AI Regulation Tracker / Guidance

Israel Tells Public Bodies to Risk-Rate AI on a Traffic Light Before They Buy or Build It

Regulatory summary: Israel's Guide for Responsible AI Use in the Public Sector, version 1.0, was published on May 19, 2026 by the Israel National Digital Agency together with the Ministry of Justice and the Ministry of Innovation, Science and Technology. It directs public bodies to stand up internal AI governance (a named.

Israel's National Digital Agency, with the Ministry of Justice and the Ministry of Innovation, Science and Technology, published version 1.0 of a guide requiring government organizations to run internal governance and risk assessment before procuring, developing, or deploying AI, sort each use into a traffic-light risk tier, and route limited experiments through a supervised blue track. It is best-practice guidance, not statute.

Primary source

By Anthony Guerriero, Founder, The Leveraged Years · Reviewed by The Leveraged Years Editorial Desk · Published July 9, 2026 · Last updated July 9, 2026

Israel Tells Public Bodies to Risk-Rate AI on a Traffic Light Before They Buy or Build It regulation briefing

The Leveraged Years AI Regulation Tracker

Key takeaways

Israel moved from principles-level AI policy to a concrete operating manual for government. Public bodies are now told to build an internal governance structure with defined roles, to run a structured risk assessment before adopting an AI tool, to classify each use on a traffic-light scale that governs how it is approved and monitored, and to confine early experimentation to a supervised blue track. Version 1.0 formalizes and updates the framework that the National Digital Agency first put out for public consultation in draft in 2025.
Public-sector CIOs, chief data officers, and digital-transformation leads in Israeli government bodies; govtech and AI vendors selling into Israeli government; procurement officials; and privacy and public-law counsel advising on automated decisions and the interaction with Amendment 13 and the Privacy Protection Authority's draft AI guidance.
Status: Version 1.
If you supply or run AI for an Israeli public body, assemble the documentation the guide points to now: a risk assessment for each use case, a mapped traffic-light classification, a named governance owner, and a plan to run any pilot inside the blue track. Align the same package with Amendment 13 and the Privacy Protection Authority's draft AI privacy guidance.

Regulatory Briefing

Bindingness: Best-practice guidance, not statute or binding regulation. The document is issued as an operational guide for the public sector, so it sets expectations and a recommended method rather than legal duties enforced by fines. Its force comes from adoption inside government procurement and governance, and from the privacy law it sits beside, not from any penalty in the guide itself. Do not describe it as a law or as an in-force regulation.
Scope: Israeli public-sector organizations and their employees when they procure, develop, deploy, or use AI tools. It reaches senior management, a designated AI governance officer, business process managers, and end users inside government bodies, and through procurement it reaches vendors that supply AI systems to those bodies. It does not by its own terms bind the private sector.
What Changed: Israel moved from principles-level AI policy to a concrete operating manual for government. Public bodies are now told to build an internal governance structure with defined roles, to run a structured risk assessment before adopting an AI tool, to classify each use on a traffic-light scale that governs how it is approved and monitored, and to confine early experimentation to a supervised blue track. Version 1.0 formalizes and updates the framework that the National Digital Agency first put out for public consultation in draft in 2025.
Who This Affects: Public-sector CIOs, chief data officers, and digital-transformation leads in Israeli government bodies; govtech and AI vendors selling into Israeli government; procurement officials; and privacy and public-law counsel advising on automated decisions and the interaction with Amendment 13 and the Privacy Protection Authority's draft AI guidance.
Current Status: Version 1.0 published May 19, 2026. It is live guidance, but as best practice rather than enforceable regulation. A public consultation draft preceded it.
Effective Date: Applies as guidance from publication on May 19, 2026. There is no separate commencement or enforcement date, because the document is not a statute.
Primary Source: Israel National Digital Agency landing page, https://www.gov.il/en/pages/ai-guide (the gov.il site blocks automated fetching, so the page could not be machine-read; it is the government's own English landing page for the guide). The gov.il-hosted official English translation of the earlier public consultation draft, published by the National Digital Agency, is available at https://www.gov.il/BlobFolder/news/ai-guide/en/Responsible%20AI%20Guide%20-%20public%20consultation%20draft.pdf and confirms the governance-roles, risk-classification, and risk-assessment structure.
Secondary Analysis: Arnon, Tadmor-Levy, Quarterly AI Update Q2 2026 (arnontl.com), and Lexology's republication of the same update, both dated Q2 2026, report the May 19, 2026 publication of version 1.0, the traffic-light approval system, and the supervised blue track for experimentation.
Workflow Impact: Government AI adoption now runs through a defined pipeline. Before a tool is bought or built, the body is expected to assign an AI governance officer, run and document a risk assessment, assign the use a traffic-light tier that dictates the controls and approvals it needs, and keep early trials inside the blue track. Vendors should expect these artifacts to be requested during procurement.
Operational Next Step: If you supply or run AI for an Israeli public body, assemble the documentation the guide points to now: a risk assessment for each use case, a mapped traffic-light classification, a named governance owner, and a plan to run any pilot inside the blue track. Align the same package with Amendment 13 and the Privacy Protection Authority's draft AI privacy guidance.
Last Verified: July 10, 2026

