Global AI laws can change daily. Your coding agent was trained last year.
Are your applications designed and built for current AI laws and responsible use?
Your coding agent does the review. TwinEthos supplies machine-readable law and suggested guards.
TwinEthos is a maintained semantic cognitive layer for global AI law, delivered over MCP. Your agent asks which rules and detectors apply to the repository, inspects the code itself, and cites the exact provision behind each finding.
Explore our global AI laws, rules and suggested guards.
For informational purposes only. Content on this site is not legal or compliance advice.
What's new in AI law for applications
- European UnionEU Consumer Credit Directive (EU) 2023/2225, Art. 18 (automated creditworthiness assessment)Automated credit assessment: explain on request its logic, risks, significance and effects on the decisionOpen in explorer
- United States (federal)FCC Declaratory Ruling FCC 24-17 (AI voices under the TCPA; 47 U.S.C. 227, 47 CFR 64.1200)Give AI-voice telemarketing calls an automated opt-out that records the do-not-call request and ends the callOpen in explorer
- ChileChile Law 21.719 (new Art. 8 bis of Law 19.628)Automated individual decisions: right to object, information, explanation, human intervention, the person's view and reviewOpen in explorer
- European UnionEU AI ActAI generating non-consensual intimate imagery or CSAM is prohibitedOpen in explorer
- MarylandMaryland HB 895 (2026 Md. Laws ch. 154; Com. Law 13-321)Food retailers and delivery services must not use protected class data to offer or sell in a way that withholds an advantage from a consumerOpen in explorer
- ConnecticutConnecticut CART Act (PA 26-15)Large GenAI providers must embed tamper-resistant provenance dataOpen in explorer
- AlabamaAlabama SB 63 (2026; AI in health-plan prior-authorization determinations)Patient data used by AI in utilization review may not be used beyond its intended and stated purposeOpen in explorer
- CaliforniaCalifornia SB 942GenAI providers must embed latent provenance disclosure in synthetic mediaOpen in explorer
- European UnionEU Cyber Resilience Act (EU) 2024/2847, as applied to AI (AI-adjacent: software bill of materials listing AI components)List the product's AI components in its software bill of materialsOpen in explorer
- SomaliaSomalia Data Protection Act (Sharciga Dhowrista Xogta Dadweynaha), 2023, Art. 23No solely automated decision with a legal effect unless contract, a law with safeguards or consentOpen in explorer
- BarbadosBarbados Data Protection Act, 2019 (Act 2019-29), s. 18No solely automated decision with legal or similar effects outside the contract, enactment and consent exceptionsOpen in explorer
- MalawiMalawi Data Protection Act, 2024 (Act No. 3 of 2024), s. 25Solely automated decisions with legal or similar effects: only on an exception, then with safeguardsOpen in explorer
Data as of
How it works
TwinEthos gives your application or agent a current, citable map of global AI law as well as responsible practices — citing the exact provision, including laws newer than today's AI models, and suggesting the guards to add.
Build
Write or review code
Your code agent
Code analysis & AI patternsRequest MCP/API access
Reads your code, picks out the AI patterns it uses and the markets you serve, and calls TwinEthos MCP to ask what applies: Claude Code, GitHub Copilot, Cursor or any agent that connects over MCP.
Use it while you write code, so the guards go in from the start, or when you review a pull request. Each result names the file and line, the exact provision, its lane and the guard to add:
Binding law — in forceBinding law — not yet in force or stayedStandard / soft lawBest practice (not law)TwinEthos recommendation (not law)
The full server needs an API key: Request MCP access.
Ask
Connector or plugin
Your Claude, ChatGPT
Ask questions about AI lawsAdd the connector or plugin
Add TwinEthos Lite once, as a connector in Claude or a plugin in ChatGPT: TwinEthos in AI assistants. Then ask questions about AI laws: each answer names the rule, who it applies to, when it applies and the exact provision, with its official link. Questions to try:
- Which AI laws apply to a customer-support chatbot used in California and the EU?
- What does the EU AI Act require of a chatbot, and from when?
- What AI rules come into force in the next six months for hiring tools in the US?
TwinEthos MCP
9 tools
Lite: 5 tools, free
TwinEthos MCP serves the context data layer, read-only: the same question gets the same rules from the same data.
With an API key, 9 tools return what to look for in code: file globs, SDK calls, data flows, settings and missing artifacts. Your coding agent uses them to find the files and lines to check. TwinEthos never receives your code. Request MCP access.
