Blog

Soft and Hard Laws in AI: Demystifying the Path to Responsible AI

Gopal Wunnava, Founder, DataGuardAI Consulting
October 29, 2025

Shape Responsible AI with Soft and Hard Laws

As artificial intelligence rapidly moves from experimentation to widespread adoption, regulators around the world are racing to define how AI should be governed and designed for compliance. Yet not all rules carry the same legal weight. Some are binding laws or hard laws, enforceable by regulators and courts, while others are non-binding frameworks or soft laws that shape best practices and influence policy development.

Understanding this distinction between soft laws and hard laws is essential for navigating the global AI landscape as they play different yet complementary roles in shaping the regulatory landscape and influencing organizational practices.

Together, these frameworks form a layered system of governance that balances innovation with accountability, enabling organizations to build AI systems that are both trustworthy and compliant. These layers of regulation form the foundation of modern Responsible AI governance, blending ethical intent with legal accountability.

Soft and Hard Laws Landscape in Responsible AI

What Are Soft Laws in AI?

Soft laws are non-binding guidelines, principles, and frameworks that provide ethical direction and best practices for governing AI systems without legal enforcement or penalties. Soft laws serve to influence, inspire, and prepare the groundwork for future regulation and responsible AI adoption.

Key Characteristics

Non-binding Nature: Soft laws do not impose legal obligations or direct penalties.
Influence and Guidance: They shape national policies, corporate AI strategies, and often inform the drafting of future hard laws.
Voluntary Adoption: Organizations follow them voluntarily to show commitment to ethical AI, reduce risk, and align with international norms.
Trustworthy AI: Most soft laws promote trustworthy AI by encouraging fairness, transparency, accountability, and safety.

Soft Laws in AI Governance

OECD AI Principles: Adopted by more than 40 countries, these were the first intergovernmental standards for responsible AI While non-binding, they significantly influence AI regulation globally, providing foundational principles like inclusive growth, human-centered values, transparency, robustness, and accountability.

NIST AI Risk Management Framework (AI RMF): A voluntary, sector-neutral framework from the U.S. National Institute of Standards and Technology. It promotes trustworthy AI through four core functions—Govern, Map, Measure, and Manage—and is increasingly referenced by both public and private institutions worldwide.
U.S. Blueprint for an AI Bill of Rights This is a non-binding policy framework issued by the White House Office of Science and Technology Policy (OSTP) that provides voluntary technical guidelines across five core rights (e.g., safe and effective systems, algorithmic discrimination protections).

UNESCO Recommendation on the Ethics of AI: Adopted by 193 countries, this is a globally endorsed ethical framework emphasizing human development, sustainability, and peace in AI. It provides foundational pillars for ethical AI, often influencing government-funded AI research and public sector procurement.

EU High-Level Expert Group (HLEG) Ethics Guidelines: These guidelines define seven principles for trustworthy AI, including human oversight, fairness, and transparency. While not law, they directly influenced the risk-tiered structure of the EU AI Act.
Singapore Model AI Governance Framework (Hard/Soft Hybrid): While primarily a soft law, Singapore’s Model AI Governance Framework has evolved through implementation guides and sector-specific standards that are increasingly codified in financial and public-sector regulation. It serves as a bridge between ethical guidance and enforceable compliance.
IEEE Standards for Ethical AI: Developed through the IEEE Global Initiative on Ethics of Autonomous and Intelligent Systems, these standards (e.g., IEEE 7000–7014 series) provide detailed guidance for implementing ethical AI principles, addressing issues like bias, transparency, privacy, and human well-being. While voluntary, they are highly influential among engineers and policymakers.
G7 Hiroshima Process: A global intergovernmental initiative promoting safe, secure, and trustworthy AI, with an emphasis on generative AI transparency, accountability, and content authenticity. The process aligns with OECD principles and advances cross-border collaboration on AI governance.
African Union AI Frameworks: The African Union’s AI Strategy and the Smart Africa AI Blueprint advocate for inclusive, rights-based AI that supports sustainable development. Though non-binding, they provide a continental vision for ethical and responsible AI across African nations.
ISO/IEC Standards (e.g., 42001, 27001, 23894):
- ISO/IEC 42001 establishes requirements for AI Management Systems, allowing organizations to certify governance maturity.
- ISO/IEC 27001 establishes a certifiable framework for information security management, ensuring the protection of data used in AI systems.
- ISO/IEC 23894 provides guidance on AI Risk Management and alignment with the NIST AI RMF.

Together, these standards create a cohesive foundation for AI governance, risk, and security. Although voluntary, they can become de facto hard law when referenced in regulations or procurement contracts.

What are hard laws in AI?

Hard laws are legally binding regulatory instruments that establish mandatory obligations for organizations and individuals developing or deploying AI. Unlike soft laws, which rely on voluntary adherence, hard laws have legal authority—non-compliance can lead to penalties, audits, or even bans. They translate ethical AI principles into regulatory and operational requirements, ensuring accountability and public protection.

