Dated AI rules for financial-services decisions that are in force, apply, or have been issued. Grouped by jurisdiction, A→Z. Where a rule is in force but its duties are not yet active, the Status column says so.
Every row checked against its source on 7 October 2026 unless the row gives another date.
| Jurisdiction | Instrument | In force since | Status | Applies to | Source & Index |
|---|---|---|---|---|---|
| Australia | APRA, letter to industry on artificial intelligence | Issued 30 April 2026 | Supervisory expectations; not binding | All APRA-regulated entities · Insurance; Banking & credit | Regulator letter, 30 April 2026 · Index: AU |
| Bahrain | Personal Data Protection Law (Law No. 30 of 2018), Article 22 (decisions based solely on automated processing) | 1 August 2019 | In force | Any data subject of a decision based solely on automated processing · All sectors | Legal update (secondary; checked 27 October 2026) · note 11 |
| Canada (Quebec) | Act respecting the protection of personal information in the private sector (CQLR c. P-39.1), s.12.1 | 22 September 2023 | In force | Any business that makes a decision based exclusively on automated processing · All sectors | Statute, up to date to 12 August 2026 · Index: CA · note 1 |
| Cayman Islands | Data Protection Act (2021 Revision), s.12 (rights in relation to automated decision-making) | 30 September 2019 | In force | Data controllers taking significant decisions based solely on automated processing, including on creditworthiness · All sectors | Statute, 2021 Revision, Ombudsman copy (checked 27 October 2026) · note 12 |
| European Union | AI Act (Regulation (EU) 2024/1689), Article 50 transparency duties | 2 August 2026 | Applies; Article 50(2) marking deferred to 2 December 2026 for systems placed on the market before 2 August 2026 | Providers and deployers of AI systems · All sectors | Commission guidance, last updated 24 July 2026 · Index: EU, DE, IE, LU |
| European Union | EIOPA, Opinion on AI governance and risk management (EIOPA-BoS-25-360) | Issued 6 August 2025 | Supervisory opinion; sets no new requirements | Insurers and intermediaries (addressed to national supervisors) · Insurance | EU authority, 06 August 2025 · Index: EU |
| European Union | Regulation (EU) 2026/1744 amending the AI Act | 27 July 2026 | Regulation in force; high-risk requirements for Annex III systems deferred to 2 December 2027 | Providers and deployers of high-risk AI systems · All sectors | EU law, OJ 24 July 2026 · Index: EU, IE |
| Germany | KI-MIG (Act implementing the AI Act, Article 1), BGBl. 2026 I Nr. 223 | 29 July 2026 | In force; BaFin is the market surveillance authority for insurers' AI systems used in regulated activity (§2(3)) | AI systems in Germany; BaFin for insurers · All sectors | Statute, 22 July 2026, published 28 July 2026 · Index: DE · note 2 |
| Hong Kong | HKMA, circular "Consumer Protection in respect of Use of Generative Artificial Intelligence", building on the HKMA's High-level Principles on AI (1 November 2019) and its big data analytics and AI circular (5 November 2019) | Issued 19 August 2024 | Supervisory circular (guiding principles); the insurance watch line for Hong Kong is unchanged | All Authorized Institutions · Banking & credit | Regulator circular, 19 August 2024 (checked 27 October 2026) |
| Indonesia | OJK, AI governance guide for Indonesian banking | Launched 29 April 2025 | Guidance | Banks · Banking & credit | Regulator press release SP 67/GKPB/OJK/IV/2025, 29 April 2025 · Index: ID · note 3 |
| Ireland | Regulation of Artificial Intelligence Act 2026 (No. 31 of 2026) | 31 July 2026 | In operation; the Central Bank may fine Article 50 infringements (s.133) | Firms subject to the AI Act in Ireland · All sectors | Commencement order S.I. No. 403 of 2026, 31 July 2026 · Index: IE · note 4 |
| Japan | Act on the Promotion of Research, Development and Utilisation of AI-Related Technologies (Act No. 53 of 2025) | 4 June 2025 | In force; businesses must strive to use AI and cooperate with government measures; no penalties | All businesses · All sectors | Statute, promulgated 4 June 2025 · Index: JP |
| Malta | MFSA, Dear CEO letter: AI governance, risk and prudential expectations | Issued 4 June 2026 | Supervisory expectations; AI self-assessment expected | MFSA licence holders · Insurance; Banking & credit | Regulator letter, 04 June 2026 · Index: MT |
