21 CFR Part 11 is the FDA rule setting the conditions under which electronic records and electronic signatures are treated as equivalent to paper and ink. It requires validated systems, secure comp...
The 21st Century Cures Act is a 2016 US law whose ONC Final Rule (2020) prohibits 'information blocking' — practices that interfere with the access, exchange, or use of electronic health informatio...
Title III of the ADA prohibits discrimination in places of public accommodation, and US courts have overwhelmingly read that to reach websites and mobile apps — without any regulation specifying a ...
The Air Passenger Protection Regulations set out what Canadian air carriers owe passengers when a flight is delayed, cancelled or oversold — compensation tiers, rebooking duties, standards of treat...
AODA and its Integrated Accessibility Standards Regulation require organisations with 50 or more employees in Ontario to make their public websites and web content conform to WCAG 2.0 Level AA, and...
App Store Accountability laws move age verification from individual apps to the app stores, requiring Apple and Google to determine a user's age category, obtain verifiable parental consent for min...
APRA is Australia's prudential regulator for banks, insurers and superannuation funds, operating through binding Prudential Standards — notably CPS 234 on information security and CPS 230 on operat...
ATOL is the United Kingdom's statutory financial protection scheme for air package holidays, administered by the Civil Aviation Authority since 1973. Any business selling flight-inclusive packages ...
Australia's first standalone cyber security statute does three things: it creates mandatory security standards for smart devices, it requires businesses above a turnover threshold to report ransomw...
The Online Safety Act gives Australia's eSafety Commissioner takedown powers, Basic Online Safety Expectations and industry codes — and, since 10 December 2025, the Social Media Minimum Age obligat...
The Privacy Act 1988 is Australia's principal data-protection law, setting the Australian Privacy Principles that govern how personal information is collected, used, and disclosed. It is the privac...
The Australian Consumer Law, Schedule 2 to the Competition and Consumer Act 2010, is the national regime governing misleading conduct, unfair contract terms and consumer guarantees. Enforced by the...
The Telecommunications Act 1997 is the framework for Australian telecommunications regulation, administered by the Australian Communications and Media Authority alongside the Radiocommunications Ac...
The Bank Secrecy Act and the anti-money-laundering rules built on it require US financial institutions — including money services businesses, which is how they reach crypto firms — to identify thei...
AB 2013 requires any developer of a generative AI system made publicly available to Californians to publish, on its website, a documented summary of the datasets used to train it — sources, whether...
SB 53 is the first US law requiring public, standardised safety disclosures from developers of frontier AI models — those trained above 10^26 FLOPs. Large frontier developers must publish a frontie...
CAN-SPAM sets the United States rules for commercial email: accurate headers and subject lines, identification as an advertisement, a physical postal address, and a working unsubscribe honoured pro...
The CAP Laboratory Accreditation Program is a peer-based inspection regime holding laboratories to checklists that meet or exceed CLIA requirements, with CMS deeming authority. Its molecular pathol...
CASL is the strictest commercial-messaging law in the world — express opt-in consent, prescribed sender identification, a working unsubscribe honoured within ten business days, and penalties to CAD...
Regulation (EU) 2023/956 puts a carbon price on imports of cement, iron and steel, aluminium, fertilisers, electricity and hydrogen, requiring importers to report the greenhouse gas emissions embed...
The California Consumer Privacy Act, as amended and expanded by the California Privacy Rights Act, gives Californians rights over the personal information businesses hold about them — to know, to d...
The Consumer Financial Protection Bureau's Personal Financial Data Rights Rule, finalized in 2024 under Dodd-Frank Section 1033, requires covered financial institutions to make consumer financial d...
CLIA establishes federal quality standards for all laboratory testing performed on human specimens for diagnosis, prevention or treatment. Administered by CMS, it certifies laboratories by test com...
The UK Competition and Markets Authority's Retail Banking Market Investigation Order 2017 is the competition remedy that created UK Open Banking. It required the nine largest UK banks (the CMA9) to...
The CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F), finalized in 2024, requires impacted US payers — Medicare Advantage, Medicaid, CHIP, and ACA exchange plans — to build FHIR...
Colorado passed the first US comprehensive algorithmic-discrimination law, delayed it twice, then repealed and replaced it with a narrower automated-decision statute arriving 1 January 2027 — with ...
Australia's Consumer Data Right (CDR) is an economy-wide data-portability law that gives consumers the right to share their data with accredited third parties, beginning with banking (open banking)...
Canada's Consumer-Driven Banking framework is the federal open-banking regime legislated in the 2024 budget and fall economic statement, with the Financial Consumer Agency of Canada named as overse...
COPPA governs the online collection of personal information from children under thirteen in the United States. It requires verifiable parental consent before collection, limits retention, requires ...
Directive (EU) 2024/1760 requires large companies operating in the EU to identify, prevent, mitigate and account for adverse human rights and environmental impacts across their own operations, thei...
Directive (EU) 2022/2464 requires a large population of companies operating in the EU to report sustainability information under the European Sustainability Reporting Standards, covering climate, p...
The DUAA amends UK GDPR, the Data Protection Act 2018 and PECR, replaces the ICO with the Information Commission, and creates statutory smart-data schemes that generalise the open-banking model to ...
The Digital Markets Act designates large platforms that act as important gateways between businesses and consumers as "gatekeepers" and imposes ex-ante obligations on them — around self-preferencin...
The Digital Services Act governs how online intermediaries handle illegal content, advertising, recommendation and risk — layered by size, from every hosting provider up to the very large platforms...
The DMCC Act gives the Competition and Markets Authority a standing digital-markets regime. The CMA may designate a firm as holding Strategic Market Status in a digital activity and then impose tai...
Section 1033 of the 2010 Dodd-Frank Wall Street Reform and Consumer Protection Act gives US consumers a statutory right to access their financial data in a usable electronic form. It is the legal a...
The DOJ Data Security Program prohibits or restricts transfers of bulk US sensitive personal data and government-related data to countries of concern and to covered persons — including through ordi...
DORA is the EU regulation governing information and communication technology risk across the financial sector — banks, insurers, investment firms, payment institutions, crypto-asset providers and m...
Title II of the US Drug Quality and Security Act, requiring an interoperable, electronic, package-level traceability system for prescription drugs across manufacturers, repackagers, wholesale distr...
The Digital Technology Assessment Criteria (DTAC) is the NHS's national baseline that digital health technologies are assessed against before being adopted across the health and care system. Introd...
U-space is the European framework for managing large numbers of drones in shared airspace. It defines mandatory services — network identification, geo-awareness, flight authorisation and traffic in...
eIDAS is the EU regulation governing electronic identification and trust services — including the qualified website (QWAC) and seal (QSEAL) certificates that identify regulated third parties in ope...
eIDAS 2 amends the original eIDAS Regulation to create the European Digital Identity Wallet — a member-state-issued wallet every EU citizen and resident must be offered, and which large online plat...
The Electronic Conveyancing National Law is the uniform legislation, enacted state by state across Australia, that authorises electronic lodgement and settlement of property transactions. It establ...
The ePrivacy Directive governs privacy in electronic communications across the European Union, regulating the confidentiality of communications, traffic data, and — most relevantly for network APIs...
ESIGN is the US federal statute giving electronic signatures and records the same legal effect as their paper equivalents, and UETA is the uniform state law adopted in almost every state that does ...
The EU Artificial Intelligence Act is the world's first comprehensive, horizontal regulation of artificial intelligence — a risk-tiered regime that bans some practices outright, imposes conformity ...
Regulation (EU) 2023/1781 establishing a framework to strengthen Europe's semiconductor ecosystem — investment in first-of-a-kind facilities, a pilot-line and design infrastructure pillar, and a co...
The EU Cyber Resilience Act is the first horizontal law to impose cybersecurity obligations on products with digital elements across their whole lifecycle — secure-by-design and secure-by-default r...
The EU Data Act governs who may access and use the data generated by connected products and related services, and requires cloud and data-processing providers to enable switching between them. Unli...
