AI governance landscape

Reference Map · 15 October 2026

AI governance shapes who can develop a capability, how it can be used, whose interests it serves and who can intervene when something goes wrong. Countries are making different choices across all four questions.

A safety commitment, an evaluation programme and a law can all be described as governance. They do different work. This map compares selected markets and international initiatives by asking who can act, over what activity, and with what authority? It also distinguishes an institution announced from a power exercised.

How to read the map

These approaches overlap. A government may promote national AI capability while restricting particular uses. Evaluation can support regulation without the evaluator holding enforcement powers.

Status key: Binding identifies an applicable legal duty, subject to its scope and commencement. Voluntary identifies a commitment rather than a new statutory obligation. Proposed means the powers have not been created by that proposal. Institutional identifies an established body or policy framework. Announced means a commitment has been made, without establishing that its mechanism is operating. A single jurisdiction can contain all five.

The first distinction to make is between requiring information, assessing it and requiring a response. An evaluator may discover a problem without having the power to stop the activity. A regulator may have powers but need evidence, technical capacity and cooperation to exercise them. A control on one release or use is also different from a general halt to development or adoption.

Find a jurisdiction or region

Europe and Russia · North America · South America · Asia · Australia and New Zealand · Africa · International cooperation

Why these entries?

The selection combines markets relevant to QURKI's readers with approaches that reveal different sources of authority. Development strategies matter because governments are also trying to secure capability and its benefits. Privacy enforcement matters because a country need not have a dedicated AI Act to intervene. International proposals matter because domestic powers do not settle what happens across borders.

No country stands for an entire continent. This is a comparison of selected instruments, not a complete global inventory or a ranking of their effectiveness.

Europe and Russia

European Union: model obligations and rules for uses

Binding · different duties and commencement dates

The AI Act reaches providers placing general-purpose AI models on the EU market and actors supplying or deploying covered systems. Model duties include documentation and, for systemic-risk models, evaluation, mitigation, incident reporting and cybersecurity. Commission powers include information requests, evaluations, corrective measures and fines.¹

Practical distinction: Model obligations and application-specific rules are separate. GPAI rules applied from August 2025, with enforcement from August 2026 and existing-model transitions. Prohibitions and literacy requirements began in February 2025. The current Commission timeline places Annex III high-risk duties in December 2027 and regulated-product duties in August 2028; these future duties must not be presented as already universal.²

United Kingdom: existing regulators, independent testing and proposed wider oversight

Existing law · evaluation capacity · parliamentary and international proposals

The Joint Committee on Human Rights, drawn from both Houses of Parliament, published Human Rights and the Regulation of AI on 14 September 2026. It calls for an AI Bill, independent oversight and proportionate duties across the lifecycle. Its proposals include investigation and testing, sanctions, and powers to prevent launch or require withdrawal in relevant cases.³

At the UN on 22 September, Prime Minister Andy Burnham proposed using the UK’s 2027 G20 presidency to pursue common principles and standards for transparency, access and safe development. On 12 October, the government reported working with laboratories and the US government to retain prerelease access for the AI Security Institute, whose scientists were evaluating the latest models. It also announced work on agentic-AI incident response and verification.⁴⁵

Power and limit: Existing regulators act under their existing remits. The Committee recommends powers; it does not enact them. The Institute supplies independent technical scrutiny, while further legislation and international standards remain proposals. Government’s response to the Committee is due in November 2026.³

Russia: presidential coordination of AI development

Institutional mandate · national strategic direction

A presidential commission established in February 2026 coordinates approaches to developing and deploying AI across federal authorities, the Bank of Russia, regional authorities and other participating organisations. Its remit includes analysing risks and threats and coordinating responses.⁶

Power and limit: This is a mechanism for organising state policy and institutions. The published mandate is not evidence of an independent model-safety regulator, universal release licensing or effective oversight of every deployment. It adds a different question to the comparison: how can government direct the capability it wants to build? Evidence here establishes institutional design; it does not independently verify outcomes.⁶

Compare: The EU specifies model and system obligations; the UK Committee proposes wider oversight; Russia’s commission coordinates national policy. A shared concern with AI risk does not make these institutions equivalent.

