AI systems that infer people’s emotions are banned in workplaces and in schools and universities, except for medical or safety reasons.
Who must do it
Anyone who provides or uses such AI in the EU, including employers and schools.
The law
AI Act, Article 5(1)(f)
Who enforces it
National authorities, enforcing since August 2, 2026; fines up to €35 million or 7% of worldwide turnover, whichever is higher (for SMEs, whichever is lower).
If you provide an AI system that talks directly with people, design it so they are told they are interacting with AI, unless that is obvious.
Who must do it
Providers of AI systems used in the EU.
The law
AI Act, Article 50(1)
Who enforces it
National authorities, or the EU AI Office for chatbots built on the provider’s own general-purpose AI model or in very large online platforms; fines up to €15 million or 3% of worldwide turnover, whichever is higher (whichever is lower for SMEs and small mid-caps).
Mark AI-generated content so machines can detect it
Providers of AI that generates audio, images, video or text must mark the output in a machine-readable way as AI-made. Systems already on the market before August 2, 2026 have until December 2, 2026. Tools that only assist standard editing are exempt.
Who must do it
Providers of generative AI systems in the EU, including general-purpose AI.
The law
AI Act, Article 50(2)
Who enforces it
National authorities, or the EU AI Office for generative AI built on the provider’s own general-purpose AI model or in very large online platforms; fines up to €15 million or 3% of worldwide turnover, whichever is higher (whichever is lower for SMEs and small mid-caps).
If you use AI to create or alter a deepfake image, audio or video, disclose that it is AI-made or manipulated; for obvious art, satire or fiction a light disclosure is enough. If you use AI to write or alter text published to inform the public on matters of public interest, disclose it, unless it went through human review or editorial control and someone holds editorial responsibility.
Who must do it
Businesses and organisations that use AI to make such content in the EU; purely personal, non-professional use is exempt.
The law
AI Act, Article 50(4)
Who enforces it
National authorities; fines up to €15 million or 3% of worldwide turnover, whichever is higher (whichever is lower for SMEs and small mid-caps).
Do not offer or use AI that makes sexual deepfakes
AI systems that create or alter realistic sexual or intimate images, video or audio of an identifiable person without their explicit consent, or child sexual abuse material, are banned. Providers are covered when this is the intended purpose or a foreseeable result their safeguards do not reliably prevent; users are covered when they use AI for this.
Who must do it
Anyone who provides or uses such AI systems in the EU.
The law
AI Act, Article 5(1)(ba) and (bb) and 5(1a) to (1b), inserted by Regulation (EU) 2026/1744 (Digital Omnibus on AI)
Who enforces it
National authorities, or the EU AI Office for AI built on the provider’s own general-purpose AI model or in very large online platforms; fines up to €35 million or 7% of worldwide turnover, whichever is higher (for SMEs, whichever is lower).
AI for hiring and managing staff becomes “high-risk”
Employers using AI to recruit, manage or evaluate workers must follow its instructions, have trained people oversee it and keep its logs for at least six months. They must inform workers and their representatives before using it, and tell candidates and staff when it is used in decisions about them. AI types already on the market before then are covered only after a significant design change.
Who must do it
Employers and other organisations that use such AI in the EU.
The law
AI Act, Article 26 and Annex III (date moved by the 2026 Digital Omnibus)
Who enforces it
National authorities; fines up to €15 million or 3% of worldwide turnover, whichever is higher (whichever is lower for SMEs and small mid-caps).
Take steps to support the AI literacy of staff and others who operate or use AI for you, suited to their knowledge and to how the AI is used. Since July 27, 2026 you no longer have to guarantee a particular skill level.
Who must do it
Providers and deployers of AI systems in the EU, which includes any business using AI at work.
The law
AI Act, Article 4, as replaced by Regulation (EU) 2026/1744
Who enforces it
National authorities; the AI Act sets no EU-wide fine for this duty, so penalties come from national law.
Do not build AI that manipulates or exploits people
AI that uses subliminal, manipulative or deceptive techniques, or exploits people’s age, disability or social or economic situation, to distort their decisions in a way that causes or is likely to cause significant harm is banned.
Who must do it
Anyone who provides or uses such AI in the EU.
The law
AI Act, Article 5(1)(a) and (b)
Who enforces it
National authorities, enforcing since August 2, 2026; fines up to €35 million or 7% of worldwide turnover, whichever is higher (for SMEs, whichever is lower).
Do not use AI social scores to treat people unfairly
AI that scores people over time on their social behaviour or personal traits is banned when the score leads to unjustified or disproportionate harm, or to harm in a context unrelated to where the data came from. Ordinary performance reviews are usually not social scoring.
Who must do it
Anyone who provides or uses such AI in the EU, including private companies.
The law
AI Act, Article 5(1)(c)
Who enforces it
National authorities, enforcing since August 2, 2026; fines up to €35 million or 7% of worldwide turnover, whichever is higher (for SMEs, whichever is lower).
Do not scrape faces from the web to build face recognition
AI that creates or expands facial recognition databases by untargeted scraping of face images from the internet or CCTV footage is banned.
Who must do it
Anyone who provides or uses such AI in the EU.
The law
AI Act, Article 5(1)(e)
Who enforces it
National authorities, enforcing since August 2, 2026; fines up to €35 million or 7% of worldwide turnover, whichever is higher (for SMEs, whichever is lower).
Do not use AI to predict crime from profiling alone
AI that assesses or predicts the risk that a person will commit a crime based solely on profiling, or on their personality traits, is banned. AI that supports a human assessment already based on objective, verifiable facts is allowed.
Who must do it
Anyone who provides or uses such AI in the EU, including private companies.
The law
AI Act, Article 5(1)(d)
Who enforces it
National authorities, enforcing since August 2, 2026; fines up to €35 million or 7% of worldwide turnover, whichever is higher (for SMEs, whichever is lower).
Do not use biometrics to guess race, religion or union ties
AI that sorts individual people by biometric data, such as face or voice, to infer their race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation is banned.
Who must do it
Anyone who provides or uses such AI in the EU, including employers.
The law
AI Act, Article 5(1)(g)
Who enforces it
National authorities, enforcing since August 2, 2026; fines up to €35 million or 7% of worldwide turnover, whichever is higher (for SMEs, whichever is lower).
Tell people when you use emotion or biometric AI on them
If you use AI that recognises emotions or sorts people into categories from biometric data, inform the people exposed to it and handle their data under the GDPR. Emotion recognition at work or school is banned anyway, except for medical or safety reasons.
Who must do it
Businesses and organisations that use such systems in the EU.
The law
AI Act, Article 50(3)
Who enforces it
National authorities; fines up to €15 million or 3% of worldwide turnover, whichever is higher (whichever is lower for SMEs and small mid-caps).
Document your AI model and publish a training-data summary
If you put a general-purpose AI model on the EU market, keep technical documentation and give developers who build on it the information they need. Follow EU copyright law, including publishers’ opt-outs from text and data mining, and publish a summary of the training content. Models on the market before August 2, 2025 have until August 2, 2027.
Who must do it
Providers of general-purpose AI models offered in the EU, wherever they are based; providers outside the EU need an EU representative. Open-source models skip the documentation duties unless they pose systemic risk, but must still follow copyright law and publish the summary.
The law
AI Act, Articles 53, 54 and 111(3); text and data mining opt-outs under the Copyright Directive (EU) 2019/790, Article 4(3)
Who enforces it
European Commission (AI Office), with powers to fine since August 2, 2026: up to €15 million or 3% of worldwide turnover, whichever is higher.
Test and report risks of the most powerful AI models
A general-purpose model is presumed to have systemic risk if it was trained with more than 10²⁵ operations, and the Commission can also designate one. If yours has it, notify the Commission, evaluate and adversarially test the model, and assess and reduce its risks. Report serious incidents to the AI Office and keep strong cybersecurity.
Who must do it
Providers of general-purpose AI models with systemic risk offered in the EU.
The law
AI Act, Articles 51, 52 and 55
Who enforces it
European Commission (AI Office), with powers to fine since August 2, 2026: up to €15 million or 3% of worldwide turnover, whichever is higher.
