Data tool
Which AI rules apply to me?
Pick where you work or sell and what you use AI for. You get the AI rules that apply, what they ask you to do and from when, with a link to the official text.
Your checklist
Choose one or more answers to each question. Each rule says what to do, who it is for, and who enforces it.
10 rules match your choices.Includes European Union rules, which apply in every EU country.
- France has not yet passed the law that names its AI Act enforcers: the Senate approved it on February 18, 2026, and it is still before the National Assembly. The EU rules apply anyway, because EU regulations apply directly. Official text
In force now 7
- In force since February 2, 2025
Help your staff understand the AI they use
Take steps to support the AI literacy of staff and others who operate or use AI for you, suited to their knowledge and to how the AI is used. Since July 27, 2026 you no longer have to guarantee a particular skill level.
- Who
- Providers and deployers of AI systems in the EU, which includes any business using AI at work.
- Enforced by
- National authorities; the AI Act sets no EU-wide fine for this duty, so penalties come from national law.
- Law
- AI Act, Article 4, as replaced by Regulation (EU) 2026/1744
Official text AI Omnibus enters into force (European Commission) - In force since February 2, 2025
Do not use biometrics to guess race, religion or union ties
AI that sorts individual people by biometric data, such as face or voice, to infer their race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation is banned.
- Who
- Anyone who provides or uses such AI in the EU, including employers.
- Enforced by
- National authorities, enforcing since August 2, 2026; fines up to €35 million or 7% of worldwide turnover, whichever is higher (for SMEs, whichever is lower).
- Law
- AI Act, Article 5(1)(g)
Official text AI Act, Article 5 (EU AI Act Service Desk) - In force since May 25, 2018
Do not let AI alone make big decisions about people
People have the right not to be subject to decisions made solely by automated processing, including profiling, with legal or similarly significant effects, such as automatically rejecting a job application. Such decisions are allowed only when needed for a contract, authorised by law or with explicit consent, and then people get human intervention, a way to contest and meaningful information about the logic.
- Who
- Any organisation processing personal data in the EU, or of people in the EU, including employers and schools.
- Enforced by
- National data protection authorities; fines up to €20 million or 4% of worldwide turnover, whichever is higher.
- Law
- GDPR (Regulation (EU) 2016/679), Article 22, with Articles 13 to 15
Official text GDPR, Regulation (EU) 2016/679 (EUR-Lex) - In force since August 2, 2026
Explain decisions made with high-risk AI when asked
Some AI counts as high-risk, such as AI for hiring, managing staff, education, credit or essential services. If a decision based on it seriously affects someone, they can ask you to explain the AI’s role and the main reasons for the decision, and you must answer clearly. The AI Act’s other duties for this AI start on December 2, 2027.
- Who
- Businesses and organisations in the EU that use such AI to decide about people. It applies where other EU law, such as the GDPR, does not already give this right.
- Enforced by
- National authorities; the AI Act sets no EU-wide fine for this right, so penalties come from national law (in Germany, up to €50,000).
- Law
- AI Act, Article 86, with Annex III
Official text AI Act, Article 86 (EU AI Act Service Desk) - In force since January 1, 2018
Tell the works council before AI hiring or tracking tools
Inform your works council before you use recruitment-assistance methods or automated staff-management systems, and before changing them. Inform and consult it before deciding to deploy any tool that can monitor employees’ activity.
- Who
- Employers in France with at least 50 employees and a works council.
- Enforced by
- Obstructing the works council is a crime, with a fine of up to €7,500 (article L2317-1).
- Law
- Labour Code, article L2312-38
Official text Labour Code, article L2312-38 (Code du travail numérique) - In force since May 1, 2008
Tell job candidates before using AI to assess them
Before using any recruitment method or technique on candidates, including AI tools, tell them which ones you will use. Methods must be relevant to the job, results stay confidential, and no data may be collected through a tool they were not told about.
- Who
- All employers and recruiters in France, of any size.
- Enforced by
- These articles set no penalty of their own.
- Law
- Labour Code, articles L1221-8 and L1221-9
Official text Labour Code, article L1221-8 (Code du travail numérique) - In force since June 1, 2019
Explain your automated decision rules when asked
A decision with legal or similarly significant effects on someone may rest solely on automated processing only in the GDPR’s contract and explicit-consent cases. Then, if the person asks, you must tell them the rules that define the processing and its main characteristics, except secrets protected by law.
- Who
- Any organisation in France that takes solely automated decisions about people. Public bodies have stricter duties.
- Enforced by
- The data protection authority (CNIL); fines up to €20 million or 4% of worldwide turnover, whichever is higher.
