How we verify
A compliance site is only useful if its dates and figures are right. This page says what we check, what we have not checked yet, and what we got wrong.
What we check
- Primary sources first. EUR-Lex for EU law, official legislature and governor pages for state bills, agency pages and court dockets for enforcement. Law-firm and news summaries are used to corroborate, not as the only source.
- Named facts one by one. Every case name, fine amount, docket, bill number and article number is checked individually. We do not list them from memory.
- Secondary-only claims are labelled. If a date appears only in secondary coverage, the article says "reported" and tells you where to confirm it.
- Dated checks. A regulation entry shows a verified date only when its dates, status and headline figures were re-checked on that day.
Where coverage stands
- regulation entries carry a verified date
- link to a primary source
- corrections published below
Verified means dates, status and headline figures were re-checked. Some checks relied on law-firm or agency summaries rather than the full statute text, so read the source before you rely on detailed requirements. Any entry without a verified date has not been re-checked. This is general information, not legal advice.
Corrections
EU Product Liability Directive and AI
Was: Said Directive (EU) 2024/2853 was adopted in November 2024, published on December 18, 2024 and in force since December 9, 2024; said the AI Liability Directive was still at proposal stage in mid-2026; said trade secrets would not shield model documentation in disclosure.
Now: The Directive is dated October 23, 2024 and entered into force on December 8, 2024; December 9, 2026 is the transposition deadline and the start of application to new products. The Commission withdrew the AI Liability Directive proposal (notice published October 6, 2025). Article 9 requires courts to protect confidential information when they order disclosure.
German court rules Google liable for false AI Overviews
Was: Called the EU AI Liability Directive still pending.
Now: The Commission withdrew the AI Liability Directive proposal; the withdrawal notice was published in the Official Journal on October 6, 2025.
Privacy-first AI APIs: which ones don't train on your data
Was: Said Google uses Google AI Studio and unpaid Gemini API content to improve its products, without the exception for users in the EEA, Switzerland and the UK; listed Anthropic zero data retention as available by agreement without noting that Covered Models (Claude Mythos 5 and 5.1, Claude Fable 5 and 5.1) have required 30-day retention since June 9, 2026; marked Cohere's DPA as not verified.
Now: Google's Gemini API terms apply the paid-service data terms to AI Studio and the unpaid quota for users in the EEA, Switzerland and the UK. Anthropic's API docs say Covered Models need 30-day retention and are not available under ZDR unless Anthropic expressly authorizes it. Cohere's enterprise data commitments page tells SaaS customers to email [email protected] for its DPA.
Vendor scorecard and privacy API selector
Was: Showed Cohere's DPA as unknown. The selector's training filter was defined as no training by default or by contract, yet listed Mistral and Cohere, which both train on API data until you opt out. The Anthropic card gave zero data retention by agreement without the Covered Models exception, the Google card said unpaid Gemini API data can improve Google products without the EEA, Switzerland and UK exception, and the Azure DPA link opened a data privacy FAQ.
Now: Cohere shares its DPA with SaaS customers on request ([email protected]). The filter now covers providers that don't train by default or let you switch training off, and the Mistral and Cohere notes say training stays on until you opt out. Covered Models (Claude Mythos 5 and 5.1, Claude Fable 5 and 5.1) require 30-day retention. EEA, Swiss and UK users get Google's paid-service data terms on unpaid use. The Azure link opens the Microsoft Products and Services DPA. The seven API providers other than DeepSeek were re-checked on October 24, 2026.
Was: The unpaid Gemini API / AI Studio row said Google uses that content to improve its products, without the exception for users in the EEA, Switzerland and the UK.
Now: The row now says the paid-service data terms apply to those users, as Google's Gemini API terms state.
AI coding tools governance policy
Was: The Google AI Studio row said unpaid content is used to improve Google products, without the exception for users in the EEA, Switzerland and the UK.
Now: The row now says the paid-service data terms apply to those users, as Google's Gemini API terms state.
Was: An FAQ question called the Illinois video interview law the "Illinois AEIA". No Illinois law has that name.
Now: The law's short title is the Artificial Intelligence Video Interview Act (820 ILCS 42/1, in effect since January 1, 2020); the question now uses that name.
AI vendor governance scorecard
Was: Showed ISO 27001 as unknown for the OpenAI API and for AWS Bedrock, and SOC 2 as unknown for AWS Bedrock, so the ISO 27001 and SOC 2 filters left them out.
Now: OpenAI's trust portal lists ISO/IEC 27001:2022 for the API, ChatGPT Enterprise and Edu; AWS lists Amazon Bedrock as in scope of its ISO 27001 certification and its SOC reports.
EU AI Act Article 13: what deployers must tell users
Was: Said the Article 13 obligations apply from August 2027 and put the deployer's duty to tell people under Article 13, including for a diagnostic AI tool in a clinic.
Now: High-risk rules apply from December 2, 2027 (Annex III) and August 2, 2028 (Annex I products). Article 13 binds providers; the duty to inform people is Article 26(11) and covers only Annex III systems that make or help make decisions about them.
EU AI Act Article 9 risk management system guide
Was: Pointed to an August 2027 compliance deadline for high-risk systems and said third-party conformity assessment applies mainly to Annex III categories.
Now: High-risk rules apply from December 2, 2027 (Annex III) and August 2, 2028 (Annex I products). Annex III points 2 to 8 use internal control without a notified body (Article 43(2)); notified bodies come in for some biometric systems and for Annex I products.
Was: The summary said the EU AI Act duties apply to high-risk systems from December 2, 2027.
