Short answer: as of September 2026, three comprehensive AI statutes are in force worldwide — the EU AI Act, South Korea's AI Framework Act, and Japan's AI Promotion Act. Brazil's bill is advanced. Canada's died in January 2025. Everything else regulating AI is sectoral, sub-national, or voluntary.
A comprehensive AI statute regulates AI horizontally. One instrument, every sector, applied by the nature of the technology rather than the industry using it. That is an unusual way to legislate and it explains why the list is so short: most legal systems prefer to regulate activities, not tools.
The EU AI Act
Regulation (EU) 2024/1689 entered into force on 1 August 2024 and is the reference point for every other regime.
Four risk tiers. Unacceptable risk practices are prohibited outright and have been since February 2025 — manipulation causing significant harm, exploitation of vulnerabilities, social scoring, untargeted facial scraping, emotion inference in workplaces and schools, and biometric categorisation inferring sensitive attributes. High risk systems are permitted subject to conformity assessment, a risk management system, data governance, technical documentation, logging, human oversight, accuracy and cybersecurity requirements, registration and post-market monitoring. Limited risk carries transparency duties only. Minimal risk is unregulated.
A parallel track governs general-purpose AI models, with heightened obligations where a model is designated as posing systemic risk.
The Act reaches beyond the EU. It applies to providers placing systems on the Union market regardless of establishment, and to providers and deployers outside the Union where the output is used inside it.
Its timeline was substantially amended in July 2026. Annex III high-risk obligations now apply from 2 December 2027 and Annex I embedded high-risk from 2 August 2028. Four other obligation sets were untouched and are enforceable today.
South Korea's AI Framework Act
Act No. 20676 came into force on 22 January 2026 with its Enforcement Decree, making Korea the first Asia-Pacific jurisdiction with a mandatory comprehensive AI law. It consolidated nineteen competing bills.
The structure will feel familiar to anyone who has read the EU Act, with three distinctive features.
High-impact AI
Defined by sector rather than by use case — healthcare, energy, employment, financial services, public safety and education among them. Systems in scope carry lifecycle risk management, impact assessment, human oversight and documentation duties.
High-performance AI
Defined by cumulative training compute exceeding 10²⁶ FLOPs, roughly ten times the EU's systemic-risk presumption. This is aimed squarely at frontier developers outside Korea.
Extraterritorial reach runs through user thresholds
Foreign operators above AI-service revenue of KRW 10 billion, or one million average daily domestic users over three months, must appoint a domestic representative in Korea. You can cross that line without a single employee in the country.
MSIT is the lead regulator. Administrative fines reach KRW 30 million, and MSIT is operating a grace period through 2026 deferring investigations and fines except where serious social harm is involved.
Japan's AI Promotion Act
Passed 28 May 2025, with most provisions in force from 4 June 2025.
This is the interesting one, because it is a statute that deliberately does not bind. No penalties. No enforceable private duties. It sets national objectives, creates coordination machinery under the Prime Minister, assigns roles across government, academia, industry and citizens, and directs support for research, compute, talent and public AI literacy.
Substantive expectations live elsewhere: the AI Guidelines for Business issued by METI and MIC, the AI Basic Plan, and sector-specific law. An expert investigation team has been working on what constitutes "high-impact" AI under the Act, and that definition will determine whether Japan's framework eventually acquires teeth.
Japan is the clearest example of a jurisdiction choosing promotion over restriction as a deliberate competitive strategy.
The near misses
Brazil
PL 2338/2023 passed the Senate in December 2024 and has been working through the Chamber of Deputies since. Revisions in August 2026 moved it closer to the EU model. It would introduce excessive-risk and high-risk categories, rights of explanation and contestation, and penalties up to 2% of Brazilian revenue capped at BRL 50 million.
Canada
The Artificial Intelligence and Data Act, Part 3 of Bill C-27, died on the order paper in January 2025 when Parliament was prorogued. No successor has been tabled. Canada now governs AI through the Treasury Board Directive on Automated Decision-Making, which binds federal institutions only, plus privacy law and a voluntary code.
The United States
No comprehensive federal AI statute exists and none appears imminent. Federal policy runs through executive orders and agency memoranda, and the substantive obligations sit at state level.
Why the list is so short
Horizontal regulation of a general-purpose technology is genuinely difficult. Definitions are unstable, the regulated population is every company rather than an identifiable industry, and existing regulators already have jurisdiction over most harms. The EU proceeded anyway because its product-safety legal architecture accommodates this approach. Most jurisdictions do not have that architecture and have reached for sectoral tools instead.
The practical consequence is that "is my company covered by an AI law?" is almost never answered at Tier 1.
It is answered at Tier 3 and Tier 4, which is where the next two instalments go.
Questions people ask
How many comprehensive AI laws are there?
Three in force worldwide as of September 2026: the EU AI Act, South Korea's AI Framework Act, and Japan's AI Promotion Act.
Does the EU AI Act apply to companies outside the EU?
Yes. It applies to providers placing AI systems on the EU market regardless of where they are established, and to providers and deployers elsewhere where the system's output is used in the Union.
Does Korea's AI law apply to foreign companies?
Yes, above thresholds of KRW 10 billion in AI-service revenue or one million average daily domestic users, at which point a domestic representative must be appointed.
Part 0: The eight kinds · Part 1: Comprehensive statutes · Part 2: The treaty nobody is watching · Part 3: Where the obligations actually are · Part 4: The regulators who were already there · Part 5: ISO/IEC 42001 · Part 6: NIST AI RMF · Part 7: Security taxonomies · Part 8: Principles · Part 9: Putting it together