Reading guide · announced, in force and enforced are three different things

01EU: the only comprehensive law at the enforcement stage, but the heaviest duties were postponed

The base law is Regulation (EU) 2024/1689 (the AI Act), in force since Aug 1, 2024 and applying in phases. The key variable of 2026 is the amending Regulation (EU) 2026/1744 (the Digital Omnibus on AI): provisional trilogue agreement on May 7, adopted by Parliament on June 16, approved by the Council on June 29, published in the Official Journal on July 24, in force on July 27. The official reasons for the delay are in the amending law's recitals: harmonized standards were late, and so were national supervisory authorities. The direct cause was that two pieces of compliance infrastructure, standards and institutions, were not delivered on time, not a political retreat.

Today, the AI Act duties a company actually carries in the EU fall into four groups: no Art. 5 prohibited practices plus staff AI literacy; GPAI provider obligations; Art. 50 transparency; and existing statutory duties such as the GDPR. The full high-risk regime (risk management, data governance, conformity assessment, EU database registration, post-market monitoring) does not yet apply; the preparation period now runs to December 2027.

The first harmonized standard, EN 18286:2026, covers only the "management system"

Drafted by CEN-CENELEC JTC 21. The Commission published its reference in the Official Journal through Implementing Decision (EU) 2026/2274 (secondary sources date publication to October 14; the Commission announced it publicly on October 19). Publication is what triggers legal effect under Art. 40.

• The presumption covers only the quality management system (Art. 17) Verified live. Risk management (Art. 9), data governance (Art. 10), human oversight (Art. 14) and accuracy, robustness and cybersecurity (Art. 15) still have no harmonized standard; providers must argue compliance themselves.
• The high-risk duties it maps to only apply from Dec 2, 2027. It offers an early path to presumption, not a fix for duties that can be penalized today.
• ISO/IEC 42001 certification does not by itself create an AI Act presumption. The online claim that "EN ISO/IEC 42001:2026 confers presumption" conflicts with the Commission's statements; we do not accept it (see item 1 of the unverified list).

Two Codes of Practice; do not confuse them

At member-state level: as of October 2026 most member states have still not legislated national penalty procedures. That is the concrete shape of the gap between "a law at EU level" and "no penalties at national level". Spain's own AI governance bill (Bill 121/000096) lapsed on October 6, 2026 when parliament was dissolved (Real Decreto 806/2026); whether it is revived is for the new parliament after the November 29 election; Italy went ahead with a national implementing law (details only in secondary reporting, omitted here).

02US federal: no comprehensive law, just "take apart state law" plus voluntary channels

Baseline fact: as of October 2026, Congress has passed no comprehensive AI law. Federal "AI regulation" consists of four parts: executive orders, existing statutes applied by agencies, voluntary standards (NIST), and litigation and funding pressure against state laws. The Senate voted 99 to 1 to strip a ten-year state AI law moratorium from the 2025 reconciliation bill, and the FY2026 NDAA did not include a preemption clause either.

EO 14365: four mechanisms to take apart state law, and one case of "announced is not delivered"

Signed Dec 11, 2025. An executive order is not law and cannot repeal state law by itself. Its mechanisms: a DOJ AI Litigation Task Force (formally set up by internal memo on Jan 9, 2026); a direction to the Commerce Secretary to publish, within 90 days (by Mar 11, 2026), an assessment of "onerous" state AI laws, tied to the $42.45B BEAD broadband program; directions to the FCC to consider a federal AI disclosure standard and to the FTC to issue a policy statement under Section 5 of the FTC Act; and preparation of legislative recommendations.

According to law firms tracking it from March to August 2026, neither the Commerce assessment nor the BEAD policy notice was published by the deadline, and no final FCC or FTC action has appeared. This is the most important "announced is not delivered" example in this section. Section 8(b) of the EO carves out exceptions: child safety, AI compute and data-center infrastructure, and states' own procurement and use are outside the scope of challenge.

EO 14409: a pre-release access channel, voluntary, and explicitly not a license

Signed June 2, 2026. Section 3 sets a 60-day clock (to Aug 1): build a classified benchmarking program to evaluate models' advanced cyber capabilities, with the determination resting with the NSA Director; and set up a voluntary framework under which developers can ask whether their model is a "covered frontier model" and give the government up to 30 days of early access before releasing it to "trusted partners".