North America

United States: executive direction and voluntary frontier commitments

Executive direction · voluntary developer commitments · existing legal powers

The June 2026 executive order directs classified cyber-capability benchmarking and a voluntary framework for early federal access to covered frontier models, up to 30 days before release to other trusted partners. Section 3 expressly does not authorise mandatory model licensing or preclearance. It directs government work; it does not establish that every mechanism is operating.⁷

The 29 September White House Accord adds commitments from Anthropic, Google, Meta, OpenAI, xAI and NVIDIA. Its four layers are internal controls, an internal assurance team, external independent evaluation and oversight by an independent committee of each company's board. It also anticipates standards discussions and possible legislation.⁸

Power and limit: The accord can strengthen scrutiny without creating a public regulator. It specifies no common stopping threshold, requirement to publish audit findings or penalties for failing to implement its commitments. Company-board oversight is distinct from an independent public authority able to require a change. Existing statutory powers remain separate from the pledge.⁸

A separate September executive order directs federal use of “Super Intelligence” terminology, initially retaining the existing statutory definition of AI. Changing the name does not demonstrate a new capability or create a new technical threshold for intervention.⁹

Compare: Federal voluntary participation is not the whole US position. California imposes developer duties; government also uses procurement and national-security authorities. The June national-security memorandum, for example, directs safeguards against suppliers disabling or materially changing mission systems without government approval. Those directions concern government deployments, not a general civilian release licence.¹⁰

California: developer accountability and independent assurance

Binding developer duties · new assurance institutions

SB 53 reaches covered frontier developers through safety frameworks, transparency, incident reporting and whistleblower protections. Its deployment definition includes availability for modification and copying, so open-weight distribution can fall within scope.¹¹

Power and limit: Duties are backed by state enforcement. SB 813 and AB 1405, signed in September 2026, add an independent-verification framework and an auditor registry. Enactment does not establish that the registry is already operating. The instruments should not be described as requiring a universal release licence for all models.¹¹

Canada: privacy law, federal decision rules and voluntary commitments

Binding privacy law · mandatory federal rules · voluntary developer code

Applicable federal and provincial privacy law reaches organisations handling personal information. Under PIPEDA, the Privacy Commissioner investigates and recommends; specified Federal Court proceedings can lead to corrective orders and damages. Quebec’s private-sector rules also impose information duties for decisions based exclusively on automated processing.¹²

Separate mechanisms: Covered federal departments must meet the Directive on Automated Decision-Making, including impact assessment, transparency, monitoring and recourse. The directive can reach systems assisting human judgment; it is not a general duty on every business.¹³ Developers and managers may adopt the voluntary generative-AI code, which preserves existing legal obligations.¹⁴ AIDA in the 44th Parliament’s C-27 did not become law.¹⁵

Canada is also seeking stronger international coordination. Prime Minister Mark Carney signed the Finland/Norway-led Call for Control of Frontier AI Models and proposed a technology stability board modelled on the Financial Stability Board. On 13 October, Canada and the UK renewed cooperation on evaluation, information-sharing and technical standards.¹⁶¹⁷

Compare: Canada’s privacy law, mandatory public-sector directive, voluntary industry code and international proposals are separate instruments. The proposed board does not yet supply a further layer of regulatory authority.

South America

Brazil: privacy enforcement alongside a proposed AI framework

Binding data-protection law · AI framework still proposed

Brazil’s privacy regulator, ANPD, has exercised existing powers over AI training. In July 2024 it suspended Meta’s relevant personal-data processing; in August it permitted resumption under an approved compliance plan. This is evidence of an intervention and subsequent conditions, not an ongoing blanket ban.¹⁸

Power and limit: PL 2338/2023, passed by the Senate, remains before the Chamber of Deputies. Its proposed AI framework must not be confused with the existing data-protection powers used in the Meta episode.¹⁹ The practical control point demonstrated here is an organisation’s data processing; it does not establish the ability to retrieve released weights.

Compare: Brazil belongs alongside Canada and ANZ for existing-law enforcement, and alongside the UK’s proposed changes when discussing legislation under consideration. This Brazilian entry does not describe all South American jurisdictions.

