AI Regulation Tracker / Regional hub

Asia-Pacific AI Regulation Tracker

The AI laws, rules and enforcement across Asia-Pacific that change what a professional must do, organized by country. We update this as new rules land.

Maintained by The Leveraged Years Regulatory Research · Last updated July 14, 2026

China

GB 44721-2026, a mandatory safety standard for L3 and L4 automated drivingApproved 30 July 2026, effective 1 July 2027 with a reported one year transition. Covers M and N category vehicles carrying L3 and L4 systems and excludes automatic parking. Mandatory, so non-conforming products may not be produced or sold.
China drafts consent rules for training models on in-car voice dataNot binding and not final. A TC260 practice guide, out for comment to 3 September 2026, that would ask for separate user consent before in-car dialogue records train models.
China names a robotics company lead drafting unit on one of five AI-security standardsNot binding. Five TC260 WG9 notices recruit drafting-participant units for AI-security national standards. No draft text was published, and participation requires existing WG9 membership.
FMA thematic review: Artificial intelligence in financial advice, engagement overview published 6 August 2026Not binding. This is an exploratory fact-finding review conducted through four voluntary surveys. It creates no new obligation for financial advice providers and states no supervisory expect
Principle Code on the protection of intellectual property and transparency for the appropriate use of generatiNot binding. The document states in terms that it is not a norm with legal binding force and does not compel disclosure of sensitive information. It operates by comply-or-explain, and it is
AI Robotics Safety Evaluation Perspectives Guide v1.0, AI Safety Institute (Japan), Business Demonstration WorNot binding. This is a guide published by a working group of Japan's AI Safety Institute, not a regulation and not a standard. The guide says in its own text that it does not guarantee safet
Request on strengthening measures against impostor scam advertising on SNS and similar platforms, joint documeNot binding. Footnote 2 of the request states that it constitutes administrative guidance under Article 2(6) of the Administrative Procedure Act (Act No. 88 of 1993) and does not constitute
Guideline on Article 26 of the Act on Dealing with Infringement of Rights and Similar Harms Arising from the DThe guideline itself is interpretive guidance, not a statute, and it does not create a new offence. What it does is add two categories to the worked examples of illegal information under Art
Reiwa 8 Report on the Present State of Information and Communications (2026 Information and Communications WhiNot binding. This is an annual report to the public on the state of information and communications, the 54th edition since 1973. It contains no rules, no deadlines and no obligations. Its va
Regulations on Personal Information Protection by Large Personal Information Processors (draft for comment), CNot binding. This is a draft circulated for public comment, and the effective-date clause in Article 50 is still blank. Nobody is obliged to do anything under it yet.
Interim results of the 2026 series of special actions on personal information protection, CAC, MIIT and MPSThis is a progress report, not an instrument. It creates no new obligation. What it does is tell you where three regulators have been looking during 2026 and where they say they are going ne
Cybersecurity Standards Practice Guide: AI Agent Interaction Security Requirements (draft for comment, v0.23-2Not binding, and the comment window has closed. A TC260 practice guide is a technical document offering standardisation guidance, not a national standard and not a regulation. This one is st
Cybersecurity Standards Practice Guide: AI Browser Security Practice Guide (draft for comment, v1.1-202607), dNot binding, and the comment period is over. A TC260 practice guide is a technical document, not a national standard and not a regulation, and this text is still a draft for comment.
Announcement of the Cyberspace Administration of China on the Release of the Eighteenth Batch of Deep SynthesiThis is a publication of filings already granted, not a new rule. It creates no obligation by itself. The underlying duty to file comes from Article 19 of the Provisions on the Administratio