"Nothing in this section shall be construed to authorize the creation of a mandatory governmental licensing, preclearance, or permitting requirement."

EO 14409, Sec. 3(c). Describing it as "federal pre-release approval" is wrong. Because the program is classified, how the framework actually operates cannot be verified from public primary sources.

National Policy Framework (Mar 20, 2026)

A White House legislative proposal: ① Announced, non-binding. Seven pillars: protecting children and empowering parents; securing and strengthening American communities; respecting intellectual property and creators (training-data copyright explicitly left to the courts); preventing censorship and protecting free speech; enabling innovation and US AI dominance (explicitly opposing a new federal AI regulator); workforce and education; and federal preemption of "onerous" state AI laws while preserving state police powers such as child protection and fraud. Congress has not legislated on it.

NIST AI RMF: still version 1.0, yet a "quasi-compliance currency"

AI RMF 1.0 (NIST AI 100-1, Jan 26, 2023) is still the current version: voluntary and non-binding. NIST says it is revising it under the White House AI Action Plan (whose directions include removing references to misinformation, DEI and climate change); as of Sep 28, 2026 no 2.0 draft or timetable has been published. The Generative AI Profile (NIST AI 600-1, 2024) remains the current profile. CAISI (the US AISI, renamed in June 2025) has no veto over releases; its engagement with labs runs on voluntary agreements. Its AI Agent Standards Initiative launched Feb 17, 2026.

The RMF's compliance effect comes from being cited: Texas TRAIGA makes substantial compliance with the NIST AI RMF a safe harbor, and federal procurement and corporate vendor questionnaires routinely ask for an RMF crosswalk.

What agency guidance actually does: old law applied, not new rules

• FTC: uses Section 5 of the FTC Act against "AI washing" (false claims of AI capability). Operation AI Comply is the most concrete federal AI enforcement line (see the Cox Media case in section 07).
• EEOC and the courts: the EEOC withdrew its AI hiring technical-assistance documents, but Title VII itself has not changed. Mobley v. Workday (alleging disparate impact from AI hiring screens) was allowed to proceed as a nationwide collective action in May 2025, and in June 2026 the court declined to dismiss most discrimination claims. In 2026, the largest federal compliance risk for AI in employment comes from the courts, not agencies.
• SEC: its stance is "deploy, don't wait for guidance", covering AI through principles-based fiduciary duty (from officials' speeches, Index text, not regulation).
• FDA: continues to regulate AI medical products through device authorization pathways; no AI-specific statute in 2026.

03US states: 280 enacted, only 2 comprehensive laws

NCSL basisVerified live

The structure first. The most common enactments in 2026 were deepfake laws (sexual content, political ads, digital likeness); proposals requiring notice that a user is talking to AI nearly tripled; health and education measures appeared in large numbers. Only 2 comprehensive AI laws were enacted in 2026, Colorado SB 189 and Connecticut SB 5; everything else is sectoral or topical. Any claim that "states already have hundreds of comprehensive AI laws" misreads the NCSL count. Real state enforcement still runs on the old tracks of privacy, consumer protection and civil rights law: as of October 2026 we found no report of any state fine or public enforcement action under its new 2026 AI laws.

Sector laws: the parts that actually "bite" in 2026

04UK: no AI act, no single regulator, a "patchwork of regulators"

The House of Commons Library briefing (CBP-10003, updated Oct 14, 2026) opens plainly: "The UK does not have any AI-specific regulation or legislation covering AI as a technology". Labour promised in its 2024 manifesto and the King's Speech to place binding regulation on the handful of companies developing the most powerful models; no government bill has been introduced. Every constraint with compliance effect comes from existing law applied by sector regulators.

AISI: the evaluation capability is real, the statutory power is zero

The AI Safety Institute was set up in November 2023 and renamed the AI Security Institute on Feb 14, 2025. Legally it is a directorate within the Department for Science, Innovation and Technology (DSIT): no separate legal personality, no board, no duty to publish, no power to compel information or block a release; frontier model evaluations all rest on voluntary access arrangements with labs. AISI is not a regulator and does not certify products; a vendor's claim of "tested by AISI" is not proof of compliance.

