Jamie Watters
Operational resilience and AI delivery practitioner.
Who this is for: you use AI in an organisation that works across borders, or you advise people who do, and someone has asked you what the rules are. By the end you'll know what binds now, what lands in the next two years, where the rules contradict each other, and the short list of things an organisation needs whichever rules apply to it.
Skip it if you want a legal opinion on one system. This maps the ground. It doesn't replace a lawyer for your jurisdiction.
On the length: it's long, because it covers five regions. The summary gives the findings in two minutes. Section 8 is the part to act on. The dates the argument rests on were checked against the primary source on 14 and 24 October 2026, and points from secondary reporting say so. Regulation moves, so check again before relying on any date.
Summary #
AI regulation looks like chaos from a distance. Up close it has a shape.
- The laws are splitting into four blocs. The EU and a growing group of countries have one horizontal AI law. The US has no horizontal federal AI law, dozens of state laws, and a federal government trying to stop them. China regulates through a stack of administrative measures. And the UK, Singapore, India, Canada, Australia and the Gulf states have chosen not to pass an AI act at all.
- The duties are converging. Under all four approaches, the same few obligations keep turning up: label AI-generated content, let people get a human review of consequential automated decisions, report serious incidents, and keep an inventory of AI systems with their risks graded. They match in name more than in detail. What triggers each duty, who carries it and how fast still differ from one regime to the next.
- The EU delayed the part that matters most. Its rules for high-risk AI, the ones that cover credit scoring, insurance pricing and hiring, now apply from 2 December 2027, not August 2026. Lenders meet human review sooner: EU consumer credit rules require it for automated credit assessments from 20 November 2026.
- The US is fighting itself. Four state regimes start on 1 January 2027, while the federal government has an executive order and a litigation task force aimed at state AI laws. No court has ruled on whether federal policy overrides them.
- Most of what bites today is old law applied to a new technique : data protection, consumer protection, financial conduct rules, model risk rules for banks, product safety.
- Financial services is where AI rules arrive first, through supervisors rather than statutes : Singapore, Canada and the UK are building AI into existing supervision. The US has just done the opposite, leaving generative AI out of its new bank model guidance while telling banks to govern it under their existing practices.
The practical conclusion: an organisation can't wait for one global rulebook. Build the governance machinery once, and record inside it what each regime adds: what starts the duty, who carries it, and the deadline.
Where I'm coming from: I've worked in financial services since 1987, latterly in business continuity and resilience. From 2023 I was a member of a bank's committee that approved AI and cloud initiatives. I didn't design that process, and I haven't applied the EU AI Act inside a firm. This paper is research, not practice: two research runs on 5 and 10 October 2026, each claim graded by the strength of its evidence, and the key dates checked at source on 14 and 24 October.
1. Four ways of regulating AI #
No single model is winning. The EU's own law was delayed, and most large economies outside it chose not to copy it.
One horizontal AI law. The EU AI Act sorts AI by risk: a short list of banned uses, a heavy regime for high-risk uses, transparency duties for chatbots and synthetic content, and lighter rules for general-purpose models. Laws of the same broad shape took effect in South Korea, Vietnam, Kazakhstan, Italy, Peru and Taiwan between October 2025 and March 2026. Taiwan's is mostly a framework for government. Japan's AI Promotion Act (Act No. 53 of June 2025) is horizontal too, but promotional. Businesses "must cooperate with the measures implemented by the national government", and the Act has no penalties.
A federal retreat and a state patchwork. The US has no horizontal federal AI law. The current administration revoked its predecessor's AI executive order in January 2025 and has since pushed against regulation, including an executive order in December 2025 aimed at state AI laws (section 2). Meanwhile the states keep legislating. Trackers disagree on how much: one counted 84 AI-related laws in 27 states by July 2026 (Transparency Coalition); another counted 109 in 29 states by 1 July (NYU's Center on Technology Policy). Call it "dozens, and rising".
