High-risk systems

Most comprehensive AI laws reserve their strongest obligations for systems that make or heavily influence consequential decisions about people. The EU AI Act's Annex III names eight areas: biometrics, critical infrastructure, education, employment, access to essential services and credit, law enforcement, migration and border control, and administration of justice. South Korea's AI Basic Act uses a parallel 'high-impact' category. Several US states target the same decisions through anti-discrimination and automated-decision-making rules. Typical duties include risk management, data governance, human oversight, logging, and conformity assessment before deployment.

Why it matters

This is where the compliance cost sits. If a system touches jobs, money, housing, health, or liberty, assume the high-risk rules are the ones that will govern it.

How each jurisdiction handles it

FlagJurisdictionHow it is handledStatus

European UnionComprehensive, horizontal, risk-based statutePhasing inSouth KoreaComprehensive risk-based act with a light enforcement postureIn forceUnited KingdomSectoral, principles-based; no horizontal AI act by designNo comprehensive lawUnited States (Federal)State legislation and a federal preemption fight; no federal AI actNo comprehensive lawAustraliaNo AI act yet; existing laws plus guidance, with mandatory data-center and frontier AI standards planned after consultationNo comprehensive lawBrazilComprehensive EU-style bill advancing through the legislatureProposedCanadaProposed federal act lapsed; voluntary code plus provincial rulesLapsed / failedCouncil of Europe (international treaty)First binding international AI treaty, awaiting the ratifications that bring it into forceProposedPeruFramework AI law with a risk-based regulation phasing in by sectorIn forceSaudi ArabiaCentralized governance through SDAIA; principles and drafts, no AI actNo comprehensive lawSwitzerlandSectoral counter-model to the EU, with a treaty-implementation bill dueProposedUnited Arab EmiratesLayered model with charters and strategy federally, binding rules in the DIFC, and guidance in financeNo comprehensive lawUnited States: ColoradoRepealed comprehensive act; narrower ADMT law and a chatbot safety law take effect January 2027Phasing inUnited States: TexasIntent-based statute with a NIST-linked defenseIn forceVietnamComprehensive, risk-based AI law with extraterritorial reachIn forceChileEU-inspired risk-based bill in the Senate; updated national policyProposedKenyaSenate AI Bill at second reading, with a committee report tabled in October 2026; data protection law binds nowProposedNigeriaRisk-based AI bill that NITDA would enforce; data protection law binds nowProposedSingaporeVoluntary frameworks and testing tools; binding AI rules limited to deepfakesNo comprehensive lawMalaysiaVoluntary guidelines; draft risk-based AI Governance Bill awaiting introduction in ParliamentProposedTaiwanFramework statute; principles in force, obligations to followIn forceSpainEU AI Act applies directly; national enforcement and deepfake bills lapsed with the October 2026 dissolutionPhasing in

Recent developments

Common questions