What each regulator actually requires of enterprise AI.
A cited, versioned index of the instruments in force, organised by jurisdiction. Free to use. Every entry links to the primary source, and we publish our coverage gaps alongside our coverage.
Jurisdictions held today
Coverage is tiered by how far we have verified it. We publish the tier so you know what our answer is worth. Nine jurisdictions carry held instruments across three regions. Holding an instrument and being able to determine against it are different things, and we publish both: six of them — UAE federal, DIFC, Saudi Arabia, India, the European Union and the United Kingdom — carry applicability rules today, so a determination returns lines for those and states a held-but-not-yet-assessed position for the rest rather than guessing.
United Arab Emirates
Federal Decree-Law 45 of 2021 on personal data protection · CBUAE Model Management Standards · CBUAE Guidance Note on consumer protection and the responsible adoption and use of AI and ML (February 2026)
DIFC
Data Protection Regulations, Consolidated Version No. 2 — Regulation 10 on personal data processed through autonomous and semi-autonomous systems: deployer and operator obligations, design requirements, forming certification regime
Saudi Arabia
Personal Data Protection Law and its Implementing Regulation · SDAIA AI Ethics Principles — four risk tiers, lifecycle controls · SAMA market-risk capital framework, model validation standards
India
Digital Personal Data Protection Act 2023 and the DPDP Rules 2025 (G.S.R. 846(E)) — substantive duties from 14 May 2027, carried as a date on every line · RBI FREE-AI framework (August 2025) for regulated entities · CERT-In Technical Guidelines on AIBOM (v2.0, July 2025) · CERT-In Blueprint on AI-assisted exploitation (May 2026)
European Union
Regulation (EU) 2024/1689, the AI Act, as amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744 — prohibitions since February 2025, general-purpose models since August 2025, transparency since August 2026, Annex III high-risk from 2 December 2027 and Annex I from 2 August 2028, split by provider, deployer and GPAI provider · GDPR Articles 5, 13–14, 22 and 35 as they bite on AI
United Kingdom
UK GDPR Articles 22A–22D on automated decision-making, in force 5 February 2026 under the Data (Use and Access) Act 2025 · the five cross-sectoral principles of "A pro-innovation approach to AI regulation" (CP 815), held as the non-statutory guidance they are · ICO Guidance on AI and data protection (updated September 2025)
Qatar
QCB Artificial Intelligence Guideline (September 2024) — held and summarised into six obligation areas from the text recovered by OCR of the scanned PDF, which the entry says on its face; no applicability rules yet
Oman
MTCIT General Policy for the Safe and Ethical Use of AI Systems (April 2025) — published in Arabic only; held and summarised from our own translation, marked as such, and the Arabic text prevails; no applicability rules yet
Bahrain · Kuwait · ADGM
Bahrain — iGA General Policy for the Use of AI (May 2025), binding on government entities, not on private financial institutions · Kuwait — no AI-specific instrument for financial institutions · ADGM — the FSRA Open Regulation AI initiative is an initiative, not a rule
Where we hold nothing, we say so.
Outside the three regions above there is no jurisdiction pack, and we will not pretend otherwise. ISO/IEC 42001 and NIST AI RMF are jurisdiction-neutral and in force for you today, and the framework library maps both to the same control library the packs use.
The spine applies everywhere
An ISO 42001 management system is defensible to a regulator that has not yet written its own AI rules, and it is what a customer, an insurer or an acquirer asks for by name.
Tell us where you operate
We will say plainly whether we hold it, watch it, or neither. That answer is free and it is often "neither".
Report an entry
Every entry carries a report link. A correction is issued as a new version; the superseded one stays reachable in the archive, marked as superseded.
We publish what we have verified, and what we have not.
Verified
Counsel-reviewed and applicability rules tested. No jurisdiction carries this tier until that review is done — the tier is earned, not asserted.
Mapped
Instruments held and summarised. Where applicability rules exist they are drafted, not counsel-verified, and the entry says which. We state the verification step before advising.
Tracked
Instruments listed and monitored for change. No applicability rules yet. We will say so rather than guess.
An index, not an opinion.
Points you at the source
Each entry states what an instrument demands, its force, its status, its dates and who it reaches — in our words, with short attributed quotations and a link to the official text.
Tell you whether it applies to you
Applicability depends on your entity, jurisdiction, licence, data and use cases. That determination is a separate, deterministic process — start it with the diagnostic.