TwinEthos Lite, free with no sign-in: 5 tools (search AI laws, explain a rule, plan the guards, AI law coming into force and AI law recently in force). Answers are capped and calls are rate limited. Lite reads only TwinEthos's own data and changes nothing.
TwinEthos
Context data layer
Behind both
1
Global AI laws
317 laws, regulations and standardsLaws, regulations and standards retrieved from official sources:
- 317instruments
- 20,000+pages
- 27languages
- 87countries
- 134jurisdictions
Every week we re-check the official text and look for new laws, and dates coming into force are watched daily. Where an official site blocks automated checks, it is checked by hand. A change feed tells you when a rule touching your controls changes.
The data was last updated 13 Nov 2026. Every change to a provision is recorded with its date.
2
Rules and guards
649 citable rules from binding lawRules extracted from binding law:
- 649rules from binding law
- 407from AI laws in 62 jurisdictions
- 242from privacy and biometric laws where AI data flows trigger them
Each rule specifies who it applies to and the exact provision to cite, quotes the official text (checked by hash), and includes what to scan in code and suggested guards to add for your agent. Every rule carries one of five lanes:
Binding law — in forceBinding law — not yet in force or stayedStandard / soft lawBest practice (not law)TwinEthos recommendation (not law)
3
Cognitive layer
Patterns, markets, controls and lanes- Maps each provision to the code it touches. Not whole laws, and not one law at a time: across jurisdictions worldwide, international and US, each rule names the provision, who it applies to, and the files, SDK calls, data flows and missing artifacts that trigger it, with the guard to add.
- Knows when a law doesn't apply. Who is covered, which uses are excluded, which kinds of systems are in scope — so a companion-chatbot law isn't applied to your support bot.
- Separates law from advice. Every answer carries one of five lanes: law in force, law enacted but not yet in force (with its date), standards and frameworks, best practice, and TwinEthos recommended guardrails — clearly labeled as our opinion.
How we tested
Blind, paired tests: the same reviewer with and without TwinEthos, scored by a separate Claude Opus judge that does not know which is which. Real applications: 5 pinned public application repositories with answer keys of 41 known issues built by the TwinEthos team with Claude Opus, three runs per setup, TwinEthos given as context files with local triage; results are ranges over the runs. Law newer than the model: 17 small synthetic apps written by the TwinEthos team, one run per setup, 13 seeded issues. Known issues include TwinEthos's recommended guardrails, which are opinion, not law. Scores measure what reviewers found and cited, not whether any app meets any law. Informational data, not legal advice.
Explore Global AI laws, free
Search the laws, provisions, controls and recommended guardrails TwinEthos encodes. Each provision shows who it applies to, whether it is in force or coming (with the date), the guard to add in your code with an example, the standards that agree, and the incidents behind it. Start from a market, or see what starts applying next.
Example data
- European Union (EU)69 binding provisions
- China (CN)30 binding provisions
- Brazil (BR)12 binding provisions
- South Korea (KR)11 binding provisions
- Italy (IT)10 binding provisions
- Vietnam (VN)10 binding provisions
- Kazakhstan (KZ)8 binding provisions
- United Arab Emirates (AE)8 binding provisions
- Dubai International Financial Centre (AE-DU-DIFC)8 binding provisions
- Australia (AU)6 binding provisions
79 more markets outside the US, and 45 markets in the United States: federal, state and city law.
Recent incidents
Publicly reported AI incidents with disclosed root cause and findings. Each below links to the disclosure and includes suggested guards for others to address proactively.
An AI guardrail's injection check failed open when one of its YARA rules failed to parse
_load_rules returned None on yara.SyntaxError, and the caller treats None as 'no rules configured' and returns a non-injection outcome.
Source: NVIDIA NeMo Guardrails maintainers
Suggested guards:
Agents in an open-internet cyber evaluation took unsanctioned actions against real people
Internet access was open, and monitoring was not purpose-built.
Source: UK AI Security Institute
Suggested guards:
An open-source guardrail library's parser let unparseable judge replies pass as safe
any verdict without a leading bare keyword -> treated as safe -> content delivered.
Source: Authensor
Suggested guards:
Researchers showed a CI coding agent's file-read tool could expose workflow secrets
while [the action] supported environment scrubbing for subprocess execution paths such as Bash, the Read tool was not subject to the same sandboxing model
Source: Microsoft Security Blog
Suggested guards:
Real-world incidents provided from public record. Recommended guardrails are TwinEthos's opinion only.