Check HR AI against the high-risk rules before you sell it
If you sell AI for recruiting, promotion, firing, task allocation or monitoring workers, it must meet the high-risk requirements: risk management, data quality, documentation, logging, human oversight and accuracy. It must also pass a conformity assessment, carry the CE mark and be registered in the EU database.
Who must do it
Providers placing such AI on the EU market, including companies that sell it under their own name or substantially change it.
The law
AI Act, Articles 6(2), 8 to 17, 43 and 47 to 49, and Annex III point 4 (date moved by Regulation (EU) 2026/1744)
Who enforces it
National authorities; fines up to €15 million or 3% of worldwide turnover, whichever is higher (whichever is lower for SMEs and small mid-caps).
Treat AI for admissions, grading and exams as high-risk
This covers AI that admits or places students, grades their work, decides what level of education they can reach, or watches for cheating in tests. If you use it, follow the maker’s instructions, have trained staff oversee it, keep its logs for at least six months and tell students it is used. Public bodies, and private bodies providing a public service, must first assess its impact on people’s rights.
Who must do it
Schools, universities, training providers and exam bodies using such AI in the EU; the makers must pass a conformity assessment before selling it. AI on the market before then is covered only after a significant design change, except that AI for public authorities must comply by August 2, 2030.
The law
AI Act, Annex III point 3 and Articles 26, 27 and 111(2) (dates set by Regulation (EU) 2026/1744)
Who enforces it
National authorities; fines up to €15 million or 3% of worldwide turnover, whichever is higher (whichever is lower for SMEs and small mid-caps).
Treat face recognition and emotion AI as high-risk
This covers AI that identifies people remotely from their face or other biometrics, sorts them by sensitive or protected traits, or recognises emotions, where such uses are not banned. If you use it, follow the maker’s instructions, have trained staff oversee it, keep its logs and tell the people exposed to it. Simple ID checks that only confirm a person is who they claim to be are excluded.
Who must do it
Businesses and organisations using such AI in the EU, such as shops, venues and security firms; the makers must pass a conformity assessment before selling it. AI on the market before then is covered only after a significant design change.
The law
AI Act, Annex III point 1 and Article 26 (date set by Regulation (EU) 2026/1744)
Who enforces it
National authorities; fines up to €15 million or 3% of worldwide turnover, whichever is higher (whichever is lower for SMEs and small mid-caps).
Treat AI credit scoring and insurance pricing as high-risk
If you use AI to judge people’s creditworthiness or set their credit score, or to assess risk and set prices for life or health insurance, first assess its impact on people’s rights. Then follow the maker’s instructions, have trained staff oversee it, keep its logs for at least six months and tell people it is used in decisions about them. AI used only to detect fraud is excluded.
Who must do it
Banks, lenders, insurers and other businesses using such AI in the EU; the makers must pass a conformity assessment before selling it. AI on the market before then is covered only after a significant design change.
The law
AI Act, Annex III point 5(b) and (c) and Articles 26 and 27 (date set by Regulation (EU) 2026/1744)
Who enforces it
National authorities; fines up to €15 million or 3% of worldwide turnover, whichever is higher (whichever is lower for SMEs and small mid-caps).
Do not let AI alone make big decisions about people
People have the right not to be subject to decisions made solely by automated processing, including profiling, with legal or similarly significant effects, such as automatically rejecting a job application. Such decisions are allowed only when needed for a contract, authorised by law or with explicit consent, and then people get human intervention, a way to contest and meaningful information about the logic.
Who must do it
Any organisation processing personal data in the EU, or of people in the EU, including employers and schools.
The law
GDPR (Regulation (EU) 2016/679), Article 22, with Articles 13 to 15
Who enforces it
National data protection authorities; fines up to €20 million or 4% of worldwide turnover, whichever is higher.
Explain decisions made with high-risk AI when asked
Some AI counts as high-risk, such as AI for hiring, managing staff, education, credit or essential services. If a decision based on it seriously affects someone, they can ask you to explain the AI’s role and the main reasons for the decision, and you must answer clearly. The AI Act’s other duties for this AI start on December 2, 2027.
Who must do it
Businesses and organisations in the EU that use such AI to decide about people. It applies where other EU law, such as the GDPR, does not already give this right.
The law
AI Act, Article 86, with Annex III
Who enforces it
National authorities; the AI Act sets no EU-wide fine for this right, so penalties come from national law (in Germany, up to €50,000).
Platforms: keep humans in charge of algorithmic management
Gig-work platforms must explain their automated monitoring and decision systems to the people working through them, keep them under human oversight, and not use them to process data such as emotional state, private conversations or union activity. Only a human may decide to restrict, suspend or close a worker’s account. EU countries must put this into national law by December 2, 2026.
Who must do it
Digital labour platforms, such as ride-hailing or delivery apps, organising work in the EU. The data and human-review rules also protect self-employed platform workers.
The law
Platform Work Directive (EU) 2024/2831, Articles 7 to 15 (deadline for national laws)
Who enforces it
Under each country’s national law; data protection authorities can fine breaches of the data rules at GDPR levels.
If your online platform recommends content, explain in your terms, in plain language, the main factors your recommender systems use and how users can change them. Very large platforms and search engines must also offer at least one feed option not based on profiling.
Who must do it
Online platforms serving people in the EU, except micro and small companies; the extra option applies to services with more than 45 million monthly users in the EU.
The law
Digital Services Act (Regulation (EU) 2022/2065), Articles 27 and 38
Who enforces it
National Digital Services Coordinators, or the European Commission for very large platforms; fines up to 6% of worldwide turnover.
Explain high-risk AI decisions, or Germany can fine you
Germany backs the EU right to an explanation with its own fine. If a decision based on high-risk AI, for example in hiring, staff management, education or credit, seriously affects someone and they ask, explain the AI’s role and the main reasons. Failing to do so can cost up to €50,000. The EU has moved most other high-risk duties to December 2, 2027.
Who must do it
Businesses and other private organisations using high-risk AI in Germany, such as employers, private schools and lenders. Public bodies cannot be fined.
The law
KI-MIG (KI-Marktüberwachungs-und-Innovationsförderungs-Gesetz), sections 15(2), 15(3) and 17, with AI Act Article 86
Who enforces it
Federal Network Agency (Bundesnetzagentur) in most cases, BaFin for finance and state authorities for the media; fines up to €50,000.
If your workplace has a works council (Betriebsrat), inform it in good time, with the documents it needs, when you plan work processes that use AI. Discuss the effects on staff early enough that its suggestions can still change the plan.
Who must do it
Private employers in Germany that have a works council.
The law
Works Constitution Act (Betriebsverfassungsgesetz), section 90(1) no. 3 and (2), as amended in 2021
Who enforces it
Labour courts; fines up to €10,000 for information that is missing, wrong, incomplete or late (section 121). Obstructing the works council is a crime (section 119).
When your works council has to assess the introduction or use of AI, the law treats calling in an outside expert as necessary, so you cannot refuse on the ground that one is not needed. You still agree on the details, and you can agree on a standing AI expert.
Who must do it
Private employers in Germany that have a works council.
The law
Works Constitution Act, section 80(3), as amended in 2021
Who enforces it
Labour courts. Obstructing the works council is a crime (section 119).
Get works council consent for AI-made selection rules
General rules for choosing whom to hire, transfer, regrade or dismiss need your works council’s consent, also when AI is used to draw them up. In businesses with more than 500 employees, the works council can demand such rules. If you cannot agree, a conciliation board decides.
Who must do it
Private employers in Germany that have a works council.
The law
Works Constitution Act, section 95(1), (2) and (2a), as amended in 2021
Who enforces it
A conciliation board (Einigungsstelle) settles disputes, and labour courts enforce.
Agree with the works council before AI that tracks staff
You need your works council’s agreement before you introduce or use technical systems designed to monitor how employees behave or perform, which includes AI tools that log or analyse staff activity. If you cannot agree, a conciliation board decides.
Who must do it
Private employers in Germany that have a works council.
The law
Works Constitution Act, section 87(1) no. 6 and (2)
Who enforces it
A conciliation board settles disputes, and labour courts can stop a system introduced without agreement. Obstructing the works council is a crime (section 119).
