AI Regulatory Applicability Register: [Organisation]
Register that records which AI laws apply to which of your AI systems
and models, in which role, with the triggers, obligations, deadlines,
owners, status and evidence for each, plus a horizon-scanning process
and a change log. It has one section per law: the EU AI Act
(Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744),
the Korean Framework Act on AI (in force 22 January 2026), Colorado
SB 26-189 (replacing SB 24-205, obligations from 1 January 2027),
California SB 53 and other California AI statutes, the New York
RAISE Act as amended (effective 1 January 2027), Chinese generative
AI and labelling rules, the Texas Responsible Artificial Intelligence
Governance Act and the Japanese AI Promotion Act. Facts are recorded
as of October 2026. Replace every [bracketed] value and every row
marked Example. Check each law's current official text before
relying on a date. This is a documentation format, not legal advice.
Document control
| Field | Value |
|---|
| Document ID | [AIREG-001] |
| Organisation | [Legal name, group entities covered] |
| Version | [0.1] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@ai-compliance-lead] |
| Approvers/reviewers | [@general-counsel], [@dpo], [@ai-governance-board] |
| Jurisdiction counsel | [EU: name], [Korea: name], [US: name], [China: name], [Japan: name] |
| Facts checked as of | YYYY-MM-DD |
| Last updated | YYYY-MM-DD |
| Review cycle | [Monthly horizon scan; quarterly full review] |
| Classification | [Confidential, legal privilege where applicable] |
| Related documents | [Legal register], [AI inventory], [AI use case intakes], [Launch reviews] |
Approvals
| Role | Name | Decision | Date |
|---|
| General counsel | [@name] | [Approve / Approve with conditions] | YYYY-MM-DD |
| AI governance board chair | [@name] | [Approve] | YYYY-MM-DD |
| Data protection officer | [@name] | [Reviewed] | YYYY-MM-DD |
Revision history
| Version | Date | Author | Change summary |
|---|
| 0.1 | YYYY-MM-DD | [@name] | First draft |
| 1.0 | YYYY-MM-DD | [@name] | Example: Approved by AI governance board |
| 1.1 | YYYY-MM-DD | [@name] | Example: Colorado section rewritten for SB 26-189 |
Contents
1. AI system and model inventory
| ID | System or model | Purpose | Our role | Markets and users | Decisions affected | Model facts | Owner |
|---|
| SYS-001 (Example) | Support assistant | Customer service chat | Provider (built on third-party GPAI) | EU, Korea, California, New York | None about individuals | Third-party model via API | [@product-lead] |
| SYS-002 (Example) | CV screening tool | Shortlist job applicants | Deployer (vendor tool) | EU, Colorado, Texas | Employment | Vendor model | [@hr-lead] |
| SYS-003 (Example) | Image generation feature | Users create images | Provider | EU, China, Korea, California | None | In-house fine-tune of open model | [@ml-lead] |
| MDL-001 (Example) | Foundation model | Offered by API | Provider of GPAI model | Global | n/a | Training compute [x] FLOP | [@research-lead] |
2. Applicability matrix
| System | EU AI Act | Korea | Colorado | California | New York | Texas | China | Japan |
|---|
| SYS-001 (Example) | A: Art. 50(1), 50(2) | A: notice and labelling | N: no consequential decision | N: SB 243 customer service exclusion (CA-004) | N: not a frontier developer | N | N: not offered in China | N: no binding duty |
| SYS-002 (Example) | A: Annex III employment, deployer | P: high-impact (hiring) | A: deployer of ADMT | N | N | A: check prohibited uses | N | N |
| SYS-003 (Example) | A: Art. 50(2) | A: labelling | N | A: AI Transparency Act if covered provider | N | N | A: labelling measures | N |
| MDL-001 (Example) | A: GPAI Art. 53; check Art. 51 | P: high-compute safety | N | P: SB 53 if above thresholds | P: RAISE | N | P | N |
Not applicable reasoning: [Example: Japan: the AI Promotion Act sets
duties for the State and asks businesses to cooperate with government
measures; no compliance obligation with penalties identified.]
