Our thinking

AI Watch: Global regulatory tracker

What's inside

Keeping track of AI regulatory developments around the world.

The global dash to regulate AI

Artificial intelligence (AI) has made enormous strides in recent years and has increasingly moved into the public consciousness.

Increases in computational power, coupled with advances in machine learning, have fueled the rapid rise of AI. This has brought enormous opportunities, as new AI applications have given rise to new ways of doing business. It has also brought potential risks, from unintended impacts on individuals (e.g., AI errors harming an individual's credit score or public reputation) to the risk of misuse of AI by malicious third parties (e.g., by manipulating AI systems to produce inaccurate or misleading output, or by using AI to create deepfakes).

Governments and regulatory bodies around the world have had to act quickly to try to ensure that their regulatory frameworks do not become obsolete. In addition, international organizations such as the G7, the UN, the Council of Europe and the OECD have responded to this technological shift by issuing their own AI frameworks. But they are all scrambling to stay abreast of technological developments, and already there are signs that emerging efforts to regulate AI will struggle to keep pace. In an effort to introduce some degree of international consensus, the UK government organized the first global AI Safety Summit in November 2023, with the aim of encouraging the safe and responsible development of AI around the world. 

Most jurisdictions have sought to strike a balance between encouraging AI innovation and investment, while at the same time attempting to create rules to protect against possible harms. However, jurisdictions around the world have taken substantially different approaches to achieving these goals, which has in turn increased the risk that businesses face from a fragmented and inconsistent AI regulatory environment. Nevertheless, certain trends are becoming clearer at this stage:

  1. "AI" means different things in different jurisdictions: One of the foundational challenges that any international business faces when designing an AI regulatory compliance strategy is figuring out what constitutes "AI." Unfortunately, the definition of AI varies from one jurisdiction to the next. For example, the EU AI Act adopts a definition of "AI systems" that is based on (but is not identical to) the OECD's definition, and which leaves room for substantial doubt due to its uncertain wording. Canada has proposed a similar, though more concise, definition. Various US states have proposed their own definitions, which differ from one another. And many jurisdictions (e.g., the UK, Israel, China, and Japan) do not currently provide a comprehensive definition of AI. Because several of the proposed AI regulations have extraterritorial effect (meaning more than one AI regulation may apply simultaneously), international businesses may be forced to adopt a "highest common denominator" approach to identifying AI based on the strictest applicable standard.
  2. Emerging AI regulations come in different forms: The various emerging AI regulations have no consistent legal form – some are statutes, some are executive orders, some are expansions of existing regulatory frameworks, and so on. The EU AI Act is a "Regulation" (which means that most of it will apply directly in all EU Member States, without the need for national implementation in most cases). The UK has taken a different approach, declining to legislate at this early stage in the development of AI, and instead choosing to task existing UK regulators with the responsibility of interpreting and applying five AI principles in their respective spheres. In the US, there is a mix of White House Executive Orders, federal and state initiatives, and actions by existing regulatory agencies, such as the Federal Trade Commission. As a result, the types of compliance obligations that international businesses face are likely to be materially different from one jurisdiction to the next. Many other jurisdictions have yet to decide whether they will issue sector-specific or generally applicable rules and have yet to decide between creating new regulators or expanding the roles of existing regulators, making it challenging for businesses to anticipate what form their AI regulatory relationships will take in the long term.
  3. Emerging AI regulations have different conceptual approaches: The next difficulty is the lack of a consistent conceptual approach among emerging AI regulations around the world – some are legally binding while others are not, some are sector-specific while others apply across all sectors, some will be enforced by regulators while others are merely guidelines or recommendations, and so on. As noted above, the UK approach is to use existing regulators to implement five AI principles, but with no new explicit legal obligations. This has the advantage of meaning that businesses will deal with AI regulators with whom they are already familiar but has the disadvantage that different UK regulators may interpret these principles differently in their respective spheres. The EU AI Act is cross-sectoral and creates new regulatory and enforcement powers for existing bodies, including the European Commission, and also creates entirely new bodies such as the AI Board and the AI Office, while leaving EU Member States to appoint their own AI regulators tasked with enforcing the EU AI Act. In the US, the Federal Trade Commission, Equal Employment Opportunity Commission, Consumer Financial Protection Bureau, and Department of Justice issued a joint statement clarifying that their existing authority covers AI, while various state regulators are also likely to have competence to regulate AI. International organizations including the OECD, the UN, and the G7 have issued AI principles, but these impose no legal obligations on businesses. In principle, these initiatives encourage consistency across members of each organization, but in practice this does not seem to have worked.
  4. Flexibility is a double-edged sword: In an effort to create AI regulations that can adapt to technological advances that have not yet been anticipated, many jurisdictions have sought to include substantial flexibility in those regulations, either by using deliberately high-level wording and policies, or by allowing for future interpretation and application by courts and regulators. This has the obvious advantage of prolonging the lifespan of such regulations by allowing them to be adapted to future technologies. However, it also creates the disadvantage of uncertainty because it leaves businesses uncertain of how their compliance obligations will be interpreted in the future. This is likely to mean that it is harder for businesses to know whether their planned implementations of AI will be lawful in the medium-to-long term and may make it harder to attract long-term AI investment in those jurisdictions.
  5. The overlap between AI regulation and other areas of law is complex: A substantial number of laws that are not directly focused on AI nevertheless apply to AI by association within their respective spheres, meaning that any use of AI will often trigger compliance issues and legal challenges even where there is not (yet) any enforceable AI-specific law. These areas of overlap include: IP (e.g., IP infringement issues with respect to AI model training data, and questions about copyright and patentability of AI-assisted inventions); antitrust; data protection (which adds restrictions to processing of personal data, and in some cases imposes special compliance obligations for processing carried out by automated means, including by AI); M&A (where AI innovation is driving dealmaking in many markets); financial regulation (where financial regulatory requirements may limit the ways in which AI can lawfully be deployed); litigation; digital infrastructure; securities; global trade; foreign direct investment; mining & metals; and so on. This overlap will mean that many businesses need to understand not just AI regulations in general, but also any rules that affect the use of AI in the context of the relevant sector or business activity.