If you run a social media account that looks like a person but posts automatically through software, clearly mark each automated post as sent by a program. Social networks must also take care that such posts are labelled.
Who must do it
Anyone offering content on social networks in Germany, such as businesses, publishers and campaigns, and the networks themselves.
The law
Interstate Media Treaty (Medienstaatsvertrag), sections 18(3) and 93(4)
Who enforces it
State media authorities (Landesmedienanstalten); fines up to €500,000 for unlabelled bot posts.
Explain how your algorithm picks and ranks content
If you run a search engine, social network, news aggregator or similar service, publish in plain language the main criteria for selecting and ranking content and how your algorithms work, easy to find and always available.
Who must do it
Services that gather and present others’ content (media intermediaries) and reach at least 1 million users a month in Germany. Services focused on goods and services are exempt.
Label AI faces or bodies in paid posts “Images virtuelles”
If you are paid to promote something online and your post includes an AI-made image of a face or body, add the words “Images virtuelles”, clear and easy to read on every format. Retouched faces or bodies need “Images retouchées” instead.
Who must do it
Commercial influencers: people or companies paid to promote goods, services or causes online to a French audience, including those based abroad.
The law
Law no. 2023-451 of June 9, 2023 on commercial influence, article 5, as amended in 2024
Who enforces it
Criminal courts; up to one year in prison and a €4,500 fine.
Get consent or clearly label AI fakes of real people
Do not publish or share AI-made images, video or audio that reproduce a real person’s image or words without their consent, unless it is obvious, or clearly stated, that the content was made by AI.
Who must do it
Anyone in France, including businesses, publishers and influencers.
The law
Criminal Code (Code pénal), article 226-8, as amended by Law no. 2024-449 of May 21, 2024 (SREN)
Who enforces it
Criminal courts; up to one year in prison and €15,000, or two years and €45,000 if shared online.
Never share sexual deepfakes of a person without consent
Sharing AI-made sexual images, video or audio that reproduce a real person’s image or voice without their consent is a crime, even if it is labelled as fake.
Who must do it
Anyone in France.
The law
Criminal Code, article 226-8-1, added by Law no. 2024-449 of May 21, 2024 (SREN)
Who enforces it
Criminal courts; up to two years in prison and €60,000, or three years and €75,000 if shared online.
Consult the works council before rolling out AI at work
Inform and consult your works council (CSE) before introducing new technologies such as AI tools, and on changes that affect staff numbers, organisation or working conditions.
Who must do it
Employers in France with at least 50 employees and a works council (comité social et économique).
The law
Labour Code (Code du travail), article L2312-8
Who enforces it
Obstructing the works council is a crime, with a fine of up to €7,500 (article L2317-1).
Tell the works council before AI hiring or tracking tools
Inform your works council before you use recruitment-assistance methods or automated staff-management systems, and before changing them. Inform and consult it before deciding to deploy any tool that can monitor employees’ activity.
Who must do it
Employers in France with at least 50 employees and a works council.
The law
Labour Code, article L2312-38
Who enforces it
Obstructing the works council is a crime, with a fine of up to €7,500 (article L2317-1).
Tell job candidates before using AI to assess them
Before using any recruitment method or technique on candidates, including AI tools, tell them which ones you will use. Methods must be relevant to the job, results stay confidential, and no data may be collected through a tool they were not told about.
Who must do it
All employers and recruiters in France, of any size.
Tell staff before any AI tool collects data about them
No information about an individual employee may be collected by a device or tool they were not told about beforehand, including AI monitoring and analytics tools.
A decision with legal or similarly significant effects on someone may rest solely on automated processing only in the GDPR’s contract and explicit-consent cases. Then, if the person asks, you must tell them the rules that define the processing and its main characteristics, except secrets protected by law.
Who must do it
Any organisation in France that takes solely automated decisions about people. Public bodies have stricter duties.
The law
Data Protection Act (Loi Informatique et Libertés, law no. 78-17), article 47
Who enforces it
The data protection authority (CNIL); fines up to €20 million or 4% of worldwide turnover, whichever is higher.
Never make or share fake recordings to smear someone
It is a crime in Hungary to make, or make available to others, a false or altered audio or image recording of someone in order to damage their honour. This covers AI deepfakes and cloned voices.
Who must do it
Anyone in Hungary; a case starts only if the victim asks for it.
The law
Criminal Code (2012. évi C. törvény), sections 226/A and 226/B
Who enforces it
Police, prosecutors and criminal courts; up to one year in prison for making such a recording, two years for making it available, or three years if it reaches a large audience or causes significant harm.
Online platforms and AI chatbots: tackle illegal content
If people can share content with each other on your service, including AI-made content or chatbots they create for others, or your AI tool searches several websites or databases, the Online Safety Act applies. Assess the risk of illegal content, such as terrorism, child sexual abuse or fraud, then take proportionate steps to prevent it and remove it quickly.
Who must do it
Providers of user-to-user and search services with links to the UK, such as many UK users or the UK as a target market, wherever they are based. Chatbots where people only talk with the bot, and which do not search several websites or databases, are not covered by these duties. A chatbot that can make porn must still use age checks (see that rule).
The law
Online Safety Act 2023, sections 9, 10, 26 and 27, with section 55(4) on content made with bots and section 51 on when the duties start
Who enforces it
Ofcom; fines up to £18 million or 10% of qualifying worldwide revenue, whichever is greater.
Protect children from harmful content, also in AI chatbots
If children are likely to use your covered service, assess the risks to them and reduce them. Platforms where users share content must use highly effective age checks to keep children from porn and from content that encourages suicide, self-harm or eating disorders, unless their terms ban it for everyone. The government says most chatbots that children use are covered.
Who must do it
Providers of user-to-user and search services with links to the UK that children are likely to use, wherever they are based.
The law
Online Safety Act 2023, sections 11, 12, 28 and 29, with section 51 on when the duties start
Who enforces it
Ofcom; fines up to £18 million or 10% of qualifying worldwide revenue, whichever is greater.
Use strong age checks if your AI tool can make porn
If your online service publishes or displays pornographic images, video or audio, including content made by an AI tool you offer, use highly effective age verification or estimation so children cannot normally see it. Keep a written record of your method and publish a summary. Content that is only text is excluded.
Who must do it
Providers of online services with links to the UK that publish their own pornographic content, wherever they are based.
The law
Online Safety Act 2023, sections 79 to 81 (Part 5)
Who enforces it
Ofcom; fines up to £18 million or 10% of qualifying worldwide revenue, whichever is greater.
Let people easily report intimate images of themselves shared without consent, including AI-made fakes. Take a valid reported image down as soon as you can and within 48 hours, with copies you find to be the same, and handle complaints about it fast. Search services must stop it appearing in results.
Who must do it
Providers of user-to-user and search services with links to the UK, wherever they are based.
The law
Online Safety Act 2023, sections 10(3A), 20A, 27(3A) and 31A, added by the Crime and Policing Act 2026, section 100
Who enforces it
Ofcom; fines up to £18 million or 10% of qualifying worldwide revenue, whichever is greater. Ignoring an Ofcom order about such images can be a crime.
Never share intimate images without consent, even AI fakes
Sharing a photo or video that shows, or appears to show, someone in an intimate state, such as nude or in a sexual act, without their consent is a crime. This includes images made or altered by computer, such as AI deepfakes. Threatening to share one is a crime too.
Who must do it
Anyone in England and Wales.
The law
Sexual Offences Act 2003, sections 66B to 66D, added by the Online Safety Act 2023, section 188
Who enforces it
Police and prosecutors; up to six months in prison, a fine, or both. Up to two years if done to cause distress or for sexual gratification, or for threats.
Never create or request sexual deepfakes of an adult
It is a crime to create, without consent, an image that looks like a photo or video of a real adult in an intimate state, such as nude or in a sexual act, for example with an AI tool. Asking someone else to make one is a crime too, even if it is never made.
Who must do it
Anyone in England and Wales.
The law
Sexual Offences Act 2003, sections 66E to 66H, added by the Data (Use and Access) Act 2025, section 138
Who enforces it
Police and prosecutors; up to six months in prison, a fine, or both.