Now: December 2, 2027 is the date for Annex III systems; for high-risk AI in Annex I products, such as medical devices, the duties apply from August 2, 2028.
EU AI Act high-risk classification: May 2026 guidelines
Was: Said the December 2, 2027 date also covers most transparency requirements, gave August 2, 2027 for Annex I product-safety systems, and said four national authorities had announced enforcement plans.
Now: Article 50 transparency rules have applied since August 2, 2026; Annex I high-risk rules apply from August 2, 2028; the unsourced claim about national authorities was removed.
AI governance for healthcare startups: HIPAA and HITECH
Was: Said the EU AI Act deadline for diagnostic and triage AI was December 2, 2027 and called healthcare AI high-risk by default.
Now: Diagnostic AI that is a medical device, or a device's safety component, needing third-party conformity assessment is high-risk via Article 6(1) and Annex I, from August 2, 2028; December 2, 2027 is the Annex III date, which covers emergency patient triage.
What is the EU AI Act? Plain-English guide
Was: Put medical AI under the December 2, 2027 high-risk date and said Annex I products follow product safety timelines.
Now: AI in medical devices is high-risk via Article 6(1) and Annex I when the device needs third-party conformity assessment, and those rules apply from August 2, 2028.
AI governance for small teams: the complete guide
Was: Said EU AI Act high-risk rules apply to any AI used in clinical diagnosis, treatment or patient management, and grouped healthcare under the December 2, 2027 deadline.
Now: Medical AI is high-risk when it is a medical device, or a device's safety component, needing third-party conformity assessment (Article 6(1) and Annex I), from August 2, 2028; emergency patient triage is the Annex III case.
Denmark deepfake bill: consent record and takedown templates
Was: Said no effective date had been fixed for the Danish deepfake bill and that the bill text could not be read.
Now: The bill as introduced on October 8, 2026 (L 49, section 2(1)) enters into force on January 1, 2027 if the Folketing passes it; its notes make the face-and-voice rule a civil matter with no criminal penalty and no takedown deadline.
ConnectWise Cloud Backup breach: what to check in M365
Was: Said Storm-0940 tried to sign in to more than 2,250 tenants at 2,900 attempts a minute.
Now: Microsoft gives two figures: more than 2,250 tenants after the ConnectWise compromise, and a peak of 2,900 failed logons a minute on October 11 in the earlier password spray against 327 accounts.
Italy's Garante fine against Character.AI
Was: Said the Garante's orders map almost exactly onto Colorado's HB 26-1263, that the Colorado act requires private-by-default profiles for minors, that its parental tools cover parents of under-13 users, and that the investigation ran for nearly three years.
Now: HB 26-1263 overlaps only on age estimation: it has no cooling-off period and no private-by-default duty, and its privacy tools cover minors and a parent or guardian of any minor. The investigation ran 20 months (November 2024 to July 2026).
California 2026 AI bills tracker
Was: Said AB 1609 gives no revenue threshold, called all 13 September 30 signings AI bills, and quoted SB 951 in words its source did not use.
Now: AB 1609's chaptered text covers businesses with more than $500 million in gross annual revenue nationally; 12 of the 13 signings are AI bills (AB 1864 is gene synthesis); SB 951 is quoted from the chaptered bill.
Newsom's September 30 AI signings: who must act
Was: Described AB 1331 and AB 1883 together as covering workplace surveillance tools in bathrooms.
Now: Only AB 1331 covers restrooms; AB 1883 bars workplace surveillance tools that collect neural data or predict a worker's emotional state.
Colorado Chatbot Safety Act (HB 26-1263)
Was: Told operators to count crisis referrals for calendar year 2027 for the July 1, 2027 annual report.
Now: The statute asks for referrals in the preceding calendar year and does not say which year the first report covers; the checklist now says so and suggests raising it at the October 26 hearing.
Anthropic's Project Panama and the FTC letter
Was: Said the groups' FTC letter warns that rare books could be destroyed with AI firms taking the last copies.
Now: The letter says rare, out-of-print titles are among the books being brokered and asks the FTC to find out how often a destroyed copy was one of the last; the public record does not show it.
AI acceptable use policy template
Was: Told financial services teams to add disclosure duties under "CFPB guidance" and EU teams to reference their "conformity assessment status".
Now: Points to ECOA and Regulation B (12 CFR 1002.9), since the CFPB withdrew its adverse action circulars on May 12, 2025, and to the EU AI Act Article 26 deployer duties; conformity assessment is a provider duty.
Was: Left "and public benefits" out of Colorado's consequential-decision list, said which columns regulators look at first without a source, and quoted a Reddit thread its moderators have since removed.
Now: Colorado list completed from SB 26-189, the unsourced claim replaced with our own suggestion, and the Reddit section removed.
Notion AI vs Microsoft Copilot
Was: Said Notion Enterprise has zero retention at every model provider and that Notion AI uses Notion-hosted models plus Anthropic and OpenAI.
Now: Notion now says most Enterprise models have zero retention and the rest are off until an owner opts in; its subprocessor list also names Google, xAI, Cerebras and three inference providers.
ChatGPT product liability cases (JCCP 5431)
Was: Our take said "a dozen families" expect the cases to turn on the same questions.
Now: One of the 12 coordinated cases was brought by First County Bank, which opposed coordination with the Raine family; the sentence now describes the 12 cases accurately.
Fintech AI governance (CFPB, FCRA)
Was: Cited "CFPB guidance" for adverse action reason rules and said a notice needs at least four reasons.
