GOVERNBOX.ai’s control library covers 30 sets of AI law and guidance outside the United States, across 25 countries plus the EU and the international instruments. Turn on the ones that apply to you, and your policies, crosswalks and gap reports are built against them.
The EU AI Act and GDPR, the EU regulation and guidance around them, Italy's national AI law, and the frameworks of the United Kingdom, Switzerland and Norway.
Regulation (EU) 2024/1689 — the EU's binding, risk-tiered AI law; it reaches providers and deployers whose AI is placed on the EU market or affects people in the EU, wherever the organization sits.
Covers: Prohibited practices (Art. 5), the high-risk regime (risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy and robustness), general-purpose-model duties, chatbot and deepfake transparency, and serious-incident reporting (Art. 73).
Transparency duties apply from 2 August 2026; high-risk rules apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I)
Regulation (EU) 2016/679, the General Data Protection Regulation — the EU's data-protection law, applying to anyone processing EU residents' personal data.
Covers: Lawful basis, data-subject rights (including Art. 22 on solely automated decisions), data-protection impact assessments, records of processing, privacy by design, 72-hour breach notification and cross-border transfer rules.
European Commission regulation and guidance around the AI Act itself — the General-Purpose AI Code of Practice, the guidelines on prohibited practices, high-risk classification and the AI-system definition, and the Ethics Guidelines for Trustworthy AI.
Covers: How the AI Act's duties are expected to be met in practice: GPAI transparency and copyright, prohibited-practice boundaries, high-risk scoping, and trustworthy-AI principles.
The United Kingdom's regulator-led approach to AI — the AI Regulation White Paper and government response, the Data Protection Act 2018 and Data (Use and Access) Act 2025, ICO and CMA guidance, and public-sector AI procurement guidelines.
Covers: The five UK AI principles (safety, transparency, fairness, accountability, contestability), UK data-protection duties for automated processing, and competition/consumer guidance for AI foundation models.
Switzerland's AI-relevant statute book — the revised Federal Act on Data Protection plus the copyright, criminal, product-liability, gender-equality and disability-discrimination acts as they apply to AI.
Covers: Data-protection duties for automated decisions and profiling, liability and equality obligations that AI use triggers, and FDPIC guidance.
Norway's AI-relevant law and policy — the Personal Data Act (GDPR as incorporated), the Transparency Act, the Digital Services Act as applied, the Equality and Anti-Discrimination Act, the Working Environment Act, and Norway's position on EU AI rules.
Covers: Transparency and human-rights due diligence, workplace and equality duties for AI-assisted decisions, and Datatilsynet (DPA) expectations.
Italy's national AI law — Law No. 132 of 2025 and the legislative decrees that implement it — together with the Italian privacy, workplace-safety, copyright, criminal and corporate-liability rules it amends.
Covers: Human oversight and accessibility of AI systems, plain-language notices and parental consent under 14, AI in healthcare and health research, employer duties to inform workers, limits on AI in the professions and public administration, human authorship and text-and-data mining, deepfake offences, and civil liability for AI harm.
Canada has no AI Act, but its privacy, automated-decision and human-rights rules already apply to AI.
Canada's AI-relevant law and guidance — the Privacy Act and PIPEDA, provincial privacy statutes (Québec Law 25, Alberta PIPA/POPA, British Columbia PIPA), the Treasury Board Directive on Automated Decision-Making, and human-rights obligations.
Covers: Algorithmic impact assessments and notice for automated decisions in government, meaningful consent and privacy duties for personal data used by AI, and non-discrimination in AI-assisted decisions.
Further countries' AI laws and guidance, and the international instruments governments and organizations are converging on.
The national privacy laws of 17 countries — Argentina, Australia, Brazil, Canada, China, Colombia, India, Indonesia, Israel, Mexico, Saudi Arabia, Singapore, South Korea, Switzerland, Turkey, the United Arab Emirates and the United Kingdom — as one selectable pack, separate from those countries' AI laws.
Covers: Lawful basis and consent, notice, data-subject rights, security and breach notification, cross-border transfer rules, data-protection officers and impact assessments, and processor obligations.
Australia's AI Ethics Principles, National AI Plan, guidance for AI adoption, the policy for responsible AI use in government, and the model framework for agentic AI.
Covers: Ethics-by-design, transparency and contestability expectations, and government-use accountability.
Japan's Act on the Protection of Personal Information, the AI Promotion Act, the Social Principles of Human-Centric AI, and the METI/MIC AI Guidelines for Business.
Covers: Human-centric AI principles, business governance expectations, personal-data duties and information-distribution rules.
South Korea's AI Basic Act plus the Personal Information Protection Act, the network-utilization act, the Fair Hiring Procedure Act and content/copyright law.
Covers: High-impact AI duties, transparency, personal-data protection and fair-hiring constraints on AI.