The Joint Committee on Human Rights concluded in its Sep 14, 2026 report that the UK needs a dedicated AI Bill and a single independent statutory oversight body. Three Lords amendments in October 2026 to "assemble a regulator" were all non-government and none passed; their shared structural problem is that the body they would empower does not exist in law. The Crime and Policing Act 2026 created a regulation-making power related to illegal AI-generated content; the Commons Library confirms it "has not yet been used".

Where compliance really lives: old law plus regulators' interpretation

• Data protection (ICO): the automated decision-making provisions of the Data (Use and Access) Act apply from Feb 5, 2026. The ICO has committed to a statutory code of practice on AI and automated decision-making (expected 2027); on Oct 8, 2026 it published a 37-page call for evidence on agentic AI, closing Nov 20, 2026. The document creates no duties, but it sets out the regulator's reading of current law and should be treated as advance notice of inspections.
• Finance (FCA and PRA): explicitly not planning AI-specific rules; they apply the Consumer Duty and the Senior Managers and Certification Regime (SM&CR). The core demand: every AI system has a named accountable person and evidence to show. The Mills Review (July 6, 2026) found the model still sound for low-autonomy AI, but said accountability comes under strain when AI approves decisions on its own.
• Others: Ofcom regulates online services, including AI chatbots, under the Online Safety Act; the Equality Act applies to discriminatory outcomes caused by AI.

The ceiling of the UK model showed in October 2026: on October 13 and 14, OpenAI representatives could not assure MPs that there were no further undisclosed incidents; that same week, the EU sent its first targeted information requests. Hearings make headlines; the enforcement tools are in Brussels.

05China: the highest enforcement density, on a different road

China runs three tracks at once: a filing and registration ledger (a continuously operating system of administrative admission and public disclosure), dedicated departmental rules (such as the measures on anthropomorphic interaction services), and campaign-style content enforcement (the Qinglang campaigns). A comprehensive AI law entered the annual legislative work plans of both the State Council and the NPC Standing Committee on May 11, 2026, worded for the first time as "comprehensive legislation", but no draft has been published and nothing has been enacted.

The filing and registration ledger: a hundred-plus entries every two months

The legal basis is the Interim Measures for Generative AI Services (2023): services offered to the public with public-opinion attributes or social mobilization capacity are filed with the national CAC; applications that call a filed model via API are registered with local offices; live applications must display the model name and filing number they use. CNNIC also reports that users passed 700 million in the first half of 2026, with penetration above 50%. Internal tools used only on a company intranet create no filing duty (the common interpretation, not the text of the notice).

Measures on anthropomorphic interaction services: the first dedicated rules for emotional AI

② Enacted · published 2026-04-10③ In force · 2026-07-15

Issued jointly by five bodies: the CAC, the National Development and Reform Commission, the Ministry of Industry and Information Technology, the Ministry of Public Security and the State Administration for Market Regulation. It is China's first national-level rule aimed specifically at AI anthropomorphic interaction services (several commentators say the world's first as well).

• Scope: services offered to the public in China that simulate a human personality for ongoing emotional interaction; customer-service bots, Q&A and work assistants without ongoing emotional interaction are excluded.
• Red lines: no excessive flattery, no inducing emotional dependence or addiction; no emotional manipulation to induce unreasonable decisions; when extreme emotions are detected, the system must respond with reassurance and guidance toward help; a usage-time reminder at least every 2 hours of continuous use.
• Minors: no virtual intimate relationship services such as virtual relatives or virtual partners; guardian consent for other anthropomorphic services to users under 14; a mandatory minors' mode.
• Penalties: tiered, from warnings, public criticism and orders to correct, up to suspension of registration or service; refusal to correct or serious cases lead to suspension and fines of ¥10,000 to ¥100,000; endangering life or health with consequences, ¥100,000 to ¥200,000.

④ Enforced As of October 2026 we found no first penalty cases under these measures. A separate State Council draft regulation on minors' safe use of the internet (consultation draft, September 2026) forms a pairing: "departmental rules in force, a higher-level rule on the way". The latter is still at the ① Announced stage.

