The AI rules that apply to you, and the systems they touch.
GhostAudit tracks 15 AI laws, executive actions and standards. Each one is checked against its official text, broken into obligations with dates, and mapped to the systems in your inventory that it affects.
The tracker's current contents. Statuses and dates are the product's reference data, last verified 10 November 2026.
| Law, order or standard | Jurisdiction | Status | Next date |
|---|---|---|---|
| EU AI Act | European Union | Partially applicable | 2 Dec 2026 |
| Colorado ADMT Act | Colorado | Enacted, not yet effective | 1 Jan 2027 |
| Colorado Chatbot Act | Colorado | Enacted, not yet effective | 1 Jan 2027 |
| NYC LL 144 | New York City | In force | None scheduled |
| Illinois HB 3773 | Illinois | In force | None scheduled |
| Texas TRAIGA | Texas | In force | None scheduled |
| California SB 53 | California | In force | None scheduled |
| CPPA ADMT Regulations | California | Partially applicable | 1 Jan 2027 |
| Utah AI Policy Act | Utah | In force | None scheduled |
| NY RAISE Act | New York State | Enacted, not yet effective | 1 Jan 2027 |
| EO 14365 (State AI law preemption) | United States (federal) | Executive action in effect | None scheduled |
| Federal AI bills (watch) | United States (federal) | Proposed, watch | None scheduled |
| Korea AI Basic Act | South Korea | In force | None scheduled |
| NIST AI RMF | United States (federal) | Voluntary framework | None scheduled |
| ISO/IEC 42001 | Global | Voluntary framework | None scheduled |
Verified against the source, with the source linked.
AI regulation in 2026 moved faster than most summaries of it. The EU's Digital Omnibus postponed the AI Act's high-risk obligations. Colorado repealed and replaced its AI Act before it took effect. Articles written a year ago are wrong in ways that matter.
Each entry in the tracker is checked against the official publication and carries a link to it. Entries that could not be verified are left out. Proposals are labelled as proposals and never presented as law: the tracker lists pending federal bills in the United States as a watch item with no obligations.
Every regulation is split into obligation tracks, because laws rarely apply all at once. The EU AI Act has seven tracks in GhostAudit, from AI literacy (2 February 2025) to high-risk systems in regulated products (2 August 2028).
- Applies nowAI literacy measures (Art. 4)
Take measures to support the development of AI literacy of staff and others dealing with AI systems on your behalf. Since the Omnibus (27 Jul 2026) this is a duty to take supporting measures, not to guarantee a level of literacy.
- Applies nowProhibited practices screening (Art. 5)
Screen AI uses in sensitive contexts against the Art. 5 prohibitions (e.g. emotion recognition in the workplace, social scoring, untargeted facial-image scraping).
- Applies nowGeneral-purpose AI model provider obligations
Technical documentation, copyright policy and training-data summary for providers of GPAI models. Deployers of third-party models are not GPAI providers.
- Applies nowTransparency obligations (Art. 50)
Disclose AI interaction to people, label deepfakes and AI-generated text published on matters of public interest; providers must mark synthetic output.
- UpcomingArt. 50(2) marking grace period ends for legacy generative systems
Providers of generative systems placed on the market before 2 Aug 2026 must implement machine-readable marking of output by 2 Dec 2026 – confirm your image/video/audio generation vendors comply. New prohibitions on AI generating non-consensual intimate imagery or CSAM also apply from this date.
- UpcomingHigh-risk systems – Annex III use cases
Stand-alone high-risk uses (employment, credit, education, essential services, biometrics): provider conformity + deployer duties (human oversight, logging, monitoring, FRIA for some deployers).
- UpcomingHigh-risk systems – Annex I (AI in regulated products)
AI that is a safety component of products under EU harmonisation legislation (e.g. medical devices).
Mapped to your inventory, with the rule that matched.
A list of laws tells you little until you know which of your systems each one reaches. GhostAudit works that out from your inventory: the jurisdictions you operate in, and the attributes of each system, such as whether it is used in employment, makes consequential decisions about people, interacts with customers or generates synthetic media.
Every match shows why it matched. "Employment use" on a candidate-screening tool is a direct match. A general assistant used by people in the HR department is a potential match, shown separately until someone confirms whether it is used for hiring decisions.
