The world's AI laws disagree. Four duties keep turning up anyway

Who this is for: you use AI in an organisation that works across borders, or you advise people who do, and someone has asked you what the rules are. By the end you'll know what binds now, what lands in the next two years, where the rules contradict each other, and the short list of things an organisation needs whichever rules apply to it.

Skip it if you want a legal opinion on one system. This maps the ground. It doesn't replace a lawyer for your jurisdiction.

On the length: it's long, because it covers five regions. The summary gives the findings in two minutes. Section 8 is the part to act on. The dates the argument rests on were re-checked against the primary source on 14 October 2026; where a point comes only from secondary reporting, the text says so. Regulation moves, so check again before relying on any date.

Summary

AI regulation looks like chaos from a distance. Up close it has a shape.

The laws are splitting into four blocs. The EU and a growing group of countries have one horizontal AI law. The US has no federal AI law, dozens of state laws, and a federal government trying to stop them. China regulates through a stack of administrative measures. And the UK, Japan, Singapore, India, Canada, Australia and the Gulf states have chosen not to pass an AI act at all.
The duties are converging. Under all four approaches, the same few obligations keep turning up: label AI-generated content, let people get a human review of consequential automated decisions, report serious incidents, and keep an inventory of AI systems with their risks graded. Labelling is the most widely shared binding duty in the world as of October 2026.
The EU delayed the part that matters most. Its rules for high-risk AI, the ones that cover credit scoring, insurance pricing and hiring, now apply from 2 December 2027, not August 2026.
The US is fighting itself. Four state regimes start on 1 January 2027, while the federal government has an executive order and a litigation task force aimed at state AI laws. No court has ruled on whether federal policy overrides them.
Most of what bites today is old law applied to a new technique: data protection, consumer protection, financial conduct rules, model risk rules for banks, product safety.
Financial services is where AI rules arrive first, through supervisors rather than statutes: Singapore, Canada and the UK are building AI into existing supervision. The US has just done the opposite, leaving generative AI out of its new bank model guidance.

The practical conclusion: an organisation can't wait for one global rulebook. It needs one set of governance machinery that maps to many regimes, and a record of where the regimes disagree.

Where I'm coming from: I've worked in financial services since 1987, latterly in business continuity and resilience. From 2023 I was a member of a bank's committee that approved AI and cloud initiatives. I didn't design that process, and I haven't applied the EU AI Act inside a firm. This paper is research, not practice: two research runs on 5 and 10 October 2026, each claim graded by the strength of its evidence, and the key dates re-checked at source on 14 October.

1. Four ways of regulating AI

No single model is winning. The EU's own law was delayed, and most large economies outside it chose not to copy it.

One horizontal AI law. The EU AI Act sorts AI by risk: a short list of banned uses, a heavy regime for high-risk uses, transparency duties for chatbots and synthetic content, and lighter rules for general-purpose models. Several countries have since passed laws of the same broad shape. South Korea's AI Basic Act took effect on 22 January 2026. Vietnam's AI law took effect on 1 March 2026. Kazakhstan's AI law, signed in November 2025, took effect in January 2026. Italy's AI law took effect on 10 October 2025. Peru's implementing decree took effect in January 2026, and Taiwan's AI Basic Act, mostly a framework for government, on 14 January 2026.

A federal retreat and a state patchwork. The US has no federal AI law. The current administration revoked its predecessor's AI executive order in January 2025 and has since pushed against regulation, including an executive order in December 2025 aimed at state AI laws (section 2). Meanwhile the states keep legislating. Trackers disagree on how much: one counted 84 AI-related laws in 27 states by July 2026 (Transparency Coalition); another counted 109 in 29 states by 1 July (NYU's Center on Technology Policy). The honest statement is "dozens, and rising", with a named tracker and date.

A stack of administrative measures. China has no single AI law. It regulates through separate measures for recommendation algorithms, deepfakes and generative AI services, with a mandatory labelling standard and filing with the Cyberspace Administration. By 31 August 2026, 1,112 generative AI services had completed filing. The State Council's 2026 legislative plan says to "accelerate" comprehensive AI legislation, but the bill isn't among those due to be submitted this year.