Agent policy: from "governing outputs" to "governing actions"

• May 2026: the CAC and other bodies issued Implementation Opinions on the Standardized Application and Innovative Development of AI Agents, defining agents officially for the first time and proposing to explore an agent registration platform, digital identity management, capability declarations, behavioral guardrails and permission management. (We did not open the primary text; the issuing bodies and exact date are on the unverified list.)
• July 2026: a series of national guiding technical documents on AI agent interconnection was released; a mandatory national standard, Basic Security Requirements for Agent Applications, was put on the drafting plan, at stage ① Announced.
• Sep 14, 2026: the national cybersecurity standardization committee (TC260) released the AI Safety Governance Framework 3.0, extending governance across data, algorithms, models, applications and the supply chain.

The governance chain now runs "agent identity, authorization, credentials, tool calls, execution, logging, anomaly blocking, accountability". To be clear: most of these documents are opinions, frameworks and standards, not statutory duties that can be penalized directly. They are expected to harden through national standards and later rules.

Comprehensive legislation: on two plans, no draft yet

On May 11, 2026, the State Council's 2026 legislative work plan called for "improving AI governance and accelerating comprehensive legislation for the healthy development of AI". According to an article by Shen Weixing in The Jurist (issue 5, 2026), this is the first time the phrase "comprehensive legislation" appeared in a State Council annual plan. The same day, the NPC Standing Committee's 2026 plan listed "the healthy development of AI" as a preparatory item: research and study first, review when ready, not a must-review this year.

Its stage is only ① Announced: no draft text, no review, no enactment. Until then the system remains a dispersed toolkit: the Cybersecurity Law, Data Security Law and Personal Information Protection Law, plus the rules on algorithmic recommendation, deep synthesis, generative AI and labeling of synthetic content, plus the anthropomorphic interaction measures. The 2026 plans settled the debate over whether to legislate, not over what the law should look like.

06Compliance practice: the weight is on standards, frameworks and procurement, not in court

Survey evidence: discount by source type

• IAPP AI Governance Profession Report 2025 (still cited by many 2026 sources): 77% of organizations are building AI governance programs, but most lack a unified accountability structure. In 2026 the IAPP also released an AI Governance Skills Framework that splits governance work into eight functions: governance is becoming a profession, not a side job.
• Schellman, State of AI Governance Report 2026 Vendor-reported (commissioned by an audit firm, n=525, self-reported by US practitioners): 90% say they have funded AI governance and 74% believe they could pass an AI compliance audit, but only 27% describe their program as "fully mature". The right reading is "a 47-point gap between self-assessed confidence and self-assessed maturity (vendor survey)", not an objective audit finding.
• Deloitte, State of AI in the Enterprise 2026 (n=3,235, cited secondhand): only about one in five organizations has a mature governance model for autonomous agents. We did not open the primary report; treat it as a secondary reference.

The summer agent incidents: the first public stress test of voluntary frameworks

The EU AI Office judged both companies' voluntary disclosures insufficiently deep and escalated to formal information requests (section 01). The incidents gave the "real use" of frameworks its first externally checkable sample in 2026: not evaluation scores, but the incidents themselves and how disclosure, retrospective review and notification of victims were handled.

The third-party evaluation ecosystem: the independence fight moves from "what to test" to "who may publish"

• METR: known for its task-length (Time Horizon) metric; deliberately keeps an independence policy of taking no frontier-lab funding, and holds a technical support contract with the EU AI Office. In METR's own disclosure (Aug 14, 2026), it raised about $71M in commitments over the previous six months, from philanthropic donations and taking no lab funding; commitments, not cash received. On Oct 14, METR proposed a voluntary "embedded evaluation" scheme: independent evaluators work inside labs to gather evidence and publish reports stating scope and redactions. METR itself says the scheme gives no safety guarantee and cannot replace audits, regulation or security review.
• Apollo Research: specializes in detecting scheming, sandbagging and evaluation awareness; has long had pre-release API access and contributes to system cards. Its blog series of Sep 30 to Oct 5, 2026 argues for "embedded evaluations": evaluators should have near-employee, continuous access throughout training, not just a brief pre-release window. Its July position paper states plainly that there is currently no training-time access.
• The first case, and the pushback: per Anthropic's own post ('An update on independent evaluators', Oct 15, 2026), 6 METR staff are embedded with employee-like access; Anthropic cannot veto METR's publication and may request redactions only in narrow categories such as national security and unreleased product information.