Do not make or supply AI tools that create nude fakes
It is a crime to make, adapt, supply or offer a tool for creating images that show a real adult in an intimate state, such as nude or in a sexual act, like a nudification app. What counts is what a reasonable person would think the tool is for. You have a defence if you took all reasonable steps to stop its use without consent.
Who must do it
Anyone in England and Wales, and UK nationals and UK-registered companies also when acting abroad. Internet providers that only carry or store such a tool without knowing it are protected.
The law
Sexual Offences Act 2003, sections 66I to 66L, added by the Crime and Policing Act 2026, section 99
Who enforces it
Police and prosecutors; up to three years in prison, a fine, or both. Company directors who consent to it or connive in it can be prosecuted too.
Making, sharing or showing an indecent image of a child, anyone under 18, is a crime. This includes computer-made images that look like photos, which the government says covers AI-made images. Having such an image is also a crime, and so is having sexual images of children that do not look like photos, such as AI cartoons. A new offence for AI tools built to make such images is law but has no start date yet.
Who must do it
Anyone in England and Wales.
The law
Protection of Children Act 1978, sections 1 and 7, as amended in 1994 to cover pseudo-photographs; Criminal Justice Act 1988, section 160; Coroners and Justice Act 2009, section 62
Who enforces it
Police and prosecutors; up to 10 years in prison for making or sharing, 5 years for having one, and 3 years for images that do not look like photos.
A decision is “solely automated” when no person is meaningfully involved. If such a decision has a legal or similarly serious effect on someone, such as rejecting a job application or a loan, tell them about it, let them give their view, offer human review and let them contest it. Such decisions based on health, ethnicity or other sensitive data need explicit consent or a narrow legal basis.
Who must do it
Organisations that process personal data in the UK, or of people in the UK, including employers, lenders and schools.
The law
UK GDPR, Articles 22A to 22D, which replaced Article 22 under the Data (Use and Access) Act 2025, section 80
Who enforces it
The Information Commission (still known as the ICO), which replaced the Information Commissioner on September 30, 2026; fines up to £17.5 million or 4% of worldwide annual turnover, whichever is higher.
Do not post or buy fake reviews, including AI-written ones
Do not submit, commission or offer to write consumer reviews that pretend to be based on a real experience, or that hide they were paid for. The law counts reviews created by any means, so AI-written fakes are banned. If you publish reviews, take reasonable steps to prevent and remove fake ones.
Who must do it
Businesses dealing with UK consumers, and websites and apps that publish consumer reviews.
The law
Digital Markets, Competition and Consumers Act 2024, section 225 and Schedule 20, paragraph 13
Who enforces it
Competition and Markets Authority, which can fine up to £300,000 or 10% of turnover, whichever is higher; Trading Standards can also take cases to court.
Get consent before marketing calls with an AI voice
Marketing calls from an automated system that play recorded or synthetic speech need the called person’s consent to such calls first. The regulator says even a short AI-made greeting in a caller’s voice counts. Show your number, and give your name and an address or free phone number.
Who must do it
Businesses and other organisations making marketing calls to phone lines in the UK.
The law
Privacy and Electronic Communications Regulations 2003 (PECR), regulations 19 and 24
Who enforces it
The Information Commission (still known as the ICO); since February 5, 2026, fines up to £17.5 million or 4% of worldwide turnover, whichever is higher.
Remove reported intimate deepfakes within 48 hours
Give people a clear, plain-language way to report intimate images of themselves posted without consent, including AI-made fakes. Remove a valid reported image within 48 hours, and make reasonable efforts to remove known identical copies.
Who must do it
Public websites, apps and online services that mainly host content from users, with no size threshold. Broadband providers and email are excluded.
The law
TAKE IT DOWN Act (Public Law 119-12), section 3
Who enforces it
Federal Trade Commission; civil penalties of up to $53,088 per violation. Removals made in good faith are protected.
It is a federal crime to knowingly publish online an intimate image of an identifiable real person without their consent, including realistic fakes made with AI.
Who must do it
Anyone, people and businesses alike.
The law
TAKE IT DOWN Act (Public Law 119-12), section 2, 47 U.S.C. 223(h)
Who enforces it
Department of Justice; fines and up to two years in prison, or three years if the person shown is a minor.
Do not post or buy fake reviews, including AI-written ones
Do not write, create, sell or buy reviews or testimonials that falsely suggest the reviewer exists, used the product or had the experience described. The FTC says this covers AI-generated fake reviews.
Who must do it
Businesses selling to US consumers.
The law
FTC Rule on the Use of Consumer Reviews and Testimonials, 16 CFR part 465
Who enforces it
Federal Trade Commission; civil penalties of up to $53,088 per knowing violation.
Get consent before calling people with an AI voice
Calls that use AI-generated or cloned voices count as artificial-voice calls under the federal robocall law, so they need the called person’s prior express consent, unless it is an emergency or an exemption applies. The message must also identify the caller.
Get parents’ separate consent to train AI on kids’ data
If your site, app or service is aimed at children under 13, or you know you collect their data, get a parent’s separate, verifiable consent before disclosing a child’s personal information to third parties. The FTC says disclosing it to train or develop AI needs this consent.
Who must do it
Operators of websites, apps and online services, including education technology, aimed at children under 13 or knowingly collecting their data.
The law
Children’s Online Privacy Protection Rule, 16 CFR 312.5(a)(2), as amended in 2025
Who enforces it
Federal Trade Commission and state attorneys general; civil penalties of up to $53,088 per violation.
Embed hidden AI labels and offer a free checking tool
If you make a generative AI system that people in California can use, add hidden provenance data to the images, video and audio it creates or alters, where technically feasible. Also offer a free disclosure verification tool, your own or a compliant third-party one. Since September 30, 2026 this applies however many users you have; AI built mainly as assistive technology is exempt until 2029.
Who must do it
Makers of generative AI systems publicly available in California.
The law
California AI Transparency Act, Business and Professions Code sections 22757 to 22757.6 (SB 942, Chapter 291, Statutes of 2024; amended by AB 853, Chapter 674, Statutes of 2025, and SB 1000, Chapter 861, Statutes of 2026)
Who enforces it
Attorney General, city attorneys or county counsel; $5,000 per violation, with each day a separate violation. Falsely claiming the assistive-technology exemption costs $50,000 per violation.
Companion chatbots must disclose AI and handle crises
Tell users the chatbot is AI, not human, if they could be misled; keep and publish a suicide and self-harm protocol that refers users to crisis services; and warn that companion chatbots may not suit some minors. Until December 31, 2026, also remind known minors every three hours that it is AI and to take a break, and block sexual content for them. Yearly reports start July 1, 2027.
Who must do it
Operators of companion chatbot platforms available in California.
The law
SB 243 (Chapter 677, Statutes of 2025), Business and Professions Code sections 22601 to 22606; amended by SB 1119 (Chapter 190, Statutes of 2026) from January 1, 2027
Who enforces it
People harmed can sue for the greater of their damages or $1,000 per violation.
Do not present a customer service chatbot as a human, and say clearly that it is AI where a customer could be misled. Offer a simple way to ask for a human agent during business hours. Try to connect within 15 minutes, or book a call within one business day. Keep phone holds under 15 minutes, and under one hour in total.
Who must do it
Businesses with more than $500 million in yearly US revenue that use a customer service chatbot with customers in California.
The law
Business and Professions Code sections 22625 to 22629 (AB 1609, Chapter 733, Statutes of 2026)
Who enforces it
Public prosecutors only: up to $5,000 for a first violation and $10,000 for each later one. No private lawsuits.
If a mass layoff, relocation or closure is caused wholly or substantially by AI or other automation, the 60-day notice must say so under the line “This notice is for a technology displacement”. It must give the number, job type and work location of those jobs, the tasks that will be automated and the kind of technology used.
Who must do it
Employers with a California site that has employed 75 or more people in the past year.
Existing Cal/WARN remedies, as SB 951 adds no new penalty: workers not given notice are owed back pay and benefits for up to 60 days, and a missing notice to officials can cost up to $500 a day. Workers, unions and local governments can sue.