No AI act: existing regulators. The UK, Japan, Singapore, India, Canada, Australia and the Gulf states have, as of this research, chosen not to pass a horizontal AI law. Each applies existing law through existing regulators, with guidance on top. This is not a gap in coverage. Data protection, consumer protection and financial regulation all reach AI already.

2. What binds now

The EU

The AI Act (Regulation 2024/1689) has been amended by the Digital Omnibus, Regulation (EU) 2026/1744, which the European Parliament voted through on 16 June 2026 and which took effect on 27 July 2026. Here's what applies today:

Banned practices, from 2 February 2025: manipulative techniques that cause significant harm, exploiting vulnerabilities, social scoring, predicting crime from profiling alone, untargeted scraping of facial images, emotion recognition at work and in schools, inferring sensitive traits from biometrics, and most real-time remote biometric identification by police.
AI literacy, from the same date, though the Omnibus softened it. The original duty was to "ensure, to their best extent, a sufficient level of AI literacy". The amended Article 4 says firms "shall take measures to support the development of AI literacy", and "This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual."
General-purpose AI models, with duties from 2 August 2025 and the Commission's power to enforce them from 2 August 2026. Models already on the market before August 2025 have until 2 August 2027.
Transparency (Article 50), from 2 August 2026: tell people they're dealing with an AI, mark synthetic content in a machine-readable way, and disclose deepfakes.

Fines under the Act reach €35m or 7% of worldwide turnover for banned practices, and €15m or 3% for most other breaches (Article 99 of the AI Act).

Enforcement of the general-purpose model rules has started. The Commission confirmed at a press briefing on 1 September 2026 that it had sent requests for information to more than 30 AI companies, according to reporting of that briefing. Its enforcement page, updated 6 October, records no fines.

The UK

The UK has no AI law, and the King's Speech of 13 May 2026 didn't propose one. AI appears only inside a proposed Regulating for Growth Bill, which would give the government powers to relax existing rules temporarily for sandbox testing. That bill had not been introduced in Parliament as of 14 October. An advisory version of the government's AI Growth Lab started on 8 June 2026, beginning with legal services, and says plainly that "Legal and regulatory requirements will remain the same."

What applies is existing law:

Automated decisions. Since 5 February 2026, the Data (Use and Access) Act 2025 has replaced UK GDPR's Article 22 with Articles 22A to 22D. Solely automated decisions with significant effects are now generally permitted, with safeguards: information, the chance to make representations, human intervention and the right to contest. The EU keeps a prohibition with exceptions. That's the sharpest UK-EU split in the paper.
Financial conduct. The Financial Conduct Authority says: "We do not plan to introduce extra regulations for AI. Instead, we'll rely on existing frameworks", naming the Consumer Duty and the senior managers' accountability regime.
Bank model risk. The Prudential Regulation Authority's supervisory statement SS1/23 applies to banks approved to use their own models to set capital, and covers AI used in those models: an inventory, risk tiering, independent validation and a named senior manager. Its April 2026 update was a clarification, not a change of policy.
Critical third parties. On 10 July 2026 the Treasury announced the first four providers designated for direct oversight by the financial regulators: the UK or EU operating companies of Amazon Web Services, Google Cloud, Microsoft and Oracle. The designations took effect on 13 July.

The US: federal

There is no federal AI law. The federal government's main moves are against regulation:

Executive Order 14365, signed 11 December 2025, set up a Department of Justice task force whose "sole responsibility shall be to challenge State AI laws". It asked the Commerce Department to publish an evaluation identifying "onerous" state laws within 90 days, which I could not find published. It also ties some broadband grant money to states' AI laws, and tells the Federal Trade Commission to issue a policy statement on preemption.
The FTC proposed that statement on 1 July 2026. The statement says state law "is impliedly preempted to the extent it conflicts with a Federal regulatory scheme". The FTC's press release went further and named Colorado's AI law. Comments closed on 31 July; it isn't final.
Colorado is the test case. In X.AI v. Weiser, the court approved an agreed pause on enforcing Colorado's AI law on 27 April 2026, pending a ruling on a preliminary injunction. The Justice Department joined the case. It was a stipulation, not a ruling on the merits.
Bank model risk. The April 2026 guidance that replaced SR 11-7 says generative and agentic AI models "are not within the scope of this guidance", and promises a request for information on AI. As of 14 October that request hadn't been issued. A proposed new interagency guidance on third-party risk, published on 15 September 2026 with comments due by 16 November, doesn't mention AI.

