 3, so Art. 113 still gives it the general date of 2 Aug 2026; the Omnibus did not move it. It bites only on high-risk systems, and the classification and requirements in Chapter III Sections 1 to 3 apply from 2 Dec 2027 (Annex III) and 2 Aug 2028 (Annex I) after Digital Omnibus Art. 1(40)(b) (originally 2 Aug 2026 and 2 Aug 2027).", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_49", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-011: Article 49(2), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-011/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-012", "provision": "Article 9(1) and (2)", "applies_to": [ "Providers" ], "duty": "Establish, implement, document and maintain a risk management system that runs through the high-risk system's lifecycle to identify, evaluate and mitigate risks to health, safety and fundamental rights.", "type": "Impact assessment", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-012/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher, as a provider obligation under Art. 16 (Art. 99(4)(a)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": "Includes testing against prior defined metrics before placing on the market (Art. 9(6) and (8)) and considering adverse impact on people under 18 and other vulnerable groups (Art. 9(9)). Annex I systems: 2 Aug 2028.", "date_note": "Originally 2 Aug 2026 (Annex III) and 2 Aug 2027 (Annex I) under Art. 113. Digital Omnibus Art. 1(40)(b) moved Chapter III Sections 1 to 3 to 2 Dec 2027 for Annex III systems and 2 Aug 2028 for Annex I systems. Amended Art. 111(2): systems already placed on the market before then are covered only if significantly changed in design; public-authority systems must comply by 2 Aug 2030.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_9", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-012: Article 9(1) and (2), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-012/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-013", "provision": "Article 10(2) and (3)", "applies_to": [ "Providers" ], "duty": "Use training, validation and testing data sets that follow documented data governance practices and are relevant, sufficiently representative and, as far as possible, free of errors and complete.", "type": "Data governance", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-013/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher, as a provider obligation under Art. 16 (Art. 99(4)(a)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": "Applies to high-risk systems trained with data; systems not trained on data apply the rules to testing data sets only (Art. 10(6) as replaced by Omnibus Art. 1(9)(c)). Annex I systems: 2 Aug 2028.", "date_note": "Originally 2 Aug 2026 (Annex III) and 2 Aug 2027 (Annex I) under Art. 113. Digital Omnibus Art. 1(40)(b) moved Chapter III Sections 1 to 3 to 2 Dec 2027 for Annex III systems and 2 Aug 2028 for Annex I systems. Amended Art. 111(2): systems already placed on the market before then are covered only if significantly changed in design; public-authority systems must comply by 2 Aug 2030.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_10", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-013: Article 10(2) and (3), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-013/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-014", "provision": "Article 10(2)(f) and (g)", "applies_to": [ "Providers" ], "duty": "Examine data sets for biases likely to harm health, safety or fundamental rights or cause unlawful discrimination, and take measures to detect, prevent and mitigate them.", "type": "Bias and non-discrimination", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-014/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher, as a provider obligation under Art. 16 (Art. 99(4)(a)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": "Digital Omnibus Art. 1(9)(b) deleted Art. 10(5); processing of special categories of personal data for bias detection is now governed by new Art. 4a, with the same conditions. Annex I systems: 2 Aug 2028.", "date_note": "Originally 2 Aug 2026 (Annex III) and 2 Aug 2027 (Annex I) under Art. 113. Digital Omnibus Art. 1(40)(b) moved Chapter III Sections 1 to 3 to 2 Dec 2027 for Annex III systems and 2 Aug 2028 for Annex I systems. Amended Art. 111(2): systems already placed on the market before then are covered only if significantly changed in design; public-authority systems must comply by 2 Aug 2030.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_10", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-014: Article 10(2)(f) and (g), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-014/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-015", "provision": "Article 11(1)", "applies_to": [ "Providers" ], "duty": "Draw up technical documentation containing at least the Annex IV elements before placing a high-risk system on the market or putting it into service, and keep it up to date.", "type": "Record-keeping", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-015/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher, as a provider obligation under Art. 16 (Art. 99(4)(a)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": "Digital Omnibus Art. 1(10) lets SMEs, including start-ups, and small mid-caps use a simplified Commission form. Annex I products need a single set of documentation (Art. 11(2)).", "date_note": "Originally 2 Aug 2026 (Annex III) and 2 Aug 2027 (Annex I) under Art. 113. Digital Omnibus Art. 1(40)(b) moved Chapter III Sections 1 to 3 to 2 Dec 2027 for Annex III systems and 2 Aug 2028 for Annex I systems. Amended Art. 111(2): systems already placed on the market before then are covered only if significantly changed in design; public-authority systems must comply by 2 Aug 2030.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_11", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-015: Article 11(1), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-015/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-016", "provision": "Article 12(1)", "applies_to": [ "Providers" ], "duty": "Build high-risk systems so they technically allow automatic recording of events (logs) over their lifetime, enabling traceability for risk identification, post-market monitoring and deployer monitoring.", "type": "Record-keeping", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-016/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher, as a provider obligation under Art. 16 (Art. 99(4)(a)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": "Remote biometric identification systems (Annex III point 1(a)) need minimum log content set out in Art. 12(3). Annex I systems: 2 Aug 2028.", "date_note": "Originally 2 Aug 2026 (Annex III) and 2 Aug 2027 (Annex I) under Art. 113. Digital Omnibus Art. 1(40)(b) moved Chapter III Sections 1 to 3 to 2 Dec 2027 for Annex III systems and 2 Aug 2028 for Annex I systems. Amended Art. 111(2): systems already placed on the market before then are covered only if significantly changed in design; public-authority systems must comply by 2 Aug 2030.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_12", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-016: Article 12(1), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-016/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-017", "provision": "Article 13(1) and (2)", "applies_to": [ "Providers" ], "duty": "Design high-risk systems so deployers can interpret and properly use outputs, and supply instructions for use with concise, complete, correct and clear information, including the items in Article 13(3).", "type": "Transparency to users", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-017/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher, as a provider obligation under Art. 16 (Art. 99(4)(a)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": "Instructions must cover provider identity, intended purpose, accuracy and limitations, foreseeable risks, human oversight measures, resources and lifetime, and log handling (Art. 13(3)). Annex I systems: 2 Aug 2028.", "date_note": "Originally 2 Aug 2026 (Annex III) and 2 Aug 2027 (Annex I) under Art. 113. Digital Omnibus Art. 1(40)(b) moved Chapter III Sections 1 to 3 to 2 Dec 2027 for Annex III systems and 2 Aug 2028 for Annex I systems. Amended Art. 111(2): systems already placed on the market before then are covered only if significantly changed in design; public-authority systems must comply by 2 Aug 2030.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_13", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-017: Article 13(1) and (2), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-017/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-018", "provision": "Article 14(1)", "applies_to": [ "Providers" ], "duty": "Design high-risk systems, including with suitable human-machine interface tools, so natural persons can effectively oversee them while in use.", "type": "Human oversight", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-018/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher, as a provider obligation under Art. 16 (Art. 99(4)(a)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": "Oversight measures must let overseers understand limits, watch for automation bias, interpret output, disregard or reverse it, and halt the system (Art. 14(4)). Remote biometric identification needs separate verification by two people (Art. 14(5)).", "date_note": "Originally 2 Aug 2026 (Annex III) and 2 Aug 2027 (Annex I) under Art. 113. Digital Omnibus Art. 1(40)(b) moved Chapter III Sections 1 to 3 to 2 Dec 2027 for Annex III systems and 2 Aug 2028 for Annex I systems. Amended Art. 111(2): systems already placed on the market before then are covered only if significantly changed in design; public-authority systems must comply by 2 Aug 2030.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_14", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-018: Article 14(1), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-018/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-019", "provision": "Article 15(1) and (5)", "applies_to": [ "Providers" ], "duty": "Design high-risk systems to achieve appropriate accuracy, robustness and cybersecurity throughout their lifecycle, including resilience against data poisoning, model poisoning, adversarial examples and confidentiality attacks.", "type": "Security testing", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-019/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher, as a provider obligation under Art. 16 (Art. 99(4)(a)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": "Accuracy levels and metrics must be declared in the instructions for use (Art. 15(3)). Under Art. 42(3), added by Omnibus Art. 1(18), systems meeting Cyber Resilience Act conditions are deemed to meet the cybersecurity requirements.", "date_note": "Originally 2 Aug 2026 (Annex III) and 2 Aug 2027 (Annex I) under Art. 113. Digital Omnibus Art. 1(40)(b) moved Chapter III Sections 1 to 3 to 2 Dec 2027 for Annex III systems and 2 Aug 2028 for Annex I systems. Amended Art. 111(2): systems already placed on the market before then are covered only if significantly changed in design; public-authority systems must comply by 2 Aug 2030.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_15", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-019: Article 15(1) and (5), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-019/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-020", "provision": "Article 17(1)", "applies_to": [ "Providers" ], "duty": "Put in place a documented quality management system covering compliance strategy, design, testing, data management, risk management, post-market monitoring, incident reporting and accountability.", "type": "Conformity assessment", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-020/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher, as a provider obligation under Art. 16 (Art. 99(4)(a)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": "Implementation must be proportionate to the provider's size, especially for SMEs and small mid-caps (Art. 17(2) as replaced by Omnibus Art. 1(11)). Financial institutions largely meet it through financial services governance rules (Art. 17(4)).", "date_note": "Originally 2 Aug 2026 (Annex III) and 2 Aug 2027 (Annex I) under Art. 113. Digital Omnibus Art. 1(40)(b) moved Chapter III Sections 1 to 3 to 2 Dec 2027 for Annex III systems and 2 Aug 2028 for Annex I systems. Amended Art. 111(2): systems already placed on the market before then are covered only if significantly changed in design; public-authority systems must comply by 2 Aug 2030.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_17", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-020: Article 17(1), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-020/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-021", "provision": "Article 18(1)", "applies_to": [ "Providers" ], "duty": "Keep technical documentation, quality management documentation, notified body decisions and the EU declaration of conformity available to national authorities for 10 years after the system is placed on the market.", "type": "Record-keeping", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-021/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher, as a provider obligation under Art. 16 (Art. 99(4)(a)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": "Financial institutions keep technical documentation within their financial services records (Art. 18(3)).", "date_note": "Originally 2 Aug 2026 (Annex III) and 2 Aug 2027 (Annex I) under Art. 113. Digital Omnibus Art. 1(40)(b) moved Chapter III Sections 1 to 3 to 2 Dec 2027 for Annex III systems and 2 Aug 2028 for Annex I systems. Amended Art. 111(2): systems already placed on the market before then are covered only if significantly changed in design; public-authority systems must comply by 2 Aug 2030.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_18", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-021: Article 18(1), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-021/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-022", "provision": "Article 19(1)", "applies_to": [ "Providers" ], "duty": "Keep the logs automatically generated by your high-risk systems, to the extent under your control, for a period suited to the intended purpose and at least six months.", "type": "Record-keeping", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-022/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher, as a provider obligation under Art. 16 (Art. 99(4)(a)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": "Unless other Union or national law, in particular data protection law, provides otherwise.", "date_note": "Originally 2 Aug 2026 (Annex III) and 2 Aug 2027 (Annex I) under Art. 113. Digital Omnibus Art. 1(40)(b) moved Chapter III Sections 1 to 3 to 2 Dec 2027 for Annex III systems and 2 Aug 2028 for Annex I systems. Amended Art. 111(2): systems already placed on the market before then are covered only if significantly changed in design; public-authority systems must comply by 2 Aug 2030.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_19", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-022: Article 19(1), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-022/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-023", "provision": "Article 20(1) and (2)", "applies_to": [ "Providers" ], "duty": "Immediately correct, withdraw, disable or recall a non-conforming high-risk system, inform distributors and deployers, and inform market surveillance authorities when it presents a risk.", "type": "Incident reporting", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-023/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher, as a provider obligation under Art. 16 (Art. 99(4)(a)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": "Where the system presents a risk under Art. 79(1), the provider must also investigate the causes with the reporting deployer and inform any notified body that certified it (Art. 20(2)).", "date_note": "Originally 2 Aug 2026 (Annex III) and 2 Aug 2027 (Annex I) under Art. 113. Digital Omnibus Art. 1(40)(b) moved Chapter III Sections 1 to 3 to 2 Dec 2027 for Annex III systems and 2 Aug 2028 for Annex I systems. Amended Art. 111(2): systems already placed on the market before then are covered only if significantly changed in design; public-authority systems must comply by 2 Aug 2030.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_20", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-023: Article 20(1) and (2), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-023/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-024", "provision": "Article 43(1)", "applies_to": [ "Providers" ], "duty": "For biometric systems in Annex III point 1, use internal control or notified-body assessment if harmonised standards were applied in full; otherwise follow the notified-body procedure in Annex VII.", "type": "Conformity assessment", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-024/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher, as a provider obligation under Art. 16 (Art. 99(4)(a)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": "Ambiguous start: the article's own Art. 113 date is 2 Aug 2026, but no system is classified high-risk until Chapter III Section 1 applies (2 Dec 2027 for Annex III, 2 Aug 2028 for Annex I). applies_from uses the Annex III date. Notified-body route is also required where common specifications exist but were not applied, or standards were restricted. Market surveillance authorities act as notified body for law enforcement and migration uses.", "date_note": "This article is outside Chapter III Sections 1 to 3, so Art. 113 still gives it the general date of 2 Aug 2026; the Omnibus did not move it. It bites only on high-risk systems, and the classification and requirements in Chapter III Sections 1 to 3 apply from 2 Dec 2027 (Annex III) and 2 Aug 2028 (Annex I) after Digital Omnibus Art. 1(40)(b) (originally 2 Aug 2026 and 2 Aug 2027).", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_43", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-024: Article 43(1), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-024/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-025", "provision": "Article 43(2)", "applies_to": [ "Providers" ], "duty": "Carry out the internal-control conformity assessment in Annex VI, without a notified body, for high-risk systems in Annex III points 2 to 8.", "type": "Conformity assessment", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-025/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher, as a provider obligation under Art. 16 (Art. 99(4)(a)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": "Ambiguous start: the article's own Art. 113 date is 2 Aug 2026, but no system is classified high-risk until Chapter III Section 1 applies (2 Dec 2027 for Annex III, 2 Aug 2028 for Annex I). applies_from uses the Annex III date. Must be completed before the system is placed on the market or put into service (Art. 16(f)).", "date_note": "This article is outside Chapter III Sections 1 to 3, so Art. 113 still gives it the general date of 2 Aug 2026; the Omnibus did not move it. It bites only on high-risk systems, and the classification and requirements in Chapter III Sections 1 to 3 apply from 2 Dec 2027 (Annex III) and 2 Aug 2028 (Annex I) after Digital Omnibus Art. 1(40)(b) (originally 2 Aug 2026 and 2 Aug 2027).", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_43", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-025: Article 43(2), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-025/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-026", "provision": "Article 43(3)", "applies_to": [ "Providers" ], "duty": "For high-risk systems under Annex I Section A product laws, follow that law's conformity assessment procedure, including the AI Act Section 2 requirements and assessment of the quality management system.", "type": "Conformity assessment", "status": "applies later", "applies_from": "2028-08-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-026/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher, as a provider obligation under Art. 16 (Art. 99(4)(a)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": "Ambiguous start: the article's own Art. 113 date is 2 Aug 2026, but Annex I systems are classified high-risk under Art. 6(1) only from 2 Aug 2028. A product does not need third-party assessment merely because it contains a high-risk AI safety component.", "date_note": "This article is outside Chapter III Sections 1 to 3, so Art. 113 still gives it the general date of 2 Aug 2026; the Omnibus did not move it. It bites only on high-risk systems, and Annex I systems are classified and regulated under Chapter III Sections 1 to 3 from 2 Aug 2028 after Digital Omnibus Art. 1(40)(b) (originally 2 Aug 2027). Art. 43(3) was replaced by Digital Omnibus Art. 1(19), which added the quality management system assessment.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_43", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-026: Article 43(3), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-026/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-027", "provision": "Article 43(4)", "applies_to": [ "Providers" ], "duty": "Carry out a new conformity assessment whenever a high-risk system is substantially modified, unless the change was pre-determined at the initial assessment and recorded in the technical documentation.", "type": "Conformity assessment", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-027/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher, as a provider obligation under Art. 16 (Art. 99(4)(a)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": "Ambiguous start: the article's own Art. 113 date is 2 Aug 2026, but no system is classified high-risk until Chapter III Section 1 applies (2 Dec 2027 for Annex III, 2 Aug 2028 for Annex I). applies_from uses the Annex III date. Applies whether the modified system is further distributed or kept in use by the current deployer. A party making a substantial modification becomes the provider (Art. 25(1)(b)).", "date_note": "This article is outside Chapter III Sections 1 to 3, so Art. 113 still gives it the general date of 2 Aug 2026; the Omnibus did not move it. It bites only on high-risk systems, and the classification and requirements in Chapter III Sections 1 to 3 apply from 2 Dec 2027 (Annex III) and 2 Aug 2028 (Annex I) after Digital Omnibus Art. 1(40)(b) (originally 2 Aug 2026 and 2 Aug 2027).", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_43", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-027: Article 43(4), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-027/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-028", "provision": "Article 47(1) and (2)", "applies_to": [ "Providers" ], "duty": "Draw up a signed EU declaration of conformity for each high-risk system containing the Annex V information, keep it up to date, and keep it available to national authorities for 10 years.", "type": "Conformity assessment", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-028/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher, as a provider obligation under Art. 16 (Art. 99(4)(a)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": "Ambiguous start: the article's own Art. 113 date is 2 Aug 2026, but no system is classified high-risk until Chapter III Section 1 applies (2 Dec 2027 for Annex III, 2 Aug 2028 for Annex I). applies_from uses the Annex III date. A single declaration covers all Union harmonisation law that requires one (Art. 47(3)).", "date_note": "This article is outside Chapter III Sections 1 to 3, so Art. 113 still gives it the general date of 2 Aug 2026; the Omnibus did not move it. It bites only on high-risk systems, and the classification and requirements in Chapter III Sections 1 to 3 apply from 2 Dec 2027 (Annex III) and 2 Aug 2028 (Annex I) after Digital Omnibus Art. 1(40)(b) (originally 2 Aug 2026 and 2 Aug 2027).", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_47", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-028: Article 47(1) and (2), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-028/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-029", "provision": "Article 48(2) and (3)", "applies_to": [ "Providers" ], "duty": "Affix the CE marking visibly, legibly and indelibly to the high-risk system, or to its packaging or documentation, using a digital CE marking for systems provided digitally.", "type": "Conformity assessment", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-029/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher, as a provider obligation under Art. 16 (Art. 99(4)(a)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": "Ambiguous start: the article's own Art. 113 date is 2 Aug 2026, but no system is classified high-risk until Chapter III Section 1 applies (2 Dec 2027 for Annex III, 2 Aug 2028 for Annex I). applies_from uses the Annex III date. Where a notified body was involved, its identification number follows the CE marking (Art. 48(4)).", "date_note": "This article is outside Chapter III Sections 1 to 3, so Art. 113 still gives it the general date of 2 Aug 2026; the Omnibus did not move it. It bites only on high-risk systems, and the classification and requirements in Chapter III Sections 1 to 3 apply from 2 Dec 2027 (Annex III) and 2 Aug 2028 (Annex I) after Digital Omnibus Art. 1(40)(b) (originally 2 Aug 2026 and 2 Aug 2027).", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_48", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-029: Article 48(2) and (3), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-029/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-030", "provision": "Article 49(1)", "applies_to": [ "Providers" ], "duty": "Register yourself and the system in the EU database before placing an Annex III high-risk system on the market or putting it into service.", "type": "Registration or filing", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-030/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher, as a provider obligation under Art. 16 (Art. 99(4)(a)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": "Ambiguous start: the article's own Art. 113 date is 2 Aug 2026, but no system is classified high-risk until Chapter III Section 1 applies (2 Dec 2027 for Annex III, 2 Aug 2028 for Annex I). applies_from uses the Annex III date. Excludes Annex III point 2 (critical infrastructure) systems, which are registered at national level (Art. 49(5)). Law enforcement, migration and border systems go in a non-public section (Art. 49(4)). The authorised representative may register.", "date_note": "This article is outside Chapter III Sections 1 to 3, so Art. 113 still gives it the general date of 2 Aug 2026; the Omnibus did not move it. It bites only on high-risk systems, and the classification and requirements in Chapter III Sections 1 to 3 apply from 2 Dec 2027 (Annex III) and 2 Aug 2028 (Annex I) after Digital Omnibus Art. 1(40)(b) (originally 2 Aug 2026 and 2 Aug 2027).", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_49", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-030: Article 49(1), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-030/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-031", "provision": "Article 49(3)", "applies_to": [ "Deployers", "Public bodies" ], "duty": "Register yourself, select the system and register its use in the EU database before using an Annex III high-risk system, if you are a public authority or act on its behalf.", "type": "Registration or filing", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-031/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher (Art. 99(4)(e)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": "Ambiguous start: the article's own Art. 113 date is 2 Aug 2026, but no system is classified high-risk until Chapter III Section 1 applies (2 Dec 2027 for Annex III, 2 Aug 2028 for Annex I). applies_from uses the Annex III date. Excludes Annex III point 2 systems. Under Art. 26(8), such deployers must not use an unregistered system and must inform the provider or distributor.", "date_note": "This article is outside Chapter III Sections 1 to 3, so Art. 113 still gives it the general date of 2 Aug 2026; the Omnibus did not move it. It bites only on high-risk systems, and the classification and requirements in Chapter III Sections 1 to 3 apply from 2 Dec 2027 (Annex III) and 2 Aug 2028 (Annex I) after Digital Omnibus Art. 1(40)(b) (originally 2 Aug 2026 and 2 Aug 2027).", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_49", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-031: Article 49(3), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-031/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-032", "provision": "Article 72(1) to (3)", "applies_to": [ "Providers" ], "duty": "Establish and document a post-market monitoring system, based on a plan in the technical documentation, that actively collects and analyses performance data throughout the high-risk system's lifetime.", "type": "Record-keeping", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-032/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "No fixed fine tier: this provision is not listed in Art. 99(3) or (4), so Member States set the penalty under Art. 99(1).", "scope_note": "Ambiguous start: the article's own Art. 113 date is 2 Aug 2026, but no system is classified high-risk until Chapter III Section 1 applies (2 Dec 2027 for Annex III, 2 Aug 2028 for Annex I). applies_from uses the Annex III date. Annex I and financial-sector providers may integrate it into existing systems (Art. 72(4)).", "date_note": "This article is outside Chapter III Sections 1 to 3, so Art. 113 still gives it the general date of 2 Aug 2026; the Omnibus did not move it. It bites only on high-risk systems, and the classification and requirements in Chapter III Sections 1 to 3 apply from 2 Dec 2027 (Annex III) and 2 Aug 2028 (Annex I) after Digital Omnibus Art. 1(40)(b) (originally 2 Aug 2026 and 2 Aug 2027). Digital Omnibus Art. 1(30) replaced Art. 72(3): Commission guidance and a template for the plan are due by 2 Sep 2027 (originally an implementing act by 2 Feb 2026).", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_72", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-032: Article 72(1) to (3), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-032/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-033", "provision": "Article 73(1) and (2)", "applies_to": [ "Providers" ], "duty": "Report any serious incident to the market surveillance authority where it occurred, immediately after establishing a causal link or its reasonable likelihood, and no later than 15 days after becoming aware.", "type": "Incident reporting", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-033/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "No fixed fine tier: this provision is not listed in Art. 99(3) or (4), so Member States set the penalty under Art. 99(1).", "scope_note": "Ambiguous start: the article's own Art. 113 date is 2 Aug 2026, but no system is classified high-risk until Chapter III Section 1 applies (2 Dec 2027 for Annex III, 2 Aug 2028 for Annex I). applies_from uses the Annex III date. Providers must then investigate without altering the system before informing authorities (Art. 73(6)). Systems under exclusive AI Office competence report to the AI Office (Art. 75(1a), added by Omnibus Art. 1(31)(c)).", "date_note": "This article is outside Chapter III Sections 1 to 3, so Art. 113 still gives it the general date of 2 Aug 2026; the Omnibus did not move it. It bites only on high-risk systems, and the classification and requirements in Chapter III Sections 1 to 3 apply from 2 Dec 2027 (Annex III) and 2 Aug 2028 (Annex I) after Digital Omnibus Art. 1(40)(b) (originally 2 Aug 2026 and 2 Aug 2027).", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_73", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-033: Article 73(1) and (2), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-033/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-034", "provision": "Article 73(3) and (4)", "applies_to": [ "Providers" ], "duty": "Report within two days a widespread infringement or serious incident disrupting critical infrastructure, and within 10 days a serious incident involving a person's death, after becoming aware.", "type": "Incident reporting", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-034/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "No fixed fine tier: this provision is not listed in Art. 99(3) or (4), so Member States set the penalty under Art. 99(1).", "scope_note": "Ambiguous start: the article's own Art. 113 date is 2 Aug 2026, but no system is classified high-risk until Chapter III Section 1 applies (2 Dec 2027 for Annex III, 2 Aug 2028 for Annex I). applies_from uses the Annex III date. An incomplete initial report may be filed first (Art. 73(5)). Reporting is narrower for sectors with equivalent rules and for medical devices (Art. 73(9) and (10)).", "date_note": "This article is outside Chapter III Sections 1 to 3, so Art. 113 still gives it the general date of 2 Aug 2026; the Omnibus did not move it. It bites only on high-risk systems, and the classification and requirements in Chapter III Sections 1 to 3 apply from 2 Dec 2027 (Annex III) and 2 Aug 2028 (Annex I) after Digital Omnibus Art. 1(40)(b) (originally 2 Aug 2026 and 2 Aug 2027).", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_73", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-034: Article 73(3) and (4), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-034/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-035", "provision": "Article 23(1)", "applies_to": [ "Importers" ], "duty": "Verify before placing a high-risk system on the market that the provider completed conformity assessment, drew up technical documentation, affixed CE marking, supplied declaration and instructions, and appointed an authorised representative.", "type": "Conformity assessment", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-035/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher (Art. 99(4)(c)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": null, "date_note": "Originally 2 Aug 2026 (Annex III) and 2 Aug 2027 (Annex I) under Art. 113. Digital Omnibus Art. 1(40)(b) moved Chapter III Sections 1 to 3 to 2 Dec 2027 for Annex III systems and 2 Aug 2028 for Annex I systems. Amended Art. 111(2): systems already placed on the market before then are covered only if significantly changed in design; public-authority systems must comply by 2 Aug 2030.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_23", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-035: Article 23(1), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-035/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-036", "provision": "Article 23(2)", "applies_to": [ "Importers" ], "duty": "Do not place a high-risk system on the market while you have sufficient reason to consider it non-conforming or falsified, and inform the provider and authorities if it presents a risk.", "type": "Conformity assessment", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-036/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher (Art. 99(4)(c)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": "The authorised representative must also be informed where the system presents a risk under Art. 79(1).", "date_note": "Originally 2 Aug 2026 (Annex III) and 2 Aug 2027 (Annex I) under Art. 113. Digital Omnibus Art. 1(40)(b) moved Chapter III Sections 1 to 3 to 2 Dec 2027 for Annex III systems and 2 Aug 2028 for Annex I systems. Amended Art. 111(2): systems already placed on the market before then are covered only if significantly changed in design; public-authority systems must comply by 2 Aug 2030.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_23", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-036: Article 23(2), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-036/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-037", "provision": "Article 23(3)", "applies_to": [ "Importers" ], "duty": "Indicate your name, registered trade name or trade mark, and contact address on the high-risk system and on its packaging or accompanying documentation.", "type": "Transparency to users", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-037/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher (Art. 99(4)(c)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": null, "date_note": "Originally 2 Aug 2026 (Annex III) and 2 Aug 2027 (Annex I) under Art. 113. Digital Omnibus Art. 1(40)(b) moved Chapter III Sections 1 to 3 to 2 Dec 2027 for Annex III systems and 2 Aug 2028 for Annex I systems. Amended Art. 111(2): systems already placed on the market before then are covered only if significantly changed in design; public-authority systems must comply by 2 Aug 2030.