Israel has no comprehensive AI Act. Here's what's actually regulating AI there instead.
In multiple countries across the world, we have begun to see the development of advanced AI laws in order to regulate fast-moving changes. Israel, however, doesn't have a comprehensive AI Act, and this begs the question: what is actually regulating AI? For a country that is one of the world's leaders in AI advancement, you would expect some form of comprehensive regulation, yet there isn't one. So how is Israel stopping AI from getting out of hand?
In December 2023, Israel published its official policy on AI regulation and ethics, titled Responsible Innovation: Israel's Policy on Artificial Intelligence Regulation and Ethics.1 It is important to understand that this is a policy from the government, not legally binding legislation from the Knesset itself.
The policy sets out six core ethical principles: using AI to promote growth and Israeli leadership in innovation, human-centric AI that respects human dignity and privacy, equality and non-discrimination, transparency and explainability, reliability and safety throughout an AI system's life cycle, and accountability. None of these principles are legally binding on their own, they are meant to guide how regulators and businesses approach AI, not to be used as a tool for legal interpretation.
On top of these principles, the policy promotes a risk-based form of regulation that requires sector-specific rules, so requirements differ depending on how an AI system is actually being used. It also favours incremental development, encouraging the use of regulatory sandboxes and pilot projects, and generally prefers soft regulation, such as voluntary standards, over immediate binding law.1
Whilst it is true that there isn't an official AI Act, that doesn't mean AI operates without legal rules. Existing legislation can be extended and applied when AI is being used.
The strongest example of this is Israel's Privacy Protection Law. This governs the collection and use of personal information, and the PPA (Privacy Protection Authority) is the country's regulator and enforcement authority for personal digital information.
This is extremely relevant to AI, because AI, as we know, processes a ton of private personal information.
Israel's Amendment 13 to the Privacy Protection Law was approved by the Knesset in August 2024 and came into force in August 2025, strengthening this law and framework even further.2
There are various developments from 2025 to 2026 that demonstrate Israel is starting to move from general policy towards more concrete regulation.
AI and Privacy Guidance. The PPA published draft guidance in April 2025 specifically addressing AI and privacy, so it's no longer just applying existing legislation but creating its own dedicated framework. This includes important questions such as what personal information can be used to train AI, and what happens when AI generates information about people.3
AI in the Financial Sector. In December 2025, an interministerial team published its final report on AI in Israel's financial sector, following an interim report from November 2024, looking specifically at how AI should be governed within financial services.4
Cybersecurity. Israel's National Cyber Directorate also addressed AI in its 2025 to 2028 National Cybersecurity Strategy, promoting safe adoption of AI while protecting AI systems from cyber threats.5
Suggested addition, not in the original draft:
The National AI Action Plan. In August 2026, the Israeli government went further still, approving a full national AI strategy. This established a National AI Directorate within the Prime Minister's Office to coordinate AI policy across government, and a National Ethics Council to advise on algorithmic transparency, fairness and privacy. It is the clearest sign yet that Israel's approach is deepening, even without a single AI Act.6
Again, none of these are an AI Act, but we can see that AI is slowly but surely being incorporated into existing regulatory systems.
Rather than one regulator covering everything, responsibility is split by area:
| Area | Who Regulates It |
|---|---|
| Personal data used by or generated by AI | Privacy Protection Authority (PPA) |
| AI used in banking, insurance and financial services | Bank of Israel, Israel Securities Authority, and the Capital Market, Insurance and Savings Authority |
| Security of AI systems and AI-related cyber threats | Israel National Cyber Directorate (INCD) |
| National AI strategy and cross-government coordination | National AI Directorate (Prime Minister's Office) |
| Algorithmic ethics, fairness and transparency | National Ethics Council |
| Overall policy direction and sectoral guidance | Ministry of Innovation, Science and Technology, with the Ministry of Justice |
The original draft didn't yet include a conclusion, so this is a first pass:
Israel's approach is not an absence of regulation, it is regulation without a single law. A non-binding 2023 policy sets the direction, existing legislation like the Privacy Protection Law does much of the actual legal work, and a growing list of sector-specific guidance, from privacy to finance to cybersecurity, is filling in the rest.
Whether this model holds as AI becomes more capable is a genuinely open question. The 2026 National AI Action Plan suggests Israel is still building out this structure rather than settling into it, and a country that has repeatedly said it is not ready for a single AI Act may eventually find that its patchwork of regulators needs one law to hold it together after all.