A stack of administrative measures. China has no single AI law. It regulates through separate measures for recommendation algorithms, deepfakes and generative AI services, with a mandatory labelling standard and filing with the Cyberspace Administration. By 31 August 2026, 1,112 generative AI services had completed filing. The State Council's 2026 legislative plan says to "accelerate" comprehensive AI legislation, but the bill isn't among those due to be submitted this year.
No AI act: existing regulators. The UK, Singapore, India, Canada, Australia and the Gulf states have, as of this research, chosen not to pass a horizontal AI law. Each applies existing law through existing regulators, with guidance on top. This is not a gap in coverage. Data protection, consumer protection and financial regulation all reach AI already.
2. What binds now #
The EU
The AI Act (Regulation 2024/1689) has been amended by the Digital Omnibus, Regulation (EU) 2026/1744, which the European Parliament voted through on 16 June 2026 and which took effect on 27 July 2026. Here's what applies today:
- Banned practices , from 2 February 2025, including social scoring, untargeted scraping of facial images, emotion recognition at work and in schools, and most real-time remote biometric identification by police.
- AI literacy , from the same date, though the Omnibus softened it from "ensure, to their best extent, a sufficient level of AI literacy" to "shall take measures to support the development of AI literacy".
- General-purpose AI models , with duties from 2 August 2025 and the Commission's power to enforce them from 2 August 2026. Models already on the market before August 2025 have until 2 August 2027.
- Transparency (Article 50) , from 2 August 2026: tell people they're dealing with an AI, mark synthetic content in a machine-readable way, and disclose deepfakes.
Fines under the Act reach €35m or 7% of worldwide turnover for banned practices, and €15m or 3% for most other breaches (Article 99 of the AI Act). The Act reaches firms outside the EU too, wherever "the output produced by the AI system is used in the Union" (Article 2).
Enforcement of the general-purpose model rules has started. The Commission confirmed at a press briefing on 1 September 2026 that it had sent requests for information to more than 30 AI companies, according to reporting of that briefing. Its enforcement page, updated 6 October, records no fines.
The UK
The UK has no AI law, and the King's Speech of 13 May 2026 didn't propose one. AI appears only inside a proposed Regulating for Growth Bill, to let the government relax rules temporarily for sandbox testing, and that bill hadn't been introduced as of 14 October. The government's advisory AI Growth Lab, started on 8 June 2026, says plainly that "Legal and regulatory requirements will remain the same."
What applies is existing law:
- Automated decisions. Since 5 February 2026, the Data (Use and Access) Act 2025 has replaced UK GDPR's Article 22 with Articles 22A to 22D. Solely automated decisions with significant effects are now generally permitted, with safeguards: information, the chance to make representations, human intervention and the right to contest. The exception is health, biometric and other special category data: decisions using them still can't be solely automated without explicit consent or a narrow legal basis. The EU keeps a prohibition with exceptions. That's the sharpest UK-EU split in the paper.
- Financial conduct. The Financial Conduct Authority says: "We do not plan to introduce extra regulations for AI. Instead, we'll rely on existing frameworks", naming the Consumer Duty and the senior managers' accountability regime.
- Bank model risk. The Prudential Regulation Authority's supervisory statement SS1/23 applies to banks, building societies and PRA-designated investment firms with approval to use internal models to calculate capital. At those firms it covers every model, built in-house or bought from a vendor: an inventory, risk tiering, independent validation and a named senior manager. Its April 2026 update was a clarification, not a change of policy.
- Critical third parties. From 13 July 2026 the UK or EU operating companies of Amazon Web Services, Google Cloud, Microsoft and Oracle are under direct oversight by the financial regulators, the first four providers designated.
The US: federal
There is no horizontal federal AI law, only narrow ones. The TAKE IT DOWN Act of May 2025 makes it a crime to publish AI-generated intimate images of a real person without consent. It also gives platforms 48 hours to remove reported intimate images. Otherwise the federal government's main moves are against regulation:
- Executive Order 14365 , signed 11 December 2025, set up a Department of Justice task force "whose sole responsibility shall be to challenge State AI laws inconsistent with the policy set forth in section 2 of this order". It also ties some broadband grant money to states' AI laws, and tells the Federal Trade Commission to issue a policy statement on preemption.