Cybersecurity Code of Practice for Critical Information Infrastructure (CCoP 2026) and Cybersecurity Code of PThis is a press release announcing forthcoming instruments. Neither CCoP 2026 nor CCoP (Cloud) has been released. Nothing in the announcement binds anyone today; the binding force will come
Public Consultation on Digital Infrastructure Bill, MDDI and IMDA, 1 July 2026, with the draft Bill at Annex AA consultation on a draft Bill. It binds nobody. MDDI and IMDA state plainly that the document and the draft Bill are released only for consultation and do not represent the final legislatio
Permintaan Masukan Publik terhadap Konsep Laporan Tahunan Penyelenggaraan Bidang Kecerdasan Artifisial, BlockcThis is a public consultation on a draft form, not a regulation. The draft concept binds nobody. The underlying reporting obligation sits in PP 28/2025 and Permen Komdigi 15/2025, not in thi
Personal Information Protection Commission, 2026 Second-Half Work Plan (2026 haneetgi eopmu gyehoek), reportedA work plan reported to the President. It binds nobody and creates no obligation on its own. The one hard date in it comes from a law already amended in March 2026: punitive fines take effec
Personal Data Protection Circular No. 01/2026, Data Protection Authority of Sri Lanka, ref DPA/Legal/01/02An administrative circular from the Data Protection Authority to public sector heads. It creates no obligation on its own; the obligations sit in the Personal Data Protection Act No. 9 of 20
Risks and controls for multi-agent systems, a report commissioned by the Australian AI Safety Institute from GA commissioned research report, not a rule or a standard. It binds nobody, imposes nothing and carries no deadline. Its output is an analytical framework and a catalogue.
Facial recognition technology: a guide to assessing the privacy risks (OAIC), updated 29 July 2026Updated regulatory guidance, not a rule change. The Privacy Act 1988 is unchanged. The guidance describes the OAIC's regulatory application of the law and now incorporates the Administrative
China drafts AI labelling and tracing duties into statuteA CAC draft statute of 60 articles would give AI detection, labelling and provenance-tracing duties statutory rank, with fines to RMB 2,000,000 and personal liability. It is a draft; comments close 28 August 2026.
TC260 drafts a national standard for grading AI application securityThe consultation would lift AI security grading from practice guide to full GB national standard.
Order No. 25 keeps automated decisions inside the audit scopeCAC and the Ministry of Public Security created a simplified PIPL track for small processors, but automated decision-making stays an express audit and assessment trigger.
China issues non-binding AI agent governance opinionsCAC, NDRC and MIIT Implementation Opinions on AI agents take effect July 15, 2026, as non-binding guidance.
China CAC publishes on-device GenAI filing, names AppleChina's CAC publishes an on-device generative AI filing batch citing the Interim Measures, with Apple Intelligence named.
China CAC logs 120 new GenAI filings, 988 cumulativeChina's CAC records 120 new filed generative AI services for May to June, 988 cumulative, under the Interim Measures.
China starts sector AI-security guidesTC260 opened calls on July 7, 2026 to draft AI-security guidance for China's finance, healthcare and broadcasting sectors.
Judiciary limits AI in judgmentsKeeping AI out of writing court judgments.
TC260 AI-agent security guideBaseline controls for deploying AI agents.
CAC internet rules add an AI chapterDraft measures propose dedicated AI duties.
China's rules for human-like AI companionsFiling, AI-nature disclosure and safeguards for companion and emotional chatbots, effective July 15.
China NFRA AI rules for financeThirty-two AI requirements for banks and insurers, with human oversight and a ban on customer data in model training.
China rewrites web rules, adds AI chapterChina reopened comment on rewritten Internet Information Services rules, adding a new Smart Information Services AI section across 94 articles.
China AI crackdown: 14,000 products disposedChina's CAC reported disposing over 14,000 AI products and removing millions of items while enforcing model filing, filtering and labeling duties.
China sets annual data-security risk assessmentsChina finalized the Network Data Security Risk Assessment Measures requiring important-data processors to assess yearly, in force August 20, 2026.
China sets 2027 mandatory driver-assistance AI safety ruleChina's MIIT set a 2027 mandatory safety standard for AI-driven driver-assistance and autonomous driving systems.