Now: Cites Regulation B (12 CFR 1002.9(b)(2)): no fixed number of reasons, more than four not likely to be helpful; the CFPB circulars were withdrawn on May 12, 2025.
Was: The financial decision-making item listed "CFPB guidance" alongside FCRA and ECOA.
Now: Points to Regulation B adverse action notices; the CFPB circulars were withdrawn on May 12, 2025.
Was: The Notion AI entry said Enterprise has zero retention at its LLM providers.
Now: Most Enterprise models have zero retention; the few that keep data are off until the workspace owner opts in.
Meta Commercial Terms crawl clause
Was: Said the US English and UK English editions of Meta's Commercial Terms preview disagree, and that the UK English edition still let Meta use crawled website content to "train" Meta Company Products (the text we saw on October 19).
Now: On October 22 both editions limit crawled content to advertising and business products and neither says train. The post also adds the CMA's letter to Meta and the German publishers' request to the European Commission.
AI employee monitoring laws guide
Was: Said Connecticut's notice must describe the methods used, that GDPR requires a DPIA for all large-scale employee monitoring, that Article 22 gives a right to object, and that the NLRB had signaled more scrutiny of AI monitoring; also made unsourced claims about Florida, Washington's health data law, French law, EU court rulings, BIPA settlements and HIPAA.
Now: Rewritten against the statutes: Connecticut requires notice of the types of monitoring (a posting counts), a DPIA is required where high risk is likely, Article 22 is a right not to be subject to solely automated decisions, and the NLRB monitoring memo was rescinded in 2025. The unsourced claims were removed.
Illinois AI employment law guide
Was: Treated the AI Video Interview Act and HB 3773 as one law: said the Video Interview Act took effect January 1, 2026, carries a $500-per-day penalty enforced by the Department of Labor or DCEO, requires written consent, an opt-out to human review and a ban on AI as the sole hiring factor, and covers Illinois residents wherever the job is.
Now: The Video Interview Act (820 ILCS 42) has applied since 2020 to AI analysis of recorded interviews for positions based in Illinois: notice, explanation, consent, limited sharing, deletion on request and a demographic report if AI alone picks in-person interviews; it has no penalty section. HB 3773 (P.A. 103-0804) amends the Human Rights Act from January 1, 2026. The unsourced tool table was removed.
AI hiring tool compliance state-by-state matrix
Was: Described Illinois HB 3773 as an amendment to the AI Video Interview Act requiring written notice, written consent and a human review option for AI-analyzed video interviews of Illinois-resident candidates.
Now: Two separate laws: the Video Interview Act (since 2020) requires notice, an explanation and consent for positions based in Illinois, with no human review option; HB 3773 amends the Human Rights Act and covers any AI in employment decisions from January 1, 2026.
Workday AI lawsuit HR screening checklist
Was: Said the Illinois AI Video Interview Act requires written consent and bans AI analysis as the sole basis for a hiring decision.
Now: The act requires notice, an explanation and consent, without saying written, and has no sole-basis ban; HB 3773 is a separate Human Rights Act amendment.
EEOC AI hiring guidance employer checklist
Was: Said the Illinois AI Video Interview Act requires written consent.
Now: It requires consent before the interview and doesn't say written. HB 3773 was added to the state table as a separate law.
Was: Listed only "written notice" before AI video interview analysis for Illinois.
Now: Notice, an explanation and consent before an AI-analyzed video interview (Video Interview Act), plus HB 3773's notice duty for any AI used in employment decisions.
FCRA AI hiring disclosure requirements
Was: Said the Illinois AI Video Interview Act was amended effective January 1, 2026, requires written consent, bans AI as the sole hiring factor and applies to anyone hiring Illinois residents.
Now: The act dates from 2020, requires consent without saying written, has no sole-factor ban and covers positions based in Illinois; January 1, 2026 is HB 3773, a separate law.
Multi-state AI compliance strategy
Was: Said Illinois amendments extending to broader AI employment use took effect in 2024.
Now: HB 3773 was signed in 2024 and took effect January 1, 2026.
US state AI law tracker, June 2026
Was: Said Illinois HB 3773 requires written notice before using the tool and is "just disclosure".
Now: HB 3773 requires notice, without saying written, and also bars AI with a discriminatory effect on protected classes and zip codes as a proxy.
One Big Beautiful Bill AI preemption
Was: Said the Illinois AI Video Interview Act "has survived multiple legal challenges".
Now: We found no court decision applying the act; the claim was removed.
Utah AI Policy Act compliance guide
Was: Called the AI Policy Act "HB 452", signed March 22, 2024, with a "sincerely asks" trigger and no up-front disclosure for anyone; said Utah was the first state with such a law and that there is no private right of action.
Now: The act was SB 149, signed March 13, 2024; SB 226 (2025) moved the rules to Utah Code 13-77 with a clear-and-unambiguous-request trigger and an up-front duty for regulated occupations in high-risk interactions. HB 452 is the mental health chatbot law. The unsourced claims were removed.
Employee monitoring laws by state tracker
Was: Cited New York "Labor Law § 740A" with a signed acknowledgment before monitoring, said Delaware always requires a written acknowledgment, described Illinois draft rules open for comment with a four-year retention rule and Attorney General penalties, and said remote workers are covered wherever they live.
Now: New York is Civil Rights Law §52-c: notice upon hiring, acknowledged in writing or electronically, and posted. Delaware needs an acknowledgment only for its one-time notice. Illinois withdrew its draft rules on June 2, 2026, and the act has no retention rule or AI-specific penalty. New York and Delaware turn on the employer's place of business.