Asia

China: public-facing services and development objectives

Binding service rules · promotion and state-security objectives

The Interim Measures for Generative AI Services reach services offered to the public in mainland China. Duties cover data, personal information, content and service management; specified services require security assessment and algorithm filing. Authorities can require explanations and use relevant rectification or suspension powers.²⁰

Power and limit: The public service and provider are the immediate control points. The same instrument also supports domestic technical innovation. Specified development and use not serving the domestic public is outside its scope. This entry maps those measures, rather than treating them as the entirety of China’s AI governance.²⁰

India: adoption, technical safeguards and existing institutions

Government guidelines · existing legal mandates

The November 2025 India AI Governance Guidelines combine responsible-adoption principles, practical measures and an implementation plan. The government’s explanation emphasises use of existing legislation, technical safeguards and sectoral regulators acting within their legal mandates.²¹

Power and limit: The guidelines themselves do not introduce new statutory audit, appeal or oversight mechanisms. Their policy direction should not be mistaken for a new horizontal AI Act or unrestricted permission to deploy high-risk systems. An organisation still needs to establish the applicable law, sector and commencement provisions for its activity.²¹

Singapore: practical assurance and human accountability

Voluntary governance frameworks and testing · binding data-protection obligations

Singapore supports responsible adoption through AI Verify’s technical tests and organisational checks. Its Model AI Governance Framework for Agentic AI, launched in January 2026 and updated in May, addresses systems that can take actions: bound their risks, allocate responsibility, implement controls and keep human oversight effective as automation becomes more capable.²²

Power and limit: These tools help organisations assess and govern deployment; using them does not itself establish regulatory approval or prove safety. Existing Personal Data Protection Act duties apply to covered activities, with PDPC guidance explaining their application to AI development and use.²³ Singapore’s contribution here is practical assurance and organisational accountability. Those mechanisms do not by themselves establish an authority to compel collective restraint. Singapore’s September UN proposals address that separate international question below.

Japan: organising government and promoting adoption

Binding institutional law · promotion-led approach

Japan’s AI Act, fully effective from September 2025, provides national leadership, planning, support for research and use, and mechanisms to investigate harmful cases and provide guidance. A further AI Basic Plan was adopted in July 2026.²⁴

Power and limit: Legal force can organise state action and cooperation without establishing the EU’s model obligations and risk-classification regime. The institutional framework does not, by itself, establish a general model-release approval requirement.²⁴

South Korea: industry development and trust obligations

Binding framework · enforcement grace period

The AI Basic Act and implementing framework took effect on 22 January 2026. They combine national policy coordination and industry support with transparency, safety and high-impact-AI obligations on covered businesses.²⁵

Power and limit: The ministry announced a grace period of at least one year, generally deferring investigations and penalties while retaining exceptions for serious harm. Duties depend on the applicable actor, activity and thresholds; this framework should not be treated as identical to the EU regime.²⁵

Compare: India, Japan and South Korea connect governance with adoption through different legal forms. Singapore adds testing and human-accountability practices; China’s public-service controls show a further approach to direct state oversight.

Australia and New Zealand (ANZ)

ANZ is a regional route through two jurisdictions. Organisations operating across the Tasman need to establish which country’s rules reach their activities, data and customers.

Australia: existing law and evaluation capacity

Binding privacy obligations · institutional and voluntary measures

Existing regulators retain their statutory powers. OAIC guidance applies Privacy Act and Australian Privacy Principles obligations to covered organisations using AI products and to relevant model development and training.²⁶ The AI Safety Institute supports technical evidence and evaluation.²⁷

Power and limit: Government says the earlier mandatory development/deployment guardrails proposal is not proceeding at this time. This does not remove existing law. Equally, establishing an evaluation institute does not give it a general model-licensing power. Data obligations and technical evidence perform different governance functions.²⁷

New Zealand: privacy law, business guidance and public-sector commitments

Binding privacy law · voluntary guidance · signatory commitments

The Privacy Act and Information Privacy Principles apply to relevant AI handling of personal information. The Privacy Commissioner can issue compliance notices requiring covered agencies to act or stop specified conduct. MBIE’s responsible AI guidance supports business adoption but remains voluntary.²⁸²⁹