3. European Union: AI Act
3.1 Key dates
| Date | What applies (summary) |
|---|
| 2 February 2025 | Prohibited practices (Art. 5) and AI literacy (Art. 4, reframed by Regulation (EU) 2026/1744) |
| 2 August 2025 | GPAI model obligations (Art. 53 to 55), governance, penalties framework |
| 2 August 2026 | Transparency obligations (Art. 50); Commission enforcement powers for GPAI |
| 2 December 2026 | Art. 50(2) marking for generative systems placed on the market before 2 August 2026 (Art. 111(4)); new prohibitions on AI generating non-consensual intimate content or child sexual abuse material (Art. 5(1)(ba) and (bb), Art. 113) |
| 2 August 2027 | GPAI models placed on the market before 2 August 2025 must comply |
| 2 December 2027 | High-risk obligations for Art. 6(2) and Annex III systems |
| 2 August 2028 | High-risk obligations for Art. 6(1) and Annex I systems |
3.2 Triggers and obligations
| ID | Trigger | Obligations (summary) | Articles | Systems | Deadline | Owner | Status | Evidence |
|---|
| EU-001 (Example) | Any role | Do not use prohibited practices | Art. 5 | All | In force | [@legal] | Compliant | Use case intake screening records |
| EU-002 (Example) | Provider or deployer | Take measures for staff AI literacy | Art. 4 | All | In force | [@hr-lead] | Compliant | Literacy plan |
| EU-003 (Example) | Interactive system, provider | Inform people they are dealing with AI | Art. 50(1) | SYS-001 | 2 August 2026 | [@product-lead] | Compliant | Transparency plan |
| EU-004 (Example) | Generative system, provider | Machine-readable marking | Art. 50(2) | SYS-003 | 2 August 2026 | [@ml-lead] | In progress | Transparency plan |
| EU-005 (Example) | Annex III point 4 employment, deployer | Deployer duties: use per instructions, oversight, logs, worker information | Art. 26 | SYS-002 | 2 December 2027 | [@hr-lead] | Planned | Gap analysis |
| EU-006 (Example) | GPAI model provider | Technical documentation, downstream information, copyright policy, training content summary | Art. 53 | MDL-001 | 2 August 2025 | [@research-lead] | Compliant | GPAI documentation |
| EU-007 (Example) | GPAI model with systemic risk | Evaluations, risk mitigation, incident reporting, cybersecurity | Art. 55 | MDL-001 if Art. 51 met | 2 August 2025 | [@frontier-safety] | Assessment open | Frontier safety framework |
Penalties (summary): up to 35 million EUR or 7% of worldwide turnover
for prohibited practices; up to 15 million EUR or 3% for most other
obligations; lower ceilings for SMEs and small mid-caps (check Art. 99
as amended).
4. Republic of Korea: Framework Act on AI
| ID | Trigger | Obligation (summary) | Systems | Deadline | Owner | Status | Evidence |
|---|
| KR-001 (Example) | Product or service using generative or high-impact AI | Notify users in advance that the service uses AI | SYS-001, SYS-003 | In force | [@product-lead] | Compliant | Notice screenshots |
| KR-002 (Example) | Generative AI outputs | Label outputs as AI-generated; clear notice for realistic synthetic sound, image or video | SYS-003 | In force | [@ml-lead] | Compliant | Transparency plan section 10 |
| KR-003 (Example) | AI above the compute level in the Enforcement Decree (reported as 10^26 FLOP cumulative training) | Risk identification and mitigation, safety incident monitoring, report results to MSIT | MDL-001 | In force | [@frontier-safety] | Not triggered | Compute record |
| KR-004 (Example) | Possible high-impact AI (for example hiring, credit, health, energy) | Check high-impact status before deployment; risk management, explanation, user protection, human oversight, documentation; efforts on impact assessment | SYS-002 | In force | [@hr-lead] | Analysis open | Assessment memo |
| KR-005 (Example) | Foreign operator above thresholds (revenue or daily users in the Enforcement Decree) without a Korean address | Designate a domestic representative and report it to MSIT | Group | In force | [@legal] | Compliant | Designation letter |
Enforcement: fines up to 30 million KRW for listed breaches such as
failing to give notice, failing to designate a representative or
breaching a corrective order; MSIT announced a grace period of at least
one year before fines are imposed. [Record the current MSIT position.]