AI employee monitoring laws 2026
Was: Said New York requires a new notice whenever monitoring practices change and a description of what is monitored, and that Delaware always requires prior written notice.
Now: New York's Civil Rights Law §52-c notice is given upon hiring, in the statute's blanket wording, acknowledged and posted. Delaware accepts a daily electronic notice or an acknowledged one-time notice.
AI hallucination sanctions tracker
Was: Dated the Couvrette v. Wisnovsky sanction to Q1 2026 and United States v. McGee to October 14, 2025, gave the Whiting docket as No. 25-5425, called all five cases 2026 sanctions for AI output, and said Stewart's corrections added new false quotations without acknowledging the problem.
Now: Couvrette's sanctions order is dated December 12, 2025 (fee order March 23, 2026); McGee was filed October 10, 2025; Whiting is Nos. 24-5918/5919 and 25-5424, and AI use there was never established; Stewart's corrections swapped in real quotations that changed the meaning, and she conceded the Rule 11 violation.
State chatbot disclosure laws 2026
Was: Said California SB 243 covers every customer support chatbot, requires disclosure only when a user sincerely asks and lets any user sue over a denial, and that Utah requires proactive disclosure at the start of any AI interaction.
Now: SB 243 covers companion chatbots, excludes bots used only for customer service, requires an up-front notice when a reasonable person could think the bot is human, and gives a civil action for injury in fact; sales bots fall under SB 1001. Utah requires disclosure on a clear and unambiguous request.
Was: Said SB 243 had no private right of action, that Adam's Law was the first to give one against companion chatbot operators, and that Adam's Law has no damages floor.
Now: SB 243 already gives a civil action for at least $1,000 per violation (Section 22605). Under Adam's Law a financial-harm claim must allege more than $1,000 per child.
EU AI Act GPAI codes of conduct
Was: Said signing the GPAI Code of Practice gives a presumption of conformity, that an AI Office public register lists systemic-risk models (naming four) and holds training summaries, that the 10^25 FLOP threshold is not cumulative, and that the Code was finalised in June 2026 with four chapters.
Now: Articles 53(4) and 55(2) let providers rely on the Code to demonstrate compliance; only harmonised standards give a presumption. No Article 52(6) list found; Article 51(2) counts cumulative compute; the Code was published July 10, 2025, in three chapters.
Meta skipped the EU AI code (Llama)
Was: The page description said Llama gets no presumption of conformity because Meta did not sign the GPAI Code of Practice.
Now: Signing gives no presumption either; Article 53(4) lets signatories rely on the Code to demonstrate compliance. The description now says Meta must prove compliance another way.
Texas biometric law and AI hiring
Was: Presented Business & Commerce Code Section 503.001 as part of TRAIGA, said consent must be written and state a retention period, allowed retention up to three years, read 'per violation' as per applicant, and quoted a 'publicly available' definition and exclusions the section lacks.
Now: Section 503.001 is the Capture or Use of Biometric Identifier Act (2009), amended by TRAIGA from January 1, 2026: notice and consent before capture, no written-form rule, deletion no later than one year after the purpose expires; rebuilt from the statute text.
BIPA and facial recognition AI
Was: Said Texas CUBI requires written notice and consent.
Now: Section 503.001 requires notice and consent before capture, with no written-form rule, and deletion no later than one year after the purpose expires.
Was: Implied Texas law requires written consent and a published retention schedule for biometric data.
Now: Texas's Section 503.001 requires notice and consent before capture, with no written-form rule, and deletion no later than one year after the purpose expires.
Was: Credited the July 1, 2026 threshold changes to SB 4 instead of Public Act 25-113, said the new sensitive data categories become enforceable October 1, described the geolocation sale ban as an opt-in rule, and kept the repealed 25,000-consumer revenue test.
Now: The July 1 changes, including sensitive data, come from Public Act 25-113; SB 4 (Public Act 26-64) starts October 1, 2026 and bans the sale of precise geolocation data; the revenue test was replaced by the sale trigger.
Seedance enterprise risk checklist
Was: Described copyright litigation from Disney and Paramount, dated the MPA letter February 22, and said Seedance 2.5 entered enterprise beta in the first week of July.
Now: The studios and the MPA sent cease-and-desist letters and we found no lawsuit; the MPA letter is dated February 20, 2026; Seedance 2.5 was announced June 23 and reached CapCut on July 31, 2026.
Texas TRAIGA compliance checklist
Was: Told readers to adopt NIST AI RMF 1.0 for TRAIGA's defense and described the cure and penalty rules loosely; several FAQ answers relied on an earlier draft bill we could not source.
Now: Rebuilt step by step from the enrolled text of HB 149: the defense names NIST's Generative AI Profile or another recognized framework and covers violations found through internal review (Sec. 552.105(e)); cure, penalties and investigative demands follow Secs. 552.103-552.105.
Was: Called NIST AI RMF compliance a complete affirmative defense that protects you before a violation is alleged, misstated the AI system definition, listed exclusions the law lacks, and cited AG guidance and penalty estimates we could not source.
Now: Rewritten against Sec. 552.105(e): a defense for violations discovered through feedback, testing, agency guidelines or an internal review that substantially complies with NIST's Generative AI Profile or another recognized framework.
Was: Said documented NIST AI RMF compliance is an affirmative defense, misdescribed two banned uses, referred to an earlier draft bill without a source, and said the AG decides which violations are uncurable.