Separate mechanism: The Algorithm Charter for Aotearoa New Zealand commits signatory public agencies to impact assessment, transparency, oversight and engagement. It includes Treaty considerations and explicitly recognises that Māori data sovereignty needs separate consideration. It is not a market-wide statute or equivalent to Canada’s mandatory departmental directive.³⁰

Compare: Both ANZ entries show why voluntary guidance must be read alongside existing obligations. Their shared regional setting does not establish equivalent duties or mutual recognition.

Africa: regional priorities and a national example

African Union: development, participation and regional coordination

Endorsed continental strategy · national implementation required

The Continental AI Strategy, endorsed in July 2024, connects responsible AI with development, local capability and regional cooperation. Its priorities make access to the benefits of AI part of governance, alongside protection from harm.³¹

Power and limit: This is a framework for coordinated approaches and implementation by member states. Endorsement does not create an AU-wide regulator able to license or withdraw models. The strategy is a continental perspective; it is not a substitute for examining national law.³¹

Kenya: building capability alongside data-protection obligations

National strategy · binding data-protection law

Kenya’s AI Strategy 2025–2030 links digital infrastructure, data and governance, and research and commercialisation. It establishes a policy direction for developing capability and adoption.³²

Power and limit: The Data Protection Act 2019 separately establishes the Data Protection Commissioner and obligations on controllers and processors. Those existing duties can reach relevant AI data processing; the AI strategy does not itself create a universal release licence. Kenya is a national example, not a proxy for the laws or implementation capacity of other African countries.³³

Compare: The AU’s regional coordination and Kenya’s national institutions answer different questions. Compare the former with international frameworks, and the latter with India’s adoption objectives and Canada’s existing-law approach.

International cooperation

Council of Europe: treaty commitments and domestic implementation

Treaty · ratification stage

The Framework Convention addresses AI, human rights, democracy and the rule of law. Its reach includes public authorities and private actors acting for them, with flexibility for other private-sector activity; defence is excluded.³⁴

Power and limit: Commitments depend on participation, entry into force and domestic implementation. The Council’s September 2026 update records the EU’s ratification as the first. Entry into force requires five ratifications, including three Council member states. A signature is not an operating enforcement system, and the Convention supplies no global model-release switch.³⁴

United Nations: shared assessment and dialogue

Established coordination mechanisms

The Scientific Panel and Global Dialogue, established through a 2025 General Assembly resolution, provide shared evidence and international discussion. The first reporting and dialogue milestones took place in July 2026.³⁵

Power and limit: These mandates provide assessment and convening, not licensing, inspection or sanction powers over developers. Their contribution is to the knowledge and participation needed for agreement. Enforcing any resulting restraint would require additional authority and commitments.³⁵

G7 Hiroshima reporting and OECD risk work offer further routes for voluntary comparison and evidence-sharing. They help make practices visible without constituting another operating regulator.³⁶

Finland and Norway: a proposal for stronger frontier control

Political declaration · mandatory controls proposed

The 21 September Call for Control of Frontier AI Models asks for mandatory predeployment testing, independent evaluation with sufficient access, common standards and serious-incident reporting. It asks UN members to explore an international institution able to support standards and verification and convene states when capability thresholds are crossed.³⁷

Power and limit: The declaration creates none of those powers. It is not an agreement to pause development, and it does not specify the thresholds or an enforcement mechanism. Its insistence on evaluation capacity across regions connects control with participation: countries outside the frontier industry also need the means to assess what is being deployed.

Singapore at the UN: participation beyond the leading developers

National diplomatic position · international framework proposed

Foreign Minister Vivian Balakrishnan’s 26 September General Assembly address argues that large and small economies depend on shared rules, using freedom of navigation as its example. Where universal agreement is unavailable, willing states should begin cooperation and leave the door open to others. For AI, he identifies shared science, comparable testing and cross-border incident reporting as practical starting points despite disagreement over governance.³⁸

Power and limit: He treats a general halt as unrealistic amid rivalry and financial incentives, while calling for safeguards, limits on autonomous action and exploration of a UN framework convention and international standards and verification functions. Countries outside the leading developers should have a meaningful stake. These are proposals, not an adopted convention.