| Mauritius | Data Protection Act 2017 (Act 20 of 2017), s.38 (automated individual decision making) | 15 January 2018 | In force | Any data subject of a decision based solely on automated processing · All sectors | Statute, Proclamation No. 3 of 2018, FSC copy (checked 27 October 2026) |
| Mauritius | FSC, Fintech Series Guidance Notes 4: Principles for the Responsible Use of AI in Financial Services | Issued September 2025 | Guidance; not binding | Insurance, wealth management and non-bank licensees · Insurance | Regulator guidance, September 2025 · Index: MU |
| Nigeria | Nigeria Data Protection Act 2023, s.37 (automated decision-making) | 12 June 2023 | In force (the date of assent printed on the Act) | Any data subject of a decision based solely on automated processing · All sectors | Statute, Act No. 37 of 2023, Official Gazette No. 119 (government copy; checked 27 October 2026) · note 13 |
| Peru | Supreme Decree DS 115-2025-PCM (regulation under Law 31814) | Published 9 September 2025 | In force; finance-sector uses were required to implement its obligations by 10 September 2026 | Public and private entities using AI · All sectors | Regulation, El Peruano, 9 September 2025 · Index: PE · note 2 |
| Qatar | Qatar Central Bank, Artificial Intelligence Guideline | 4 September 2024 | In force; a provider launching a new AI system needs the Bank's approval first | QCB-licensed entities · Insurance; Banking & credit | Regulator guideline, in force as of 04/09/2024 · Index: QA · note 2 |
| Saudi Arabia | SDAIA, National AI Risk Management Framework (SDAIA-P145, v1.0) | Issued April 2026 (launch announced 14 July 2026) | "Advisory framework" (the document's own words); not binding | Government and private-sector entities in all sectors · All sectors | SDAIA framework document, April 2026 (printed) · Government news agency release, 14 July 2026 · Index: SA · note 5 |
| Singapore | MAS, FEAT Principles | Released 12 November 2018 | Guidance; not binding | Firms using AI and data analytics for financial products and services · Insurance; Banking & credit | Regulator principles (undated) · Index: SG · note 6 |
| South Africa | Protection of Personal Information Act 4 of 2013, s.71 (automated decision-making) | 1 July 2020 | In force | Any person subject to a decision based solely on automated processing · All sectors | Statute, Gazette No. 37067, 26 November 2013 · Index: ZA · note 7 |
| South Korea | Framework Act on the Development of AI and the Establishment of Trust (AI Basic Act) | 22 January 2026 | Act in force; fines not imposed during a grace period of at least one year (MSIT) | Operators of high-impact AI · All sectors | Press report of the Ministry's statement, 31 December 2025 · Index: — · note 8 |
| South Korea | FSC, Financial Sector AI Guideline | 22 June 2026 | Self-regulation (the Commission's own term) | All financial companies using AI · Insurance; Banking & credit | Regulator press release, 2026-06-18 · Index: KR · note 2 |
| Switzerland | FINMA Guidance 08/2024: governance and risk management when using AI | Issued 18 December 2024 | Supervisory guidance; not binding | FINMA-supervised institutions · Insurance; Banking & credit | Regulator guidance, 18 December 2024 · Index: CH |
| Taiwan | AI Basic Act (人工智慧基本法) | 16 January 2026 | In force (promulgated 14 January 2026; Central Regulation Standard Act Art. 13); requires agencies to complete rules within two years; no direct duties or penalties for businesses | Government agencies, including the Financial Supervisory Commission; no direct duties for businesses · All sectors | Statute, promulgated 14 January 2026 (ROC 115) · Statute: Central Regulation Standard Act (中央法規標準法), Art. 13 · Index: TW · note 9 |
| Taiwan | FSC, Guidelines for the Use of AI in the Financial Industry | Issued 20 June 2024 | Guidance; not binding | Financial institutions · Insurance; Banking & credit | Regulator guideline, 20 June 2024 (ROC 113) · Index: TW |
| Thailand | Bank of Thailand, AI Risk Management Guidelines for Financial Service Providers | Issued 12 September 2025 | Guidelines (the Bank's own term) | Financial institutions and payment service providers · Banking & credit | Regulator consultation page, draft of 12 June 2025 (checked 27 October 2026) · note 14 |
| Thailand | OIC, AI Governance Guideline for insurance companies | Issued November 2025 | Guideline; customer disclosure required for customer-facing AI | Insurance companies · Insurance | Regulator guideline, November 2025 (B.E. 2568) · Index: TH |