The US: states

The state laws that matter most for organisations:

Colorado repealed its 2024 AI Act and replaced it with SB 26-189, signed on 14 May 2026 and applying to decisions from 1 January 2027. It covers automated decision technology in consequential decisions, requiring notice, an explanation of adverse decisions, correction and human review. The 2024 law's defence for firms following the NIST framework or ISO 42001 is gone. Breaches are treated as deceptive trade practices under the Colorado Consumer Protection Act, which allows civil penalties of up to $20,000 per violation, with a 60-day cure period until 2030.
California's privacy regulator requires businesses using automated decision-making technology for significant decisions to comply from 1 January 2027. Its AI Transparency Act, requiring disclosures in AI-generated content, became operative on 2 August 2026, and was amended again by SB 1000 on 30 September 2026.
New York's RAISE Act, for developers of the largest frontier models, was signed on 19 December 2025, amended on 27 March 2026, and takes effect on 1 January 2027, with penalties of up to $1m for a first violation and $3m after.
Illinois's AI Safety Measures Act (SB 315), also aimed at frontier developers, with incident reporting and the same $1m and $3m penalties, takes effect on 1 January 2027. Separately, since 1 January 2026, Illinois employers can't use AI that "has the effect of subjecting employees to discrimination".
Utah's AI Policy Act is due to be repealed on 1 July 2027 unless renewed.

China

China's mandatory standard for labelling AI-generated content, GB 45438-2025, has applied since 1 September 2025, requiring both visible labels and hidden metadata. Measures for AI services that offer "continuing emotional interaction", companion-style chatbots, took effect on 15 July 2026. Generative AI services must be filed with the Cyberspace Administration before public launch. All of this sits on China's cybersecurity, data security and personal information laws.

The rest of Asia

South Korea's AI Basic Act took effect on 22 January 2026, with fact-finding and fines held back for "at least one year", according to the government's own announcement. It covers high-impact AI, labelling of generative output, and a local representative for large foreign firms.
Vietnam's AI law (Law 134/2025/QH15) took effect on 1 March 2026, with risk tiers and machine-readable marking, and a transition period for systems already in use.
India has no AI law, but amended its IT Rules in February 2026 to require prominent labels and permanent metadata on synthetic content, with fast takedown duties for large platforms.
Singapore has no AI law. Its financial regulator issued final AI risk management guidelines on 7 October 2026, applying in two phases from 7 October 2027 and 7 October 2028.

3. What lands next

The two EU high-risk dates matter most to banks, insurers and anyone using AI in hiring.

2 December 2026. Generative AI systems placed on the EU market before 2 August 2026 must comply with the machine-readable marking duty. Two new EU prohibitions apply: AI that generates intimate images of an identifiable person without consent, and AI that generates child sexual abuse material.

1 January 2027. Colorado's automated-decision law, California's automated-decision rules, New York's RAISE Act and Illinois's frontier AI law all start in the same week. If a federal court rules that federal policy overrides state AI laws before then, some of this changes. Until a court does, the state laws apply.

Early 2027. South Korea's grace period on fines ends, at the earliest.

2 December 2027 and 2 August 2028. The EU's high-risk rules apply in two stages. First come the Annex III uses, which include credit scoring, life and health insurance pricing, recruitment and access to essential services. Then come AI systems built into products already regulated under EU safety law. The amended Act also sets 2 August 2030 for high-risk systems used by public authorities.

What the EU high-risk rules will ask of a deployer. A deployer is an organisation using a high-risk system rather than building it. Under Article 26 it must use the system according to the instructions, and give human oversight to people "who have the necessary competence, training and authority". It must keep the system's automatic logs for at least six months. And it must tell workers' representatives and affected workers before using it at work. Deployers of credit scoring and life or health insurance pricing must also carry out a fundamental rights impact assessment (Article 27). A deployer can also become a provider, with much heavier duties (Article 25). That happens if it puts its own name on a high-risk system, substantially modifies one, or changes a system's purpose so that it becomes high-risk. That last point is the trap for a bank that fine-tunes a vendor's model for credit decisions.