The map of evaluators: secondary summaries based on system-card credits show that Google DeepMind's Gemini 4 Argon safety report for the first time named 6 outside testers (UK AISI, US CAISI, Apollo, Faculty, Gray Swan, Trajectory Labs); Gray Swan is credited by 4 labs, and Apollo, Irregular and UK AISI by 3 each. SecureBio runs pre-release bio and chem capability evaluations for OpenAI and Anthropic.

An "accredited evaluator" regime does not yet exist. Apart from the statutory audit demand Illinois SB 315 creates from 2028 (the law sets no accreditation or qualification scheme for evaluators) and NYC LL 144's "independent bias audit" (no accredited list), there is no operating AI evaluator accreditation regime anywhere in 2026. Who is qualified to audit, against what standard, and what legal weight an audit opinion carries remain blank. That gap is both the audit market's largest growth area and its largest risk.

Frontier labs' own safety frameworks: 2026 versions and real use

The cross-cutting conclusion: the shared direction of the three main frameworks in 2026 is "from hard commitments to disclosable processes". Pause and gating language is weakening; roadmaps, risk reports and public frameworks are strengthening. This and the state-law choice to require transparency but not substantive gating are cause and effect of each other. The AI audit market is "supply first, statutory demand late": all Big Four accounting firms have built teams, but there are only three statutory anchors so far (NYC LL 144, EU high-risk conformity assessment from December 2027, Illinois annual independent audits from 2028); the rest of the demand comes from procurement and insurance questionnaires.

07The enforcement gap: penalties under AI-specific law are close to zero worldwide

The landmark cases of 2026 all ran on general law

Four structural causes of the gap

08Market signals: capital favors evaluation and runtime security over documentation-style governance suites

Market size estimates: three sets of numbers that cannot be compared

The differences come from how the market is defined (platform software, the broad TRiSM basket, all governance spending), not from disagreement over measuring the same market.

The Gartner figure (February 2026, reported secondhand) has the narrowest definition and is the most citable, but it is still an analyst forecast with undisclosed methods. Another research firm gave TRiSM at $3.54B (2026) to $21.1B (2035) the same year: same market name, different numbers, which shows how sensitive these estimates are to model assumptions. The "$2.54B total enterprise AI governance spending in 2026" seen on aggregator sites has no original source and is rejected.

Vendor landscape and 2026 capital moves

Enterprise buying actually takes the form of layered assembly, not a single platform: governance suites (registry plus evaluation, such as Credo AI and Holistic AI), an observability and monitoring layer (Arize, Fiddler and similar), and a runtime security layer (prompt boundaries, gateways). Incumbents (IBM, Microsoft, ServiceNow, OneTrust, SAP) squeeze independents through distribution and existing GRC contracts; IBM reselling Credo AI Policy Packs on an OEM basis is the typical example of "independent vendor plus incumbent channel" symbiosis. Gartner has made AI Governance Platforms a formal category.

• The consolidation thread (2024 to 2025): big security vendors absorbed AI governance and runtime protection into their portfolios: Cisco bought Robust Intelligence (2024), Palo Alto Networks bought Protect AI (July 2025), Check Point bought Lakera (September 2025). No public report of a deal of similar size in 2026.
• Funding: the evaluation and security side is hotter than the governance-suite side. Apollo Research raised a seed round in January 2026 (led by 50Y; amount not reliably disclosed); METR's ~$71M is on a donation and commitment basis. Leading governance vendor Credo AI has raised about $41.3M in total (Tracxn and PitchBook figures, latest round July 2024); the rumored "big Series B in 2026" has no reliable source.

The honest conclusion: in 2026, no landmark large funding round or acquisition in AI governance has been confirmed by a primary source. This judgment rests on the absence of evidence within our search scope and should be stated as "not found", not "does not exist".

09The next 12 months: the dates with the most consequence

The window runs from Oct 27, 2026 to Oct 26, 2027, plus two milestones outside it that need work to start now.

1. Nov 18, 2026

   The Ninth Circuit hears oral argument in x.AI LLC v. Bonta (California AB 2013 training-data transparency); the ruling will decide the fate of state transparency laws under the First Amendment and the Takings Clause. The district court denied a preliminary injunction on Mar 4.

2. Nov 20, 2026

   The UK ICO's call for evidence on agentic AI closes; the direction of later guidance and the statutory code takes shape from here.