Now: The defense is the Sec. 552.105(e) internal-review route; the ban list follows Secs. 552.052-552.057; the court decides curability; health care providers' disclosure duty is noted.
Was: Said TRAIGA gives a presumption of reasonable care to companies that follow NIST AI RMF, and that the FTC has cited NIST AI RMF in enforcement actions.
Now: The presumption applies to everyone (Sec. 552.105(c)); the NIST-linked defense is separate and names the Generative AI Profile. The FTC claim was removed for lack of a source.
Multi-state AI compliance strategy
Was: Said NIST AI RMF documentation satisfies most US state safe harbors and fully satisfies Texas TRAIGA's.
Now: Texas is the only law in the comparison with a framework-linked defense, and it covers violations found through internal review.
AI acceptable use policy annual update
Was: Cited TRAIGA Sections 5, 7 and 8 for an employment-inference ban, a human review duty and an annually reviewed safe harbor program; said EU high-risk enforcement had already begun.
Now: TRAIGA's bans are in Secs. 552.052-552.057, it has no human review duty for private companies, and its defense is in Sec. 552.105(e). The Annex III rules apply from December 2, 2027.
AI governance Q3 review template
Was: Cited a TRAIGA Section 541.152 offering reduced liability for following NIST AI RMF, and said Texas regulators will examine specific NIST controls.
Now: The defense is in Sec. 552.105(e) and names the Generative AI Profile or another recognized framework; the law lists no controls.
ISO 42001 vs EU AI Act vs NIST AI RMF
Was: Called TRAIGA Senate Bill 2024 and said it gives a safe harbor for high-risk AI systems that NIST AI RMF explicitly qualifies for.
Now: TRAIGA is House Bill 149, has no high-risk category, and its defense names NIST's Generative AI Profile or another recognized framework.
AI compliance checklist by team size
Was: Said framework adoption is required for a Texas TRAIGA safe harbor.
Now: TRAIGA requires no framework; its internal-review defense names NIST's Generative AI Profile or another recognized framework.
One documentation set for EU AI Act, NIST AI RMF and TRAIGA
Was: Said TRAIGA requires a governance program with inventory, risk, oversight, incident and vendor elements, bans social scoring and biometric surveillance for everyone, and gives a safe harbor for NIST AI RMF 1.0 compliance.
Now: TRAIGA has no documentation duty; the social scoring and biometric bans bind government entities; the Texas column now maps records to Secs. 552.103-552.105.
Was: Said TRAIGA's disclosure duty covers certain other regulated entities and applies at the start of any AI-driven interaction.
Now: Sec. 552.051 covers government agencies (before or at the time of interaction) and health care providers (by the first date of service) only.
EU AI Act high-risk documentation templates
Was: Presented Articles 9-15 and Article 18's 10-year retention as deployer duties, and the sample notice promised a right to human review of any AI-assisted decision.
Now: Articles 9-15 are provider requirements (Article 16) and Article 18 binds providers; deployer duties are in Article 26, including logs kept at least six months. The notice now reflects the Article 86 right to an explanation and the GDPR Article 22 right to human intervention for solely automated decisions.
AI agent data controls register template
Was: The summary said Article 12 logging took effect August 2, 2026; called a small r/artificial post viral; merged two IBM sources and cited IBM figures we could not find; put six-month log retention in Article 12.
Now: Article 12 applies to Annex III systems from December 2, 2027; IBM's Think 2026 recap and its June study are cited separately, unsupported figures removed; retention is in Articles 19 and 26(6).
CNIL credit scoring and the AI Act
Was: Below its October 19 correction, the body still told the unconfirmed story of CNIL requests to 14 lenders as fact, and said deployers must report serious incidents within 15 days under Article 72.
Now: Body rewritten around CNIL's May 7, 2026 recommendation and the AI Act text; incident reporting is Article 73, mainly a provider duty.
AI governance Q3 review template
Was: Said Article 18 requires documentation for 10 years after the system leaves the market.
Now: The 10 years run from placing on the market or putting into service and bind providers; deployers keep logs for at least six months.
FTC says Colorado's AI bias law may be preempted
Was: Left out xAI's lawsuit against Colorado's Attorney General, where enforcement is paused by an April 27, 2026 stipulation, and the FTC's August 7 disparate-impact statement; said without a source that Texas TRAIGA and Illinois law would face the same preemption argument.
Now: The post covers the xAI case and the stipulation (no enforcement until 14 days after a preliminary-injunction ruling), notes the August 7 statement says it does not preempt state law, and drops the unsourced Texas and Illinois claim.
Does your AI vendor train on your data
Was: Said Atlassian uses data from every plan unless teams opt out, missed GitHub's April 24 training change for Copilot Free, Pro and Pro+, called consumer Copilot's opt-out limited, gave an unsourced Atlassian customer count and billed the page as an 11-vendor comparison.
Now: Atlassian's in-app data is on by default only for Free and Standard; GitHub individual plans train unless you opt out; Microsoft says consumers can opt out at any time; the page covers seven vendors.
Moonshot AI, Anthropic Fable and Treasury sanctions
Was: Gave Kimi K3's unveiling as July 15-17 and said its open weights came out July 27, without a source.
Now: K3 was unveiled July 16; the unsourced open-weights date is removed. Moonshot is on neither the OFAC SDN list nor the BIS Entity List as of October 20.
FTC AI accuracy policy: questions for your vendor
Was: Attributed the over-90% no-fact-check figure to the FTC press release, said Anthropic walked back the Fable 5 safeguard within 24 hours, and said the statement names suppression of accuracy for undisclosed commercial interests as a category.