What isn't ready. The harmonised standards that would give firms a presumption of conformity aren't there yet. The quality management standard, EN 18286, was published on 31 July 2026 but hadn't been cited in the EU's Official Journal by mid-October, so using it gives no legal presumption yet. The risk management standard is still a draft, and secondary reports say most national bodies rejected it at enquiry in July. The Commission's guidelines on what counts as high-risk were still a draft in October, after their statutory deadline passed in February.

What's stuck. The EU has a separate proposal to change the GDPR, including a narrower definition of personal data and a new legal basis for training AI. Neither the Council nor the Parliament has agreed a position on it, so the GDPR applies unchanged.

4. Which sectors are ahead

Ranked by binding obligations that bite on AI today, weighted by whether a supervisor with real powers is visibly using them:

Medical devices. A gatekeeper existed before AI: devices need approval before sale. The US Food and Drug Administration's public list of AI-enabled medical devices ran to 1,614 entries on 4 September 2026.
Financial services. Model risk rules, conduct rules and supervisors are already there, and they're adding AI. Singapore's guidelines apply from 2027. Canada's OSFI E-23 model risk guideline explicitly includes AI and applies from 1 May 2027. And the UK has SS1/23. Held back by the US carve-out of generative AI and the UK's choice of no new rules.
Insurance. In the US, 29 jurisdictions, 27 states plus Washington DC and Puerto Rico, had adopted the insurance regulators' model bulletin on AI by 8 October 2026. Four more states have their own insurance AI rules instead.
Consumer chatbots. Companion-chatbot laws in several US states, China's companion-AI measures, and the EU's transparency duties.
Employment. Many laws, little enforcement. New York City's law on automated hiring tools is the cautionary case. A state audit published on 2 December 2025 found the city had received "only two" complaints in two years. The city reviewed 32 companies and found "a single issue of non-compliance". The auditors found "at least 17 instances of potential non-compliance".
Public sector. Binding internal rules in places, mostly self-certified.
Critical infrastructure. Covered by technology-neutral resilience and cyber laws, with AI-specific duties mostly voluntary until the EU high-risk date.

The pattern: the sectors that are ahead already had a gatekeeper or a validation function before AI arrived. AI governance moves fastest where it can be bolted onto machinery that already exists.

5. How long until it bites

Neighbouring regimes give a rough guide, though no study measures this across regimes, so treat it as an analogy.

Data protection is the slow outlier. The OECD's privacy guidelines date from 1980. The GDPR applied from May 2018, and Ireland's first large fine under it, €225m against WhatsApp, came in September 2021: about three years from application to a big fine, and about forty from first principles.
Model risk moved faster. The US SR 11-7 guidance came in 2011. The UK's SS1/23 was effective from May 2024, about two years after its consultation, because the supervision to enforce it already existed.
Operational resilience in UK financial services took about seven years from a 2018 discussion paper to full compliance in March 2025.
EU digital operational resilience (DORA) applied from January 2025, with the first critical providers designated in November 2025: fast, again because it was built on existing supervision.

On that pattern, regimes built into existing supervision mature in two or three years, and broad new laws take much longer. That suggests AI rules will bite soonest in financial services, and that the EU's high-risk rules will produce their first material fines some years after December 2027. Two things don't transfer. AI is a technique, not a sector, so seven or more families of regulator are involved and maturity will be uneven. And unlike every earlier regime, US federal policy on AI is moving towards less regulation, not more.

Enforcement isn't waiting for AI laws anyway. It arrives through neighbouring law. Italy's data protection authority fined the company behind Character.AI €158,000 in July 2026 over privacy notices, a late impact assessment and age checks. In the US, consumer protection and privacy law are doing the same job.

6. Who's pushing which way

Pressure for less regulation has changed binding law. The EU's Omnibus delayed the high-risk rules and softened the literacy duty. Colorado repealed and narrowed its AI Act. The US carved generative AI out of its bank model guidance. These are legislative and executive changes, and they're enacted.

Pressure for more accountability has worked through courts, settlements and state legislatures. In copyright, the class action against Anthropic over the books used to train its models settled for $1.5bn, with final approval reported in July 2026. Child-safety cases against chatbot companies settled in January 2026. And the states kept legislating.

Public opinion favours regulation and has moved policy least. A 2025 Gallup survey with the Special Competitive Studies Project found 80% of Americans would keep AI safety rules even if that slowed development. Pew found 50% of Americans more concerned than excited about AI in 2025, up from 37% in 2021. Neither shows up in federal law. It shows up in state activity, and in child safety being carved out of the federal preemption proposals so far.