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_23", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-037: Article 23(3), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-037/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-038", "provision": "Article 23(5)", "applies_to": [ "Importers" ], "duty": "Keep copies of any notified body certificate, the instructions for use and the EU declaration of conformity for 10 years after the high-risk system is placed on the market.", "type": "Record-keeping", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-038/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher (Art. 99(4)(c)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": null, "date_note": "Originally 2 Aug 2026 (Annex III) and 2 Aug 2027 (Annex I) under Art. 113. Digital Omnibus Art. 1(40)(b) moved Chapter III Sections 1 to 3 to 2 Dec 2027 for Annex III systems and 2 Aug 2028 for Annex I systems. Amended Art. 111(2): systems already placed on the market before then are covered only if significantly changed in design; public-authority systems must comply by 2 Aug 2030.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_23", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-038: Article 23(5), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-038/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-039", "provision": "Article 24(1)", "applies_to": [ "Distributors" ], "duty": "Verify before making a high-risk system available that it bears CE marking, comes with the EU declaration of conformity and instructions, and that provider and importer identification duties were met.", "type": "Conformity assessment", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-039/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher (Art. 99(4)(d)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": null, "date_note": "Originally 2 Aug 2026 (Annex III) and 2 Aug 2027 (Annex I) under Art. 113. Digital Omnibus Art. 1(40)(b) moved Chapter III Sections 1 to 3 to 2 Dec 2027 for Annex III systems and 2 Aug 2028 for Annex I systems. Amended Art. 111(2): systems already placed on the market before then are covered only if significantly changed in design; public-authority systems must comply by 2 Aug 2030.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_24", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-039: Article 24(1), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-039/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-040", "provision": "Article 24(2)", "applies_to": [ "Distributors" ], "duty": "Do not make available a high-risk system you have reason to consider non-conforming until it is brought into conformity, and inform the provider or importer if it presents a risk.", "type": "Conformity assessment", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-040/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher (Art. 99(4)(d)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": null, "date_note": "Originally 2 Aug 2026 (Annex III) and 2 Aug 2027 (Annex I) under Art. 113. Digital Omnibus Art. 1(40)(b) moved Chapter III Sections 1 to 3 to 2 Dec 2027 for Annex III systems and 2 Aug 2028 for Annex I systems. Amended Art. 111(2): systems already placed on the market before then are covered only if significantly changed in design; public-authority systems must comply by 2 Aug 2030.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_24", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-040: Article 24(2), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-040/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-041", "provision": "Article 24(4)", "applies_to": [ "Distributors" ], "duty": "Correct, withdraw or recall a non-conforming high-risk system you supplied, or ensure others do, and immediately inform the provider or importer and authorities if it presents a risk.", "type": "Incident reporting", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-041/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher (Art. 99(4)(d)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": null, "date_note": "Originally 2 Aug 2026 (Annex III) and 2 Aug 2027 (Annex I) under Art. 113. Digital Omnibus Art. 1(40)(b) moved Chapter III Sections 1 to 3 to 2 Dec 2027 for Annex III systems and 2 Aug 2028 for Annex I systems. Amended Art. 111(2): systems already placed on the market before then are covered only if significantly changed in design; public-authority systems must comply by 2 Aug 2030.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_24", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-041: Article 24(4), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-041/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-042", "provision": "Article 26(1)", "applies_to": [ "Deployers" ], "duty": "Take appropriate technical and organisational measures to use high-risk systems in accordance with the provider's instructions for use.", "type": "Human oversight", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-042/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher (Art. 99(4)(e)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": null, "date_note": "Originally 2 Aug 2026 (Annex III) and 2 Aug 2027 (Annex I) under Art. 113. Digital Omnibus Art. 1(40)(b) moved Chapter III Sections 1 to 3 to 2 Dec 2027 for Annex III systems and 2 Aug 2028 for Annex I systems. Amended Art. 111(2): systems already placed on the market before then are covered only if significantly changed in design; public-authority systems must comply by 2 Aug 2030.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_26", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-042: Article 26(1), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-042/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-043", "provision": "Article 26(2)", "applies_to": [ "Deployers" ], "duty": "Assign human oversight of high-risk systems to natural persons who have the necessary competence, training and authority, and give them the necessary support.", "type": "Human oversight", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-043/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher (Art. 99(4)(e)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": null, "date_note": "Originally 2 Aug 2026 (Annex III) and 2 Aug 2027 (Annex I) under Art. 113. Digital Omnibus Art. 1(40)(b) moved Chapter III Sections 1 to 3 to 2 Dec 2027 for Annex III systems and 2 Aug 2028 for Annex I systems. Amended Art. 111(2): systems already placed on the market before then are covered only if significantly changed in design; public-authority systems must comply by 2 Aug 2030.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_26", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-043: Article 26(2), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-043/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-044", "provision": "Article 26(4)", "applies_to": [ "Deployers" ], "duty": "Ensure input data you control is relevant and sufficiently representative for the high-risk system's intended purpose.", "type": "Data governance", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-044/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher (Art. 99(4)(e)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": null, "date_note": "Originally 2 Aug 2026 (Annex III) and 2 Aug 2027 (Annex I) under Art. 113. Digital Omnibus Art. 1(40)(b) moved Chapter III Sections 1 to 3 to 2 Dec 2027 for Annex III systems and 2 Aug 2028 for Annex I systems. Amended Art. 111(2): systems already placed on the market before then are covered only if significantly changed in design; public-authority systems must comply by 2 Aug 2030.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_26", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-044: Article 26(4), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-044/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-045", "provision": "Article 26(5)", "applies_to": [ "Deployers" ], "duty": "Monitor the system using its instructions, suspend use and inform the provider or distributor and market surveillance authority if it presents a risk, and immediately report serious incidents.", "type": "Incident reporting", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-045/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher (Art. 99(4)(e)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": "If the provider cannot be reached, Art. 73 applies to the deployer. Financial institutions meet the monitoring duty through financial services governance rules.", "date_note": "Originally 2 Aug 2026 (Annex III) and 2 Aug 2027 (Annex I) under Art. 113. Digital Omnibus Art. 1(40)(b) moved Chapter III Sections 1 to 3 to 2 Dec 2027 for Annex III systems and 2 Aug 2028 for Annex I systems. Amended Art. 111(2): systems already placed on the market before then are covered only if significantly changed in design; public-authority systems must comply by 2 Aug 2030.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_26", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-045: Article 26(5), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-045/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-046", "provision": "Article 26(6)", "applies_to": [ "Deployers" ], "duty": "Keep the logs automatically generated by the high-risk system, to the extent under your control, for a period suited to its purpose and at least six months.", "type": "Record-keeping", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-046/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher (Art. 99(4)(e)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": "Unless other Union or national law, in particular data protection law, provides otherwise.", "date_note": "Originally 2 Aug 2026 (Annex III) and 2 Aug 2027 (Annex I) under Art. 113. Digital Omnibus Art. 1(40)(b) moved Chapter III Sections 1 to 3 to 2 Dec 2027 for Annex III systems and 2 Aug 2028 for Annex I systems. Amended Art. 111(2): systems already placed on the market before then are covered only if significantly changed in design; public-authority systems must comply by 2 Aug 2030.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_26", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-046: Article 26(6), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-046/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-047", "provision": "Article 26(7)", "applies_to": [ "Deployers", "Employers" ], "duty": "Inform workers' representatives and affected workers before putting into service or using a high-risk system at the workplace that they will be subject to it.", "type": "Transparency to users", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-047/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher (Art. 99(4)(e)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": null, "date_note": "Originally 2 Aug 2026 (Annex III) and 2 Aug 2027 (Annex I) under Art. 113. Digital Omnibus Art. 1(40)(b) moved Chapter III Sections 1 to 3 to 2 Dec 2027 for Annex III systems and 2 Aug 2028 for Annex I systems. Amended Art. 111(2): systems already placed on the market before then are covered only if significantly changed in design; public-authority systems must comply by 2 Aug 2030.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_26", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-047: Article 26(7), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-047/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-048", "provision": "Article 26(11)", "applies_to": [ "Deployers" ], "duty": "Inform natural persons that they are subject to an Annex III high-risk system that makes, or assists in making, decisions about them.", "type": "Transparency to users", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-048/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher (Art. 99(4)(e)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": "Without prejudice to Art. 50. For law enforcement uses, Art. 13 of Directive (EU) 2016/680 applies instead.", "date_note": "Originally 2 Aug 2026 (Annex III) and 2 Aug 2027 (Annex I) under Art. 113. Digital Omnibus Art. 1(40)(b) moved Chapter III Sections 1 to 3 to 2 Dec 2027 for Annex III systems and 2 Aug 2028 for Annex I systems. Amended Art. 111(2): systems already placed on the market before then are covered only if significantly changed in design; public-authority systems must comply by 2 Aug 2030.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_26", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-048: Article 26(11), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-048/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-049", "provision": "Article 27(1)", "applies_to": [ "Deployers", "Public bodies", "Lenders", "Insurers" ], "duty": "Assess the impact on fundamental rights before first deploying an Annex III high-risk system, covering processes, period of use, affected groups, risks of harm, human oversight and mitigation measures.", "type": "Impact assessment", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-049/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "No fixed fine tier: this provision is not listed in Art. 99(3) or (4), so Member States set the penalty under Art. 99(1).", "scope_note": "Applies to public-law bodies, private entities providing public services, and deployers of credit-scoring or life and health insurance pricing systems (Annex III point 5(b) and (c)); excludes Annex III point 2. May cross-refer to a GDPR DPIA (Art. 27(4) as replaced by Omnibus Art. 1(13)).", "date_note": "Originally 2 Aug 2026 (Annex III) and 2 Aug 2027 (Annex I) under Art. 113. Digital Omnibus Art. 1(40)(b) moved Chapter III Sections 1 to 3 to 2 Dec 2027 for Annex III systems and 2 Aug 2028 for Annex I systems. Amended Art. 111(2): systems already placed on the market before then are covered only if significantly changed in design; public-authority systems must comply by 2 Aug 2030.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_27", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-049: Article 27(1), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-049/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-050", "provision": "Article 27(3)", "applies_to": [ "Deployers", "Public bodies", "Lenders", "Insurers" ], "duty": "Notify the market surveillance authority of the results of the fundamental rights impact assessment, submitting the completed AI Office template questionnaire.", "type": "Registration or filing", "status": "applies later", "applies_from": "2027-12-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-050/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "No fixed fine tier: this provision is not listed in Art. 99(3) or (4), so Member States set the penalty under Art. 99(1).", "scope_note": "Deployers may be exempt in the public-security derogation cases of Art. 46(1).", "date_note": "Originally 2 Aug 2026 (Annex III) and 2 Aug 2027 (Annex I) under Art. 113. Digital Omnibus Art. 1(40)(b) moved Chapter III Sections 1 to 3 to 2 Dec 2027 for Annex III systems and 2 Aug 2028 for Annex I systems. Amended Art. 111(2): systems already placed on the market before then are covered only if significantly changed in design; public-authority systems must comply by 2 Aug 2030.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_27", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-050: Article 27(3), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-050/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-051", "provision": "Article 50(1)", "applies_to": [ "Providers" ], "duty": "Design AI systems that interact directly with people so they are informed they are interacting with an AI system, unless obvious to a reasonably well-informed, observant person.", "type": "Transparency to users", "status": "applies now", "applies_from": "2026-08-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-051/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher (Art. 99(4)(g)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": "Does not apply to systems authorised by law to detect, prevent, investigate or prosecute crime, unless available to the public to report a crime.", "date_note": "Applies from 2 Aug 2026 (Art. 113, general date of application). The Digital Omnibus did not change the date of this paragraph.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_50", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-051: Article 50(1), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-051/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-052", "provision": "Article 50(2)", "applies_to": [ "Providers" ], "duty": "Mark outputs of AI systems that generate synthetic audio, image, video or text in a machine-readable format so they are detectable as artificially generated or manipulated.", "type": "Labelling AI content", "status": "applies now", "applies_from": "2026-08-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-052/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher (Art. 99(4)(g)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": "Includes general-purpose AI systems. Solutions must be effective, interoperable, robust and reliable as far as technically feasible. Exempt: assistive standard editing, systems not substantially altering input, and uses authorised by law for crime detection or prosecution.", "date_note": "Applies from 2 Aug 2026 (Art. 113). Digital Omnibus Art. 1(39)(b) added Art. 111(4): providers of systems placed on the market before 2 Aug 2026 must comply by 2 Dec 2026.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_50", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-052: Article 50(2), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-052/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-053", "provision": "Article 50(3)", "applies_to": [ "Deployers" ], "duty": "Inform people exposed to an emotion recognition or biometric categorisation system that it is operating, and process their personal data in line with EU data protection law.", "type": "Transparency to users", "status": "applies now", "applies_from": "2026-08-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-053/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher (Art. 99(4)(g)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": "Does not apply to such systems permitted by law to detect, prevent or investigate crime, subject to safeguards.", "date_note": "Applies from 2 Aug 2026 (Art. 113, general date of application). The Digital Omnibus did not change the date of this paragraph.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_50", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-053: Article 50(3), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-053/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-054", "provision": "Article 50(4), first subparagraph", "applies_to": [ "Deployers" ], "duty": "Disclose that image, audio or video deep fake content you generate or manipulate with an AI system has been artificially generated or manipulated.", "type": "Labelling AI content", "status": "applies now", "applies_from": "2026-08-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-054/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher (Art. 99(4)(g)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": "For evidently artistic, creative, satirical or fictional works, disclosure is limited to the existence of such content in a way that does not hamper enjoyment of the work. Exempt where authorised by law for crime detection or prosecution.", "date_note": "Applies from 2 Aug 2026 (Art. 113, general date of application). The Digital Omnibus did not change the date of this paragraph.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_50", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-054: Article 50(4), first subparagraph, Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-054/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-055", "provision": "Article 50(4), second subparagraph", "applies_to": [ "Deployers" ], "duty": "Disclose that AI-generated or manipulated text published to inform the public on matters of public interest was artificially generated or manipulated.", "type": "Labelling AI content", "status": "applies now", "applies_from": "2026-08-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-055/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher (Art. 99(4)(g)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": "Exempt where the text underwent human review or editorial control and a natural or legal person holds editorial responsibility, or where authorised by law for crime detection or prosecution.", "date_note": "Applies from 2 Aug 2026 (Art. 113, general date of application). The Digital Omnibus did not change the date of this paragraph.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_50", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-055: Article 50(4), second subparagraph, Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-055/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-056", "provision": "Article 50(5)", "applies_to": [ "Providers", "Deployers" ], "duty": "Give the information required by Article 50(1) to (4) clearly and distinguishably, at the latest at the first interaction or exposure, and in line with accessibility requirements.", "type": "Transparency to users", "status": "applies now", "applies_from": "2026-08-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-056/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of total worldwide annual turnover, whichever is higher (Art. 99(4)(g)); for SMEs and small mid-caps, whichever is lower (Art. 99(6) and (6a)).", "scope_note": null, "date_note": "Applies from 2 Aug 2026 (Art. 113, general date of application). The Digital Omnibus did not change the date of this paragraph.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_50", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-056: Article 50(5), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-056/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-057", "provision": "Article 53(1)(a)", "applies_to": [ "Providers" ], "duty": "Draw up and keep up to date technical documentation of the general-purpose AI model, including training, testing and evaluation results with at least the Annex XI information, for the AI Office on request.", "type": "Record-keeping", "status": "applies now", "applies_from": "2025-08-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-057/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of annual total worldwide turnover, whichever is higher, imposed by the Commission (Art. 101(1)); the Commission's fining power applies from 2 Aug 2026 (Art. 113).", "scope_note": "Points (a) and (b) do not apply to models released under a free and open-source licence with public weights, architecture and usage information, unless the model has systemic risk (Art. 53(2)). Compliance may be shown through an approved code of practice until a harmonised standard is published (Art. 53(4)).", "date_note": "Applies from 2 Aug 2025 (Art. 113(b): Chapter V). Providers of models placed on the market before 2 Aug 2025 must comply by 2 Aug 2027 (Art. 111(3)). The Digital Omnibus did not change these dates.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_53", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-057: Article 53(1)(a), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-057/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-058", "provision": "Article 53(1)(b)", "applies_to": [ "Providers" ], "duty": "Give downstream AI system providers up-to-date information and documentation on the model's capabilities and limitations, containing at least the Annex XII elements.", "type": "Transparency to users", "status": "applies now", "applies_from": "2025-08-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-058/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of annual total worldwide turnover, whichever is higher, imposed by the Commission (Art. 101(1)); the Commission's fining power applies from 2 Aug 2026 (Art. 113).", "scope_note": "Points (a) and (b) do not apply to models released under a free and open-source licence with public weights, architecture and usage information, unless the model has systemic risk (Art. 53(2)). Without prejudice to protection of intellectual property and trade secrets.", "date_note": "Applies from 2 Aug 2025 (Art. 113(b): Chapter V). Providers of models placed on the market before 2 Aug 2025 must comply by 2 Aug 2027 (Art. 111(3)). The Digital Omnibus did not change these dates.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_53", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-058: Article 53(1)(b), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-058/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-059", "provision": "Article 53(1)(c)", "applies_to": [ "Providers" ], "duty": "Put in place a policy to comply with EU copyright law, including identifying and respecting text and data mining opt-outs under Article 4(3) of Directive (EU) 2019/790.", "type": "Copyright and training data", "status": "applies now", "applies_from": "2025-08-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-059/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of annual total worldwide turnover, whichever is higher, imposed by the Commission (Art. 101(1)); the Commission's fining power applies from 2 Aug 2026 (Art. 113).", "scope_note": "Applies to all general-purpose AI model providers, including open-source releases. State-of-the-art technologies are expected to identify rights reservations.", "date_note": "Applies from 2 Aug 2025 (Art. 113(b): Chapter V). Providers of models placed on the market before 2 Aug 2025 must comply by 2 Aug 2027 (Art. 111(3)). The Digital Omnibus did not change these dates.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_53", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-059: Article 53(1)(c), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-059/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-060", "provision": "Article 53(1)(d)", "applies_to": [ "Providers" ], "duty": "Publish a sufficiently detailed summary of the content used to train the general-purpose AI model, using the AI Office template.", "type": "Copyright and training data", "status": "applies now", "applies_from": "2025-08-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-060/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of annual total worldwide turnover, whichever is higher, imposed by the Commission (Art. 101(1)); the Commission's fining power applies from 2 Aug 2026 (Art. 113).", "scope_note": "Applies to all general-purpose AI model providers, including open-source releases.", "date_note": "Applies from 2 Aug 2025 (Art. 113(b): Chapter V). Providers of models placed on the market before 2 Aug 2025 must comply by 2 Aug 2027 (Art. 111(3)). The Digital Omnibus did not change these dates.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_53", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-060: Article 53(1)(d), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-060/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-061", "provision": "Article 54(1)", "applies_to": [ "Providers" ], "duty": "Appoint by written mandate an authorised representative established in the EU before placing a general-purpose AI model on the EU market, if you are established outside the EU.", "type": "Registration or filing", "status": "applies now", "applies_from": "2025-08-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-061/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of annual total worldwide turnover, whichever is higher, imposed by the Commission (Art. 101(1)); the Commission's fining power applies from 2 Aug 2026 (Art. 113).", "scope_note": "Not required for free and open-source models with public weights, unless the model has systemic risk (Art. 54(6)). The representative keeps the Annex XI documentation for 10 years (Art. 54(3)(b)).", "date_note": "Applies from 2 Aug 2025 (Art. 113(b): Chapter V). Providers of models placed on the market before 2 Aug 2025 must comply by 2 Aug 2027 (Art. 111(3)). The Digital Omnibus did not change these dates.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_54", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-061: Article 54(1), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-061/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-062", "provision": "Article 55(1)(a)", "applies_to": [ "Providers" ], "duty": "Evaluate the model with standardised state-of-the-art protocols and tools, including conducting and documenting adversarial testing, to identify and mitigate systemic risks.", "type": "Frontier model safety", "status": "applies now", "applies_from": "2025-08-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-062/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of annual total worldwide turnover, whichever is higher, imposed by the Commission (Art. 101(1)); the Commission's fining power applies from 2 Aug 2026 (Art. 113).", "scope_note": "Applies to general-purpose AI models with systemic risk, presumed where training compute exceeds 10^25 floating point operations (Art. 51(2)) or designated by the Commission. Compliance may be shown through an approved code of practice (Art. 55(2)).", "date_note": "Applies from 2 Aug 2025 (Art. 113(b): Chapter V). Providers of models placed on the market before 2 Aug 2025 must comply by 2 Aug 2027 (Art. 111(3)). The Digital Omnibus did not change these dates.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_55", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-062: Article 55(1)(a), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-062/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-063", "provision": "Article 55(1)(b)", "applies_to": [ "Providers" ], "duty": "Assess and mitigate possible systemic risks at Union level, including their sources, that may arise from developing, placing on the market or using the model.", "type": "Frontier model safety", "status": "applies now", "applies_from": "2025-08-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-063/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of annual total worldwide turnover, whichever is higher, imposed by the Commission (Art. 101(1)); the Commission's fining power applies from 2 Aug 2026 (Art. 113).", "scope_note": "Applies to general-purpose AI models with systemic risk, presumed where training compute exceeds 10^25 floating point operations (Art. 51(2)) or designated by the Commission. Compliance may be shown through an approved code of practice (Art. 55(2)).", "date_note": "Applies from 2 Aug 2025 (Art. 113(b): Chapter V). Providers of models placed on the market before 2 Aug 2025 must comply by 2 Aug 2027 (Art. 111(3)). The Digital Omnibus did not change these dates.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_55", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-063: Article 55(1)(b), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-063/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-064", "provision": "Article 55(1)(c)", "applies_to": [ "Providers" ], "duty": "Track, document and report without undue delay to the AI Office, and as appropriate national authorities, relevant information about serious incidents and possible corrective measures.", "type": "Incident reporting", "status": "applies now", "applies_from": "2025-08-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-064/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of annual total worldwide turnover, whichever is higher, imposed by the Commission (Art. 101(1)); the Commission's fining power applies from 2 Aug 2026 (Art. 113).", "scope_note": "Applies to general-purpose AI models with systemic risk, presumed where training compute exceeds 10^25 floating point operations (Art. 51(2)) or designated by the Commission. Compliance may be shown through an approved code of practice (Art. 55(2)).", "date_note": "Applies from 2 Aug 2025 (Art. 113(b): Chapter V). Providers of models placed on the market before 2 Aug 2025 must comply by 2 Aug 2027 (Art. 111(3)). The Digital Omnibus did not change these dates.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_55", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-064: Article 55(1)(c), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-064/ (checked 2026-10-08)." }, { "record_id": "WTA-R-EU-0001-065", "provision": "Article 55(1)(d)", "applies_to": [ "Providers" ], "duty": "Ensure an adequate level of cybersecurity protection for the general-purpose AI model with systemic risk and its physical infrastructure.", "type": "Security testing", "status": "applies now", "applies_from": "2025-08-02", "url": "https://wheresthe.ai/id/WTA-R-EU-0001-065/", "rule": { "record_id": "WTA-R-EU-0001", "id": "eu-ai-act-2024-1689", "title": "Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)", "jurisdiction": "EU", "jurisdiction_name": "European Union", "url": "https://wheresthe.ai/rule/eu-ai-act-2024-1689/" }, "penalty": "Up to EUR 15m or 3% of annual total worldwide turnover, whichever is higher, imposed by the Commission (Art. 101(1)); the Commission's fining power applies from 2 Aug 2026 (Art. 113).", "scope_note": "Applies to general-purpose AI models with systemic risk, presumed where training compute exceeds 10^25 floating point operations (Art. 51(2)) or designated by the Commission. Compliance may be shown through an approved code of practice (Art. 55(2)).", "date_note": "Applies from 2 Aug 2025 (Art. 113(b): Chapter V). Providers of models placed on the market before 2 Aug 2025 must comply by 2 Aug 2027 (Art. 111(3)). The Digital Omnibus did not change these dates.", "source_url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_55", "verified_on": "2026-10-08", "citation": "WTA-R-EU-0001-065: Article 55(1)(d), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). wheresthe.ai, https://wheresthe.ai/id/WTA-R-EU-0001-065/ (checked 2026-10-08)." }, { "record_id": "WTA-R-IN-0006-001", "provision": "Rule 3(3)(a)(i)", "applies_to": [ "Platforms", "Providers" ], "duty": "Deploy reasonable and appropriate technical measures, including automated tools, so users cannot create or share unlawful synthetically generated information, such as CSAM, non-consensual intimate imagery, false documents, explosives material or deceptive impersonation.", "type": "Prohibited uses", "status": "applies now", "applies_from": "2026-02-20", "url": "https://wheresthe.ai/id/WTA-R-IN-0006-001/", "rule": { "record_id": "WTA-R-IN-0006", "id": "in-it-rules-amendment-sgi-2026", "title": "Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (synthetically generated information)", "jurisdiction": "IN", "jurisdiction_name": "India", "url": "https://wheresthe.ai/rule/in-it-rules-amendment-sgi-2026/" }, "penalty": "Loss of the safe-harbour exemption under section 79(1) of the IT Act and liability under applicable law, including the IT Act and the Bharatiya Nyaya Sanhita, 2023 (Rule 7).", "scope_note": "Applies to any intermediary whose computer resource enables, permits or facilitates creating, modifying or sharing synthetically generated information (SGI). SGI excludes routine good-faith editing, document preparation and accessibility uses (Rule 2(1)(wa) proviso). Listed examples are in Rule 3(3)(a)(i)(I) to (IV).", "date_note": "Amendment G.S.R. 120(E) dated 10 Feb 2026; in force 20 Feb 2026. Provision text checked on MeitY's consolidated Rules (updated 10.02.2026); the 20 Feb date is from a Shardul Amarchand Mangaldas note because the e-Gazette copy could not be fetched.", "source_url": "https://www.meity.gov.in/static/uploads/2026/02/550681ab908f8afb135b0ad42816a1c9.pdf#page=12", "verified_on": "2026-10-08", "citation": "WTA-R-IN-0006-001: Rule 3(3)(a)(i), Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (synthetically generated information). wheresthe.ai, https://wheresthe.ai/id/WTA-R-IN-0006-001/ (checked 2026-10-08)." }, { "record_id": "WTA-R-IN-0006-002", "provision": "Rule 3(3)(a)(ii)", "applies_to": [ "Platforms", "Providers" ], "duty": "Label all other synthetically generated information prominently, visibly in the display or with a prefixed audio disclosure for audio, so people can immediately tell it was created or altered using a computer resource.", "type": "Labelling AI content", "status": "applies now", "applies_from": "2026-02-20", "url": "https://wheresthe.ai/id/WTA-R-IN-0006-002/", "rule": { "record_id": "WTA-R-IN-0006", "id": "in-it-rules-amendment-sgi-2026", "title": "Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (synthetically generated information)", "jurisdiction": "IN", "jurisdiction_name": "India", "url": "https://wheresthe.ai/rule/in-it-rules-amendment-sgi-2026/" }, "penalty": "Loss of the safe-harbour exemption under section 79(1) of the IT Act and liability under applicable law, including the IT Act and the Bharatiya Nyaya Sanhita, 2023 (Rule 7).", "scope_note": "Applies to any intermediary whose computer resource enables, permits or facilitates creating, modifying or sharing synthetically generated information (SGI). SGI excludes routine good-faith editing, document preparation and accessibility uses (Rule 2(1)(wa) proviso).", "date_note": "Amendment G.S.R. 120(E) dated 10 Feb 2026; in force 20 Feb 2026. Provision text checked on MeitY's consolidated Rules (updated 10.02.2026); the 20 Feb date is from a Shardul Amarchand Mangaldas note because the e-Gazette copy could not be fetched.", "source_url": "https://www.meity.gov.in/static/uploads/2026/02/550681ab908f8afb135b0ad42816a1c9.pdf#page=12", "verified_on": "2026-10-08", "citation": "WTA-R-IN-0006-002: Rule 3(3)(a)(ii), Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (synthetically generated information). wheresthe.ai, https://wheresthe.ai/id/WTA-R-IN-0006-002/ (checked 2026-10-08)." }, { "record_id": "WTA-R-IN-0006-003", "provision": "Rule 3(3)(a)(ii)", "applies_to": [ "Platforms", "Providers" ], "duty": "Embed permanent metadata or other technical provenance mechanisms, including a unique identifier of the computer resource used, in synthetically generated information, to the extent technically