AI Regulatory Changes Tracker | Attestry Intelligence

mediumNigeria NDPC AI PolicyclarificationMay 29, 2026

FG PUSHES E-GOVERNANCE, DIGITAL ECONOMY BILL TO DEEPEN AI, CLOUD ADOPTION

By James Ishaku Nigeria’s drive toward a fully digital economy is gathering pace as the Federal Government intensifies work on e-governance and digital economy bill to strengthen the regulatory framework […]

mediumASEAN AI Governance GuideclarificationMay 24, 2026

ASEAN and the U.S. convened the AI Ministerial to Deepen Cooperation on AI Development and Governance

SINGAPORE, 20 MAY 2026– The U.S.-ASEAN AI Ministerial was organised by the US Department of State, held on 20th May 2026, in Singapore on the sidelines of ATxSummit 2026. The Ministerial also marked the launch of “The Road to 50 years of ASEAN-U.S.Relations”, ahead of Singapore’s ASEAN The post <a rel="nofollow" href="https://asean.org/asean-and-the-u-s-convened-the-ai-ministerial-to-deepen-cooperation-on-ai-development-and-governance/">ASEAN and the U.S. convened the AI Ministerial to Deepen Cooperation on AI Development and Governance</a> appeared first on <a rel="nofollow" href="https://asean.org">ASEAN Main Portal</a>.

mediumKenya Data Protection AI PolicyclarificationMar 29, 2026

ODPC Joins delegates as Kenya Hosts Inaugural AI and Software Summit

ELDORET, Kenya, November 12th – The Office of the Data Protection Commissioner(ODPC) joined various stakeholders at the inaugural Kenya AI and Software Summit, hosted by the Ministry of Information, Communications, and Digital Economy. Under the theme “Software as a Catalyst for Inclusive Growth, Jobs, and Competitiveness,” Data Commissioner Immaculate Kassait delivered remarks during a high-level […]

mediumPhilippines Data Privacy AI RoadmapclarificationMar 29, 2026

NPC Joins International Data Protection Authorities in Statement on Privacy Risks of AI-Generated Imagery

The National Privacy Commission (NPC), together with data protection authorities from across The post <a href="https://privacy.gov.ph/npc-joins-international-data-protection-authorities-in-statement-on-privacy-risks-of-ai-generated-imagery/">NPC Joins International Data Protection Authorities in Statement on Privacy Risks of AI-Generated Imagery</a> appeared first on <a href="https://privacy.gov.ph">National Privacy Commission</a>.

mediumNew Jersey AI RegulationguidanceMar 28, 2026

New Jersey Automated Decision-Making Systems Act

New Jersey A4544 would regulate automated decision-making systems used by state agencies and large private entities. The bill requires impact assessments prior to deployment, ongoing auditing for discriminatory outcomes, public disclosure of system capabilities and limitations, and consumer access to human review of automated decisions. Covers employment, credit, insurance, and government benefit determinations.

mediumMassachusetts AI GovernanceguidanceMar 28, 2026

Massachusetts AI Governance Act

Massachusetts SD 1372 would establish a comprehensive AI governance framework requiring organizations deploying high-risk AI systems to conduct algorithmic impact assessments, implement bias testing protocols, and maintain human oversight mechanisms. The bill targets AI used in employment screening, lending decisions, healthcare triage, and criminal justice risk assessment. It would create an AI Advisory Council to develop technical standards.

mediumVirginia AI RegulationguidanceMar 28, 2026

Virginia High-Risk AI Developer Duties Act

Virginia HB 2094 would impose duties on developers and deployers of high-risk AI systems operating in Virginia. Developers must provide model documentation, share bias testing results, and disclose known limitations to downstream deployers. Deployers must implement risk management programs, conduct impact assessments, and maintain records for audit purposes. The bill aligns closely with the NIST AI RMF governance framework and the Colorado AI Act.