- Law
- Data Protection Act (Loi Informatique et Libertés, law no. 78-17), article 47
Official text Data Protection Act, article 47 (CNIL)
Coming up 3
- Starts December 2, 2026
Platforms: keep humans in charge of algorithmic management
Gig-work platforms must explain their automated monitoring and decision systems to the people working through them, keep them under human oversight, and not use them to process data such as emotional state, private conversations or union activity. Only a human may decide to restrict, suspend or close a worker’s account. EU countries must put this into national law by December 2, 2026.
- Who
- Digital labour platforms, such as ride-hailing or delivery apps, organising work in the EU. The data and human-review rules also protect self-employed platform workers.
- Enforced by
- Under each country’s national law; data protection authorities can fine breaches of the data rules at GDPR levels.
- Law
- Platform Work Directive (EU) 2024/2831, Articles 7 to 15 (deadline for national laws)
Official text Platform Work Directive (EU) 2024/2831 (EUR-Lex) - Starts December 2, 2027
AI for hiring and managing staff becomes “high-risk”
Employers using AI to recruit, manage or evaluate workers must follow its instructions, have trained people oversee it and keep its logs for at least six months. They must inform workers and their representatives before using it, and tell candidates and staff when it is used in decisions about them. AI types already on the market before then are covered only after a significant design change.
- Who
- Employers and other organisations that use such AI in the EU.
- Enforced by
- National authorities; fines up to €15 million or 3% of worldwide turnover, whichever is higher (whichever is lower for SMEs and small mid-caps).
- Law
- AI Act, Article 26 and Annex III (date moved by the 2026 Digital Omnibus)
Official text AI Act overview (European Commission) - Starts December 2, 2027
Check HR AI against the high-risk rules before you sell it
If you sell AI for recruiting, promotion, firing, task allocation or monitoring workers, it must meet the high-risk requirements: risk management, data quality, documentation, logging, human oversight and accuracy. It must also pass a conformity assessment, carry the CE mark and be registered in the EU database.
- Who
- Providers placing such AI on the EU market, including companies that sell it under their own name or substantially change it.
- Enforced by
- National authorities; fines up to €15 million or 3% of worldwide turnover, whichever is higher (whichever is lower for SMEs and small mid-caps).
- Law
- AI Act, Articles 6(2), 8 to 17, 43 and 47 to 49, and Annex III point 4 (date moved by Regulation (EU) 2026/1744)
Official text AI Act overview (European Commission)
Next deadlines
The next rules to start, everywhere we track.
- European UnionDo not offer or use AI that makes sexual deepfakes
- European UnionPlatforms: keep humans in charge of algorithmic management
- CaliforniaSay in layoff notices when AI caused the cuts
- CaliforniaNo surveillance tools in workplace bathrooms
- CaliforniaDo not use AI to read workers’ emotions or neural data
- CaliforniaBig platforms must show whether content is AI-made
What this checker covers
We aim to list every rule that fits the scope below, and we say openly what is not in it yet.
Covered
- Binding laws and regulations about AI, automated decisions, AI-made content, chatbots and AI developers.
- Rules already in force, and rules that are law with a set start date.
- Duties for businesses, employers, platforms and AI makers in the places listed above.
- For Germany, France and Hungary: national rules that add to EU law, and who enforces the AI Act there.
- A few general laws that are the main rule for an AI use in a country, marked “General law”.
Not covered yet
- Rules for a single sector, such as health care, insurance, banking, elections or law firms.
- Rules that bind only public bodies, such as government agencies, state schools or public broadcasters.
- Bills that have not passed, official guidance and voluntary codes.
- Most general laws that are not about AI but still apply to it, such as data protection, anti-discrimination or consumer law.
- Other US states, and countries not listed above, including the United Kingdom.
- National laws of EU countries other than Germany, France and Hungary.
How we check these rules
We read each rule in the official text, the law itself or the regulator’s own page, and link it. Where an earlier summary disagrees with the signed text, we follow the signed text. We last checked all 96 rules, from 69 official sources, on October 1, 2026.
Two notes on dates. California laws that set no start date of their own take effect on January 1 of the next year, so we list the bills signed in September 2026 from January 1, 2027. The EU dates follow the European Commission’s timeline, which includes the changes made by the 2026 Digital Omnibus; the article pages we link still show the 2024 wording.
One note on sources. Illinois’s legislature website could not be reached when we checked, so the Illinois entries rest on official summaries by the Governor, the Attorney General and state agencies. We will check them against the law texts as soon as the site is reachable.
For every AI law, bill, order and court ruling we have covered, including ones that are not yet in force, see the AI laws tracker and the AI calendar.
This is a plain-language guide, not legal advice. Laws have exceptions and details we leave out, and they change. Check the official text, or ask a lawyer, before you act. If you spot a mistake, tell us through the corrections policy.