Businesses in almost all sectors need to keep a close eye on these developments to ensure that they are aware of the AI regulations and forthcoming trends, in order to identify new opportunities and new potential business risks. But even at this early stage, the inconsistent approaches each jurisdiction has taken to the core questions of how to regulate AI is clear. As a result, it appears that international businesses may face substantially different AI regulatory compliance challenges in different parts of the world. To that end, this AI Tracker is designed to provide businesses with an understanding of the state of play of AI regulations in the core markets in which they operate. It provides analysis of the approach that each jurisdiction has taken to AI regulation and provides helpful commentary on the likely direction of travel.

Because global AI regulations remain in a constant state of flux, this AI Tracker will develop over time, adding updates and new jurisdictions when appropriate. Stay tuned, as we continue to provide insights to help businesses navigate these ever-evolving issues.

Articles

Australia

Voluntary AI Ethics Principles guide responsible AI development in Australia, with potential reforms under consideration.

Australia

Brazil

The enactment of Brazil's proposed AI Regulation remains uncertain with compliance requirements pending review.

Sao Paulo

Canada

AIDA expected to regulate AI at the federal level in Canada but provincial legislatures have yet to be introduced.

Canada

China

The Interim AI Measures is China's first specific, administrative regulation on the management of generative AI services.

China

Council of Europe

The Council of Europe is developing a new Convention on AI to safeguard human rights, democracy, and the rule of law in the digital space covering governance, accountability and risk assessment.

European Union

Czech Republic

The successful implementation of the EU AI Act into national law is the primary focus for the Czech Republic, with its National AI Strategy being the main policy document.

Czech Republic

European Union

The EU introduces the pioneering EU AI Act, aiming to become a global hub for human-centric, trustworthy AI.