feasible.", "type": "Labelling AI content", "status": "applies now", "applies_from": "2026-02-20", "url": "https://wheresthe.ai/id/WTA-R-IN-0006-003/", "rule": { "record_id": "WTA-R-IN-0006", "id": "in-it-rules-amendment-sgi-2026", "title": "Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (synthetically generated information)", "jurisdiction": "IN", "jurisdiction_name": "India", "url": "https://wheresthe.ai/rule/in-it-rules-amendment-sgi-2026/" }, "penalty": "Loss of the safe-harbour exemption under section 79(1) of the IT Act and liability under applicable law, including the IT Act and the Bharatiya Nyaya Sanhita, 2023 (Rule 7).", "scope_note": "Applies to any intermediary whose computer resource enables, permits or facilitates creating, modifying or sharing synthetically generated information (SGI). SGI excludes routine good-faith editing, document preparation and accessibility uses (Rule 2(1)(wa) proviso). The duty is qualified by 'to the extent technically feasible'; no metadata standard is specified.", "date_note": "Amendment G.S.R. 120(E) dated 10 Feb 2026; in force 20 Feb 2026. Provision text checked on MeitY's consolidated Rules (updated 10.02.2026); the 20 Feb date is from a Shardul Amarchand Mangaldas note because the e-Gazette copy could not be fetched.", "source_url": "https://www.meity.gov.in/static/uploads/2026/02/550681ab908f8afb135b0ad42816a1c9.pdf#page=12", "verified_on": "2026-10-08", "citation": "WTA-R-IN-0006-003: Rule 3(3)(a)(ii), Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (synthetically generated information). wheresthe.ai, https://wheresthe.ai/id/WTA-R-IN-0006-003/ (checked 2026-10-08)." }, { "record_id": "WTA-R-IN-0006-004", "provision": "Rule 3(3)(b)", "applies_to": [ "Platforms", "Providers" ], "duty": "Do not enable anyone to modify, suppress or remove the synthetic content label, permanent metadata or unique identifier applied under Rule 3(3)(a)(ii).", "type": "Labelling AI content", "status": "applies now", "applies_from": "2026-02-20", "url": "https://wheresthe.ai/id/WTA-R-IN-0006-004/", "rule": { "record_id": "WTA-R-IN-0006", "id": "in-it-rules-amendment-sgi-2026", "title": "Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (synthetically generated information)", "jurisdiction": "IN", "jurisdiction_name": "India", "url": "https://wheresthe.ai/rule/in-it-rules-amendment-sgi-2026/" }, "penalty": "Loss of the safe-harbour exemption under section 79(1) of the IT Act and liability under applicable law, including the IT Act and the Bharatiya Nyaya Sanhita, 2023 (Rule 7).", "scope_note": "Applies to any intermediary whose computer resource enables, permits or facilitates creating, modifying or sharing synthetically generated information (SGI). SGI excludes routine good-faith editing, document preparation and accessibility uses (Rule 2(1)(wa) proviso).", "date_note": "Amendment G.S.R. 120(E) dated 10 Feb 2026; in force 20 Feb 2026. Provision text checked on MeitY's consolidated Rules (updated 10.02.2026); the 20 Feb date is from a Shardul Amarchand Mangaldas note because the e-Gazette copy could not be fetched.", "source_url": "https://www.meity.gov.in/static/uploads/2026/02/550681ab908f8afb135b0ad42816a1c9.pdf#page=12", "verified_on": "2026-10-08", "citation": "WTA-R-IN-0006-004: Rule 3(3)(b), Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (synthetically generated information). wheresthe.ai, https://wheresthe.ai/id/WTA-R-IN-0006-004/ (checked 2026-10-08)." }, { "record_id": "WTA-R-IN-0006-005", "provision": "Rule 3(1)(ca)", "applies_to": [ "Platforms", "Providers" ], "duty": "Tell users that misusing the service to create or share unlawful synthetically generated information can lead to penalties under named laws, content removal, account suspension, disclosure of identity to victims and mandatory reporting.", "type": "Transparency to users", "status": "applies now", "applies_from": "2026-02-20", "url": "https://wheresthe.ai/id/WTA-R-IN-0006-005/", "rule": { "record_id": "WTA-R-IN-0006", "id": "in-it-rules-amendment-sgi-2026", "title": "Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (synthetically generated information)", "jurisdiction": "IN", "jurisdiction_name": "India", "url": "https://wheresthe.ai/rule/in-it-rules-amendment-sgi-2026/" }, "penalty": "Loss of the safe-harbour exemption under section 79(1) of the IT Act and liability under applicable law, including the IT Act and the Bharatiya Nyaya Sanhita, 2023 (Rule 7).", "scope_note": "Applies to any intermediary whose computer resource enables, permits or facilitates creating, modifying or sharing synthetically generated information (SGI). SGI excludes routine good-faith editing, document preparation and accessibility uses (Rule 2(1)(wa) proviso). Clause (ca) states no frequency of its own. It says 'additionally inform' alongside Rule 3(1)(c), which requires notices at least every three months.", "date_note": "Amendment G.S.R. 120(E) dated 10 Feb 2026; in force 20 Feb 2026. Provision text checked on MeitY's consolidated Rules (updated 10.02.2026); the 20 Feb date is from a Shardul Amarchand Mangaldas note because the e-Gazette copy could not be fetched.", "source_url": "https://www.meity.gov.in/static/uploads/2026/02/550681ab908f8afb135b0ad42816a1c9.pdf#page=7", "verified_on": "2026-10-08", "citation": "WTA-R-IN-0006-005: Rule 3(1)(ca), Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (synthetically generated information). wheresthe.ai, https://wheresthe.ai/id/WTA-R-IN-0006-005/ (checked 2026-10-08)." }, { "record_id": "WTA-R-IN-0006-006", "provision": "Rule 3(1)(cb)", "applies_to": [ "Platforms", "Providers" ], "duty": "Take expeditious and appropriate action, including removal and account suspension, when you become aware, on your own or through complaints, of a breach of Rule 3(3) involving synthetically generated information.", "type": "Prohibited uses", "status": "applies now", "applies_from": "2026-02-20", "url": "https://wheresthe.ai/id/WTA-R-IN-0006-006/", "rule": { "record_id": "WTA-R-IN-0006", "id": "in-it-rules-amendment-sgi-2026", "title": "Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (synthetically generated information)", "jurisdiction": "IN", "jurisdiction_name": "India", "url": "https://wheresthe.ai/rule/in-it-rules-amendment-sgi-2026/" }, "penalty": "Loss of the safe-harbour exemption under section 79(1) of the IT Act and liability under applicable law, including the IT Act and the Bharatiya Nyaya Sanhita, 2023 (Rule 7).", "scope_note": "Applies to any intermediary whose computer resource enables, permits or facilitates creating, modifying or sharing synthetically generated information (SGI). SGI excludes routine good-faith editing, document preparation and accessibility uses (Rule 2(1)(wa) proviso). The clause refers to SGI 'covered under sub-clause (ii) of clause (a)' of Rule 3(3); the cross-reference is ambiguous.", "date_note": "Amendment G.S.R. 120(E) dated 10 Feb 2026; in force 20 Feb 2026. Provision text checked on MeitY's consolidated Rules (updated 10.02.2026); the 20 Feb date is from a Shardul Amarchand Mangaldas note because the e-Gazette copy could not be fetched.", "source_url": "https://www.meity.gov.in/static/uploads/2026/02/550681ab908f8afb135b0ad42816a1c9.pdf#page=8", "verified_on": "2026-10-08", "citation": "WTA-R-IN-0006-006: Rule 3(1)(cb), Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (synthetically generated information). wheresthe.ai, https://wheresthe.ai/id/WTA-R-IN-0006-006/ (checked 2026-10-08)." }, { "record_id": "WTA-R-IN-0006-007", "provision": "Rule 3(1)(d)", "applies_to": [ "Platforms" ], "duty": "Remove or disable access to unlawful information, including synthetically generated information, within three hours of receiving a court order or a reasoned written intimation from an authorised government officer.", "type": "Prohibited uses", "status": "applies now", "applies_from": "2026-02-20", "url": "https://wheresthe.ai/id/WTA-R-IN-0006-007/", "rule": { "record_id": "WTA-R-IN-0006", "id": "in-it-rules-amendment-sgi-2026", "title": "Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (synthetically generated information)", "jurisdiction": "IN", "jurisdiction_name": "India", "url": "https://wheresthe.ai/rule/in-it-rules-amendment-sgi-2026/" }, "penalty": "Loss of the safe-harbour exemption under section 79(1) of the IT Act and liability under applicable law, including the IT Act and the Bharatiya Nyaya Sanhita, 2023 (Rule 7).", "scope_note": "Applies to all intermediaries; Rule 2(1A) makes 'information' include SGI. The 2026 amendment cut the deadline from 36 hours to three hours. Intimations must come from an officer not below Joint Secretary (or Director where none is appointed), or a police officer not below Deputy Inspector General.", "date_note": "Amendment G.S.R. 120(E) dated 10 Feb 2026; in force 20 Feb 2026. Provision text checked on MeitY's consolidated Rules (updated 10.02.2026); the 20 Feb date is from a Shardul Amarchand Mangaldas note because the e-Gazette copy could not be fetched.", "source_url": "https://www.meity.gov.in/static/uploads/2026/02/550681ab908f8afb135b0ad42816a1c9.pdf#page=9", "verified_on": "2026-10-08", "citation": "WTA-R-IN-0006-007: Rule 3(1)(d), Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (synthetically generated information). wheresthe.ai, https://wheresthe.ai/id/WTA-R-IN-0006-007/ (checked 2026-10-08)." }, { "record_id": "WTA-R-IN-0006-008", "provision": "Rule 3(2)(b)", "applies_to": [ "Platforms" ], "duty": "Remove or disable access within two hours of a complaint about content that prima facie exposes a person's private area, shows nudity or sexual acts, or impersonates them, including artificially morphed images.", "type": "Prohibited uses", "status": "applies now", "applies_from": "2026-02-20", "url": "https://wheresthe.ai/id/WTA-R-IN-0006-008/", "rule": { "record_id": "WTA-R-IN-0006", "id": "in-it-rules-amendment-sgi-2026", "title": "Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (synthetically generated information)", "jurisdiction": "IN", "jurisdiction_name": "India", "url": "https://wheresthe.ai/rule/in-it-rules-amendment-sgi-2026/" }, "penalty": "Loss of the safe-harbour exemption under section 79(1) of the IT Act and liability under applicable law, including the IT Act and the Bharatiya Nyaya Sanhita, 2023 (Rule 7).", "scope_note": "Applies to all intermediaries; the complaint may be made by the individual or someone on their behalf. The 2026 amendment cut the deadline from 24 hours to two hours.", "date_note": "Amendment G.S.R. 120(E) dated 10 Feb 2026; in force 20 Feb 2026. Provision text checked on MeitY's consolidated Rules (updated 10.02.2026); the 20 Feb date is from a Shardul Amarchand Mangaldas note because the e-Gazette copy could not be fetched.", "source_url": "https://www.meity.gov.in/static/uploads/2026/02/550681ab908f8afb135b0ad42816a1c9.pdf#page=11", "verified_on": "2026-10-08", "citation": "WTA-R-IN-0006-008: Rule 3(2)(b), Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (synthetically generated information). wheresthe.ai, https://wheresthe.ai/id/WTA-R-IN-0006-008/ (checked 2026-10-08)." }, { "record_id": "WTA-R-IN-0006-009", "provision": "Rule 3(2)(a)(i)", "applies_to": [ "Platforms" ], "duty": "Acknowledge user complaints within 24 hours, resolve them within seven days, and resolve requests to remove content prohibited under Rule 3(1)(b) within 36 hours.", "type": "Consumer rights", "status": "applies now", "applies_from": "2026-02-20", "url": "https://wheresthe.ai/id/WTA-R-IN-0006-009/", "rule": { "record_id": "WTA-R-IN-0006", "id": "in-it-rules-amendment-sgi-2026", "title": "Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (synthetically generated information)", "jurisdiction": "IN", "jurisdiction_name": "India", "url": "https://wheresthe.ai/rule/in-it-rules-amendment-sgi-2026/" }, "penalty": "Loss of the safe-harbour exemption under section 79(1) of the IT Act and liability under applicable law, including the IT Act and the Bharatiya Nyaya Sanhita, 2023 (Rule 7).", "scope_note": "Applies to all intermediaries through their Grievance Officer. The 2026 amendment cut resolution from 15 days to seven days and removal requests from 72 to 36 hours. The 36-hour limit excludes Rule 3(1)(b)(i), (iv) and (xi).", "date_note": "Amendment G.S.R. 120(E) dated 10 Feb 2026; in force 20 Feb 2026. Provision text checked on MeitY's consolidated Rules (updated 10.02.2026); the 20 Feb date is from a Shardul Amarchand Mangaldas note because the e-Gazette copy could not be fetched.", "source_url": "https://www.meity.gov.in/static/uploads/2026/02/550681ab908f8afb135b0ad42816a1c9.pdf#page=11", "verified_on": "2026-10-08", "citation": "WTA-R-IN-0006-009: Rule 3(2)(a)(i), Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (synthetically generated information). wheresthe.ai, https://wheresthe.ai/id/WTA-R-IN-0006-009/ (checked 2026-10-08)." }, { "record_id": "WTA-R-IN-0006-010", "provision": "Rule 4(1A)(a)", "applies_to": [ "Platforms" ], "duty": "Require users to declare whether content is synthetically generated information before it is displayed, uploaded or published.", "type": "Transparency to users", "status": "applies now", "applies_from": "2026-02-20", "url": "https://wheresthe.ai/id/WTA-R-IN-0006-010/", "rule": { "record_id": "WTA-R-IN-0006", "id": "in-it-rules-amendment-sgi-2026", "title": "Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (synthetically generated information)", "jurisdiction": "IN", "jurisdiction_name": "India", "url": "https://wheresthe.ai/rule/in-it-rules-amendment-sgi-2026/" }, "penalty": "Loss of the safe-harbour exemption under section 79(1) of the IT Act and liability under applicable law, including the IT Act and the Bharatiya Nyaya Sanhita, 2023 (Rule 7).", "scope_note": "Applies to significant social media intermediaries (registered users in India above the threshold notified by the Central Government) that enable displaying, uploading or publishing information.", "date_note": "Amendment G.S.R. 120(E) dated 10 Feb 2026; in force 20 Feb 2026. Provision text checked on MeitY's consolidated Rules (updated 10.02.2026); the 20 Feb date is from a Shardul Amarchand Mangaldas note because the e-Gazette copy could not be fetched.", "source_url": "https://www.meity.gov.in/static/uploads/2026/02/550681ab908f8afb135b0ad42816a1c9.pdf#page=14", "verified_on": "2026-10-08", "citation": "WTA-R-IN-0006-010: Rule 4(1A)(a), Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (synthetically generated information). wheresthe.ai, https://wheresthe.ai/id/WTA-R-IN-0006-010/ (checked 2026-10-08)." }, { "record_id": "WTA-R-IN-0006-011", "provision": "Rule 4(1A)(b)", "applies_to": [ "Platforms" ], "duty": "Deploy appropriate technical measures, including automated tools, to verify the accuracy of user declarations about synthetic content, having regard to the nature, format and source of the content.", "type": "Labelling AI content", "status": "applies now", "applies_from": "2026-02-20", "url": "https://wheresthe.ai/id/WTA-R-IN-0006-011/", "rule": { "record_id": "WTA-R-IN-0006", "id": "in-it-rules-amendment-sgi-2026", "title": "Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (synthetically generated information)", "jurisdiction": "IN", "jurisdiction_name": "India", "url": "https://wheresthe.ai/rule/in-it-rules-amendment-sgi-2026/" }, "penalty": "Loss of the safe-harbour exemption under section 79(1) of the IT Act and liability under applicable law, including the IT Act and the Bharatiya Nyaya Sanhita, 2023 (Rule 7).", "scope_note": "Applies to significant social media intermediaries (registered users in India above the threshold notified by the Central Government) that enable displaying, uploading or publishing information. The Explanation says the duty extends to reasonable and proportionate technical measures.", "date_note": "Amendment G.S.R. 120(E) dated 10 Feb 2026; in force 20 Feb 2026. Provision text checked on MeitY's consolidated Rules (updated 10.02.2026); the 20 Feb date is from a Shardul Amarchand Mangaldas note because the e-Gazette copy could not be fetched.", "source_url": "https://www.meity.gov.in/static/uploads/2026/02/550681ab908f8afb135b0ad42816a1c9.pdf#page=14", "verified_on": "2026-10-08", "citation": "WTA-R-IN-0006-011: Rule 4(1A)(b), Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (synthetically generated information). wheresthe.ai, https://wheresthe.ai/id/WTA-R-IN-0006-011/ (checked 2026-10-08)." }, { "record_id": "WTA-R-IN-0006-012", "provision": "Rule 4(1A)(c)", "applies_to": [ "Platforms" ], "duty": "Clearly and prominently label content as synthetically generated where the user declaration or technical verification confirms it, and publish no synthetic content without a declaration or label.", "type": "Labelling AI content", "status": "applies now", "applies_from": "2026-02-20", "url": "https://wheresthe.ai/id/WTA-R-IN-0006-012/", "rule": { "record_id": "WTA-R-IN-0006", "id": "in-it-rules-amendment-sgi-2026", "title": "Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (synthetically generated information)", "jurisdiction": "IN", "jurisdiction_name": "India", "url": "https://wheresthe.ai/rule/in-it-rules-amendment-sgi-2026/" }, "penalty": "Loss of the safe-harbour exemption under section 79(1) of the IT Act and liability under applicable law, including the IT Act and the Bharatiya Nyaya Sanhita, 2023 (Rule 7).", "scope_note": "Applies to significant social media intermediaries (registered users in India above the threshold notified by the Central Government) that enable displaying, uploading or publishing information. Under the proviso, an intermediary that knowingly permits, promotes or fails to act on SGI in breach of the Rules is deemed to have failed its due diligence.", "date_note": "Amendment G.S.R. 120(E) dated 10 Feb 2026; in force 20 Feb 2026. Provision text checked on MeitY's consolidated Rules (updated 10.02.2026); the 20 Feb date is from a Shardul Amarchand Mangaldas note because the e-Gazette copy could not be fetched.", "source_url": "https://www.meity.gov.in/static/uploads/2026/02/550681ab908f8afb135b0ad42816a1c9.pdf#page=14", "verified_on": "2026-10-08", "citation": "WTA-R-IN-0006-012: Rule 4(1A)(c), Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (synthetically generated information). wheresthe.ai, https://wheresthe.ai/id/WTA-R-IN-0006-012/ (checked 2026-10-08)." }, { "record_id": "WTA-R-IN-0006-013", "provision": "Rule 4(4)", "applies_to": [ "Platforms" ], "duty": "Deploy appropriate technical measures, including automated tools, to proactively identify content depicting rape or child sexual abuse, including simulations, and exact copies of removed content, and show a notice to users trying to access it.", "type": "Prohibited uses", "status": "applies now", "applies_from": "2026-02-20", "url": "https://wheresthe.ai/id/WTA-R-IN-0006-013/", "rule": { "record_id": "WTA-R-IN-0006", "id": "in-it-rules-amendment-sgi-2026", "title": "Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (synthetically generated information)", "jurisdiction": "IN", "jurisdiction_name": "India", "url": "https://wheresthe.ai/rule/in-it-rules-amendment-sgi-2026/" }, "penalty": "Loss of the safe-harbour exemption under section 79(1) of the IT Act and liability under applicable law, including the IT Act and the Bharatiya Nyaya Sanhita, 2023 (Rule 7).", "scope_note": "Applies to significant social media intermediaries (registered users in India above the threshold notified by the Central Government). The 2026 amendment replaced 'endeavour to deploy technology-based measures' with 'deploy appropriate technical measures'. Measures must be proportionate to free speech and privacy.", "date_note": "Amendment G.S.R. 120(E) dated 10 Feb 2026; in force 20 Feb 2026. Provision text checked on MeitY's consolidated Rules (updated 10.02.2026); the 20 Feb date is from a Shardul Amarchand Mangaldas note because the e-Gazette copy could not be fetched.", "source_url": "https://www.meity.gov.in/static/uploads/2026/02/550681ab908f8afb135b0ad42816a1c9.pdf#page=16", "verified_on": "2026-10-08", "citation": "WTA-R-IN-0006-013: Rule 4(4), Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (synthetically generated information). wheresthe.ai, https://wheresthe.ai/id/WTA-R-IN-0006-013/ (checked 2026-10-08)." }, { "record_id": "WTA-R-IN-0006-014", "provision": "Rule 4(4), second and third provisos", "applies_to": [ "Platforms" ], "duty": "Put appropriate human oversight on automated tools deployed under Rule 4(4), including periodic reviews of their accuracy, fairness, propensity for bias and discrimination, and privacy and security impact.", "type": "Human oversight", "status": "applies now", "applies_from": null, "url": "https://wheresthe.ai/id/WTA-R-IN-0006-014/", "rule": { "record_id": "WTA-R-IN-0006", "id": "in-it-rules-amendment-sgi-2026", "title": "Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (synthetically generated information)", "jurisdiction": "IN", "jurisdiction_name": "India", "url": "https://wheresthe.ai/rule/in-it-rules-amendment-sgi-2026/" }, "penalty": "Loss of the safe-harbour exemption under section 79(1) of the IT Act and liability under applicable law, including the IT Act and the Bharatiya Nyaya Sanhita, 2023 (Rule 7).", "scope_note": "Applies to significant social media intermediaries (registered users in India above the threshold notified by the Central Government).", "date_note": "Provisos unchanged since the 2021 Rules; the 2026 amendment (in force 20 Feb 2026) changed the main Rule 4(4) duty from 'endeavour to deploy' to 'deploy'.", "source_url": "https://www.meity.gov.in/static/uploads/2026/02/550681ab908f8afb135b0ad42816a1c9.pdf#page=16", "verified_on": "2026-10-08", "citation": "WTA-R-IN-0006-014: Rule 4(4), second and third provisos, Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (synthetically generated information). wheresthe.ai, https://wheresthe.ai/id/WTA-R-IN-0006-014/ (checked 2026-10-08)." }, { "record_id": "WTA-R-IN-0003-001", "provision": "Regulation 16C(1)(a)", "applies_to": [ "Deployers" ], "duty": "Take sole responsibility for the privacy, security and integrity of investor and stakeholder data, including data held in a fiduciary capacity, throughout any processes using AI or machine learning tools.", "type": "Data governance", "status": "applies now", "applies_from": "2025-02-10", "url": "https://wheresthe.ai/id/WTA-R-IN-0003-001/", "rule": { "record_id": "WTA-R-IN-0003", "id": "in-sebi-ai-responsibility-reg-16c-2025", "title": "SEBI (Intermediaries) (Amendment) Regulations, 2025 – Regulation 16C: Responsibility for the use of artificial intelligence", "jurisdiction": "IN", "jurisdiction_name": "India", "url": "https://wheresthe.ai/rule/in-sebi-ai-responsibility-reg-16c-2025/" }, "penalty": "Action as SEBI deems fit, including action under Chapter V of the Intermediaries Regulations, 2008 (Reg. 16C(2)).", "scope_note": "Applies to every 'person regulated by the Board' (Explanation 1 to Regulation 16A) using AI/ML tools, built in-house or procured from third parties, irrespective of scale. AI/ML tools include applications offered to investors or used internally, including for compliance.", "date_note": "Notification dated 6 Feb 2025; in force on publication in the Gazette on 10 Feb 2025 (Regulation 2).", "source_url": "https://www.sebi.gov.in/sebi_data/attachdocs/feb-2025/1739276753544.pdf#page=4", "verified_on": "2026-10-08", "citation": "WTA-R-IN-0003-001: Regulation 16C(1)(a), SEBI (Intermediaries) (Amendment) Regulations, 2025 – Regulation 16C: Responsibility for the use of artificial intelligence. wheresthe.ai, https://wheresthe.ai/id/WTA-R-IN-0003-001/ (checked 2026-10-08)." }, { "record_id": "WTA-R-IN-0003-002", "provision": "Regulation 16C(1)(b)", "applies_to": [ "Deployers" ], "duty": "Take sole responsibility for the output of AI or machine learning tools that you rely on or deal with, whether designed in-house or procured from third-party technology providers.", "type": "Human oversight", "status": "applies now", "applies_from": "2025-02-10", "url": "https://wheresthe.ai/id/WTA-R-IN-0003-002/", "rule": { "record_id": "WTA-R-IN-0003", "id": "in-sebi-ai-responsibility-reg-16c-2025", "title": "SEBI (Intermediaries) (Amendment) Regulations, 2025 – Regulation 16C: Responsibility for the use of artificial intelligence", "jurisdiction": "IN", "jurisdiction_name": "India", "url": "https://wheresthe.ai/rule/in-sebi-ai-responsibility-reg-16c-2025/" }, "penalty": "Action as SEBI deems fit, including action under Chapter V of the Intermediaries Regulations, 2008 (Reg. 16C(2)).", "scope_note": "Applies to every 'person regulated by the Board' (Explanation 1 to Regulation 16A) using AI/ML tools, built in-house or procured from third parties, irrespective of scale. AI/ML tools include applications offered to investors or used internally, including for compliance. The regulation assigns accountability for outputs but does not prescribe specific oversight measures.", "date_note": "Notification dated 6 Feb 2025; in force on publication in the Gazette on 10 Feb 2025 (Regulation 2).", "source_url": "https://www.sebi.gov.in/sebi_data/attachdocs/feb-2025/1739276753544.pdf#page=4", "verified_on": "2026-10-08", "citation": "WTA-R-IN-0003-002: Regulation 16C(1)(b), SEBI (Intermediaries) (Amendment) Regulations, 2025 – Regulation 16C: Responsibility for the use of artificial intelligence. wheresthe.ai, https://wheresthe.ai/id/WTA-R-IN-0003-002/ (checked 2026-10-08)." }, { "record_id": "WTA-R-IN-0003-003", "provision": "Regulation 16C(1)(c)", "applies_to": [ "Deployers" ], "duty": "Take sole responsibility for complying with all applicable laws in force when using AI or machine learning tools in your business or investor services.", "type": "Data governance", "status": "applies now", "applies_from": "2025-02-10", "url": "https://wheresthe.ai/id/WTA-R-IN-0003-003/", "rule": { "record_id": "WTA-R-IN-0003", "id": "in-sebi-ai-responsibility-reg-16c-2025", "title": "SEBI (Intermediaries) (Amendment) Regulations, 2025 – Regulation 16C: Responsibility for the use of artificial intelligence", "jurisdiction": "IN", "jurisdiction_name": "India", "url": "https://wheresthe.ai/rule/in-sebi-ai-responsibility-reg-16c-2025/" }, "penalty": "Action as SEBI deems fit, including action under Chapter V of the Intermediaries Regulations, 2008 (Reg. 16C(2)).", "scope_note": "Applies to every 'person regulated by the Board' (Explanation 1 to Regulation 16A) using AI/ML tools, built in-house or procured from third parties, irrespective of scale. AI/ML tools include applications offered to investors or used internally, including for compliance. No schema type matches a general legal-compliance duty, so it is classed as data-governance.", "date_note": "Notification dated 6 Feb 2025; in force on publication in the Gazette on 10 Feb 2025 (Regulation 2).", "source_url": "https://www.sebi.gov.in/sebi_data/attachdocs/feb-2025/1739276753544.pdf#page=4", "verified_on": "2026-10-08", "citation": "WTA-R-IN-0003-003: Regulation 16C(1)(c), SEBI (Intermediaries) (Amendment) Regulations, 2025 – Regulation 16C: Responsibility for the use of artificial intelligence. wheresthe.ai, https://wheresthe.ai/id/WTA-R-IN-0003-003/ (checked 2026-10-08)." }, { "record_id": "WTA-R-IN-0001-001", "provision": "Section 4(1)", "applies_to": [ "Developers", "Deployers" ], "duty": "Process personal data only for a lawful purpose, either with the Data Principal's consent or for one of the legitimate uses listed in section 7.", "type": "Data governance", "status": "applies later", "applies_from": "2027-05-13", "url": "https://wheresthe.ai/id/WTA-R-IN-0001-001/", "rule": { "record_id": "WTA-R-IN-0001", "id": "in-dpdp-act-2023-and-rules-2025", "title": "Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025", "jurisdiction": "IN", "jurisdiction_name": "India", "url": "https://wheresthe.ai/rule/in-dpdp-act-2023-and-rules-2025/" }, "penalty": "Up to INR 50 crore (Schedule, item 7).", "scope_note": "Applies to Data Fiduciaries (mapped here to AI developers and deployers that decide the purpose and means of processing). The Act does not apply to personal data made publicly available by the Data Principal or under a legal duty (s.3(c)(ii)).", "date_note": "Act sections 3 to 5, 6(1)-(8) and (10), and 7 to 17 commence 13 May 2027 (G.S.R. 843(E), per the India Code footnote to s.1(2)); Rules 3, 5 to 16, 22 and 23 commence 18 months after Gazette publication on 13 Nov 2025 (Rule 1(4)). Consent Manager provisions (s.6(9), Rule 4) commence 13 Nov 2026.", "source_url": "https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf#page=4", "verified_on": "2026-10-08", "citation": "WTA-R-IN-0001-001: Section 4(1), Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025. wheresthe.ai, https://wheresthe.ai/id/WTA-R-IN-0001-001/ (checked 2026-10-08)." }, { "record_id": "WTA-R-IN-0001-002", "provision": "Section 5(1); Rule 3", "applies_to": [ "Developers", "Deployers" ], "duty": "Give a standalone notice with or before every consent request, itemising the personal data and specified purpose, and explaining how to withdraw consent, exercise rights and complain to the Data Protection Board.", "type": "Transparency to users", "status": "applies later", "applies_from": "2027-05-13", "url": "https://wheresthe.ai/id/WTA-R-IN-0001-002/", "rule": { "record_id": "WTA-R-IN-0001", "id": "in-dpdp-act-2023-and-rules-2025", "title": "Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025", "jurisdiction": "IN", "jurisdiction_name": "India", "url": "https://wheresthe.ai/rule/in-dpdp-act-2023-and-rules-2025/" }, "penalty": "Up to INR 50 crore (Schedule, item 7).", "scope_note": "Applies to Data Fiduciaries (mapped here to AI developers and deployers that decide the purpose and means of processing). The Act does not apply to personal data made publicly available by the Data Principal or under a legal duty (s.3(c)(ii)). Rule 3 also requires a description of the goods, services or uses enabled and a link to the Data Fiduciary's website or app; s.5(3) requires an English or Eighth Schedule language option.", "date_note": "Act sections 3 to 5, 6(1)-(8) and (10), and 7 to 17 commence 13 May 2027 (G.S.R. 843(E), per the India Code footnote to s.1(2)); Rules 3, 5 to 16, 22 and 23 commence 18 months after Gazette publication on 13 Nov 2025 (Rule 1(4)). Consent Manager provisions (s.6(9), Rule 4) commence 13 Nov 2026.", "source_url": "https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf#page=4", "verified_on": "2026-10-08", "citation": "WTA-R-IN-0001-002: Section 5(1); Rule 3, Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025. wheresthe.ai, https://wheresthe.ai/id/WTA-R-IN-0001-002/ (checked 2026-10-08)." }, { "record_id": "WTA-R-IN-0001-003", "provision": "Section 5(2)", "applies_to": [ "Developers", "Deployers" ], "duty": "Give a notice, as soon as reasonably practicable, to people whose personal data you process on consent given before the Act commenced, describing the data, purpose, rights and complaint route.", "type": "Transparency to users", "status": "applies later", "applies_from": "2027-05-13", "url": "https://wheresthe.ai/id/WTA-R-IN-0001-003/", "rule": { "record_id": "WTA-R-IN-0001", "id": "in-dpdp-act-2023-and-rules-2025", "title": "Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025", "jurisdiction": "IN", "jurisdiction_name": "India", "url": "https://wheresthe.ai/rule/in-dpdp-act-2023-and-rules-2025/" }, "penalty": "Up to INR 50 crore (Schedule, item 7).", "scope_note": "Applies to Data Fiduciaries (mapped here to AI developers and deployers that decide the purpose and means of processing). The Act does not apply to personal data made publicly available by the Data Principal or under a legal duty (s.3(c)(ii)). Processing may continue until the Data Principal withdraws consent (s.5(2)(b)).", "date_note": "Act sections 3 to 5, 6(1)-(8) and (10), and 7 to 17 commence 13 May 2027 (G.S.R. 843(E), per the India Code footnote to s.1(2)); Rules 3, 5 to 16, 22 and 23 commence 18 months after Gazette publication on 13 Nov 2025 (Rule 1(4)). Consent Manager provisions (s.6(9), Rule 4) commence 13 Nov 2026.", "source_url": "https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf#page=4", "verified_on": "2026-10-08", "citation": "WTA-R-IN-0001-003: Section 5(2), Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025. wheresthe.ai, https://wheresthe.ai/id/WTA-R-IN-0001-003/ (checked 2026-10-08)." }, { "record_id": "WTA-R-IN-0001-004", "provision": "Section 6(1)", "applies_to": [ "Developers", "Deployers" ], "duty": "Rely only on consent that is free, specific, informed, unconditional and unambiguous, given by clear affirmative action, and limited to the personal data necessary for the specified purpose.", "type": "Data governance", "status": "applies later", "applies_from": "2027-05-13", "url": "https://wheresthe.ai/id/WTA-R-IN-0001-004/", "rule": { "record_id": "WTA-R-IN-0001", "id": "in-dpdp-act-2023-and-rules-2025", "title": "Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025", "jurisdiction": "IN", "jurisdiction_name": "India", "url": "https://wheresthe.ai/rule/in-dpdp-act-2023-and-rules-2025/" }, "penalty": "Up to INR 50 crore (Schedule, item 7).", "scope_note": "Applies to Data Fiduciaries (mapped here to AI developers and deployers that decide the purpose and means of processing). The Act does not apply to personal data made publicly available by the Data Principal or under a legal duty (s.3(c)(ii)). Under s.6(10) the Data Fiduciary must prove that notice was given and consent obtained.", "date_note": "Act sections 3 to 5, 6(1)-(8) and (10), and 7 to 17 commence 13 May 2027 (G.S.R. 843(E), per the India Code footnote to s.1(2)); Rules 3, 5 to 16, 22 and 23 commence 18 months after Gazette publication on 13 Nov 2025 (Rule 1(4)). Consent Manager provisions (s.6(9), Rule 4) commence 13 Nov 2026.", "source_url": "https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf#page=5", "verified_on": "2026-10-08", "citation": "WTA-R-IN-0001-004: Section 6(1), Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025. wheresthe.ai, https://wheresthe.ai/id/WTA-R-IN-0001-004/ (checked 2026-10-08)." }, { "record_id": "WTA-R-IN-0001-005", "provision": "Section 6(4) and 6(6)", "applies_to": [ "Developers", "Deployers" ], "duty": "Let Data Principals withdraw consent at any time as easily as they gave it, and then stop, and make your Data Processors stop, processing their personal data within a reasonable time.", "type": "Consumer rights", "status": "applies later", "applies_from": "2027-05-13", "url": "https://wheresthe.ai/id/WTA-R-IN-0001-005/", "rule": { "record_id": "WTA-R-IN-0001", "id": "in-dpdp-act-2023-and-rules-2025", "title": "Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025", "jurisdiction": "IN", "jurisdiction_name": "India", "url": "https://wheresthe.ai/rule/in-dpdp-act-2023-and-rules-2025/" }, "penalty": "Up to INR 50 crore (Schedule, item 7).", "scope_note": "Applies to Data Fiduciaries (mapped here to AI developers and deployers that decide the purpose and means of processing). The Act does not apply to personal data made publicly available by the Data Principal or under a legal duty (s.3(c)(ii)). Processing required or authorised by law may continue.", "date_note": "Act sections 3 to 5, 6(1)-(8) and (10), and 7 to 17 commence 13 May 2027 (G.S.R. 843(E), per the India Code footnote to s.1(2)); Rules 3, 5 to 16, 22 and 23 commence 18 months after Gazette publication on 13 Nov 2025 (Rule 1(4)). Consent Manager provisions (s.6(9), Rule 4) commence 13 Nov 2026.", "source_url": "https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf#page=5", "verified_on": "2026-10-08", "citation": "WTA-R-IN-0001-005: Section 6(4) and 6(6), Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025. wheresthe.ai, https://wheresthe.ai/id/WTA-R-IN-0001-005/ (checked 2026-10-08)." }, { "record_id": "WTA-R-IN-0001-006", "provision": "Section 8(3)", "applies_to": [ "Developers", "Deployers" ], "duty": "Ensure the completeness, accuracy and consistency of personal data that is likely to be used to make a decision affecting the Data Principal or to be disclosed to another Data Fiduciary.", "type": "Data governance", "status": "applies later", "applies_from": "2027-05-13", "url": "https://wheresthe.ai/id/WTA-R-IN-0001-006/", "rule": { "record_id": "WTA-R-IN-0001", "id": "in-dpdp-act-2023-and-rules-2025", "title": "Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025", "jurisdiction": "IN", "jurisdiction_name": "India", "url": "https://wheresthe.ai/rule/in-dpdp-act-2023-and-rules-2025/" }, "penalty": "Up to INR 50 crore (Schedule, item 7).", "scope_note": "Applies to Data Fiduciaries (mapped here to AI developers and deployers that decide the purpose and means of processing). The Act does not apply to personal data made publicly available by the Data Principal or under a legal duty (s.3(c)(ii)). The provision is technology-neutral and does not mention automated decisions specifically.", "date_note": "Act sections 3 to 5, 6(1)-(8) and (10), and 7 to 17 commence 13 May 2027 (G.S.R. 843(E), per the India Code footnote to s.1(2)); Rules 3, 5 to 16, 22 and 23 commence 18 months after Gazette publication on 13 Nov 2025 (Rule 1(4)). Consent Manager provisions (s.6(9), Rule 4) commence 13 Nov 2026.", "source_url": "https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf#page=7", "verified_on": "2026-10-08", "citation": "WTA-R-IN-0001-006: Section 8(3), Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025. wheresthe.ai, https://wheresthe.ai/id/WTA-R-IN-0001-006/ (checked 2026-10-08)." }, { "record_id": "WTA-R-IN-0001-007", "provision": "Section 8(5); Rule 6", "applies_to": [ "Developers", "Deployers" ], "duty": "Protect personal data with reasonable security safeguards, including encryption or masking, access controls, logging