Which countries regulate high-risk AI?

Where the law defines a class of high-risk or high-impact AI systems and attaches extra obligations to it.

17 of 108 reviewed jurisdictions address this in at least one tracked instrument. Updated 2026-11-10.

Each answer cites the instrument it rests on; open it for the provision and the full analysis. Whether a rule is binding law, a bill or guidance comes from the instrument's type and status, not from wording.

“Not found” means none of the instruments we track for that jurisdiction addresses the topic. It is not a finding that no such rule exists.

Yes — binding law in force (13)

Partly — regional, framework or general (non-AI) law (2)

  • Spain

    Partly — regional, framework or general (non-AI) law

    High-risk AI systems in the sandbox must align with specified requirements.

    Status verified 2026-09-09

    As an EU member state, the EU AI Act also applies here.

    1 of 3 regions address this
    • AsturiasPartly — regional, framework or general (non-AI) law

      It requires a prior lawfulness analysis for some high-risk systems.

      Status verified 2026-09-09

    • CataloniaNot found in the instruments we track
    • GaliciaNot found in the instruments we track

  • United States

    Partly — regional, framework or general (non-AI) law

    It defines high-risk AI and links that classification to enhanced risk, transparency, testing, and oversight requirements.

    Status verified 2026-10-21

    8 of 50 states address this
    • AlabamaNot found in the instruments we track
    • AlaskaNot found in the instruments we track
    • ArizonaNot found in the instruments we track
    • ArkansasNot found in the instruments we track
    • CaliforniaPartly — regional, framework or general (non-AI) law

      It defines frontier models by compute threshold and imposes safety, reporting, and transparency duties on their developers.

      Status verified 2026-09-10

    • ColoradoPartly — regional, framework or general (non-AI) law

      Deployers must conduct and document annual impact assessments for each high-risk AI system.

      Status verified 2026-09-08

    • ConnecticutNot found in the instruments we track
    • DelawareNot found in the instruments we track
    • FloridaNot found in the instruments we track
    • GeorgiaNot found in the instruments we track
    • HawaiiNot found in the instruments we track
    • IdahoNot found in the instruments we track
    • IllinoisAdopted — not yet in force

      Large frontier developers must maintain safety frameworks and undergo audits for frontier models posing catastrophic risks.

      A possible change to a cited instrument is not yet verified.

      Status verified 2026-09-09

    • IndianaNot found in the instruments we track
    • IowaNot found in the instruments we track
    • KansasNot found in the instruments we track
    • KentuckyPartly — regional, framework or general (non-AI) law

      It defines high-risk AI and imposes review, risk-management, transparency, and oversight duties for its use by state bodies.

      Status verified 2026-09-10

    • LouisianaNot found in the instruments we track
    • MaineNot found in the instruments we track
    • MarylandNot found in the instruments we track
    • MassachusettsNot found in the instruments we track
    • MichiganNot found in the instruments we track
    • MinnesotaNot found in the instruments we track
    • MississippiNot found in the instruments we track
    • MontanaPartly — regional, framework or general (non-AI) law

      Deployers must create a reasonable risk-management policy when critical AI controls critical infrastructure.

      Status verified 2026-09-08

    • NebraskaNot found in the instruments we track
    • NevadaNot found in the instruments we track
    • New HampshireNot found in the instruments we track
    • New JerseyNot found in the instruments we track
    • New MexicoNot found in the instruments we track
    • New YorkAdopted — not yet in force

      Frontier models posing defined catastrophic risks are subject to safety frameworks, assessments, mitigation, reporting and disclosure duties.

      Status verified 2026-09-08

    • North CarolinaNot found in the instruments we track
    • North DakotaNot found in the instruments we track
    • OhioProposed

      Operators of AI systems controlling critical infrastructure must implement comprehensive risk management policies.

      Status verified 2026-09-11

    • OklahomaNot found in the instruments we track
    • OregonNot found in the instruments we track
    • PennsylvaniaNot found in the instruments we track
    • Puerto RicoNot found in the instruments we track
    • Rhode IslandNot found in the instruments we track
    • South CarolinaNot found in the instruments we track
    • South DakotaNot found in the instruments we track
    • TennesseeNot found in the instruments we track
    • TexasNot found in the instruments we track
    • UtahPartly — regional, framework or general (non-AI) law

      Regulated professionals must prominently disclose generative-AI use in high-risk AI interactions.