Now: The figure is in the proposed policy statement, citing an AI developer; Fable 5 launched June 9 and Anthropic reversed course June 11. The statement's examples are ideological distortion, pressure from state law and political pressure; it names no commercial-interest category.
State AG AI chatbot lawsuits tracker
Was: Left out the October 14 eight-state suit against OpenAI and described Minnesota's law without the Eighth Circuit's October 2 injunction.
Now: The tracker lists nine states with their own suits, and the Minnesota row reflects the injunction.
EU AI Act deployer evidence gaps for SMEs
Was: Treated Articles 14, 26 and 27 as applying from August 2, 2026, put employment uses under the Article 27 impact assessment, gave deployers the Article 73 incident report and assigned chatbot disclosure to deployers.
Now: Annex III high-risk rules apply from December 2, 2027 (Annex I from August 2, 2028); Article 27 covers public-law bodies, public-service providers and credit or life and health insurance uses; Article 73 is a provider duty and deployers inform the provider; chatbot disclosure is a provider duty.
Two EU AI Act posts: agent data controls register, high-risk documentation templates
Was: The register post said enforcement for high-risk systems began August 2, 2026; the templates post said GPAI documentation was due by August 2, 2026.
Now: Annex III high-risk rules, Article 12 logging included, apply from December 2, 2027; GPAI provider obligations have applied since August 2, 2025, with until August 2, 2027 for models already on the market.
CNIL credit scoring and the EU AI Act
Was: Said high-risk obligations took effect August 2, 2026 and reported CNIL requests to 14 financial institutions on the strength of one aggregator blog.
Now: High-risk rules apply from December 2, 2027; the CNIL claim is unconfirmed, a correction leads the post and it's removed from search indexing.
Does your AI vendor train on your data
Was: Said Anthropic doesn't train on Claude conversations on any plan, and described Atlassian's data contribution change as still to come.
Now: Claude Free, Pro and Max users choose in Privacy Settings, commercial plans aren't used by default; Atlassian's change went into effect August 17, 2026.
Three EU AI Act Digital Omnibus posts, stale status and dates
Was: Said the Official Journal published the Omnibus on July 27, 2026 and still treated it in places as a provisional agreement; said it does not touch Article 5, that the remaining bans start August 2, 2026 and GPAI requirements start August 2, 2026; gave Annex I an original August 2, 2026 date; described SME exclusions not in the text.
Now: Regulation (EU) 2026/1744 was published July 24 and in force July 27, 2026; it adds two Article 5 bans from December 2, 2026; the original bans applied from February 2, 2025 and GPAI obligations from August 2, 2025; Annex I moved from August 2, 2027 to August 2, 2028; no SME sector exclusions exist.
EU AI Act Annex III guide, full re-check against the consolidated text
Was: Still described the Digital Omnibus as the May 7 provisional agreement, not yet law, with the old date given as December 2, 2027; the October 16 note called the May 7 agreement unverified (it did happen); listed insurance claims triage and all insurance pricing, travel document checks and face-based access control as high-risk; said critical infrastructure AI can need a notified body and gave GPAI obligations from August 2, 2026.
Now: Regulation (EU) 2026/1744 moved Annex III from August 2, 2026 to December 2, 2027; only life and health insurance pricing is listed, travel document verification and one-to-one biometric verification are excluded, only point 1 biometrics can need a notified body, and GPAI obligations applied from August 2, 2025.
Five EU AI Act posts: Annex III lists, Article 27 scope, provider role
Was: The compliance checklist and the sprint checklist listed nine Annex III categories with insurance in general; the checklist put banking, education and healthcare entities under Article 27; the classification post and the risk-decisioning post listed insurance pricing in general and stale Omnibus dates; the plain-English guide called startups selling a fine-tuned product deployers.
Now: Eight Annex III areas, life and health insurance only; Article 27 covers public-law bodies, private entities providing public services and credit or life and health insurance deployers; dates per Regulation (EU) 2026/1744; a company selling an AI system under its own name is its provider (Article 3(3)).
EU AI Act complete guide for small teams, three statements tightened
Was: Said the December 2026 bans hit providers of generative AI only, gave the Article 6(3) conditions as examples, and gave the two-day incident deadline only for widespread infringements.
Now: The bans also bind deployers who use a system to produce that material; one of the four Article 6(3) conditions must be met; the two-day deadline also covers a serious and irreversible disruption of critical infrastructure.
EU AI Act complete guide for small teams, full audit; insurance scope in three EU AI Act posts
Was: The Annex III table listed real-time biometric identification, all insurance risk and critical infrastructure management; clinical AI was placed under Annex III; deployers were told they cannot deploy without a declaration of conformity; three other posts listed insurance risk in general.
Now: Remote biometric identification (verification excluded), life and health insurance only, safety components only; medical-device AI is high-risk through Annex I; only public-authority deployers must not use unregistered systems.
AI vendor scorecard, HIPAA BAA column and FAQ
Was: Marked Cursor and Perplexity as offering no HIPAA BAA and Mistral and Grammarly as unknown; the HIPAA FAQ named only five vendors.
Now: Cursor and Grammarly offer BAAs on Enterprise plans and Mistral for qualifying services; Perplexity says it is HIPAA compliant but publishes no BAA terms, so it is unknown. The FAQ now covers all 17 vendors.
AI vendor DPA tracker, DeepSeek API training opt-out
Was: Said the DeepSeek API training opt-out works through the "Improve the model for everyone" setting or by email to [email protected].