mediumNew York AI Employment LawguidanceMar 28, 2026

New York AI Bias Audit Law Expansion

New York S7623 expands the existing NYC Local Law 144 (automated employment decision tools) statewide and broadens its scope beyond employment to include housing, lending, and insurance decisions. The expansion requires annual bias audits by independent auditors, published audit summaries, candidate/consumer notification prior to AI-assisted evaluation, and an alternative assessment process for individuals who opt out of automated evaluation.

mediumConnecticut AI AccountabilityguidanceMar 28, 2026

Connecticut AI Accountability Act

Connecticut SB 2 proposes accountability requirements for AI systems used in consequential decisions affecting Connecticut residents. The bill would require deployers to conduct impact assessments, implement governance frameworks, provide consumer transparency notices, and establish appeal processes. It follows a similar structure to the Colorado AI Act and covers employment, lending, insurance, housing, and educational decisions.

highCalifornia AI Transparency ActamendmentMar 28, 2026

California AI Transparency Act

California SB 942 requires developers and deployers of AI systems to provide clear transparency disclosures to consumers. Covered AI systems must display conspicuous notices when interacting with users, disclose training data practices, and provide opt-out mechanisms. The law applies to generative AI systems, chatbots, and automated decision tools used in consumer-facing applications. Penalties include fines up to $5,000 per violation enforced by the California Attorney General.

criticalColorado AI ActamendmentMar 28, 2026

Colorado AI Act — Consumer Protections for AI

Colorado SB 24-205 establishes comprehensive consumer protections for high-risk AI systems making consequential decisions in employment, financial services, housing, insurance, and government services. Deployers must complete impact assessments, implement risk management programs, and provide consumers with notice, explanation, and appeal rights. Developers must share testing results and known limitations. The law provides an affirmative defense for organizations demonstrating reasonable compliance efforts.

highEU AI ActlegislativeMar 21, 2026

European Parliament: Resolution on AI Liability Directive Alignment

The European Parliament adopted a resolution urging faster adoption of the AI Liability Directive, emphasizing alignment with the AI Act risk categories. Includes recommendations for strict liability for high-risk AI system failures.

highEU AI ActamendmentMar 19, 2026

EU AI Act: Implementing Rules on High-Risk AI System Classification

The European Commission published detailed implementing rules clarifying the classification criteria for high-risk AI systems under Annex III. Key updates include expanded definitions for creditworthiness assessment and employment-related AI, with new thresholds for determining when systems fall under high-risk category.

mediumConnecticut AI Act (SB 2)clarificationMar 18, 2026

Connecticut SB 2 — An Act Concerning Artificial Intelligence

Connecticut SB 2 is a comprehensive AI governance bill modeled on the Colorado AI Act. It requires deployers of high-risk AI systems to perform impact assessments before deployment, disclose AI use to consumers, provide explanation of AI-driven decisions upon request, and maintain risk management programs. High-risk AI covers consequential decisions in employment, housing, education, financial services, healthcare, insurance, and legal services. Developers must provide deployers with documentation on training data, known limitations, and recommended monitoring practices. The bill establishes the Office of Artificial Intelligence within the AG's office with enforcement authority. Violations are treated as unfair trade practices under CUTPA.

highEU AI ActguidanceMar 18, 2026

EU AI Act — GPAI Code of Practice (Draft 3)

The EU AI Office's third and near-final draft of the General-Purpose AI (GPAI) Code of Practice, released in February 2025. This code operationalizes Article 53-55 of the EU AI Act for GPAI model providers. It defines transparency obligations including technical documentation, training data summaries, copyright compliance processes, and downstream deployer communication requirements. For GPAI models with systemic risk (>10^25 FLOPs), it adds mandatory adversarial testing, red-teaming protocols, incident reporting within 24 hours, and cybersecurity measures. The code establishes a tiered compliance structure allowing SMEs simplified obligations. Adherence creates a presumption of conformity with the EU AI Act.