The Digital Omnibus is the European Commission's simplification package amending the AI Act, GDPR, ePrivacy, the Data Act, NIS2 and DORA at once. It split in practice: the AI half was adopted and e...
IVDR replaced the IVD Directive in May 2022 and reclassified most in vitro diagnostics into risk classes requiring notified-body conformity assessment. It brings diagnostic software explicitly into...
The Machinery Regulation replaces the Machinery Directive across the EU and extends it to software that performs a safety function, machines with self-evolving behaviour, and digital documentation....
The EU Medical Device Regulation (Regulation (EU) 2017/745, MDR) governs the safety and performance of medical devices placed on the European market, and — critically for digital health — brings mu...
Regulation (EU) 2020/852 establishes a classification system defining which economic activities count as environmentally sustainable, with technical screening criteria per activity across climate m...
Regulation (EU) 2023/1115 prohibits placing specified commodities — cattle, cocoa, coffee, oil palm, rubber, soya and wood, and products derived from them — on the EU market unless they are defores...
The European Accessibility Act requires a defined set of products and services — including e-commerce, e-books, banking services and consumer digital services — to meet accessibility requirements, ...
Part 107 governs commercial small unmanned aircraft operation in the United States — pilot certification, operating limits, and the waiver and authorization process for flying beyond them. Part 89,...
The FATF Travel Rule requires originator and beneficiary information to travel alongside a transfer between regulated institutions. Extended to virtual asset service providers in 2019, it obliges c...
The United Kingdom regulates insurance through two bodies: the Financial Conduct Authority for market conduct and the Prudential Regulation Authority, part of the Bank of England, for prudential so...
The Fair Credit Reporting Act is the US law governing the collection, use, and sharing of consumer credit information, giving consumers rights to access and dispute their data held by credit report...
FERC Order 889, issued in 1996 alongside the Order 888 open-access rules, requires public utilities that own or control interstate transmission to operate an Open Access Same-Time Information Syste...
FERPA is the United States statute governing the privacy of student education records. It gives parents, and students once they turn eighteen, the right to inspect and seek correction of those reco...
The FMCSA rule requiring most commercial motor vehicle drivers to record hours of service on a certified electronic logging device rather than on paper, fully effective from December 2019. It speci...
The FDA rule implementing Section 204 of the Food Safety Modernization Act, requiring persons who manufacture, process, pack or hold foods on the Food Traceability List to keep key data elements fo...
The General Data Protection Regulation is the EU's comprehensive data-protection law (retained in the UK as the UK GDPR), governing how personal data is processed, consented to, and ported. It is t...
The Gramm-Leach-Bliley Act is the 1999 US law governing how financial institutions handle and protect consumers' nonpublic personal information, including the Privacy Rule and the Safeguards Rule. ...
GxP is the umbrella for the good-practice quality regimes governing regulated life-science work: GLP (21 CFR Part 58) for nonclinical safety studies, GCP (ICH E6) for clinical trials, GMP (21 CFR 2...
HIPAA is the 1996 US law that governs the privacy and security of protected health information (PHI). Its Privacy Rule sets the terms under which PHI may be used and disclosed and grants patients a...
The Health Information Technology for Economic and Clinical Health (HITECH) Act, enacted in 2009 as part of the American Recovery and Reinvestment Act, funded the nationwide adoption of electronic ...
Resolution 787 is the IATA industry resolution, adopted in 2012, that authorised New Distribution Capability — the XML messaging standard for airline retailing. It is not law and no regulator enfor...
Resolution 824 establishes the Passenger Sales Agency Agreement — the standard contract between IATA member airlines and accredited travel agencies, and the basis of the accreditation regime that d...
Resolution 850m governs Agency Debit Memos — the instrument by which an airline charges an accredited agency for a breach of fare rules, booking policy or distribution terms. ADMs are the enforceme...
Internet Data Exchange is the National Association of REALTORS policy framework, implemented through each local MLS's own rules, that permits participating brokers to display other brokers' listing...
