Dated, source-checked status of AI regulation across the EU, US, UK, India, China and Asia-Pacific as of 13 October 2026, with three NKK models for managing regulatory change.
Written for: General counsel, chief risk and compliance officers, heads of AI, CIOs, transformation leads
13 chapters, 105 cited sources, 28 models and charts. The first 2 chapters are open; the rest unlock with the form.
Date from which EU Annex III high-risk requirements now apply, after the Digital Omnibus
Maximum EU fine for prohibited practices, whichever is higher, for large undertakings
The main change in AI regulation over the past twelve months is not volume. It is instability in dates and terms. As of 13 October 2026, the EU has switched on general application but pushed high-risk duties to 2 December 2027 and 2 August 2028 [1]. Colorado's 2024 AI Act was postponed, stayed, then repealed and re-enacted with different duties [2][3][4]. New York reset its coverage test, penalties and regulator before its law applied [5][6]. Washington is contesting state laws through litigation and funding levers and asking Congress to preempt them, with no federal statute yet [7][8]. Korea's AI Basic Act is in force with penalties deferred for at least a year [9].
For an enterprise, a plan keyed to calendar dates and thresholds will be wrong within a year; the duty types we could verify, mainly content marking, human oversight and incident reporting, are steadier. We recommend planning around controls that survive such changes (inventory, transparency, oversight, incident reporting, vendor accountability, data and copyright) and tracking each obligation's legal status separately from its date. The report gives a dated status per jurisdiction and three NKK models: the Regulatory Gravity Map, Control Once, Map Many and the Regulatory Change Radar.
This report is a synthesis of public research; it does not contain primary survey data. Several statutes were read through official summaries or law-firm alerts, and we say where. It is not legal advice.
Date from which EU Annex III high-risk requirements now apply, after the Digital Omnibus
Maximum EU fine for prohibited practices, whichever is higher, for large undertakings
Every claim here is stamped "as of 13 October 2026" and traced to a numbered reference. Each reference carries a tier: tier 1 is a law, regulator, government or standards-body page; tier 2 is a research organisation, professional body or secondary government or legislature page; tier 3 is a law-firm alert or news report, used to corroborate or to date an event. Where a legal fact rests on tier 3 alone, the text says so.
Some primary sources could not be read: EUR-Lex, the California and Texas legislature sites, the Senate site, most congress.gov bill pages, the UK parliamentary libraries, Australia's National AI Plan, the ISO catalogue and two Indian PIB press pages (HTTP 403). Rows that remain secondary-source only: Australia's approach, Taiwan's private-sector scope, California's AI Transparency Act dates and penalty, Colorado's penalty figure, SB 53's effective date and Korea's fine. For the EU we relied on the Commission's AI Act Service Desk, which marks Omnibus amendments in the consolidated text as at 27 July 2026 [1]; it is a Commission page, not the Official Journal.
One status vocabulary is used throughout. The Regulatory Change Radar later reuses four of its five labels and adds a rung called Signal.
| Criterion | What it means | Example in this report |
|---|---|---|
| Applies and enforceable | In force, and a regulator has power to act | EU Commission powers over general-purpose AI providers, including fines, from 2 Aug 2026 |
| Applies, enforcement deferred | In force, but penalties or investigations are suspended or graced | Korea's AI Basic Act: penalties deferred for at least one year from 22 Jan 2026 |
| Adopted, not yet applicable | Passed, with duties that start on a later date | EU Annex III high-risk rules (2 Dec 2027); Colorado SB 26-189 developer documentation (1 Jan 2027) |
| Proposed or draft | Bill, draft rules or draft guidelines | Brazil's PL 2338/2023; the Commission's draft high-risk classification guidelines |
| Soft law | Guidance, principles or voluntary frameworks | India's AI Governance Guidelines; Singapore's agentic AI framework |
Regulators have converged on a problem and diverged on tools. We see four architectures. Comprehensive risk-based statutes (the EU, Korea, Vietnam) define tiers and attach duties to them. Existing law plus sector regulators (the UK, India, Australia) decline to write an AI statute. Targeted rules (China, the US states, Singapore's financial supervisor) regulate one use, one technology or one sector at a time. Promotion law (Japan, Taiwan) states goals and builds institutions without penalties.
Counting laws does not tell you which architecture will burden you. Stanford's AI Index reports that US state AI-related bills passed into law rose from fewer than 10 in 2020 to 150 in 2025, and that "federal policy shifted toward deregulation even as state legislatures passed a record number of AI-related bills" [10]. The count comes from a keyword search of bill texts, so it measures legislative activity, not compliance burden [10]. California enacted 20 in 2025, Texas 12 (the second most active state) and New York 10 [10].
Our argument is that the number to watch is not laws but distinct obligation types. A multinational faces a small set of recurring duties: know your systems, tell people when AI is involved, mark synthetic content, keep humans accountable, report incidents, and answer for your vendors. The legal wrappers differ and the dates and terms move, but the duty types we could verify repeat. That is the premise of the Control Once, Map Many model later in this report.
The first model ranks jurisdictions by two questions: how binding is the regime today, and how far does it reach a company that merely sells into the market?
How to apply it. Plot the markets where you have revenue, users or outputs, then read the quadrant. The reach axis builds on extraterritorial-scope provisions already in law, such as Article 2 of the EU AI Act [17] and Korea's domestic-representative rule [18]. The positions are judgement resting on cited facts. The EU sits top right: binding since 2024, fines up to EUR 35m or 7% [11], and a scope that covers providers "irrespective of whether those providers are established or located within the Union" [17]. Korea sits high on reach but just left of centre, which puts it in Watch closely: the Act is in force, penalties are deferred, and foreign operators above revenue or user thresholds must appoint a domestic representative [9][18]. Vietnam sits just left of centre on binding force because transition periods for existing systems are running [19], and mid-high on reach because the law covers foreign organisations active in Vietnam [19]; that reach placement is low-confidence, as we read an English government outlet and not the Gazette text. Korea and Vietnam move right when their clocks end. China is placed high on binding force because labelling measures have applied since 1 September 2025 [20]; its reach is a low-confidence estimate, because we did not read the texts' territorial clauses. US states sit in the middle because the laws bind but the thresholds are size-based and preemption is contested [21][22]. India is split: guidance on AI [15] but a binding data protection regime on a schedule [23]. The UK, Singapore and Japan sit low because the AI-specific instruments are guidance or promotion law [24][16][25].
Where it breaks. The map ignores sector law. A bank in Singapore faces MAS supervisory expectations, effective 7 October 2027, whose legal force is not stated [26]; a country-level dot hides that, and Singapore's placement is explicit judgement. The map also ages fast. Re-plot it quarterly.
Every figure and regulatory statement in this piece traces to a numbered source below. Links open the original publisher in a new tab.
The EU delayed its high-risk rules, not the board's duty to show it was watching. What the evidence says, what it does not, and an NKK framework of five lenses and a one-page dashboard.
ISO 42001, NIST, the EU AI Act and MAS agree on the capabilities but not the operating model. NKK's tiering matrix, six pillars and evidence chain turn them into decisions, owners and proof.
Official statistics, central-bank surveys and consultancy research on AI adoption, agents, spend, value and jobs, reconciled, with three NKK models for reading the numbers.
