AI Regulation Watch: What Changed This WeekBy Tom Morgan · Regulation Desk · Last verified October 6, 2026 · 10 min read
Direct answer: The biggest shift of the past two weeks is not a new federal rule. On September 29 six AI companies signed a voluntary White House accord. In the same period, state attorneys general of both parties began using existing consumer-protection law against an AI developer, and California rewrote its AI Transparency Act on September 30, widening who it covers. The EU’s Article 50 duties, live since August 2, remain the most concrete obligation for publishers.
Not legal advice. This page maps public sources so you can ask a qualified lawyer better questions.
Confidence key: Established = confirmed by a primary source or several independent outlets · Reported = credible secondary reporting, no primary document found · Contested = sources disagree or the measure is being challenged.
Binding or voluntary? Every entry is tagged. A voluntary pledge is not law, however it is described at the podium.
| Date | Development | Binding? | Confidence |
|---|---|---|---|
| Oct 5 | NYC Council hearing on AI risk and regulation | No (hearing) | Established |
| Oct 4 | Super Intelligence Force created; Jay Clayton named AI czar | Policy body, no new law | Established |
| Oct 1 | California AG subpoenas OpenAI over agent cybersecurity incidents | Investigative, no finding of violation | Established |
| Oct 1 | Connecticut AI-companion and whistleblower law takes effect | Binding | Established |
| Sep 30 | California SB 1000 rewrites the AI Transparency Act (effective on enactment) | Binding | Established |
| Sep 30 | Newsom acts on the last AI bills: 13 signed, 4 AI-related vetoes | Binding | Established |
| Sep 29 | White House Accord on Super Intelligence | Voluntary | Established |
| Sep 18 | Newsom executive order on independent oversight and “kill switch” research | Executive direction | Established |
| Sep 9 | California SB 813 and AB 1405 signed (AI auditor framework and registry) | Binding | Established |
| Aug 3 | 15 Republican state AGs send OpenAI a records-preservation demand | Not binding (legal notice) | Established |
On September 29, 2026, Trump and the heads of Google, Anthropic, Meta, OpenAI, xAI and Nvidia signed the White House Accord on Super Intelligence. It calls for internal controls, an internal oversight team, independent outside auditors and a board committee to review results. It sets no penalties, does not require public release of audit results, gives the government no enforcement role, and leaves implementation to each company. The text says it “may make sense” to codify the measures later. Trump called it “morally binding”; House Speaker Mike Johnson called it voluntary. (One signatory is the maker of the AI system that helped draft this page; see the disclosure at the end.)
What to watch: who the auditors are (the accord does not say who performs third-party evaluations), and whether any company publishes results.
On October 4 Trump announced the Super Intelligence Force, led by Director of National Intelligence Jay Clayton as AI czar, with FTC Chair Andrew Ferguson, Emil Michael and Scott Kupor as vice chairs (Established). Reporting based on a Wall Street Journal interview says it has 120 days to report on risks and rewards and to define the government’s role (Reported; we found no White House document stating the clock). That points to early 2027, with no exact date.
Separately, a September 29 executive order directs agencies to use the terms “Super Intelligence” and “SI,” and reportedly asks the White House science adviser for legislative language defining the term within 60 days (Reported). California answered on September 30 with Executive Order N-10-26, which keeps state agencies using “AI.” Terminology is not law, but it shows the two governments are not coordinating.
No comprehensive federal AI law exists (Established). Senator Hawley announced legislation for a national AI incident database, mandatory serious-incident reporting and federal pre-deployment testing environments. It is an announcement, not law. For the preemption fight, see our AI Regulation guide.
Three actions, one legal theory:
Two things are easy to get wrong:
1. Auditors and oversight (Established). SB 813 (signed Sept 9) directs the Government Operations Agency to set up a process for certifying independent verification organizations by January 1, 2028. AB 1405 (signed Sept 9) creates an AI Auditor Registry by January 1, 2029. On September 18, Newsom’s executive order told the agency to accelerate both and convened experts to report within two months on options that include a frontier-model “kill switch” (so, around mid-November).
2. AI Transparency Act rewritten (Established). SB 1000 is covered in detail in the next section. AB 2713, signed the same day, also amends the act; the governor’s office describes it as prohibiting deletion of digital watermarks and allowing access to provenance metadata. We have not read its chaptered text.