Date	Jurisdiction	Rule	Affected professionals	Status or effective date
2026-07-09	Israel	Israel moved from principles-level AI policy to a concrete operating manual for government. Public bodies are now told to build an internal governance structure with defined roles, to run a structured risk assessment before adopting an AI tool, to classify each use on a traffic-light scale that governs how it is approved and monitored, and to confine early experimentation to a supervised blue track. Version 1.0 formalizes and updates the framework that the National Digital Agency first put out for public consultation in draft in 2025.	Public-sector CIOs, chief data officers, and digital-transformation leads in Israeli government bodies; govtech and AI vendors selling into Israeli government; procurement officials; and privacy and public-law counsel advising on automated decisions and the interaction with Amendment 13 and the Privacy Protection Authority's draft AI guidance.	Version 1.0 published May 19, 2026. It is live guidance, but as best practice rather than enforceable regulation. A public consultation draft preceded it.

Source File

Instrument: Guide for Responsible AI Use in the Public Sector, version 1.0
Authority: Israel National Digital Agency, with the Ministry of Justice and the Ministry of Innovation, Science and Technology
Date: Version 1.0 published May 19, 2026; preceded by a 2025 public consultation draft
Citation: Guide for Responsible AI Use in the Public Sector, v1.0, Israel National Digital Agency (2026)
Primary Source: https://www.gov.il/en/pages/ai-guide (government English landing page; gov.il blocks automated fetch, so it was not machine-readable; the gov.il-hosted English translation of the earlier consultation draft, https://www.gov.il/BlobFolder/news/ai-guide/en/Responsible%20AI%20Guide%20-%20public%20consultation%20draft.pdf, confirms the governance-roles, risk-classification, and risk-assessment structure)
Corroboration: Arnon, Tadmor-Levy, Quarterly AI Update Q2 2026 (arnontl.com), and its Lexology republication, reporting the May 19, 2026 publication of version 1.0, the traffic-light approval system, and the supervised blue track.

Frequently Asked Questions

Is Israel's Guide for Responsible AI Use in the Public Sector a law?

No. It is best-practice guidance published by the National Digital Agency with the Ministry of Justice and the Ministry of Innovation, Science and Technology. It is not a statute and has no penalties of its own. Its binding neighbors are Amendment 13 to the Privacy Protection Law and the Privacy Protection Authority's draft AI privacy guidance.

When was version 1.0 published, and did anything come before it?

Version 1.0 was published on May 19, 2026. It follows an earlier public consultation draft that the National Digital Agency circulated in 2025, which set out the same governance roles and risk-classification method.

What is the traffic-light system?

It is a risk-based approval scheme. Each AI use is classified by risk level, and the tier determines how it is approved, what controls attach, and how it is monitored. Higher tiers inherit the controls of the lower ones and require more oversight.

What is the blue track?

It is a supervised channel for limited AI experimentation. It lets public bodies test tools under controlled conditions without moving them straight into full production or the full weight of standard approval.

Who does the guide apply to?

Israeli public-sector organizations and their employees when they procure, develop, deploy, or use AI, including senior management, a designated AI governance officer, business process managers, and end users. Through procurement it also reaches vendors that supply AI to those bodies. It does not by its own terms bind the private sector.