7. Where it's heading: three scenarios

Labelling AI-generated content is the most widely shared binding duty in the world.

A. Most of the world converges on EU-style law. For: Korea, Vietnam, Kazakhstan, Peru, Italy and Taiwan have all passed laws of that broad shape since 2025, and Brazil's draft law is similar. Against: the EU delayed its own core rules, and the US, UK, Japan, India, Canada and Australia chose not to pass a horizontal act. The Council of Europe's AI treaty has one ratification, the EU's, and isn't in force. Weakly supported.

B. Fragmented law, converging duties. The laws keep splitting by bloc, but the same core duties spread across all of them: labelling, human review of consequential automated decisions, incident reporting, and an inventory with risk tiering. For: every row of the figure above is already law somewhere. Against: a US federal law that overrides the states and adopts EU-style risk tiers, or a second EU Omnibus that guts the high-risk rules, would collapse the blocs. Strongly supported. This is the forecast with the best evidence, because its premise is already enacted; the forecast is only that it holds.

C. Supervisors and standards lead. The pressure on regulated firms comes mainly from sector supervisors and certifiable standards, not AI statutes. For: Singapore, Canada, the UK bank rules and the US insurance bulletin. Against: more AI statutes were passed in 2026, not fewer, and the EU standards aren't in force. A good description of what a bank or insurer experiences day to day; a poor description of where the law is going.

What would show B is wrong: a merits ruling that federal policy overrides state AI laws, followed by a federal statute with a single risk-tiered regime; or the EU removing the Annex III high-risk duties.

8. What an organisation has to do

Most organisations are deployers, meaning they use AI systems built by someone else. The machinery below is what the regimes have in common. Build it once, map it to each regime you're subject to, and record where they disagree.

The machinery

AI GOVERNANCE MACHINERY: WHAT MOST REGIMES ASSUME YOU HAVE

1  INVENTORY        Every AI use, tagged: your role (builder or
                    user), the countries it touches, the
                    regulatory category, the data it uses, and
                    how much it acts on its own.

2  RISK TIERING     One internal scale that maps to each
                    external one (EU tiers, bank model
                    materiality, Korea's high-impact AI).

3  HUMAN REVIEW     A route for people to get a human to look
                    at consequential automated decisions. Build
                    to the strictest (EU), record where the UK
                    and US are looser.

4  DISCLOSURE AND   Tell people when they're dealing with AI.
   LABELLING        Mark generated content with metadata plus
                    visible labels per market.

5  IMPACT           Where required (EU credit and insurance
   ASSESSMENT       pricing from Dec 2027; data protection
                    impact assessments now).

6  INCIDENTS        One process, set to the shortest clock you
                    are subject to.

7  VENDORS          Contract for the documentation each regime
                    expects your supplier to hand over, and for
                    notice when the model changes.

8  LOGS             Keep them for the longest period that
                    applies (EU deployers: at least 6 months).

9  OWNERSHIP        One named, accountable executive. Every
                    regime assumes one exists.

10 STAFF            Training before access. The EU duty is now
                    soft, but it's the cheapest evidence you
                    have governance at all.

ISO/IEC 42001, the certifiable AI management system standard, maps to most of this list. But it gives no presumption of conformity under the EU AI Act, and Colorado's new law removed the defence the old one gave for following it. Treat certification as evidence that a system works, not as compliance.

Where the regimes conflict

Bias testing. The EU AI Act, Illinois and California's employment rules expect you to test for discriminatory effects. US federal policy is moving the other way: the Justice Department's intervention in the Colorado case argues that such duties breach equal protection. Keep testing where it's required, and take advice on how to describe it in the US.
Automated decisions. The EU prohibits solely automated significant decisions, with exceptions. The UK permits them with safeguards. California and Colorado require notice and review from 2027. One human-review route built to the EU standard covers all of them.
Labelling formats. China requires visible labels plus hidden metadata; India requires permanent metadata and fast takedown; the EU's code of practice combines metadata and watermarks; California requires latent disclosures. A provenance layer plus per-market labels is the workable answer.
Federal versus state in the US. The state laws apply from 1 January 2027. Federal preemption is a litigation risk, not a defence, until a court rules.