 

European Union

France

France actively participates in international efforts and proposes sector-specific laws.

Paris

G7

The G7's AI regulations mandate Member States' compliance with international human rights law and relevant international frameworks.

G7 flags

Germany

Germany evaluates AI-specific legislation needs and actively engages in international initiatives.

Germany

India

National frameworks inform India’s approach to AI regulation, with sector-specific initiatives in finance and health sectors.

India

Israel

Israel promotes responsible AI innovation through policy and sector-specific guidelines to address core issues and ethical principles.

Israel

Italy

Italy engages in political discussions for future laws.

Milan

Japan

Japan adopts a soft law approach to AI governance but lawmakers advance proposal for a hard law approach for certain harms.

Tokyo

Kenya

Kenya's National AI Strategy and Code of Practice expected to set foundation of AI regulation once finalized.

Kenya
Kenya

Nigeria

Nigeria's draft National AI Policy underway and will pave the way for a comprehensive national AI strategy.

Nigeria
Nigeria

Norway

Position paper informs Norwegian approach to AI, with sector-specific legislative amendments to regulate developments in AI.

Norway

OECD

The OECD's AI recommendations encourage Member States to uphold principles of trustworthy AI.

country flags

Saudi Arabia

Saudi Arabia is yet to enact AI Regulations, relying on guidelines to establish practice standards and general principles.

Riyadh_Hero_1600x600 Saudi Arabia

Singapore

Singapore's AI frameworks guide AI ethical and governance principles, with existing sector-specific regulations addressing AI risks.

Singapore

South Africa

South Africa is yet to announce any AI regulation proposals but is in the process of obtaining inputs for a draft National AI plan.

Johannesburg

South Korea

South Korea's AI Act to act as a consolidated body of law governing AI once approved by the National Assembly.

Korea

Spain

Spain creates Europe's first AI supervisory agency and actively participates in EU AI Act negotiations.

Madrid

Switzerland

Switzerland's National AI Strategy sets out guidelines for the use of AI, and aims to finalize an AI regulatory proposal in 2025.

Switzerland

Taiwan

Draft laws and guidelines are under consideration in Taiwan, with sector-specific initiatives already in place.

Taiwan city

Turkey

Turkey has published multiple guidelines on the use of AI in various sectors, with a bill for AI regulation now in the legislative process.

Türkiye

United Arab Emirates

Mainland UAE has published an array of decrees and guidelines regarding regulation of AI, while the ADGM and DIFC free zones each rely on amendments to existing data protection laws to regulate AI.

UAE

United Kingdom

The UK prioritizes a flexible framework over comprehensive regulation and emphasizes sector-specific laws.

London hero image

United Nations

The UN's new draft resolution on AI encourages Member States to implement national regulatory and governance approaches for a global consensus on safe, secure and trustworthy AI systems.

United Nations

United States

The US relies on existing federal laws and guidelines to regulate AI but aims to introduce AI legislation and a federal regulation authority.

New York city photo

Contacts

Tim Hickman
Partner
London
Erin Hanson
Partner
New York
Dr. Sylvia Lorenz
Partner
Berlin
G7 flags

AI Watch: Global regulatory tracker - G7

The G7's AI regulations mandate Member States' compliance with international human rights law and relevant international frameworks.

Insight
|
11 min read

Laws/Regulations directly regulating AI (the “AI Regulations”)

The G7 nations have progressed the Hiroshima AI Process Comprehensive Policy Framework, which consists of four pillars: 

(i) the International Guiding Principles for Organizations Developing Advanced AI Systems (the "Guiding Principles");1

(ii) the International Code of Conduct for Organizations Developing Advanced AI Systems (the "Code of Conduct")2 designed to supplement the Guiding Principles and provide voluntary guidance to organizations developing Advanced AI systems; 

(iii) analysis of priority risks, challenges and opportunities of generative AI; and 

(iv) project-based cooperation in support of the development of responsible AI tools and best practices.
Neither the Guiding Principles nor the Code of Conduct are legally binding, yet both pieces of guidance will likely exert strong political influence internationally. 
 

