AI used in consequential decisions: hiring, credit, health, and public services.
Most comprehensive AI laws reserve their strongest obligations for systems that make or heavily influence consequential decisions about people. The EU AI Act's Annex III names eight areas: biometrics, critical infrastructure, education, employment, access to essential services and credit, law enforcement, migration and border control, and administration of justice. South Korea's AI Basic Act uses a parallel 'high-impact' category. Several US states target the same decisions through anti-discrimination and automated-decision-making rules. Typical duties include risk management, data governance, human oversight, logging, and conformity assessment before deployment.
This is where the compliance cost sits. If a system touches jobs, money, housing, health, or liberty, assume the high-risk rules are the ones that will govern it.
European UnionComprehensive, horizontal, risk-based statutePhasing in
South KoreaComprehensive risk-based act with a light enforcement postureIn force
United KingdomSectoral, principles-based; no horizontal AI act by designNo comprehensive law
United States (Federal)No comprehensive law; deregulatory posture and state preemption pushNo comprehensive law
AustraliaNo AI act; existing laws plus voluntary guidance, by explicit choiceNo comprehensive law
BrazilComprehensive EU-style bill advancing through the legislatureProposed
CanadaProposed federal act lapsed; voluntary code plus provincial rulesLapsed / failed
Council of Europe (international treaty)First binding international AI treaty (framework convention)Partially in force
PeruFirst AI law in Latin America; promotional statute with risk-based regulationIn force
Saudi ArabiaCentralized governance through SDAIA; principles and drafts, no AI actNo comprehensive law
SwitzerlandDeliberate counter-model to the EU: sectoral, with a treaty-implementation bill dueProposed
United Arab EmiratesLayered model: charters and strategy federally, binding rules in zones and financePartially in force
United States: ColoradoRepealed comprehensive act; replaced with a narrower ADMT lawRepealed / replaced
United States: TexasIntent-based statute with a NIST safe harborIn force
VietnamComprehensive, risk-based AI law with extraterritorial reachIn force
ChileEU-inspired risk-based bill in Congress; updated national policyProposed
KenyaAI Bill tabled 2026: classification, high-risk duties, and a registerProposed
NigeriaBinding framework in motion: risk-based bill with licensing for high-risk AIProposed
SingaporeVoluntary frameworks and testing tools; no binding AI lawNo comprehensive lawThe AI Act simplification package cleared its final approval. It confirms the deferral of stand-alone high-risk obligations to December 2, 2027 and product-embedded ones to August 2, 2028, narrows the 'safety component' test, and adds the nudifier and CSAM prohibition taking effect in December 2026.
Governor Pritzker signed the Artificial Intelligence Safety Measures Act (SB 315), putting Illinois beside California and New York with the same frontier template: models trained past 10^26 operations, developers above 500 million dollars in revenue, safety frameworks, transparency reports, and incident reporting. Illinois goes one step further than either coast: from January 1, 2028, large frontier developers must retain an independent third party to audit their compliance annually and publish the results. The act takes effect January 1, 2027, enforced exclusively by the attorney general, with no private right of action, and it preempts local AI regulation inside the state.
The UAE consolidated its AI, data, and digital-government functions under a single federal authority, the clearest signal yet that its layered governance model is formalizing. The move follows the DIFC's AI-specific regulation reaching full enforcement in January and binding-in-practice central bank guidance for financial institutions in February.
Draft Commission guidelines on high-risk classification walk through each Annex III area with examples. They clarify that intended purpose is judged from instructions, marketing, and documentation together, so a provider cannot dodge high-risk status by omitting a use from the manual.
Artificial Intelligence Regulations, "High-risk systems in AI Regulation," reviewed July 28, 2026, https://artificialintelligenceregulations.com/topics/high-risk-systems.html.
Entries state the position as of the review date and link to the primary text for verification.