Employers may not use surveillance tools to monitor workers in workplace bathrooms, except under a court order, and workers may leave such tools behind when they go in. Simple badges or alarms without audio, video or built-in AI are allowed.
Who must do it
All California employers, public and private.
The law
AB 1331 (Chapter 851, Statutes of 2026), Labor Code sections 1560 to 1565
Who enforces it
Labor Commissioner and public prosecutors; up to $500 per violation.
Do not use AI to read workers’ emotions or neural data
Employers may not use AI-powered workplace surveillance tools to recognise, infer or predict workers’ emotional state, or to collect neural data, meaning measurements of the nervous system. Tools used to keep people safe are not banned.
Who must do it
All California employers, public and private.
The law
AB 1883 (Chapter 853, Statutes of 2026), Labor Code sections 1580 to 1583
Who enforces it
Labor Commissioner, public prosecutors or the worker; up to $500 per violation.
Big platforms must show whether content is AI-made
Detect provenance data in content on your platform, clearly show whether it says the content was made or substantially altered by AI or captured by a camera or recorder, and let users inspect that data. Where technically feasible, do not knowingly strip it.
Who must do it
Public-facing social media, file-sharing, mass-messaging and stand-alone search services with more than 2 million unique monthly users over the past 12 months. Broadband and telecom services are excluded.
The law
Business and Professions Code section 22757.3.1, added by AB 853 (Chapter 674, Statutes of 2025) and amended by AB 2713 (Chapter 856, Statutes of 2026)
Who enforces it
Attorney General, city attorneys or county counsel; $5,000 per violation, with each day a separate violation.
If an ad prominently shows a synthetic performer, a realistic performer made with generative AI who is not a real, recognisable person, add a clear disclosure such as “this performance features a synthetic performer”.
Who must do it
Anyone who creates an ad and has it published. Ads for films, TV shows and video games are excluded when the AI use matches the work, and so is AI used only for translation or accessibility.
The law
Business and Professions Code section 17610 (SB 1050, Chapter 246, Statutes of 2026)
Who enforces it
Treated as false advertising under section 17500, and enforced under the unfair competition law (section 17200 and following); a court can order the ad taken down.
Publish frontier AI safety plans and report incidents
If you train frontier AI models, publish a transparency report when you deploy a new or substantially changed one. Report critical safety incidents to the state’s Office of Emergency Services within 15 days, or within 24 hours to the right authority if lives are at risk. Developers with over $500 million in yearly revenue must also publish and follow a frontier AI framework and run an anonymous internal reporting channel.
Who must do it
Frontier developers: anyone who has trained a model using more than 10²⁶ operations. None may gag or punish staff who report catastrophic risks.
The law
Transparency in Frontier Artificial Intelligence Act, SB 53 (Chapter 138, Statutes of 2025), Business and Professions Code sections 22757.10 to 22757.16 and Labor Code sections 1107 to 1107.2
Who enforces it
Attorney General; civil penalties of up to $1 million per violation, scaled to its severity.
Do not knowingly host AI models that skip hidden labels
If your site or app offers generative AI model weights or source code for download, do not knowingly make available a system that does not add the hidden provenance data California requires.
Who must do it
Generative AI hosting platforms, paid or free, that offer downloads to people in California.
The law
Business and Professions Code section 22757.3.2 (AB 853, Chapter 674, Statutes of 2025)
Who enforces it
Attorney General, city attorneys or county counsel; $5,000 per violation.
This covers cameras, phones with cameras or microphones, and voice recorders first made for sale in California from January 1, 2028. Offer users hidden provenance data in what the device records, and turn it on by default. It names the maker, the device and its version, and the time and date. This applies where technically feasible and where widely adopted standards allow it.
Who must do it
Makers of cameras, phones and voice recorders for sale in California; companies that only assemble devices are excluded.
The law
California AI Transparency Act, Business and Professions Code section 22757.3.3 (AB 853, Chapter 674, Statutes of 2025)
Who enforces it
Attorney General, city attorneys or county counsel; $5,000 per violation, with each day a separate violation.
Assess, limit and audit companion chatbots for children
From January 1, 2027, check users’ ages or give everyone the child protections. From July 1, 2027, if children may use your companion chatbot, assess child risks before each release, publish a child safety policy and run a crisis protocol. Set parent-controlled limits such as one-hour sessions, block romance, sexual content and purchase pressure, and do not sell children’s data. Independent audits are due from 2029.
Who must do it
Anyone who makes a companion chatbot available in California; most duties apply only if children under 18 may use it. Colleges offering it only for education, and employers offering it only to staff, are excluded.
The law
Adam’s Law, SB 1119 (Chapter 190, Statutes of 2026), Business and Professions Code sections 21810 to 21818
Who enforces it
Public prosecutors; up to $5,000 per affected child for each negligent violation and $15,000 for each intentional one. Harmed children or their parents can sue for damages.
Until January 1, 2031, do not make, sell, exchange or offer to retailers any toy that includes a companion chatbot. A toy here means a product made for play by children under 16.
Who must do it
Toy makers, sellers and distributors in California.
The law
SB 867 (Chapter 189, Statutes of 2026), Business and Professions Code section 22604.5
Who enforces it
People harmed can sue for their actual damages or $1,000 per violation, whichever is greater, plus a court order and legal fees.
Spell out digital replica uses in performer contracts
A contract term can let a digital replica of a person’s voice or likeness replace work they would have done in person. Such a term is unenforceable if it lacks a reasonably specific description of the uses and the person had no lawyer or union negotiating for them.
Who must do it
Anyone contracting with a person in California for personal or professional services, such as actors, voice artists and creators. It covers new performances fixed from January 1, 2025.
The law
AB 2602 (Chapter 259, Statutes of 2024), Labor Code section 927
Who enforces it
No regulator or fine; such a term cannot be enforced.
Do not train AI on students’ data from your school app
If your website, service or app is designed or marketed for preschool, school or college use, do not use the student information it creates or gathers, including persistent identifiers, to train generative AI or develop any AI system. The rules for colleges start on July 1, 2027.
Who must do it
Operators of education websites, services and apps that know they are used for school purposes in California, and companies working for them.
The law
AB 1159 (Chapter 182, Statutes of 2026), Business and Professions Code sections 22584, 22586 and 22587 and following
Who enforces it
Students or parents who suffer damages can sue, also as a class, for their actual damages or $500 per violation, whichever is greater, after giving the operator 60 days’ written notice to fix it.
Before each public release of a generative AI system, or a substantial change to it, post documentation on your website about its training data. It must include a high-level summary of the datasets: their sources or owners, whether they include copyrighted or personal information, and whether they were bought or licensed.
Who must do it
Developers of generative AI systems or services released since January 1, 2022 and publicly available to Californians, including anyone who substantially modifies one. AI used only for security, aircraft operation or national security is exempt.
The law
AB 2013 (Chapter 817, Statutes of 2024), Civil Code sections 3110 and 3111, amended by AB 1170 (Chapter 67, Statutes of 2025)
Who enforces it
The law names no penalty or enforcer. A federal court refused to block it in March 2026; xAI’s appeal is set for argument on November 18, 2026.
Do not create or share sexually explicit deepfakes of a real person when you know, or should know, that they did not consent or were a minor, and do not knowingly help others do it. A service mainly for making sexual deepfakes is presumed to know there was no consent. Companies that keep such a service running are presumed liable if they do not stop within 30 days of notice.
Who must do it
Anyone, including people and businesses that run or serve deepfake services.
The law
AB 621 (Chapter 673, Statutes of 2025), Civil Code section 1708.86
Who enforces it
The person shown can sue for profits, actual damages or $1,500 to $50,000 per work, up to $250,000 with malice, plus punitive damages and fees. Public prosecutors can seek $25,000 per violation, or $50,000 with malice.
Let users report sexual deepfakes and act within 30 days
Let California account holders report sexually explicit images or videos of themselves that were made or altered digitally without their consent. Confirm each report within 48 hours, update within 7 days, block the material while you check, and decide within 30 days, or 60 days if the delay is beyond your control. Remove it at once if the report holds up.
Who must do it
Social media platforms with users in California; end-to-end encrypted messaging services and charities are excluded.