Taiwan

Taiwan FSC urges banks to prepare for frontier-AI attacksTaiwan's FSC tells banks to inventory critical systems and deploy defensive AI against frontier-AI attack risk.
Taiwan's AI Basic ActSeven principles; high-risk duties left to sector regulators.
FSC AI guidelines for financeLifecycle AI governance for banks, insurers and securities firms.
Banking AI standardA named senior officer must own the AI; disclose human-or-machine.
Insurer AI self-regulationExplainability and fair-treatment duties on underwriting and claims AI.
Robo-advisors into statutory rulesA higher capital floor and large fines for automated advice.
New data authority for AIAmended PDPA and an independent Personal Data Protection Commission.
TFDA rules for diagnostic AINew validation criteria for CADe and CADx medical devices.
Courts use AI, you must verifyAI output may not be the sole basis for a decision.
Draft AI-in-hiring rulesNotice, a final human decision and an explainable result.
Coming AI-content labeling dutyAn emerging duty to label AI output and disclose the bot.

Japan

Ministry of Justice drafts guidance on AI likeness and voice misuseA draft report reading existing tort, publicity and unfair-competition doctrine onto generative-AI likeness and voice. It binds nobody.
APPI amendment promulgated as Act No. 56, not yet in forceCommencement waits on a Cabinet Order due within two years, so this is a planning horizon rather than a compliance deadline.
AI Promotion ActNo fines, but a comply-or-explain disclosure and public-naming risk.
Phase II AI Basic Plan adoptedA non-binding national AI strategy under the AI Act.
AI Business Guidelines v1.2Governance for AI agents and physical AI.
FSA on AI adviceThe suitability and explanation duty survives autonomous AI advice.
Article 30-4 training limitsFree-to-train has real carve-outs for rights-holders.
Data bill: statistical-processing laneAn AI-training lane, with tighter profiling rules.
Japan APPI amendment enacted: sensitive data for AI without consentThe Diet passed the APPI revision on July 10, 2026, adding a narrow no-consent path to use sensitive personal data solely for AI development; enacted, not yet in force.
Bar's five AI rules for lawyersVerify output, protect confidentiality, watch Article 72.
Patent attorney AI warningPasting an invention into AI can breach confidentiality and novelty.
IDATEN for learning medical AIA pre-agreed change plan and post-market monitoring.
METI AI contract checklistA template to allocate AI liability, IP and indemnity.
DS-920 for government AIProcurement and use rules for generative AI in government.
Japan signals an AI-law rewriteA reorganized reform council will fundamentally review the laws governing AI, a policy direction not a bill.
Japan's AI Safety Guide Now Covers AI AgentsJapan's AI Safety Institute published v1.20 of its evaluation guide, adding an observation-and-control category for autonomous AI agents.
Japan enacts first privacy surcharge and AI carve-outJapan's Diet passed the APPI amendment, creating the first privacy surcharge and a consent exception for statistics and AI model development.
Japan's Top Court: AI Cannot Be a Patent InventorJapan's Supreme Court declined the DABUS appeal, finalizing that only a natural person can be a patent inventor while AI-assisted inventions stay patentable.
Japan METI issues AI civil liability guidanceJapan's METI issued guidance on civil liability allocation when AI systems cause harm.

South Korea

Korea passes a PIPA special provision for AI development, not yet in forcePassed the National Assembly on 20 August 2026. Not promulgated and not in force; it would commence six months after promulgation and operate case by case on PIPC resolution.
Decree 36506 requires a human-facing cue on AI labelsArticle 23(2) means embedded machine-readable metadata alone does not satisfy the generative-AI labelling duty.
PIPC fines TikTok and Apple over Siri transcriptsPIPC held that text transcripts derived from voice recordings needed their own lawful basis, separate from the audio.
Korea sets AI red-teaming and threat methodMSIT and KISA published South Korea's AI red-teaming guide and threat manual on July 7, 2026, voluntary but raising the audit floor for AI operators.
PIPC 3rd Basic PlanA conditional raw-data path for AI training.
Foreign AI firms name an agentLarge foreign providers must appoint a Korea-based representative.
AI-generated content labelsWatermark or metadata, plus a deepfake notice.
High-impact AI dutiesAI in loans, hiring and care owes an explanation and human oversight.
Draft financial-AI codeA named human would own every AI credit decision.
Automated-decision rightsPeople can refuse, and get an explanation and human re-review.
Generative-AI privacy rulebookWhen training on public data is legal, plus the DeepSeek order.
Generative-AI medical devicesAn approval pathway for generative-AI medical devices.
AI hiring as high-impactDisclose-and-justify, with a hiring-law amendment planned.
Court sanctions proposalCost-shifting and bar referral for AI-fabricated citations.
Election deepfake banA 90-day ban and AI-content labels outside it.
Korea opens raw data to AI trainingLawfully collected raw video, voice and image data could train AI, gated by a mandatory PIPC review.
Korea Extends AI Image-Matching Duty to PhotosFrom July 1, 2026 about 80 Korean platforms must auto-scan every uploaded image against a reference database and block matches, with sanctions from 2027.