5. United States: Colorado
| ID | Trigger | Obligation (summary) | Systems | Deadline | Owner | Status | Evidence |
|---|
| CO-001 (Example) | Developer of covered ADMT | Give deployers documentation on intended uses, training data categories, known limitations, appropriate use and human review; notify material updates; keep records at least 3 years | n/a (we are deployer) | 1 January 2027 | [@legal] | Not applicable | Role analysis |
| CO-002 (Example) | Deployer using ADMT in a consequential decision (education, employment, housing, financial or lending, insurance, health care, essential government services) | Clear notice at the point of interaction | SYS-002 | 1 January 2027 | [@hr-lead] | Planned | Draft notice |
| CO-003 (Example) | Adverse consequential decision | Plain-language description of the ADMT's role within 30 days; rights to access and correct personal data and to request human review and reconsideration | SYS-002 | 1 January 2027 | [@hr-lead] | Planned | Process design |
| CO-004 (Example) | Attorney General rules | Track rules due by 1 January 2027 on post-adverse-outcome disclosures | SYS-002 | Watch | [@legal] | Watching | Horizon scan |
Cure period: before 1 January 2030 the Attorney General gives 60 days'
notice and an opportunity to cure where a cure is possible.
6. United States: California
| ID | Law | Trigger | Obligation (summary) | Effective | Systems | Owner | Status | Evidence |
|---|
| CA-001 (Example) | SB 53, Transparency in Frontier Artificial Intelligence Act (Chapter 138, Statutes of 2025) | Frontier developer (more than 10^26 operations); large frontier developer (above 500 million USD revenue) | Publish frontier AI framework (large developers); transparency report at deployment; critical safety incidents to the Office of Emergency Services within 15 days (24 hours to an authority if imminent risk to life); whistleblower protections; penalties up to 1 million USD per violation | 1 January 2026 | MDL-001 | [@frontier-safety] | Threshold analysis | Frontier safety framework |
| CA-002 (Example) | AB 2013, generative AI training data transparency | Developer making generative AI available to Californians | Publish a high-level summary of training datasets | 1 January 2026 | MDL-001, SYS-003 | [@research-lead] | Compliant | Published summary |
| CA-003 (Example) | SB 942, California AI Transparency Act, as amended by AB 853 | Covered provider (generative AI with more than 1 million monthly users, publicly accessible in California) | Free AI detection tool; latent disclosures and optional manifest disclosures in image, video and audio | 2 August 2026 (as amended) | SYS-003 | [@ml-lead] | Analysis open | User count record |
| CA-004 (Example) | SB 243, companion chatbots | Operator of a companion chatbot platform | Disclose the chatbot is not human, suicide and self-harm protocols, reminders for minors; annual reporting from 1 July 2027 | 1 January 2026 | SYS-001 (customer service exclusion analysed) | [@legal] | Not applicable | Memo |
7. United States: New York
| ID | Trigger | Obligation (summary) | Systems | Deadline | Owner | Status | Evidence |
|---|
| NY-001 (Example) | Large frontier developer | Publish a frontier AI framework, review at least annually, publish material changes with justification within 30 days | MDL-001 | 1 January 2027 | [@frontier-safety] | Threshold analysis | Framework |
| NY-002 (Example) | Frontier developer | Report critical safety incidents within 72 hours of determination (24 hours to authorities if imminent risk of death or serious injury) | MDL-001 | 1 January 2027 | [@frontier-safety] | Planned | Incident runbook |
