Standing compendium · Updated quarterly
The Rulebook
Every AI obligation that binds an organisation today, and every one that is coming, in one dated document. Regulation is the weekly series. The Rulebook is what it accumulates into.
The verification rule
Cite the instrument, the article or section number, and the date. Not the law firm alert, not the tracker, not this document. That single habit is what separates a policy committee from a commentator, and it is the whole basis of the authority.
The three regulatory camps
| Camp | What it means | Who is in it |
|---|---|---|
| Comprehensive horizontal law | A single statute covering AI across sectors, risk-tiered | European Union, South Korea |
| Targeted binding rules | Specific instruments covering specific harms, no omnibus law | China, India |
| Existing law, applied | No AI statute. Sectoral regulators and general law do the work | United Kingdom, Japan, Canada, Singapore, Australia, and the United States at federal level |
Binding obligations by year
Counting the dated obligations tracked in this compendium. Not a forecast.
Source: Global AI Forum, The Rulebook v1.0, September 2026. n = 21 tracked obligations.
The compliance calendar
| Date | Jurisdiction | What happens | Status |
|---|---|---|---|
| Feb 2025 | European Union | AI Act prohibited practices and the AI literacy duty | In force |
| Jul 2023 | New York City | Local Law 144 bias audits for automated employment tools | In force |
| Aug 2025 | European Union | GPAI obligations and the penalties regime | In force |
| Sep 2025 | China | AI content labelling measures | In force |
| Nov 2025 | India | DPDP Phase 1. Data Protection Board established | In force |
| 1 Jan 2026 | California | SB 53 frontier transparency and AB 2013 training data disclosure | In force |
| 1 Jan 2026 | Texas | TRAIGA, with the NIST safe harbour | In force |
| 1 Jan 2026 | Illinois | HB 3773, employment AI, with a private right of action | In force |
| 22 Jan 2026 | South Korea | AI Basic Act and Enforcement Decree | In force |
| 20 Feb 2026 | India | IT Amendment Rules, synthetic content labelling and traceability | In force |
| 27 Jul 2026 | European Union | Digital Omnibus in force | In force |
| 2 Aug 2026 | European Union | AI Act Article 50 transparency obligations | In force |
| 13 Nov 2026 | India | DPDP Phase 2, consent managers | Coming |
| 2 Dec 2026 | European Union | Watermarking for pre-existing deployed generative systems | Coming |
| 9 Dec 2026 | European Union | Member State transposition, revised Product Liability Directive | Coming |
| 1 Jan 2027 | Colorado | SB 26-189 duties and Attorney General rulemaking | Coming |
| 1 Jan 2027 | New York | RAISE Act, frontier developers, 72 hour incident reporting | Coming |
| 22 Jan 2027 | South Korea | Fine grace period ends | Coming |
| 13 May 2027 | India | DPDP Phase 3, full enforcement | Coming |
| 2 Dec 2027 | European Union | High-risk Annex III obligations apply | Coming |
| 2 Aug 2028 | European Union | High-risk Annex I embedded product obligations apply | Coming |
Cite this asGlobal AI Forum Legal and Policy Committee, The Rulebook, version 1.0, September 2026. Verify each entry against its instrument before relying on it. Nothing here is legal advice.
The weekly
Six pieces of research a week. One email on Sunday.
An organisation mapped, a failure documented, a category defined, an obligation explained, a company running AI in production, and an investor mapped by position. Free, and the archive is public.