Status of the AI Regulations 

The G7 lacks the ability to pass laws regarding AI or its implementation. Nevertheless, the G7's AI Regulations do specify that its members must abide by their obligations under international human rights law, while private sector activities should be in line with international frameworks such as the United Nations Guiding Principles on Business and Human Rights and the OECD Guidelines of Multinational Enterprises.

The Guiding Principles were proposed in draft form on October 30, 2023 and are expected to be regularly reviewed and updated. This will involve multiple consultations before the Guiding Principles are finalized.

The International Code of Conduct also remains in draft form as proposed on October 30, 2023. Timing of the consultation and finalization process remains uncertain.3

Other laws affecting AI

The G7's Guiding Principles and Code of Conduct build on existing OECD AI Principles and are intended to inform and spearhead the national regulatory regimes implemented by the G7 nations as part of a fit-for-purpose global governance charter on AI.

In addition, there are various laws and frameworks that do not directly seek to regulate AI, but may affect the development or use of AI in the G7. For example:

  • International human rights law continues to apply to the G7 states to ensure that human rights are fully respected and protected
  • Private sector activities of all AI actors should comply with international frameworks such as the United Nations Guiding Principles on Business and Human Rights and the OECD Guidelines for Multinational Enterprises

Definition of “AI”

The Guiding Principles and Code of Conduct do not establish an independent definition of "AI." Instead, both pieces of guidance build on the OECD AI Principles that adopt the following definitions:4

  • "AI system" means "a machine-based system that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments. Different AI systems vary in their levels of autonomy and adaptiveness after deployment."
  • "AI actors" means "those who play an active role in the AI system lifecycle, including organizations and individuals that deploy or operate AI."
  • "AI system lifecycle" involves the following phases: "i) ‘design, data and models,' which is a context-dependent sequence encompassing planning and design, data collection and processing, as well as model building; ii) ‘verification and validation,' iii) ‘deployment,' and iv) ‘operation and monitoring.' These phases often take place in an iterative manner and are not necessarily sequential. The decision to retire an AI system from operation may occur at any point during the operation and monitoring phase."

The Code of Conduct and the Guiding Principles additionally define the following term:

  • "Advanced AI systems" to mean "the most advanced foundation models and generative AI systems."

Territorial scope

The Guiding Principles and Code of Conduct do not territorially confine the concepts of AI actors or Advanced AI systems. The G7 members, namely Canada, France, Germany, Italy, Japan, the UK, the US, and the EU have called on AI actors in their respective states to follow the Guiding Principles and have called on organizations to follow the Code of Conduct in line with a risk-based approach while national governments develop more detailed governance and regulatory regimes. 

Sectoral scope 

The Guiding Principles and Code of Conduct are not sector-specific. 

The Guiding Principles apply to all AI actors (i.e., including both individuals and organizations) involved in the design, development, deployment and use of Advanced AI systems.

The Code of Conduct applies to all organizations that are developing Advanced AI systems.

Such organizations may include entities from academia, civil society, the private sector and the public sector.5

Compliance roles

Organizations involved in the design, development, deployment and use of Advanced AI Systems are expected to abide by the G7's AI Regulations. All AI actors should also comply with the Guiding Principles.

Core issues that the AI Regulations seek to address

The G7's AI Regulations seek to promote safe, secure, and trustworthy AI worldwide and provide practical guidance for organizations developing and using foundation models and generative AI systems. The G7's AI Regulations actively seek to prevent organizations from developing or deploying Advanced AI systems that are considered "not acceptable" – namely Advanced AI systems that undermine democratic values, are particularly harmful to individuals or communities, facilitate terrorism, enable criminal misuse, or pose substantial risks to safety, security, and human rights.6

Risk categorization

AI is not explicitly categorized according to risk in the G7's AI Regulations. However, the Code of Conduct highlights various risks that should be particularly considered by organizations (as discussed in the section below).

