Which countries regulate high-risk AI?

Where the law defines a class of high-risk or high-impact AI systems and attaches extra obligations to it.

17 of 109 reviewed jurisdictions address this in at least one tracked instrument. Updated 2026-10-04.

Each answer cites the instrument it rests on; open it for the provision and the full analysis. Whether a rule is binding law, a bill or guidance comes from the instrument's type and status, not from wording.

“Not found” means none of the instruments we track for that jurisdiction addresses the topic. It is not a finding that no such rule exists.

Yes — binding law in force (13)

Partly — regional, framework or general (non-AI) law (2)

  • Spain

    Partly — regional, framework or general (non-AI) law

    High-risk AI systems in the sandbox must align with specified requirements.

    Status verified 2026-09-09

    As an EU member state, the EU AI Act also applies here.

    1 of 3 regions address this
    • AsturiasPartly — regional, framework or general (non-AI) law

      It requires a prior lawfulness analysis for some high-risk systems.

      Status verified 2026-09-09

    • CataloniaNot found in the instruments we track
    • GaliciaNot found in the instruments we track

  • United States

    Partly — regional, framework or general (non-AI) law

    It defines high-risk AI and links that classification to enhanced risk, transparency, testing, and oversight requirements.

    A possible change to a cited instrument is not yet verified.

    Status verified 2026-09-07

    9 of 51 states address this
    • AlabamaNot found in the instruments we track
    • AlaskaNot found in the instruments we track
    • ArizonaNot found in the instruments we track
    • ArkansasNot found in the instruments we track
    • CaliforniaPartly — regional, framework or general (non-AI) law

      It defines frontier models by compute threshold and imposes safety, reporting, and transparency duties on their developers.

      Status verified 2026-09-10

    • ColoradoPartly — regional, framework or general (non-AI) law

      Deployers must conduct and document annual impact assessments for each high-risk AI system.

      Status verified 2026-09-08

    • ConnecticutPartly — regional, framework or general (non-AI) law

      A new impact assessment is required within 90 days after a substantial modification to a high-risk AI system.

      A possible change to a cited instrument is not yet verified.

      Status verified 2026-09-09

    • DelawareNot found in the instruments we track
    • FloridaNot found in the instruments we track
    • GeorgiaNot found in the instruments we track
    • HawaiiNot found in the instruments we track
    • IdahoNot found in the instruments we track
    • IllinoisAdopted — not yet in force

      Large frontier developers must maintain safety frameworks and undergo audits for frontier models posing catastrophic risks.

      A possible change to a cited instrument is not yet verified.

      Status verified 2026-09-09

    • IndianaNot found in the instruments we track
    • IowaNot found in the instruments we track
    • KansasNot found in the instruments we track
    • KentuckyPartly — regional, framework or general (non-AI) law

      It defines high-risk AI and imposes review, risk-management, transparency, and oversight duties for its use by state bodies.

      Status verified 2026-09-10

    • LouisianaNot found in the instruments we track
    • MaineNot found in the instruments we track
    • MarylandNot found in the instruments we track
    • MassachusettsNot found in the instruments we track
    • MichiganNot found in the instruments we track
    • MinnesotaNot found in the instruments we track
    • MississippiNot found in the instruments we track
    • MissouriNot found in the instruments we track
    • MontanaPartly — regional, framework or general (non-AI) law

      Deployers of AI controlling critical infrastructure must maintain risk-management policies.

      Status verified 2026-09-08

    • NebraskaNot found in the instruments we track
    • NevadaNot found in the instruments we track
    • New HampshireNot found in the instruments we track
    • New JerseyNot found in the instruments we track
    • New MexicoNot found in the instruments we track
    • New YorkPartly — regional, framework or general (non-AI) law

      Frontier models posing catastrophic risks are subject to special safety, publication, and incident-reporting duties.

      Status verified 2026-09-09

    • North CarolinaNot found in the instruments we track
    • North DakotaNot found in the instruments we track
    • OhioProposed

      Operators of AI systems controlling critical infrastructure must implement comprehensive risk management policies.

