Building AI Products? Here's What the Law Says You Can't Do
Part 3 of 3 — China, the UK, and the Rest of the World
When you look at the global AI landscape, China stands out as one of the most interesting regulatory stories.
It is a market that feels open and innovative at the product level, fast-moving, ambitious, and technically sophisticated. And yet it has more AI-specific rules in force than almost any other country in the world.
That tension, active innovation, active regulation, is what makes China’s approach worth understanding properly. And it is where we are starting Part 3.
This is the final part of this series. We are going global today, covering China, the UK, Asia Pacific, Africa, and the Middle East.
If you have not read Parts 1 and 2, here is the short version: Part 1 covered the EU AI Act, the strictest and most comprehensive AI framework in the world. Part 2 covered the United States, no federal law, 50 states writing their own rules, a compliance maze for any business with US customers.
Part 3 closes the picture. By the end of it, you will have a working map of how AI regulation looks across every major market your product might touch.
Let’s get into it.
🇨🇳 China: The Innovator That Also Regulates
The AI products from China feel unconstrained in terms of speed, ambition, and the range of what is being built and shipped. But China is not operating without rules. It has been writing and enforcing targeted AI-specific regulations since 2022. The innovation feels open because the regulation is surgical, focused on specific harms rather than broad governance frameworks.
China does not have one comprehensive AI law like the EU. It has a layered stack of targeted rules, each covering a specific AI use case, all running simultaneously.
What is currently in force:
Content labelling: all AI-generated content must carry explicit labels visible to users, as well as implicit metadata embedded within the content. China has published specific technical standards covering audio watermarking, encrypted metadata, and visual marking systems. This is a hard technical requirement, not a disclosure checkbox
Algorithm recommendation systems must operate transparently, adhere to defined content standards, and must not manipulate user behaviour or amplify prohibited content
Deepfakes, synthetic media used to create or spread false information, are prohibited. This covers text, images, audio, and video
Generative AI services providers must ensure training data is legally sourced, implement content moderation, and prevent the generation of the following prohibited content:
Content that endangers national security or harms national interests
Content that undermines ethnic or religious unity
Content that spreads rumours or disrupts social or economic order
Content promoting obscenity, gambling, violence, or criminal activity
Content that insults, defames, or creates false depictions of individuals
Fake news or misinformation of any kind
Does this apply to you, you might ask? If your product operates in China or serves Chinese users, yes, fully. The obligations apply regardless of where your business is headquartered.
What this means for your business: Content labelling is a product and engineering decision, not just a legal one. It needs to be built into your output pipeline from the start. Training data sourcing must be legally defensible. And the prohibited content list above is not aspirational; it is enforced, and enforcement has been active since 2025.
So the big question: Would your AI generated content know when to label generated content?
🇬🇧 The UK: No AI Law, But There Are Rules
The UK left the EU in 2020, and with it came a clear regulatory divergence. Where the EU built the world’s most comprehensive AI framework, the UK seem to have deliberately chosen not to. There is no UK AI Act. No single AI regulator. No comprehensive framework.
The UK’s stated position is that existing sector regulators are best placed to apply AI principles within their own domains: the ICO for data protection, the FCA for financial services, and Ofcom for online platforms.
What actually governs AI in the UK right now:
UK GDPR via the ICO applies to any AI system that processes personal data, which covers most AI products. The ICO has made AI and biometrics an explicit enforcement priority for 2026
The Data (Use and Access) Act 2025 introduced reforms to automated decision-making rules, updating how businesses must handle decisions made by or substantially assisted by AI
The Online Safety Act requires regulated platforms to assess algorithmic harms, covering recommendation algorithms, content ranking, and AI-driven curation
Copyright and AI training remain unresolved. The government is still consulting on how AI training data intersects with UK copyright law. Watch this closely if your product trains on or generates creative content
What this means for your business: The UK’s light-touch approach gives you room to build without a prescriptive compliance overhead. But ICO enforcement is real, UK GDPR applies.
🇰🇷 South Korea: The Asia Pacific Leader
South Korea was the first country in the Asia Pacific to pass comprehensive AI legislation. The Framework Act on AI, also known as the AI Basic Act, came into force in January 2026.