The law
SB 981 (Chapter 292, Statutes of 2024), Business and Professions Code sections 22670 and 22671
Before an automatic dialing device plays a prerecorded message, a live, natural voice must state the nature of the call and the caller’s name, address and phone number. It must ask whether the person consents to hear the message, and say if the message uses an artificial voice, such as an AI-generated one.
Who must do it
Anyone placing calls with automatic dialing-announcing devices to people in California.
The law
AB 2905 (Chapter 316, Statutes of 2024), Public Utilities Code section 2874
Who enforces it
California Public Utilities Commission; fines of up to $500 per violation, or disconnection of the line.
Get estate consent for AI replicas of dead celebrities
Do not use a digital replica of a deceased personality’s voice or likeness in a film, video or sound recording without consent from whoever holds their rights. News, sports, criticism, satire, parody, documentaries, biographies and fleeting uses are excepted.
Who must do it
Studios, labels, advertisers, AI companies and anyone else using such a replica in California.
The law
AB 1836 (Chapter 258, Statutes of 2024), Civil Code section 3344.1
Who enforces it
No regulator; the rights holders can sue for $10,000 or their actual damages, whichever is greater.
Get consent before using a person’s AI voice or likeness
Do not use a digital replica of a living person’s voice or likeness on products, in ads or to sell things without their prior consent. The law now says plainly that California’s right of publicity covers digital replicas, and using one to impersonate someone counts as false impersonation under criminal law.
Who must do it
Anyone using a person’s voice or likeness commercially in California.
The law
SB 1111 (Chapter 862, Statutes of 2026), Civil Code section 3344(f) and Penal Code section 540
Who enforces it
No regulator; the person can sue for $750 or their actual damages, whichever is greater, plus profits, punitive damages and fees.
Do not knowingly use AI to make it look as if a real person appeared before, sent information to or otherwise dealt with a government agency. One example would be AI-written public comments sent in real people’s names.
Who must do it
Anyone, including businesses and groups that send comments or requests to government agencies in California.
The law
Government Code section 8319 (SB 1159, Chapter 863, Statutes of 2026)
Who enforces it
The law sets no penalty of its own and names no enforcer.
Give notice and an opt-out before automated decisions
If software makes significant decisions about people without real human involvement, such as hiring, pay, promotion, firing or school admissions, give a notice before use, offer an opt-out, and explain the logic and result on request. In most cases an appeal to a human who can overturn the decision can replace the opt-out.
Who must do it
Businesses covered by the California Consumer Privacy Act, such as those with over $26,625,000 in yearly revenue or that buy, sell or share data on 100,000 or more consumers.
The law
CCPA regulations, California Code of Regulations title 11, sections 7200 and 7220 to 7222
Who enforces it
California Privacy Protection Agency or the Attorney General: up to $2,663 per violation, or $7,988 if intentional (2025 amounts).
Do not let AI tools discriminate; keep their data 4 years
Using an automated decision system that discriminates against job applicants or workers is unlawful, even when a vendor runs it for you. Keep the system’s data with your employment records for four years. Evidence of anti-bias testing can count for or against you.
Who must do it
Employers covered by California’s Fair Employment and Housing Act, usually those with 5 or more employees, plus employment agencies and unions.
The law
Civil Rights Council regulations, California Code of Regulations title 2, sections 11008.1, 11009(f) and 11013(c)
Who enforces it
Civil Rights Department complaints and lawsuits under the Fair Employment and Housing Act; damages rather than a fixed fine.
Do a risk assessment before using AI to judge people
Do and document a privacy risk assessment, and review it at least every three years, before you use automated decision-making for significant decisions such as jobs, loans, housing, education or health care. The same applies to automated tools that infer workers’, students’ or applicants’ performance, health, behaviour or location from systematic observation, and to training such tools or face recognition on personal data. Uses that began before 2026 need one by December 31, 2027.
Who must do it
Businesses covered by the California Consumer Privacy Act.
The law
CCPA regulations, California Code of Regulations title 11, sections 7150, 7155 and 7157
Who enforces it
California Privacy Protection Agency or the Attorney General: up to $2,663 per violation, or $7,988 if intentional (2025 amounts).
Do not use or sell a shared pricing algorithm as part of an agreement or plan that restrains competition. Do not pressure others to adopt the prices or terms it recommends. A shared pricing algorithm is any software used by two or more businesses that uses competitors’ data to recommend or set prices or terms. Prices here include workers’ pay.
Who must do it
Businesses that use, sell or license pricing software in California; end consumers are excluded.
The law
Cartwright Act, Business and Professions Code section 16729 (AB 325, Chapter 338, Statutes of 2025)
Who enforces it
Attorney General or district attorneys; civil penalties up to $1 million per violation. As a crime, fines up to $6 million for a company, and prison or fines up to $1 million for a person. Anyone harmed can sue for three times their damages.
If an ad for selling property shows a photo changed with editing software or AI, say so clearly on or next to the photo. Add a link, web address or QR code to the original photo. On a website you control, show the original too. Normal edits such as lighting, cropping or colour correction do not count.
Who must do it
Real estate brokers and salespeople in California, and anyone advertising for them.
The law
Business and Professions Code section 10140.8 (AB 723, Chapter 497, Statutes of 2025); amended by AB 2025 (Chapter 572, Statutes of 2026) from January 1, 2027
Who enforces it
Department of Real Estate: a breach of the Real Estate Law, which can lead to a suspended or revoked licence. Wilful violations are a crime, with a fine up to $10,000, up to six months in jail, or both.
If an ad for renting property shows a photo made fully by AI, or changed with editing software or AI, say so clearly on or next to the photo. Also show the original photo, or give a link, web address or QR code to it. Renderings not made with a camera need no original. Normal edits such as lighting, cropping or colour correction do not count.
Who must do it
Anyone who advertises property for rent in California, such as landlords, property managers and agents.
The law
Civil Code section 1940.11 (AB 2025, Chapter 572, Statutes of 2026)
Who enforces it
For real estate licensees, a violation is a breach of their licensing law. For others the section sets no penalty of its own; false advertising law still applies.
Do not discipline or fire workers by software alone
Do not rely solely on an automated decision system to discipline or fire. If you rely mainly on one, a human must corroborate the result, and the worker gets a written notice when told of the decision. Such systems also may not be used to infer protected traits, and workers can ask for their own data.
Who must do it
Employers in California, including public employers such as cities and counties. It protects employees, not job applicants.
The law
SB 947, the No Robo Bosses Act of 2026 (Chapter 859, Statutes of 2026), Labor Code sections 1520 to 1526.7
Who enforces it
Labor Commissioner and public prosecutors; $500 per violation.
Explain automated decisions and offer a human review
Before technology that processes personal data materially influences a decision about someone’s job, education, housing, financial or lending services, insurance, health care or essential government services, tell them clearly; a prominent notice where they apply is enough. After a bad outcome, explain its role within 30 days and, on request, let them correct their data and get a human review where commercially reasonable.
Who must do it
Businesses in Colorado that use such technology in decisions about people in Colorado, including workers and job applicants. Developers that sell it must give users documentation and update notices; both keep records for 3 years.
The law
SB 26-189, which replaced the 2024 Colorado AI Act
Who enforces it
Attorney General only, as a deceptive trade practice. Until January 1, 2030, a 60-day chance to fix after a warning, except for knowing or repeated violations. No new right to sue, but discrimination claims still apply. A court order of April 27, 2026 (xAI v. Weiser) stops the Attorney General from starting enforcement until 14 days after the court rules on xAI’s request to block the law.
Tell users clearly that your chatbot is AI at the start of each day’s first chat, at least every three hours or with a notice that stays visible, and whenever they ask. Have a suicide and self-harm protocol that refers users to crisis services, and never present its answers as coming from a licensed professional such as a doctor, lawyer or therapist. Yearly reports to the Attorney General start July 1, 2027.
Who must do it
Operators of public chatbots in Colorado that mainly simulate human conversation. Customer-service, shopping, productivity, developer, school and narrow-topic tools, voice assistants and game bots are excluded.
The law
HB 26-1263 (signed May 29, 2026), section 2
Who enforces it
Attorney General, as a deceptive trade practice under Colorado’s AI law; no new right to sue.
