ShadowAI · Free tool
AI regulation deadline tracker
Compliance deadlines for AI regulation, each carrying its own verification state. Dates get amended and repealed after publication — this tracker shows you which ones have actually been checked.
| Regulation | Effective | Applies to | What it requires |
|---|---|---|---|
| Synthetic performer disclosure in advertising New York · N.Y. Gen. Bus. Law § 396-b, as amended by L.2025 ch. 617 (S8420-A) Verified 2026-09-23 |
2026-06-09 | Any person, firm, corporation or association engaged in the business of dealing in property that makes or causes to be published, in New York, an advertisement prominently featuring a synthetic performer. It reaches advertisers wherever they are based, because the test is where the advertisement is placed before the public. | A clear disclosure in the advertisement that a synthetic performer is used. A "synthetic performer" is a digitally created asset made with generative AI or a software algorithm that creates the impression of a performance by a human performer WHO IS NOT RECOGNIZABLE AS ANY IDENTIFIABLE NATURAL PERFORMER — so this is not the deepfake rule, which covers fakes of a real person. Civil penalty $1,000 for a first violation and $5,000 for each subsequent violation. Two carve-outs matter: § 396-b(7)(a) exempts AUDIO-ONLY advertisements, and § 396-b(7)(b) exempts AI used solely for language translation of a human performer. § 396-b(8) puts no liability on the advertising medium itself. Verified 2026-09-23 against the enacted bill text and action history on the New York Assembly site (nysenate.gov is Cloudflare-gated and could not be read). Signed 2025-12-11 as Chapter 617 of 2025; § 3 reads "This act shall take effect on the one hundred eightieth day after it shall have become a law", which is 2026-06-09. ALREADY IN FORCE — this is the oldest live obligation in this tracker and the one most likely to be missed, because coverage of AI content disclosure is written almost entirely about deepfakes and this rule is the inverse. Compare the California entry: the audio carve-out here does NOT exist there, so one compliance rule does not cover both states. |
| EU AI Act — Article 50 transparency obligations European Union · Regulation (EU) 2024/1689, Article 50 (Chapter IV); application date per Article 113, second paragraph Verified 2026-08-04 |
2026-08-02 | Deployers of AI systems — an employer using AI is a deployer — as well as providers. Applies to any organisation placing AI in front of people in the EU, regardless of where the organisation is established. | Deployer duties: inform people exposed to an emotion-recognition or biometric-categorisation system that it is operating (Art. 50(3)); disclose that image, audio or video content is an artificially generated or manipulated deep fake (Art. 50(4)); and disclose AI-generated text published to inform the public on matters of public interest — UNLESS the content underwent human review or editorial control and a natural or legal person holds editorial responsibility for the publication. Providers must ensure people are told they are interacting with an AI system (Art. 50(1)) and mark synthetic output machine-readably (Art. 50(2)). All Art. 50(1)-(4) information must be given clearly and distinguishably at the latest at the time of first interaction or exposure (Art. 50(5)). Verified against the Official Journal text. Article 113 says the Regulation 'shall apply from 2 August 2026'; Article 50 sits in Chapter IV, which is NOT among the carve-outs in Article 113, third paragraph, points (a)-(d) — so it takes the general date. Regulation (EU) 2026/1744 (Digital Omnibus on AI) did NOT touch Article 50(1)-(6); it amended only Article 50(7), removing the Commission's power to approve codes of practice by implementing act. Deep-fake disclosure is reduced to a non-intrusive acknowledgment where the content is part of an evidently artistic, creative, satirical or fictional work, and the law-enforcement carve-outs in each paragraph are narrow. Do not read the 2 August 2026 date as switching on the whole AI Act — see the two high-risk entries, which were deferred. |
| CART Act — AEDT use is not a defense to a discrimination claim Connecticut · CT Public Act 26-15, amending Conn. Gen. Stat. § 46a-60 Verified 2026-07-26 |
2026-10-01 | Connecticut employers using automated employment-related decision technology, whether built in-house or bought from a vendor. | Use of an AEDT cannot be raised as a defense to a discriminatory employment practice complaint. A commission or court may still weigh evidence of anti-bias testing — its quality, efficacy, recency and scope, and what the employer did about the results. A liability rule rather than a policy clause, but it changes what a policy is worth: bias-testing and vendor-diligence records become the evidence that matters, since pointing at the vendor no longer works. |