Now: The setting is the opt-out; the email right in DeepSeek's privacy policy covers the account holder's own personal information, since section 5.5 of the Open Platform terms leaves end users' data in an app built on the API to the developer's own privacy policy.
GDPR Article 30 RoPA template, ten vendor entries and Article 30 notes
Was: Named OpenAI, L.L.C. at 1960 Bryant Street as processor and Anthropic, PBC for every customer; said GitHub's individual plan only may contribute to training; said Intercom does not train on customer data and HeyGen's training terms were unclear; named HeyGen Interactive, Inc. in San Francisco; said Midjourney trains unless you have a private plan and offers enterprise DPAs; gave Washington's likeness law an effective date of June 10, 2026; credited the EDPB with recommending legal basis in the RoPA and called the AI vendor a sub-processor.
Now: OpenAI OpCo, LLC, 1455 3rd Street (OpenAI Ireland Ltd. for EEA and Swiss customers); Anthropic Ireland, Limited for EEA, Swiss and UK customers; GitHub Copilot Free, Pro and Pro+ data is used for training since April 24, 2026 unless users opt out; Intercom can fine-tune on anonymized customer data and HeyGen trains on non-Enterprise inputs unless you opt out; HeyGen Technology Inc., Los Angeles; Midjourney's Stealth Mode controls visibility, not training, and we found no Midjourney DPA; Washington SSB 5886 took effect June 11, 2026; the ICO quote replaces the EDPB claim and the AI vendor is a processor.
Best AI tools for compliance, full re-check of all eight tools
Was: Said Cursor has no standard enterprise tier, Notion's audit log is partly available on Business, a Claude Business/Enterprise tier has audit logs, GitHub Copilot Individual is the personal plan, and Grammarly's extension reads passwords; used the old plan names ChatGPT Team and Grammarly Premium/Business; cited a 4-7 tools figure and called Anthropic's zero retention the strongest control of any vendor.
Now: Cursor offers SSO, SCIM and compliance logging for enterprises; Notion's and Claude's audit logs are Enterprise only; GitHub Copilot's personal plans (Free, Pro, Pro+) train on interaction data unless users opt out; Grammarly says its extensions ignore password and payment fields on a best-efforts basis; plans are ChatGPT Business and Grammarly Pro/Enterprise; the unsourced figure and superlative were removed.
Washington AI likeness law checklist, full re-check against the enacted text of SSB 5886
Was: Gave the effective date as June 10, 2026; said the law bans AI sexual deepfakes and deceptive AI media generally, requires written consent and rejects oral consent, is enforced by the attorney general, puts takedown and moderation duties on platforms and distributors, awards capped statutory damages, and exempts satire only when clearly labeled.
Now: Effective June 11, 2026 (signed March 16, 2026). SSB 5886 adds a forged digital likeness to RCW 63.60 for use in goods, advertising and fundraising; consent may be written or oral, express or implied; the bill gives the attorney general no role and platforms no duties, and RCW 63.60.070(4) exempts advertising media owners; remedies are a $3,000 civil penalty plus actual damages, profits and, for a forged digital likeness, noneconomic damages; the satire exemption has no labeling requirement. Sexual deepfakes fall under HB 1999 (2024).
AI governance metrics dashboard, Washington deadline
Was: Listed Washington's AI likeness law under June 10, 2026.
Now: June 11, 2026, per the Washington Legislature's bill page for SSB 5886.
New York synthetic performer ad law, full re-check against the enacted text of S8420-A
Was: Said platforms must remove flagged non-compliant ads within 5 days, the attorney general enforces the law, New York enacted it in January 2026, it applies to any ad reaching New York wherever the advertiser is based, deceased performers' digital replicas are exempt, and several states had introduced copies; dated Washington's AI likeness law June 10, 2026 and said it covers sexual and deceptive AI content with statutory damages.
Now: Signed December 11, 2025 as Chapter 617 of the Laws of 2025, effective June 9, 2026. Subdivision 8 exempts the media that publish or disseminate ads, so there is no takedown duty; the statute names no enforcer and draws no geographic line; deceased performers' replicas are covered by Chapter 616 (Civil Rights Law 50-f); the unsourced claim about other states was removed. Washington SSB 5886 took effect June 11, 2026 and covers use in goods, ads and fundraising, with a civil penalty plus actual damages, profits and noneconomic damages for a forged digital likeness.
TAKE IT DOWN Act compliance, full re-check against Public Law 119-12
Was: Said requests must be verified with a government ID or sworn declaration, the law requires reasonable steps against re-uploads and a removal confirmation, private messaging isn't covered, and the Act criminalizes AI-generated child sexual abuse material; described a May 19, 2026 FTC priorities statement we could not find; dated the EU Digital Omnibus May 7, 2026; said Washington's AI likeness law took effect June 10, 2026 and listed it as the state intimate-image law.
Now: Section 3 requires a written request with a signature, location information, a good-faith statement and contact details, and reasonable efforts to remove known identical copies; hashing and outcome notices are FTC advice; messages are in the covered-platform definition; child pornography is left to existing federal law; the EU Omnibus is Regulation (EU) 2026/1744 of July 8, 2026; SSB 5886 took effect June 11, 2026 and Washington's fabricated intimate images law is HB 1999 (Chapter 88, Laws of 2024).
Was: Said a valid request only needs a URL, description or hash, platforms must take reasonable steps to prevent re-uploads, penalties are $53,088 per violation per day, hosting or distributing NCII is a federal crime, California, Texas and New York let victims sue, and the May 11 letters were warning letters.
