AI and data protection regulation by country

Registry of 101 rules, guidance documents and standards with 253 obligations across 11 jurisdictions, with date, status, who they apply to, source and verification status, as of November 2, 2026.

• Argentina

  Argentina has no AI law: Data Law 25,326 applies, including the duty to explain the logic of automated decisions, plus an AAIP guide that sets out what to document.

  6 rules · 17 obligations

• Brazil

  Brazil has no AI law in force, but the LGPD already requires review of automated decisions, and specific ANVISA and CFM rules apply in healthcare.

  7 rules · 19 obligations

• Chile

  Chile has no AI law, but its new data law, with rights regarding automated decisions, applies from December 1, 2026, unless the postponement to October 2027 is enacted.

  7 rules · 23 obligations

• Colombia

  Colombia has no AI law: obligations come from the personal data law, SIC guidance and sector rules for healthcare and platforms.

  8 rules · 18 obligations

• Ecuador

  Ecuador has no AI law, but the data protection authority already enforces specific rules for any AI that processes personal data.

  11 rules · 24 obligations

• Spain

  The EU AI Act applies directly in Spain, but the national penalties bill lapsed; Spanish employment and customer-service rules already apply.

  9 rules · 13 obligations

• European Union

  The EU already requires AI literacy, avoiding prohibited practices and AI disclosures; high-risk obligations arrive in December 2027.

  14 rules · 38 obligations

• International standards

  Publicly available international frameworks are not mandatory, but they organize the work and banks and large customers ask for them.

  5 rules · 9 obligations

• Mexico

  Mexico has no AI law: today's duties come from the 2025 data law, the platform-work reform and the new protection of voice and likeness against AI.

  5 rules · 15 obligations

• Peru

  Peru is the only country in the region with an AI law and implementing regulation in force, and the deadlines for healthcare, education, security and finance have already passed.

  5 rules · 21 obligations

• United States (federal)

  The US has no federal AI law: your obligations depend on the states where your customers and employees are.

  24 rules · 56 obligations