| CART Act — WARN notice must disclose AI as a layoff cause Connecticut · CT Public Act 26-15 (Substitute Senate Bill No. 5) Verified 2026-07-26 |
2026-10-01 | Employers filing a plant-closing or mass-layoff notice with the Connecticut Department of Labor. | The WARN notice must state whether the layoffs relate to the employer's use of artificial intelligence or other technological change. The earliest of the Act's employer deadlines, and the one least likely to be on an employer's radar because it only bites during a reduction in force. Arrives a full year before the AEDT notice duty that most coverage leads with. |
| EU AI Act — new prohibited practices, and marking deadline for pre-existing generative systems European Union · Regulation (EU) 2024/1689, Article 5(1)(ba), (bb) and Article 5(1a), (1b), and Article 111(4), as inserted by Regulation (EU) 2026/1744, Articles 1(7) and 1(39)(b); dates per Article 113(3)(a) as amended by Article 1(40)(a) Verified 2026-08-04 |
2026-12-02 | Anyone placing on the market, putting into service, or USING the AI systems concerned — the use limb reaches employers and their staff. The separate marking deadline falls on providers only. | Two distinct things on the same date. (1) New prohibitions: AI systems that generate or manipulate realistic intimate imagery of an identifiable person without that person's explicit consent, or that generate child sexual abuse material. For USE, the prohibition bites where the deployer uses the system for the purpose of generating such material — which is the limb an employer's acceptable-use policy should reflect. (2) Providers of systems generating synthetic audio, image, video or text that were placed on the market before 2 August 2026 must comply with the Article 50(2) machine-readable marking obligation by this date. Verified against the Official Journal text of Regulation (EU) 2026/1744 (OJ L 2026/1744, 24.7.2026). Article 113(3)(a) as amended reads: 'Chapters I and II shall apply from 2 February 2025, with the exception of Article 5(1), first subparagraph, points (ba) and (bb), and Article 5(1a) and (1b) which shall apply from 2 December 2026'. Note the asymmetry the statute draws: placing on the market is prohibited only where such generation is the system's intended purpose or a reasonably foreseeable and reproducible outcome without adequate safeguards, whereas USE is prohibited only where the deployer's purpose is to generate that material. The item (2) marking deadline is a PROVIDER obligation and is listed only so the shared date is not misread as an employer duty. |
| Colorado Automated Decision-Making Technology Act Colorado · Colorado SB 26-189 (repeals and reenacts the Colorado AI Act, SB 24-205) Verified 2026-07-26 |
2027-01-01 | Developers and deployers of automated decision-making technology that materially influences a consequential decision. | Consumer notice, an explanation when there is an adverse outcome, meaningful human review, and developer documentation. CORRECTED 2026-07-26 — an earlier draft cited SB 24-205 and described a duty of reasonable care plus mandatory impact assessments. That law never took effect: it was repealed and reenacted by SB 26-189, signed 2026-05-14. The duty of care, mandatory impact assessments and the risk-management-program requirement were REMOVED; what replaced them is a narrower transparency and human-review regime. This statute has now moved three times (2026-02-01 → 2026-06-30 → repealed → 2027-01-01), so re-check before relying on it. |
| California CCPA regulations — automated decisionmaking technology (ADMT) California · Cal. Code Regs. tit. 11, §§ 7200, 7220–7222; compliance date per § 7200(b); “significant decision” defined at § 7001(ddd); approved by the Office of Administrative Law 2025-09-23 Verified 2026-09-07 |
2027-01-01 | Any CCPA “business” that uses ADMT to make a significant decision about a California consumer. “Significant decision” is defined as one resulting in the provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services — so ordinary hiring, promotion and pay decisions are in scope. Because California’s employment-data exemption sunset, applicants and employees count as consumers here. The revenue limb of the “business” test is $26,625,000 in annual gross revenue (Civil Code § 1798.140(d)(1)(A), as CPI-adjusted effective 2025-01-01). | A pre-use notice (§ 7220), the ability to opt out of the ADMT (§ 7221), and the right to access information about how the ADMT was used (§ 7222). Verified 2026-09-07 against the adopted regulation text, not the agency press release. Two points that secondary coverage routinely flattens. First, appeal to a human is NOT a fourth standalone right sitting alongside the other three: under § 7221(b)(1) it is an EXCEPTION that removes the opt-out duty, and it qualifies only if the reviewer is designated, knows how to interpret the ADMT output, and has authority to overturn the decision. Build the appeal route and you need not build the opt-out; build neither and you are exposed. Second, § 7200(b) splits by when use began: a business already using ADMT for a significant decision before 2027-01-01 must be compliant by that date, while one that starts on or after it must be compliant from the moment it starts — there is no grace period for a new deployment. Response timelines come from § 7021: acknowledge within 10 business days, respond within 45 calendar days. |