Vietnam

Decision 29 requires portal AI to stay advisoryArticle 48 of the annexed Regulation requires AI output on the National Public Service Portal to remain reference and support only.
Law on AI: risk tiersClassify every system by risk; high-risk faces conformity certs.
Privacy law AI opt-outA right to object to automated decisions and profiling.
Decree 356 reworks privacyNew impact-assessment duties, a DPO role and transfer steps.
Draft AI banking rulesHuman review of challenged AI decisions; a 24-hour incident report.
Fintech AI sandboxAI credit scoring runs only inside a State Bank sandbox.
Decree 147: real names, takedownsReal-name verification and rapid takedowns.
Data Law export gateState approval before core data leaves the country.
Chatbot disclosure dutyYour support bot must let users know it is AI.
Generative-AI transparencyWatermark AI content and disclose training data.
Draft medical-data rulesAI use of patient data would need authorization.
Vietnam high-risk AI systems listDecision 33/2026 names which AI systems are legally high-risk across six sectors, in force August 15.
Vietnam Decree 142 AI Law rules liveThree-tier AI risk classification, content labelling and 72-hour incident reports are now in force.
Vietnam decree: label AI-made journalism from Jul 1Vietnam's Decree 237, in force July 1, 2026, requires licensed newsrooms to label AI-created or edited journalism that could confuse authenticity.

Indonesia

Court widens the DPO mandateAny single trigger now requires a data protection officer.
AI credit-scoring licensingA license, a capital floor, and data localization.
Draft AI-content labelingA coming platform duty to label AI content (not yet in force).
Draft hospital-AI oversightValidation before hospital algorithms are used.
Automated-decision and DPIAObject to solely-automated decisions; run a DPIA for high-risk AI.
OJK AI governance for banksA six-stage lifecycle benchmarked to the EU AI Act.
Privacy duties, no enforcer yetDuties are live but the data-protection agency does not exist.
Draft AI risk tiersEU-style tiers, framed as carrying no sanctions of their own.
ITE Law AI backstopThe instrument that governs AI content and deepfakes today.
P2P lending credit checksA stronger duty to assess credit and disclose funding risk.

Australia

eSafety advisory on AI deepfakes built from school imageryAn eSafety advisory sets out what the regulator can and cannot compel off a platform: altered intimate images draw enforceable removal notices, while non-sexual face swaps of adults may fall outside the criteria. It is guidance, not a statute.
APRA CPS 230 AI vendor riskCritical AI and cloud vendors are now material service providers.
NSW Law Society maps solicitor AI dutiesThe NSW Law Society guide maps solicitors' responsible AI use to existing professional conduct rules.
APRA keeps AI vendors in scopeFinal CPS 230 amendments decline to exempt IT and cloud providers.
ASIC on AI-assisted adviceAdvisers own any AI recommendation under the best-interests duty.
TGA on AI medical softwareAI does not create a new device class; full SaMD rules apply.
eSafety codes on AI nudify toolsAI image tools must block children or face civil penalties.
Fair Work Commission AI draftA draft duty to disclose and verify AI-prepared filings.
NSW algorithmic-management dutyA work-health duty for AI work allocation and surveillance.
No AI text-and-data-mining rightAustralia rules out a TDM exception; training stays a licensing question.
APRA minimum AI governance for financeMinimum AI governance expectations for banks, insurers and super funds, covering inventory and human oversight.
Australia launches Office of AI to drive national standardsAustralia stood up an Office of AI inside PM and Cabinet to coordinate national AI standards and assurance.
Australia signals AI consumer-safety prioritiesThe government says it will legislate a Digital Duty of Care and develop other workstreams. This is policy direction, not a new rule in force.

New Zealand

Biometric Privacy Code deadlineFacial-recognition users must meet the code by August 3, 2026.
FMA on AI in adviceConduct duties apply to AI, and a thematic review is planned.
Doctors own AI in careDoctors stay responsible for every AI-assisted clinical decision.

Singapore

Singapore MAS SAFR agentic-finance rulesA white paper sets runtime checkpoints to verify and log AI agent actions in finance, not binding.
Singapore PDPC: Privacy Duties for Generative AISingapore's PDPC draft advisory maps PDPA duties across generative-AI development, deployment and procurement, including provider-to-deployer safeguards.
MinLaw GenAI guide for legal workNonbinding Ministry guidance for Singapore legal work on professional judgment, confidentiality and context-specific transparency.