Key Characteristics

Legally binding: Hard laws carry the force of law and are enforceable by government agencies or regulatory bodies.
Prescriptive and mandatory: They define specific compliance duties, such as documentation, risk assessments, and transparency obligations.
Enforceable penalties: Non-compliance can lead to significant administrative sanctions, fines, legal action, product recalls, or bans.
Sectoral or jurisdictional scope: Hard laws may be global in influence but apply regionally—e.g., the EU, U.S. states, or China.
Direct Application: They directly define what is permissible or prohibited, and what measures must be taken.

Hard Laws in AI Governance

EU AI Act : Adopted in June 2024, this act is the world’s first comprehensive AI regulation, introducing a risk-based framework that categorizes AI systems as unacceptable, high-risk, limited-risk, or minimal-risk. This act establishes direct obligations for providers, deployers, importers, and distributors of AI systems in the European Union. High-risk systems—such as those used in employment, credit scoring, or biometric ID—must comply with strict obligations on data governance, transparency, and human oversight. The Act complements existing laws like the General Data Protection Regulation (GDPR) and integrates AI-specific safeguards such as post-market monitoring and conformity assessments. Penalties can be substantial, reaching up to €35 million or 7% of global annual turnover for prohibited AI practices.

General Data Protection Regulation (GDPR): Although broader than AI, the GDPR remains central to Responsible AI because it governs how personal data—AI’s core input—is collected, processed, and protected. Provisions like Article 22 (automated decision-making and profiling) and Article 35 (Data Protection Impact Assessments) directly apply to AI-driven systems that affect individuals’ rights. Non-compliance with GDPR can result in significant fines. The GDPR was adopted in 2016 and effective since May 2018.

Canada’s Artificial Intelligence and Data Act (AIDA): Introduced as part of Bill C-27, AIDA seeks to regulate high-impact AI systems across sectors. It mandates risk management frameworks, transparency obligations, and penalties for non-compliance. Once enacted, it will be among the first national laws focused solely on AI accountability and trust. Penalties can be up to $10 million CAD or 3% of global revenue.

China’s AI Regulations and PIPL: China has developed one of the most comprehensive and enforceable AI governance regimes in the world. Alongside its AI-specific rules—such as the Provisions on Algorithmic Recommendation Services (2022), the Deep Synthesis Regulations (2023), and the Interim Measures for Generative AI Services (2023)—China enforces the Personal Information Protection Law (PIPL), a national privacy law often compared to the EU’s GDPR. The PIPL establishes strict requirements for personal data collection, consent, cross-border transfers, and automated decision-making, including a right for individuals to request human review of algorithmic outcomes. Together, these measures form a binding hard-law framework that governs both AI systems and the data that powers them, positioning China as one of the earliest nations to operationalize AI regulation through law.
U.S. State Laws:

Note: While the U.S. lacks a single federal AI regulation, several states have enacted privacy and data protection laws that include provisions for automated decision-making and profiling — aligning closely with the GDPR’s transparency and fairness principles.

California: The California Consumer Privacy Act (CCPA) ), enacted in 2018 and effective since 2020, and its amendment, the California Privacy Rights Act (CPRA), effective January 2023, establish some of the strongest data privacy protections in the U.S. Both laws influence AI transparency and automated decision-making by granting consumers rights to access, delete, and limit the use of their data, while requiring companies to disclose when algorithms or profiling are used to make significant decisions. The CPRA also introduces the California Privacy Protection Agency (CPPA), which is actively exploring future regulations on AI and automated systems.
New York: Effective in 2023, the NY City Local Law 144 (Automated Employment Decision Tools) regulates the use of AI in hiring and employment decisions. It requires annual bias audits, candidate notification, and public disclosure of AI-driven assessments, making it one of the first operational hard laws governing AI use in human resources.
Colorado Privacy Act (CPA) – Effective July 2023, the CPA grants consumers the right to opt out of profiling and automated decision-making that produces legal or similarly significant effects. The law emphasizes transparency by requiring clear notice of automated processing and mandates data protection assessments for profiling activities that pose high risks to consumers.
Connecticut Data Privacy Act (CTDPA) – In force since July 2023, Connecticut’s law provides individuals with rights similar to Colorado’s, including the ability to access, correct, and opt out of profiling-related decisions. Controllers must conduct risk assessments for high-risk AI applications and ensure meaningful human oversight of automated systems.
Virginia Consumer Data Protection Act (VCDPA) – Effective January 2023, Virginia was the first state to adopt a GDPR-inspired privacy framework. It gives consumers the right to opt out of profiling for targeted advertising or decisions with significant effects. It also requires companies to implement reasonable data minimization and purpose limitation practices, ensuring that AI systems operate transparently and ethically.

Together, these state laws are paving the way for a more unified U.S. approach to AI governance, blending privacy, fairness, and transparency requirements that mirror global Responsible AI principles.