Singapore's Model AI Governance Framework (incl. the generative- and agentic-AI editions), the AI Verify toolkit, PDPC advisory guidelines and the National AI Strategy 2.0.
Covers: Governance structures, human oversight, operations management, stakeholder communication and testing evidence.
India's Digital Personal Data Protection Act, the IT Act and its intermediary and deepfake rules, the AI Governance Guidelines and the National Strategy for AI.
Covers: Personal-data duties, AI-generated-content and deepfake labeling, and governance principles for AI deployment.
Indonesia's Personal Data Protection Law, National AI Strategy, the Circular Letter on AI Ethics and the fintech code of conduct for responsible AI.
Covers: AI ethics principles, data-protection duties and sector codes of conduct.
Thailand's Personal Data Protection Act, Computer Crime Act, AI ethics and generative-AI governance guidelines, and the SEC framework for AI in capital markets.
Covers: Ethics and governance guidance for organizations, data-protection duties and sector supervision.
Taiwan's AI Basic Act, the AI technology R&D guidelines and the national AI action plan.
Covers: Fundamental AI principles (transparency, fairness, privacy, safety) and government AI direction.
China's binding AI rules — the generative-AI interim measures, the deep-synthesis and algorithmic-recommendation provisions, the AI-generated content labeling measures and national standard, the anthropomorphic AI interaction measures, the facial-recognition measures and the Personal Information Protection Law.
Covers: Training-data and labeling rules, security assessment and algorithm filing, labels on synthetic content, user choice over recommendations, protection of minors and older users, transparency and impact assessment for automated decisions, and consent for facial recognition.
Vietnam's Law on Artificial Intelligence (2025), the decree that details it and the Prime Minister's list of high-risk AI systems.
Covers: Prohibited AI purposes, self-classification by risk level, notifying the ministry before using medium- and high-risk systems, AI-interaction disclosure and labels on generated media, incident reporting, conformity assessment, provider and deployer duties, and transition deadlines for systems already in use.
Brazil's General Data Protection Law (LGPD), Consumer Protection Code and copyright law, the deepfake penalty law, and federal public-sector AI ethics and generative-AI guidance.
Covers: Personal-data and consumer duties, deepfake liability, and public-sector impact-assessment expectations.
Mexico's federal personal-data law, the National AI Agenda 2024–2030 and the National Declaration on Ethical AI.
Covers: Personal-data duties for AI and the national ethical-AI principles.
Argentina's data-protection law, the Recommendations for Reliable AI, the transparency and data-protection program for AI, and the Responsible AI Guide.
Covers: Reliable-AI recommendations, transparency and data-protection expectations.
Colombia's data-protection framework, consumer-protection statute, National AI Policy 2024–2030, ethical guide for AI in public entities and AI security/privacy guidelines.
Covers: Ethics for public-sector AI, security and privacy guidance, and consumer duties.
Peru's AI law (Law No. 31814, 2023), its implementing regulation (Supreme Decree No. 115-2025-PCM) and the Personal Data Protection Law.
Covers: Prohibited uses, high-risk classification, transparency and a register for high-risk systems, human oversight and impact assessment, public-entity governance and security duties, personal-data compliance and bias minimisation.
Israel's Protection of Privacy Law, privacy-enhancing-technology guidelines, the Policy on AI Regulation and Ethics, and copyright law.
Covers: Privacy duties for AI, ethical-AI policy principles and PET expectations.
Saudi Arabia's Personal Data Protection Law, SDAIA's AI Ethics Principles, generative-AI guidelines and the AI Readiness Index.
Covers: Ethics principles, personal-data duties and secondary-use rules for AI.
The UAE's Charter for the Development and Use of AI, the AI Act and national AI strategy, and the federal/DIFC data-protection laws.
Covers: Charter principles (safety, fairness, transparency, accountability) and data-protection duties.
Türkiye's National AI Strategy and the data-protection authority's recommendations on personal data in AI, privacy in mobile applications and generative AI.
Covers: Personal-data protection expectations for AI systems and generative-AI guidance.
The international instruments — the Council of Europe Framework Convention on AI, the OECD AI Principles and incident-reporting framework, UNESCO's Recommendation on the Ethics of AI, and UN guidance.
Covers: Human-rights, democracy and rule-of-law safeguards, ethical-impact assessment and incident-reporting expectations governments and organizations are converging on.
Kazakhstan's Law on Artificial Intelligence (2025).
Covers: Prohibited AI capabilities, classification by risk and autonomy, ongoing risk management, telling users about AI and marking synthetic output, users' rights to explanation and refusal, continuous human control, data protection, respect for copyright opt-outs in training, and audits for trusted high-risk lists.
Looking for the U.S. state laws? They have their own guide. Every plan’s coverage is on the pricing page.