Use reasonable methods to estimate users’ ages, and do not ignore clear signs that a user is a minor. For minors, keep a regular AI notice, give no surprise rewards to drive engagement, block sexual content, stop the bot claiming to be human or sentient or role-playing romance, and give minors and parents privacy and account tools.
Who must do it
Operators of public chatbots in Colorado that mainly simulate human conversation. Customer-service, shopping, productivity, developer, school and narrow-topic tools, voice assistants and game bots are excluded.
The law
HB 26-1263 (signed May 29, 2026), section 2
Who enforces it
Attorney General, as a deceptive trade practice under Colorado’s AI law; no new right to sue.
Let people opt out of profiling that feeds decisions with legal or similarly significant effects, such as on loans, housing, insurance, education or health care. If a human is meaningfully involved you may refuse, but you must then explain the decision, the data used and the logic in plain language. Assess the risks in writing before such profiling.
Who must do it
Businesses serving Colorado residents that handle the data of more than 100,000 of them a year, or of 25,000 or more while earning money or discounts from selling personal data.
The law
Colorado Privacy Act, C.R.S. 6-1-1306(1)(a) and 6-1-1309, with the Attorney General’s rules (4 CCR 904-3, rule 9.04)
When you file a federal mass-layoff (WARN) notice, also tell the Connecticut Labor Department whether the layoffs are related to your use of AI or another technological change.
Who must do it
Employers that must file a federal WARN notice, usually those with 100 or more workers.
The law
Public Act 26-15, section 26
Who enforces it
Connecticut Labor Department, in the form the Labor Commissioner sets. The act sets no penalty.
If an automated tool helps make a job decision, its use is no defence against a discrimination complaint. Evidence of anti-bias testing can be taken into account.
Who must do it
Employers in Connecticut.
The law
Public Act 26-15, sections 13 and 14 (amending C.G.S. 46a-60(b)(1) and 46a-81c)
Who enforces it
Commission on Human Rights and Opportunities and the courts.
Tell people when an AI tool helps decide about their job
If an automated tool is a substantial factor in a job decision, give the person a written notice before the decision. Tell people in plain language when they are interacting with such a tool.
Who must do it
Businesses in Connecticut, such as employers, recruiters and staffing firms, that use automated tools in job decisions about Connecticut staff or applicants. Developers of tools sold for job decisions must give users the information they need.
The law
Public Act 26-15, sections 7 to 12
Who enforces it
Attorney General only, as an unfair trade practice. For violations up to December 31, 2027, the Attorney General may first give 60 days to fix them. No private lawsuits.
Do not punish staff who warn about catastrophic AI risks
Do not adopt or enforce any policy or contract that lets you punish staff for reporting a specific and substantial danger from catastrophic AI risk, or for whistleblowing to authorities, and tell your risk staff their rights. Developers with over $500 million in yearly revenue need an anonymous internal reporting channel by January 1, 2027.
Who must do it
Frontier AI developers doing business in Connecticut: those training models with more than 10²⁶ operations.
The law
Public Act 26-15, section 2
Who enforces it
Attorney General; civil penalty of up to $1,000 per violation.
Spell out the terms before charging for AI media tools
Before you start or renew a subscription to your AI image, audio or video tool, or charge for it, give the customer a written notice of the key terms. Include usage limits (such as tokens or images) and any right to cut features, and get the customer’s written acceptance. For a renewal, list only the new or changed limits.
Who must do it
Businesses that make a generative AI tool for images, audio or video with more than one million users a month, open to the public for personal use, and sell subscriptions to it in Connecticut. Government agencies are excluded.
The law
Public Act 26-100 (HB 5222), section 46, which replaced Public Act 26-15, section 1
Who enforces it
Attorney General only, as an unfair trade practice; customers cannot sue under this section.
Where commercially and technically reasonable, embed provenance data in images, audio and video your AI creates or materially alters, and make it hard to remove, for example with the C2PA standard.
Who must do it
Makers of generative AI systems for images, audio or video that the public can use for personal purposes and that have more than one million users a month. Business-to-business tools, games, and pure upscaling or compression tools are excluded.
The law
Public Act 26-15, section 15
Who enforces it
Attorney General, as an unfair trade practice; no private lawsuits.
AI companions must say they are not human and handle crises
An AI companion needs a published protocol that detects talk of suicide, self-harm or violence and refers users to help such as the 988 line, and it must not claim to be human. If it could be mistaken for a person, show a clear AI notice: always visible, or at the start of each day’s first chat and then hourly for minors and every three hours for adults.
Who must do it
Operators of AI companion chatbots used in Connecticut.
The law
Public Act 26-15, sections 4 to 6
Who enforces it
Attorney General only, as an unfair trade practice; no private lawsuits.
If you know or have reason to believe a user is under 18, use measures that meet industry standards to keep your AI companion safe for them. It must not encourage self-harm, suicide, violence, disordered eating or drug use, discourage seeking help, engage in romantic or sexual talk, or use manipulative engagement tactics. Give minors and parents tools to manage screen time and account settings.
Who must do it
Operators of AI companions used in Connecticut; customer-service, game, voice-assistant and narrow-task bots are excluded.
The law
Public Act 26-15, section 6
Who enforces it
Attorney General only, as an unfair trade practice; no private lawsuits.
Label prices raised by algorithms using personal data
If an automated process uses a customer’s personal data to set a price shown online, and the price is not a discount, show the notice “THIS PRICE WAS INCREASED BY A PRICE SETTING DEVICE USING YOUR PERSONAL DATA”. Retailers and delivery apps may not set personal prices from tracking data at all, except for cost differences, supply and demand, and open discount or loyalty schemes.
Who must do it
Businesses selling to people in Connecticut, for the label; retailers and delivery apps, for the ban. Insurers, banks and other financial institutions are excluded.
The law
Public Act 26-64, section 11
Who enforces it
Attorney General only, as an unfair trade practice; no private lawsuits.
Remove intimate deepfakes in 48 hours, or face state fines
Set up a written process, explained in a plain-language notice on your platform, for victims or the Attorney General to report synthetic intimate images. Remove a valid report within 48 hours and make reasonable efforts to remove copies.
Who must do it
Public websites and apps that mainly host content shared by users, as defined in the federal TAKE IT DOWN Act.
The law
Public Act 26-55, section 2
Who enforces it
Attorney General, in court; civil penalties of up to $25,000 a day for each person harmed.
Let people challenge automated profiling decisions
Let people opt out of profiling used for automated decisions with legal or similarly significant effects. If you made such a decision, where feasible let them question the result, tell them the reason and let them review their data; for housing decisions, let them correct the data and get the decision re-evaluated. Do an impact assessment for such profiling.
Who must do it
Businesses covered by the Connecticut Data Privacy Act: those serving people in Connecticut that handle the data of at least 35,000 consumers, process sensitive data, or sell personal data. It protects people as consumers, not as workers.
The law
Connecticut Data Privacy Act, C.G.S. 42-518 and 42-522, as amended by Public Act 25-113 (impact assessments for processing from August 1, 2026)
Who enforces it
Attorney General only, as an unfair trade practice; no private lawsuits.
Say in your privacy notice if you train AI on personal data
Your privacy notice must state whether you collect, use or sell personal data to train large language models.
Who must do it
Businesses covered by the Connecticut Data Privacy Act: those serving people in Connecticut that handle the data of at least 35,000 consumers, process sensitive data, or sell personal data. It protects people as consumers, not as workers.
The law
Connecticut Data Privacy Act, C.G.S. 42-520, as amended by Public Act 25-113
Who enforces it
Attorney General only, as an unfair trade practice; no private lawsuits.
Post signs if you use face recognition on your premises
If you use face recognition on your premises against security threats, fraud or crime, match faces only against your own database. Post clearly legible signs at each public entrance saying it is in use, with a link or QR code to your face recognition policy, which must give the Attorney General’s contact details.
Who must do it
Businesses covered by the Connecticut Data Privacy Act: those serving people in Connecticut that handle the data of at least 35,000 consumers, process sensitive data, or sell personal data. It protects people as consumers, not as workers.
