Resources

Federal guidance for institutions on assessing the risks of generative AI tools and using them responsibly, with principles, policy considerations and good practices.

A voluntary code asking organizations that build or run general-purpose generative AI to adopt risk management measures such as accountability, safety and transparency.

Uruguay’s AI roadmap with guiding principles and three objectives, governance, capabilities and sustainable development, built through a participatory process.

Colombia’s planning department presents its national AI policy approved in February 2025, with six axes and more than 100 actions through 2030.

Brazil’s 2024–2028 national AI plan, with a planned budget of R$ 23 billion over four years and five structural axes.

The action plan for Chile’s national AI policy, covering its 177 initiatives, their implementation status and its strategic axes.

Describes the authority’s sandbox, which gives free guidance to selected companies and shares lessons for privacy-friendly use of AI.

The UK government policy paper setting out a proportionate, innovation-friendly framework for regulating AI, published in March 2023.

The Commission’s page on the EU legal framework for AI, which sets rules for developers and deployers according to the risk level of each system.

The ministry’s overview of Egypt’s national approach to AI, including governance bodies, the national strategy and responsible AI principles.

The UAE Government’s overview of the AI tools it uses, the policies that support them and available AI courses.

China’s rules for public-facing generative AI services, in Chinese only, covering provider duties, training data, content, labelling and penalties since 15 August 2023.

Hosts Hong Kong’s Ethical Artificial Intelligence Framework and its Generative AI Technical and Application Guideline for developers, service providers and users.

Singapore’s governance framework for organizations deploying AI agents, covering upfront risk assessment, human accountability, technical controls and end-user responsibility across the agent lifecycle.

Official English translation of Japan’s 2025 AI Act, which sets basic principles for AI, requires a national basic plan and creates an AI Strategic Headquarters.

India’s November 2025 guidelines setting principles and recommendations for safe, risk-based AI use that build on the country’s existing laws.

English text of South Korea’s AI framework law, enacted in January 2025 and in effect from 22 January 2026.

Malaysia’s voluntary national guidelines on AI governance and ethics, built on seven principles for users, policymakers and AI developers.

Voluntary July 2025 guidance helping New Zealand businesses use and develop AI responsibly, covering governance, foundations and issues across the AI lifecycle.

The African Union’s strategy for an Africa-centred, development-focused approach to AI, promoting responsible and ethical use and coordinated national approaches among member states.

Rwanda’s National Artificial Intelligence Policy, a roadmap of six priority areas, developed by the Ministry of ICT and Innovation with the Rwanda Utilities Regulatory Authority.

The first legally binding international treaty on AI, covering human rights, democracy and the rule of law, open to countries worldwide.

The G7 initiative that produced the Hiroshima AI Process Comprehensive Policy Framework, with guiding principles and a code of conduct for advanced AI.

The OECD’s intergovernmental standard on trustworthy AI, adopted in 2019 and updated in 2024, with values-based principles and recommendations for governments.

The official legal instrument containing the OECD’s principles for responsible stewardship of trustworthy AI, listed in the OECD Legal Instruments database.

UNESCO’s global standard on AI ethics, adopted in November 2021, grounded in human rights with core values, ten principles and policy actions.

The UN’s record of resolution 78/265 of 21 March 2024, the General Assembly’s first resolution on safe, secure and trustworthy artificial intelligence.

The UN framework for digital cooperation and the governance of artificial intelligence, opened for endorsement in September 2024.

Mexico’s federal law, published on 20 March 2025, setting rules for how private parties collect, use, transfer and secure personal data.

Principles from Canada’s federal privacy regulator on how privacy obligations apply to organizations that develop, provide or use generative AI, including consent and safeguards.

The regulator’s hub for Canada’s federal private-sector privacy law, with its requirements, fair information principles, business guidance and investigation findings.

The data protection authority’s AI documents, led by a guide for public and private entities on transparency and personal data protection in responsible AI.

The data protection authority’s page offering Law No. 13,709, Brazil’s general data protection law, as an English-language PDF.

The Commission’s overview of the rules that protect personal data inside and outside the EU, including the General Data Protection Regulation.

The Board’s opinion on data protection questions raised by AI models, including legal basis and anonymization, issued in December 2024.

The Swiss authority explains that the Federal Data Protection Act already applies to AI-supported data processing and sets transparency requirements.

The UK regulator’s guidance and tools on applying data protection law to AI, including explaining AI-assisted decisions.

A government overview of the UAE’s main data protection and privacy laws, centred on the federal Personal Data Protection Law.

Explains how Singapore’s Personal Data Protection Act applies when organizations use personal data to develop, test and deploy AI systems that make recommendations or decisions.