United Kingdom and Canada: building cooperation through existing institutes

Renewed bilateral partnership · expanded cooperation announced

The 13 October partnership sets priorities for interoperable security standards, sharing information on frontier capabilities and risks, and exchanges on evaluation methods. It includes sensitive reporting through appropriate Five Eyes channels and exploration of staff exchanges and coordinated evaluations.¹⁶

Power and limit: This builds on cooperation established in 2024. It offers a route to shared technical capacity while broader arrangements are negotiated; it does not create an international regulator. Coordinated evaluations and staff exchanges are described as areas to explore. Carney’s UN remarks likewise advocate willing coalitions that others can join, rather than waiting for unanimity.³⁹

United States and China: an announced incident channel

Bilateral diplomatic commitments · operation not established

Both governments' September summit accounts record an AI dialogue and agreement to establish a communication channel for incidents. The US says the next exchange will occur by November; China says in November.⁴⁰

Power and limit: Neither account publishes operating procedures, a verification regime or a development pause. The announcements do not establish that the channel is operating, that substantive information has been shared or that either state would accept limits on its advantage. Communication could help manage an incident while competition continued. That possibility is different from demonstrated cooperation or joint control.

Compare: The UN mechanisms support shared assessment and discussion. The Finland/Norway call proposes additional institutional functions. Singapore argues for participation and safeguards beyond the frontier powers; UK–Canada cooperation develops capacity through existing institutes. The US–China announcement offers a separate bilateral route. None of these descriptions alone establishes an authority that can compel collective restraint.

Open weights: a test of reach

Open weights test the difference between legal responsibility and practical control. Once copies can be run and modified elsewhere, the original developer may no longer be able to withdraw access or enforce safeguards. Applicable duties on developers and organisations using those copies can nevertheless remain.

The EU has specific, limited exemptions for qualifying free and open-source releases; copyright and training-summary duties remain, and systemic-risk models do not receive the exemptions.¹ California’s deployment definition includes copying and modification.¹¹ China’s public-service rules and the privacy obligations discussed elsewhere illustrate how governance can instead reach the organisation putting a model to use.

For every entry, ask: what can be required before release, who remains accountable afterwards, and what changes when the capability crosses borders? An open-weight label alone answers none of those questions. Nor does it describe who operates a particular hosted service.

What the comparison reveals

Different regimes are governing different things: a model, an application, a data practice, a national capability or the conditions for international agreement. Their authority and implementation capacity need to be assessed separately.

For an organisation, where does responsibility sit, who can intervene, and what practical options remain when a capability or its terms change?

For collective restraint, the question is wider: who can require a costly change when companies or governments have reasons to continue? Shared evidence, trust and authority all matter. A collection of national initiatives, or an announcement that their leaders will talk, does not establish that ability.

Limits of this edition

Geographical breadth improves the comparison; it does not make it exhaustive. Brazil and Kenya establish specific national examples, while the AU adds a distinct regional perspective. Other South American and African jurisdictions, the Middle East and further Asian markets remain outside this edition. Absence is not a finding that a jurisdiction has no governance.

Official sources establish instruments, stated policy and selected actions. They do not independently establish institutional effectiveness, equal enforcement or sufficient protection. The US national-security example illustrates a distinct source of control; military and intelligence uses, sanctions and export controls are not systematically mapped here. Those limits matter when reading this as an AI × Geopolitics reference.

Related reading

The risk is shared. The race is not. examines the incentives and powers behind collective restraint. The terms of access can change follows the effects of political decisions through technological dependencies.

