AI Regulation in Israel: A Practical Guide for Companies (2026)
Israel has no AI law, but AI is regulated. What applies to companies operating in Israel in 2026: the Privacy Protection Law, the Supreme Court's AI ruling, the new public-sector AI guide, the EU AI Act after the Digital Omnibus, and a 90-day compliance plan.
Israel has no dedicated AI law, and many companies read that as "no AI rules apply here". That is a costly mistake. A company that uses AI in Israel in 2026 is already bound by a strict privacy law that was overhauled in 2025, by sector regulators, and since March 2026 by a Supreme Court ruling that treats unverified AI output as a serious failure. And if the company serves customers in the European Union, the EU AI Act applies to it even without an office in Europe.
This guide is written for companies operating in Israel, international companies with Israeli operations, and Israeli companies selling abroad. It explains what applies today, what changed in 2026, and what to do in the next 90 days.
- Israel regulates AI through principles, sector regulators and existing law, mainly the Privacy Protection Law and its Amendment 13 (in force since August 14, 2025). There is no comprehensive AI statute.
- In March 2026 Israel's Supreme Court called a public body's reliance on unverified AI output "reckless" and ordered it to pay costs. Human verification is now an expectation, not a best practice.
- In May 2026 the Israel National Digital Agency published a responsible AI guide for the public sector, including a Chief AI Officer role. It is the clearest local benchmark for private companies too.
- The EU AI Act applies to companies in Israel that sell into the EU. After the 2026 Digital Omnibus, most high-risk obligations apply from December 2, 2027, but transparency duties already apply.
This guide is general information, not legal advice. Regulation changes quickly; check the official sources and consult a lawyer before making decisions.
Is there an AI law in Israel?
No. Israel has chosen not to pass a horizontal AI framework law for now. Instead, it relies on a "soft law" approach built on principles, plus regulation by existing laws and sector regulators. The main milestones:
- Principles for AI regulation and ethics (December 2023): published by the Ministry of Innovation, Science and Technology, recommending sector-specific, risk-based regulation instead of one cross-cutting law.
- The national AI program: a multi-year government program investing in infrastructure, talent and research.
- A national AI headquarters: in 2025 a public committee recommended accelerating AI adoption, and the government decided to establish a national AI headquarters in the Prime Minister's Office.
- The public-sector responsible AI guide (May 2026): the most detailed governance framework published by the Israeli government so far. More on it below.
The direction is clear: Israel prefers to accelerate AI adoption and regulate through existing tools. For companies, this means the obligations are spread across several sources rather than collected in one law.
What already applies to companies using AI in Israel
1. The Privacy Protection Law and Amendment 13
Any AI system that processes personal data of customers or employees in Israel falls under the Privacy Protection Law. Amendment 13, in force since August 14, 2025, significantly expanded it: a broader definition of highly sensitive information (including biometric, genetic, location and financial data), a requirement for certain organizations to appoint a privacy protection officer, and much stronger enforcement powers for the Privacy Protection Authority, including administrative fines. The Authority has also published draft guidance on AI, covering the legal basis for processing, data minimization, transparency and data subject rights.
2. Sector regulation
Existing sector rules apply to AI-driven decisions just as they apply to any other decision: banking and insurance regulation, consumer protection, equal opportunity in employment, and health regulation. An AI model that scores credit, screens job candidates or supports medical decisions is judged by the rules of that sector.
3. The courts: the Ramat Gan ruling
On March 22, 2026, Israel's Supreme Court ruled against the Ramat Gan municipality in a case about services for a child with special needs. The municipality's response relied on a Ministry of Education directive and on legal precedents that did not exist: they had been invented by a generative AI tool. According to an analysis by Pearl Cohen, the court described the reliance on unverified AI content as "reckless", a term that implies more than negligence, and ordered the municipality to pay 30,000 shekels in costs. As commentary from the Hebrew University notes, the ruling focuses on the duty to verify AI output and stand behind decisions.