- The FTC proposed that statement on 1 July 2026. The statement says state law "is impliedly preempted to the extent it conflicts with a Federal regulatory scheme". The statement and its press release both name Colorado's AI law. Comments closed on 31 July; it isn't final.
- Colorado is the test case. In X.AI v. Weiser, the court ordered an agreed on 27 April 2026. Colorado's Attorney General can't start enforcement, not even an investigation, under the 2024 law or any law replacing it, until 14 days after the court rules on a preliminary injunction. xAI has 28 days from the state's final rules to ask for one. The Justice Department joined the case against the 2024 law. The was asked for by the parties; it isn't a ruling on the merits.
- Bank model risk. The April 2026 guidance that replaced SR 11-7 says generative and agentic AI models "are not within the scope of this guidance". It then tells banks that their existing risk management and governance practices "should guide" the controls for anything it doesn't cover. The OCC's release on the guidance promised a request for information on banks' AI, including generative and agentic AI. As of 14 October that request hadn't been issued.
The US: states
The state laws that matter most for organisations:
- Colorado repealed its 2024 AI Act and replaced it with SB 26-189, signed on 14 May 2026 and applying to decisions from 1 January 2027. It covers automated decision technology in consequential decisions, requiring notice, an explanation of adverse decisions, correction and human review. The 2024 law's defence for firms following the NIST framework or ISO 42001 is gone. Breaches are treated as deceptive trade practices under the Colorado Consumer Protection Act, which allows civil penalties of up to $20,000 per violation. Until 2030 there's a 60-day cure period where the Attorney General decides a cure is possible, and none for knowing or repeated breaches.
- California's privacy regulator requires businesses using automated decision-making technology for significant decisions to comply from 1 January 2027. Its AI Transparency Act, requiring disclosures in AI-generated content, became operative on 2 August 2026, and was amended again by SB 1000 on 30 September 2026. Its frontier AI law, SB 53, approved on 29 September 2025, requires frontier developers to report critical safety incidents.
- New York's RAISE Act, for developers of the largest frontier models, was signed on 19 December 2025, amended on 27 March 2026, and takes effect on 1 January 2027, with penalties of up to $1m for a first violation and $3m after. From November 2026 the state will direct large frontier developers to register.
- Illinois's AI Safety Measures Act (SB 315), also aimed at frontier developers, with incident reporting and the same $1m and $3m penalties, takes effect on 1 January 2027. Separately, since 1 January 2026, Illinois employers can't use AI that "has the effect of subjecting employees to discrimination".
- Texas's Responsible AI Governance Act has applied since 1 January 2026. It bans building or using AI that intentionally aims to encourage self-harm, harm to others or crime, and bars government agencies from social scoring.
- Utah's AI Policy Act is due to be repealed on 1 July 2027 unless renewed.
China
China's mandatory standard for labelling AI-generated content, GB 45438-2025, has applied since 1 September 2025, requiring both visible labels and hidden metadata. Measures for AI services that offer "continuing emotional interaction", companion-style chatbots, took effect on 15 July 2026. Generative AI services must be filed with the Cyberspace Administration before public launch.
The rest of Asia
- South Korea's AI Basic Act took effect on 22 January 2026, with fact-finding and fines held back for "at least one year", according to the government's own announcement. It covers high-impact AI, labelling of generative output, and a local representative for large foreign firms.
- Vietnam's AI law (Law 134/2025/QH15) took effect on 1 March 2026, with risk tiers and machine-readable marking, and a transition period for systems already in use.
- India has no AI law, but amended its IT Rules in February 2026 to require prominent labels and permanent metadata on synthetic content, with fast takedown duties for large platforms.
- Singapore has no AI law. Its financial regulator issued final AI risk management guidelines on 7 October 2026, applying in two phases from 7 October 2027 and 7 October 2028.
3. What lands next #
The two EU high-risk dates matter most to banks, insurers and anyone using AI in hiring.