Notes

Footnotes

1. EU: Commission GPAI questions and answers, AI Office and enforcement framework. These distinguish mandatory obligations, the Code and enforcement powers. ↩ ↩²

2. EU: Commission's current implementation timeline, incorporating AI Omnibus changes, and market-surveillance responsibilities. The amended timeline distinguishes duties already applicable from later high-risk-system requirements. It also lists new prohibitions and a synthetic-content transition on 2 December 2026. ↩

3. UK: Joint Committee on Human Rights, Human Rights and the Regulation of AI, published 14 September 2026, recommendations 178, 204, 208 and 226–227. The recommended oversight body could be new or an existing body with expanded powers. The Joint Committee’s parliamentary page identifies the report and government-response timetable. ↩ ↩²

4. UK Prime Minister’s Office, Andy Burnham’s UN General Assembly speech, delivered 22 September and published 23 September 2026. The AI section proposes a G20 process and leaves open further domestic legislation. ↩

5. UK Parliament, Artificial Intelligence Policy, written ministerial statement, 12 October 2026, especially “Independent testing of advanced AI”, “Agentic AI incident response” and “Verification”. The statement confirms evaluations underway; incident-response arrangements and verification work are being developed. ↩

6. President of Russia, regulation establishing the AI development commission, 26 February 2026, and commission record. The mandate identifies coordination across federal and regional authorities, the Bank of Russia and participating organisations, including risk analysis. ↩ ↩²

7. US: June 2026 executive order, particularly section 3. ↩

8. White House, White House Accord on Super Intelligence: Joint Commitment on Frontier Responsibilities, 29 September 2026, archived by the American Presidency Project. The external-evaluation layer and company-board committee are distinct. The commitment does not itself create statutory penalties or a mandatory release-approval regime. ↩ ↩²

9. White House, Inaugurating the Era of Super Intelligence, Executive Order 14434, 29 September 2026, sections 1–4. The executive-branch terminology instruction is subject to law; the order initially uses the existing statutory AI definition. It is not a ban on private use of “AI”. ↩

10. White House, National Security Presidential Memorandum 11, 5 June 2026. The public memorandum directs accelerated adoption, assurance, command accountability and dependable access. ↩

11. California: Governor's SB 53 signing statement, 29 September 2025, and SB 813 / AB 1405 signing statement, 9 September 2026. California, SB 53 legislative text, sections 22757.11(e) and 22757.12. Deployment includes availability for modification and copying; duties depend on the statutory model and developer scope. ↩ ↩² ↩³

12. Canadian privacy regulators, Principles for responsible, trustworthy and privacy-protective generative AI; OPC, Federal Court applications under PIPEDA; Quebec CAI, private-sector law scope and obligations. Privacy guidance explains underlying law; it is not a new AI statute. Quebec is an illustrative provincial layer, not an exhaustive provincial survey. ↩

13. Treasury Board, Directive on Automated Decision-Making, as updated June 2025; scope guide; Algorithmic Impact Assessment. Scope includes covered departments’ production systems assisting administrative decisions and contains institutional and activity exclusions. ↩

14. ISED, Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems. Developer and manager roles, risk measures and preservation of existing legal obligations are explicit. ↩

15. Parliament, C-27, 44th Parliament, first session. The historical record does not reach third reading or Royal Assent. ISED’s archived AIDA companion document describes a proposal. ↩

16. UK Cabinet Office, UK–Canada renewed AI security partnership, 13 October 2026. The announcement records Carney’s endorsement of the September Call and sets out the partnership’s three priorities. Staff exchanges and coordinated evaluations remain exploratory. ↩ ↩²

17. Brian Platt and Christine Dobby, Bloomberg, Carney Calls for Global Tech Body to Boost AI Guardrails, 14 September 2026. Carney proposed a technology stability board along Financial Stability Board lines; this was an institutional proposal, not an established body. ↩

18. ANPD, July 2024 suspension of Meta’s relevant data processing and 30 August 2024 permission to resume under conditions. The suspension was lifted subject to conditions. ↩

19. Brazil, Chamber of Deputies, PL 2338/2023 legislative record. The Chamber record places the bill with a special committee awaiting the rapporteur’s opinion. Senate passage is not enactment of the proposed national AI framework. ↩

20. China: CAC, Interim Measures, original Chinese text, especially Articles 2, 7, 9–14 and 17–21. ↩ ↩²

21. MeitY/PIB, launch of India AI Governance Guidelines, 5 November 2025; parliamentary explanation of scope and legal effect, 19 December 2025. These distinguish guidelines, existing regulators’ statutory mandates and technical safeguards. ↩ ↩²