mediumVirginia CDPA AI Amendments (HB 2094)amendmentMar 18, 2026

Virginia HB 2094 — CDPA Amendments: Automated Decisions & AI Transparency

Virginia HB 2094 amends the Consumer Data Protection Act (CDPA) to expand rights for consumers subject to profiling and automated decision-making with legal or similarly significant effects. It requires controllers to conduct data protection impact assessments before deploying automated decision systems, provide meaningful notice about AI use in consequential decisions, offer the right to opt out of profiling, and ensure human review of automated decisions upon consumer request. The bill covers decisions affecting employment, credit, insurance, housing, education, and healthcare. Controllers must document the logic, significance, and anticipated consequences of automated processing. Enforcement remains with the Virginia AG.

mediumTexas AI in Employment Act (HB 1709)clarificationMar 18, 2026

Texas HB 1709 — Relating to the Use of Artificial Intelligence in Employment Decisions

Texas HB 1709 requires employers using artificial intelligence systems in employment decisions to provide written notice to Texas residents when AI is materially used in hiring, promotion, demotion, discipline, or termination decisions. Employers must disclose the specific AI system used, the categories of data processed, and provide meaningful information about the logic involved. Affected individuals can request human review of any AI-driven employment decision within 30 days. Employers with 500+ employees must conduct annual bias audits of AI employment tools and publish summary results. The Texas Workforce Commission has enforcement authority with civil penalties up to $10,000 per violation.

highNIST AI RMFguidanceMar 18, 2026

NIST Artificial Intelligence Risk Management Framework (AI RMF 1.0)

The NIST AI Risk Management Framework (AI RMF 1.0), published January 2023, is a voluntary framework providing organizations with structured guidance for managing AI risks throughout the AI lifecycle. It defines four core functions: Govern (establish AI risk management culture and policies), Map (contextualize and identify AI risks), Measure (assess and benchmark AI risks using quantitative and qualitative methods), and Manage (prioritize and respond to identified risks). The framework emphasizes trustworthy AI characteristics: validity, reliability, safety, fairness, bias management, transparency, explainability, privacy, and security. While voluntary, it is increasingly referenced as a compliance baseline by state AI laws including Colorado SB 205 and Connecticut SB 2.

highUS Federal AI PolicyenforcementMar 18, 2026

US Executive Order 14179 — Removing Barriers to American Leadership in AI

Executive Order 14179, signed January 23, 2025, revoked the Biden administration's EO 14110 on Safe, Secure, and Trustworthy AI. It shifts US AI policy from precautionary regulation toward promoting American AI competitiveness and innovation. The order directs agencies to remove barriers to AI development and deployment, review existing AI-related rules and guidance for rescission, and develop an AI action plan within 180 days prioritizing US global leadership. It dissolved the AI Safety Institute's policy functions while maintaining technical research at NIST. The order signals reduced federal oversight of AI development but does not preempt state AI laws. Organizations should monitor the action plan due in July 2025 and prepare for a potentially fragmented US regulatory landscape.

mediumUK AI RegulationclarificationMar 18, 2026

UK Artificial Intelligence (Regulation) Bill 2024-25 (Lord Holmes Private Member's Bill)

Lord Holmes' Artificial Intelligence (Regulation) Bill, introduced in the House of Lords in November 2023, proposes establishing a statutory AI Authority to coordinate UK AI regulation across existing sector regulators. The bill mandates a risk-based regulatory framework with mandatory registration for high-risk AI systems, requirements for transparency, explainability, and human oversight. It requires AI developers to conduct impact assessments, maintain audit trails, and submit to regulatory sandboxes for novel applications. The bill creates individual rights to AI explanations and human review of automated decisions. While a private member's bill with uncertain passage prospects, it signals the direction of future UK AI legislation and has influenced government thinking on the statutory footing for AI oversight.