BIPA requires written consent before collecting a fingerprint, faceprint, voiceprint, retina or hand scan, mandates a published retention and destruction schedule, bans selling biometric data, and ...
The International Telecommunication Union is the United Nations agency for information and communication technologies, and its Constitution, Convention and Radio Regulations form the treaty framewo...
The Lieferkettensorgfaltspflichtengesetz obliges companies above an employee threshold with a presence in Germany to conduct human rights and environmental due diligence in their own operations and...
The McCarran-Ferguson Act is the 1945 US statute that delegated the regulation of insurance to the states and exempted the business of insurance from most federal law where a state already regulate...
MiCA is the EU regulation that brings crypto-asset issuance and services inside a single authorisation regime. It covers asset-referenced tokens and e-money tokens — the stablecoins — with reserve,...
The Markets in Financial Instruments Directive II and its accompanying regulation govern investment services across the EU — including pre- and post-trade transparency obligations, the unbundling o...
The NAIC is the standard-setting and coordinating body of the United States' fifty state insurance regulators. It writes model laws and regulations that states may adopt, accredits state department...
Policy Statement 7.90 of the National Association of REALTORS' Multiple Listing Service policy requires association-owned MLSs to certify against the RESO Data Dictionary and RESO Web API within on...
The NHS Data Security and Protection Toolkit (DSPT) is an annual online self-assessment that organizations must complete to demonstrate they meet the National Data Guardian's data security standard...
NIS2 is the EU's second-generation network and information security directive, widening the scope of regulated 'essential' and 'important' entities across eighteen sectors, imposing baseline risk-m...
Ofgem's Data Best Practice Guidance sets the data obligations of Great Britain's energy network licensees. Published in November 2021 and applied through licence conditions under the RIIO price con...
The ONC Health IT Certification Program is the US voluntary-but-effectively-mandatory program under which health IT is certified against federal criteria. Its Cures Act Final Rule 'Standardized API...
Ontario Regulation 633/21, made under section 25.35.8 of the Electricity Act, 1998, requires Ontario electricity and natural gas local distribution companies to make customer energy data available ...
The Open Government Licence is the United Kingdom's standard legal instrument for releasing public sector information for reuse. Administered by The National Archives, it grants a worldwide, royalt...
OSFI is Canada's federal prudential regulator for banks and insurers, and Guideline B-13 sets its expectations for technology and cyber risk management, alongside Guideline B-10 on third-party risk...
The Package Travel and Linked Travel Arrangements Regulations 2018 implement the EU Package Travel Directive in UK law, extending long-standing package-holiday protections to modern dynamic packagi...
The Personal Health Information Protection Act (PHIPA) is Ontario's health-sector privacy law, in force since 2004 and overseen by the Information and Privacy Commissioner of Ontario. It governs ho...
PIPEDA is Canada's federal private-sector privacy law, governing how organizations collect, use, and disclose personal information in the course of commercial activity. It is the privacy backdrop a...
Tabled 15 June 2026, Bill C-36 is Canada's third attempt to replace PIPEDA — after Bill C-11 died in 2020 and Bill C-27 died on prorogation in January 2025. It would create a new Digital Safety and...
PSD2 is the European Union directive that opened bank payment accounts to licensed third parties, mandating that banks provide access to accounts (XS2A) for account-information and payment-initiati...
PSD3 (the third Payment Services Directive) and the accompanying Payment Services Regulation (PSR) are the European Union's proposed successors to PSD2, intended to fix its uneven execution — tight...
The PSTI Act and its 2023 security regime make three baseline security requirements legally binding on consumer connectable products sold in the UK: no universal default passwords, a published vuln...
Quebec's Law 25 is the province's modernization of personal-information protection, introducing consent requirements, breach notification, privacy-by-default, automated-decision transparency and a ...
The Retail Payment Activities Act is Canada's federal law bringing payment service providers under supervision by the Bank of Canada, requiring registration and operational-risk and safeguarding st...
The EU's material-compliance regime for electrical and electronic equipment — RoHS restricting hazardous substances in products, WEEE governing collection and recycling, and REACH requiring declara...