| United Arab Emirates (DIFC) | DIFC Data Protection Regulations, Regulation 10 (autonomous and semi-autonomous systems) | 1 September 2023 | In force | Deployers and operators of such systems processing personal data in the DIFC · All sectors | Regulation, Consolidated Version No. 2, in force 1 September 2023 · Index: AE-DIFC |
| United Arab Emirates (mainland) | Central Bank of the UAE, Guidance Note on consumer protection and responsible use of AI and ML | Issued 11 February 2026 | Guidance (principles); no supervisory follow-up stated | Licensed financial institutions, including insurance providers · Insurance; Banking & credit | Regulator guidance, issued 11/2/2026 · Index: AE |
| United Kingdom | PRA, SS1/23 Model risk management principles for banks | 17 May 2024 | Supervisory expectations; current version effective 23 April 2026; covers "the use of artificial intelligence" in modelling | UK banks, building societies and PRA-designated investment firms with internal model approval for regulatory capital · Banking & credit | Regulator supervisory statement, 17 May 2023; updated 23 April 2026 (checked 27 October 2026) |
| United States (California) | California Department of Insurance, Bulletin 2022-5 | Issued 30 June 2022 | Issued; the Department reserves the right to audit insurers' models | Insurers and licensees · Insurance | Regulator bulletin, June 30, 2022 · Index: US-CA · note 10 |
| United States (Colorado) | Division of Insurance, Regulation 10-1-1 (3 CCR 702-10) | 15 October 2025 | In force; compliance reports: life from 1 December 2024, auto and health from 1 July 2026 | Life, private passenger auto and health benefit plan insurers · Insurance | Regulation, effective October 15, 2025 · Index: US-CO |
| United States (Federal) | OCC, Federal Reserve and FDIC, Supervisory Guidance on Model Risk Management (SR 26-2), replacing SR 11-7 | Issued 17 April 2026 | Guidance; "does not set forth enforceable standards"; covers non-generative, non-agentic AI models; generative and agentic AI are outside it | Banking organizations; "most relevant" above $30 billion in total assets · Banking & credit | Regulator letter SR 26-2, April 17, 2026 (checked 27 October 2026) |
| United States (New York) | NYDFS, Insurance Circular Letter No. 7 (2024) | Issued 11 July 2024 | Sets out the Department's expectations; calls for AI disclosure in adverse underwriting notices (para. 39) | Insurers authorised in New York · Insurance | Regulator circular, July 11, 2024 · Index: US-NY |
| United States (Texas) | Texas Insurance Code §4201.156 (added by SB 815) | 1 September 2025 | In force; applies to plans delivered, issued or renewed on or after 1 January 2026 | Utilization review agents · Insurance | Enrolled bill text, "This Act takes effect September 1, 2025" (secondary host) · Index: US-TX |
- The in-force date (22 September 2023) is from the Commission d'accès à l'information, as cited in the Index entry; the statute page does not print it.
- The primary source could not be opened on 7 October 2026; the row follows the Index entry's reading of it.
- The guide was read through its press release.
- The commencement order could not be opened on 7 October 2026. A government release of 30 July 2026 confirms the Act was signed on 21 July 2026; the commencement date follows the Index entry.
- The SDAIA framework document (April 2026, printed) was read from copies of the English summary (SDAIA-P145EN) and the Arabic full text on 7 October 2026; no SDAIA link is given. The news agency release confirms the 14 July 2026 launch.
- The release date is from a reproduction of the release, as cited in the Index entry.
- The commencement date is from legal news, as cited in the Index entry; the commencement proclamation was not read.
- The statute text could not be opened on 7 October 2026; the row relies on a press report of the Ministry's statement.
- The Article 13 page was opened and checked on 7 October 2026.
- The bulletin is listed on the Department's bulletins page; the PDF itself was not re-opened on 7 October 2026.
- The in-force date is from legal news (secondary); the Law's official text was not opened on 27 October 2026.
- The commencement date (30 September 2019) is from the Act's endnotes (Data Protection Law, 2017, Commencement Order, 2019).
- The Act prints no separate commencement date; the date shown is the date of assent printed on it.
- The final guidelines (issued 12 September 2025) were read through legal news (Tilleke & Gibbins, 24 September 2025); the Bank's consultation page for the draft was opened on 27 October 2026.