The lesson for companies: AI output that reaches a customer, an employee, a regulator or a court must be checked by a person. "The system wrote it" is not a defense.
4. The public-sector responsible AI guide
In May 2026 the Israel National Digital Agency, together with the Ministry of Justice and the Ministry of Innovation, Science and Technology, published version 1.0 of a guide to the responsible use of AI in the public sector. It is binding guidance for government bodies, not for private companies, but it is the clearest picture of what Israeli regulators consider good AI governance. It defines:
- The responsibility of senior management for AI use.
- A Chief AI Officer and an AI governance forum.
- A business owner for each AI process, and guidelines for end users.
- A risk management method for AI systems, and a sample responsible AI policy.
A private company that builds its governance along these lines will be well prepared for whatever Israel regulates next.
The EU AI Act: why it matters in Israel
The EU AI Act (Regulation (EU) 2024/1689) entered into force on August 1, 2024 and applies in stages. It is extraterritorial: it covers providers outside the EU that place AI systems on the EU market, and deployers outside the EU when the output of the AI system is used in the EU. In practice, an Israeli company selling software, SaaS, medical devices or security products with an AI component to European customers is very likely in scope, even without an entity in Europe.
Four risk levels
| Risk level | What it covers | Obligations |
|---|---|---|
| Unacceptable (prohibited) | Social scoring, manipulative techniques, exploiting vulnerable groups, certain real-time biometric identification | Banned since February 2, 2025 |
| High risk | Employment and HR decisions, credit scoring, insurance, education, critical infrastructure, biometrics, AI in regulated products such as medical devices | Risk management, data governance, technical documentation, logging, human oversight, accuracy and cybersecurity, conformity assessment |
| Limited risk | Chatbots, AI-generated content, deepfakes | Transparency: tell people they are interacting with AI, label synthetic content |
| Minimal risk | Spam filters, simple recommendation engines | No mandatory obligations |
The timeline after the 2026 Digital Omnibus
In 2026 the EU adopted a "Digital Omnibus" package that postponed parts of the AI Act. According to the Cloud Security Alliance and Usercentrics, it was published as Regulation (EU) 2026/1744 and entered into force on July 27, 2026:
| Date | What applies |
|---|---|
| February 2, 2025 | Prohibited practices and AI literacy (the literacy duty was softened in 2026 to "supporting" staff literacy) |
| August 2, 2025 | Obligations for providers of general-purpose AI models |
| August 2, 2026 | Transparency duties (Article 50): disclosure and labeling of AI-generated content. A grace period for watermarking in systems already on the market runs until December 2, 2026 |
| December 2, 2027 | High-risk systems listed in Annex III (employment, credit, education, biometrics, infrastructure), postponed from August 2026 |
| August 2, 2028 | High-risk AI embedded in regulated products (Annex I), postponed from August 2027 |
Fines reach up to 35 million euros or 7% of global annual turnover for prohibited practices, up to 15 million euros or 3% for most other violations, and up to 7.5 million euros or 1.5% for supplying incorrect information to authorities.
Important: the postponement gives more time for high-risk systems, not for transparency. And many European customers already ask Israeli suppliers for evidence of AI risk management in contracts and vendor questionnaires, without waiting for the official deadlines.
Provider or deployer: the first question to answer
Under the AI Act, a provider develops an AI system or places it on the market under its own name, and carries most of the compliance burden. A deployer uses an AI system in its professional activity, and is mainly responsible for transparency, human oversight and monitoring. A company that builds a product on top of OpenAI, Anthropic or Google models is usually a deployer of the model, but it may become a provider of the product it sells. Getting this classification right determines everything that follows.
What to do now: three common situations
- You sell into the EU: map every product and service that reaches European customers, classify each AI component by risk level, define your role (provider or deployer), and start with the high-risk systems, where the obligations are heaviest.