3. Nov 29, 2026

   Spain's general election (November 29); its AI governance bill lapsed on October 6, and whether the new parliament restarts it as a fresh bill becomes clear afterwards.

4. Dec 2, 2026 · two EU milestones

   (i) The transition period for Art. 50(2) marking duties for generative systems placed on the market before Aug 2, 2026 ends; (ii) the Omnibus's new prohibitions (nudification, non-consensual intimate imagery, CSAM-related) begin to apply. Basis: Regulation (EU) 2026/1744.

5. Dec 31, 2026

   The statutory point for a progress report on AI safety regulation-making under section 249 of the UK Crime and Policing Act 2026 (date from secondary sources; the text is not verified at primary level; track and confirm).

6. Jan 1, 2027 · the big US state effective date

   Colorado's ADMT Act and Chatbot Safety Act; New York's RAISE Act; Illinois SB 315 disclosure statements; California CPPA's automated decision-making rules; California SB 942 platform provenance duties; Connecticut SB 5 AI companion duties, on the same day or around it.

7. Aug 2, 2027 · two EU milestones

   (i) The compliance deadline for GPAI models placed on the market before Aug 2, 2025; (ii) the (postponed) deadline for each member state to set up at least one AI regulatory sandbox. Basis: AI Act Art. 111 and 113, as amended by 2026/1744.

8. Oct 1, 2027

   Main duties on automated employment decision tools under Connecticut SB 5 take effect (phased schedule, secondary).

9. Dec 2, 2027 · outside the window, start now

   EU Annex III high-risk obligations apply in full: the end point of every EN 18286 and conformity assessment preparation in 2026 and 2027.

10. 2028 · outside the window

    Jan 1: Illinois frontier framework duties and the first annual independent third-party audits; Aug 2: EU Annex I high-risk obligations apply.

10Claims we could not verify from primary sources

The claims below could not be verified from primary sources (official journals, regulators' own texts, company originals, court documents) in this round of research. Wherever the body mentions them, they are treated as secondary or background; they are collected here so nothing misleads by omission. A further group of claims (NIST, NSA and CISA agent "key practices", rumors about EO numbers and agency renamings and the like) appears only on low-quality secondary sites and does not match current public names; those claims are not credited, though the executive order they invoke, EO 14434, has itself been verified.

1. "EN ISO/IEC 42001:2026 confers a presumption of EU AI Act conformity": seen only on vendor-oriented content sites; it directly conflicts with the Commission's official statement that EN 18286 is the only AI QMS standard carrying presumption. Rejected.
2. The global count of ISO/IEC 42001 certifications (for example "fewer than 50 as of March 2026"): no primary statistic from ISO or accreditation bodies; individual certification announcements are real but cannot be summed into market penetration.
3. EO 14434 itself is verified: the executive order 'Inaugurating the Era of Super Intelligence' was signed on September 29, 2026 and published in the Federal Register on October 2; it uses 'Super Intelligence (SI)' for AI in non-statutory federal documents. Two claims remain rejected as unverifiable on primary pages: that CAISI was renamed 'CAISSI', and that NIST, NSA and CISA released agent-incident 'key practices' on October 16, 2026.
4. Federal Reserve SR 26-2 and OCC Bulletin 2026-13 (April 2026) replacing SR 11-7 and excluding generative and agentic AI: only industry-tracker secondary sources; the regulatory text was not opened.
5. Details of the FTC's July 1, 2026 "accuracy suppression" policy proposal: seen in law-firm and tracker sources, FTC text not verified; that it has not been finalized is consistent across sources.
6. Status of the Commerce "onerous state laws" assessment and the BEAD policy notice: "not published by the deadline (Mar 11, 2026)" is the consistent account of law-firm articles from March to August; the October status was not checked page by page, and a quiet later release cannot be ruled out.
7. Redaction details in the Oct 22 summary by OpenAI, METR and Redwood: relayed secondhand, not verified word for word.
8. The exact signing date of Connecticut SB 5: near-primary sources conflict (May 27 vs June 2); the PA 26-15 designation and phased effective dates are consistent across sources.
9. China's Implementation Opinions on AI Agents (May 2026): issuing bodies, exact date and text known only from secondary summaries. Release of the AI Safety Governance Framework 3.0 on Sep 14 is corroborated by publicity-week coverage, but details of its agent chapter are also secondary.
10. The exact text of section 249 of the UK Crime and Policing Act 2026 ("a progress report by Dec 31, 2026"): the section 216A power and its non-use are corroborated by the Commons Library; the section 249 date appears only in secondary sources.
11. Details of Italy's 2026 AI implementing law (allocation of competent authorities, the remedy that "dismissal by algorithm alone is void"): only aggregator news reports; the official gazette was not checked.
12. A new 2026 round (Series B) for Credo AI: no reliable source found; what can be checked is about $41.3M raised in total, latest round in 2024.
13. "Total global AI governance and compliance spending of $2.54B in 2026": relayed by aggregator sites with no original source; rejected. The Gartner and MarketsandMarkets figures are paid research forecasts whose methods cannot be verified publicly; cite only with their definitions stated.
14. Several extended details of the summer incidents (number of organizations affected, an Astra model reaching a Critical threshold, the FTC investigating labs and METR): all media or secondary reporting; the two core incidents are corroborated by consistent multi-source reporting and the companies' own disclosures.
15. The total signatory count of the EU Art. 50 transparency Code: the Commission's "about 190 organizations" does not match its per-section counts (95 and 192), possibly because of timing and overlap; the Commission's live list governs.