Key compliance requirements 

The G7's AI Regulations set out the following 11 Guiding Principles and supplementary guidance:

  • Risk identification and mitigation: Take appropriate measures throughout the development of Advanced AI systems, including prior to and throughout their deployment and placement on the market, to identify, evaluate, and mitigate risks across the AI lifecycle.  Testing should take place before deployment and before placement on the market, and should continue throughout the AI lifecycle.8
  • Monitoring for risks and vulnerabilities: Organizations should monitor AI systems for vulnerabilities, incidents, emerging risks, and misuse after deployment, and take appropriate action to address these.9  This includes, for example, facilitating third-party and user discovery and reporting of issues and vulnerabilities after deployment such as through bounty systems, contests, or prizes to incentivize the responsible disclosure of weaknesses. Appropriate documentation should be maintained, and reports on vulnerabilities should be accessible to a diverse set of stakeholders.10
  • Accountability: Organizations should publicly report Advanced AI systems' capabilities, limitations and domains of appropriate and inappropriate use, to support ensuring sufficient transparency, with the aim of increasing accountability. This should include publishing transparency reports  containing meaningful information for all new significant releases of Advanced AI systems.12
  • Information sharing: Organizations should work towards responsible information sharing and reporting of incidents.13 Organizations should establish or join mechanisms to develop, advance, and adopt, where appropriate, shared standards, tools, mechanisms, and best practices across the AI lifecycle for ensuring the safety, security, and trustworthiness of Advanced AI systems.14
  • AI governance: Organizations should develop, implement and disclose AI governance and risk management policies, grounded in a risk-based approach – including privacy policies, and mitigation measures, in particular for organizations developing Advanced AI systems.15  This includes disclosing any appropriate privacy policies, including for personal data, user prompts and Advanced AI system outputs.16
  • Security: Organizations should invest in and implement robust security controls, including physical security, cybersecurity and insider threat safeguards across the AI lifecycle. These controls may include securing model weights and algorithms, servers, and datasets such as through operational security measures for information security and appropriate cyber/physical access controls.17  Organizations should also look to establish a robust insider threat detection program.18
  • Authentication and provenance: Organizations should develop and deploy reliable content authentication and provenance mechanisms such as watermarking or other techniques to enable users to identify AI-generated content. Organizations should also develop tools or APIs to allow users to determine if particular content was created with their Advanced AI system, as well as other mechanisms such as labelling or disclaimers to enable users, where possible and appropriate, to know when they are interacting with an AI system.19 The provenance data need not identify individual users. Content authentication mechanisms should be developed by organizations only where technically feasible and appropriate.20
  • Research and development: Organizations should prioritize research to mitigate societal, safety and security risks and prioritize investment in effective mitigation tools.21 Organizations should prioritize research on key areas such as upholding democratic values, respecting human rights, protecting children and vulnerable groups, safeguarding intellectual property rights and privacy, and avoiding harmful bias, misinformation and disinformation, and information manipulation.22
  •  Focus on challenges: Organizations should prioritize the development of Advanced AI systems to address global challenges such as climate change, global health and education. These efforts are undertaken in support of progress on the United Nations Sustainable Development Goals, and to encourage AI development for global benefit.23 Organizations should prioritize responsible stewardship of trustworthy and human-centric AI and also support digital literacy initiatives that promote the education and training of the public, including students and workers.24 
  • Development of standards: Organizations should advance the development and adoption of international technical standards and best practices.25 In particular, organizations are encouraged to work to develop interoperable international technical standards and frameworks to help users distinguish content generated by AI from non-AI generated content.26
  • Data protection and IP: Organizations should implement appropriate protections for personal data and intellectual property, as well as transparency of training datasets.27 Appropriate measures could include transparency, privacy-preserving training techniques, and/or testing and fine-tuning to ensure that systems do not divulge confidential or sensitive data.28

Regulators

The G7 intends to develop, in consultation with the OECD and other stakeholders, monitoring tools and mechanisms to help AI actors "stay accountable" in their compliance with the Guiding Principles and Code of Conduct.29 This suggests that the G7's AI Regulations will therefore be "self-regulated" by the organizations and/or individuals to which they apply, but the position is not settled.