| Colorado Conversational AI Service Operator Requirements (“Chatbot Safety Act”) Colorado · Colorado HB 26-1263, ch. 208, adding C.R.S. § 6-1-1708 and definitions at § 6-1-1701(3.5); approved by the Governor 2026-05-29 Verified 2026-09-07 |
2027-01-01 | Operators of a “conversational artificial intelligence service” — an AI system accessible to the general public that primarily simulates human conversation through adaptive textual, visual or aural communication. Read the exclusions before assuming this applies to you: § 6-1-1701(3.5)(b) carves out, among others, services primarily designed to provide commerce-related or transactional assistance “including product or service recommendations, shopping, ordering, payments, delivery, returns, customer support, or customer service”; services primarily designed and marketed for commercial use by business entities for business operations, productivity, information analysis, internal research, training or technical assistance; and anything “used by a business solely for internal purposes.” | On and after 2027-01-01: disclose clearly and conspicuously that the service is AI, at the start of the first interaction each day, again at least once every three hours in a continuous interaction (or as a persistent visible disclosure), and whenever a user asks whether they are talking to a human (§ 6-1-1708(3)); estimate user age; apply the minor-specific duties; run a suicide and self-harm protocol including referral to a crisis service (§ 6-1-1708(4)); and stop representing outputs as provided by, endorsed by, or equivalent to a licensed professional (§ 6-1-1708(5)). Separately, on and after 2027-07-01 an operator must report annually to the Attorney General on crisis referrals issued in the preceding calendar year and the protocols behind them (§ 6-1-1708(6)). Verified 2026-09-07 against the enacted session law. Two cautions. The exclusions above do most of the work for an ordinary employer: a customer-service chatbot and an internal AI assistant are both named carve-outs, so most mid-size companies are OUT of scope for this statute even though widely-read coverage describes it as applying to any public chatbot. Do not confuse this with the EU AI Act Article 50 disclosure duty, which is already in force, has no equivalent customer-service carve-out, and is tracked separately. Also note the act itself took effect 2026-08-12 (ninety days after sine die) but every operative duty is written “on and after January 1, 2027”, so nothing is owed during 2026 — the same effective-date-versus-duty-date split this tracker already had to correct once for Connecticut. The 2027-07-01 report covers the preceding calendar year, so the counting has to be running from 2027-01-01. |
| Synthetic performer disclosure in advertising (SB 1050) California · Cal. Bus. & Prof. Code § 17610 (Stats. 2026, ch. 246; SB 1050, Ashby) Verified 2026-09-23 |
2027-01-01 | Any person who creates and causes to be published in an advertising medium an advertisement that prominently includes a synthetic performer, where the advertisement is made available to consumers in California. Separately, an advertising medium that has been served with a qualifying court order. | A clear and conspicuous disclosure that the advertisement includes a synthetic performer, using wording substantially similar to "this performance features a synthetic performer" or "no human performer is depicted" (§ 17610(c)). "Advertisement" covers any AUDIO, video or audiovisual message, and "prominently" expressly includes a synthetic performer "providing or voicing the on- or off-camera narration or commercial message" (§ 17610(a)(5)(B)) — so an AI voiceover over ordinary footage is in scope. A violation is a violation of § 17500 and is enforceable under the Unfair Competition Law, § 17200 (§ 17610(f)). Carve-outs: advertisements for expressive works where the synthetic use matches the work (§ 17610(d)(4)), and AI used solely for language translation or accessibility (§ 17610(d)(5)). Verified 2026-09-23 against the chaptered text on leginfo. Approved by the Governor and filed with the Secretary of State 2026-09-16. The effective date is DERIVED, not stated: the chaptered text contains no urgency clause and no operative-date section (searched for "take effect", "urgency" and "operative" — no matches), so the default in Cal. Const. art. IV, § 8(c) applies and a statute of the 2026 regular session takes effect 2027-01-01. California is the SECOND state to do this, after New York, and the two do not match — New York exempts audio-only advertisements and California expressly covers audio. A company that built one rule for New York under-complies here from 2027-01-01. |