App.Main sources

All sources were searched and read on Oct 26, 2026; the EU and NCSL items were re-checked on Oct 27 before publication. Titles are the links; each points to the site or specific page, with no bare URLs. Items relayed by aggregators, tech media or wiki-type pages are leads, not conclusions.

EU

1. European Commission: First harmonised standard supporting the AI Act published in the Official Journal (EN 18286:2026) Verified live
2. European Commission: Strong backing for the Code of Practice on Transparency of AI-generated Content Index text
3. GPAI Code of Practice and signatory summary Index text
4. AI Office's first targeted information requests (Virkkunen, Oct 14, as reported) Index text
5. Digital Omnibus on AI enters into force (Regulation (EU) 2026/1744) Index text
6. Italian Garante: Character.AI fine Index text
7. Italian Garante: OpenAI fine annulled Index text

US federal and states

1. NCSL: As Congress Deliberates, States Lead the Way on AI Regulation (Oct 21, 2026) Verified live
2. EO 14365 and the DOJ Litigation Task Force (Proskauer) Index text
3. EO 14365 and the DOJ Litigation Task Force (McDermott) Index text
4. National Policy Framework (Mar 20, 2026), analysis Index text
5. DOJ intervention in xAI v. Colorado; AB 2013 litigation Index text
6. Colorado SB 26-189 Index text
7. Texas TRAIGA Index text
8. Overview of the three California laws Index text
9. New York RAISE Act Index text
10. Illinois SB 315 (DLA Piper) Index text
11. Connecticut SB 5 Index text
12. FTC Cox Media case Index text

UK and China

1. House of Commons Library: AI regulation in the UK (CBP-10003); AI safety briefing (CBP-12231) Index text
2. ICO call for evidence on agentic AI Index text
3. CAC generative AI filing notice (Sep 14, 2026), full text relayed; Qinglang phase two results Index text
4. CNNIC Generative AI Application Development Report (2026), relayed Index text
5. Interim Measures on AI Anthropomorphic Interaction Services, full text Index text
6. Shen Weixing on the dual-track comprehensive legislation (The Jurist, no. 5, 2026) Index text

Compliance practice and market

1. Lab framework summary: Anthropic RSP, DeepMind FSF, OpenAI PF Index text
2. Coverage of Apollo's embedded evaluations Index text
3. Summary of the evaluator landscape Index text
4. Coverage of Schellman's State of AI Governance Report 2026 Vendor-reported
5. IAPP AI Governance Skills Framework Index text
6. EN 18286 and Gartner market size (as relayed) Index text
7. MarketsandMarkets AI TRiSM forecast Vendor-reported
8. Individual ISO/IEC 42001 certification Vendor-reported

Note: every "enforced" statement is limited to the first actions listed here. Where no enforcement action is listed for a rule, it means none was found in public records within this search as of Oct 26, 2026: a search result, not an absolute claim. Data are fixed at the report date; later changes are governed by each jurisdiction's official journal.