3. Workers and healthcare (Established). The governor’s September 30 list of 13 signed bills includes SB 947 (employment automated decision systems; the release says employers may not rely only on AI for discipline or termination), SB 951 (notice when a mass layoff is caused by an AI system), AB 1883 and AB 1331 (workplace surveillance), AB 1979 and SB 503 (healthcare AI), SB 574 (lawyers may not hand core legal work entirely to AI), SB 1111 (digital replicas), AB 1864 (gene-synthesis screening), AB 2392 (AI procurement and training in public higher education) and SB 1159 (AI transparency and governance).
4. Vetoes (Established). The governor’s September 30 update lists four AI-related vetoes, each with a published message: AB 2575 (healthcare AI), SB 903 (AI in mental health professions), AB 2656 (notice to public employees about AI performing their work) and SB 1130 (wearable recording devices). Earlier in September he signed SB 1050 (disclosure for ads using AI-generated performers) and the companion-chatbot child-safety bills.
The ADMT Act (SB 26-189) applies from January 1, 2027. The Attorney General released draft rules on August 11 for it and for the separate Chatbot Safety Act (HB 26-1263), with January 1, 2027 as the proposed rule effective date. The rulemaking hearing is October 26, 2026, and formal comments are open through that date.
A new law took effect October 1. It requires operators of “AI companions” to have protocols to detect users showing a risk of suicide, self-harm or imminent violence, and to ensure the bot never claims or implies it is human. It also bars providing companions to minors without parental controls and protects AI-company whistleblowers. Separately, Connecticut S.B. 5 (Public Act 26-15) regulates automated employment decision tools.
The City Council held a hearing on AI risks and regulation on October 5, with testimony from Anthropic, OpenAI, Google and Meta. Google’s line was that conduct illegal without AI remains illegal with AI. Reporting says the council is considering 10 bills (Reported); none is law.
SB 1000 took effect immediately. If you read about the act before September 30, much of what you read is out of date. Based on Morrison Foerster’s October 1 analysis (check the chaptered text before relying on any clause):
| Topic | Before SB 1000 | After SB 1000 |
|---|---|---|
| Who is covered | Providers of a publicly accessible GenAI system with more than 1 million monthly users or visitors | Any person that creates, codes or produces a GenAI system publicly accessible in California |
| Exemption | Non-user-generated video games, TV, streaming, movies and interactive experiences | Narrowed to non-user-generated video games only |
| Free tool | “AI detection tool” | “Disclosure verification tool,” still free; ignores minor modifications (cropping, resizing, color changes); a qualifying third-party tool may satisfy the duty; providers may limit access to prevent misuse |
| Personal data | Tool may not output personal provenance data | Tool may not output personal information unless the person consents after notice; no collection, use, retention, sale or sharing beyond what is strictly necessary; access may not be conditioned on extra personal data |
| Visible label | Providers had to offer users an option to add a manifest disclosure | Option eliminated |
| Embedded (latent) disclosure | Required where technically feasible: provider name, system name and version, time and date, unique ID | Kept, and must now also state whether the system created or altered the content; must be permanent or extraordinarily difficult to remove, work with the verification tool and follow widely recognized standards |
| Licensees | License-revocation framework | Provider notifies licensees of duties; once it knows of a noncompliant modification it has 72 hours to terminate or notify; the licensee has 96 hours to fix or stop and report; if no report arrives, the provider reports to the California AG. No duty to monitor licensees |
| Assistive technology | No exemption | Temporary exemption to Jan 1, 2029; falsely claiming it carries a $50,000 per-violation penalty, each day a separate violation |
| Platform duties (AB 853) | Large platforms and GenAI hosting platforms from Jan 1, 2027; capture devices from Jan 1, 2028 | Unchanged |
What this means in practice
Nothing new from the Commission this week: a daily governance briefing found no enforcement action, fine or AI Board decision for October 4 to 5 (Reported). The state of play:
Commentary now frames the EU’s focus as a shift from legislating to implementing.
This section is our reading of the evidence, not reported fact. We name what would change our mind.