Emerging AI Regulatory Frameworks – Brazil and India:

Beyond the major jurisdictions such as the EU, U.S., Canada, and China, other countries are also advancing their AI governance agendas through a mix of data protection laws and emerging AI-specific initiatives. In Brazil, the Lei Geral de Proteção de Dados (LGPD) provides a binding foundation for data privacy, while the proposed Artificial Intelligence Bill (PL 21/2020) and the Brazilian AI Strategy (EBIA) outline non-binding ethical principles on transparency, accountability, and human rights.

In India, the Digital Personal Data Protection Act (DPDP, 2023) establishes enforceable rights around data collection and consent, complemented by the NITI Aayog’s Responsible AI for All (RAI4A) framework, which promotes fairness, inclusivity, and accountability in AI systems. Both nations are gradually evolving toward risk-based, enforceable AI regulation, reflecting the broader global momentum to transform Responsible AI principles into law.

Converging Toward Responsible AI with Soft and Hard Laws

Soft laws often provide the foundation on which hard laws are built. Ethical principles and best practices articulated in soft law frameworks, such as the OECD AI Principles and HLEG Guidelines, are frequently “legally codified” into binding regulations like the EU AI Act. Similarly, voluntary frameworks like the NIST AI RMF provide practical methodologies that “map to mandatory controls under laws like GDPR and the EU AI Act”.

Organizations often adopt soft law frameworks to proactively manage AI risks and demonstrate responsible innovation, thereby preparing for potential future hard law mandates and building public trust.

Hard laws are critical because they turn ethical aspirations into enforceable accountability. They protect individuals from algorithmic discrimination, data misuse, and unsafe AI deployment while creating a level playing field for innovation.

As more jurisdictions enact binding AI regulations, organizations must learn to harmonize compliance across regions—adopting global best practices from both soft laws (like OECD and NIST) and hard laws (like the EU AI Act and GDPR).

As mentioned previously, when taken together, these frameworks form the foundation of Responsible AI governance, ensuring that technological progress remains aligned with human rights, fairness, and safety.

Aspect	Soft Laws	Hard Laws
Nature	Non-binding ethical guidelines, principles, or frameworks.	Legally binding rules, regulations, or statutes.
Purpose	Promote responsible innovation, trust, and best practices in AI.	Protect rights, ensure accountability, and regulate AI use through enforceable requirements.
Adoption	Voluntary; organizations choose to align to demonstrate ethical commitment.	Mandatory; compliance is required within a legal jurisdiction.
Enforcement	No direct legal penalties; relies on social, market, or reputational pressure.	Enforced by regulators through audits, fines, or sanctions for non-compliance.
Scope	Broad, flexible, and global — applicable across sectors and borders.	Specific to jurisdiction or sector; defines clear legal obligations.
Examples	OECD AI Principles, NIST AI RMF, UNESCO AI Ethics Recommendations, EU HLEG Ethics Guidelines, ISO/IEC 42001, U.S. AI Bill of Rights.	EU AI Act, GDPR, Canada’s AIDA, China’s AI Regulations, New York Local Law 144, U.S. state privacy laws (CCPA, CPRA), Singapore’s AI governance mandates.
Update Cycle	Adaptive and regularly revised as technology evolves.	Slower to update; requires legislative or regulatory change.
Relationship	Often serve as precursors or foundations for future hard laws.	Frequently reference or incorporate soft-law principles into legal text.
Organizational Impact	Builds ethical maturity, reputation, and readiness for regulation.	Requires compliance programs, documentation, audits, and risk management.

Conclusion

As artificial intelligence continues to evolve, the global landscape of AI governance is being shaped by both soft laws and hard laws. Soft laws provide the ethical compass and shared vision for AI governance — fostering trust, transparency, and accountability — while hard laws establish the legal guardrails and enforcement mechanisms that turn these principles into practice.

Effective Responsible AI strategies require balancing both — adopting soft-law principles to build trust and readiness, while adhering to hard-law obligations to ensure legal and regulatory compliance. Together, soft and hard laws form a layered system of governance that balances innovation with responsibility.

For organizations, the path forward is clear: align with soft-law frameworks such as the OECD AI Principles, NIST AI RMF, and UNESCO Ethics Recommendations to build a strong ethical foundation, while ensuring compliance with binding regulations such as the EU AI Act, GDPR, Canada’s AIDA, China’s AI regulations, and U.S. state privacy laws — including California’s CCPA/CPRA, New York Local Law 144, and similar emerging frameworks in Colorado, Connecticut, and Virginia.

In the broader context of Responsible AI, this balance between guidance and governance represents not just a compliance requirement — but a commitment to designing AI systems that remain safe, fair, and trustworthy as the global regulatory landscape continues to mature. While both soft and hard laws may evolve over time and vary by region, the need for Responsible AI must remain constant.

Ready to Apply These Insights to Your Business?

From blogs on GDPR and Responsible AI to practical consulting and training, Data Guard AI helps you turn insight into impact.

Tagged AI Governance, hard laws in AI, Responsible AI, Soft Laws in AI