| Cal/WARN — layoff notice must disclose AI displacement (SB 951) California · Cal. Lab. Code § 1401(d) (Stats. 2026, ch. 860; SB 951, Reyes) Verified 2026-10-05 |
2027-01-01 | Employers that own and operate a Cal/WARN "covered establishment" — a facility that employs, or has employed in the preceding 12 months, 75 or more persons (§ 1400.5(b)) — when giving notice of a mass layoff, relocation or termination. | Where the layoff, relocation or termination is caused "in whole or in substantial part" by an AI system or other automated technology replacing or automating positions, the 60-day notice must additionally state: the number, classification or occupation, and work location of the affected layoffs; the job functions that will be automated; and the specific category or type of AI or automating technology responsible (§ 1401(d)(1)(A)-(C)). The notice must carry the statement "This notice is for a technology displacement" at the top (§ 1401(d)(1)(D)). The Employment Development Department publishes a summary of these notices and a quarterly statewide summary (§ 1401(d)(2)), so the disclosure becomes public. Verified 2026-10-05 against the chaptered text on leginfo. Approved by the Governor and filed with the Secretary of State 2026-09-30. The effective date is DERIVED: the text has no urgency clause and no operative-date section, so the Cal. Const. art. IV, § 8(c) default of 2027-01-01 applies. California's counterpart to Connecticut's WARN amendment (ct-pa-26-15-warn, live 2026-10-01), but it asks for more — the functions and the type of system, not a yes/no. |
| Ban on AI emotion recognition and neural-data collection at work (AB 1883) California · Cal. Lab. Code §§ 1580–1583 (Stats. 2026, ch. 853; AB 1883, Bryan) Verified 2026-10-05 |
2027-01-01 | Any employer of California employees, including public employers, labor contractors, and client employers that contract with a labor contractor (§ 1580(d)). No headcount floor. | An employer may not use a workplace surveillance tool that uses AI on employees to recognise, or make inferences or predictions about, an individual's emotional state, or to collect neural data (§ 1581(a)). "Workplace surveillance tool" is broad — any system that collects employee data, communications, biometrics or behaviour other than by direct human observation, including video and audio surveillance and continuous time-tracking (§ 1580(g)). Use of a tool to ensure safety is not prohibited (§ 1581(b)). Up to $500 per violation, recoverable as a statutory penalty to the employee or a civil penalty, not both (§ 1582(d)); Labor Commissioner and public-prosecutor enforcement. Verified 2026-10-05 against the chaptered text on leginfo; signed 2026-09-30. Effective date DERIVED from the Cal. Const. art. IV, § 8(c) default — no operative-date clause. The ordinary case it reaches is call-centre or sales-coaching software that scores an agent's mood, sentiment or stress. The EU has prohibited AI emotion inference in the workplace since 2025-02-02 (Reg. (EU) 2024/1689, Art. 5(1)(f)); the two safety carve-outs are worded differently, so clearance in one jurisdiction does not carry to the other. |
| No Robo Bosses Act — human corroboration before AI-assisted discipline or termination (SB 947) California · Cal. Lab. Code §§ 1520–1526.7 (Stats. 2026, ch. 859; SB 947, McNerney) Verified 2026-10-05 |
2027-07-01 | Any employer of California employees, including public employers and labor contractors (§ 1520(d)(3)). No headcount floor. A collective bargaining agreement can waive it only expressly and only if it also protects against algorithmic management (§ 1526.5). | No relying SOLELY on an automated decision system (ADS) for a disciplinary or termination decision (§ 1522(b)(1)). Where the employer relies PRIMARILY on one, a human must corroborate the decision using the underlying data or other supporting information — supervisory evaluations, personnel files, work product, peer reviews, witness interviews (§ 1522(b)(2)); if it cannot be corroborated, or the reviewer finds the output inaccurate, incomplete or misleading, the output may not be used (§ 1522(c)). The employee gets a written, plain-language, stand-alone post-use notice at the time they are told of the decision (§ 1524), and may request a description of their own data the ADS used (§ 1522(d)). No using an ADS to infer protected status or to predict and punish the exercise of legal rights (§ 1522(a)). Once ADS use is shown, the EMPLOYER must prove it did not primarily rely on it or that it complied (§ 1526.1(c)). $500 per violation (§ 1526.1(e)), plus injunctive relief, punitive damages and fees. Verified 2026-10-05 against the chaptered text on leginfo; signed 2026-09-30. The date is STATED, not derived: "This part shall become operative on July 1, 2027" (§ 1526.7). The burden shift in § 1526.1(c) is the clause that changes behaviour — the review record becomes the employer's only defence. A CCPA-covered business stays subject to the CPPA's ADMT regulations as well (§ 1526.4; see ca-ccpa-admt). A 2025 predecessor (SB 7) was vetoed; this version dropped its advance-notice duty. |