| NY-003 (Example) | Large frontier developer | Registration or disclosure statements to the oversight office as required; penalties up to 1 million USD for a first violation and 3 million USD for later ones, enforced by the Attorney General | MDL-001 | Per office guidance | [@legal] | Watching | Horizon scan |
8. United States: Texas
| ID | Trigger | Obligation (summary) | Systems | Deadline | Owner | Status | Evidence |
|---|
| TX-001 (Example) | Any developer or deployer in Texas | Do not develop or deploy AI for the prohibited purposes listed in the Act | All | 1 January 2026 | [@legal] | Compliant | Intake screening |
| TX-002 (Example) | Supplying AI to a Texas government entity | Support the entity's disclosure duties to consumers | [System] | 1 January 2026 | [@sales-lead] | Not applicable | Customer list |
9. China
| ID | Instrument | Obligation (summary) | Systems | Effective | Owner | Status | Evidence |
|---|
| CN-001 (Example) | Interim Measures for Generative AI Services | Lawful training data and IP respect, content management, user agreements, complaint handling, security assessment and algorithm filing where the service has public opinion or social mobilisation attributes | SYS-003 | 15 August 2023 | [@china-ops] | Filed | Filing number |
| CN-002 (Example) | Labelling Measures, Art. 4 and 5; GB 45438-2025 | Explicit labels people can perceive; implicit metadata labels with content attributes, provider name or code and content ID | SYS-003 | 1 September 2025 | [@ml-lead] | Compliant | Transparency plan section 9 |
| CN-003 (Example) | Labelling Measures, Art. 8 to 10 | Explain labelling in the user agreement; logs for unlabelled output requests kept at least six months; no removal or forgery of labels | SYS-003 | 1 September 2025 | [@legal] | Compliant | Terms of service |
| CN-004 (Example) | Labelling Measures, Art. 12 | Submit labelling materials with algorithm filing or security assessment | SYS-003 | 1 September 2025 | [@china-ops] | Compliant | Filing pack |
10. Japan
| ID | Instrument | Expectation (summary) | Systems | Owner | Status | Evidence |
|---|
| JP-001 (Example) | AI Promotion Act | Make efforts to use AI appropriately and cooperate with national measures, including government research and information requests | All Japan-facing | [@legal] | Monitoring | Horizon scan |
| JP-002 (Example) | AI Basic Plan and government AI guidelines | Voluntary alignment of governance practices | All Japan-facing | [@ai-governance] | Partially aligned | Gap note |
11. Horizon scanning
11.1 Sources and cadence
| Source | Jurisdiction | Frequency | Checked by |
|---|
| EUR-Lex consolidated AI Act; AI Office pages on digital-strategy.ec.europa.eu | EU | Weekly | [@eu-counsel] |
| National competent authority announcements in [Member States] | EU | Monthly | [@eu-counsel] |
| law.go.kr and MSIT notices on Enforcement Decree and guidelines | Korea | Monthly | [@kr-counsel] |
| leg.colorado.gov and Colorado Attorney General rulemaking | Colorado | Monthly | [@us-counsel] |
| leginfo.legislature.ca.gov, California OES and Attorney General | California | Monthly | [@us-counsel] |
| nysenate.gov and Department of Financial Services | New York | Monthly | [@us-counsel] |
| capitol.texas.gov and Texas Attorney General | Texas | Quarterly | [@us-counsel] |
| cac.gov.cn notices, national standards portal | China | Monthly | [@cn-counsel] |
| Cabinet Office AI Strategy Headquarters | Japan | Quarterly | [@jp-counsel] |
| Federal US developments affecting state AI laws | US | Monthly | [@us-counsel] |
11.2 Process
Each candidate change moves through the same steps, so nothing found
in a scan is lost between counsel and system owners.