highSouth Korea AI Basic ActamendmentMar 18, 2026

South Korea Framework Act on Artificial Intelligence

South Korea's Framework Act on Artificial Intelligence, enacted December 2024 with effect from January 22, 2026, is Asia's first comprehensive AI law. It establishes a National AI Committee under the Prime Minister for policy coordination, defines 'high-impact AI' as systems affecting life, physical safety, fundamental rights, or public safety, and requires operators of high-impact AI to conduct risk assessments, implement human oversight mechanisms, maintain transparency about AI decision-making, and notify users of AI-generated content. The law mandates AI impact assessments for public sector AI deployment and creates an AI ethics framework. Violations of high-impact AI obligations carry administrative penalties. The law positions South Korea as a global AI governance leader alongside the EU.

mediumBrazil AI Regulation (PL 2338/2023)clarificationMar 18, 2026

Brazil PL 2338/2023 — AI Regulatory Framework

Brazil's PL 2338/2023 establishes a comprehensive AI regulatory framework modeled partly on the EU AI Act. The bill creates a risk-based classification system with four tiers: excessive risk (prohibited), high risk (strict obligations), limited risk (transparency requirements), and low risk (voluntary codes). High-risk AI in areas like public safety, employment, education, credit scoring, healthcare, and justice must undergo impact assessments, implement human oversight, maintain audit trails, and ensure algorithmic transparency. The bill establishes a national AI authority (ANAI) for enforcement, certification, and regulatory sandboxes. It creates rights for individuals affected by AI decisions including explanation, human review, and correction. Penalties reach up to 2% of revenue or R$50 million. Currently advancing through the Brazilian Senate.

mediumCanada AIDAclarificationMar 18, 2026

Canada Bill C-27 — Artificial Intelligence and Data Act (AIDA)

Canada's Artificial Intelligence and Data Act (AIDA), Part 3 of Bill C-27 (Digital Charter Implementation Act), establishes federal AI governance requirements. It mandates impact assessments for high-impact AI systems affecting health, safety, human rights, or economic interests. Organizations must implement risk mitigation measures, maintain records of AI system design and deployment decisions, provide explanations of AI decision-making to affected individuals, and publish plain-language descriptions of AI systems. AIDA creates a new AI and Data Commissioner with enforcement powers including compliance orders and administrative monetary penalties up to $25 million or 5% of global revenue. Bill C-27 died when Parliament was prorogued in January 2025 but is expected to be reintroduced in a future session. The framework signals Canada's regulatory direction.

highNYC Local Law 144 (AEDT)amendmentMar 18, 2026

NYC Local Law 144 — Automated Employment Decision Tools

NYC Local Law 144, effective July 5, 2023, is the first US municipal law regulating AI in employment. It requires employers and employment agencies in New York City using automated employment decision tools (AEDTs) for hiring or promotion to conduct annual independent bias audits assessing disparate impact across race/ethnicity and sex categories. Results must be publicly posted on the employer's website. Employers must notify candidates at least 10 business days before AEDT use, disclose the job qualifications and characteristics the tool evaluates, and offer an alternative selection process upon request. The NYC Department of Consumer and Worker Protection (DCWP) enforces the law with civil penalties of $500 for the first violation and $500-$1,500 for subsequent violations per day.

mediumIllinois AI Video Interview ActamendmentMar 18, 2026

Illinois AI Video Interview Act (PA 101-0260)

The Illinois Artificial Intelligence Video Interview Act (PA 101-0260), effective January 1, 2020, regulates employer use of AI analysis in video interviews. Employers must inform applicants before the interview that AI will analyze facial expressions, word choices, or other characteristics, explain how the AI system works and what it evaluates, and obtain explicit written consent before proceeding. Applicants who do not consent cannot be penalized. Employers must limit video sharing to those whose expertise is necessary for evaluation. Upon applicant request, employers must delete the video within 30 days and instruct any third parties to do the same. The Illinois Department of Labor has enforcement authority. While narrow in scope, this law pioneered state-level AI employment regulation and influenced subsequent legislation across states.