Introduced 10 June 2026, Bill C-34 would enact the Digital Safety Act and create a Digital Safety Commission of Canada — imposing safety duties, risk assessment and transparency on large online pla...
Sarbanes-Oxley requires management of US public companies to assess and attest to the effectiveness of internal control over financial reporting, with auditor attestation alongside. Sections 302 an...
SEC rules require public companies to disclose a material cybersecurity incident on Form 8-K Item 1.05 within four business days of determining materiality, and to describe their risk management pr...
Section 508 requires US federal agencies — and, through procurement rules and state adoptions, the institutions that take federal funds — to make information and communications technology accessibl...
Regulation (EU) 2019/2088 requires financial market participants and advisers to disclose how sustainability risks are integrated into investment decisions and to report principal adverse impacts a...
The SOCI Act imposes registration, mandatory incident reporting and a Critical Infrastructure Risk Management Program on responsible entities across eleven sectors — and, unusually, treats DATA STO...
SOPIPA is California's student privacy law, and the template most other US states adopted. Where FERPA regulates what a school may disclose, SOPIPA regulates the operator directly: it prohibits tar...
The Spam Act prohibits sending commercial electronic messages to Australian addresses without consent, requires accurate sender identification and a functional unsubscribe honoured within five work...
Strong Customer Authentication (SCA) is the security requirement mandated by PSD2's Regulatory Technical Standards, requiring multi-factor authentication (two of knowledge, possession, and inherenc...
TEFCA is a US framework, established under the 21st Century Cures Act and operationalized by the ONC with a Recognized Coordinating Entity, that creates a nationwide floor for health information ex...
TRAIGA took effect 1 January 2026 as an intent-based AI statute: rather than imposing risk-management duties on classes of system, it prohibits developing or deploying AI with the intent to manipul...
US law establishing a rebuttable presumption that any goods mined, produced or manufactured wholly or in part in the Xinjiang Uyghur Autonomous Region, or by entities on an associated list, are mad...
The Communications Act 2003 established Ofcom as the United Kingdom's converged regulator for telecommunications, broadcasting and spectrum. It governs licensing, competition, universal service and...
The Cyber Security and Resilience Bill is the UK's intended successor to the NIS Regulations 2018 and its answer to the EU's NIS2 — extending regulatory reach to managed service providers and data ...
The Online Safety Act imposes duties of care on user-to-user and search services with links to the UK, enforced by Ofcom with fines to 10% of global turnover and, ultimately, business disruption me...
The Smart Energy Code is the multiparty contract governing Great Britain's smart-metering infrastructure. It binds energy suppliers, network operators and other parties to a common set of technical...
UN Regulations 155 and 156, developed under UNECE WP.29, require vehicle manufacturers to operate a certified Cyber Security Management System and Software Update Management System as a condition o...
US Bureau of Industry and Security controls under the Export Administration Regulations restricting the export, reexport and in-country transfer of advanced computing chips, semiconductor manufactu...
US legislation providing approximately $52 billion in subsidies, grants and tax credits for domestic semiconductor manufacturing, research and workforce development, with conditions on recipients c...
The Communications Act of 1934, as amended by the Telecommunications Act of 1996, is the statutory basis for US telecommunications regulation and the Federal Communications Commission's authority. ...
Roughly half of US states now require age verification for access to adult content, and a growing group requires parental consent for minors' social media accounts. The Supreme Court upheld Texas's...
In the absence of a federal privacy statute, twenty US states have comprehensive consumer privacy laws in effect and twenty-four have enacted one. They converge on six rights — access, deletion, co...
Employment is where US AI regulation actually bit first. Illinois HB 3773 amends the Human Rights Act to reach AI in employment decisions; New York City Local Law 144 requires an independent annual...
A Virtual Office Website is the National Association of REALTORS policy framework permitting a broker to provide MLS listing data to consumers who have registered and established a broker-consumer ...
The My Health My Data Act regulates consumer health data held by anyone HIPAA does not cover, on an extremely broad definition that reaches inferences, biometrics, precise location near a health fa...