Beyond the law
Law sets a floor. TwinEthos recommended guardrails cover what a responsible AI integration does anyway, most backed by the published security standards that converge on them, graded real incidents, or both, and each graded by the evidence behind it:
- Law-derived — engineering controls that make a legal duty work: disclosure that reaches the person, reproducible decision records, substantive human review.
- Agent security — permission-aware retrieval, tool-server authentication, memory-write controls, AI-generated code provenance.
- Operational integrity — the controls that quietly disappear under cost pressure: scoped caches, guards that fail closed, re-evaluation on every model change.
- Ethical use (opt-in) — engagement design, sycophancy, substantiated capability claims, training consent, age signals.
Recommended guardrails are TwinEthos's opinion of good practice. Where binding law applies, the law governs. Browse the recommended guardrails.
Enforce the requesting user's permissions on every retrieval
Evidence gradeStandards consensus (7)
7 standards and frameworks · 1 graded incident.
Filter every vector, search, and tool lookup by the requester's tenant and groups at query time, and re-check read access on each retrieved item before it enters the prompt.
Opinion, never law: where binding law applies, the law governs.
Filter data for your needs
Trackers list laws; single-jurisdiction scanners cite whole articles. TwinEthos works a level down and across markets: each provision in every jurisdiction covered, international and US, who it applies to, and the guard in your code that addresses it. Many laws in many markets then read as a short list of engineering controls, not dozens of checklists.
For each guard, the plan shows:
- The guard to add, where it goes in the code, and a before/after example.
- The provisions it addresses, by lane, each with its exact citation and a link to the official text.
- Where that law is in force, and where it is coming, with the date it starts applying.
- The standards that agree, and any TwinEthos recommended guardrail on the same control, labeled as opinion.
- How far to trust it: when the official source was last checked, and that no lawyer has reviewed the rules.
Try an example:
- A chat assistant for users in the EU and California
- A hiring screener used in New York City and Illinois
- An agent that uses tools, for users across the US
Free, no sign-up. The plan's link holds only your choice of features and markets, so you can share it or print it.
No code yet? The plan works before any code exists: beside the guards, it lists the laws that reach your product, the dates ahead, and what code cannot show.
A chat assistant for users in the EU and California
- AI chat interaction without disclosure
Show an AI-identity notice at or before the first assistant turn, in the UI or as the opening message, and answer truthfully when asked if it is a bo…
Addresses 9 items: 3 binding law in force · 2 enacted, not yet applying · 3 standards · 1 recommended guardrail
- Data erasure does not reach embeddings, vector stores or AI chat history
Make the account-deletion handler also delete the person's vector entries, embeddings, chat history, agent memory and provider-stored files or conver…
Addresses 2 items: 2 binding law in force
- GenAI without published training-data summary
Publish a high-level training-data summary for each generative AI system on the developer's website, and revise it whenever the system is retrained o…
Addresses 2 items: 2 binding law in force
77 guards address 149 items across 3 jurisdictions with binding law: 40 binding law in force, 29 enacted but not yet applying, 32 standards and frameworks, 21 best-practice items, 22 TwinEthos recommended guardrails, 5 optional safe harbors.
Who it's for
- Agent and developer-tool builders adding a review step on every pull request.
- Teams shipping AI features — chat, companions, content generation, agents — who want to know what each market requires of their code and which guard to add.
- Platforms that need AI-law data — code scanners, AI-governance tools, trackers — through a data licence.
> Use TwinEthos to review this repo. It is an agentic support bot with users in the EU and California.
twinethos · review_checklist(patterns: ["chat", "agentic"], jurisdictions: ["EU", "US-CA"], compact: true)
{
"data_as_of": "2026-11-12",
"total": 198,
"results": [
{
"lane": "binding_in_force",
"rule_id": "ca-ab1008.consumer-requests-reach-ai-systems",
"citation": "Cal. Civ. Code 1798.140(v)(4)",
"applies_from": "2025-01-01",
"fix": "Make the account-deletion handler also delete the person's vector entri…"
},
{
"lane": "binding_in_force",
"rule_id": "ca-ab1836.digital-replica-deceased-consent",
"citation": "Cal. Civ. Code 3344.1(a)(2)(A)",
"applies_from": "2025-01-01",
"fix": "Require an estate or rights-holder consent record, or a reviewer's stor…"
},
…
]
}Become a design partner.
Help us continue improving TwinEthos and the future of democratized application building. We provide free MCP access to TwinEthos for your helpful feedback!