      Status verified 2026-09-11

    • OklahomaNot found in the instruments we track
    • OregonNot found in the instruments we track
    • PennsylvaniaNot found in the instruments we track
    • Puerto RicoNot found in the instruments we track
    • Rhode IslandNot found in the instruments we track
    • South CarolinaNot found in the instruments we track
    • South DakotaNot found in the instruments we track
    • TennesseeNot found in the instruments we track
    • TexasNot found in the instruments we track
    • UtahPartly — regional, framework or general (non-AI) law

      Regulated professionals must prominently disclose generative-AI use in high-risk AI interactions.

    • VermontNot found in the instruments we track
    • VirginiaNot found in the instruments we track
    • WashingtonNot found in the instruments we track
    • West VirginiaNot found in the instruments we track
    • WisconsinNot found in the instruments we track
    • WyomingNot found in the instruments we track

Proposed (23)

Guidance or policy only (26)

Not found in the instruments we track (21)

  • Austria

    Not found in the instruments we track

    As an EU member state, the EU AI Act also applies here.

  • Côte d'Ivoire

    Not found in the instruments we track

  • Egypt

    Not found in the instruments we track

  • France

    Not found in the instruments we track

    As an EU member state, the EU AI Act also applies here.

  • Hong Kong

    Not found in the instruments we track

  • Iran

    Not found in the instruments we track

  • Iraq

    Not found in the instruments we track

  • Italy

    Not found in the instruments we track

    As an EU member state, the EU AI Act also applies here.

    0 of 2 regions address this
    • Emilia-RomagnaNot found in the instruments we track
    • LombardyNot found in the instruments we track

  • Japan

    Not found in the instruments we track

  • Latvia

    Not found in the instruments we track

    As an EU member state, the EU AI Act also applies here.

  • Maldives

    Not found in the instruments we track

  • Panama

    Not found in the instruments we track

  • Portugal

    Not found in the instruments we track

    As an EU member state, the EU AI Act also applies here.

  • Russia

    Not found in the instruments we track
    0 of 2 regions address this
    • MoscowNot found in the instruments we track
    • TatarstanNot found in the instruments we track

  • Rwanda

    Not found in the instruments we track

  • Senegal

    Not found in the instruments we track

  • Slovenia

    Not found in the instruments we track

    As an EU member state, the EU AI Act also applies here.

  • South Africa

    Not found in the instruments we track

  • Tunisia

    Not found in the instruments we track

  • Ukraine

    Not found in the instruments we track

  • Uruguay

    Not found in the instruments we track

International organisations (24)

  • African Union

    Not found in the instruments we track

  • APEC

    Not found in the instruments we track

  • ASEAN

    Not found in the instruments we track

  • BRICS

    Not found in the instruments we track

  • Council of Europe

    Not found in the instruments we track

  • European Union

    Yes — binding law in force

    Providers deeming an Annex III system not high-risk must document that assessment before market placement or service.

    A possible change to a cited instrument is not yet verified.

    Status verified 2026-09-11

  • G7

    Not found in the instruments we track

  • GPAI

    Not found in the instruments we track

  • IAEA

    Not found in the instruments we track

  • ICAO

    Not found in the instruments we track

  • IEEE

    Not found in the instruments we track

  • ILO

    Not found in the instruments we track

  • International

    Not found in the instruments we track

  • Interpol

    Not found in the instruments we track

  • ISO

    Guidance or policy only

    Organizations must conduct impact assessments for AI systems that could significantly affect individuals or society.

    Status verified 2026-09-09

  • ITU

    Not found in the instruments we track

  • NATO

    Not found in the instruments we track

  • OAS

    Not found in the instruments we track

  • OECD

    Guidance or policy only

    High-risk AI systems require deeper assessments and stakeholder engagement.

    Status verified 2026-09-09

  • UNESCO

    Not found in the instruments we track

  • United Nations

    Adopted — not yet in force

    It mandates human-rights impact assessments before high-risk AI systems are deployed.

    Status verified 2026-09-09

  • WHO

    Not found in the instruments we track

  • World Bank

    Not found in the instruments we track

  • World Economic Forum

    Guidance or policy only

    Agents with higher autonomy, authority or complex environments are assigned stricter safeguards and monitoring.

    Status verified 2026-09-09