22. IMDA, AI Verify and responsible AI deployment; Model AI Governance Framework for Agentic AI, launched 22 January 2026; and 20 May 2026 update. The framework addresses risk boundaries, meaningful human accountability, technical controls and end-user responsibility. ↩

23. Singapore PDPC, Advisory Guidelines on use of Personal Data in AI Recommendation and Decision Systems, issued 1 March 2024. The guidance explains applicable PDPA obligations, including the position of third-party developers; it does not create a new horizontal AI statute. ↩

24. Japan: Cabinet Office AI Act page, official English overview, and AI strategy index, which records the July 2026 plan. ↩ ↩²

25. South Korea: MSIT, The AI Basic Act Comes into Force to Lay the Foundation for Korea to Become an AI G3, January 2026. This entry reports the ministry's implementation position, including the grace period. ↩ ↩²

26. OAIC, Guidance on privacy and the use of commercially available AI products and developing and training generative AI models. Guidance explains existing Privacy Act and Australian Privacy Principles obligations within their scope. ↩

27. Australia: official update on mandatory guardrails; AI Safety Institute. The Institute page records evaluation work, including a multi-agent-systems report in August 2026. ↩ ↩²

28. New Zealand Privacy Commissioner, AI and the Information Privacy Principles and Compliance Notice Guidelines. The latter distinguishes statutory compliance notices and the agencies they can reach. ↩

29. MBIE, Responsible AI guidance for businesses and New Zealand’s AI Strategy; Business.govt.nz introduction. The guidance is expressly voluntary and supplements applicable law. ↩

30. Stats NZ, Algorithm Charter for Aotearoa New Zealand, released July 2020. Signatory commitments, impact-based application, Treaty considerations and the limits concerning Māori data sovereignty are explicit. ↩

31. African Union, Continental Artificial Intelligence Strategy, endorsed by the Executive Council in July 2024 and published August 2024. Development, responsible use and coordination are stated aims. Endorsement is not the creation of a directly enforcing continental AI regulator. ↩ ↩²

32. Kenya MICDE, AI Strategy 2025–2030 launch and implementation roadmap. Three pillars cover infrastructure, data/governance and research/commercialisation. ↩

33. Kenya ODPC, Data Protection Act 2019. The Act establishes the Commissioner, data-subject rights and controller/processor obligations. ↩

34. Council of Europe: Convention scope, treaty status and entry threshold, and September 2026 anniversary update. The ratification milestone is the Council’s September account. The Council’s Treaty Office subsequently records Bosnia and Herzegovina’s ratification on 28 October 2026. This additional ratification does not establish that the Convention has entered into force. ↩ ↩²

35. UN: Global Dialogue and Scientific Panel FAQ. The latter identifies resolution A/RES/79/325 and the first reporting/dialogue milestones. ↩ ↩²

36. OECD, Hiroshima AI Process reporting framework update, May 2026; developer risk-management report, 2025. These concern voluntary reporting and evidence rather than a model-release authorisation system. ↩

37. Governments of Finland and Norway, A Call for Control of Frontier AI Models, 21 September 2026. Endorsements continued after publication. The call proposes testing and institutional functions; it does not create an international regulator or bind the frontier powers to a pause. ↩

38. Singapore Ministry of Foreign Affairs, Vivian Balakrishnan’s UN General Assembly statement, 26 September 2026, paragraphs 8–12 (navigation), 17–19 (willing coalitions) and 21–32 (AI). Proposals, not an adopted convention. ↩

39. Prime Minister of Canada, Carney’s remarks on the margins of the UN General Assembly, official transcript, 22 September 2026. The remarks place AI among cross-border challenges and advocate practical coalitions open to wider participation. ↩

40. White House, US–China state-visit fact sheet, 25 September 2026; China Ministry of Foreign Affairs, eight summit deliverables, 26 September, item 7. Both record commitments to dialogue and an incident channel. The separate military crisis-communication memorandum should not be confused with the AI channel. ↩