The G7's AI Regulations do not otherwise stipulate how the G7 nations should regulate the implementation of the Guiding Principles in their own jurisdictions. 

Enforcement powers and penalties

As the G7's AI Regulations are not legally binding, they do not confer enforcement powers or give rise to any penalties for non-compliance. The G7 therefore relies on its members to implement the relevant Guiding Principles and give effect to the Code of Conduct. Notably, the Guiding Principles and Code of Conduct state that each G7 state has considerable discretion to implement the relevant AI Regulation uniquely in different ways and as each sees fit.30

1 https://digital-strategy.ec.europa.eu/en/library/hiroshima-process-international-guiding-principles-advanced-ai-system
https://digital-strategy.ec.europa.eu/en/library/hiroshima-process-international-code-conduct-advanced-ai-systems
3 See the
G7 Leaders' Statement.
4 Please see the
OECD's AI Principles.
5 See the
Guiding Principles (draft), page 1, paragraph 1.
6 See the
Guiding Principles (draft), page 2, paragraph 1.
7 This includes testing measures such as "red-teaming" and traceability in relation to datasets, processes and decisions. See the
Guiding Principles (draft), page 2, Principle 1.
8 See the
Code of Conduct (draft), pages 2-3, Code 1. Relevant risks include: (i) chemical, biological, radiological and nuclear risks; (ii) offensive cyber capabilities; (iii) risks to health and/or safety; (iv) risks from models "self-replicating" themselves or training other models; (v) societal risks; (vi) threats to democratic values and human rights; and (vii) risks of creating a chain reaction.
9 See the
Guiding Principles (draft), page 2, Principle 2.
10 See the
Code of Conduct (draft), page 4, Code 2.
11 See the
Code of Conduct (draft), page 4, Code 3. Transparency reports should include, for example: (i) details of the evaluations conducted for potential safety, security and societal risks; (ii) capacities of the model/system and significant limitations in performance that have implications for the domains of appropriate use; (iii) assessment of the AI system's effects and risks, such as harmful bias, discrimination and threats to the protection of privacy or personal data; and (iv) the results of "red-teaming."
12 See the
Guiding Principles (draft), page 3, Principle 3. 
13 See the
Guiding Principles (draft), page 3, Principle 4.
14 See the
Code of Conduct (draft), page 5, Code 4.
15 See the
Guiding Principles (draft), page 3, Principle 5.
16 See the
Code of Conduct (draft), pages 5-6, Code 5.
17 See the
Guiding Principles (draft), pages 4, Principle 6.
18 See the
Code of Conduct (draft), page 6, Code 6.
19 See the
Guiding Principles (draft), page 4, Principle 7.
20 See the
Code of Conduct (draft), pages 6-7, Code 7.
21 See the
Guiding Principles (draft), page 4, Principle 8.
22 See the
Code of Conduct (draft), page 7, Code 8.
23 See the
Guiding Principles (draft), pages 4-5, Principle 9.
24 See the
Code of Conduct (draft), pages 7-8, Code 9.
25 See the
Guiding Principles (draft), page 5, Principle 10.
26 See the
Code of Conduct (draft), page 8, Code 10.
27 See the
Guiding Principles (draft), page 5, Principle 11.
28 See the
Code of Conduct (draft), page 8, Code 11.
29 See the
Guiding Principles (draft), page 1, paragraph 6 and the Code of Conduct (draft), Page 1.
30 See the
Guiding Principles (draft), page 1, paragraph 5 and the Code of Conduct (draft), Page 1.

White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.

This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.

© 2024 White & Case LLP

Daniel Mair (Trainee Solicitor, White & Case, Paris) contributed to this publication.

Top