The Most Consequential Tech Regulations That Shaped 2025

News

1. CBD Becomes the UAE’s First Bank to Go Live Under the Open Finance Framework

2. Will Halt Potential Rogue AI Systems, Says Microsoft AI Chief

3. Google Bets Big on Data Infra With a $4.75B Deal in Intersect

4. OpenAI Softens ChatGPT’s Tone While Scaling for an AI Showdown

5. UAE President Meets Musk to Discuss AI and Cross-Border Collaboration

6. UAE Forms National Media Authority to Centralize Media Oversight

The year 2025 brought about a substantial update to the AI regulatory landscape. Beyond ethics, frameworks increasingly reflected concerns around infrastructure, capacity building, talent, and the real-world deployment of these technologies.

Across jurisdictions, lawmakers focused less on blanket restrictions and more on managing systemic risk, protecting strategic data, and aligning technology policy with geopolitical alliances. Artificial intelligence sat at the center of this shift, but so did data flows, compute infrastructure, and cross-border dependencies. 

“We still don’t have harmonized policies or regulations when it comes to tech… There is nobody on a global level that is actually providing that,” summed up Riyadh-based Digital Cooperation Organization’s Secretary-General Deemah AlYahya earlier this year. 

Here are some key developments from the tech regulatory space this year, which will shape our operating environment. 

Saudi Arabia Updates Its Data Protection Regime

Saudi Arabia strengthened its digital governance framework through amendments to the Personal Data Protection Law in early 2025, overseen by the Saudi Data and AI Authority, as the law marked its first anniversary of enactment.

The updates introduced mandatory data protection officers, clearer standards for explicit consent, and structured assessments for cross-border data transfers—bringing enforcement closer to global norms while supporting Vision 2030’s digitization programs. 

The proposed changes also tighten data protection obligations across the board: privacy policies must be clear, easy to understand, and written in the same language used to provide services.

EU AI Act Enforcement Begins

This year, the world’s first comprehensive AI law moved from theory to enforcement. Under the European Union’s AI Act implementation timeline, prohibitions on “unacceptable risk” AI systems—such as social scoring—took effect on February 2, 2025.

However, towards the end of this year, in November, news surfaced that the EU was considering pausing parts of its act from US hyperscalers, the Trump administration, and European tech groups, as reported by the Financial Times.

India Operationalizes Its Data Protection Law

India crossed a critical threshold by notifying the Digital Personal Data Protection Rules on November 14, 2025. The rules transformed the 2023 statute into a live compliance regime, introducing consent managers, mandatory breach reporting within 72 hours, and enforceable user rights such as erasure and grievance redressal.

As tech policy expert Amber Sinha pointed out in his blog, the march to this data protection law has been a slow one. With an 18-month rollout fraught with challenges, India signaled that data protection would not delay its digital economy ambitions. However, it will affect everything from fintech and e-commerce to AI training datasets.

The US Resets Federal AI Policy

On January 23, 2025, Donald Trump signed Executive Order 14179, which revoked the Biden-era AI safety directives. The order mandated a 180-day AI Action Plan focused on the US competitiveness, national security, and what the administration termed “human flourishing.” 

Later this year, on December 11, 2025, President Trump also signed an executive order on “Ensuring A National Policy Framework for Artificial Intelligence.” The order came on the heels of several failed federal legislative efforts to impose a moratorium on state AI legislation, including a high-profile attempt to include a 10-year moratorium on state AI laws in the One Big Beautiful Bill Act.

A New US-EU Technology Alliance Takes Shape

Washington and Brussels announced a landmark tech framework agreement committing the EU to $40 billion in US-manufactured AI chips. The “Tech Prosperity Deal” was agreed during a celebration of the countries’ close ties and ability to work together on trade and technology. 

However, the US is stalling the implementation of the agreement following concerns in Washington over London’s approach to digital regulation and food standards.

China Mandates AI Content Labeling and Tightens Data Localisation 

Earlier in the year, new regulations effective January 1 strengthened enforcement under China’s Personal Information Protection Law and Data Security Law. The measures expanded localization requirements and tightened approvals for exporting “important data,” particularly from critical information infrastructure. 

The country also expanded its already dense tech regulatory architecture with GB 45438-2025, effective September 1. The standard requires explicit and implicit labeling of AI-generated content, including text, images, and conversational systems, alongside human moderation requirements for deepfakes. 

Since the advent of the generative AI wave following the launch of ChatGPT, AI labelling and classifiers have been pitched on several instances. However, with the increasing amount of AI-generated content flooding the internet, it has been difficult to thoroughly differentiate between the two. 

Japan Passes an Innovation-First AI Law

Japan chartered a different course by approving the “Act on the Promotion of Research and Development and the Utilization of AI-Related Technologies” on May 28, 2025. Rather than imposing new prohibitions, the law emphasized public-private partnerships, R&D support, and ethical utilization guidelines.

The act is primarily introduced to drive economic growth. It acknowledges AI as a foundational technology for Japan’s socioeconomic development and seeks to enhance the country’s competitiveness and efficiency through the use of this technology. 

Its regulatory approach minimizes regulatory burdens, rejecting express penalties in favor of governmental guidance and voluntary cooperation