The law focuses on high-impact AI systems used in healthcare, education, finance, employment, and essential services, the same high-risk categories that appear in the EU AI Act and Colorado’s framework.
If your AI system falls into any of these categories and operates in South Korea, the obligations include:
Human monitoring and intervention must be possible at all times
Users must be informed when they are interacting with AI-generated content or AI-influenced decisions
All AI risks and controls must be assessed, documented, and addressed
Foreign AI companies operating in South Korea must appoint a local representative to handle regulatory communications
That last point is worth flagging specifically for non-Korean businesses. A local representative requirement is a meaningful compliance overhead, which means you cannot simply deploy a product and manage compliance remotely.
So the big question: Can your AI decision always be overridden by a human?
🇯🇵 Japan: An Act That Does Not Enforce
Japan passed its AI Promotion Act in June 2025, but it is not what most businesses expect from a law. The Act takes a soft-law, innovation-oriented approach and does not impose direct fines or penalties on businesses. Instead it promotes voluntary compliance and relies on existing sector laws for binding enforcement where needed.
The practical guidance sits in the AI Guidelines for Business published by Japan’s Ministry of Economy, Trade and Industry updated to version 1.1 in March 2025. These are not legally binding but set clear expectations for what responsible AI development and deployment looks like in Japan. For businesses operating in the market they represent the standard you are expected to meet.
What the guidelines expect from your organisation:
Conduct risk assessments and document safety, fairness, and bias testing results
Implement user notices so people know when they are interacting with AI
Include AI-specific provisions in supplier and vendor contracts
Maintain deployment records across the full AI lifecycle
Report incidents and have a defined response process
Enforcement where it exists comes through existing laws the Act on Protection of Personal Information (APPI) for data handling, competition law for algorithmic pricing, and product safety law for AI in physical products. The reputational mechanism public disclosure of non-compliance is also a real consideration in Japan’s business culture.
Watch this space: Japan is actively consulting on binding rules for high-risk sectors including healthcare and autonomous vehicles. The voluntary approach is not permanent.
🇸🇬 Singapore: The Region’s Most Developed Voluntary Framework
Singapore does not have a binding AI law. But calling its approach voluntary undersells it significantly.
Singapore has built the most comprehensive voluntary AI governance ecosystem in the Asia Pacific region and it is used as a compliance reference point by businesses well beyond Singapore’s borders.
Here is what actually exists:
The Model AI Governance Framework updated in 2025 to cover generative AI, it provides operational guidance across transparency, fairness, human oversight, data governance, and security. It has been mapped to ISO/IEC 42001, the NIST AI Risk Management Framework, and OECD AI Principles which means aligning with it puts you in a defensible position across multiple international compliance frameworks simultaneously.
AI Verify a government-developed AI testing toolkit, the first of its kind in the world. It allows organisations to test their AI systems against governance principles through standardised technical tests. Companies including Google, Microsoft, and DBS Bank use it. If you are building AI products for the Southeast Asian market this is worth knowing about.
The Agentic AI Governance Framework released in January 2026, making Singapore the first country in the world to publish structured governance guidance for autonomous AI agents. If your product uses AI agents systems that take independent actions, update databases, or execute tasks without per-step human approval, Singapore’s framework is currently the only structured global reference point for how to govern them responsibly.
Sector-specific binding rules apply via existing legislation the Personal Data Protection Act (PDPA) covers all AI systems that process personal data, and the Monetary Authority of Singapore has its own AI guidelines for financial institutions.
What this means for your business: Nothing in Singapore’s AI framework will land you in court on its own. But if you are building AI products for Southeast Asian markets, alignment with Singapore’s framework is rapidly becoming the de facto regional standard. The fact that it maps directly to NIST and OECD frameworks also means the work you do for Singapore compliance transfers directly to other jurisdictions.
Africa: Building the Foundation
Africa’s AI regulatory story is one of rapid foundation-building rather than comprehensive enforcement, and understanding that distinction matters for any business operating across African markets.
