Governance

The best PCI outcome for an AI system is staying out of scope entirely. This guide covers how cardholder data leaks into prompts and logs, how to keep it out, and what applies when the system genuinely must touch it.

South Africa's data protection law includes explicit limits on automated decision-making alongside standard processing conditions. This guide covers what applies to AI systems and what has to be designed in from the start.

Data subject rights are where GDPR meets AI architecture most directly, because access, erasure, and explanation all require the system to have recorded the right things. This guide covers what each right demands.

Brazil's data protection law reaches AI systems directly, including a right to request review of automated decisions. This guide covers legal bases, rights handling, and the architecture decisions the law forces early.

Personal data protection acts across Singapore, Malaysia, and Thailand share a structure that reaches AI systems through consent, purpose, and accountability. This guide covers what they require and what to build.

Canadian federal privacy law reaches AI systems through consent, purpose limitation, and accountability principles, with provincial regimes adding requirements. This guide covers what applies and what to build into systems.

US state AI rules differ in what they require but overlap in what they assume: inventory, assessment, testing, and disclosure. This guide compares the main approaches and explains how to build once rather than per state.

Utah's AI policy legislation makes disclosure the central obligation and confirms that consumer protection law applies to AI outputs. This guide covers who must disclose what, and why the liability point matters most.

Brazil's data protection law already reaches AI systems directly, including a right to review automated decisions, with dedicated AI legislation under consideration. This guide covers what applies today and what to build.

China's AI rules are prescriptive and operational, covering generative services, algorithms, and synthetic content, layered on a data regime that constrains where processing happens. This guide covers what applies in practice.

Illinois has the most consequential biometric statute in the US, with a private right of action, plus specific rules on AI in hiring. This guide covers what applies, why the exposure is unusual, and what to build.

New York City requires an annual independent bias audit for automated employment decision tools, with results published and candidates notified. This guide covers what counts as a tool in scope and what the audit involves.

Saudi Arabia combines national AI ethics principles with a personal data protection law and sector supervision, alongside residency expectations that shape architecture. This guide covers what applies and what to build.

Texas has moved on both consumer privacy and AI governance, with biometric identifier rules that predate both. This guide covers what applies to businesses, what the obligations look like, and what to build.

The UAE operates federal data protection alongside free zone regimes with their own rules, which means the applicable framework depends on where your entity sits. This guide covers what applies and how to decide.

Australia regulates AI through existing privacy, consumer, and sector law alongside a voluntary safety standard, with mandatory guardrails for high-risk settings under consideration. This guide covers what applies today.

Canada's AI-specific legislation has had a complicated path, which makes existing privacy, human rights, and sector rules the operating reality. This guide covers what applies today and what to build so a future statute is not a shock.

India's data protection legislation is the main binding constraint on AI systems, supported by sector rules and advisories rather than a single AI statute. This guide covers what applies and what to build.

Japan's approach has been guideline-led rather than prescriptive, with personal information law and sector supervision providing the binding obligations. This guide covers what applies and what to build for export-facing systems.

Singapore's approach combines a voluntary model governance framework with sector supervision and practical testing tooling. This guide covers what the framework asks for, how it differs from prescriptive regimes, and what to build.

South Korea has moved towards framework AI legislation alongside an actively enforced personal information regime. This guide covers what applies, what the obligations look like, and what to build regardless of timing.

Conformity assessment is the gate between a finished high-risk system and the EU market. This guide covers which route applies, what evidence must exist beforehand, what the declaration and CE marking involve, and what triggers reassessment later.

General-purpose AI model obligations sit on providers of the models themselves, and they shape what downstream builders receive. This guide covers documentation, downstream information duties, copyright policy, and the additional requirements for systemic-risk models.

High-risk classification under the EU AI Act brings a defined set of obligations that shape engineering rather than paperwork. This guide covers what each one requires, who carries it, and what evidence has to exist before a system is placed on the market.