| CART Act — developer information-sharing obligations Connecticut · CT Public Act 26-15 § 8 (Substitute Senate Bill No. 5) Verified 2026-07-30 |
2027-10-01 | Developers of an automated employment-related decision technology deployed in Connecticut on or after October 1, 2027, where the technology was advertised, marketed, configured, contracted for, sold or licensed to materially influence an employment-related decision. | Provide the deployer with all information the deployer needs to perform its own duties under §§ 9 and 10. A developer may instead contract to assume the deployer's §§ 9-10 duties outright, and that contract must state clearly which duties it takes on. A trade-secret carve-out (§ 11) limits what must be handed over, but the withholder must notify the other party that it is withholding and why. CORRECTED 2026-07-30 against the enacted text. This entry previously read 2026-10-01 and described itself as "the CART Act date that actually falls in 2026" — that conflated the section's effective date with the date its duty attaches. § 8 is indeed "(NEW) (Effective October 1, 2026)", but the duty it creates runs only to a technology "deployed in the state on or after October 1, 2027", so no developer owes anything under it during 2026. Same drafting pattern as §§ 9 and 10. The dates that genuinely bite in 2026 are the WARN disclosure (§ 26) and the no-defense rule amending § 46a-60, both tracked separately. Enforcement (§ 12) is Attorney-General-only as a CUTPA unfair trade practice, and for violations on or before 2027-12-31 the AG may first issue a notice of violation with 60 days to cure. |
| Connecticut AI Responsibility and Transparency Act (CART Act) — employer AEDT duties Connecticut · CT Public Act 26-15 (Substitute Senate Bill No. 5) Verified 2026-07-26 |
2027-10-01 | Employers deploying automated employment-related decision technology (AEDT) in Connecticut. | Before an employment-related decision in which an AEDT is a substantial factor, written notice disclosing the use and purpose of the AEDT, its trade name, the categories and sources of personal data used, how that data is assessed, and employer contact information. A separate interaction disclosure applies when a person is dealing with automated technology. CORRECTED 2026-07-26 — an earlier draft of this entry dated the employer disclosure duty 2026-10-01, which is wrong. The Act splits its dates: 2026-10-01 starts DEVELOPER information-sharing obligations and the trade-secret carve-out; the employer-facing interaction disclosure and pre-decision notice duties begin 2027-10-01. Signed by Governor Lamont 2026-06-02. Developers may contractually assume the employer's disclosure duty, which makes vendor contracts the early compliance lever. |
| EU AI Act — high-risk obligations, standalone systems (Annex III) — DEFERRED European Union · Regulation (EU) 2024/1689, Chapter III, Sections 1, 2 and 3 (except Article 6(5)), for systems classified high-risk under Article 6(2) and Annex III; date per Article 113(3)(c)(i) as replaced by Regulation (EU) 2026/1744, Article 1(40)(b) Verified 2026-08-04 |
2027-12-02 | Providers and deployers of standalone high-risk AI systems under Annex III — for employers, most relevantly AI used in recruitment, promotion and termination decisions, access to education, and access to essential public and private services including credit. | The full high-risk regime: risk management, data governance, technical documentation, record-keeping and logging, transparency to deployers, human oversight, accuracy and robustness, conformity assessment, and the deployer-side obligations in Article 26. DEFERRED — this date moved LATER, from the original 2 August 2026. Verified against the Official Journal text of Regulation (EU) 2026/1744, which replaces Article 113(3)(c) with: 'Chapter III, Sections 1, 2, and 3, with the exception of Article 6(5), shall apply from: (i) 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III'. Recital 40 gives the reason: delayed standards, common specifications and national competent authorities. Because the deferral is a RELAXATION, an employer adopting high-risk controls today is going beyond what is currently required — sensible preparation, but it should not be presented as a present legal obligation. |
