UCI strongly recommends it, country of event can enforce it:
https://www.uci.org/inside-uci/constitutions-regulations/regulations
§3 Clothing and protective accessories
4.3.011 All lycra-elastane based tight-fitting clothing is not permitted.
4.3.012 A full-face helmet must be worn properly both when racing and when training on the course. The helmet must be fitted with apeak. Open-face helmets may not be worn.
E0119 MOUNTAIN BIKE 26
UCI CYCLING REGULATIONS
4.3.013 The UCI strongly recommends that riders wear the following protection:
− back, elbow, knee and shoulder protectors made of rigid materials;
− protection for the nape of the neck and the cervical vertebrae;
− padding on shins and thighs;
− broad full-length trousers made from rip-resistant material incorporating protection for the knees and calves, or broad-cut shorts made from rip-resistant material plus knee and calf protectors with a rigid surface;
− long sleeved shirt;
− full finger gloves.
National federations may impose in their national regulations and under their responsibility the use of other protections than helmets including for international events on their territory. The national federations are responsible for monitoring compliance with such regulations to the exclusion of UCI.
A rider not wearing the protection imposed by the national federation in an international event shall be banned from the race by the commissaires’ panel only at the request of a representative of the national federation and under the responsibility of the latter.
Comment:
The riders shall inquire about any applicable national federation regulation. The use of protective gear other than helmets may also be imposed by national legislation. The rider shall inquire about this. Compliance with such legislation is the exclusive responsibility of the rider.
A wide variety of equipment is available on the market that is presented and sold as protective gear.
Some of these are provided by reputable manufacturers that may be expected to produce quality products.
Yet, and except for helmets, there seem to exist no official technical norms for protective gear as referred to in the above article.
Therefore it is not known at this time to what extent items that are sold as protective gear provide effective protection, as the concept, the quality, etc. have not been tested and compared with an applicable official technical standard.
It is not known either whether gear that provides protection in a certain type of crash might provide or fail to provide the expected protection in another type of crash.
Likewise the combination of different types of protections may not be adequate. For example a neck protection may not fit with a back protector.