Hong Kong

Hong Kong PCPD personal-data AI sandboxA voluntary sandbox pilots free AI compliance guidance, starting with 15 schools.
Hong Kong SFC AI cyberattack circularLicensed firms must harden cybersecurity against AI-enabled attacks, with senior management accountable.
Hong Kong expands GenAI sandbox across four regulatorsHong Kong expanded its generative AI sandbox to cover four financial regulators for supervised deployment testing.

Malaysia

Malaysia opens consultation on its first AI governance billMalaysia's National AI Office opens a public consultation on a proposed horizontal AI Governance Bill.
Malaysia mandatory DPIA for AI decisionsA DPIA is now mandatory for automated decision-making and profiling above set data-subject thresholds.
Malaysia SC eyes board AI oversight for listed firmsSecurities Commission Malaysia proposes board oversight and listed-company disclosure of AI use and governance in a July 2026 consultation.

Thailand

Thailand draft AI Act strict liabilityA draft AI Act would add strict liability, extraterritorial reach and a required local agent for foreign vendors.

India

Delhi High Court refuses to injunct OpenAI's training on a news agency's contentA single judge dismissed ANI's interim injunction application, holding on a prima facie view that storage for LLM training falls within section 52(1)(a) fair dealing. The court also found the outputs were not substantially similar and that memorisation was not proved. Paragraph 274 disclaims any bearing on the final outcome.
CDSCO finalises medical device software guidance, keeping the filing step for AI updatesCDSCO's final Medical Device Software guidance formalises an Algorithm Change Protocol for AI, but a major change still needs licensing-authority approval and a minor change still needs notification. Models trained outside India now need a documented justification of applicability to Indian clinical environments.
RBI draft model-risk AI kill switchDraft guidance would put every bank and NBFC AI model under one board framework with kill switches and human override.
India's Top Court: Fake AI Cases Void a RulingIndia's Supreme Court set aside orders built on AI-hallucinated precedents and held that citing unverified AI case law is advocate misconduct.
Supreme Court draft rules for AI in courtsBars AI-only outcomes; disclosure duty on filings.
Delhi HC: 72-Hour AI-Deepfake Takedown OrderThe Delhi High Court restrained AI and deepfake persona misuse and set 3-day registrar and 72-hour platform takedown clocks.
India IT Rules: Mandatory Labels for AI-Generated ContentIndia's amended IT Rules require AI-generated content to carry permanent provenance metadata and make large platforms verify user AI declarations.

Philippines

Philippines BSP STARS AI governanceVoluntary AI governance for banks and fintechs built around five STARS principles.
BSP: drop passwords for privileged bank accessBSP Memorandum M-2026-034 tells supervised banks to drop passwords and SMS codes for privileged access and move to FIDO2 hardware keys.
Supreme Court adopts AI Judiciary FrameworkThe framework sets scoped AI disclosure for Judiciary documents and transparency requirements for Judiciary procurement vendors.

Pakistan

Pakistan data-governance policy on AIGovernment AI faces human review, explainability and registration duties under the national policy.

Kazakhstan

Kazakhstan: human review for automated decisionsKazakhstan's Digital Code gives a right to notice, explanation and human review of automated decisions from July 11, 2026.

Uzbekistan

Decree PF-141 writes AI into the Digital Uzbekistan 2030 StrategyIt orders state bodies to draft AI ethics rules and state standards on a quarterly clock. It does not itself bind private developers.
Uzbekistan bars AI-only rights and health callsUzbekistan's AI Ethical Rules, in force June 17, 2026, bar AI-only decisions on legal rights and healthcare under eight principles.

Sri Lanka

Sri Lanka fixes 1 January 2027 for the core of its data protection actGazette Extraordinary 2498/16 appoints 1 January 2027 for Section 2, Section 3, Part I and Part III of the PDPA, carrying the extraterritorial scope clause and the Section 24 profiling impact assessment duty.

Bangladesh

Bangladesh publishes a draft National AI Policy for consultationDraft v2 of the National AI Policy 2026-2030, dated 9 February 2026, was published for public consultation. A policy instrument, not legislation.

Mongolia

Mongolia bill would require labelling of AI-generated contentA bill submitted to the State Great Khural would mandate AI content labelling, with enforcement assigned to the Communications Regulatory Commission. A draft, not law.

International

IMDRF closes consultation on global AI device frameworkIMDRF closed consultation on a global lifecycle framework for AI-enabled medical devices.