11.3 Watch list
| ID | Item | Jurisdiction | Expected | Impact if adopted | Owner |
|---|
| WL-001 (Example) | Korea Enforcement Decree amendments and MSIT guidelines on high-impact AI | Korea | [Quarter] | Changes KR-004 scope | [@kr-counsel] |
| WL-002 (Example) | Colorado Attorney General rules under SB 26-189 | Colorado | Before 1 January 2027 | Defines CO-003 content | [@us-counsel] |
| WL-003 (Example) | AI Office templates and guidelines (high-risk, FRIA questionnaire) | EU | [Quarter] | Evidence formats | [@eu-counsel] |
| WL-004 (Example) | New York oversight office rules and registration | New York | [Quarter] | NY-003 | [@us-counsel] |
12. Change log
| Date | Change | Source | Impact on register | Action | Owner |
|---|
| 2026-03-27 (Example) | New York RAISE Act chapter amendment signed | nysenate.gov | NY rows aligned with SB 53 model; effective 1 January 2027 | Extend incident runbook | [@us-counsel] |
| 2026-05-14 (Example) | Colorado SB 26-189 signed, repealing and re-enacting SB 24-205 | leg.colorado.gov | CO rows rewritten; start date moved to 1 January 2027 | Redesign notices for SYS-002 | [@us-counsel] |
| 2026-07-24 (Example) | Regulation (EU) 2026/1744 published | EUR-Lex | High-risk dates moved; new prohibition; Art. 50(2) transitional date | Update EU-005 deadline | [@eu-counsel] |
13. Glossary and references
| Term | Meaning |
|---|
| Provider (EU) | Develops an AI system or GPAI model, or has it developed, and places it on the market or puts it into service under its own name |
| Deployer (EU, Colorado) | Uses an AI system or ADMT under its authority (EU) or in a consequential decision (Colorado) |
| ADMT | Automated decision-making technology, as defined in Colorado SB 26-189 |
| Consequential decision | Under Colorado law, a decision with a material effect on access to listed services such as employment or housing |
| High-impact AI | Under the Korean Act, AI in listed areas that may significantly affect life, safety or fundamental rights |
| Frontier developer | Under SB 53 and RAISE, a developer that trained a frontier model above the compute threshold |
References (check current versions):
- Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744
(eur-lex.europa.eu).
- Framework Act on the Development of Artificial Intelligence and the
Establishment of a Foundation for Trust (Republic of Korea), in force
22 January 2026 (law.go.kr).
- Colorado SB 26-189, Automated Decision-Making Technology (2026)
(leg.colorado.gov).
- California SB 53 (2025), AB 2013 (2024), SB 942 (2024) as amended by
AB 853 (2025), SB 243 (2025) (leginfo.legislature.ca.gov).
- New York RAISE Act (2025) and chapter amendment (2026)
(nysenate.gov).
- Texas HB 149 (2025), Texas Responsible Artificial Intelligence
Governance Act.
- Interim Measures for the Management of Generative AI Services (2023);
Measures for Labeling AI-Generated and Synthetic Content (2025);
GB 45438-2025 (cac.gov.cn).
- Act on the Promotion of Research, Development and Utilization of
AI-Related Technologies, Act No. 53 of 2025 (Japan).
- Related templates:
compliance/legal-register,
ai-data/ai-use-case-intake, ai-data/ai-content-transparency-plan,
ai-data/frontier-safety-framework, ai-data/ai-launch-review,
compliance/ai-vendor-risk-questionnaire.
Standard and licence note
Based on the public texts of the EU Artificial Intelligence Act
(Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744),
the Korean Framework Act on AI, Colorado SB 26-189, California SB 53,
AB 2013, SB 942 and SB 243, the New York RAISE Act as amended, Texas
HB 149, Chinese generative AI and labelling rules with GB 45438-2025,
and the Japanese AI Promotion Act, as checked in October 2026. All
obligations are paraphrased in original wording; no statutory text is
reproduced. Laws in this area change quickly: check each official
source for the binding wording, current dates and any court decisions
before relying on this register. This is a documentation format, not
legal advice. Template licence: MIT.