20 November 2026. The EU's consumer credit directive applies. Where a lender's creditworthiness assessment uses automated processing of personal data, the consumer can ask for human intervention, including a clear explanation of the assessment. For credit, that's a year before the AI Act's high-risk rules.
2 December 2026. Generative AI systems placed on the EU market before 2 August 2026 must comply with the machine-readable marking duty. Two new EU prohibitions apply: AI that generates intimate images of an identifiable person without consent, and AI that generates child sexual abuse material.
1 January 2027. Colorado's automated-decision law, California's automated-decision rules, New York's RAISE Act and Illinois's frontier AI law all start in the same week. Colorado's Attorney General must adopt its rules by the same date. Until a court rules that federal policy overrides them, the state laws apply.
Early 2027. South Korea's grace period on fines ends, at the earliest.
2 December 2027 and 2 August 2028. The EU's high-risk rules apply in two stages. First come the Annex III uses, which include credit scoring, life and health insurance pricing, recruitment and access to essential services. Then come AI systems built into products already regulated under EU safety law. High-risk systems already in use before those dates are caught only after a significant change to their design, with one exception: those used by public authorities must comply by 2 August 2030.
What the EU high-risk rules will ask of a deployer. A deployer is an organisation using a high-risk system rather than building it. Under Article 26 it must use the system according to the instructions, and give human oversight to people "who have the necessary competence, training and authority". It must keep the system's automatic logs, where it controls them, for at least six months unless other EU or national law says otherwise; a bank or insurer keeps them with the records its financial services law already requires. And it must tell workers' representatives and affected workers before using it at work. Deployers of credit scoring and life or health insurance pricing must also carry out a fundamental rights impact assessment (Article 27). For a bank or insurer, the authority enforcing all this is its own financial supervisor, where the AI is used in direct connection with its financial services (Article 74). A deployer can also become a provider, with much heavier duties (Article 25). That happens if it puts its own name on a high-risk system, substantially modifies one, or changes a system's purpose so that it becomes high-risk. That last point is the trap for a bank that fine-tunes a vendor's model for credit decisions.
What isn't ready. Most of the harmonised standards that would give firms a presumption of conformity aren't there yet. The quality management standard, EN 18286, became the first to be cited in the EU's Official Journal, on 14 October 2026. The risk management standard is still a draft, and secondary reports say most national bodies rejected it at enquiry in July. The Commission's guidelines on what counts as high-risk were still a draft in October, after their statutory deadline passed in February.
What's stuck. The EU's proposal to change the GDPR, including a narrower definition of personal data and a new legal basis for training AI, has no agreed position from the Council or the Parliament. The GDPR applies unchanged.
4. Which sectors are ahead #
Ranked by binding obligations that bite on AI today, weighted by whether a supervisor with real powers is visibly using them:
- Medical devices. A gatekeeper existed before AI: devices need approval before sale. The US Food and Drug Administration's public list of AI-enabled medical devices ran to 1,614 entries on 4 September 2026.
- Financial services. Model risk rules, conduct rules and supervisors are already there, and they're adding AI. Singapore's guidelines apply from 2027. Canada's OSFI E-23 model risk guideline explicitly includes AI and applies from 1 May 2027. And the UK has SS1/23. Held back by the US carve-out of generative AI and the UK's choice of no new rules.
- Insurance. In the US, 29 jurisdictions, 27 states plus Washington DC and Puerto Rico, had adopted the insurance regulators' model bulletin on AI by 8 October 2026. Four more states have their own insurance AI rules instead.
- Consumer chatbots. Companion-chatbot laws in several US states, China's companion-AI measures, and the EU's transparency duties.
- Employment. Many laws, little enforcement. New York City's law on automated hiring tools is the cautionary case. A state audit published on 2 December 2025 found the city had received "only two" complaints in two years. Reviewing 32 companies, the city found "a single issue of non-compliance"; the auditors found "at least 17 instances of potential non-compliance".
- Public sector. Binding internal rules in places, mostly self-certified.
