RedLectern topic

AI law and regulation

Jurisdiction-specific AI rules · privacy · copyright · duties · legal status and dates.

For: Everyone · organizations.

After this page you can: Locate the relevant rule and distinguish law from proposals or guidance.

Page reviewed

Part of: Artificial Intelligence › AI safety and governance

About AI law and regulation

AI regulation is not a single worldwide rulebook. To investigate an AI legal issue, first identify the jurisdiction, the activity, the actor, and the instrument that might apply. Then check whether the source is enacted law, guidance, a proposal, or litigation, and confirm the relevant date. A rule’s title alone does not establish who it covers or when its provisions apply.

The EU AI Act is in force and generally applies from 2 August 2026. The EU’s 2026 AI Omnibus amendment, in force from 27 July 2026, sets later application dates for specified high-risk system obligations. Privacy and copyright questions also depend on jurisdiction and on the facts. For example, the EU GDPR defines personal data, while United States fair use is assessed under a four-factor statutory framework. Use the official legal text to check definitions, scope, exceptions, and dates before relying on a summary.

Start here

Learn the foundations

1.Find the law, status and dateStart with the jurisdiction and the exact instrument.

Start with the jurisdiction and the exact instrument. In the EU, the AI Act is in force and generally applies from 2 August 2026. The EU’s AI Omnibus amendment, in force from 27 July 2026, changed the application dates for specified high-risk system obligations: 2 December 2027 for Annex III systems and 2 August 2028 for Annex I product systems. Other provisions have their own dates, so check the consolidated text and the amending regulation together.

The Act distinguishes general-purpose AI models from AI systems and sets rules for high-risk categories. In the United States, the Copyright Act of 1976 was adopted on 19 October 1976; section 107 sets out factors considered when evaluating fair use. These examples show why a page about AI law should be read by jurisdiction and provision, not treated as a universal compliance checklist.

EU AI Act

EU legislation establishing requirements for specified AI systems and models. In the EU, the Act is in force and generally applies from 2 August 2026, with provision-specific dates.

General-purpose AI

An EU legal category concerning models capable of a broad range of distinct tasks. The EU AI Act, in force and generally applying from 2 August 2026, defines a general-purpose AI model by its significant generality and capacity to perform a wide range of distinct tasks.

High-risk AI

AI systems falling within specified high-risk categories under the EU AI Act. In the EU, the Act is in force and generally applies from 2 August 2026; the AI Omnibus amendment sets later application dates for specified obligations.

In the United States, the Copyright Act of 1976 was adopted on 19 October 1976. Copyright concerns legal rights in original works of authorship fixed in a tangible medium of expression.

Fair use

In the United States, the Copyright Act of 1976 was adopted on 19 October 1976. Section 107 provides a context-dependent copyright exception evaluated using statutory factors; it is not a universal permission.

Personal data

Under the EU GDPR, which applies from 25 May 2018, personal data means information relating to an identified or identifiable natural person.

Try it

A page says a high-risk AI obligation applies on a particular date. Find the relevant EU AI Act category and its current application date in the consolidated text. What amending text, if any, changed that date?

For a system classified as high-risk under Article 6(2) and Annex III, the specified Chapter III obligations apply from 2 December 2027. For a system under Article 6(1) and Annex I, they apply from 2 August 2028. Regulation (EU) 2026/1744 amended those dates.

2.Check privacy rules by jurisdictionFor a privacy question, first identify whose information is involved and which jurisdiction’s definition and rules are relevant.

For a privacy question, first identify whose information is involved and which jurisdiction’s definition and rules are relevant. The EU GDPR defines personal data as information relating to an identified or identifiable natural person. That definition is a useful legal starting point, but identifying a definition does not by itself settle whether a particular AI use is permitted or what duties apply.

Read the legal text for the relevant rule, actor, processing activity, exceptions, and application date. The EU GDPR applies from 25 May 2018. When a summary discusses another jurisdiction or a newer proposal, verify it against that jurisdiction’s official law or regulator source and label its status accurately. Keep the question narrow: what information is processed, for what purpose, by which actor, and under which provision?

Try it

Choose an AI product’s data practice, such as storing prompts or using them for training. Name the jurisdiction and actor you would investigate, then locate the official legal definition of personal data for that jurisdiction.

For an EU service that stores prompts, check the EU GDPR and identify the relevant actor and processing activity. Article 4 defines personal data as information relating to an identified or identifiable natural person; the GDPR applies from 25 May 2018.

Latest

No recent updates are available.

See the sources list

Books

Glossary

6 terms on this page.

Browse the AI glossary

Questions and comments