and monitoring, backups, one-year retention of logs, and security clauses in Data Processor contracts.", "type": "Data governance", "status": "applies later", "applies_from": "2027-05-13", "url": "https://wheresthe.ai/id/WTA-R-IN-0001-007/", "rule": { "record_id": "WTA-R-IN-0001", "id": "in-dpdp-act-2023-and-rules-2025", "title": "Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025", "jurisdiction": "IN", "jurisdiction_name": "India", "url": "https://wheresthe.ai/rule/in-dpdp-act-2023-and-rules-2025/" }, "penalty": "Up to INR 250 crore (Schedule, item 1).", "scope_note": "Applies to Data Fiduciaries (mapped here to AI developers and deployers that decide the purpose and means of processing). The Act does not apply to personal data made publicly available by the Data Principal or under a legal duty (s.3(c)(ii)). Rule 6(1) lists these as minimum safeguards; they also cover processing by Data Processors.", "date_note": "Act sections 3 to 5, 6(1)-(8) and (10), and 7 to 17 commence 13 May 2027 (G.S.R. 843(E), per the India Code footnote to s.1(2)); Rules 3, 5 to 16, 22 and 23 commence 18 months after Gazette publication on 13 Nov 2025 (Rule 1(4)). Consent Manager provisions (s.6(9), Rule 4) commence 13 Nov 2026.", "source_url": "https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf#page=7", "verified_on": "2026-10-08", "citation": "WTA-R-IN-0001-007: Section 8(5); Rule 6, Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025. wheresthe.ai, https://wheresthe.ai/id/WTA-R-IN-0001-007/ (checked 2026-10-08)." }, { "record_id": "WTA-R-IN-0001-008", "provision": "Section 8(6); Rule 7(1)", "applies_to": [ "Developers", "Deployers" ], "duty": "Tell each affected Data Principal about a personal data breach without delay, describing the breach, likely consequences, mitigation measures, steps they can take, and a contact person.", "type": "Incident reporting", "status": "applies later", "applies_from": "2027-05-13", "url": "https://wheresthe.ai/id/WTA-R-IN-0001-008/", "rule": { "record_id": "WTA-R-IN-0001", "id": "in-dpdp-act-2023-and-rules-2025", "title": "Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025", "jurisdiction": "IN", "jurisdiction_name": "India", "url": "https://wheresthe.ai/rule/in-dpdp-act-2023-and-rules-2025/" }, "penalty": "Up to INR 200 crore (Schedule, item 2).", "scope_note": "Applies to Data Fiduciaries (mapped here to AI developers and deployers that decide the purpose and means of processing). The Act does not apply to personal data made publicly available by the Data Principal or under a legal duty (s.3(c)(ii)).", "date_note": "Act sections 3 to 5, 6(1)-(8) and (10), and 7 to 17 commence 13 May 2027 (G.S.R. 843(E), per the India Code footnote to s.1(2)); Rules 3, 5 to 16, 22 and 23 commence 18 months after Gazette publication on 13 Nov 2025 (Rule 1(4)). Consent Manager provisions (s.6(9), Rule 4) commence 13 Nov 2026.", "source_url": "https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf#page=26", "verified_on": "2026-10-08", "citation": "WTA-R-IN-0001-008: Section 8(6); Rule 7(1), Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025. wheresthe.ai, https://wheresthe.ai/id/WTA-R-IN-0001-008/ (checked 2026-10-08)." }, { "record_id": "WTA-R-IN-0001-009", "provision": "Section 8(6); Rule 7(2)", "applies_to": [ "Developers", "Deployers" ], "duty": "Report a personal data breach to the Data Protection Board without delay, then give a detailed report within 72 hours covering causes, mitigation, findings on who caused it, remedial measures and notices sent.", "type": "Incident reporting", "status": "applies later", "applies_from": "2027-05-13", "url": "https://wheresthe.ai/id/WTA-R-IN-0001-009/", "rule": { "record_id": "WTA-R-IN-0001", "id": "in-dpdp-act-2023-and-rules-2025", "title": "Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025", "jurisdiction": "IN", "jurisdiction_name": "India", "url": "https://wheresthe.ai/rule/in-dpdp-act-2023-and-rules-2025/" }, "penalty": "Up to INR 200 crore (Schedule, item 2).", "scope_note": "Applies to Data Fiduciaries (mapped here to AI developers and deployers that decide the purpose and means of processing). The Act does not apply to personal data made publicly available by the Data Principal or under a legal duty (s.3(c)(ii)). The Board may allow a longer period on written request (Rule 7(2)(b)).", "date_note": "Act sections 3 to 5, 6(1)-(8) and (10), and 7 to 17 commence 13 May 2027 (G.S.R. 843(E), per the India Code footnote to s.1(2)); Rules 3, 5 to 16, 22 and 23 commence 18 months after Gazette publication on 13 Nov 2025 (Rule 1(4)). Consent Manager provisions (s.6(9), Rule 4) commence 13 Nov 2026.", "source_url": "https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf#page=26", "verified_on": "2026-10-08", "citation": "WTA-R-IN-0001-009: Section 8(6); Rule 7(2), Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025. wheresthe.ai, https://wheresthe.ai/id/WTA-R-IN-0001-009/ (checked 2026-10-08)." }, { "record_id": "WTA-R-IN-0001-010", "provision": "Section 8(7); Rule 8", "applies_to": [ "Developers", "Deployers" ], "duty": "Erase personal data, and make your Data Processors erase it, when consent is withdrawn or the specified purpose is no longer served, unless the law requires you to keep it.", "type": "Data governance", "status": "applies later", "applies_from": "2027-05-13", "url": "https://wheresthe.ai/id/WTA-R-IN-0001-010/", "rule": { "record_id": "WTA-R-IN-0001", "id": "in-dpdp-act-2023-and-rules-2025", "title": "Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025", "jurisdiction": "IN", "jurisdiction_name": "India", "url": "https://wheresthe.ai/rule/in-dpdp-act-2023-and-rules-2025/" }, "penalty": "Up to INR 50 crore (Schedule, item 7).", "scope_note": "Applies to Data Fiduciaries (mapped here to AI developers and deployers that decide the purpose and means of processing). The Act does not apply to personal data made publicly available by the Data Principal or under a legal duty (s.3(c)(ii)). Rule 8 and the Third Schedule set deemed periods for specified classes, with 48 hours' notice before erasure; Rule 8(3) requires keeping data and processing logs for at least one year.", "date_note": "Act sections 3 to 5, 6(1)-(8) and (10), and 7 to 17 commence 13 May 2027 (G.S.R. 843(E), per the India Code footnote to s.1(2)); Rules 3, 5 to 16, 22 and 23 commence 18 months after Gazette publication on 13 Nov 2025 (Rule 1(4)). Consent Manager provisions (s.6(9), Rule 4) commence 13 Nov 2026.", "source_url": "https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf#page=7", "verified_on": "2026-10-08", "citation": "WTA-R-IN-0001-010: Section 8(7); Rule 8, Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025. wheresthe.ai, https://wheresthe.ai/id/WTA-R-IN-0001-010/ (checked 2026-10-08)." }, { "record_id": "WTA-R-IN-0001-011", "provision": "Section 12(3)", "applies_to": [ "Developers", "Deployers" ], "duty": "Erase a Data Principal's personal data on request unless keeping it is necessary for the specified purpose or to comply with law.", "type": "Consumer rights", "status": "applies later", "applies_from": "2027-05-13", "url": "https://wheresthe.ai/id/WTA-R-IN-0001-011/", "rule": { "record_id": "WTA-R-IN-0001", "id": "in-dpdp-act-2023-and-rules-2025", "title": "Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025", "jurisdiction": "IN", "jurisdiction_name": "India", "url": "https://wheresthe.ai/rule/in-dpdp-act-2023-and-rules-2025/" }, "penalty": "Up to INR 50 crore (Schedule, item 7).", "scope_note": "Applies to Data Fiduciaries (mapped here to AI developers and deployers that decide the purpose and means of processing). The Act does not apply to personal data made publicly available by the Data Principal or under a legal duty (s.3(c)(ii)). The right covers data processed on consent, including under s.7(a). Rule 14(3) sets a grievance response period not exceeding 90 days.", "date_note": "Act sections 3 to 5, 6(1)-(8) and (10), and 7 to 17 commence 13 May 2027 (G.S.R. 843(E), per the India Code footnote to s.1(2)); Rules 3, 5 to 16, 22 and 23 commence 18 months after Gazette publication on 13 Nov 2025 (Rule 1(4)). Consent Manager provisions (s.6(9), Rule 4) commence 13 Nov 2026.", "source_url": "https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf#page=10", "verified_on": "2026-10-08", "citation": "WTA-R-IN-0001-011: Section 12(3), Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025. wheresthe.ai, https://wheresthe.ai/id/WTA-R-IN-0001-011/ (checked 2026-10-08)." }, { "record_id": "WTA-R-IN-0001-012", "provision": "Section 9(1); Rule 10", "applies_to": [ "Developers", "Deployers" ], "duty": "Obtain verifiable parental consent before processing a child's personal data, checking through reliable identity and age details or an authorised virtual token that the parent is an identifiable adult.", "type": "Data governance", "status": "applies later", "applies_from": "2027-05-13", "url": "https://wheresthe.ai/id/WTA-R-IN-0001-012/", "rule": { "record_id": "WTA-R-IN-0001", "id": "in-dpdp-act-2023-and-rules-2025", "title": "Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025", "jurisdiction": "IN", "jurisdiction_name": "India", "url": "https://wheresthe.ai/rule/in-dpdp-act-2023-and-rules-2025/" }, "penalty": "Up to INR 200 crore (Schedule, item 3).", "scope_note": "Applies to Data Fiduciaries (mapped here to AI developers and deployers that decide the purpose and means of processing). The Act does not apply to personal data made publicly available by the Data Principal or under a legal duty (s.3(c)(ii)). A child is anyone under 18 (s.2(f)). Rule 12 and the Fourth Schedule exempt specified classes and purposes.", "date_note": "Act sections 3 to 5, 6(1)-(8) and (10), and 7 to 17 commence 13 May 2027 (G.S.R. 843(E), per the India Code footnote to s.1(2)); Rules 3, 5 to 16, 22 and 23 commence 18 months after Gazette publication on 13 Nov 2025 (Rule 1(4)). Consent Manager provisions (s.6(9), Rule 4) commence 13 Nov 2026.", "source_url": "https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf#page=27", "verified_on": "2026-10-08", "citation": "WTA-R-IN-0001-012: Section 9(1); Rule 10, Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025. wheresthe.ai, https://wheresthe.ai/id/WTA-R-IN-0001-012/ (checked 2026-10-08)." }, { "record_id": "WTA-R-IN-0001-013", "provision": "Section 9(2)", "applies_to": [ "Developers", "Deployers" ], "duty": "Do not process personal data in any way likely to have a detrimental effect on a child's well-being.", "type": "Prohibited uses", "status": "applies later", "applies_from": "2027-05-13", "url": "https://wheresthe.ai/id/WTA-R-IN-0001-013/", "rule": { "record_id": "WTA-R-IN-0001", "id": "in-dpdp-act-2023-and-rules-2025", "title": "Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025", "jurisdiction": "IN", "jurisdiction_name": "India", "url": "https://wheresthe.ai/rule/in-dpdp-act-2023-and-rules-2025/" }, "penalty": "Up to INR 200 crore (Schedule, item 3).", "scope_note": "Applies to Data Fiduciaries (mapped here to AI developers and deployers that decide the purpose and means of processing). The Act does not apply to personal data made publicly available by the Data Principal or under a legal duty (s.3(c)(ii)). A child is anyone under 18 (s.2(f)). The Act does not define 'detrimental effect'.", "date_note": "Act sections 3 to 5, 6(1)-(8) and (10), and 7 to 17 commence 13 May 2027 (G.S.R. 843(E), per the India Code footnote to s.1(2)); Rules 3, 5 to 16, 22 and 23 commence 18 months after Gazette publication on 13 Nov 2025 (Rule 1(4)). Consent Manager provisions (s.6(9), Rule 4) commence 13 Nov 2026.", "source_url": "https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf#page=8", "verified_on": "2026-10-08", "citation": "WTA-R-IN-0001-013: Section 9(2), Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025. wheresthe.ai, https://wheresthe.ai/id/WTA-R-IN-0001-013/ (checked 2026-10-08)." }, { "record_id": "WTA-R-IN-0001-014", "provision": "Section 9(3)", "applies_to": [ "Developers", "Deployers" ], "duty": "Do not track or behaviourally monitor children, or direct targeted advertising at them.", "type": "Prohibited uses", "status": "applies later", "applies_from": "2027-05-13", "url": "https://wheresthe.ai/id/WTA-R-IN-0001-014/", "rule": { "record_id": "WTA-R-IN-0001", "id": "in-dpdp-act-2023-and-rules-2025", "title": "Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025", "jurisdiction": "IN", "jurisdiction_name": "India", "url": "https://wheresthe.ai/rule/in-dpdp-act-2023-and-rules-2025/" }, "penalty": "Up to INR 200 crore (Schedule, item 3).", "scope_note": "Applies to Data Fiduciaries (mapped here to AI developers and deployers that decide the purpose and means of processing). The Act does not apply to personal data made publicly available by the Data Principal or under a legal duty (s.3(c)(ii)). A child is anyone under 18 (s.2(f)). Exemptions for classes and purposes in s.9(4), Rule 12 and the Fourth Schedule.", "date_note": "Act sections 3 to 5, 6(1)-(8) and (10), and 7 to 17 commence 13 May 2027 (G.S.R. 843(E), per the India Code footnote to s.1(2)); Rules 3, 5 to 16, 22 and 23 commence 18 months after Gazette publication on 13 Nov 2025 (Rule 1(4)). Consent Manager provisions (s.6(9), Rule 4) commence 13 Nov 2026.", "source_url": "https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf#page=8", "verified_on": "2026-10-08", "citation": "WTA-R-IN-0001-014: Section 9(3), Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025. wheresthe.ai, https://wheresthe.ai/id/WTA-R-IN-0001-014/ (checked 2026-10-08)." }, { "record_id": "WTA-R-IN-0001-015", "provision": "Section 10(2)(b) and (c); Rule 13(1) and (2)", "applies_to": [ "Developers", "Deployers" ], "duty": "Carry out a Data Protection Impact Assessment and an audit every twelve months, and have the assessor submit a report of significant observations to the Data Protection Board.", "type": "Impact assessment", "status": "applies later", "applies_from": "2027-05-13", "url": "https://wheresthe.ai/id/WTA-R-IN-0001-015/", "rule": { "record_id": "WTA-R-IN-0001", "id": "in-dpdp-act-2023-and-rules-2025", "title": "Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025", "jurisdiction": "IN", "jurisdiction_name": "India", "url": "https://wheresthe.ai/rule/in-dpdp-act-2023-and-rules-2025/" }, "penalty": "Up to INR 150 crore (Schedule, item 4).", "scope_note": "Applies to Data Fiduciaries (mapped here to AI developers and deployers that decide the purpose and means of processing). The Act does not apply to personal data made publicly available by the Data Principal or under a legal duty (s.3(c)(ii)). Applies only to Significant Data Fiduciaries notified by the Central Government under s.10(1). Section 10(2) also requires a Data Protection Officer based in India and an independent data auditor.", "date_note": "Act sections 3 to 5, 6(1)-(8) and (10), and 7 to 17 commence 13 May 2027 (G.S.R. 843(E), per the India Code footnote to s.1(2)); Rules 3, 5 to 16, 22 and 23 commence 18 months after Gazette publication on 13 Nov 2025 (Rule 1(4)). Consent Manager provisions (s.6(9), Rule 4) commence 13 Nov 2026.", "source_url": "https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf#page=29", "verified_on": "2026-10-08", "citation": "WTA-R-IN-0001-015: Section 10(2)(b) and (c); Rule 13(1) and (2), Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025. wheresthe.ai, https://wheresthe.ai/id/WTA-R-IN-0001-015/ (checked 2026-10-08)." }, { "record_id": "WTA-R-IN-0001-016", "provision": "Rule 13(3)", "applies_to": [ "Developers", "Deployers" ], "duty": "Exercise due diligence to verify that technical measures, including algorithmic software, used to process personal data are not likely to pose a risk to the rights of Data Principals.", "type": "Impact assessment", "status": "applies later", "applies_from": "2027-05-13", "url": "https://wheresthe.ai/id/WTA-R-IN-0001-016/", "rule": { "record_id": "WTA-R-IN-0001", "id": "in-dpdp-act-2023-and-rules-2025", "title": "Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025", "jurisdiction": "IN", "jurisdiction_name": "India", "url": "https://wheresthe.ai/rule/in-dpdp-act-2023-and-rules-2025/" }, "penalty": "The Schedule does not name Rule 13: s.10 breaches carry up to INR 150 crore (item 4); other breaches of the Act or Rules up to INR 50 crore (item 7).", "scope_note": "Applies to Data Fiduciaries (mapped here to AI developers and deployers that decide the purpose and means of processing). The Act does not apply to personal data made publicly available by the Data Principal or under a legal duty (s.3(c)(ii)). Applies only to Significant Data Fiduciaries notified by the Central Government under s.10(1). Covers software used for hosting, display, uploading, modification, publishing, transmission, storage, updating or sharing of personal data.", "date_note": "Act sections 3 to 5, 6(1)-(8) and (10), and 7 to 17 commence 13 May 2027 (G.S.R. 843(E), per the India Code footnote to s.1(2)); Rules 3, 5 to 16, 22 and 23 commence 18 months after Gazette publication on 13 Nov 2025 (Rule 1(4)). Consent Manager provisions (s.6(9), Rule 4) commence 13 Nov 2026.", "source_url": "https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf#page=29", "verified_on": "2026-10-08", "citation": "WTA-R-IN-0001-016: Rule 13(3), Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025. wheresthe.ai, https://wheresthe.ai/id/WTA-R-IN-0001-016/ (checked 2026-10-08)." }, { "record_id": "WTA-R-GB-0003-001", "provision": "Article 22A(2)", "applies_to": [ "Deployers" ], "duty": "Consider, among other things, the extent to which a decision is reached by profiling when judging whether there is meaningful human involvement in it.", "type": "Human oversight", "status": "applies now", "applies_from": "2026-02-05", "url": "https://wheresthe.ai/id/WTA-R-GB-0003-001/", "rule": { "record_id": "WTA-R-GB-0003", "id": "gb-data-use-and-access-act-2025-automated-decisions", "title": "Data (Use and Access) Act 2025, section 80 and Schedule 6 - Automated decision-making", "jurisdiction": "GB", "jurisdiction_name": "United Kingdom", "url": "https://wheresthe.ai/rule/gb-data-use-and-access-act-2025-automated-decisions/" }, "penalty": "Not fined on its own; breaches of Articles 22B or 22C attract up to GBP 17.5m or 4% of turnover (Art. 83(5)(ba)).", "scope_note": "The duty falls on any 'person' assessing meaningful human involvement. Applies to controllers taking significant decisions (legal or similarly significant effect) based solely on automated processing, meaning with no meaningful human involvement (Art. 22A(1)). The Secretary of State may add or refine rules by regulations (Art. 22D).", "date_note": "Section 80 commenced 5 Feb 2026 (SI 2026/82, reg. 2(j)); reg. 5 saves decisions taken before that date to which old Article 22(3) applied.", "source_url": "https://www.legislation.gov.uk/eur/2016/679/article/22A", "verified_on": "2026-10-08", "citation": "WTA-R-GB-0003-001: Article 22A(2), Data (Use and Access) Act 2025, section 80 and Schedule 6 - Automated decision-making. wheresthe.ai, https://wheresthe.ai/id/WTA-R-GB-0003-001/ (checked 2026-10-08)." }, { "record_id": "WTA-R-GB-0003-002", "provision": "Article 22B(1)-(3)", "applies_to": [ "Deployers" ], "duty": "Do not take a solely automated significant decision based wholly or partly on special category data unless the data subject explicitly consented, or it is needed for a contract or required or authorised by law and Article 9(2)(g) applies.", "type": "Prohibited uses", "status": "applies now", "applies_from": "2026-02-05", "url": "https://wheresthe.ai/id/WTA-R-GB-0003-002/", "rule": { "record_id": "WTA-R-GB-0003", "id": "gb-data-use-and-access-act-2025-automated-decisions", "title": "Data (Use and Access) Act 2025, section 80 and Schedule 6 - Automated decision-making", "jurisdiction": "GB", "jurisdiction_name": "United Kingdom", "url": "https://wheresthe.ai/rule/gb-data-use-and-access-act-2025-automated-decisions/" }, "penalty": "Up to GBP 17.5m or 4% of total worldwide annual turnover, whichever is higher (UK GDPR Art. 83(5)(ba)).", "scope_note": "Applies to controllers taking significant decisions (legal or similarly significant effect) based solely on automated processing, meaning with no meaningful human involvement (Art. 22A(1)). The Secretary of State may add or refine rules by regulations (Art. 22D). The explicit consent condition requires the decision to be based entirely on data covered by that consent (Art. 22B(2)).", "date_note": "Section 80 commenced 5 Feb 2026 (SI 2026/82, reg. 2(j)); reg. 5 saves decisions taken before that date to which old Article 22(3) applied.", "source_url": "https://www.legislation.gov.uk/eur/2016/679/article/22B", "verified_on": "2026-10-08", "citation": "WTA-R-GB-0003-002: Article 22B(1)-(3), Data (Use and Access) Act 2025, section 80 and Schedule 6 - Automated decision-making. wheresthe.ai, https://wheresthe.ai/id/WTA-R-GB-0003-002/ (checked 2026-10-08)." }, { "record_id": "WTA-R-GB-0003-003", "provision": "Article 22B(4)", "applies_to": [ "Deployers" ], "duty": "Do not take a significant decision based solely on automated processing where the processing for that decision relies wholly or partly on recognised legitimate interests under Article 6(1)(ea).", "type": "Prohibited uses", "status": "applies now", "applies_from": "2026-02-05", "url": "https://wheresthe.ai/id/WTA-R-GB-0003-003/", "rule": { "record_id": "WTA-R-GB-0003", "id": "gb-data-use-and-access-act-2025-automated-decisions", "title": "Data (Use and Access) Act 2025, section 80 and Schedule 6 - Automated decision-making", "jurisdiction": "GB", "jurisdiction_name": "United Kingdom", "url": "https://wheresthe.ai/rule/gb-data-use-and-access-act-2025-automated-decisions/" }, "penalty": "Up to GBP 17.5m or 4% of total worldwide annual turnover, whichever is higher (UK GDPR Art. 83(5)(ba)).", "scope_note": "Applies to controllers taking significant decisions (legal or similarly significant effect) based solely on automated processing, meaning with no meaningful human involvement (Art. 22A(1)). The Secretary of State may add or refine rules by regulations (Art. 22D).", "date_note": "Section 80 commenced 5 Feb 2026 (SI 2026/82, reg. 2(j)); reg. 5 saves decisions taken before that date to which old Article 22(3) applied.", "source_url": "https://www.legislation.gov.uk/eur/2016/679/article/22B", "verified_on": "2026-10-08", "citation": "WTA-R-GB-0003-003: Article 22B(4), Data (Use and Access) Act 2025, section 80 and Schedule 6 - Automated decision-making. wheresthe.ai, https://wheresthe.ai/id/WTA-R-GB-0003-003/ (checked 2026-10-08)." }, { "record_id": "WTA-R-GB-0003-004", "provision": "Article 22C(1) and (2)(a)", "applies_to": [ "Deployers" ], "duty": "Give data subjects information about significant decisions taken about them based solely on automated processing of personal data.", "type": "Transparency to users", "status": "applies now", "applies_from": "2026-02-05", "url": "https://wheresthe.ai/id/WTA-R-GB-0003-004/", "rule": { "record_id": "WTA-R-GB-0003", "id": "gb-data-use-and-access-act-2025-automated-decisions", "title": "Data (Use and Access) Act 2025, section 80 and Schedule 6 - Automated decision-making", "jurisdiction": "GB", "jurisdiction_name": "United Kingdom", "url": "https://wheresthe.ai/rule/gb-data-use-and-access-act-2025-automated-decisions/" }, "penalty": "Up to GBP 17.5m or 4% of total worldwide annual turnover, whichever is higher (UK GDPR Art. 83(5)(ba)).", "scope_note": "Applies to controllers taking significant decisions (legal or similarly significant effect) based solely on automated processing, meaning with no meaningful human involvement (Art. 22A(1)). The Secretary of State may add or refine rules by regulations (Art. 22D).", "date_note": "Section 80 commenced 5 Feb 2026 (SI 2026/82, reg. 2(j)); reg. 5 saves decisions taken before that date to which old Article 22(3) applied.", "source_url": "https://www.legislation.gov.uk/eur/2016/679/article/22C", "verified_on": "2026-10-08", "citation": "WTA-R-GB-0003-004: Article 22C(1) and (2)(a), Data (Use and Access) Act 2025, section 80 and Schedule 6 - Automated decision-making. wheresthe.ai, https://wheresthe.ai/id/WTA-R-GB-0003-004/ (checked 2026-10-08)." }, { "record_id": "WTA-R-GB-0003-005", "provision": "Article 22C(1) and (2)(b)", "applies_to": [ "Deployers" ], "duty": "Enable data subjects to make representations about significant decisions taken about them based solely on automated processing of personal data.", "type": "Consumer rights", "status": "applies now", "applies_from": "2026-02-05", "url": "https://wheresthe.ai/id/WTA-R-GB-0003-005/", "rule": { "record_id": "WTA-R-GB-0003", "id": "gb-data-use-and-access-act-2025-automated-decisions", "title": "Data (Use and Access) Act 2025, section 80 and Schedule 6 - Automated decision-making", "jurisdiction": "GB", "jurisdiction_name": "United Kingdom", "url": "https://wheresthe.ai/rule/gb-data-use-and-access-act-2025-automated-decisions/" }, "penalty": "Up to GBP 17.5m or 4% of total worldwide annual turnover, whichever is higher (UK GDPR Art. 83(5)(ba)).", "scope_note": "Applies to controllers taking significant decisions (legal or similarly significant effect) based solely on automated processing, meaning with no meaningful human involvement (Art. 22A(1)). The Secretary of State may add or refine rules by regulations (Art. 22D).", "date_note": "Section 80 commenced 5 Feb 2026 (SI 2026/82, reg. 2(j)); reg. 5 saves decisions taken before that date to which old Article 22(3) applied.", "source_url": "https://www.legislation.gov.uk/eur/2016/679/article/22C", "verified_on": "2026-10-08", "citation": "WTA-R-GB-0003-005: Article 22C(1) and (2)(b), Data (Use and Access) Act 2025, section 80 and Schedule 6 - Automated decision-making. wheresthe.ai, https://wheresthe.ai/id/WTA-R-GB-0003-005/ (checked 2026-10-08)." }, { "record_id": "WTA-R-GB-0003-006", "provision": "Article 22C(1) and (2)(c)", "applies_to": [ "Deployers" ], "duty": "Enable data subjects to obtain human intervention by the controller in significant decisions taken about them based solely on automated processing of personal data.", "type": "Human oversight", "status": "applies now", "applies_from": "2026-02-05", "url": "https://wheresthe.ai/id/WTA-R-GB-0003-006/", "rule": { "record_id": "WTA-R-GB-0003", "id": "gb-data-use-and-access-act-2025-automated-decisions", "title": "Data (Use and Access) Act 2025, section 80 and Schedule 6 - Automated decision-making", "jurisdiction": "GB", "jurisdiction_name": "United Kingdom", "url": "https://wheresthe.ai/rule/gb-data-use-and-access-act-2025-automated-decisions/" }, "penalty": "Up to GBP 17.5m or 4% of total worldwide annual turnover, whichever is higher (UK GDPR Art. 83(5)(ba)).", "scope_note": "Applies to controllers taking significant decisions (legal or similarly significant effect) based solely on automated processing, meaning with no meaningful human involvement (Art. 22A(1)). The Secretary of State may add or refine rules by regulations (Art. 22D).", "date_note": "Section 80 commenced 5 Feb 2026 (SI 2026/82, reg. 2(j)); reg. 5 saves decisions taken before that date to which old Article 22(3) applied.", "source_url": "https://www.legislation.gov.uk/eur/2016/679/article/22C", "verified_on": "2026-10-08", "citation": "WTA-R-GB-0003-006: Article 22C(1) and (2)(c), Data (Use and Access) Act 2025, section 80 and Schedule 6 - Automated decision-making. wheresthe.ai, https://wheresthe.ai/id/WTA-R-GB-0003-006/ (checked 2026-10-08)." }, { "record_id": "WTA-R-GB-0003-007", "provision": "Article 22C(1) and (2)(d)", "applies_to": [ "Deployers" ], "duty": "Enable data subjects to contest significant decisions taken about them based solely on automated processing of personal data.", "type": "Consumer rights", "status": "applies now", "applies_from": "2026-02-05", "url": "https://wheresthe.ai/id/WTA-R-GB-0003-007/", "rule": { "record_id": "WTA-R-GB-0003", "id": "gb-data-use-and-access-act-2025-automated-decisions", "title": "Data (Use and Access) Act 2025, section 80 and Schedule 6 - Automated decision-making", "jurisdiction": "GB", "jurisdiction_name": "United Kingdom", "url": "https://wheresthe.ai/rule/gb-data-use-and-access-act-2025-automated-decisions/" }, "penalty": "Up to GBP 17.5m or 4% of total worldwide annual turnover, whichever is higher (UK GDPR Art. 83(5)(ba)).", "scope_note": "Applies to controllers taking significant decisions (legal or similarly significant effect) based solely on automated processing, meaning with no meaningful human involvement (Art. 22A(1)). The Secretary of State may add or refine rules by regulations (Art. 22D).", "date_note": "Section 80 commenced 5 Feb 2026 (SI 2026/82, reg. 2(j)); reg. 5 saves decisions taken before that date to which old Article 22(3) applied.", "source_url": "https://www.legislation.gov.uk/eur/2016/679/article/22C", "verified_on": "2026-10-08", "citation": "WTA-R-GB-0003-007: Article 22C(1) and (2)(d), Data (Use and Access) Act 2025, section 80 and Schedule 6 - Automated decision-making. wheresthe.ai, https://wheresthe.ai/id/WTA-R-GB-0003-007/ (checked 2026-10-08)." }, { "record_id": "WTA-R-GB-0003-008", "provision": "Article 13(2)(f) and Article 14(2)(g)", "applies_to": [ "Deployers" ], "duty": "Tell data subjects about automated decision-making that is subject to Article 22C safeguards, with meaningful information about the logic involved and its significance and envisaged consequences.", "type": "Transparency to users", "status": "applies now", "applies_from": "2026-02-05", "url": "https://wheresthe.ai/id/WTA-R-GB-0003-008/", "rule": { "record_id": "WTA-R-GB-0003", "id": "gb-data-use-and-access-act-2025-automated-decisions", "title": "Data (Use and Access) Act 2025, section 80 and Schedule 6 - Automated decision-making", "jurisdiction": "GB", "jurisdiction_name": "United Kingdom", "url": "https://wheresthe.ai/rule/gb-data-use-and-access-act-2025-automated-decisions/" }, "penalty": "Up to GBP 17.5m or 4% of total worldwide annual turnover, whichever is higher (UK GDPR Art. 83(5)(b)).", "scope_note": "Wording amended by DUAA 2025 Sch. 6 paras 3 and 4. Applies when data is collected from the data subject (Art. 13) or obtained elsewhere (Art. 14).", "date_note": "Section 80 commenced 5 Feb 2026 (SI 2026/82, reg. 2(j)); reg. 5 saves decisions taken before that date to which old Article 22(3) applied.", "source_url": "https://www.legislation.gov.uk/eur/2016/679/article/13", "verified_on": "2026-10-08", "citation": "WTA-R-GB-0003-008: Article 13(2)(f) and Article 14(2)(g), Data (Use and Access) Act 2025, section 80 and Schedule 6 - Automated decision-making. wheresthe.ai, https://wheresthe.ai/id/WTA-R-GB-0003-008/ (checked 2026-10-08)." }, { "record_id": "WTA-R-GB-0003-009", "provision": "Data Protection Act 2018, section 50C", "applies_to": [ "Public bodies" ], "duty": "Provide information, a route for representations, human intervention and a way to contest solely automated significant law-enforcement decisions, unless an exemption applies and the decision is promptly reconsidered with meaningful human involvement.", "type": "Human oversight", "status": "applies now", "applies_from": "2026-02-05", "url": "https://wheresthe.ai/id/WTA-R-GB-0003-009/", "rule": { "record_id": "WTA-R-GB-0003", "id": "gb-data-use-and-access-act-2025-automated-decisions", "title": "Data (Use and Access) Act 2025, section 80 and Schedule 6 - Automated decision-making", "jurisdiction": "GB", "jurisdiction_name": "United Kingdom", "url": "https://wheresthe.ai/rule/gb-data-use-and-access-act-2025-automated-decisions/" }, "penalty": "Higher maximum: GBP 17.5m or 4% of worldwide turnover for undertakings (DPA 2018 s.157(2)(a) and (5)).", "scope_note": "Applies to competent authorities processing for law enforcement purposes (DPA 2018 Part 3). 'Significant' means an adverse legal or similarly significant adverse effect (s.50A). Exemption reasons are listed in s.50C(4).", "date_note": "Section 80 commenced 5 Feb 2026 (SI 2026/82, reg. 2(j)); reg. 5 saves decisions taken before that date to which old Article 22(3) applied.", "source_url": "https://www.legislation.gov.uk/ukpga/2018/12/section/50C", "verified_on": "2026-10-08", "citation": "WTA-R-GB-0003-009: Data Protection Act 2018, section 50C, Data (Use and Access) Act 2025, section 80 and Schedule 6 - Automated decision-making. wheresthe.ai, https://wheresthe.ai/id/WTA-R-GB-0003-009/ (checked 2026-10-08)." }, { "record_id": "WTA-R-GB-0004-001", "provision": "Sexual Offences Act 2003, section 66E (inserted by s.138(2))", "applies_to": [ "Anyone" ], "duty": "Do not intentionally create an image that appears to be a photograph or film of an adult in an intimate state, but is not, without their consent or a reasonable belief that they consent.", "type": "Prohibited uses", "status": "applies now", "applies_from": "2026-02-06", "url": "https://wheresthe.ai/id/WTA-R-GB-0004-001/", "rule": { "record_id": "WTA-R-GB-0004", "id": "gb-duaa-2025-s138-purported-intimate-images", "title": "Data (Use and Access) Act 2025, section 138 - Creating, or requesting the creation of, purported intimate image of adult", "jurisdiction": "GB", "jurisdiction_name": "United Kingdom", "url": "https://wheresthe.ai/rule/gb-duaa-2025-s138-purported-intimate-images/" }, "penalty": "Summary offence: imprisonment up to the maximum term for summary offences (six months, or 51 weeks once CJA 2003 s.281(5) is in force), a fine, or both (s.66G(8)).", "scope_note": "England and Wales. The text does not mention AI; it covers any 'purported intimate image'. Defence of reasonable excuse (s.66E(5)). Modifications that add no intimate content and no other person are excluded (s.66E(4)).", "date_note": "Section 138 commenced 6 Feb 2026 (SI 2026/31, reg. 2).", "source_url": "https://www.legislation.gov.uk/ukpga/2003/42/section/66E", "verified_on": "2026-10-08", "citation": "WTA-R-GB-0004-001: Sexual Offences Act 2003, section 66E (inserted by s.138(2)), Data (Use and Access) Act 2025, section 138 - Creating, or requesting the creation of, purported intimate image of adult. wheresthe.ai, https://wheresthe.ai/id/WTA-R-GB-0004-001/ (checked 2026-10-08)." }, { "record_id": "WTA-R-GB-0004-002", "provision": "Sexual Offences Act 2003, section 66F (inserted by s.138(2))", "applies_to": [ "Anyone" ], "duty": "Do not intentionally request, privately or publicly, the creation of a purported intimate image of another adult, or ask for particular content in it, without their consent or a reasonable belief in consent.", "type": "Prohibited uses", "status": "applies now", "applies_from": "2026-02-06", "url": "https://wheresthe.ai/id/WTA-R-GB-0004-002/", "rule": { "record_id": "WTA-R-GB-0004", "id": "gb-duaa-2025-s138-purported-intimate-images", "title": "Data (Use and Access) Act 2025, section 138 - Creating, or requesting the creation of, purported intimate image of adult", "jurisdiction": "GB", "jurisdiction_name": "United Kingdom", "url": "https://wheresthe.ai/rule/gb-duaa-2025-s138-purported-intimate-images/" }, "penalty": "Summary offence: imprisonment up to the maximum term for summary offences (six months, or 51 weeks once CJA 2003 s.281(5) is in force), a fine, or both (s.66G(8)).", "scope_note": "England and Wales. The offence applies whether or not the image is created and wherever the recipients of the request are (s.66F(6)). Defence of reasonable excuse (s.66F(7)).", "date_note": "Section 138 commenced 6 Feb 2026 (SI 2026/31, reg. 2).", "source_url": "https://www.legislation.gov.uk/ukpga/2003/42/section/66F", "verified_on": "2026-10-08", "citation": "WTA-R-GB-0004-002: Sexual Offences Act 2003, section 66F (inserted by s.138(2)), Data (Use and Access) Act 2025, section 138 - Creating, or requesting the creation of, purported intimate image of adult. wheresthe.ai, https://wheresthe.ai/id/WTA-R-GB-0004-002/ (checked 2026-10-08)." }, { "record_id": "WTA-R-GB-0006-001", "provision": "Sexual Offences Act 2003, section 66I(1)(a) (inserted by s.99)", "applies_to": [ "Developers", "Providers" ], "duty": "Do not make or adapt a program, service or other thing for use as a generator of purported intimate images, judged by whether a reasonable person would consider it made for that use.", "type": "Prohibited uses", "status": "applies now", "applies_from": "2026-06-29", "url": "https://wheresthe.ai/id/WTA-R-GB-0006-001/", "rule": { "record_id": "WTA-R-GB-0006", "id": "gb-crime-and-policing-act-2026-ai-provisions", "title": "Crime and Policing Act 2026 - AI-related provisions (ss. 72-74 CSA image-generators; s. 99 purported intimate image generators; s. 248 power to amend Online Safety Act for AI)", "jurisdiction": "GB", "jurisdiction_name": "United Kingdom", "url": "https://wheresthe.ai/rule/gb-crime-and-policing-act-2026-ai-provisions/" }, "penalty": "On indictment up to 3 years' imprisonment, a fine or both; on summary conviction up to the general limit in a magistrates' court, a fine or both (s.66I(5)).", "scope_note": "England and Wales; also covers acts abroad by UK nationals and UK bodies (s.66I(6)). 