    • VermontNot found in the instruments we track
    • VirginiaNot found in the instruments we track
    • WashingtonNot found in the instruments we track
    • West VirginiaNot found in the instruments we track
    • WisconsinNot found in the instruments we track
    • WyomingNot found in the instruments we track

Adopted — not yet in force (1)

  • Uruguay

    Adopted — not yet in force

    Systems potentially significantly affecting human rights trigger information and documentation safeguards.

    Status verified 2026-09-09

Proposed (21)

Guidance or policy only (27)

  • Australia

    Guidance or policy only

    Agencies must notify the DTA when they identify a new or reassessed high-risk AI use case.

    A possible change to a cited instrument is not yet verified.

    3 of 7 regions address this

  • Bangladesh

    Guidance or policy only

    It requires risk and impact assessments and registration for high-risk AI systems.

    Status verified 2026-09-10

  • Belgium

    Guidance or policy only

    It recommends algorithmic impact assessments for high-impact public AI systems.

    Status verified 2026-09-09

    As an EU member state, the EU AI Act also applies here.

  • Canada

    Guidance or policy only

    It classifies systems into four impact levels, with higher levels determining proportionate required mitigations.

    Status verified 2026-09-07

    0 of 3 regions address this
    • British ColumbiaNot found in the instruments we track
    • OntarioNot found in the instruments we track
    • QuebecNot found in the instruments we track

  • China

    Guidance or policy only

    Critical AI applications are to undergo safety evaluation and conformity assessment before broad deployment.

    Status verified 2026-09-09

    1 of 4 regions address this
    • BeijingNot found in the instruments we track
    • ShanghaiPartly — regional, framework or general (non-AI) law

      High-risk AI products and services must be subject to list management and compliance review.

      Status verified 2026-09-07

    • ShenzhenNot found in the instruments we track
    • ZhejiangNot found in the instruments we track

  • Cyprus

    Guidance or policy only

    It imposes technical documentation, logs and user disclosures for high-risk systems.

    Status verified 2026-09-09

    As an EU member state, the EU AI Act also applies here.

  • Denmark

    Guidance or policy only

    It recommends restricting high-risk use cases until safeguards and testing are in place.

    Status verified 2026-09-09

    As an EU member state, the EU AI Act also applies here.

  • Estonia

    Guidance or policy only

    It requires human-centred impact assessments for high-impact systems.

    A possible change to a cited instrument is not yet verified.

    Status verified 2026-09-09

    As an EU member state, the EU AI Act also applies here.

  • Ethiopia

    Guidance or policy only

    High-risk applications are defined and must undergo impact assessments, audits and evaluations.

    Status verified 2026-09-09

  • Ghana

    Guidance or policy only

    It requires sectoral risk assessments before deployment of high-impact AI systems.

    Status verified 2026-09-10

  • Greece

    Guidance or policy only

    It identifies Annex III high-risk AI systems as subject to mandatory AI Act requirements.

    Status verified 2026-09-10

    As an EU member state, the EU AI Act also applies here.

  • Iceland

    Guidance or policy only

    The compliance checklist requires ethical assessments for high-impact AI applications.

    Status verified 2026-09-09

  • Israel

    Guidance or policy only

    It recommends DPIAs before deployment for high-impact systems.

    A possible change to a cited instrument is not yet verified.

    Status verified 2026-09-07

  • Kenya

    Guidance or policy only

    High-impact AI is defined and may not be deployed without risk-management and ethical assessments.

    Status verified 2026-09-09

  • Lebanon

    Guidance or policy only

    The checklist requires ethical impact assessments for high-risk AI applications.

    A possible change to a cited instrument is not yet verified.

    Status verified 2026-09-09

  • Luxembourg

    Guidance or policy only

    High-risk systems are identified and subject to mandatory documentation requirements.

    Status verified 2026-09-08

    As an EU member state, the EU AI Act also applies here.

  • Malaysia

    Guidance or policy only

    Private-sector high-risk systems have obligations including model documentation, data lineage, incident reporting and audits.

    A possible change to a cited instrument is not yet verified.

    Status verified 2026-09-08

  • New Zealand

    Guidance or policy only

    Agencies must apply the Charter at the high-risk threshold under its risk matrix.

    Status verified 2026-09-09

  • Pakistan

    Guidance or policy only

    It requires impact and ethics assessments, documentation and model cards for high-risk AI systems.

    Status verified 2026-09-09

  • Qatar

    Guidance or policy only

    It defines high-risk AI and recommends documenting high-risk systems through risk classification.

    1 of 1 regions address this
    • DohaGuidance or policy only

      High-risk AI systems require QCB approval before purchase, licensing, outsourcing or deployment.