1. The accord costs little and signals a lot. Signatories pick the controls and the auditors, and publish nothing. Critics quoted in coverage say it lacks independence and anything that crosses a border; defenders say it sets a baseline and that its own text contemplates codification. The test is observable: if auditors are not named and no result is published by the time the Super Intelligence Force reports, the pledge stayed a pledge. A published audit would change our view.
2. State enforcement is not a partisan pattern. The preservation letter came from 15 Republican AGs, the Alabama subpoena from a Republican AG, and the October 1 subpoena from a Democrat. Same facts, same theory: existing consumer-protection and privacy law applies. Google’s testimony (“if it’s illegal without AI, it’s still illegal with AI”) is the industry’s own formulation, and it cuts two ways: it argues against new AI-specific laws and concedes that old ones apply. Critics of this approach argue it stretches statutes written for other conduct and invites inconsistent results across states. Supporters answer that no federal regulator exists. Neither side has been tested in court on these facts, so we would not predict outcomes yet. A filed complaint or a consent order would be the first real evidence.
3. Two audit systems may collide. The accord’s “independent outside auditors” and California’s SB 813 verification organizations address the same need with different rules. Our expectation, which is speculation, is that large developers will push for one audit to satisfy both. A federal statute codifying the accord with preemption would change that picture.
4. For publishers and small builders, nothing this week lowers the EU Article 50(4) bar, and SB 1000’s removal of the one-million-user threshold is the largest immediate scope change for anyone shipping a public generative tool into California.
| Date | Event | Confidence |
|---|---|---|
| Oct 15 | Comments close on NIST SP 1353 (non-binding draft guide on using AI for Cybersecurity Framework reporting) | Established |
| Oct 26 | Colorado ADMT and Chatbot Act rulemaking hearing | Established |
| ~Mid-Nov | California expert recommendations under the Sept 18 executive order (“within two months”) | Established (approximate) |
| ~Late Nov | Science adviser’s proposed legislative definition of “Super Intelligence” (60 days from Sept 29) | Reported (approximate) |
| Dec 2 | EU marking grace period ends; new prohibition on non-consensual intimate content and CSAM generators applies | Established |
| Jan 1, 2027 | Colorado ADMT Act applies; NY RAISE Act effective; California platform and hosting duties under AB 853 begin | Established |
| Early 2027 | Super Intelligence Force report due | Reported |
| Jan 1, 2028 | California independent verification organization process due; capture-device duties begin | Established |
Is the White House accord a law? No. It is voluntary, with no penalties and no required public disclosure.
Does a state subpoena mean a company broke the law? No. It is an information demand. California has not identified a specific violation.
Who has to comply with California’s AI Transparency Act now? Since SB 1000, any person producing a publicly accessible generative AI system in California, not only providers above one million monthly users. Check the enacted text for exemptions.
Is the EU ban on AI nudification tools in force? It applies from December 2, 2026; companies have until then to comply.
Did Japan’s AI law take effect in 2026? No, September 1, 2025.
This page was researched and drafted with AI assistance (Claude, made by Anthropic, which is also a signatory of the White House accord discussed above). Tom Morgan reviewed the facts and sources and holds editorial responsibility for what we publish. We checked bill outcomes against the California governor’s published lists; EU dates against the European Parliament and Commission; and the Colorado hearing and NIST deadlines against agency or law-firm notices. We label items we could not confirm in a primary document as Reported. Our general process is on the methodology page.
See an error or a missing development? Contact us, and we will verify and update this page.
Primary and official
News and law-firm analysis
Last updated October 6, 2026. This is a research summary, not legal advice. Statutes get amended, and rules are still being written, so check the primary text before you ship anything. Eighteen months ago, “AI companion law” meant a single New York statute that almost nobody had read. Today three of the most watched legislatures … Read more
Short answer: Almost anyone who builds a generative AI system that people in California can reach. On September 30, 2026, Governor Newsom signed SB 1000, which deletes the old “more than 1,000,000 monthly users” test from the definition of a covered provider. The law took effect immediately. A startup with 2,000 users now sits under … Read more
AI regulation · Updated 6 October 2026 Information, not legal advice. Check your own situation with counsel who knows EU media and AI law. The short answer. You need a visible disclosure if four things are all true: you use an AI system professionally, the text it generates or manipulates is published, the text aims … Read more