'Thing' includes a program, electronic information and a service. Defence if all reasonable steps were taken to prevent non-consensual use (s.66I(4)); crime-prevention, intelligence and OFCOM defences (s.66J); ISP exemptions for conduit, caching and hosting with prompt removal on knowledge (s.66K); directors liable on consent or connivance (s.66L).", "date_note": "Section 99 commenced 29 Jun 2026 (SI 2026/689, reg. 2(1)(i)); Royal Assent 29 Apr 2026.", "source_url": "https://www.legislation.gov.uk/ukpga/2026/20/section/99", "verified_on": "2026-10-08", "citation": "WTA-R-GB-0006-001: Sexual Offences Act 2003, section 66I(1)(a) (inserted by s.99), Crime and Policing Act 2026 - AI-related provisions (ss. 72-74 CSA image-generators; s. 99 purported intimate image generators; s. 248 power to amend Online Safety Act for AI). wheresthe.ai, https://wheresthe.ai/id/WTA-R-GB-0006-001/ (checked 2026-10-08)." }, { "record_id": "WTA-R-GB-0006-002", "provision": "Sexual Offences Act 2003, section 66I(1)(b) (inserted by s.99)", "applies_to": [ "Providers", "Distributors", "Platforms" ], "duty": "Do not supply or offer to supply a program, service or other thing for use as a generator of purported intimate images, judged by whether a reasonable person would consider it supplied for that use.", "type": "Prohibited uses", "status": "applies now", "applies_from": "2026-06-29", "url": "https://wheresthe.ai/id/WTA-R-GB-0006-002/", "rule": { "record_id": "WTA-R-GB-0006", "id": "gb-crime-and-policing-act-2026-ai-provisions", "title": "Crime and Policing Act 2026 - AI-related provisions (ss. 72-74 CSA image-generators; s. 99 purported intimate image generators; s. 248 power to amend Online Safety Act for AI)", "jurisdiction": "GB", "jurisdiction_name": "United Kingdom", "url": "https://wheresthe.ai/rule/gb-crime-and-policing-act-2026-ai-provisions/" }, "penalty": "On indictment up to 3 years' imprisonment, a fine or both; on summary conviction up to the general limit in a magistrates' court, a fine or both (s.66I(5)).", "scope_note": "England and Wales; also covers acts abroad by UK nationals and UK bodies (s.66I(6)). 'Thing' includes a program, electronic information and a service. Defence if all reasonable steps were taken to prevent non-consensual use (s.66I(4)); crime-prevention, intelligence and OFCOM defences (s.66J); ISP exemptions for conduit, caching and hosting with prompt removal on knowledge (s.66K); directors liable on consent or connivance (s.66L).", "date_note": "Section 99 commenced 29 Jun 2026 (SI 2026/689, reg. 2(1)(i)); Royal Assent 29 Apr 2026.", "source_url": "https://www.legislation.gov.uk/ukpga/2026/20/section/99", "verified_on": "2026-10-08", "citation": "WTA-R-GB-0006-002: Sexual Offences Act 2003, section 66I(1)(b) (inserted by s.99), Crime and Policing Act 2026 - AI-related provisions (ss. 72-74 CSA image-generators; s. 99 purported intimate image generators; s. 248 power to amend Online Safety Act for AI). wheresthe.ai, https://wheresthe.ai/id/WTA-R-GB-0006-002/ (checked 2026-10-08)." }, { "record_id": "WTA-R-GB-0006-003", "provision": "Sexual Offences Act 2003, section 46A(1)(a) (inserted by s.72)", "applies_to": [ "Developers", "Providers" ], "duty": "Do not make or adapt a program, service or other thing for use for creating, or facilitating the creation of, child sexual abuse images.", "type": "Prohibited uses", "status": "applies later", "applies_from": null, "url": "https://wheresthe.ai/id/WTA-R-GB-0006-003/", "rule": { "record_id": "WTA-R-GB-0006", "id": "gb-crime-and-policing-act-2026-ai-provisions", "title": "Crime and Policing Act 2026 - AI-related provisions (ss. 72-74 CSA image-generators; s. 99 purported intimate image generators; s. 248 power to amend Online Safety Act for AI)", "jurisdiction": "GB", "jurisdiction_name": "United Kingdom", "url": "https://wheresthe.ai/rule/gb-crime-and-policing-act-2026-ai-provisions/" }, "penalty": "On indictment up to 5 years' imprisonment, a fine or both; on summary conviction up to the general limit in a magistrates' court, a fine or both (s.46A(5)).", "scope_note": "England and Wales. 'CSA image' means an indecent photograph or pseudo-photograph of a child or a prohibited image of a child; 'thing' includes a program, electronic information and a service. Defences in s.46A(2)-(3) and s.46B (crime prevention, intelligence, OFCOM); ISP exemptions with prompt removal on knowledge (s.46B(2)-(6)); directors liable on consent or connivance (s.46C).", "date_note": "Section 72 was not in force at Royal Assent (s.255(1)); legislation.gov.uk lists it as prospective with no commencement regulations as of 8 Oct 2026.", "source_url": "https://www.legislation.gov.uk/ukpga/2026/20/section/72", "verified_on": "2026-10-08", "citation": "WTA-R-GB-0006-003: Sexual Offences Act 2003, section 46A(1)(a) (inserted by s.72), Crime and Policing Act 2026 - AI-related provisions (ss. 72-74 CSA image-generators; s. 99 purported intimate image generators; s. 248 power to amend Online Safety Act for AI). wheresthe.ai, https://wheresthe.ai/id/WTA-R-GB-0006-003/ (checked 2026-10-08)." }, { "record_id": "WTA-R-GB-0006-004", "provision": "Sexual Offences Act 2003, section 46A(1)(b) (inserted by s.72)", "applies_to": [ "Anyone", "Distributors", "Platforms" ], "duty": "Do not possess, supply or offer to supply a program, service or other thing made or adapted for creating, or facilitating the creation of, child sexual abuse images.", "type": "Prohibited uses", "status": "applies later", "applies_from": null, "url": "https://wheresthe.ai/id/WTA-R-GB-0006-004/", "rule": { "record_id": "WTA-R-GB-0006", "id": "gb-crime-and-policing-act-2026-ai-provisions", "title": "Crime and Policing Act 2026 - AI-related provisions (ss. 72-74 CSA image-generators; s. 99 purported intimate image generators; s. 248 power to amend Online Safety Act for AI)", "jurisdiction": "GB", "jurisdiction_name": "United Kingdom", "url": "https://wheresthe.ai/rule/gb-crime-and-policing-act-2026-ai-provisions/" }, "penalty": "On indictment up to 5 years' imprisonment, a fine or both; on summary conviction up to the general limit in a magistrates' court, a fine or both (s.46A(5)).", "scope_note": "England and Wales. 'CSA image' means an indecent photograph or pseudo-photograph of a child or a prohibited image of a child; 'thing' includes a program, electronic information and a service. Defences in s.46A(2)-(3) and s.46B (crime prevention, intelligence, OFCOM); ISP exemptions with prompt removal on knowledge (s.46B(2)-(6)); directors liable on consent or connivance (s.46C). Possession defence for unsolicited receipt not kept unreasonably long; no-knowledge defence for possession and supply.", "date_note": "Section 72 was not in force at Royal Assent (s.255(1)); legislation.gov.uk lists it as prospective with no commencement regulations as of 8 Oct 2026.", "source_url": "https://www.legislation.gov.uk/ukpga/2026/20/section/72", "verified_on": "2026-10-08", "citation": "WTA-R-GB-0006-004: Sexual Offences Act 2003, section 46A(1)(b) (inserted by s.72), Crime and Policing Act 2026 - AI-related provisions (ss. 72-74 CSA image-generators; s. 99 purported intimate image generators; s. 248 power to amend Online Safety Act for AI). wheresthe.ai, https://wheresthe.ai/id/WTA-R-GB-0006-004/ (checked 2026-10-08)." }, { "record_id": "WTA-R-GB-0006-005", "provision": "Sexual Offences (Northern Ireland) Order 2008, Article 42A (inserted by s.73)", "applies_to": [ "Anyone", "Developers", "Distributors" ], "duty": "Do not make, adapt, possess, supply or offer to supply a program, service or other thing made or adapted for creating, or facilitating the creation of, child sexual abuse images.", "type": "Prohibited uses", "status": "applies later", "applies_from": null, "url": "https://wheresthe.ai/id/WTA-R-GB-0006-005/", "rule": { "record_id": "WTA-R-GB-0006", "id": "gb-crime-and-policing-act-2026-ai-provisions", "title": "Crime and Policing Act 2026 - AI-related provisions (ss. 72-74 CSA image-generators; s. 99 purported intimate image generators; s. 248 power to amend Online Safety Act for AI)", "jurisdiction": "GB", "jurisdiction_name": "United Kingdom", "url": "https://wheresthe.ai/rule/gb-crime-and-policing-act-2026-ai-provisions/" }, "penalty": "On indictment up to 5 years' imprisonment, a fine or both; on summary conviction up to 6 months, a fine up to the statutory maximum or both (Art. 42A(5)).", "scope_note": "Northern Ireland. Defences for unsolicited receipt and lack of knowledge (Art. 42A(2)-(3)); further defences in Art. 42B.", "date_note": "Section 73 was not in force at Royal Assent; legislation.gov.uk cites s.255(1) and (8)(g) and lists it as prospective as of 8 Oct 2026.", "source_url": "https://www.legislation.gov.uk/ukpga/2026/20/section/73", "verified_on": "2026-10-08", "citation": "WTA-R-GB-0006-005: Sexual Offences (Northern Ireland) Order 2008, Article 42A (inserted by s.73), Crime and Policing Act 2026 - AI-related provisions (ss. 72-74 CSA image-generators; s. 99 purported intimate image generators; s. 248 power to amend Online Safety Act for AI). wheresthe.ai, https://wheresthe.ai/id/WTA-R-GB-0006-005/ (checked 2026-10-08)." }, { "record_id": "WTA-R-GB-0006-006", "provision": "Civic Government (Scotland) Act 1982, section 52D (inserted by s.74)", "applies_to": [ "Anyone", "Developers", "Distributors" ], "duty": "Do not make, adapt, possess, supply or offer to supply a program, service or other thing made or adapted for creating, or facilitating the creation of, child sexual abuse images.", "type": "Prohibited uses", "status": "applies later", "applies_from": null, "url": "https://wheresthe.ai/id/WTA-R-GB-0006-006/", "rule": { "record_id": "WTA-R-GB-0006", "id": "gb-crime-and-policing-act-2026-ai-provisions", "title": "Crime and Policing Act 2026 - AI-related provisions (ss. 72-74 CSA image-generators; s. 99 purported intimate image generators; s. 248 power to amend Online Safety Act for AI)", "jurisdiction": "GB", "jurisdiction_name": "United Kingdom", "url": "https://wheresthe.ai/rule/gb-crime-and-policing-act-2026-ai-provisions/" }, "penalty": "On indictment up to 5 years' imprisonment, a fine or both; on summary conviction up to 12 months, a fine up to the statutory maximum or both (s.52D(5)).", "scope_note": "Scotland. Defences for unsolicited receipt and lack of knowledge (s.52D(2)-(3)); further defences in s.52E.", "date_note": "Section 74 was not in force at Royal Assent; legislation.gov.uk cites s.255(1) and (10)(d) and lists it as prospective as of 8 Oct 2026.", "source_url": "https://www.legislation.gov.uk/ukpga/2026/20/section/74", "verified_on": "2026-10-08", "citation": "WTA-R-GB-0006-006: Civic Government (Scotland) Act 1982, section 52D (inserted by s.74), Crime and Policing Act 2026 - AI-related provisions (ss. 72-74 CSA image-generators; s. 99 purported intimate image generators; s. 248 power to amend Online Safety Act for AI). wheresthe.ai, https://wheresthe.ai/id/WTA-R-GB-0006-006/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CO-0003-001", "provision": "C.R.S. 6-1-1702(1)", "applies_to": [ "Developers" ], "duty": "Give each deployer of a covered ADMT a statement of intended and known harmful uses, training data categories, known limitations, instructions for use, monitoring and human review, and information needed for deployer disclosures.", "type": "Transparency to users", "status": "applies later", "applies_from": "2027-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-CO-0003-001/", "rule": { "record_id": "WTA-R-US-CO-0003", "id": "us-co-sb26-189-admt-2026", "title": "Automated Decision-Making Technology (SB 26-189)", "jurisdiction": "US-CO", "jurisdiction_name": "Colorado", "url": "https://wheresthe.ai/rule/us-co-sb26-189-admt-2026/" }, "penalty": "Deceptive trade practice under the Colorado Consumer Protection Act (C.R.S. 6-1-105(1)(uuuu)); Attorney General enforces exclusively, with a 60-day cure notice where cure is possible until 1 Jan 2030; no private right of action (C.R.S. 6-1-1706).", "scope_note": "Covered ADMT means ADMT used to materially influence a consequential decision (education, employment, housing, lending, insurance, health care, government services). Applies only where the ADMT was marketed, configured, contracted, sold or licensed for consequential decisions (6-1-1702(3)). Trade secrets are protected, but the developer must tell the deployer if information is withheld. Per our records, a stipulated federal-court stay in X.AI v. Weiser (D. Colo.) bars enforcement of SB 24-205 and replacement legislation until 14 days after a ruling on a preliminary-injunction motion; the stay is not part of the act.", "date_note": "Act (Ch. 131, Session Laws 2026) signed 14 May 2026; takes effect 1 Jan 2027 and applies to consequential decisions made on or after that date (Section 5).", "source_url": "https://leg.colorado.gov/laws/session-laws/SB26-189/131/download", "verified_on": "2026-10-08", "citation": "WTA-R-US-CO-0003-001: C.R.S. 6-1-1702(1), Automated Decision-Making Technology (SB 26-189). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CO-0003-001/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CO-0003-002", "provision": "C.R.S. 6-1-1702(2)", "applies_to": [ "Developers" ], "duty": "Notify each deployer within a reasonable time of material updates, intentional and substantial modifications, and changes to intended use, limitations or risk mitigation of the covered ADMT.", "type": "Transparency to users", "status": "applies later", "applies_from": "2027-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-CO-0003-002/", "rule": { "record_id": "WTA-R-US-CO-0003", "id": "us-co-sb26-189-admt-2026", "title": "Automated Decision-Making Technology (SB 26-189)", "jurisdiction": "US-CO", "jurisdiction_name": "Colorado", "url": "https://wheresthe.ai/rule/us-co-sb26-189-admt-2026/" }, "penalty": "Deceptive trade practice under the Colorado Consumer Protection Act (C.R.S. 6-1-105(1)(uuuu)); Attorney General enforces exclusively, with a 60-day cure notice where cure is possible until 1 Jan 2030; no private right of action (C.R.S. 6-1-1706).", "scope_note": "Public release notes satisfy this duty if the developer gives each deployer direct notice of the release. Per our records, a stipulated federal-court stay in X.AI v. Weiser (D. Colo.) bars enforcement of SB 24-205 and replacement legislation until 14 days after a ruling on a preliminary-injunction motion; the stay is not part of the act.", "date_note": null, "source_url": "https://leg.colorado.gov/laws/session-laws/SB26-189/131/download", "verified_on": "2026-10-08", "citation": "WTA-R-US-CO-0003-002: C.R.S. 6-1-1702(2), Automated Decision-Making Technology (SB 26-189). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CO-0003-002/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CO-0003-003", "provision": "C.R.S. 6-1-1702(4)", "applies_to": [ "Developers" ], "duty": "Keep records showing compliance with the developer documentation duties, including version identifiers, changelogs and update notices, for at least three years after each record is created.", "type": "Record-keeping", "status": "applies later", "applies_from": "2027-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-CO-0003-003/", "rule": { "record_id": "WTA-R-US-CO-0003", "id": "us-co-sb26-189-admt-2026", "title": "Automated Decision-Making Technology (SB 26-189)", "jurisdiction": "US-CO", "jurisdiction_name": "Colorado", "url": "https://wheresthe.ai/rule/us-co-sb26-189-admt-2026/" }, "penalty": "Deceptive trade practice under the Colorado Consumer Protection Act (C.R.S. 6-1-105(1)(uuuu)); Attorney General enforces exclusively, with a 60-day cure notice where cure is possible until 1 Jan 2030; no private right of action (C.R.S. 6-1-1706).", "scope_note": "Per our records, a stipulated federal-court stay in X.AI v. Weiser (D. Colo.) bars enforcement of SB 24-205 and replacement legislation until 14 days after a ruling on a preliminary-injunction motion; the stay is not part of the act.", "date_note": null, "source_url": "https://leg.colorado.gov/laws/session-laws/SB26-189/131/download", "verified_on": "2026-10-08", "citation": "WTA-R-US-CO-0003-003: C.R.S. 6-1-1702(4), Automated Decision-Making Technology (SB 26-189). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CO-0003-003/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CO-0003-004", "provision": "C.R.S. 6-1-1703", "applies_to": [ "Deployers" ], "duty": "Keep records reasonably necessary to show compliance with Part 17 for at least three years after each consequential decision, such as ADMT version identifiers, changelogs and mitigation changes.", "type": "Record-keeping", "status": "applies later", "applies_from": "2027-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-CO-0003-004/", "rule": { "record_id": "WTA-R-US-CO-0003", "id": "us-co-sb26-189-admt-2026", "title": "Automated Decision-Making Technology (SB 26-189)", "jurisdiction": "US-CO", "jurisdiction_name": "Colorado", "url": "https://wheresthe.ai/rule/us-co-sb26-189-admt-2026/" }, "penalty": "Deceptive trade practice under the Colorado Consumer Protection Act (C.R.S. 6-1-105(1)(uuuu)); Attorney General enforces exclusively, with a 60-day cure notice where cure is possible until 1 Jan 2030; no private right of action (C.R.S. 6-1-1706).", "scope_note": "Per our records, a stipulated federal-court stay in X.AI v. Weiser (D. Colo.) bars enforcement of SB 24-205 and replacement legislation until 14 days after a ruling on a preliminary-injunction motion; the stay is not part of the act.", "date_note": null, "source_url": "https://leg.colorado.gov/laws/session-laws/SB26-189/131/download", "verified_on": "2026-10-08", "citation": "WTA-R-US-CO-0003-004: C.R.S. 6-1-1703, Automated Decision-Making Technology (SB 26-189). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CO-0003-004/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CO-0003-005", "provision": "C.R.S. 6-1-1704(1)-(2)", "applies_to": [ "Deployers" ], "duty": "Give consumers a clear and conspicuous notice, before a covered ADMT is used to materially influence a consequential decision about them, of that use and how to get more information.", "type": "Transparency to users", "status": "applies later", "applies_from": "2027-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-CO-0003-005/", "rule": { "record_id": "WTA-R-US-CO-0003", "id": "us-co-sb26-189-admt-2026", "title": "Automated Decision-Making Technology (SB 26-189)", "jurisdiction": "US-CO", "jurisdiction_name": "Colorado", "url": "https://wheresthe.ai/rule/us-co-sb26-189-admt-2026/" }, "penalty": "Deceptive trade practice under the Colorado Consumer Protection Act (C.R.S. 6-1-105(1)(uuuu)); Attorney General enforces exclusively, with a 60-day cure notice where cure is possible until 1 Jan 2030; no private right of action (C.R.S. 6-1-1706).", "scope_note": "A prominent public notice reasonably accessible at points of consumer interaction satisfies this duty (6-1-1704(2)). Creditors giving ECOA/FCRA adverse action notices that also meet this section, and FERPA-covered education deployers, have alternative compliance routes (6-1-1704(6), (9)). Per our records, a stipulated federal-court stay in X.AI v. Weiser (D. Colo.) bars enforcement of SB 24-205 and replacement legislation until 14 days after a ruling on a preliminary-injunction motion; the stay is not part of the act.", "date_note": null, "source_url": "https://leg.colorado.gov/laws/session-laws/SB26-189/131/download", "verified_on": "2026-10-08", "citation": "WTA-R-US-CO-0003-005: C.R.S. 6-1-1704(1)-(2), Automated Decision-Making Technology (SB 26-189). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CO-0003-005/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CO-0003-006", "provision": "C.R.S. 6-1-1704(3)", "applies_to": [ "Deployers" ], "duty": "Give a consumer who receives an adverse outcome, within 30 days, a plain-language description of the decision and the ADMT's role, a process to request ADMT and input details, and an explanation of their rights.", "type": "Transparency to users", "status": "applies later", "applies_from": "2027-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-CO-0003-006/", "rule": { "record_id": "WTA-R-US-CO-0003", "id": "us-co-sb26-189-admt-2026", "title": "Automated Decision-Making Technology (SB 26-189)", "jurisdiction": "US-CO", "jurisdiction_name": "Colorado", "url": "https://wheresthe.ai/rule/us-co-sb26-189-admt-2026/" }, "penalty": "Deceptive trade practice under the Colorado Consumer Protection Act (C.R.S. 6-1-105(1)(uuuu)); Attorney General enforces exclusively, with a 60-day cure notice where cure is possible until 1 Jan 2030; no private right of action (C.R.S. 6-1-1706).", "scope_note": "Insurers subject to C.R.S. 10-3-1104.9 are deemed compliant in the practice of insurance (6-1-1708(1)). HIPAA covered entities are largely exempt but must give a general notice and, for financial-assistance eligibility decisions, specified disclosures (6-1-1708(3)). Per our records, a stipulated federal-court stay in X.AI v. Weiser (D. Colo.) bars enforcement of SB 24-205 and replacement legislation until 14 days after a ruling on a preliminary-injunction motion; the stay is not part of the act.", "date_note": "The Attorney General must adopt rules clarifying these disclosures on or before 1 Jan 2027 (6-1-1704(4)(b), effective on passage).", "source_url": "https://leg.colorado.gov/laws/session-laws/SB26-189/131/download", "verified_on": "2026-10-08", "citation": "WTA-R-US-CO-0003-006: C.R.S. 6-1-1704(3), Automated Decision-Making Technology (SB 26-189). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CO-0003-006/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CO-0003-007", "provision": "C.R.S. 6-1-1705(1)(a)", "applies_to": [ "Deployers" ], "duty": "Give a consumer who requests it after an adverse outcome instructions to obtain and correct inaccurate personal data used and, where commercially reasonable, meaningful human review and reconsideration of the decision.", "type": "Consumer rights", "status": "applies later", "applies_from": "2027-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-CO-0003-007/", "rule": { "record_id": "WTA-R-US-CO-0003", "id": "us-co-sb26-189-admt-2026", "title": "Automated Decision-Making Technology (SB 26-189)", "jurisdiction": "US-CO", "jurisdiction_name": "Colorado", "url": "https://wheresthe.ai/rule/us-co-sb26-189-admt-2026/" }, "penalty": "Deceptive trade practice under the Colorado Consumer Protection Act (C.R.S. 6-1-105(1)(uuuu)); Attorney General enforces exclusively, with a 60-day cure notice where cure is possible until 1 Jan 2030; no private right of action (C.R.S. 6-1-1706).", "scope_note": "Correction does not extend to opinions, predictions, scores or protected evaluations (6-1-1705(1)(c)). Meaningful human review is defined in 6-1-1701(15). Per our records, a stipulated federal-court stay in X.AI v. Weiser (D. Colo.) bars enforcement of SB 24-205 and replacement legislation until 14 days after a ruling on a preliminary-injunction motion; the stay is not part of the act.", "date_note": "Attorney General rules due on or before 1 Jan 2027 (6-1-1705(3)).", "source_url": "https://leg.colorado.gov/laws/session-laws/SB26-189/131/download", "verified_on": "2026-10-08", "citation": "WTA-R-US-CO-0003-007: C.R.S. 6-1-1705(1)(a), Automated Decision-Making Technology (SB 26-189). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CO-0003-007/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CO-0002-001", "provision": "3 CCR 702-10, Regulation 10-1-1, Section 5.A", "applies_to": [ "Insurers" ], "duty": "Set up a risk-based governance and risk management framework, overseen by the board, to detect and remediate unfair discrimination with respect to race from use of external consumer data, algorithms and predictive models.", "type": "Bias and non-discrimination", "status": "applies now", "applies_from": "2025-10-15", "url": "https://wheresthe.ai/id/WTA-R-US-CO-0002-001/", "rule": { "record_id": "WTA-R-US-CO-0002", "id": "us-co-doi-regulation-10-1-1-insurance-ai", "title": "Regulation 10-1-1: Governance and Risk Management Framework Requirements for Insurers’ Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models", "jurisdiction": "US-CO", "jurisdiction_name": "Colorado", "url": "https://wheresthe.ai/rule/us-co-doi-regulation-10-1-1-insurance-ai/" }, "penalty": "Sanctions under Colorado insurance statutes, including civil penalties, cease and desist orders, and licence suspension or revocation (Reg. 10-1-1, Section 9).", "scope_note": "Applies to insurers offering individual life insurance, private passenger auto insurance or health benefit plans in Colorado that use external consumer data and information sources (ECDIS) or algorithms and predictive models using ECDIS (Section 3). Framework components are listed in Section 5.A.1 to 5.A.14 (governing principles, senior management accountability, cross-functional group, documented policies, risk prioritisation, annual review).", "date_note": "Amended regulation effective 15 Oct 2025 (Section 10). Framework must be available to the Division from 1 Dec 2024 for life insurers and from 1 Jul 2026 for auto and health insurers, then annually (Section 5.C).", "source_url": "https://drive.google.com/file/d/1gWvUT_zEn6npupumvYB4Sq_hvh2OZO8y/view", "verified_on": "2026-10-08", "citation": "WTA-R-US-CO-0002-001: 3 CCR 702-10, Regulation 10-1-1, Section 5.A, Regulation 10-1-1: Governance and Risk Management Framework Requirements for Insurers’ Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models. wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CO-0002-001/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CO-0002-002", "provision": "3 CCR 702-10, Regulation 10-1-1, Section 5.A.9-5.A.12", "applies_to": [ "Insurers" ], "duty": "Keep an up-to-date, version-controlled inventory of all external data sources, algorithms and models, and document quantitative testing for unfair discrimination, its results and remediation, and ongoing monitoring for model drift.", "type": "Record-keeping", "status": "applies now", "applies_from": "2025-10-15", "url": "https://wheresthe.ai/id/WTA-R-US-CO-0002-002/", "rule": { "record_id": "WTA-R-US-CO-0002", "id": "us-co-doi-regulation-10-1-1-insurance-ai", "title": "Regulation 10-1-1: Governance and Risk Management Framework Requirements for Insurers’ Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models", "jurisdiction": "US-CO", "jurisdiction_name": "Colorado", "url": "https://wheresthe.ai/rule/us-co-doi-regulation-10-1-1-insurance-ai/" }, "penalty": "Sanctions under Colorado insurance statutes, including civil penalties, cease and desist orders, and licence suspension or revocation (Reg. 10-1-1, Section 9).", "scope_note": "Applies to insurers offering individual life insurance, private passenger auto insurance or health benefit plans in Colorado that use external consumer data and information sources (ECDIS) or algorithms and predictive models using ECDIS (Section 3). Testing methodology follows requirements established by the Division.", "date_note": "Amended regulation effective 15 Oct 2025 (Section 10). Framework must be available to the Division from 1 Dec 2024 for life insurers and from 1 Jul 2026 for auto and health insurers, then annually (Section 5.C).", "source_url": "https://drive.google.com/file/d/1gWvUT_zEn6npupumvYB4Sq_hvh2OZO8y/view", "verified_on": "2026-10-08", "citation": "WTA-R-US-CO-0002-002: 3 CCR 702-10, Regulation 10-1-1, Section 5.A.9-5.A.12, Regulation 10-1-1: Governance and Risk Management Framework Requirements for Insurers’ Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models. wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CO-0002-002/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CO-0002-003", "provision": "3 CCR 702-10, Regulation 10-1-1, Section 5.A.5", "applies_to": [ "Insurers" ], "duty": "Ensure a provider acting for the health benefit plan insurer is ultimately responsible for decisions to modify or deny prior or concurrent authorization requests informed by external consumer data, or algorithms or predictive models that use such data.", "type": "Human oversight", "status": "applies now", "applies_from": "2025-10-15", "url": "https://wheresthe.ai/id/WTA-R-US-CO-0002-003/", "rule": { "record_id": "WTA-R-US-CO-0002", "id": "us-co-doi-regulation-10-1-1-insurance-ai", "title": "Regulation 10-1-1: Governance and Risk Management Framework Requirements for Insurers’ Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models", "jurisdiction": "US-CO", "jurisdiction_name": "Colorado", "url": "https://wheresthe.ai/rule/us-co-doi-regulation-10-1-1-insurance-ai/" }, "penalty": "Sanctions under Colorado insurance statutes, including civil penalties, cease and desist orders, and licence suspension or revocation (Reg. 10-1-1, Section 9).", "scope_note": "Applies to health benefit plan insurers only.", "date_note": "Amended regulation effective 15 Oct 2025 (Section 10). Framework must be available to the Division from 1 Dec 2024 for life insurers and from 1 Jul 2026 for auto and health insurers, then annually (Section 5.C).", "source_url": "https://drive.google.com/file/d/1gWvUT_zEn6npupumvYB4Sq_hvh2OZO8y/view", "verified_on": "2026-10-08", "citation": "WTA-R-US-CO-0002-003: 3 CCR 702-10, Regulation 10-1-1, Section 5.A.5, Regulation 10-1-1: Governance and Risk Management Framework Requirements for Insurers’ Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models. wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CO-0002-003/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CO-0002-004", "provision": "3 CCR 702-10, Regulation 10-1-1, Section 5.B", "applies_to": [ "Insurers" ], "duty": "Remain responsible for Section 5.A compliance when using third-party vendors of data, algorithms or models, and document a process for selecting and overseeing those vendors.", "type": "Data governance", "status": "applies now", "applies_from": "2025-10-15", "url": "https://wheresthe.ai/id/WTA-R-US-CO-0002-004/", "rule": { "record_id": "WTA-R-US-CO-0002", "id": "us-co-doi-regulation-10-1-1-insurance-ai", "title": "Regulation 10-1-1: Governance and Risk Management Framework Requirements for Insurers’ Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models", "jurisdiction": "US-CO", "jurisdiction_name": "Colorado", "url": "https://wheresthe.ai/rule/us-co-doi-regulation-10-1-1-insurance-ai/" }, "penalty": "Sanctions under Colorado insurance statutes, including civil penalties, cease and desist orders, and licence suspension or revocation (Reg. 10-1-1, Section 9).", "scope_note": "Vendors may provide requested documents directly to the Division on the insurer's behalf.", "date_note": "Amended regulation effective 15 Oct 2025 (Section 10). Framework must be available to the Division from 1 Dec 2024 for life insurers and from 1 Jul 2026 for auto and health insurers, then annually (Section 5.C).", "source_url": "https://drive.google.com/file/d/1gWvUT_zEn6npupumvYB4Sq_hvh2OZO8y/view", "verified_on": "2026-10-08", "citation": "WTA-R-US-CO-0002-004: 3 CCR 702-10, Regulation 10-1-1, Section 5.B, Regulation 10-1-1: Governance and Risk Management Framework Requirements for Insurers’ Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models. wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CO-0002-004/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CO-0002-005", "provision": "3 CCR 702-10, Regulation 10-1-1, Section 6.B-6.D", "applies_to": [ "Insurers" ], "duty": "File an annual officer-signed report in SERFF summarising compliance with Section 5 and naming responsible roles, or a corrective action plan if compliance cannot be attested.", "type": "Registration or filing", "status": "applies now", "applies_from": "2026-07-01", "url": "https://wheresthe.ai/id/WTA-R-US-CO-0002-005/", "rule": { "record_id": "WTA-R-US-CO-0002", "id": "us-co-doi-regulation-10-1-1-insurance-ai", "title": "Regulation 10-1-1: Governance and Risk Management Framework Requirements for Insurers’ Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models", "jurisdiction": "US-CO", "jurisdiction_name": "Colorado", "url": "https://wheresthe.ai/rule/us-co-doi-regulation-10-1-1-insurance-ai/" }, "penalty": "Sanctions under Colorado insurance statutes, including civil penalties, cease and desist orders, and licence suspension or revocation (Reg. 10-1-1, Section 9).", "scope_note": "Insurers that do not use ECDIS must instead file an officer attestation within one month of the effective date and each 1 Dec (Section 6.E).", "date_note": "Due 1 Dec 2024 and annually for life insurers; 1 Jul 2026 and annually for private passenger auto and health benefit plan insurers (Sections 6.B, 6.C).", "source_url": "https://drive.google.com/file/d/1gWvUT_zEn6npupumvYB4Sq_hvh2OZO8y/view", "verified_on": "2026-10-08", "citation": "WTA-R-US-CO-0002-005: 3 CCR 702-10, Regulation 10-1-1, Section 6.B-6.D, Regulation 10-1-1: Governance and Risk Management Framework Requirements for Insurers’ Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models. wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CO-0002-005/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0004-001", "provision": "Section 22757.12(a)-(b)", "applies_to": [ "Developers" ], "duty": "Write, follow and publish a frontier AI framework covering catastrophic-risk thresholds, mitigations, third-party assessment, model-weight security, incident response and internal-use risk; review it yearly and publish material changes with justification within 30 days.", "type": "Frontier model safety", "status": "applies now", "applies_from": "2026-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0004-001/", "rule": { "record_id": "WTA-R-US-CA-0004", "id": "us-ca-sb53-tfaia-2025", "title": "Transparency in Frontier Artificial Intelligence Act (SB 53)", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-sb53-tfaia-2025/" }, "penalty": "Civil penalty up to $1,000,000 per violation, scaled to severity, recovered only by the Attorney General; applies to large frontier developers (Bus. & Prof. Code 22757.15).", "scope_note": "Large frontier developers only. Frontier developer: trained or began training a foundation model using more than 10^26 operations. Large frontier developer: frontier developer with affiliates over $500 million gross revenue in the prior calendar year (22757.11).", "date_note": "SB 53, Chapter 138, Statutes of 2025, approved 29 Sep 2025; in effect 1 Jan 2026.", "source_url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC§ionNum=22757.12", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0004-001: Section 22757.12(a)-(b), Transparency in Frontier Artificial Intelligence Act (SB 53). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0004-001/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0004-002", "provision": "Section 22757.12(c)(1)", "applies_to": [ "Developers" ], "duty": "Publish, before or when deploying a new or substantially modified frontier model, a transparency report with release date, languages, output modalities, intended uses, use restrictions and a contact mechanism.", "type": "Transparency to users", "status": "applies now", "applies_from": "2026-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0004-002/", "rule": { "record_id": "WTA-R-US-CA-0004", "id": "us-ca-sb53-tfaia-2025", "title": "Transparency in Frontier Artificial Intelligence Act (SB 53)", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-sb53-tfaia-2025/" }, "penalty": "Bus. & Prof. Code 22757.15 civil penalty (up to $1,000,000 per violation, AG only) applies to large frontier developers; the text sets no penalty for other frontier developers.", "scope_note": "Applies to all frontier developers. A system card or model card containing the information counts (22757.12(c)(3)). Frontier developer: trained or began training a foundation model using more than 10^26 operations. Large frontier developer: frontier developer with affiliates over $500 million gross revenue in the prior calendar year (22757.11).", "date_note": "SB 53, Chapter 138, Statutes of 2025, approved 29 Sep 2025; in effect 1 Jan 2026.", "source_url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC§ionNum=22757.12", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0004-002: Section 22757.12(c)(1), Transparency in Frontier Artificial Intelligence Act (SB 53). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0004-002/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0004-003", "provision": "Section 22757.12(c)(2)", "applies_to": [ "Developers" ], "duty": "Include in the transparency report summaries of catastrophic-risk assessments under the frontier AI framework, their results, third-party evaluator involvement, and other framework steps taken for the model.", "type": "Frontier model safety", "status": "applies now", "applies_from": "2026-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0004-003/", "rule": { "record_id": "WTA-R-US-CA-0004", "id": "us-ca-sb53-tfaia-2025", "title": "Transparency in Frontier Artificial Intelligence Act (SB 53)", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-sb53-tfaia-2025/" }, "penalty": "Civil penalty up to $1,000,000 per violation, scaled to severity, recovered only by the Attorney General; applies to large frontier developers (Bus. & Prof. Code 22757.15).", "scope_note": "Large frontier developers only. Redactions allowed for trade secrets, cybersecurity, public safety or national security, with the redaction described and unredacted text kept five years (22757.12(f)).", "date_note": "SB 53, Chapter 138, Statutes of 2025, approved 29 Sep 2025; in effect 1 Jan 2026.", "source_url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC§ionNum=22757.12", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0004-003: Section 22757.12(c)(2), Transparency in Frontier Artificial Intelligence Act (SB 53). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0004-003/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0004-004", "provision": "Section 22757.12(d)", "applies_to": [ "Developers" ], "duty": "Send the Office of Emergency Services a summary of any assessment of catastrophic risk from internal use of frontier models every three months, or on another reasonable schedule communicated in writing.", "type": "Frontier model safety", "status": "applies now", "applies_from": "2026-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0004-004/", "rule": { "record_id": "WTA-R-US-CA-0004", "id": "us-ca-sb53-tfaia-2025", "title": "Transparency in Frontier Artificial Intelligence Act (SB 53)", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-sb53-tfaia-2025/" }, "penalty": "Civil penalty up to $1,000,000 per violation, scaled to severity, recovered only by the Attorney General; applies to large frontier developers (Bus. & Prof. Code 22757.15).", "scope_note": "Large frontier developers only. Summaries are exempt from the California Public Records Act (22757.13(f)).", "date_note": "SB 53, Chapter 138, Statutes of 2025, approved 29 Sep 2025; in effect 1 Jan 2026.", "source_url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC§ionNum=22757.12", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0004-004: Section 22757.12(d), Transparency in Frontier Artificial Intelligence Act (SB 53). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0004-004/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0004-005", "provision": "Section 22757.12(e)", "applies_to": [ "Developers" ], "duty": "Do not make materially false or misleading statements about catastrophic risk from frontier models or its management, or, for large frontier developers, about implementing or complying with the frontier AI framework.", "type": "Transparency to users", "status": "applies now", "applies_from": "2026-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0004-005/", "rule": { "record_id": "WTA-R-US-CA-0004", "id": "us-ca-sb53-tfaia-2025", "title": "Transparency in Frontier Artificial Intelligence Act (SB 53)", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-sb53-tfaia-2025/" }, "penalty": "Civil penalty up to $1,000,000 per violation, scaled to severity, recovered only by the Attorney General; applies to large frontier developers (Bus. & Prof. Code 22757.15).", "scope_note": "Does not apply to statements made in good faith that were reasonable in the circumstances (22757.12(e)(2)).", "date_note": "SB 53, Chapter 138, Statutes of 2025, approved 29 Sep 2025; in effect 1 Jan 2026.", "source_url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC§ionNum=22757.12", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0004-005: Section 22757.12(e), Transparency in Frontier Artificial Intelligence Act (SB 53). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0004-005/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0004-006", "provision": "Section 22757.13(c)(1)", "applies_to": [ "Developers" ], "duty": "Report any critical safety incident involving a frontier model to the Office of Emergency Services within 15 days of discovering it.", "type": "Incident reporting", "status": "applies now", "applies_from": "2026-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0004-006/", "rule": { "record_id": "WTA-R-US-CA-0004", "id": "us-ca-sb53-tfaia-2025", "title": "Transparency in Frontier Artificial Intelligence Act (SB 53)", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-sb53-tfaia-2025/" }, "penalty": "Civil penalty up to $1,000,000 per violation, scaled to severity, recovered only by the Attorney General; applies to large frontier developers (Bus. & Prof. Code 22757.15).", "scope_note": "Critical safety incidents include weight exfiltration causing injury, materialised catastrophic risk, loss of control causing injury, and deceptive subversion of developer controls (22757.11(d)). Amended reports allowed. Compliance via a designated federal standard is possible after declaring intent to OES (22757.13(h)-(i)).", "date_note": "SB 53, Chapter 138, Statutes of 2025, approved 29 Sep 2025; in effect 1 Jan 2026.", "source_url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC§ionNum=22757.13", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0004-006: Section 22757.13(c)(1), Transparency in Frontier Artificial Intelligence Act (SB 53). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0004-006/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0004-007", "provision": "Section 22757.13(c)(2)", "applies_to": [ "Developers" ], "duty": "Disclose a critical safety incident that poses an imminent risk of death or serious physical injury within 24 hours to an appropriate authority, such as a law enforcement or public safety agency.", "type": "Incident reporting", "status": "applies now", "applies_from": "2026-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0004-007/", "rule": { "record_id": "WTA-R-US-CA-0004", "id": "us-ca-sb53-tfaia-2025", "title": "Transparency in Frontier Artificial Intelligence Act (SB 53)", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-sb53-tfaia-2025/" }, "penalty": "Civil penalty up to $1,000,000 per violation, scaled to severity, recovered only by the Attorney General; applies to large frontier developers (Bus. & Prof. Code 22757.15).", "scope_note": "Applies to all frontier developers, but the penalty provision covers large frontier developers.", "date_note": "SB 53, Chapter 138, Statutes of 2025, approved 29 Sep 2025; in effect 1 Jan 2026.", "source_url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC§ionNum=22757.13", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0004-007: Section 22757.13(c)(2), Transparency in Frontier Artificial Intelligence Act (SB 53). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0004-007/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0004-008", "provision": "Labor Code Section 1107.1(a)-(b), (d)", "applies_to": [ "Developers" ], "duty": "Do not adopt rules, policies or contracts that stop covered employees from reporting catastrophic-risk dangers or violations to authorities, or retaliate against them, and give covered employees clear notice of these rights.", "type": "Frontier model safety", "status": "applies now", "applies_from": "2026-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0004-008/", "rule": { "record_id": "WTA-R-US-CA-0004", "id": "us-ca-sb53-tfaia-2025", "title": "Transparency in Frontier Artificial Intelligence Act (SB 53)", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-sb53-tfaia-2025/" }, "penalty": "Civil action by the employee; court may award attorney's fees and grant injunctive relief not stayed on appeal (Lab. Code 1107.1(f)-(i)).", "scope_note": "Covered employee: an employee responsible for assessing, managing or addressing risk of critical safety incidents (Lab. Code 1107(b)). Notice by workplace posting or yearly written notice (1107.1(d)).", "date_note": "SB 53, Chapter 138, Statutes of 2025, approved 29 Sep 2025; in effect 1 Jan 2026.", "source_url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=LAB§ionNum=1107.1", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0004-008: Labor Code Section 1107.1(a)-(b), (d), Transparency in Frontier Artificial Intelligence Act (SB 53). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0004-008/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0004-009", "provision": "Labor Code Section 1107.1(e)", "applies_to": [ "Developers" ], "duty": "Provide a reasonable internal process for covered employees to disclose catastrophic-risk dangers or violations anonymously, with monthly status updates to the discloser and quarterly sharing with officers and directors.", "type": "Frontier model safety", "status": "applies now", "applies_from": "2026-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0004-009/", "rule": { "record_id": "WTA-R-US-CA-0004", "id": "us-ca-sb53-tfaia-2025", "title": "Transparency in Frontier Artificial Intelligence Act (SB 53)", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-sb53-tfaia-2025/" }, "penalty": "Civil action by the employee; court may award attorney's fees and grant injunctive relief (Lab. Code 1107.1(f)-(h)).", "scope_note": "Large frontier developers only. Officers or directors accused in a disclosure are excluded from the quarterly sharing.", "date_note": "SB 53, Chapter 138, Statutes of 2025, approved 29 Sep 2025; in effect 1 Jan 2026.", "source_url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=LAB§ionNum=1107.1", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0004-009: Labor Code Section 1107.1(e), Transparency in Frontier Artificial Intelligence Act (SB 53). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0004-009/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0002-001", "provision": "Civil Code Section 3111", "applies_to": [ "Developers" ], "duty": "Post training-data documentation on your website for each generative AI system or substantial modification released since 1 Jan 2022 and made available to Californians, by 1 Jan 2026 and before each later release.", "type": "Transparency to users", "status": "applies now", "applies_from": "2026-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0002-001/", "rule": { "record_id": "WTA-R-US-CA-0002", "id": "us-ca-ab2013-training-data-transparency-2024", "title": "Generative Artificial Intelligence: Training Data Transparency (AB 2013)", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-ab2013-training-data-transparency-2024/" }, "penalty": "No penalty or enforcement provision in the act (Civil Code 3110-3111).", "scope_note": "Developer includes any person or government agency that designs, codes, produces or substantially modifies an AI system or service for public use (Civ. Code 3110(b)). Exempt: systems solely for security and integrity, aircraft operation in national airspace, or national security uses made available only to a federal entity (3111(b)).", "date_note": "AB 2013, Chapter 817, Statutes of 2024, approved 28 Sep 2024; statute effective 1 Jan 2025, first postings due on or before 1 Jan 2026. Our record lists 1 Jan 2026 as the effective date, but that is the compliance date.", "source_url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=3111", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0002-001: Civil Code Section 3111, Generative Artificial Intelligence: Training Data Transparency (AB 2013). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0002-001/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0002-002", "provision": "Civil Code Section 3111(a)(1)-(12)", "applies_to": [ "Developers" ], "duty": "Include a high-level dataset summary covering sources, purpose, size, data types, copyright or licence status, personal or aggregate consumer information, cleaning, collection periods, first-use dates and synthetic data use.", "type": "Copyright and training data", "status": "applies now", "applies_from": "2026-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0002-002/", "rule": { "record_id": "WTA-R-US-CA-0002", "id": "us-ca-ab2013-training-data-transparency-2024", "title": "Generative Artificial Intelligence: Training Data Transparency (AB 2013)", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-ab2013-training-data-transparency-2024/" }, "penalty": "No penalty or enforcement provision in the act (Civil Code 3110-3111).", "scope_note": "Developer includes any person or government agency that designs, codes, produces or substantially modifies an AI system or service for public use (Civ. Code 3110(b)). Exempt: systems solely for security and integrity, aircraft operation in national airspace, or national security uses made available only to a federal entity (3111(b)).", "date_note": "AB 2013, Chapter 817, Statutes of 2024, approved 28 Sep 2024; statute effective 1 Jan 2025, first postings due on or before 1 Jan 2026. Our record lists 1 Jan 2026 as the effective date, but that is the compliance date.", "source_url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=3111", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0002-002: Civil Code Section 3111(a)(1)-(12), Generative Artificial Intelligence: Training Data Transparency (AB 2013). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0002-002/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0003-001", "provision": "11 CCR Section 7150, 7152, 7155(a)", "applies_to": [ "Anyone" ], "duty": "Conduct and document a risk assessment before starting processing that presents significant privacy risk, including using ADMT for significant decisions or training ADMT or facial recognition, and review it at least every three years.", "type": "Impact assessment", "status": "applies now", "applies_from": "2026-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0003-001/", "rule": { "record_id": "WTA-R-US-CA-0003", "id": "us-ca-ccpa-admt-regulations-2025", "title": "CCPA Regulations on Automated Decisionmaking Technology, Risk Assessments and Cybersecurity Audits", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-ccpa-admt-regulations-2025/" }, "penalty": "Administrative fines up to $2,663 per violation or $7,988 per intentional violation or violation involving known minors under 16 (Civil Code 1798.155(a), CPI-adjusted from 1 Jan 2025); AG civil penalties at the same levels (1798.199.90).", "scope_note": "Applies to businesses subject to the CCPA. Other triggers: selling or sharing personal information, processing sensitive personal information, and certain automated inferences about workers, students or people at sensitive locations (7150(b)). Keep assessments for the processing period or five years, whichever is later (7155(c)).", "date_note": "Regulations approved by OAL 22 Sep 2025 (adopted by the CPPA Board 24 Jul 2025); effective 1 Jan 2026. For covered processing begun before 1 Jan 2026 and continuing after, the assessment is due by 31 Dec 2027 (7155(b)). Updates are due within 45 days of a material change (7155(a)(3)).", "source_url": "https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0003-001: 11 CCR Section 7150, 7152, 7155(a), CCPA Regulations on Automated Decisionmaking Technology, Risk Assessments and Cybersecurity Audits. wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0003-001/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0003-002", "provision": "11 CCR Section 7153", "applies_to": [ "Providers" ], "duty": "Give any business to which you make available ADMT trained on personal information, for significant decisions, all available facts it needs to conduct its own risk assessment.", "type": "Transparency to users", "status": "applies now", "applies_from": "2026-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0003-002/", "rule": { "record_id": "WTA-R-US-CA-0003", "id": "us-ca-ccpa-admt-regulations-2025", "title": "CCPA Regulations on Automated Decisionmaking Technology, Risk Assessments and Cybersecurity Audits", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-ccpa-admt-regulations-2025/" }, "penalty": "Administrative fines up to $2,663 per violation or $7,988 per intentional violation or violation involving known minors under 16 (Civil Code 1798.155(a), CPI-adjusted from 1 Jan 2025); AG civil penalties at the same levels (1798.199.90).", "scope_note": "Applies to businesses subject to the CCPA. ADMT: technology that processes personal information and uses computation to replace or substantially replace human decisionmaking (11 CCR 7001(e)). Significant decision: provision or denial of financial or lending services, housing, education, employment or compensation, or healthcare (7001(ddd)).", "date_note": "Regulations approved by OAL 22 Sep 2025 (adopted by the CPPA Board 24 Jul 2025); effective 1 Jan 2026.", "source_url": "https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0003-002: 11 CCR Section 7153, CCPA Regulations on Automated Decisionmaking Technology, Risk Assessments and Cybersecurity Audits. wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0003-002/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0003-003", "provision": "11 CCR Section 7157", "applies_to": [ "Anyone" ], "duty": "Submit risk assessment information to the CPPA, including counts by processing type and an executive's attestation under penalty of perjury, by 1 Apr 2028 for 2026-2027 assessments, then by each 1 Apr.", "type": "Registration or filing", "status": "applies later", "applies_from": "2028-04-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0003-003/", "rule": { "record_id": "WTA-R-US-CA-0003", "id": "us-ca-ccpa-admt-regulations-2025", "title": "CCPA Regulations on Automated Decisionmaking Technology, Risk Assessments and Cybersecurity Audits", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-ccpa-admt-regulations-2025/" }, "penalty": "Administrative fines up to $2,663 per violation or $7,988 per intentional violation or violation involving known minors under 16 (Civil Code 1798.155(a), CPI-adjusted from 1 Jan 2025); AG civil penalties at the same levels (1798.199.90).", "scope_note": "Applies to businesses subject to the CCPA. The CPPA or Attorney General may demand full risk assessment reports, due within 30 days (7157(e)).", "date_note": "Regulations approved by OAL 22 Sep 2025 (adopted by the CPPA Board 24 Jul 2025); effective 1 Jan 2026.", "source_url": "https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0003-003: 11 CCR Section 7157, CCPA Regulations on Automated Decisionmaking Technology, Risk Assessments and Cybersecurity Audits. wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0003-003/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0003-004", "provision": "11 CCR Section 7120-7124", "applies_to": [ "Businesses" ], "duty": "Complete an annual independent cybersecurity audit if your processing presents significant security risk, and certify completion to the CPPA by each 1 Apr; the first report is due 1 Apr 2028, 2029 or 2030 by revenue.", "type": "Security testing", "status": "applies later", "applies_from": "2028-04-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0003-004/", "rule": { "record_id": "WTA-R-US-CA-0003", "id": "us-ca-ccpa-admt-regulations-2025", "title": "CCPA Regulations on Automated Decisionmaking Technology, Risk Assessments and Cybersecurity Audits", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-ccpa-admt-regulations-2025/" }, "penalty": "Administrative fines up to $2,663 per violation or $7,988 per intentional violation or violation involving known minors under 16 (Civil Code 1798.155(a), CPI-adjusted from 1 Jan 2025); AG civil penalties at the same levels (1798.199.90).", "scope_note": "Applies to businesses subject to the CCPA. Significant security risk: businesses deriving 50% or more of revenue from selling or sharing personal information, or meeting the revenue threshold and processing personal information of 250,000+ consumers or sensitive personal information of 50,000+ consumers (7120(b)).", "date_note": "Regulations approved by OAL 22 Sep 2025 (adopted by the CPPA Board 24 Jul 2025); effective 1 Jan 2026. First report due 1 Apr 2028 if 2026 revenue exceeded $100 million; 1 Apr 2029 if 2027 revenue was $50-100 million; 1 Apr 2030 if 2028 revenue was under $50 million; then each 1 Apr (7121).", "source_url": "https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0003-004: 11 CCR Section 7120-7124, CCPA Regulations on Automated Decisionmaking Technology, Risk Assessments and Cybersecurity Audits. wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0003-004/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0003-005", "provision": "11 CCR Section 7220", "applies_to": [ "Deployers" ], "duty": "Give consumers a Pre-use Notice at or before collecting their data for ADMT use in significant decisions, explaining the specific purpose, how the ADMT works, and how to opt out (or appeal) and access ADMT information.", "type": "Transparency to users", "status": "applies later", "applies_from": "2027-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0003-005/", "rule": { "record_id": "WTA-R-US-CA-0003", "id": "us-ca-ccpa-admt-regulations-2025", "title": "CCPA Regulations on Automated Decisionmaking Technology, Risk Assessments and Cybersecurity Audits", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-ccpa-admt-regulations-2025/" }, "penalty": "Administrative fines up to $2,663 per violation or $7,988 per intentional violation or violation involving known minors under 16 (Civil Code 1798.155(a), CPI-adjusted from 1 Jan 2025); AG civil penalties at the same levels (1798.199.90).", "scope_note": "Applies to businesses subject to the CCPA. ADMT: technology that processes personal information and uses computation to replace or substantially replace human decisionmaking (11 CCR 7001(e)). Significant decision: provision or denial of financial or lending services, housing, education, employment or compensation, or healthcare (7001(ddd)).", "date_note": "Regulations approved by OAL 22 Sep 2025 (adopted by the CPPA Board 24 Jul 2025); effective 1 Jan 2026. Businesses using ADMT for significant decisions before 1 Jan 2027 must comply by 1 Jan 2027 (7200(b)).", "source_url": "https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0003-005: 11 CCR Section 7220, CCPA Regulations on Automated Decisionmaking Technology, Risk Assessments and Cybersecurity Audits. wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0003-005/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0003-006", "provision": "11 CCR Section 7221(a)-(f)", "applies_to": [ "Deployers" ], "duty": "Let consumers opt out of ADMT used for significant decisions through at least two easy methods, unless an exception applies, such as offering an appeal to a qualified human reviewer with authority to overturn the decision.", "type": "Consumer rights", "status": "applies later", "applies_from": "2027-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0003-006/", "rule": { "record_id": "WTA-R-US-CA-0003", "id": "us-ca-ccpa-admt-regulations-2025", "title": "CCPA Regulations on Automated Decisionmaking Technology, Risk Assessments and Cybersecurity Audits", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-ccpa-admt-regulations-2025/" }, "penalty": "Administrative fines up to $2,663 per violation or $7,988 per intentional violation or violation involving known minors under 16 (Civil Code 1798.155(a), CPI-adjusted from 1 Jan 2025); AG civil penalties at the same levels (1798.199.90).", "scope_note": "Applies to businesses subject to the CCPA. Other exceptions cover certain admission, hiring, work-allocation and compensation uses where the ADMT works for its purpose and does not unlawfully discriminate (7221(b)(2)-(3)).", "date_note": "Regulations approved by OAL 22 Sep 2025 (adopted by the CPPA Board 24 Jul 2025); effective 1 Jan 2026. Compliance date 1 Jan 2027 (7200(b)).", "source_url": "https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0003-006: 11 CCR Section 7221(a)-(f), CCPA Regulations on Automated Decisionmaking Technology, Risk Assessments and Cybersecurity Audits. wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0003-006/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0003-007", "provision": "11 CCR Section 7221(m)-(n)", "applies_to": [ "Deployers" ], "duty": "Stop processing a consumer's personal information with the ADMT within 15 business days of an opt-out request and tell service providers and others processing it to do the same.", "type": "Consumer rights", "status": "applies later", "applies_from": "2027-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0003-007/", "rule": { "record_id": "WTA-R-US-CA-0003", "id": "us-ca-ccpa-admt-regulations-2025", "title": "CCPA Regulations on Automated Decisionmaking Technology, Risk Assessments and Cybersecurity Audits", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-ccpa-admt-regulations-2025/" }, "penalty": "Administrative fines up to $2,663 per violation or $7,988 per intentional violation or violation involving known minors under 16 (Civil Code 1798.155(a), CPI-adjusted from 1 Jan 2025); AG civil penalties at the same levels (1798.199.90).", "scope_note": "Applies to businesses subject to the CCPA. If the opt-out comes before processing starts, the business must not start it (7221(m)). Wait 12 months before asking the consumer to consent again (7221(k)).", "date_note": "Regulations approved by OAL 22 Sep 2025 (adopted by the CPPA Board 24 Jul 2025); effective 1 Jan 2026. Compliance date 1 Jan 2027 (7200(b)).", "source_url": "https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0003-007: 11 CCR Section 7221(m)-(n), CCPA Regulations on Automated Decisionmaking Technology, Risk Assessments and Cybersecurity Audits. wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0003-007/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0003-008", "provision": "11 CCR Section 7222", "applies_to": [ "Deployers" ], "duty": "Explain in plain language, when a consumer requests access to ADMT, the specific purpose of its use, the logic of the ADMT, and the outcome and how its output was used in the decision.", "type": "Consumer rights", "status": "applies later", "applies_from": "2027-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0003-008/", "rule": { "record_id": "WTA-R-US-CA-0003", "id": "us-ca-ccpa-admt-regulations-2025", "title": "CCPA Regulations on Automated Decisionmaking Technology, Risk Assessments and Cybersecurity Audits", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-ccpa-admt-regulations-2025/" }, "penalty": "Administrative fines up to $2,663 per violation or $7,988 per intentional violation or violation involving known minors under 16 (Civil Code 1798.155(a), CPI-adjusted from 1 Jan 2025); AG civil penalties at the same levels (1798.199.90).", "scope_note": "Applies to businesses subject to the CCPA. ADMT: technology that processes personal information and uses computation to replace or substantially replace human decisionmaking (11 CCR 7001(e)). Significant decision: provision or denial of financial or lending services, housing, education, employment or compensation, or healthcare (7001(ddd)).", "date_note": "Regulations approved by OAL 22 Sep 2025 (adopted by the CPPA Board 24 Jul 2025); effective 1 Jan 2026. Compliance date 1 Jan 2027 (7200(b)).", "source_url": "https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0003-008: 11 CCR Section 7222, CCPA Regulations on Automated Decisionmaking Technology, Risk Assessments and Cybersecurity Audits. wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0003-008/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0005-001", "provision": "Section 22602(a)", "applies_to": [ "Operators" ], "duty": "Tell users clearly and conspicuously that the companion chatbot is artificially generated and not human whenever a reasonable person could be misled into thinking they are talking to a human.", "type": "Transparency to users", "status": "applies now", "applies_from": "2026-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0005-001/", "rule": { "record_id": "WTA-R-US-CA-0005", "id": "us-ca-sb243-companion-chatbots-2025", "title": "Companion Chatbots (SB 243)", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-sb243-companion-chatbots-2025/" }, "penalty": "Private civil action by a person injured in fact: injunctive relief, damages of the greater of actual damages or $1,000 per violation, and reasonable attorney's fees and costs (Bus. & Prof. Code 22605).", "scope_note": "Operator: a person who makes a companion chatbot platform available to a user in California (22601(e)). Excludes customer-service bots, limited video-game bots and stand-alone voice assistants (22601(b)(2)).", "date_note": "SB 243, Chapter 677, Statutes of 2025, approved 13 Oct 2025; in effect 1 Jan 2026.", "source_url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC§ionNum=22602", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0005-001: Section 22602(a), Companion Chatbots (SB 243). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0005-001/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0005-002", "provision": "Section 22602(b)", "applies_to": [ "Operators" ], "duty": "Do not let a companion chatbot engage users unless you maintain a protocol to prevent suicidal ideation, suicide or self-harm content, including crisis-line referrals, and publish details of that protocol on your website.", "type": "Consumer rights", "status": "applies now", "applies_from": "2026-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0005-002/", "rule": { "record_id": "WTA-R-US-CA-0005", "id": "us-ca-sb243-companion-chatbots-2025", "title": "Companion Chatbots (SB 243)", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-sb243-companion-chatbots-2025/" }, "penalty": "Private civil action by a person injured in fact: injunctive relief, damages of the greater of actual damages or $1,000 per violation, and reasonable attorney's fees and costs (Bus. & Prof. Code 22605).", "scope_note": "Operator: a person who makes a companion chatbot platform available to a user in California (22601(e)). Excludes customer-service bots, limited video-game bots and stand-alone voice assistants (22601(b)(2)).", "date_note": "SB 243, Chapter 677, Statutes of 2025, approved 13 Oct 2025; in effect 1 Jan 2026.", "source_url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC§ionNum=22602", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0005-002: Section 22602(b), Companion Chatbots (SB 243). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0005-002/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0005-003", "provision": "Section 22602(c)", "applies_to": [ "Operators" ], "duty": "Tell users known to be minors that they are interacting with AI, remind them at least every three hours to take a break, and take reasonable measures to stop sexually explicit material or prompts to sexual conduct.", "type": "Consumer rights", "status": "applies now", "applies_from": "2026-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0005-003/", "rule": { "record_id": "WTA-R-US-CA-0005", "id": "us-ca-sb243-companion-chatbots-2025", "title": "Companion Chatbots (SB 243)", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-sb243-companion-chatbots-2025/" }, "penalty": "Private civil action by a person injured in fact: injunctive relief, damages of the greater of actual damages or $1,000 per violation, and reasonable attorney's fees and costs (Bus. & Prof. Code 22605).", "scope_note": "Operator: a person who makes a companion chatbot platform available to a user in California (22601(e)). Excludes customer-service bots, limited video-game bots and stand-alone voice assistants (22601(b)(2)).", "date_note": "SB 243, Chapter 677, Statutes of 2025, approved 13 Oct 2025; in effect 1 Jan 2026. SB 1119 (Chapter 190, Statutes of 2026) rewrites Section 22602 without subdivision (c), so these minor-specific duties end when SB 1119 takes effect on 1 Jan 2027; SB 1119's child protections replace them from 1 Jul 2027.", "source_url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC§ionNum=22602", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0005-003: Section 22602(c), Companion Chatbots (SB 243). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0005-003/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0005-004", "provision": "Section 22603", "applies_to": [ "Operators" ], "duty": "Report yearly to the Office of Suicide Prevention your crisis referral count, your protocols for detecting and responding to suicidal ideation, and your protocols prohibiting chatbot responses about it, with no user identifiers.", "type": "Registration or filing", "status": "applies later", "applies_from": "2027-07-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0005-004/", "rule": { "record_id": "WTA-R-US-CA-0005", "id": "us-ca-sb243-companion-chatbots-2025", "title": "Companion Chatbots (SB 243)", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-sb243-companion-chatbots-2025/" }, "penalty": "Private civil action by a person injured in fact: injunctive relief, damages of the greater of actual damages or $1,000 per violation, and reasonable attorney's fees and costs (Bus. & Prof. Code 22605).", "scope_note": "Operator: a person who makes a companion chatbot platform available to a user in California (22601(e)). Excludes customer-service bots, limited video-game bots and stand-alone voice assistants (22601(b)(2)). Operators must use evidence-based methods for measuring suicidal ideation (22603(d)).", "date_note": "SB 243, Chapter 677, Statutes of 2025, approved 13 Oct 2025; in effect 1 Jan 2026. Reports begin 1 Jul 2027 (22603(a)).", "source_url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC§ionNum=22603", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0005-004: Section 22603, Companion Chatbots (SB 243). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0005-004/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0005-005", "provision": "Section 22604", "applies_to": [ "Operators" ], "duty": "Disclose on the app, browser or other access format that companion chatbots may not be suitable for some minors.", "type": "Transparency to users", "status": "applies now", "applies_from": "2026-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0005-005/", "rule": { "record_id": "WTA-R-US-CA-0005", "id": "us-ca-sb243-companion-chatbots-2025", "title": "Companion Chatbots (SB 243)", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-sb243-companion-chatbots-2025/" }, "penalty": "Private civil action by a person injured in fact: injunctive relief, damages of the greater of actual damages or $1,000 per violation, and reasonable attorney's fees and costs (Bus. & Prof. Code 22605).", "scope_note": "Operator: a person who makes a companion chatbot platform available to a user in California (22601(e)). Excludes customer-service bots, limited video-game bots and stand-alone voice assistants (22601(b)(2)).", "date_note": "SB 243, Chapter 677, Statutes of 2025, approved 13 Oct 2025; in effect 1 Jan 2026.", "source_url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC§ionNum=22604", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0005-005: Section 22604, Companion Chatbots (SB 243). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0005-005/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0007-001", "provision": "Section 21811", "applies_to": [ "Operators" ], "duty": "Determine each user's age under the Digital Age Assurance Act (Civ. Code Title 1.81.9) or apply the child protections of 21812(d) and 21813 to all users.", "type": "Consumer rights", "status": "applies later", "applies_from": "2027-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0007-001/", "rule": { "record_id": "WTA-R-US-CA-0007", "id": "us-ca-sb1119-adams-law-companion-chatbots-children-2026", "title": "Companion Chatbots: Children’s Safety (SB 1119, ‘Adam’s Law’)", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-sb1119-adams-law-companion-chatbots-children-2026/" }, "penalty": "Public prosecutors may seek civil penalties up to $5,000 per affected child per negligent violation and $15,000 per affected child per intentional violation; children harmed by violations of 21812(d)(1)-(5), or their parents, may sue for actual damages (Bus. & Prof. Code 21816).", "scope_note": "If age cannot be determined that way, the operator relies on the age determination under Health & Safety Code 27001(a)(1)(B). Parental default settings may change only with actual knowledge the user is not a child.", "date_note": "No separate operative date, so this section applies when the act takes effect on 1 Jan 2027. Our record gives 1 Jul 2027 as the effective date, but that is the operative date of 21812, 21812.5 and 21813 only.", "source_url": "https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB1119", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0007-001: Section 21811, Companion Chatbots: Children’s Safety (SB 1119, ‘Adam’s Law’). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0007-001/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0007-002", "provision": "Section 21812(a)", "applies_to": [ "Operators" ], "duty": "Perform and document, before releasing a new or substantially modified companion chatbot, a child-safety risk assessment of each covered harm and its evaluation methods, and take and document reasonable mitigations.", "type": "Impact assessment", "status": "applies later", "applies_from": "2027-07-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0007-002/", "rule": { "record_id": "WTA-R-US-CA-0007", "id": "us-ca-sb1119-adams-law-companion-chatbots-children-2026", "title": "Companion Chatbots: Children’s Safety (SB 1119, ‘Adam’s Law’)", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-sb1119-adams-law-companion-chatbots-children-2026/" }, "penalty": "Public prosecutors may seek civil penalties up to $5,000 per affected child per negligent violation and $15,000 per affected child per intentional violation; children harmed by violations of 21812(d)(1)-(5), or their parents, may sue for actual damages (Bus. & Prof. Code 21816).", "scope_note": "Applies to operators that allow child users. One assessment may cover comparable chatbots; an assessment made under another law with similar scope may be reused. Covered harms include physical, financial, severe psychological, privacy and discrimination harms (21810.5(g)).", "date_note": "SB 1119, Chapter 190, Statutes of 2026, approved 10 Sep 2026; statute takes effect 1 Jan 2027, most duties operative 1 Jul 2027. Operative 1 Jul 2027 (21812(e)).", "source_url": "https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB1119", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0007-002: Section 21812(a), Companion Chatbots: Children’s Safety (SB 1119, ‘Adam’s Law’). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0007-002/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0007-003", "provision": "Section 21812(b)-(c)", "applies_to": [ "Operators" ], "duty": "Publish and keep current a child safety policy describing how the chatbot prevents and responds to covered harms, age assurance, data and advertising limits, defaults and crisis protocols, or, if children are barred, how age assurance works.", "type": "Transparency to users", "status": "applies later", "applies_from": "2027-07-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0007-003/", "rule": { "record_id": "WTA-R-US-CA-0007", "id": "us-ca-sb1119-adams-law-companion-chatbots-children-2026", "title": "Companion Chatbots: Children’s Safety (SB 1119, ‘Adam’s Law’)", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-sb1119-adams-law-companion-chatbots-children-2026/" }, "penalty": "Public prosecutors may seek civil penalties up to $5,000 per affected child per negligent violation and $15,000 per affected child per intentional violation; children harmed by violations of 21812(d)(1)-(5), or their parents, may sue for actual damages (Bus. & Prof. Code 21816).", "scope_note": null, "date_note": "SB 1119, Chapter 190, Statutes of 2026, approved 10 Sep 2026; statute takes effect 1 Jan 2027, most duties operative 1 Jul 2027. Operative 1 Jul 2027 (21812(e)).", "source_url": "https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB1119", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0007-003: Section 21812(b)-(c), Companion Chatbots: Children’s Safety (SB 1119, ‘Adam’s Law’). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0007-003/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0007-004", "provision": "Section 21812(d)(1)", "applies_to": [ "Operators" ], "duty": "Implement a documented crisis response protocol for child users, with in-service referrals to crisis services and, on a credible imminent threat, parent notification or direct 988 helpline access.", "type": "Consumer rights", "status": "applies later", "applies_from": "2027-07-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0007-004/", "rule": { "record_id": "WTA-R-US-CA-0007", "id": "us-ca-sb1119-adams-law-companion-chatbots-children-2026", "title": "Companion Chatbots: Children’s Safety (SB 1119, ‘Adam’s Law’)", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-sb1119-adams-law-companion-chatbots-children-2026/" }, "penalty": "Public prosecutors may seek civil penalties up to $5,000 per affected child per negligent violation and $15,000 per affected child per intentional violation; children harmed by violations of 21812(d)(1)-(5), or their parents, may sue for actual damages (Bus. & Prof. Code 21816).", "scope_note": "Children whose accounts are linked to a parent must be told a parent may be notified. Where a child dies or seriously self-harms, operators must notify a parent and preserve relevant conversation records for at least three years (21812.5).", "date_note": "SB 1119, Chapter 190, Statutes of 2026, approved 10 Sep 2026; statute takes effect 1 Jan 2027, most duties operative 1 Jul 2027. Operative 1 Jul 2027 (21812(e)).", "source_url": "https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB1119", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0007-004: Section 21812(d)(1), Companion Chatbots: Children’s Safety (SB 1119, ‘Adam’s Law’). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0007-004/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0007-005", "provision": "Section 21812(d)(3)", "applies_to": [ "Operators" ], "duty": "Set parent-only defaults for child users that disable persistent memory and push notifications and limit sessions to one hour and daily use to two hours, and provide and promote parental controls.", "type": "Consumer rights", "status": "applies later", "applies_from": "2027-07-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0007-005/", "rule": { "record_id": "WTA-R-US-CA-0007", "id": "us-ca-sb1119-adams-law-companion-chatbots-children-2026", "title": "Companion Chatbots: Children’s Safety (SB 1119, ‘Adam’s Law’)", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-sb1119-adams-law-companion-chatbots-children-2026/" }, "penalty": "Public prosecutors may seek civil penalties up to $5,000 per affected child per negligent violation and $15,000 per affected child per intentional violation; children harmed by violations of 21812(d)(1)-(5), or their parents, may sue for actual damages (Bus. & Prof. Code 21816).", "scope_note": "Parental controls must let parents adjust each default and disable access for children under 16. Narrow memory rules apply for users aged 16 and 17. Without a linked parent account the defaults cannot be changed.", "date_note": "SB 1119, Chapter 190, Statutes of 2026, approved 10 Sep 2026; statute takes effect 1 Jan 2027, most duties operative 1 Jul 2027. Operative 1 Jul 2027 (21812(e)).", "source_url": "https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB1119", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0007-005: Section 21812(d)(3), Companion Chatbots: Children’s Safety (SB 1119, ‘Adam’s Law’). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0007-005/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0007-006", "provision": "Section 21812(d)(2), (d)(4)", "applies_to": [ "Operators" ], "duty": "Tell child users in age-appropriate language that they are interacting with or receiving content from AI, repeat the notice during extended interactions, and provide usage reminders and other protective design features.", "type": "Transparency to users", "status": "applies later", "applies_from": "2027-07-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0007-006/", "rule": { "record_id": "WTA-R-US-CA-0007", "id": "us-ca-sb1119-adams-law-companion-chatbots-children-2026", "title": "Companion Chatbots: Children’s Safety (SB 1119, ‘Adam’s Law’)", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-sb1119-adams-law-companion-chatbots-children-2026/" }, "penalty": "Public prosecutors may seek civil penalties up to $5,000 per affected child per negligent violation and $15,000 per affected child per intentional violation; children harmed by violations of 21812(d)(1)-(5), or their parents, may sue for actual damages (Bus. & Prof. Code 21816).", "scope_note": null, "date_note": "SB 1119, Chapter 190, Statutes of 2026, approved 10 Sep 2026; statute takes effect 1 Jan 2027, most duties operative 1 Jul 2027. Operative 1 Jul 2027 (21812(e)).", "source_url": "https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB1119", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0007-006: Section 21812(d)(2), (d)(4), Companion Chatbots: Children’s Safety (SB 1119, ‘Adam’s Law’). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0007-006/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0007-007", "provision": "Section 21812(d)(5)", "applies_to": [ "Operators" ], "duty": "Take reasonable measures to stop the chatbot encouraging self-harm, drugs or disordered eating, diagnosing health conditions, sexual content, claiming to be human or sentient, romantic interest, soliciting purchases, or fostering emotional reliance with child users.", "type": "Prohibited uses", "status": "applies later", "applies_from": "2027-07-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0007-007/", "rule": { "record_id": "WTA-R-US-CA-0007", "id": "us-ca-sb1119-adams-law-companion-chatbots-children-2026", "title": "Companion Chatbots: Children’s Safety (SB 1119, ‘Adam’s Law’)", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-sb1119-adams-law-companion-chatbots-children-2026/" }, "penalty": "Public prosecutors may seek civil penalties up to $5,000 per affected child per negligent violation and $15,000 per affected child per intentional violation; children harmed by violations of 21812(d)(1)-(5), or their parents, may sue for actual damages (Bus. & Prof. Code 21816).", "scope_note": "Full list of 14 behaviours in 21812(d)(5)(A)(i)-(xiv). Age-appropriate safety information about abuse, neglect or bullying is allowed. Diagnosis bar does not apply to FDA-regulated medical-device chatbots.", "date_note": "SB 1119, Chapter 190, Statutes of 2026, approved 10 Sep 2026; statute takes effect 1 Jan 2027, most duties operative 1 Jul 2027. Operative 1 Jul 2027 (21812(e)).", "source_url": "https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB1119", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0007-007: Section 21812(d)(5), Companion Chatbots: Children’s Safety (SB 1119, ‘Adam’s Law’). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0007-007/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0007-008", "provision": "Section 21813", "applies_to": [ "Operators" ], "duty": "Do not show child users cross-context behavioural or chat-based targeted advertising, sell their personal information, use it beyond listed necessary purposes, or use dark patterns in safety features and controls.", "type": "Data governance", "status": "applies later", "applies_from": "2027-07-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0007-008/", "rule": { "record_id": "WTA-R-US-CA-0007", "id": "us-ca-sb1119-adams-law-companion-chatbots-children-2026", "title": "Companion Chatbots: Children’s Safety (SB 1119, ‘Adam’s Law’)", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-sb1119-adams-law-companion-chatbots-children-2026/" }, "penalty": "Public prosecutors may seek civil penalties up to $5,000 per affected child per negligent violation and $15,000 per affected child per intentional violation; children harmed by violations of 21812(d)(1)-(5), or their parents, may sue for actual damages (Bus. & Prof. Code 21816).", "scope_note": "Age-appropriate contextual advertising using limited categories is allowed and must be labelled as an advertisement.", "date_note": "SB 1119, Chapter 190, Statutes of 2026, approved 10 Sep 2026; statute takes effect 1 Jan 2027, most duties operative 1 Jul 2027. Operative 1 Jul 2027 (21813(b)).", "source_url": "https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB1119", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0007-008: Section 21813, Companion Chatbots: Children’s Safety (SB 1119, ‘Adam’s Law’). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0007-008/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0007-009", "provision": "Section 21814(a) (AB 1405 version)", "applies_to": [ "Operators" ], "duty": "Obtain an independent child safety audit by the later of 1 Jan 2029 or first public release, then every two years and before releasing higher-risk substantial modifications, and keep audit documents and the report for deployment plus five years.", "type": "Conformity assessment", "status": "applies later", "applies_from": "2029-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0007-009/", "rule": { "record_id": "WTA-R-US-CA-0007", "id": "us-ca-sb1119-adams-law-companion-chatbots-children-2026", "title": "Companion Chatbots: Children’s Safety (SB 1119, ‘Adam’s Law’)", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-sb1119-adams-law-companion-chatbots-children-2026/" }, "penalty": "Public prosecutors may seek civil penalties up to $5,000 per affected child per negligent violation and $15,000 per affected child per intentional violation; children harmed by violations of 21812(d)(1)-(5), or their parents, may sue for actual damages (Bus. & Prof. Code 21816).", "scope_note": "Before 1 Jan 2032 the section does not apply to operators with under $500 million gross revenue in the prior year (21814(c)). One audit may cover comparable chatbots.", "date_note": "Because AB 1405 (Chapter 178, Statutes of 2026, approved 9 Sep 2026) was chaptered and takes effect 1 Jan 2027, the second version of 21814 in SB 1119 applies (21814(f)).", "source_url": "https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB1119", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0007-009: Section 21814(a) (AB 1405 version), Companion Chatbots: Children’s Safety (SB 1119, ‘Adam’s Law’). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0007-009/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0007-010", "provision": "Section 21814(b), (d) (AB 1405 version)", "applies_to": [ "Operators" ], "duty": "Send the Attorney General an officer-attested summary of each child safety audit within 30 business days, post a high-level summary on your website within 90 days, and provide the full report if the Attorney General requests it for cause.", "type": "Registration or filing", "status": "applies later", "applies_from": "2029-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0007-010/", "rule": { "record_id": "WTA-R-US-CA-0007", "id": "us-ca-sb1119-adams-law-companion-chatbots-children-2026", "title": "Companion Chatbots: Children’s Safety (SB 1119, ‘Adam’s Law’)", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-sb1119-adams-law-companion-chatbots-children-2026/" }, "penalty": "Public prosecutors may seek civil penalties up to $5,000 per affected child per negligent violation and $15,000 per affected child per intentional violation; children harmed by violations of 21812(d)(1)-(5), or their parents, may sue for actual damages (Bus. & Prof. Code 21816).", "scope_note": "Audit reports given to the Attorney General are confidential (21814(e)). Before 1 Jan 2032 the section does not apply to operators with under $500 million gross revenue in the prior year (21814(c)).", "date_note": "Applies once audits are due (first by the later of 1 Jan 2029 or first public release). AB 1405-linked version applies (21814(f)).", "source_url": "https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB1119", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0007-010: Section 21814(b), (d) (AB 1405 version), Companion Chatbots: Children’s Safety (SB 1119, ‘Adam’s Law’). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0007-010/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0001-001", "provision": "Section 22757.2(a)-(b)", "applies_to": [ "Providers" ], "duty": "Offer a free, publicly accessible disclosure verification tool, with API access, that lets users check whether image, video or audio content was made or altered by your GenAI system and shows detected system provenance data.", "type": "Labelling AI content", "status": "applies now", "applies_from": "2026-08-02", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0001-001/", "rule": { "record_id": "WTA-R-US-CA-0001", "id": "us-ca-ai-transparency-act-sb942", "title": "California AI Transparency Act (SB 942, as amended by AB 853 and SB 1000)", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-ai-transparency-act-sb942/" }, "penalty": "Civil penalty of $5,000 per violation, each day a separate violation, in actions by the Attorney General, a city attorney or county counsel, plus attorney's fees for a prevailing plaintiff (Bus. & Prof. Code 22757.4).", "scope_note": "Covered provider: a person that creates, codes or produces a GenAI system publicly accessible in California (22757.1(e)). Before 1 Jan 2029 the chapter does not apply to GenAI systems designed primarily as assistive technology; exclusively non-user-generated video games are exempt (22757.5). The tool must not output personal information without express consent; providers must collect user feedback on efficacy and may use a compliant third-party tool (22757.2(a)(3), (b), (e)).", "date_note": "SB 942 (Chapter 291, Statutes of 2024, approved 19 Sep 2024); operative date moved to 2 Aug 2026 by AB 853 (Chapter 674, Statutes of 2025; 22757.6). SB 1000 (Chapter 861, Statutes of 2026), an urgency statute effective 30 Sep 2026, removed the 1,000,000-user threshold and the manifest-disclosure option.", "source_url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC§ionNum=22757.2", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0001-001: Section 22757.2(a)-(b), California AI Transparency Act (SB 942, as amended by AB 853 and SB 1000). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0001-001/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0001-002", "provision": "Section 22757.3(a)", "applies_to": [ "Providers" ], "duty": "Embed, where technically feasible, a permanent or hard-to-remove latent disclosure in AI-created or altered image, video or audio content naming the provider, system and version, creation time, a unique identifier, and whether content was created or altered.", "type": "Labelling AI content", "status": "applies now", "applies_from": "2026-08-02", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0001-002/", "rule": { "record_id": "WTA-R-US-CA-0001", "id": "us-ca-ai-transparency-act-sb942", "title": "California AI Transparency Act (SB 942, as amended by AB 853 and SB 1000)", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-ai-transparency-act-sb942/" }, "penalty": "Civil penalty of $5,000 per violation, each day a separate violation, in actions by the Attorney General, a city attorney or county counsel, plus attorney's fees for a prevailing plaintiff (Bus. & Prof. Code 22757.4).", "scope_note": "Covered provider: a person that creates, codes or produces a GenAI system publicly accessible in California (22757.1(e)). Before 1 Jan 2029 the chapter does not apply to GenAI systems designed primarily as assistive technology; exclusively non-user-generated video games are exempt (22757.5). Disclosure must work with the provider's verification tool and widely recognised industry standards. Minor edits such as cropping or colour changes are excluded.", "date_note": "SB 942 (Chapter 291, Statutes of 2024, approved 19 Sep 2024); operative date moved to 2 Aug 2026 by AB 853 (Chapter 674, Statutes of 2025; 22757.6). SB 1000 (Chapter 861, Statutes of 2026), an urgency statute effective 30 Sep 2026, removed the 1,000,000-user threshold and the manifest-disclosure option. From 1 Jan 2029 the disclosure must also state whether the system is designed primarily as assistive technology (22757.3(a)(1)(F)).", "source_url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC§ionNum=22757.3", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0001-002: Section 22757.3(a), California AI Transparency Act (SB 942, as amended by AB 853 and SB 1000). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0001-002/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0001-003", "provision": "Section 22757.3(b)", "applies_to": [ "Providers", "Deployers" ], "duty": "Tell licensees of their obligations when licensing a GenAI system; within 72 hours of learning a licensee broke compliance, revoke the licence or notify it, and report unremedied licensees to the Attorney General.", "type": "Labelling AI content", "status": "applies now", "applies_from": "2026-08-02", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0001-003/", "rule": { "record_id": "WTA-R-US-CA-0001", "id": "us-ca-ai-transparency-act-sb942", "title": "California AI Transparency Act (SB 942, as amended by AB 853 and SB 1000)", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-ai-transparency-act-sb942/" }, "penalty": "Civil penalty of $5,000 per violation, each day a separate violation, in actions by the Attorney General, a city attorney or county counsel, plus attorney's fees for a prevailing plaintiff (Bus. & Prof. Code 22757.4).", "scope_note": "Covered provider: a person that creates, codes or produces a GenAI system publicly accessible in California (22757.1(e)). Before 1 Jan 2029 the chapter does not apply to GenAI systems designed primarily as assistive technology; exclusively non-user-generated video games are exempt (22757.5). A notified licensee must fix the system or stop using and distributing it and report which it did to the provider within 96 hours (22757.3(b)(3)). Providers need not monitor licensees.", "date_note": "SB 942 (Chapter 291, Statutes of 2024, approved 19 Sep 2024); operative date moved to 2 Aug 2026 by AB 853 (Chapter 674, Statutes of 2025; 22757.6). SB 1000 (Chapter 861, Statutes of 2026), an urgency statute effective 30 Sep 2026, removed the 1,000,000-user threshold and the manifest-disclosure option.", "source_url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC§ionNum=22757.3", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0001-003: Section 22757.3(b), California AI Transparency Act (SB 942, as amended by AB 853 and SB 1000). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0001-003/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0001-004", "provision": "Section 22757.3(d)", "applies_to": [ "Providers" ], "duty": "Do not falsely represent that a GenAI system is designed to primarily function as assistive technology.", "type": "Transparency to users", "status": "applies now", "applies_from": "2026-09-30", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0001-004/", "rule": { "record_id": "WTA-R-US-CA-0001", "id": "us-ca-ai-transparency-act-sb942", "title": "California AI Transparency Act (SB 942, as amended by AB 853 and SB 1000)", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-ai-transparency-act-sb942/" }, "penalty": "Civil penalty of $50,000 per violation, each day a separate violation, in actions by the Attorney General, a city attorney or county counsel (Bus. & Prof. Code 22757.4.1, repealed 1 Jan 2029).", "scope_note": "Covered provider: a person that creates, codes or produces a GenAI system publicly accessible in California (22757.1(e)). Before 1 Jan 2029 the chapter does not apply to GenAI systems designed primarily as assistive technology; exclusively non-user-generated video games are exempt (22757.5).", "date_note": "Added by SB 1000, urgency statute effective 30 Sep 2026.", "source_url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC§ionNum=22757.3", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0001-004: Section 22757.3(d), California AI Transparency Act (SB 942, as amended by AB 853 and SB 1000). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0001-004/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0001-005", "provision": "Section 22757.3.1 (as amended by AB 2713)", "applies_to": [ "Platforms" ], "duty": "Detect provenance data on distributed content, show users whether system provenance data or signatures indicate AI generation or capture-device origin, let users inspect it, and do not knowingly strip provenance data or signatures.", "type": "Labelling AI content", "status": "applies later", "applies_from": "2027-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0001-005/", "rule": { "record_id": "WTA-R-US-CA-0001", "id": "us-ca-ai-transparency-act-sb942", "title": "California AI Transparency Act (SB 942, as amended by AB 853 and SB 1000)", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-ai-transparency-act-sb942/" }, "penalty": "Civil penalty of $5,000 per violation, each day a separate violation, in actions by the Attorney General, a city attorney or county counsel, plus attorney's fees for a prevailing plaintiff (Bus. & Prof. Code 22757.4).", "scope_note": "Large online platform: social media, file-sharing, mass messaging platform or stand-alone search engine with over 2,000,000 unique monthly users in the prior 12 months (22757.1(i)). Duties cover only provenance data compliant with widely adopted standards; no duty to display or offer download of personal information.", "date_note": "Added by AB 853, operative 1 Jan 2027; rewritten by AB 2713 (Chapter 856, Statutes of 2026, approved 30 Sep 2026), also operative 1 Jan 2027.", "source_url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC§ionNum=22757.3.1", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0001-005: Section 22757.3.1 (as amended by AB 2713), California AI Transparency Act (SB 942, as amended by AB 853 and SB 1000). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0001-005/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0001-006", "provision": "Section 22757.3.2", "applies_to": [ "Platforms" ], "duty": "Do not knowingly make available for download a GenAI system that does not place the latent disclosures required by Section 22757.3.", "type": "Labelling AI content", "status": "applies later", "applies_from": "2027-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0001-006/", "rule": { "record_id": "WTA-R-US-CA-0001", "id": "us-ca-ai-transparency-act-sb942", "title": "California AI Transparency Act (SB 942, as amended by AB 853 and SB 1000)", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-ai-transparency-act-sb942/" }, "penalty": "Civil penalty of $5,000 per violation, each day a separate violation, in actions by the Attorney General, a city attorney or county counsel, plus attorney's fees for a prevailing plaintiff (Bus. & Prof. Code 22757.4).", "scope_note": "Applies to GenAI system hosting platforms that make source code or model weights available for download (22757.1(h)).", "date_note": "Added by AB 853 (Chapter 674, Statutes of 2025); operative 1 Jan 2027.", "source_url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC§ionNum=22757.3.2", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0001-006: Section 22757.3.2, California AI Transparency Act (SB 942, as amended by AB 853 and SB 1000). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0001-006/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0001-007", "provision": "Section 22757.3.3", "applies_to": [ "Providers" ], "duty": "Offer users of capture devices first produced for sale in California from 1 Jan 2028 a latent disclosure naming the manufacturer, device and version, and capture time, and embed it by default.", "type": "Labelling AI content", "status": "applies later", "applies_from": "2028-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0001-007/", "rule": { "record_id": "WTA-R-US-CA-0001", "id": "us-ca-ai-transparency-act-sb942", "title": "California AI Transparency Act (SB 942, as amended by AB 853 and SB 1000)", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-ai-transparency-act-sb942/" }, "penalty": "Civil penalty of $5,000 per violation, each day a separate violation, in actions by the Attorney General, a city attorney or county counsel, plus attorney's fees for a prevailing plaintiff (Bus. & Prof. Code 22757.4).", "scope_note": "Applies to capture device manufacturers (cameras, phones, voice recorders), only where technically feasible and compliant with widely adopted standards. 'provider' is used here because the schema has no manufacturer role.", "date_note": "Added by AB 853 (Chapter 674, Statutes of 2025); operative 1 Jan 2028.", "source_url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC§ionNum=22757.3.3", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0001-007: Section 22757.3.3, California AI Transparency Act (SB 942, as amended by AB 853 and SB 1000). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0001-007/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0008-001", "provision": "Labor Code Section 1522(a)", "applies_to": [ "Employers" ], "duty": "Do not use an automated decision system to violate labour, safety, employment or civil rights laws, to infer an employee's protected status, or to predict and punish workers for exercising legal rights.", "type": "Prohibited uses", "status": "applies later", "applies_from": "2027-07-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0008-001/", "rule": { "record_id": "WTA-R-US-CA-0008", "id": "us-ca-sb947-no-robo-bosses-2026", "title": "Employment: Automated Decision Systems (SB 947, ‘No Robo Bosses Act’)", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-sb947-no-robo-bosses-2026/" }, "penalty": "Civil penalty of $500 per violation (Lab. Code 1526.1(e)); enforced by the Labor Commissioner and public prosecutors, with injunctive relief, punitive damages and attorney's fees available in civil actions (1526.1(a), (b), (d)).", "scope_note": "Employer includes public employers, labor contractors and farm labor contractors (1520(d)(3)). ADS excludes spam filters, firewalls, antivirus, calculators and databases (1520(c)). Does not apply where a collective agreement expressly waives it, or to uses required by certain federal aerospace or defence obligations (1526.5, 1526.6).", "date_note": "SB 947, Chapter 859, Statutes of 2026, approved 30 Sep 2026; Part 5.5.5 operative 1 Jul 2027 (Lab. Code 1526.7).", "source_url": "https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB947", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0008-001: Labor Code Section 1522(a), Employment: Automated Decision Systems (SB 947, ‘No Robo Bosses Act’). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0008-001/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0008-002", "provision": "Labor Code Section 1522(b)-(c)", "applies_to": [ "Employers" ], "duty": "Do not rely solely on an automated decision system for discipline or termination; when relying primarily on its output, have a human corroborate it, and do not use output that cannot be corroborated or is inaccurate.", "type": "Human oversight", "status": "applies later", "applies_from": "2027-07-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0008-002/", "rule": { "record_id": "WTA-R-US-CA-0008", "id": "us-ca-sb947-no-robo-bosses-2026", "title": "Employment: Automated Decision Systems (SB 947, ‘No Robo Bosses Act’)", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-sb947-no-robo-bosses-2026/" }, "penalty": "Civil penalty of $500 per violation (Lab. Code 1526.1(e)); enforced by the Labor Commissioner and public prosecutors, with injunctive relief, punitive damages and attorney's fees available in civil actions (1526.1(a), (b), (d)).", "scope_note": "Employer includes public employers, labor contractors and farm labor contractors (1520(d)(3)). ADS excludes spam filters, firewalls, antivirus, calculators and databases (1520(c)). Does not apply where a collective agreement expressly waives it, or to uses required by certain federal aerospace or defence obligations (1526.5, 1526.6). Corroborating information may include supervisor evaluations, personnel files, work product, peer reviews and witness interviews.", "date_note": "SB 947, Chapter 859, Statutes of 2026, approved 30 Sep 2026; Part 5.5.5 operative 1 Jul 2027 (Lab. Code 1526.7).", "source_url": "https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB947", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0008-002: Labor Code Section 1522(b)-(c), Employment: Automated Decision Systems (SB 947, ‘No Robo Bosses Act’). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0008-002/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0008-003", "provision": "Labor Code Section 1522(d)-(e)", "applies_to": [ "Employers" ], "duty": "Give an employee disciplined or terminated primarily using an automated decision system, on request, a meaningful, objective description of their own data the system used, anonymising other people's personal information.", "type": "Consumer rights", "status": "applies later", "applies_from": "2027-07-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0008-003/", "rule": { "record_id": "WTA-R-US-CA-0008", "id": "us-ca-sb947-no-robo-bosses-2026", "title": "Employment: Automated Decision Systems (SB 947, ‘No Robo Bosses Act’)", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-sb947-no-robo-bosses-2026/" }, "penalty": "Civil penalty of $500 per violation (Lab. Code 1526.1(e)); enforced by the Labor Commissioner and public prosecutors, with injunctive relief, punitive damages and attorney's fees available in civil actions (1526.1(a), (b), (d)).", "scope_note": "Employer includes public employers, labor contractors and farm labor contractors (1520(d)(3)). ADS excludes spam filters, firewalls, antivirus, calculators and databases (1520(c)). Does not apply where a collective agreement expressly waives it, or to uses required by certain federal aerospace or defence obligations (1526.5, 1526.6).", "date_note": "SB 947, Chapter 859, Statutes of 2026, approved 30 Sep 2026; Part 5.5.5 operative 1 Jul 2027 (Lab. Code 1526.7).", "source_url": "https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB947", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0008-003: Labor Code Section 1522(d)-(e), Employment: Automated Decision Systems (SB 947, ‘No Robo Bosses Act’). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0008-003/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0008-004", "provision": "Labor Code Section 1524", "applies_to": [ "Employers" ], "duty": "Give an employee, when informing them of discipline or termination primarily based on an automated decision system, a plain-language stand-alone written notice stating this, that a human corroborated it, a contact person, and non-retaliation rights.", "type": "Transparency to users", "status": "applies later", "applies_from": "2027-07-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0008-004/", "rule": { "record_id": "WTA-R-US-CA-0008", "id": "us-ca-sb947-no-robo-bosses-2026", "title": "Employment: Automated Decision Systems (SB 947, ‘No Robo Bosses Act’)", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-sb947-no-robo-bosses-2026/" }, "penalty": "Civil penalty of $500 per violation (Lab. Code 1526.1(e)); enforced by the Labor Commissioner and public prosecutors, with injunctive relief, punitive damages and attorney's fees available in civil actions (1526.1(a), (b), (d)).", "scope_note": "Employer includes public employers, labor contractors and farm labor contractors (1520(d)(3)). ADS excludes spam filters, firewalls, antivirus, calculators and databases (1520(c)). Does not apply where a collective agreement expressly waives it, or to uses required by certain federal aerospace or defence obligations (1526.5, 1526.6). Notice must be in the language of routine workplace communications and delivered by a simple method such as email or hyperlink.", "date_note": "SB 947, Chapter 859, Statutes of 2026, approved 30 Sep 2026; Part 5.5.5 operative 1 Jul 2027 (Lab. Code 1526.7).", "source_url": "https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB947", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0008-004: Labor Code Section 1524, Employment: Automated Decision Systems (SB 947, ‘No Robo Bosses Act’). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0008-004/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-CA-0008-005", "provision": "Labor Code Section 1526", "applies_to": [ "Employers" ], "duty": "Do not discharge, threaten, demote, suspend or otherwise retaliate against an employee for using rights under the part, complaining to the Labor Commissioner, or helping enforce it.", "type": "Consumer rights", "status": "applies later", "applies_from": "2027-07-01", "url": "https://wheresthe.ai/id/WTA-R-US-CA-0008-005/", "rule": { "record_id": "WTA-R-US-CA-0008", "id": "us-ca-sb947-no-robo-bosses-2026", "title": "Employment: Automated Decision Systems (SB 947, ‘No Robo Bosses Act’)", "jurisdiction": "US-CA", "jurisdiction_name": "California", "url": "https://wheresthe.ai/rule/us-ca-sb947-no-robo-bosses-2026/" }, "penalty": "Civil penalty of $500 per violation (Lab. Code 1526.1(e)); enforced by the Labor Commissioner and public prosecutors, with injunctive relief, punitive damages and attorney's fees available in civil actions (1526.1(a), (b), (d)).", "scope_note": "Employer includes public employers, labor contractors and farm labor contractors (1520(d)(3)). ADS excludes spam filters, firewalls, antivirus, calculators and databases (1520(c)). Does not apply where a collective agreement expressly waives it, or to uses required by certain federal aerospace or defence obligations (1526.5, 1526.6).", "date_note": "SB 947, Chapter 859, Statutes of 2026, approved 30 Sep 2026; Part 5.5.5 operative 1 Jul 2027 (Lab. Code 1526.7).", "source_url": "https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB947", "verified_on": "2026-10-08", "citation": "WTA-R-US-CA-0008-005: Labor Code Section 1526, Employment: Automated Decision Systems (SB 947, ‘No Robo Bosses Act’). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0008-005/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-TX-0001-001", "provision": "Bus. & Com. Code Section 552.051(b)-(e)", "applies_to": [ "Public bodies" ], "duty": "Tell each consumer clearly, conspicuously and in plain language, before or at the time of interaction, that they are interacting with an AI system, even if it would be obvious, and do not use dark patterns.", "type": "Transparency to users", "status": "applies now", "applies_from": "2026-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-TX-0001-001/", "rule": { "record_id": "WTA-R-US-TX-0001", "id": "us-tx-traiga-hb149-2025", "title": "Texas Responsible Artificial Intelligence Governance Act (HB 149)", "jurisdiction": "US-TX", "jurisdiction_name": "Texas", "url": "https://wheresthe.ai/rule/us-tx-traiga-hb149-2025/" }, "penalty": "Attorney General only, after written notice and a 60-day cure period: $10,000-$12,000 per curable violation, $80,000-$200,000 per uncurable violation, $2,000-$40,000 per day of continuing violation, plus injunctions; no private right of action (Bus. & Com. Code 552.101, 552.104, 552.105).", "scope_note": "Applies to governmental agencies that make AI systems intended to interact with consumers available. A hyperlink to a separate page may be used.", "date_note": "HB 149 signed 22 Jun 2025; takes effect 1 Jan 2026 (Section 10).", "source_url": "https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm", "verified_on": "2026-10-08", "citation": "WTA-R-US-TX-0001-001: Bus. & Com. Code Section 552.051(b)-(e), Texas Responsible Artificial Intelligence Governance Act (HB 149). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-TX-0001-001/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-TX-0001-002", "provision": "Bus. & Com. Code Section 552.051(f)", "applies_to": [ "Deployers" ], "duty": "Disclose to the patient or their representative that an AI system is used in their health care service or treatment no later than when the service is first provided, or as soon as reasonably possible in an emergency.", "type": "Transparency to users", "status": "applies now", "applies_from": "2026-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-TX-0001-002/", "rule": { "record_id": "WTA-R-US-TX-0001", "id": "us-tx-traiga-hb149-2025", "title": "Texas Responsible Artificial Intelligence Governance Act (HB 149)", "jurisdiction": "US-TX", "jurisdiction_name": "Texas", "url": "https://wheresthe.ai/rule/us-tx-traiga-hb149-2025/" }, "penalty": "Attorney General only, after written notice and a 60-day cure period: $10,000-$12,000 per curable violation, $80,000-$200,000 per uncurable violation, $2,000-$40,000 per day of continuing violation, plus injunctions; no private right of action (Bus. & Com. Code 552.101, 552.104, 552.105).", "scope_note": "Applies to licensed health care providers using AI in relation to health care services or treatment (552.051(a), (f)).", "date_note": "HB 149 signed 22 Jun 2025; takes effect 1 Jan 2026 (Section 10).", "source_url": "https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm", "verified_on": "2026-10-08", "citation": "WTA-R-US-TX-0001-002: Bus. & Com. Code Section 552.051(f), Texas Responsible Artificial Intelligence Governance Act (HB 149). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-TX-0001-002/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-TX-0001-003", "provision": "Bus. & Com. Code Section 552.052", "applies_to": [ "Developers", "Deployers" ], "duty": "Do not develop or deploy an AI system in a way that intentionally aims to incite or encourage a person to commit self-harm, including suicide, harm another person, or commit a crime.", "type": "Prohibited uses", "status": "applies now", "applies_from": "2026-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-TX-0001-003/", "rule": { "record_id": "WTA-R-US-TX-0001", "id": "us-tx-traiga-hb149-2025", "title": "Texas Responsible Artificial Intelligence Governance Act (HB 149)", "jurisdiction": "US-TX", "jurisdiction_name": "Texas", "url": "https://wheresthe.ai/rule/us-tx-traiga-hb149-2025/" }, "penalty": "Attorney General only, after written notice and a 60-day cure period: $10,000-$12,000 per curable violation, $80,000-$200,000 per uncurable violation, $2,000-$40,000 per day of continuing violation, plus injunctions; no private right of action (Bus. & Com. Code 552.101, 552.104, 552.105).", "scope_note": "Applies to persons that do business in Texas, make products or services used by Texans, or develop or deploy AI systems in Texas (551.002). Defences include discovering violations through red-teaming or substantial compliance with the NIST AI RMF GenAI Profile (552.105(e)).", "date_note": "HB 149 signed 22 Jun 2025; takes effect 1 Jan 2026 (Section 10).", "source_url": "https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm", "verified_on": "2026-10-08", "citation": "WTA-R-US-TX-0001-003: Bus. & Com. Code Section 552.052, Texas Responsible Artificial Intelligence Governance Act (HB 149). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-TX-0001-003/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-TX-0001-004", "provision": "Bus. & Com. Code Section 552.053", "applies_to": [ "Public bodies" ], "duty": "Do not use or deploy an AI system to assign social scores based on social behaviour or personal characteristics that lead to unjustified, disproportionate or out-of-context detrimental treatment or infringe legal rights.", "type": "Prohibited uses", "status": "applies now", "applies_from": "2026-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-TX-0001-004/", "rule": { "record_id": "WTA-R-US-TX-0001", "id": "us-tx-traiga-hb149-2025", "title": "Texas Responsible Artificial Intelligence Governance Act (HB 149)", "jurisdiction": "US-TX", "jurisdiction_name": "Texas", "url": "https://wheresthe.ai/rule/us-tx-traiga-hb149-2025/" }, "penalty": "Attorney General only, after written notice and a 60-day cure period: $10,000-$12,000 per curable violation, $80,000-$200,000 per uncurable violation, $2,000-$40,000 per day of continuing violation, plus injunctions; no private right of action (Bus. & Com. Code 552.101, 552.104, 552.105).", "scope_note": "Applies to governmental entities; hospital districts and institutions of higher education are excluded from the definition (552.001(3)).", "date_note": "HB 149 signed 22 Jun 2025; takes effect 1 Jan 2026 (Section 10).", "source_url": "https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm", "verified_on": "2026-10-08", "citation": "WTA-R-US-TX-0001-004: Bus. & Com. Code Section 552.053, Texas Responsible Artificial Intelligence Governance Act (HB 149). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-TX-0001-004/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-TX-0001-005", "provision": "Bus. & Com. Code Section 552.054(b)", "applies_to": [ "Public bodies" ], "duty": "Do not develop or deploy AI to uniquely identify a specific person using biometric data or scraped online images without consent where the gathering would infringe constitutional or legal rights.", "type": "Prohibited uses", "status": "applies now", "applies_from": "2026-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-TX-0001-005/", "rule": { "record_id": "WTA-R-US-TX-0001", "id": "us-tx-traiga-hb149-2025", "title": "Texas Responsible Artificial Intelligence Governance Act (HB 149)", "jurisdiction": "US-TX", "jurisdiction_name": "Texas", "url": "https://wheresthe.ai/rule/us-tx-traiga-hb149-2025/" }, "penalty": "Attorney General only, after written notice and a 60-day cure period: $10,000-$12,000 per curable violation, $80,000-$200,000 per uncurable violation, $2,000-$40,000 per day of continuing violation, plus injunctions; no private right of action (Bus. & Com. Code 552.101, 552.104, 552.105).", "scope_note": "Applies to governmental entities. A violation of Bus. & Com. Code 503.001 (biometric identifiers) is also a violation of this section (552.054(c)).", "date_note": "HB 149 signed 22 Jun 2025; takes effect 1 Jan 2026 (Section 10).", "source_url": "https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm", "verified_on": "2026-10-08", "citation": "WTA-R-US-TX-0001-005: Bus. & Com. Code Section 552.054(b), Texas Responsible Artificial Intelligence Governance Act (HB 149). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-TX-0001-005/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-TX-0001-006", "provision": "Bus. & Com. Code Section 552.056", "applies_to": [ "Developers", "Deployers" ], "duty": "Do not develop or deploy an AI system with the intent to unlawfully discriminate against a protected class in violation of state or federal law.", "type": "Bias and non-discrimination", "status": "applies now", "applies_from": "2026-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-TX-0001-006/", "rule": { "record_id": "WTA-R-US-TX-0001", "id": "us-tx-traiga-hb149-2025", "title": "Texas Responsible Artificial Intelligence Governance Act (HB 149)", "jurisdiction": "US-TX", "jurisdiction_name": "Texas", "url": "https://wheresthe.ai/rule/us-tx-traiga-hb149-2025/" }, "penalty": "Attorney General only, after written notice and a 60-day cure period: $10,000-$12,000 per curable violation, $80,000-$200,000 per uncurable violation, $2,000-$40,000 per day of continuing violation, plus injunctions; no private right of action (Bus. & Com. Code 552.101, 552.104, 552.105).", "scope_note": "Disparate impact alone does not show intent (552.056(c)). Insurers subject to insurance anti-discrimination statutes are excluded; federally insured financial institutions complying with banking laws are deemed compliant.", "date_note": "HB 149 signed 22 Jun 2025; takes effect 1 Jan 2026 (Section 10).", "source_url": "https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm", "verified_on": "2026-10-08", "citation": "WTA-R-US-TX-0001-006: Bus. & Com. Code Section 552.056, Texas Responsible Artificial Intelligence Governance Act (HB 149). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-TX-0001-006/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-TX-0001-007", "provision": "Bus. & Com. Code Section 552.057", "applies_to": [ "Developers", "Distributors" ], "duty": "Do not develop or distribute AI solely to produce child sexual abuse material or unlawful sexual deepfakes, or intentionally distribute AI that conducts sexual text conversations while impersonating a child under 18.", "type": "Prohibited uses", "status": "applies now", "applies_from": "2026-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-TX-0001-007/", "rule": { "record_id": "WTA-R-US-TX-0001", "id": "us-tx-traiga-hb149-2025", "title": "Texas Responsible Artificial Intelligence Governance Act (HB 149)", "jurisdiction": "US-TX", "jurisdiction_name": "Texas", "url": "https://wheresthe.ai/rule/us-tx-traiga-hb149-2025/" }, "penalty": "Attorney General only, after written notice and a 60-day cure period: $10,000-$12,000 per curable violation, $80,000-$200,000 per uncurable violation, $2,000-$40,000 per day of continuing violation, plus injunctions; no private right of action (Bus. & Com. Code 552.101, 552.104, 552.105).", "scope_note": "References Penal Code 43.26 and 21.165.", "date_note": "HB 149 signed 22 Jun 2025; takes effect 1 Jan 2026 (Section 10).", "source_url": "https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm", "verified_on": "2026-10-08", "citation": "WTA-R-US-TX-0001-007: Bus. & Com. Code Section 552.057, Texas Responsible Artificial Intelligence Governance Act (HB 149). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-TX-0001-007/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-NY-0003-001", "provision": "General Business Law Section 1421(1)-(2)", "applies_to": [ "Developers" ], "duty": "Write, follow and publish a detailed frontier AI framework on catastrophic-risk thresholds, mitigations, third-party assessment, model-weight security, incidents and internal use; review it yearly and publish material changes with justification within 30 days.", "type": "Frontier model safety", "status": "applies later", "applies_from": "2027-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-NY-0003-001/", "rule": { "record_id": "WTA-R-US-NY-0003", "id": "us-ny-raise-act", "title": "Responsible AI Safety and Education Act (RAISE Act), as amended by 2026 chapter amendment", "jurisdiction": "US-NY", "jurisdiction_name": "New York", "url": "https://wheresthe.ai/rule/us-ny-raise-act/" }, "penalty": "Attorney General civil penalty up to $1,000,000 for a first violation and $3,000,000 per subsequent violation, by severity, for large frontier developers; no private right of action (GBL 1427).", "scope_note": "Large frontier developers only. Frontier developer: trained or began training a foundation model using more than 10^26 operations. Large frontier developer: frontier developer with affiliates over $500 million gross revenue in the prior calendar year (GBL 1420). Applies to frontier models developed, deployed or operating in whole or part in New York (1425); accredited universities doing academic research and Empire AI are exempt (1426).", "date_note": "Original act Chapter 699 of 2025 (S6953-B) signed 19 Dec 2025; Article 44-B repealed and replaced by chapter amendment Chapter 96 of 2026 (S8828/A9449) signed 27 Mar 2026; takes effect 1 Jan 2027.", "source_url": "https://nyassembly.gov/leg/?default_fld=&leg_video=&bn=S08828&term=2025&Summary=Y&Actions=Y&Text=Y", "verified_on": "2026-10-08", "citation": "WTA-R-US-NY-0003-001: General Business Law Section 1421(1)-(2), Responsible AI Safety and Education Act (RAISE Act), as amended by 2026 chapter amendment. wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-NY-0003-001/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-NY-0003-002", "provision": "General Business Law Section 1421(3)(a)", "applies_to": [ "Developers" ], "duty": "Publish, before or when deploying a new or substantially modified frontier model, a transparency report with release date, languages, output modalities, intended uses, use restrictions and a contact mechanism.", "type": "Transparency to users", "status": "applies later", "applies_from": "2027-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-NY-0003-002/", "rule": { "record_id": "WTA-R-US-NY-0003", "id": "us-ny-raise-act", "title": "Responsible AI Safety and Education Act (RAISE Act), as amended by 2026 chapter amendment", "jurisdiction": "US-NY", "jurisdiction_name": "New York", "url": "https://wheresthe.ai/rule/us-ny-raise-act/" }, "penalty": "GBL 1427 civil penalties (up to $1m first, $3m subsequent) apply to large frontier developers; the text sets no penalty for other frontier developers.", "scope_note": "Applies to all frontier developers. A system card or model card with the information counts (1421(3)(c)). Frontier developer: trained or began training a foundation model using more than 10^26 operations. Large frontier developer: frontier developer with affiliates over $500 million gross revenue in the prior calendar year (GBL 1420). Applies to frontier models developed, deployed or operating in whole or part in New York (1425); accredited universities doing academic research and Empire AI are exempt (1426).", "date_note": "Original act Chapter 699 of 2025 (S6953-B) signed 19 Dec 2025; Article 44-B repealed and replaced by chapter amendment Chapter 96 of 2026 (S8828/A9449) signed 27 Mar 2026; takes effect 1 Jan 2027.", "source_url": "https://nyassembly.gov/leg/?default_fld=&leg_video=&bn=S08828&term=2025&Summary=Y&Actions=Y&Text=Y", "verified_on": "2026-10-08", "citation": "WTA-R-US-NY-0003-002: General Business Law Section 1421(3)(a), Responsible AI Safety and Education Act (RAISE Act), as amended by 2026 chapter amendment. wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-NY-0003-002/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-NY-0003-003", "provision": "General Business Law Section 1421(3)(b), (5)", "applies_to": [ "Developers" ], "duty": "Include in the transparency report summaries of catastrophic-risk assessments, results, third-party evaluator involvement and other framework steps; describe any redactions and keep unredacted information for five years.", "type": "Frontier model safety", "status": "applies later", "applies_from": "2027-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-NY-0003-003/", "rule": { "record_id": "WTA-R-US-NY-0003", "id": "us-ny-raise-act", "title": "Responsible AI Safety and Education Act (RAISE Act), as amended by 2026 chapter amendment", "jurisdiction": "US-NY", "jurisdiction_name": "New York", "url": "https://wheresthe.ai/rule/us-ny-raise-act/" }, "penalty": "Attorney General civil penalty up to $1,000,000 for a first violation and $3,000,000 per subsequent violation, by severity, for large frontier developers; no private right of action (GBL 1427).", "scope_note": "The summaries are required of large frontier developers, and the redaction rules apply to all frontier developers (1421(5)).", "date_note": "Original act Chapter 699 of 2025 (S6953-B) signed 19 Dec 2025; Article 44-B repealed and replaced by chapter amendment Chapter 96 of 2026 (S8828/A9449) signed 27 Mar 2026; takes effect 1 Jan 2027.", "source_url": "https://nyassembly.gov/leg/?default_fld=&leg_video=&bn=S08828&term=2025&Summary=Y&Actions=Y&Text=Y", "verified_on": "2026-10-08", "citation": "WTA-R-US-NY-0003-003: General Business Law Section 1421(3)(b), (5), Responsible AI Safety and Education Act (RAISE Act), as amended by 2026 chapter amendment. wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-NY-0003-003/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-NY-0003-004", "provision": "General Business Law Section 1421(4)", "applies_to": [ "Developers" ], "duty": "Do not make materially false or misleading statements about catastrophic risk from frontier models or its management, or, for large frontier developers, about implementing or complying with the frontier AI framework.", "type": "Transparency to users", "status": "applies later", "applies_from": "2027-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-NY-0003-004/", "rule": { "record_id": "WTA-R-US-NY-0003", "id": "us-ny-raise-act", "title": "Responsible AI Safety and Education Act (RAISE Act), as amended by 2026 chapter amendment", "jurisdiction": "US-NY", "jurisdiction_name": "New York", "url": "https://wheresthe.ai/rule/us-ny-raise-act/" }, "penalty": "Attorney General civil penalty up to $1,000,000 for a first violation and $3,000,000 per subsequent violation, by severity, for large frontier developers; no private right of action (GBL 1427).", "scope_note": "Good-faith statements reasonable in the circumstances are excluded (1421(4)(b)).", "date_note": "Original act Chapter 699 of 2025 (S6953-B) signed 19 Dec 2025; Article 44-B repealed and replaced by chapter amendment Chapter 96 of 2026 (S8828/A9449) signed 27 Mar 2026; takes effect 1 Jan 2027.", "source_url": "https://nyassembly.gov/leg/?default_fld=&leg_video=&bn=S08828&term=2025&Summary=Y&Actions=Y&Text=Y", "verified_on": "2026-10-08", "citation": "WTA-R-US-NY-0003-004: General Business Law Section 1421(4), Responsible AI Safety and Education Act (RAISE Act), as amended by 2026 chapter amendment. wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-NY-0003-004/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-NY-0003-005", "provision": "General Business Law Section 1422(2)(a)", "applies_to": [ "Developers" ], "duty": "Send the DFS office a summary of any assessment of catastrophic risk from internal use of frontier models every three months, or on another reasonable schedule agreed with the office.", "type": "Frontier model safety", "status": "applies later", "applies_from": "2027-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-NY-0003-005/", "rule": { "record_id": "WTA-R-US-NY-0003", "id": "us-ny-raise-act", "title": "Responsible AI Safety and Education Act (RAISE Act), as amended by 2026 chapter amendment", "jurisdiction": "US-NY", "jurisdiction_name": "New York", "url": "https://wheresthe.ai/rule/us-ny-raise-act/" }, "penalty": "Attorney General civil penalty up to $1,000,000 for a first violation and $3,000,000 per subsequent violation, by severity, for large frontier developers; no private right of action (GBL 1427).", "scope_note": "Large frontier developers only. Summaries are exempt from disclosure under the Public Officers Law (1422(6)).", "date_note": "Original act Chapter 699 of 2025 (S6953-B) signed 19 Dec 2025; Article 44-B repealed and replaced by chapter amendment Chapter 96 of 2026 (S8828/A9449) signed 27 Mar 2026; takes effect 1 Jan 2027.", "source_url": "https://nyassembly.gov/leg/?default_fld=&leg_video=&bn=S08828&term=2025&Summary=Y&Actions=Y&Text=Y", "verified_on": "2026-10-08", "citation": "WTA-R-US-NY-0003-005: General Business Law Section 1422(2)(a), Responsible AI Safety and Education Act (RAISE Act), as amended by 2026 chapter amendment. wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-NY-0003-005/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-NY-0003-006", "provision": "General Business Law Section 1422(3)(a)", "applies_to": [ "Developers" ], "duty": "Report any critical safety incident involving a frontier model to the DFS office within 72 hours of determining it occurred or learning facts supporting a reasonable belief that it occurred.", "type": "Incident reporting", "status": "applies later", "applies_from": "2027-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-NY-0003-006/", "rule": { "record_id": "WTA-R-US-NY-0003", "id": "us-ny-raise-act", "title": "Responsible AI Safety and Education Act (RAISE Act), as amended by 2026 chapter amendment", "jurisdiction": "US-NY", "jurisdiction_name": "New York", "url": "https://wheresthe.ai/rule/us-ny-raise-act/" }, "penalty": "Attorney General civil penalty up to $1,000,000 for a first violation and $3,000,000 per subsequent violation, by severity, for large frontier developers; no private right of action (GBL 1427).", "scope_note": "Amended reports allowed. Developers using a designated federal standard instead must declare intent and copy federal incident reports to the office at the same time (1422(9)).", "date_note": "Original act Chapter 699 of 2025 (S6953-B) signed 19 Dec 2025; Article 44-B repealed and replaced by chapter amendment Chapter 96 of 2026 (S8828/A9449) signed 27 Mar 2026; takes effect 1 Jan 2027.", "source_url": "https://nyassembly.gov/leg/?default_fld=&leg_video=&bn=S08828&term=2025&Summary=Y&Actions=Y&Text=Y", "verified_on": "2026-10-08", "citation": "WTA-R-US-NY-0003-006: General Business Law Section 1422(3)(a), Responsible AI Safety and Education Act (RAISE Act), as amended by 2026 chapter amendment. wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-NY-0003-006/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-NY-0003-007", "provision": "General Business Law Section 1422(3)(b)", "applies_to": [ "Developers" ], "duty": "Disclose a critical safety incident posing an imminent risk of death or serious physical injury within 24 hours to an appropriate authority, such as a law enforcement or public safety agency.", "type": "Incident reporting", "status": "applies later", "applies_from": "2027-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-NY-0003-007/", "rule": { "record_id": "WTA-R-US-NY-0003", "id": "us-ny-raise-act", "title": "Responsible AI Safety and Education Act (RAISE Act), as amended by 2026 chapter amendment", "jurisdiction": "US-NY", "jurisdiction_name": "New York", "url": "https://wheresthe.ai/rule/us-ny-raise-act/" }, "penalty": "Attorney General civil penalty up to $1,000,000 for a first violation and $3,000,000 per subsequent violation, by severity, for large frontier developers; no private right of action (GBL 1427).", "scope_note": "Applies to all frontier developers. The 72-hour report to the office still applies.", "date_note": "Original act Chapter 699 of 2025 (S6953-B) signed 19 Dec 2025; Article 44-B repealed and replaced by chapter amendment Chapter 96 of 2026 (S8828/A9449) signed 27 Mar 2026; takes effect 1 Jan 2027.", "source_url": "https://nyassembly.gov/leg/?default_fld=&leg_video=&bn=S08828&term=2025&Summary=Y&Actions=Y&Text=Y", "verified_on": "2026-10-08", "citation": "WTA-R-US-NY-0003-007: General Business Law Section 1422(3)(b), Responsible AI Safety and Education Act (RAISE Act), as amended by 2026 chapter amendment. wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-NY-0003-007/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-NY-0003-008", "provision": "General Business Law Section 1428(1)-(4)", "applies_to": [ "Developers" ], "duty": "Do not develop, deploy or operate a frontier model in New York without a current disclosure statement filed with the DFS office, renewed every two years or on ownership or material change, and paying assessed pro rata fees.", "type": "Registration or filing", "status": "applies later", "applies_from": "2027-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-NY-0003-008/", "rule": { "record_id": "WTA-R-US-NY-0003", "id": "us-ny-raise-act", "title": "Responsible AI Safety and Education Act (RAISE Act), as amended by 2026 chapter amendment", "jurisdiction": "US-NY", "jurisdiction_name": "New York", "url": "https://wheresthe.ai/rule/us-ny-raise-act/" }, "penalty": "After notice and hearing, the office may impose $1,000 per day for failing to file or correct a disclosure, plus assessments owed (GBL 1428(5)); AG penalties under 1427 also apply.", "scope_note": "Large frontier developers only. Statement lists business names, principal and New York office addresses, 5% owners (50% for public companies) and three contacts (1428(3)). The office publishes a list of filers.", "date_note": "Original act Chapter 699 of 2025 (S6953-B) signed 19 Dec 2025; Article 44-B repealed and replaced by chapter amendment Chapter 96 of 2026 (S8828/A9449) signed 27 Mar 2026; takes effect 1 Jan 2027.", "source_url": "https://nyassembly.gov/leg/?default_fld=&leg_video=&bn=S08828&term=2025&Summary=Y&Actions=Y&Text=Y", "verified_on": "2026-10-08", "citation": "WTA-R-US-NY-0003-008: General Business Law Section 1428(1)-(4), Responsible AI Safety and Education Act (RAISE Act), as amended by 2026 chapter amendment. wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-NY-0003-008/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-NY-0001-001", "provision": "NYC Admin. Code Section 20-871(a)(1); 6 RCNY 5-301(a)", "applies_to": [ "Employers" ], "duty": "Do not use an automated employment decision tool unless an independent bias audit of it was conducted no more than one year before use.", "type": "Bias and non-discrimination", "status": "applies now", "applies_from": "2023-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-NY-0001-001/", "rule": { "record_id": "WTA-R-US-NY-0001", "id": "us-ny-nyc-local-law-144-aedt", "title": "New York City Local Law 144 of 2021 (Automated Employment Decision Tools)", "jurisdiction": "US-NY", "jurisdiction_name": "New York", "url": "https://wheresthe.ai/rule/us-ny-nyc-local-law-144-aedt/" }, "penalty": "Civil penalty up to $500 for a first violation and each additional violation the same day, and $500 to $1,500 for each subsequent violation; each day of unlawful use and each missed notice is a separate violation (NYC Admin. Code 20-872).", "scope_note": "Applies to employers and employment agencies using an automated employment decision tool to screen candidates or employees for hiring or promotion decisions in New York City (Admin. Code 20-870). 'employer' here also covers employment agencies.", "date_note": "Local Law 144 of 2021 (enacted 11 Dec 2021, returned unsigned by the Mayor) took effect 1 Jan 2023 (Section 2). DCWP rules (6 RCNY 5-300 to 5-304) took effect 5 Jul 2023, when enforcement began; our record shows 5 Jul 2023 as the effective date.", "source_url": "https://legistar.council.nyc.gov/View.ashx?M=F&ID=10399761&GUID=F99584B7-57C8-469E-9637-46A0E780690E", "verified_on": "2026-10-08", "citation": "WTA-R-US-NY-0001-001: NYC Admin. Code Section 20-871(a)(1); 6 RCNY 5-301(a), New York City Local Law 144 of 2021 (Automated Employment Decision Tools). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-NY-0001-001/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-NY-0001-002", "provision": "6 RCNY Section 5-301(b)-(d), 5-302", "applies_to": [ "Employers" ], "duty": "Ensure the bias audit calculates selection or scoring rates and impact ratios for sex, race/ethnicity and intersectional categories, reports unknown-category counts, and uses historical data unless insufficient data justifies test data.", "type": "Bias and non-discrimination", "status": "applies now", "applies_from": "2023-07-05", "url": "https://wheresthe.ai/id/WTA-R-US-NY-0001-002/", "rule": { "record_id": "WTA-R-US-NY-0001", "id": "us-ny-nyc-local-law-144-aedt", "title": "New York City Local Law 144 of 2021 (Automated Employment Decision Tools)", "jurisdiction": "US-NY", "jurisdiction_name": "New York", "url": "https://wheresthe.ai/rule/us-ny-nyc-local-law-144-aedt/" }, "penalty": "Civil penalty up to $500 for a first violation and each additional violation the same day, and $500 to $1,500 for each subsequent violation; each day of unlawful use and each missed notice is a separate violation (NYC Admin. Code 20-872).", "scope_note": "Applies to employers and employment agencies using an automated employment decision tool to screen candidates or employees for hiring or promotion decisions in New York City (Admin. Code 20-870). Categories under 2% of the data may be excluded with justification. An employer may rely on a multi-employer audit only if it contributed its own data or has never used the tool (5-302(a)).", "date_note": "DCWP rules effective 5 Jul 2023; underlying Local Law 144 of 2021 effective 1 Jan 2023.", "source_url": "https://rules.cityofnewyork.us/wp-content/uploads/2023/04/DCWP-NOA-for-Use-of-Automated-Employment-Decisionmaking-Tools-2.pdf", "verified_on": "2026-10-08", "citation": "WTA-R-US-NY-0001-002: 6 RCNY Section 5-301(b)-(d), 5-302, New York City Local Law 144 of 2021 (Automated Employment Decision Tools). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-NY-0001-002/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-NY-0001-003", "provision": "NYC Admin. Code Section 20-871(a)(2); 6 RCNY 5-303", "applies_to": [ "Employers" ], "duty": "Publish clearly on the employment section of your website, before use, the date and summary results of the most recent bias audit and the tool's distribution date, and keep them posted six months after last use.", "type": "Transparency to users", "status": "applies now", "applies_from": "2023-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-NY-0001-003/", "rule": { "record_id": "WTA-R-US-NY-0001", "id": "us-ny-nyc-local-law-144-aedt", "title": "New York City Local Law 144 of 2021 (Automated Employment Decision Tools)", "jurisdiction": "US-NY", "jurisdiction_name": "New York", "url": "https://wheresthe.ai/rule/us-ny-nyc-local-law-144-aedt/" }, "penalty": "Civil penalty up to $500 for a first violation and each additional violation the same day, and $500 to $1,500 for each subsequent violation; each day of unlawful use and each missed notice is a separate violation (NYC Admin. Code 20-872).", "scope_note": "Applies to employers and employment agencies using an automated employment decision tool to screen candidates or employees for hiring or promotion decisions in New York City (Admin. Code 20-870). Summary must include data source, unknown-category counts, applicant numbers, rates and impact ratios. A clearly labelled hyperlink is acceptable.", "date_note": "Local Law 144 of 2021 (enacted 11 Dec 2021, returned unsigned by the Mayor) took effect 1 Jan 2023 (Section 2). DCWP rules (6 RCNY 5-300 to 5-304) took effect 5 Jul 2023, when enforcement began; our record shows 5 Jul 2023 as the effective date. The content and six-month retention come from DCWP rule 5-303, effective 5 Jul 2023.", "source_url": "https://legistar.council.nyc.gov/View.ashx?M=F&ID=10399761&GUID=F99584B7-57C8-469E-9637-46A0E780690E", "verified_on": "2026-10-08", "citation": "WTA-R-US-NY-0001-003: NYC Admin. Code Section 20-871(a)(2); 6 RCNY 5-303, New York City Local Law 144 of 2021 (Automated Employment Decision Tools). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-NY-0001-003/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-NY-0001-004", "provision": "NYC Admin. Code Section 20-871(b)(1)-(2); 6 RCNY 5-304(a)-(c)", "applies_to": [ "Employers" ], "duty": "Notify each New York City resident candidate or employee at least 10 business days before use that the tool will be used and which job qualifications and characteristics it assesses, with instructions to request an alternative process or accommodation.", "type": "Transparency to users", "status": "applies now", "applies_from": "2023-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-NY-0001-004/", "rule": { "record_id": "WTA-R-US-NY-0001", "id": "us-ny-nyc-local-law-144-aedt", "title": "New York City Local Law 144 of 2021 (Automated Employment Decision Tools)", "jurisdiction": "US-NY", "jurisdiction_name": "New York", "url": "https://wheresthe.ai/rule/us-ny-nyc-local-law-144-aedt/" }, "penalty": "Civil penalty up to $500 for a first violation and each additional violation the same day, and $500 to $1,500 for each subsequent violation; each day of unlawful use and each missed notice is a separate violation (NYC Admin. Code 20-872).", "scope_note": "Applies to employers and employment agencies using an automated employment decision tool to screen candidates or employees for hiring or promotion decisions in New York City (Admin. Code 20-870). Notice may be given on the careers website, in the job posting, or by mail or email; for employees, also in a written policy. The rules do not require an alternative process to be provided (5-304(a)).", "date_note": "Local Law 144 of 2021 (enacted 11 Dec 2021, returned unsigned by the Mayor) took effect 1 Jan 2023 (Section 2). DCWP rules (6 RCNY 5-300 to 5-304) took effect 5 Jul 2023, when enforcement began; our record shows 5 Jul 2023 as the effective date.", "source_url": "https://legistar.council.nyc.gov/View.ashx?M=F&ID=10399761&GUID=F99584B7-57C8-469E-9637-46A0E780690E", "verified_on": "2026-10-08", "citation": "WTA-R-US-NY-0001-004: NYC Admin. Code Section 20-871(b)(1)-(2); 6 RCNY 5-304(a)-(c), New York City Local Law 144 of 2021 (Automated Employment Decision Tools). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-NY-0001-004/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-NY-0001-005", "provision": "NYC Admin. Code Section 20-871(b)(3); 6 RCNY 5-304(d)", "applies_to": [ "Employers" ], "duty": "Post your tool data retention policy and the type and source of data collected, or provide them within 30 days of a written request, and explain any refusal based on law or a law enforcement investigation.", "type": "Consumer rights", "status": "applies now", "applies_from": "2023-01-01", "url": "https://wheresthe.ai/id/WTA-R-US-NY-0001-005/", "rule": { "record_id": "WTA-R-US-NY-0001", "id": "us-ny-nyc-local-law-144-aedt", "title": "New York City Local Law 144 of 2021 (Automated Employment Decision Tools)", "jurisdiction": "US-NY", "jurisdiction_name": "New York", "url": "https://wheresthe.ai/rule/us-ny-nyc-local-law-144-aedt/" }, "penalty": "Civil penalty up to $500 for a first violation and each additional violation the same day, and $500 to $1,500 for each subsequent violation; each day of unlawful use and each missed notice is a separate violation (NYC Admin. Code 20-872).", "scope_note": "Applies to employers and employment agencies using an automated employment decision tool to screen candidates or employees for hiring or promotion decisions in New York City (Admin. Code 20-870).", "date_note": "Local Law 144 of 2021 (enacted 11 Dec 2021, returned unsigned by the Mayor) took effect 1 Jan 2023 (Section 2). DCWP rules (6 RCNY 5-300 to 5-304) took effect 5 Jul 2023, when enforcement began; our record shows 5 Jul 2023 as the effective date.", "source_url": "https://legistar.council.nyc.gov/View.ashx?M=F&ID=10399761&GUID=F99584B7-57C8-469E-9637-46A0E780690E", "verified_on": "2026-10-08", "citation": "WTA-R-US-NY-0001-005: NYC Admin. Code Section 20-871(b)(3); 6 RCNY 5-304(d), New York City Local Law 144 of 2021 (Automated Employment Decision Tools). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-NY-0001-005/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-NY-0002-001", "provision": "General Business Law Section 1701", "applies_to": [ "Operators" ], "duty": "Do not operate or provide an AI companion unless it has a protocol making reasonable efforts to detect user expressions of suicidal ideation or self-harm and refer the user to crisis services such as the 988 hotline.", "type": "Consumer rights", "status": "applies now", "applies_from": "2025-11-05", "url": "https://wheresthe.ai/id/WTA-R-US-NY-0002-001/", "rule": { "record_id": "WTA-R-US-NY-0002", "id": "us-ny-ai-companion-safeguards-2025", "title": "Artificial Intelligence Companion Models (General Business Law Article 47)", "jurisdiction": "US-NY", "jurisdiction_name": "New York", "url": "https://wheresthe.ai/rule/us-ny-ai-companion-safeguards-2025/" }, "penalty": "Attorney General may seek an injunction and civil penalties up to $15,000 per day for violations of GBL 1701 or 1702; penalties go to the state suicide prevention fund (GBL 1703).", "scope_note": "AI companion: a system designed to simulate a sustained human-like relationship by retaining prior interactions, asking unprompted emotion-based questions and sustaining personal dialogue; excludes customer-service, productivity, research and internal business tools (GBL 1700(4)). The NY Senate law page showed no revision after 7 Nov 2025.", "date_note": "Enacted as Part U of the FY2026 budget bill S3008-C/A3008-C, Chapter 58 of 2025, signed 9 May 2025; effective on the 180th day after becoming law (5 Nov 2025). Our record has no adoption date.", "source_url": "https://www.nysenate.gov/legislation/laws/GBS/A47", "verified_on": "2026-10-08", "citation": "WTA-R-US-NY-0002-001: General Business Law Section 1701, Artificial Intelligence Companion Models (General Business Law Article 47). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-NY-0002-001/ (checked 2026-10-08)." }, { "record_id": "WTA-R-US-NY-0002-002", "provision": "General Business Law Section 1702", "applies_to": [ "Operators" ], "duty": "Tell users clearly and conspicuously, verbally or in writing, that they are not communicating with a human at the start of an AI companion interaction and at least every three hours during continuing interactions.", "type": "Transparency to users", "status": "applies now", "applies_from": "2025-11-05", "url": "https://wheresthe.ai/id/WTA-R-US-NY-0002-002/", "rule": { "record_id": "WTA-R-US-NY-0002", "id": "us-ny-ai-companion-safeguards-2025", "title": "Artificial Intelligence Companion Models (General Business Law Article 47)", "jurisdiction": "US-NY", "jurisdiction_name": "New York", "url": "https://wheresthe.ai/rule/us-ny-ai-companion-safeguards-2025/" }, "penalty": "Attorney General may seek an injunction and civil penalties up to $15,000 per day for violations of GBL 1701 or 1702; penalties go to the state suicide prevention fund (GBL 1703).", "scope_note": "AI companion: a system designed to simulate a sustained human-like relationship by retaining prior interactions, asking unprompted emotion-based questions and sustaining personal dialogue; excludes customer-service, productivity, research and internal business tools (GBL 1700(4)). The NY Senate law page showed no revision after 7 Nov 2025. The start-of-interaction notice need not be given more than once per day.", "date_note": "Enacted as Part U of the FY2026 budget bill S3008-C/A3008-C, Chapter 58 of 2025, signed 9 May 2025; effective on the 180th day after becoming law (5 Nov 2025). Our record has no adoption date.", "source_url": "https://www.nysenate.gov/legislation/laws/GBS/A47", "verified_on": "2026-10-08", "citation": "WTA-R-US-NY-0002-002: General Business Law Section 1702, Artificial Intelligence Companion Models (General Business Law Article 47). wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-NY-0002-002/ (checked 2026-10-08)." } ], "note": "Informational, not legal advice. Every record links to its official source; check it before relying on a record. Cite as \"Source: wheresthe.ai\"." }