- Critical infrastructure. Covered by technology-neutral resilience and cyber laws, with AI-specific duties mostly voluntary until the EU high-risk date.
The pattern: the sectors that are ahead already had a gatekeeper or a validation function before AI arrived. AI governance moves fastest where it can be bolted onto machinery that already exists.
5. How long until it bites #
Neighbouring regimes give a rough guide, though no study measures this across regimes, so treat it as an analogy.
- Data protection is the slow outlier, and the slow part was the law. The OECD's privacy guidelines date from 1980; the GDPR applied from May 2018. France's regulator fined Google €50m eight months later.
- Model risk moved faster. The UK's SS1/23 was effective from May 2024, about two years after its consultation, because the supervision to enforce it already existed.
- Operational resilience in UK financial services took about seven years from a 2018 discussion paper to full compliance in March 2025. The EU's version, DORA, applied from January 2025 and designated its first critical providers that November, again on existing supervision.
On that pattern, regimes built into existing supervision mature in two or three years, and broad new laws take much longer to arrive. That suggests AI rules will bite soonest in financial services. The GDPR adds a warning for the EU's high-risk rules: once a broad law applies, the first big fine can come within a year. Two things don't transfer. AI is a technique, not a sector, so seven or more families of regulator are involved and maturity will be uneven. And unlike every earlier regime, US federal policy on AI is moving towards less regulation, not more.
Enforcement isn't waiting for AI laws anyway. It arrives through neighbouring law. Italy's data protection authority fined the company behind Character.AI €158,000 in July 2026 over privacy notices, a late impact assessment and age checks. In the US, consumer protection and privacy law are doing the same job.
6. Who's pushing which way #
Pressure for less regulation has changed binding law. The EU's Omnibus delayed the high-risk rules and softened the literacy duty. Colorado repealed and narrowed its AI Act. The US carved generative AI out of its bank model guidance. All three are enacted.
Pressure for more accountability has worked mainly through the states. They kept legislating while Washington pushed the other way. Four state regimes start on 1 January 2027, and California, New York and Illinois now require frontier developers to report safety incidents.
7. Where it's heading: three scenarios #
The same four duties turn up across the blocs, with a different trigger, addressee and deadline in each regime.
A. Most of the world converges on EU-style law. For: Korea, Vietnam, Kazakhstan, Peru, Italy and Taiwan have all passed laws of that broad shape since 2025, and Brazil's draft law is similar. Against: the EU delayed its own core rules, and the US, UK, India, Canada and Australia chose not to pass a horizontal act. The Council of Europe's AI treaty has one ratification, the EU's, and isn't in force. Weakly supported.
B. Fragmented law, converging duties. The laws keep splitting by bloc, but the same core duties spread across all of them: labelling, human review of consequential automated decisions, incident reporting, and an inventory with risk tiering. For: each of the four is already enacted somewhere. Labelling binds in the EU, China and India. Human review binds in the EU and the UK, and in Colorado from 2027. Incident reporting is enacted for EU high-risk providers and for frontier developers in New York, Illinois and California. Inventories and risk tiers are in the EU AI Act and the UK's bank model rules. Against: a US federal law that overrides the states and adopts EU-style risk tiers, or a second EU Omnibus that guts the high-risk rules, would collapse the blocs. Strongly supported. This is the forecast with the best evidence, because its premise is already enacted; the forecast is only that it holds.
C. Supervisors and standards lead. The pressure on regulated firms comes mainly from sector supervisors and certifiable standards, not AI statutes. For: Singapore, Canada, the UK bank rules and the US insurance bulletin. Against: more AI statutes were passed in 2026, not fewer, and the EU standards aren't in force. A good description of what a bank or insurer experiences day to day; a poor description of where the law is going.
What would show B is wrong: a merits ruling that federal policy overrides state AI laws, followed by a federal statute with a single risk-tiered regime; or the EU removing the Annex III high-risk duties.