The Commission’s 2023 announcement of its principle-based approach to personal data in AI, with safeguards from design through service delivery.

The Commission’s English page listing the Act on the Protection of Personal Information, its enforcement rules and overview documents, with translations for reference only.

Guidance for organizations that develop or fine-tune generative AI models on meeting Australian Privacy Principles, with practical tips and a checklist.

Explains how the Privacy Act 1988 applies when organizations deploy commercial AI products such as chatbots, with checklists on choosing products and managing privacy risk.

The Commissioner’s overview of the Privacy Act 1988 and its 13 Australian Privacy Principles, with links to related topics.

The Privacy Commissioner’s guidance on applying the Information Privacy Principles at each stage of AI use, with a recommended privacy impact assessment.

The Commissioner’s summary of the Privacy Act 2020 and its information privacy principles on how agencies collect, store, use and share personal information.

The independent regulator established under the Data Protection Act, 2012 (Act 843) to protect personal data by regulating how it is processed.

The office’s guidance under the Data Protection Act 2017, including a guide on data protection for health data and AI solutions.

The regulator’s page for the Protection of Personal Information Act, with forms and information on how organizations process personal information.

The data protection regulator’s site, covering the Nigeria Data Protection Act 2023 and its implementation guidance and notices for organizations.

The regulator’s collection of guidance notes under the Data Protection Act, including consent, impact assessments, cross-border transfers and data protection officers.

An awareness publication explaining how generative AI is used, the cyber security risks it creates and measures organizations can take to reduce them.

Joint guidance on protecting data across the life of an AI system, from development and testing through deployment and operation.

Brazil’s national cybersecurity strategy, established by Decree 12.573 of 2025, with guidelines on governance, risk management and essential services.

MinTIC’s security and privacy of information model, a set of good practices based on international standards for Colombian public entities.

Describes the EU regulation intended to make sure digital products are safe from cyber threats across their life.

Explains the EU directive that sets cybersecurity rules for critical sectors, national strategies, cross-border cooperation and incident reporting.

Security guidance for organizations building AI systems, covering design, development, deployment and operation.

Introduces the NSM’s cybersecurity work, including its role as Norway’s national computer emergency response team and cybersecurity hub.

Guidelines for system owners on securing AI systems across their lifecycle, with a companion guide of practical controls drawn from industry and academia.

India’s national cyber agency sets out measures for organizations to reduce exposure and defend against attackers who use AI to find and exploit vulnerabilities.

The agency’s page on Malaysia’s Cyber Security Act, covering duties for critical information infrastructure entities and licensing of cyber security service providers.

A beta framework of five functions for organizing cyber security work, which any organization can use to strengthen or build a security program.

The African Union treaty, adopted in 2014, that sets continental rules on cybersecurity and the protection of personal data.

The authority created under the Cybersecurity Act, 2020 to regulate cybersecurity, with advisories for business, licensing and incident reporting.

The national cyber agency’s site, with security alerts, advisories, documentation and incident reporting for organizations operating in Rwanda.

Describes the agency’s cybersecurity department, which sets standards for government and private-sector organizations and issues guidelines and business continuity guidance.

The ITU benchmark scoring countries’ cybersecurity commitment across legal, technical, organizational, capacity development and cooperation pillars; the 2024 edition is the latest.

A voluntary framework for building trustworthiness into the design, development, use and evaluation of AI systems, with a playbook and generative AI profile.

The hub for the Cybersecurity Framework 2.0, with guidance, profiles, mappings and tools that help organizations manage cybersecurity risk.

A framework of UK guidance for organizations whose essential functions support everyday life to assess their cybersecurity, now at version 4.0.

The Authority’s updated baseline cybersecurity controls, intended to strengthen cybersecurity at the national level and protect information and technology assets.

A reference and methodology for managing cybersecurity risks in the Kingdom, at both entity and national levels.

The international standard specifying requirements for establishing, running and improving an AI management system within an organization.

Statistics Canada’s quarterly analysis of the share of Canadian businesses planning to use AI over the next 12 months, with detail by application.

A biweekly survey of about 1.2 million businesses on conditions and expectations, including a supplement and reports on AI use at US businesses.

ENISA’s analysis of 4,875 incidents from July 2024 to June 2025, covering the main cybersecurity threats and trends facing the EU.

Official EU statistics on AI adoption by enterprises, broken down by company size, sector, technology type, purpose and reasons for not using it.

Official UK survey results that include the share of businesses using AI technologies, with figures by business size.

Official report on Singapore’s digital economy, including enterprise digitalization and a section on the state of AI adoption among businesses.

Official business survey results released 25 June 2026, including the share of Australian businesses using artificial intelligence and other digital practices.