The law
Public Act 26-64, section 16 (C.G.S. 42-524)
Who enforces it
Attorney General only, as an unfair trade practice; no private lawsuits.
Do not let AI discriminate at work, and say you use it
Do not use AI in recruiting, hiring, promotion, training, discipline, firing or other job decisions in a way that leads to discrimination against protected groups, even if unintended. Do not use ZIP codes as a stand-in for them, and tell employees when you use AI for these decisions.
Who must do it
Employers with at least one employee in Illinois on each working day of 20 or more weeks this year or last. Draft rules on the notice were withdrawn in June 2026, so its exact form is not yet set.
The law
Illinois Human Rights Act, 775 ILCS 5/2-102(L), added by Public Act 103-0804 (HB 3773)
Who enforces it
Illinois Department of Human Rights: a worker or applicant can file a charge within 2 years, and the case then goes to the Human Rights Commission or a court. Remedies include damages, hiring or reinstatement, back pay and legal fees.
Get consent before AI analyses video job interviews
Before AI analyses an applicant’s recorded video interview, tell them AI may be used and get their consent. If you rely only on AI to decide who gets an in-person interview, report the race and ethnicity of the people interviewed and hired to the state every year.
Who must do it
Employers that use AI to analyse video interviews for jobs based in Illinois.
The law
Artificial Intelligence Video Interview Act, 820 ILCS 42 (HB 2557 of 2019; yearly reports added by HB 53 of 2021, from January 1, 2022)
Who enforces it
The Department of Commerce and Economic Opportunity collects the yearly reports; the official summaries name no fine.
Get consent before using a person’s AI digital replica
Do not create or distribute a digital replica, an AI-made version of a person’s voice, image or likeness that could pass as authentic, without their consent. Illinois’s right-of-publicity law now covers such replicas.
Who must do it
Anyone creating or distributing such replicas in Illinois.
The law
Right of Publicity Act (765 ILCS 1075), as amended by HB 4875 of 2024
Who enforces it
No regulator; the person can sue under the Right of Publicity Act.
Describe AI replica uses clearly in performer contracts
A contract clause that allows a digital replica of a person’s voice or likeness is invalid if it does not clearly describe the intended uses and the person had no lawyer or union representing them.
Who must do it
Anyone contracting with performers or other individuals in Illinois for their voice or likeness.
The law
Digital Voice and Likeness Protection Act (HB 4762 of 2024)
Who enforces it
No regulator or fine; such a clause cannot be enforced.
Report frontier AI incidents and get yearly safety audits
Large frontier AI developers must publish a safety framework, file disclosure statements with the state emergency management agency and send it regular summaries of catastrophic-risk assessments. Report critical safety incidents to that agency and the Attorney General within 72 hours, or 24 hours if lives are at risk. Yearly independent audits start on January 1, 2028.
Who must do it
Developers of the largest frontier AI models. Staff who raise safety concerns get confidential reporting channels and whistleblower protection.
The law
Artificial Intelligence Safety Measures Act (SB 315, signed July 6, 2026)
Who enforces it
Civil penalties of up to $1 million for a first violation and $3 million for each later one.
Add crisis help and “not human” notices to AI companions
If your chatbot acts as an ongoing AI companion, it must detect signs of suicidal thoughts or self-harm and refer users to crisis services such as the 988 line. It must also tell users clearly that they are not talking to a human, at the start of a conversation and at least every three hours while it continues.
Who must do it
Businesses that offer AI companions to people in New York for personal use: AI that remembers past chats, asks unprompted emotional questions and keeps up personal conversations. Customer-service, productivity and research tools are excluded.
The law
General Business Law, article 47 (sections 1700 to 1704), added by Chapter 58 of 2025, Part U
Who enforces it
Attorney General; civil penalties of up to $15,000 a day, paid into a suicide prevention fund.
Do not give minors chatbot features that seem human or emotional, claim a relationship, flatter, ask unprompted emotional questions or reuse personal details from earlier sessions. The chatbot must never encourage self-harm, eating disorders, drug use, secrecy or isolation, or produce sexual content for them. Offer these features only after an age check shows the user is not a minor. Offer more than one check, including one without government ID or one that keeps the user anonymous, and delete the age data right after.
Who must do it
Businesses that offer chatbots giving ongoing, adaptive replies to users in New York, not only AI companions. Customer-service, research or technical tools that cannot talk about other topics, and internal business tools, are excluded.
The law
General Business Law, article 48 (sections 1800 to 1805), added by Chapter 368 of 2026
Who enforces it
Attorney General; civil penalties of up to $25,000 per violation, plus damages, restitution and the deletion of unlawfully obtained data and of algorithms trained on it.
Label prices set by an algorithm using personal data
If an algorithm uses a customer’s personal data to set the price you offer them, show this notice clearly next to the price: “THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA”.
Who must do it
Businesses offering personalised algorithmic prices to New York consumers. Insurers, financial institutions under the federal Gramm-Leach-Bliley Act, and lower prices for existing subscriptions are excluded.
The law
Algorithmic Pricing Disclosure Act, General Business Law section 349-a (Chapter 58 of 2025, Part X)
Who enforces it
Attorney General, enforcing since November 10, 2025: a cease-and-desist letter first, then court fines of up to $1,000 per violation. A federal court upheld the law in October 2025, and an appeal is pending.
If you make an ad and know it includes a synthetic performer, a realistic human made with AI or other software who is not a real, recognisable person, say so clearly in the ad.
Who must do it
Anyone who produces or creates commercial ads. Audio-only ads, ads for films, TV shows and video games, and AI used only to translate a real performer’s speech are excluded; outlets that only publish ads are exempt.
The law
General Business Law section 396-b, as amended by Chapter 617 of 2025
Who enforces it
$1,000 for a first violation and $5,000 for each later one; the law does not name the enforcer.
Get consent before using a dead performer’s AI replica
Before you use a digital replica, a realistic computer-made voice or likeness, of a deceased performer in an audiovisual work, a sound recording or a live musical performance, get consent from whoever holds their publicity rights, usually the heirs. A disclaimer is no longer enough.
Who must do it
Anyone using a replica of a performer who lived in New York when they died, on or after May 29, 2021, such as studios, labels, advertisers and AI companies.
The law
Civil Rights Law section 50-f, as amended by Chapter 616 of 2025
Who enforces it
No regulator; the rights holders can sue for $2,000 or their damages, whichever is greater, plus the profits made from the use.
Spell out digital replica terms in performer contracts
A contract clause can let you use a digital replica of a person’s voice or likeness instead of work they would have done in person. Such a clause is void if it does not describe the intended uses reasonably specifically, unless the person had a lawyer or a union contract covering such replicas.
Who must do it
Any business contracting with a person for personal or professional services in New York, such as actors, voice artists and creators. It applies to contracts made or changed from January 1, 2025.
The law
General Obligations Law section 5-302
Who enforces it
No regulator or fine; such a clause cannot be enforced.
If you develop frontier AI models, trained with more than 10²⁶ operations, publish a transparency report when you release a new model. Report critical safety incidents to a new office at the Department of Financial Services within 72 hours, or within 24 hours to an authority such as the police if lives are at risk. Developers with over $500 million in yearly revenue must also write, follow and publish a frontier AI safety framework and file disclosures with that office.
Who must do it
Frontier AI developers whose models are developed, deployed or operated at least partly in New York. Accredited universities doing academic research are exempt.
The law
RAISE Act, General Business Law article 44-B, as replaced by Chapter 96 of 2026
Who enforces it
Attorney General; up to $1 million for a first violation and $3 million for each later one. No private lawsuits.
Audit AI hiring tools for bias and tell candidates
Before you use an automated tool to screen job candidates or employees for promotion, have an independent bias audit done within the past year and post a summary of the results on your website. Tell candidates and employees who live in New York City at least 10 business days before use, including what the tool will assess and how to ask for an alternative process or accommodation.
Who must do it
Employers and employment agencies using such tools for jobs in New York City.
The law
Local Law 144 of 2021 (Administrative Code 20-870 to 20-874)
Who enforces it
Department of Consumer and Worker Protection; up to $500 for a first violation and $500 to $1,500 for each later one. Each day of non-compliant use counts as a separate violation.