By early 2026, 44 African countries had implemented data protection laws, and 38 had established fully functional Data Protection Authorities to enforce them. That is a significant shift from even three years ago, and it means the data governance infrastructure that underpins AI regulation is now in place across most of the continent.
Nigeria, Kenya, Ghana, and Algeria have all introduced data localisation requirements meaning certain types of data must be stored or processed within their borders. For AI products that collect user data across African markets, localisation compliance is already a real and enforceable obligation.
Nigeria specifically is worth watching. The Nigeria Data Protection Commission introduced its General Application and Implementation Directive in September 2025, setting enforcement priorities and compliance expectations for organisations operating in Nigeria’s digital economy including those using AI to process personal data.
The African Union’s Continental AI Strategy is also in motion, with Phase 1 running through 2025 and 2026 focused on establishing governance structures and frameworks across member states. The strategy emphasises digital sovereignty, the importance of AI systems that reflect African languages, cultures, and contexts, and aligns with the Malabo Convention on Cyber Security and Personal Data Protection.
What this means for your business: There is no binding pan-African AI law yet. But data protection obligations are real, localisation requirements are enforceable, and the regulatory infrastructure is being built at pace. Businesses that establish data governance practices now particularly around where data is stored, how consent is obtained, and how AI decisions are documented, will be significantly better positioned as AI-specific frameworks arrive.
🌐 Middle East: Positioning for AI Leadership
The Middle East is moving faster than most people realise, and the direction of travel is toward becoming a global AI hub rather than simply a regulated market.
Saudi Arabia’s Draft Global AI Hub Law of 2025 is the most significant development in the region. It signals a deliberate shift toward hard law for AI infrastructure and cross-border data governance the kingdom is not just adopting AI, it is legislating to position itself as an international destination for AI investment and development.
The UAE has been the region’s most active AI adopter and has established voluntary AI ethics frameworks, with the National AI Strategy 2031 setting ambitions for AI to contribute 14% of GDP by 2031. Regulatory frameworks are developing but remain lighter than those in more mature markets.
Morocco, Tunisia, and Iraq all have AI or data governance bills in various stages of their legislative pipelines, signalling a broader regional shift from policy aspiration to legal framework.
What this means for your business: The Middle East is not yet a compliance-heavy environment for AI, but it is moving in that direction faster than most Western businesses are tracking. If your product operates in the region or you are considering expansion there, the time to understand the emerging frameworks is now not when they become binding
The Global Picture, What It All Means
Step back and look at everything we have covered across this series, and a clear pattern emerges.
Every major regulatory framework in the world regardless of whether it is strict like the EU, fragmented like the US, surgical like China, or still forming like Africa, is built on the same underlying principles.
Transparency. Fairness. Human oversight. Accountability. Documentation.
The approaches are different. The timelines are different. The penalties are different. But the direction every market is moving in is the same.
For product teams building AI, this consistency is actually useful. It means there is a set of practices auditing your systems for bias, documenting how they work and what their limitations are, keeping humans in the loop on consequential decisions, being transparent with users about when AI is influencing outcomes that will serve you well regardless of which market’s law ends up applying to you.
Compliance is not a destination. It is a way of building.
The businesses that understand that the ones that build transparency and accountability into how they work rather than bolting it on when a regulator comes knocking are the ones that will navigate this landscape with confidence, in every market, across every jurisdiction.
That is the point I have been building toward across all three parts of this series.
Build actively. Build responsibly. And build like the regulations are already watching because in most markets, they are.
Let’s wrap this up
When I started researching this series, I expected to find a compliance checklist. A set of rules to follow and avoid.
What I actually found was something more interesting: a global conversation about what it means to build AI responsibly. Every country, every framework, every regulator is essentially wrestling with the same question, how do we get the benefits of AI without creating harms we cannot undo?
The answers look different depending on where you are. But the question is the same everywhere.
I hope this series has been useful. Not just as a reference, but as a frame for how you think about building AI products not just what you are allowed to build, but what you are choosing to build, and why.
That is a wrap on AI regulation. Next up something completely different. Same lens, different world. Stay subscribed and I will see you there 😉