      Status verified 2026-09-09

  • Saudi Arabia

    Guidance or policy only

    It recommends risk classification and stronger testing and conformity measures for high-risk systems.

  • Serbia

    Guidance or policy only

    High-risk AI systems need specific analysis and impact assessment.

    Status verified 2026-09-09

  • Singapore

    Guidance or policy only

    It promotes risk assessment and mitigation for high-impact AI uses, including finance and healthcare.

    Status verified 2026-09-07

  • Sweden

    Guidance or policy only

    Providers must register specified high-risk AI systems and maintain related documentation.

    Status verified 2026-09-10

    As an EU member state, the EU AI Act also applies here.

  • Switzerland

    Guidance or policy only

    Material AI applications are classified by risk and subject to additional documentation and independent review.

    Status verified 2026-09-08

  • United Arab Emirates

    Guidance or policy only

    It identifies critical decisions as high-risk and suggests stronger safeguards for them.

    Status verified 2026-09-07

    1 of 1 regions address this

  • United Kingdom

    Guidance or policy only

    It advises against using AI alone in high-risk areas that could harm health, safety, rights or the environment.

    A possible change to a cited instrument is not yet verified.

    Status verified 2026-09-09

Not found in the instruments we track (21)

  • Austria

    Not found in the instruments we track

    As an EU member state, the EU AI Act also applies here.

  • Côte d'Ivoire

    Not found in the instruments we track

  • Egypt

    Not found in the instruments we track

  • France

    Not found in the instruments we track

    As an EU member state, the EU AI Act also applies here.

  • Hong Kong

    Not found in the instruments we track

  • Iran

    Not found in the instruments we track

  • Iraq

    Not found in the instruments we track

  • Italy

    Not found in the instruments we track

    As an EU member state, the EU AI Act also applies here.

    0 of 2 regions address this
    • Emilia-RomagnaNot found in the instruments we track
    • LombardyNot found in the instruments we track

  • Japan

    Not found in the instruments we track

  • Latvia

    Not found in the instruments we track

    As an EU member state, the EU AI Act also applies here.

  • Maldives

    Not found in the instruments we track

  • Panama

    Not found in the instruments we track

  • Portugal

    Not found in the instruments we track

    As an EU member state, the EU AI Act also applies here.

  • Romania

    Not found in the instruments we track

    As an EU member state, the EU AI Act also applies here.

  • Russia

    Not found in the instruments we track
    0 of 1 regions address this
    • MoscowNot found in the instruments we track

  • Rwanda

    Not found in the instruments we track

  • Senegal

    Not found in the instruments we track

  • Slovenia

    Not found in the instruments we track

    As an EU member state, the EU AI Act also applies here.

  • South Africa

    Not found in the instruments we track

  • Tunisia

    Not found in the instruments we track

  • Ukraine

    Not found in the instruments we track

International organisations (23)

  • African Union

    Not found in the instruments we track

  • APEC

    Not found in the instruments we track

  • ASEAN

    Not found in the instruments we track

  • BRICS

    Not found in the instruments we track

  • Council of Europe

    Not found in the instruments we track

  • European Union

    Yes — binding law in force

    Providers deeming an Annex III system not high-risk must document that assessment before market placement or service.

    A possible change to a cited instrument is not yet verified.

    Status verified 2026-09-11

  • G7

    Not found in the instruments we track

  • GPAI

    Not found in the instruments we track

  • IAEA

    Not found in the instruments we track

  • ICAO

    Not found in the instruments we track

  • IEEE

    Not found in the instruments we track

  • ILO

    Not found in the instruments we track

  • Interpol

    Not found in the instruments we track

  • ISO

    Guidance or policy only

    Organizations must conduct impact assessments for AI systems that could significantly affect individuals or society.

    Status verified 2026-09-09

  • ITU

    Not found in the instruments we track

  • NATO

    Not found in the instruments we track

  • OAS

    Not found in the instruments we track

  • OECD

    Guidance or policy only

    High-risk AI systems require deeper assessments and stakeholder engagement.

    Status verified 2026-09-09

  • UNESCO

    Not found in the instruments we track

  • United Nations

    Not found in the instruments we track

  • WHO

    Not found in the instruments we track

  • World Bank

    Not found in the instruments we track

  • World Economic Forum

    Guidance or policy only

    Agents with higher autonomy, authority or complex environments are assigned stricter safeguards and monitoring.

    Status verified 2026-09-09