8. What an organisation has to do #
Most organisations are deployers, meaning they use AI systems built by someone else. The four duties recur in name, but each regime sets its own trigger, its own addressee and its own clock. Colorado wants records kept for three years; the EU's deployer log rule is six months. So build the infrastructure once: one inventory, one route for people to challenge a decision, one incident intake, one store of evidence. Then record each regime's path inside it: what starts the duty, who carries it, and how fast.
The machinery
- Inventory: every AI use, tagged with your role (builder or user), the countries it touches, the regulatory category, the data it uses, and how much it acts on its own.
- Risk tiering: one internal scale that maps to each external one (EU tiers, bank model materiality, Korea's high-impact AI).
- Human review: one route for people to get a human to look at consequential automated decisions, with each regime's extra steps recorded on it. Those include Colorado's plain-language description of an adverse decision within 30 days, the UK's limits on special category data, and an explanation for EU automated credit assessments.
- Disclosure and labelling: tell people when they're dealing with AI. Mark generated content with metadata plus visible labels per market.
- Impact assessment: where required (EU credit and insurance pricing from December 2027; data protection impact assessments now).
- Incidents: one intake, with each clock recorded against the party it binds. The AI-law clocks bind providers and frontier developers. The EU gives 15 days, 10 for a death and two for a widespread infringement. New York and Illinois give 72 hours, California 15 days, and both Illinois and California 24 hours for imminent risk. An EU deployer must tell the provider immediately. A bank also meets the incident clocks in DORA and the UK's operational resilience rules.
- Vendors: contract for the documentation each regime expects your supplier to hand over (in the EU, the instructions for use the deployer has to follow) and for notice when the model changes.
- Logs and records: keep them for the longest period that applies. EU deployers keep the automatic logs they control for at least six months; Colorado deployers keep compliance records for three years after each decision.
- Ownership: one named, accountable executive. Bank model rules such as SS1/23 require one. The AI laws mostly don't: the EU asks for people with "the necessary competence, training and authority".
- Staff: training before access. The EU duty is now soft, but it's the cheapest evidence you have governance at all.
ISO/IEC 42001, the certifiable AI management system standard, maps to most of this list. But it gives no presumption of conformity under the EU AI Act, and Colorado's new law removed the defence the old one gave for following it. Treat certification as evidence that a system works, not as compliance.
Where the regimes conflict
- Bias testing. The EU AI Act and California's employment rules expect you to test for discriminatory effects, and Illinois makes AI with a discriminatory effect on employees unlawful, which in practice means testing to know. US federal policy is moving the other way. The Justice Department argued in the Colorado case that the 2024 law breached equal protection. The FTC's proposed statement goes further. It says steering a model's outputs to comply with a state law "may deceive consumers in violation of section 5 of the FTC Act", and it names Colorado's revised Act as the example. Keep testing where it's required, and take advice on how to describe it in the US.
- Automated decisions. The EU prohibits solely automated significant decisions, with exceptions. The UK permits them with safeguards, except on special category data. California and Colorado require notice and review from 2027. No single standard covers all of them, so build one route and record each regime's extra steps on it (item 3 above).
- Labelling formats. China requires visible labels plus hidden metadata; India requires permanent metadata and fast takedown; the EU's code of practice combines metadata and watermarks; California requires latent disclosures. A provenance layer plus per-market labels is the workable answer.
- Federal versus state in the US. The state laws apply from 1 January 2027, though Colorado's can't be enforced until its rules are final and the court has ruled on an injunction. Federal preemption is a litigation risk, not a defence, until a court rules.
The calendar
- Now to 1 January 2027: New York's frontier developer registration (November). EU credit human review (20 November) and marking for older generative systems (2 December). The four US state regimes, and Colorado's rules, on 1 January. Labelling in China and India; Korea's operator duties.
- 2027: Canada's OSFI E-23 (May); Singapore's MAS guidelines, first phase (October); the EU's Annex III high-risk rules (2 December), including impact assessments for credit and insurance pricing.
- 2028: EU high-risk rules for regulated products (August); MAS in full (October).
- Watch, not yet act: the US bank AI request for information; the EU GDPR changes; a merits ruling in the Colorado case.