You set your regulatory profile, the jurisdictions you are exposed to and whether you develop frontier or general-purpose models, and the tracker hides what does not concern you.
- Direct and potential matches, each with its reason
- Deadlines per obligation, in a calendar and on the dashboard
- A regulatory profile so that out-of-scope laws stay out of the way
Example workspace. Names and figures are illustrative.
- Vendor
- HireVue
- Owner
- People operations · A. Moreau
- Purpose
- Ranks applicants for customer-support roles against the posted requirements
- Affects
- Job applicants in the EU, New York City and Colorado
- Data
- Restricted · personal data
- Human oversight
- Recruiter reviews every ranked list before contact
- Risk tier
- High
- Last assessed
- 6 Nov 2026 · next review in 90 days
- EU AI Act · Annex III high risk · matched on employment useFrom 2 Dec 2027
- NYC Local Law 144 · matched on employment useIn force
- Colorado SB 26-189 · matched on consequential decisionFrom 1 Jan 2027
New publications from official sources, classified and linked.
Alongside the curated tracker, GhostAudit pulls new publications from the Federal Register, the European Commission, the White House, NIST and GOV.UK. Each item is classified by topic and linked to the laws and the systems it relates to.
This is a feed of primary sources, so that the first thing you read about a change is the change itself. The feed is refreshed automatically every six hours. When something affects a system you own, you are notified.
- UpcomingADMT point-of-interaction notice
Clear and conspicuous notice before covered ADMT materially influences a consequential decision; a prominent public notice at the point of interaction is sufficient.
- UpcomingPost-adverse-outcome disclosure (30 days)
Within 30 days of an adverse outcome: plain-language description of the decision and the ADMT's role, how to request more information, and the consumer's rights.
- UpcomingCorrection and meaningful human review
On request after an adverse outcome: instructions to obtain and correct personal data, and meaningful human review and reconsideration to the extent commercially reasonable.
- UpcomingThree-year record keeping
Keep records reasonably necessary to demonstrate compliance for at least three years after each consequential decision.
Orientation, with its limits stated.
The tracker covers 15 instruments today: the EU AI Act; laws and regulations in Colorado, California, New York State, New York City, Illinois, Texas and Utah; a US executive order and pending federal bills; South Korea's AI Basic Act; NIST AI RMF and ISO/IEC 42001. It is not a complete register of every AI rule in the world, and sector rules such as financial or medical regulation are outside it.
Summaries are written for orientation and are not legal advice. They are a way to arrive at the official text knowing what to look for, and to brief counsel with a specific question.
What is tracked
Reference data last verified on 10 November 2026.
- EU AI Act
- European Union. Partially applicable. Official source.
- Colorado ADMT Act
- Colorado. Enacted, not yet effective. Official source.
- Colorado Chatbot Act
- Colorado. Enacted, not yet effective. Official source.
- NYC LL 144
- New York City. In force. Official source.
- Illinois HB 3773
- Illinois. In force. Official source.
- Texas TRAIGA
- Texas. In force. Official source.
- California SB 53
- California. In force. Official source.
- CPPA ADMT Regulations
- California. Partially applicable. Official source.
- Utah AI Policy Act
- Utah. In force. Official source.
- NY RAISE Act
- New York State. Enacted, not yet effective. Official source.
- EO 14365 (State AI law preemption)
- United States (federal). Executive action in effect. Official source.
- Federal AI bills (watch)
- United States (federal). Proposed, watch. Official source.
- Korea AI Basic Act
- South Korea. In force. Official source.
- NIST AI RMF
- United States (federal). Voluntary framework. Official source.
- ISO/IEC 42001
- Global. Voluntary framework. Official source.
- Plans
- The tracker and feed are part of Govern and Enterprise. See pricing.
Questions
- How often is the tracker updated?
The curated entries are reviewed against official sources and carry a last-verified date, currently 10 November 2026. The news feed refreshes from its sources every few hours.
- Is this legal advice?
No. It is a maintained summary with links to the official texts, and a mapping to your systems that shows its reasoning. Decisions about your obligations should involve your counsel.
- What if a law we care about is missing?
Tell us at the contact page. We add instruments when we can verify them against an official source.
See what is in use before you decide anything.
Start a 14-day trial with every Govern feature, connect one discovery source and enroll a handful of devices. No card is needed to start, and nobody is asked to change how they work.