| California CCPA regulations — privacy risk assessments California · Cal. Code Regs. tit. 11, §§ 7150, 7155, 7157; backstop date per § 7155(b); submission date per § 7157(a)(1) Verified 2026-09-07 |
2027-12-31 | Any CCPA “business” whose processing presents significant risk to privacy under § 7150(b) — which expressly includes using ADMT for a significant decision, selling or sharing personal information, and processing sensitive personal information. Processing employees’ sensitive data solely for payroll, employment authorization, benefits, legally required accommodation or wage reporting is carved out; other processing of sensitive data is not. | Conduct and document a risk assessment. Then submit an attestation and a summary to the Agency by 2028-04-01 for assessments conducted in 2026 and 2027 (§ 7157(a)(1)). The single date on this entry is a BACKSTOP, not a start. Under § 7150(a) the assessment must be conducted BEFORE initiating qualifying processing, so for anything new this obligation is already live. The 2027-12-31 date comes from § 7155(b) and applies only to qualifying processing that began before 2026-01-01 and continues after it. Listed because a company that reads only the ADMT entry will date its whole California programme to 2027-01-01 and miss an obligation that already attaches to new processing. |
| EU AI Act — high-risk obligations, AI embedded in regulated products (Annex I) — DEFERRED European Union · Regulation (EU) 2024/1689, Chapter III, Sections 1, 2 and 3 (except Article 6(5)), for systems classified high-risk under Article 6(1) and Annex I; date per Article 113(3)(c)(ii) as replaced by Regulation (EU) 2026/1744, Article 1(40)(b) Verified 2026-08-04 |
2028-08-02 | Providers and deployers of AI that is a safety component of, or is itself, a product covered by the Union harmonisation legislation in Annex I — machinery, medical devices, lifts, toys, and similar. | The same Chapter III high-risk regime as the Annex III entry, aligned to the conformity-assessment route of the underlying product legislation. DEFERRED — verified against the Official Journal text of Regulation (EU) 2026/1744: Article 113(3)(c)(ii) now reads '2 August 2028 as regards AI systems classified as high-risk pursuant to Article 6(1) and Annex I'. Least likely of the four EU entries to affect a general employer; included so the two high-risk tracks are not conflated, since they carry different dates. Separately, Article 111(2) as amended gives providers and deployers of high-risk AI intended for use by public authorities until 2 August 2030. |
This tracker is deliberately short. Entries are added only once the effective date has been checked against the enacted text — not assembled from secondary coverage.
Why this list is short on purpose
AI regulation is being written faster than it is being finalised, and the gap between "announced" and "in force" is where most compliance content goes wrong. Deadlines slip. Statutes get amended before they bite. At least one widely-reported state AI deadline was repealed and moved a full year after a great deal of guidance had already been published against the original date — including, briefly, on this site.
So the rule here is simple: a date appears on this page only when someone has read the current enacted text, and it carries the date that check happened. A short list you can trust is worth more than a comprehensive one you have to re-verify yourself.
What to do regardless of jurisdiction
Almost every AI regulation now in force or in progress asks for some combination of the same four things, and none of them depend on knowing your exact deadline:
Know what you are using. An inventory of AI tools in use, including the ones nobody approved. Most obligations attach to systems you must first be able to name.
Know what it decides. The obligations bite hardest where AI touches employment, credit, housing, insurance and healthcare. Ordinary productivity use is regulated far more lightly.
Tell people. Disclosure duties — to candidates, customers, or employees — are the most common single requirement across jurisdictions and the easiest to retrofit.
Write it down. A policy, an approval route, and evidence that staff acknowledged it. Documentation is what turns a defensible position into a provable one.
A policy covers the four things every AI regulation asks for
ShadowAI publishes a complete AI acceptable-use policy — the tool inventory and tiering, the approval route, the disclosure and confidentiality sections, and the signed acknowledgement.
Get the AI policy template — $79 Check your current policy freeHome · AI tool directory · Risk index · Vendor check · Exposure estimator · Regulation deadlines · Policy gap check
ShadowAI publishes AI governance policy templates. This page is general information about vendor terms and AI regulation, not legal advice — verify against the vendor's current terms and your own counsel before relying on it.