9. Limits #
The research covers five regions in depth and others in passing. It reads the law and the regulators, not inside organisations: whether any governance design produces better outcomes is unmeasured, because firms publish structures, not results. The scenario weights are judgement. The maturity analogy rests on a handful of regimes, with no study across regimes behind it. And the most volatile facts here, the US federal-state fight, the EU standards and the GDPR proposal, could change within weeks. The research is due a full re-check by 1 December 2026, when its watchlist starts to go stale.
Sources #
How this was produced: research runs on 5 and 10 October 2026 pulled primary sources and graded each claim by the strength of its evidence. On 14 and 24 October the dates and scope the argument rests on were checked against the primary sources below. Where only secondary reporting was available, the text says "reported" or names the reporter.
- EU: Regulation (EU) 2024/1689 and Regulation (EU) 2026/1744 (EUR-Lex); Commission Implementing Decision (EU) 2026/2274 (Official Journal, 14 October 2026), citing EN 18286; Directive (EU) 2023/2225 on consumer credit, Articles 18 and 48; European Parliament legislative resolution of 16 June 2026 (P10_TA(2026)0198); Commission AI Act enforcement page (updated 6 October 2026) and high-risk guidelines page; JTC 21 on prEN 18228; Council simplification page (reviewed 9 October 2026); Parliament procedure file 2025/0360(COD); reporting of the Commission briefing of 1 September 2026 (Allegiance Law; LexisNexis); Garante decision on Character Technologies (decided 3 July, announced 9 July 2026); CNIL sanctions list (Google, 21 January 2019).
- UK: King's Speech 2026 background briefing notes (13 May 2026); gov.uk, advisory AI Growth Lab (8 June 2026); Data (Use and Access) Act 2025, section 80, and SI 2026/82 (commencement); FCA AI approach page (2 October 2026); PRA SS1/23 and LIAF01/26; Bank of England on critical third parties (10 July 2026) and SI 2026/777.
- US federal: Executive Order 14365 (11 December 2025); TAKE IT DOWN Act, Public Law 119-12 (19 May 2025); FTC proposed policy statement (Federal Register, 7 July 2026) and press release (1 July 2026); X.AI LLC v. Weiser, 1:26-cv-01515 (D. Colo.), the United States' complaint (ECF 17) and minute order of 27 April 2026 (ECF 24); Federal Reserve SR 26-2 and OCC Bulletin 2026-13 (17 April 2026) with OCC news release 2026-29; FDA list of AI-enabled medical devices (4 September 2026).
- US states: Colorado SB 26-189 and C.R.S. 6-1-112; California CPPA on ADMT, AB 853, SB 1000 and SB 53; New York S8828 and the Governor's releases of 19 December 2025 and 21 September 2026; Illinois Public Acts 104-0538 and 103-0804; Texas HB 149; Utah Code 63I-2-213; NY State Comptroller audit of Local Law 144 (2 December 2025); NAIC model bulletin adoption map (8 October 2026); Transparency Coalition (21 July 2026) and NYU Center on Technology Policy counts.
- China and Asia: GB 45438-2025 (national standards portal); CAC measures on anthropomorphic AI interaction services and filing figures (14 September 2026); State Council 2026 legislative plan; Ministry of Science and ICT on the AI Basic Act; Japanese Law Translation database, Act No. 53 of 2025; Vietnam Ministry of Science and Technology (1 March 2026); Taiwan national law database; Akorda and the US Library of Congress on Kazakhstan; El Peruano on Peru's decree; Italy's Gazzetta Ufficiale (25 September 2025); MeitY consolidated IT Rules; MAS (7 October 2026); OSFI E-23.
- Context and analogues (from the research runs, not re-checked on 14 October): EU AI Act penalty articles; EBA's November 2025 mapping of the AI Act against banking law; the OECD privacy guidelines; UK operational resilience policy (PS21/3) and compliance date; DORA designations (November 2025); Council of Europe Framework Convention on AI (CETS 225) treaty status.