- You use third-party AI models: make sure users know when they interact with AI, define real human oversight, monitor performance, and check that your use does not turn a general tool into a high-risk process, such as candidate screening.
- You build AI in-house: even internal systems that affect employees or customers need transparency, oversight and documentation, and in Israel they are subject to the Privacy Protection Law.
A 90-day plan
| Days | What to do | Output |
|---|---|---|
| 1 to 30 | Map every AI system in the company, including tools employees adopted on their own; define your role in each; check which products reach EU customers | An AI risk classification matrix |
| 31 to 60 | Close transparency gaps (chatbot disclosure, labeling of synthetic content); publish an employee AI policy; launch AI literacy training; review compliance with Amendment 13 | An AI policy and a transparency procedure |
| 61 to 90 | For each high-risk system: an accountable owner, technical documentation and a human oversight mechanism; a regulatory tracking log; updated contracts and vendor questionnaires | A staged compliance plan to December 2027 |
Three internal tools to start with
- An AI risk matrix: one row per AI system, with its purpose, provider and deployer, the decisions it makes, and whether it affects people. The deciding column is impact: if a system affects hiring, credit, eligibility, health or safety, treat it as high risk.
- A compliance checklist: for each high-risk system, check documentation, human oversight, transparency, data quality and an accountable owner.
- A regulatory log: a living document that tracks AI Act deadlines, Privacy Protection Authority publications and Israeli policy updates, with an owner and a next review date for each.
How the Israel AI Organization can help
The Israel AI Organization works with companies and public bodies in Israel on AI adoption and governance: mapping and classifying AI systems, building AI policies, training employees and managers in AI literacy, and preparing for the requirements of European customers and partners, together with legal advisors. We also run the C-AI Forward forum of senior AI leaders from Israel's largest organizations. Leave your details below and we will get back to you within one business day, or read more about us.
Frequently asked questions
Is there an AI law in Israel?
No. As of October 2026 Israel has no comprehensive AI statute. It regulates AI through government principles (2023), a national AI program and headquarters, sector regulators, the May 2026 public-sector responsible AI guide, and existing law, mainly the Privacy Protection Law as amended by Amendment 13 in August 2025.
Does the EU AI Act apply to Israeli companies?
In many cases, yes. The AI Act applies to providers outside the EU that place AI systems on the EU market, and to deployers outside the EU when the AI output is used in the EU. An Israeli company selling software or devices with an AI component to European customers is very likely in scope, even without a European entity.
What did Israel's Supreme Court rule about AI in 2026?
On March 22, 2026, in a case against the Ramat Gan municipality, the Supreme Court found that the municipality relied on a directive and precedents invented by a generative AI tool, called this reliance reckless, and ordered it to pay 30,000 shekels in costs. The practical lesson is that AI output must be verified by a person before it is used.
When do the EU AI Act high-risk obligations apply?
After the Digital Omnibus, which entered into force on July 27, 2026, high-risk systems listed in Annex III must comply from December 2, 2027, and high-risk AI in regulated products (Annex I) from August 2, 2028. Prohibitions, AI literacy and transparency duties already apply.
Does using ChatGPT or another AI tool create obligations for a company?
Usually the company becomes a deployer: it must be transparent with people who interact with the AI, apply human oversight, and support AI literacy among employees. If the tool is used in a high-risk process such as candidate screening or credit decisions, the obligations increase. In Israel, any processing of personal data is also subject to the Privacy Protection Law.
What is the first step toward AI compliance?
Map every AI system in the company, including tools employees adopted on their own, and classify each by risk level and by your role (provider or deployer). This matrix determines which obligations apply and what to fix first.
Talk to us about AI in your organization
We help companies operating in Israel map their AI systems, build an AI policy, prepare for the EU AI Act and Israeli privacy law, and train their teams. Leave your details and we will get back to you within one business day.
The Israel AI Organization helps companies and public bodies in Israel adopt AI responsibly. Our daily content is published in Hebrew. About us · Read this guide in Hebrew