The calendar

Now to 1 January 2027: the four US state regimes; EU marking for older generative systems (2 December 2026); labelling in China and India for those markets; Korea's operator duties.
2027: Canada's OSFI E-23 (May); Singapore's MAS guidelines, first phase (October); the EU's Annex III high-risk rules (2 December), including impact assessments for credit and insurance pricing.
2028: EU high-risk rules for regulated products (August); MAS in full (October).
Watch, not yet act: the US bank AI request for information; the citation of EN 18286; the EU GDPR changes; a merits ruling in the Colorado case.

9. Limits

The research covers five regions in depth and others in passing. It reads the law and the regulators, not inside organisations: whether any governance design produces better outcomes is unmeasured, because firms publish structures, not results. The scenario weights are judgement. The maturity analogy rests on a handful of regimes, with no study across regimes behind it. And the most volatile facts here, the US federal-state fight, the EU standards and the GDPR proposal, could change within weeks. The research is due a full re-check by 1 December 2026, when its watchlist starts to go stale.

Sources

How this was produced: research runs on 5 and 10 October 2026 that pulled primary sources and graded each claim by the strength of its evidence; on 14 October the dates and scope the argument rests on were re-checked against the primary sources below. Where only secondary reporting was available, the text says "reported" or names the reporter.

EU: Regulation (EU) 2024/1689 and Regulation (EU) 2026/1744 (EUR-Lex); European Parliament legislative resolution of 16 June 2026 (P10_TA(2026)0198); Commission AI Act enforcement page (updated 6 October 2026) and high-risk guidelines page; CEN-CENELEC on EN 18286 (31 July 2026); JTC 21 on prEN 18228; Council simplification page (reviewed 9 October 2026); Parliament procedure file 2025/0360(COD); reporting of the Commission briefing of 1 September 2026 (Allegiance Law; LexisNexis); Garante decision on Character Technologies (9 July 2026).
UK: King's Speech 2026 background briefing notes (13 May 2026); gov.uk, advisory AI Growth Lab (8 June 2026); SI 2026/82 (Data (Use and Access) Act commencement); FCA AI approach page (2 October 2026); PRA SS1/23 and LIAF01/26; Bank of England on critical third parties (10 July 2026) and SI 2026/777.
US federal: Executive Order 14365 (11 December 2025); FTC proposed policy statement (Federal Register, 7 July 2026) and press release (1 July 2026); X.AI LLC v. Weiser, 1:26-cv-01515 (D. Colo.), order of 27 April 2026; Federal Reserve SR 26-2 and OCC Bulletin 2026-13 (17 April 2026); proposed interagency third-party risk guidance (Federal Register, 15 September 2026); FDA list of AI-enabled medical devices (4 September 2026).
US states: Colorado SB 26-189 and C.R.S. 6-1-112; California CPPA on ADMT, AB 853 and SB 1000; New York S8828 and the Governor's release of 19 December 2025; Illinois Public Acts 104-0538 and 103-0804; Utah Code 63I-2-213; NY State Comptroller audit of Local Law 144 (2 December 2025); NAIC model bulletin adoption map (8 October 2026); Transparency Coalition (21 July 2026) and NYU Center on Technology Policy counts.
China and Asia: GB 45438-2025 (national standards portal); CAC measures on anthropomorphic AI interaction services and filing figures (14 September 2026); State Council 2026 legislative plan; korea.kr on the AI Basic Act (21 January 2026); Vietnam Ministry of Science and Technology (1 March 2026); Taiwan national law database; Akorda and the US Library of Congress on Kazakhstan; El Peruano on Peru's decree; Italy's Gazzetta Ufficiale (25 September 2025); MeitY consolidated IT Rules; MAS (7 October 2026); OSFI E-23.
Context and analogues (from the research runs, not re-checked on 14 October): EU AI Act penalty articles; EBA's November 2025 mapping of the AI Act against banking law; the OECD privacy guidelines; Ireland's WhatsApp decision (September 2021); SR 11-7 (2011); UK operational resilience policy (PS21/3) and compliance date; DORA designations (November 2025); the Bartz v. Anthropic settlement; Character.AI and Google settlements; Gallup and the Special Competitive Studies Project (2025); Pew Research Center (2025); Council of Europe Framework Convention on AI (CETS 225) treaty status.