Now: A valid request is written, with a signature, location information, a good-faith statement and contact details; the Act requires reasonable efforts to remove known identical copies; the FTC cites up to $53,088 per violation, with daily counting only for a continuing failure; Section 2 covers knowingly publishing under set conditions; the state example is Washington's HB 1999; the May 11 letters were reminders and the warning letters went to 12 nudify sites on May 20.
GDPR Article 30 RoPA template, Notion AI and Grammarly entries
Was: Gave Notion's address as 2300 Harrison Street, limited Notion's DPA to Business and Enterprise, said Notion AI queries are retained 30 days, named Grammarly, Inc. as processor, said Grammarly Business data is not used for training, and linked privacy pages as the DPA references.
Now: Notion Labs, Inc., 685 Market Street, San Francisco; the DPA is part of the Master Subscription Agreement covering Plus, Business, Enterprise and any organization use; Notion's LLM providers keep data 30 days or fewer, with zero retention on Enterprise. Grammarly's processor is Superhuman Platform Inc., formerly Grammarly, Inc.; team plans bought on the website start with training on until an admin turns it off. Both entries link the current DPAs.
Best AI tools for compliance, Notion AI and Grammarly sections
Was: Said Notion's DPA covers only Business and Enterprise (no DPA on Plus) with no training opt-out on Free or Plus, and that Grammarly Free and Premium have no training opt-out.
Now: Notion's DPA comes with the Master Subscription Agreement, which covers Plus, Business, Enterprise and any organization use, and Notion's AI terms rule out training on that data. Grammarly Free and Premium users can opt out of training in their account privacy settings.
AI vendor scorecard, Notion AI links
Was: The Notion DPA link opened a page that no longer exists and the privacy link opened a sign-in page.
Now: Both links point to Notion's current Data Processing Addendum and Privacy Policy.
Was: Listed NYC Local Law 144 and the EEOC hiring guidance for every use case that affects a person's outcome, including credit, health and education uses.
Now: The tool asks whether the use case screens job candidates or decides promotions, the decisions Local Law 144 covers (NYC Administrative Code § 20-870), and lists the two hiring entries only when the answer is yes.
New York RAISE Act regulation card
Was: Said the RAISE Act applies only to large frontier developers (annual revenue above $500 million) and that those developers report safety incidents within 72 hours.
Now: Every frontier developer, meaning anyone who trained a model with more than 10²⁶ operations, must publish a transparency report with each new frontier model and report critical safety incidents to the DFS office within 72 hours. The $500 million revenue threshold adds the frontier AI framework and disclosure statement duties, and the Attorney General's penalties apply to those large developers. Source: the final text, Chapter 96 of 2026, on the New York State Assembly site.
Glossary and EU AI Act topic hub
Was: The glossary said serious incidents must be reported within 24 hours, or within 15 days for safety incidents and 3 months for others; said building a product on the OpenAI or Anthropic API makes you a deployer, and that using ChatGPT or Claude in a high-risk application also makes you a deployer; defined deployers as organizations that use a system under their own name. The EU AI Act hub said most high-risk obligations apply from August 2026. The CCPA entry dated the automated decisionmaking rules to January 1, 2026.
Now: Article 73 sets 15 days, 10 days if a person died, and 2 days for a widespread infringement or serious critical-infrastructure incident. A company that builds an AI system on a GPAI model is that system's provider (a downstream provider), and Article 25 makes anyone who puts a general-purpose tool to a high-risk use its provider. Deployers are organizations that use an AI system under their authority. High-risk rules apply from December 2, 2027 (Annex III) and August 2, 2028 (Annex I). The CCPA regulations took effect January 1, 2026, and businesses using ADMT for significant decisions must comply from January 1, 2027. The penalties answer now adds the SME and small mid-cap caps and the Commission's separate GPAI fines.
Was: Showed the Garante's €15 million OpenAI fine as standing, with OpenAI saying it would appeal; said the Bunnings facial recognition decision was still under tribunal review; called the Amazon Alexa, IntelliVision, Workado and Evolv orders proposed; and did not say the DoNotPay and Cox Media orders were final.
Now: The Court of Rome annulled the OpenAI decision on March 18, 2026, on the ground that Ireland's DPC was the lead authority. On February 4, 2026 the Administrative Review Tribunal set aside the Bunnings consent finding and upheld the notice and policy findings, and the Privacy Commissioner did not appeal. The court entered the Alexa order on July 19, 2023, and the FTC finalized the IntelliVision, Workado, DoNotPay and Cox Media orders. The Evolv order is a stipulated court order the FTC lists as pending. The tracker also adds Italy's July 2026 fine on Character.AI and the DPC's April 2025 Grok inquiry.
AI data privacy guide and GDPR AI fines guide
Was: The privacy guide's enforcement table listed an Irish DPC €91M AI training fine, a $3.5M FTC fine on an AI hiring vendor, a CNIL order against an AI writing tool and a California AG probe of an AI review platform, none of which we could match to a regulator's record. The GDPR fines guide said Italy's ChatGPT action ended without a fine.
Now: The table now lists five cases checked against regulator and court sources (OpenAI, Replika and Character.AI in Italy, X's Grok in Ireland, Clearview AI in the Netherlands). The GDPR fines guide adds the December 2024 €15 million fine and its annulment in March 2026.
AI regulations hub, Colorado, Connecticut and Singapore pages, and the deadline list
Was: The Colorado page still linked impact-assessment, high-risk and safe-harbor terms and an impact assessment template from SB 24-205, and did not mention the court-ordered enforcement pause in xAI's lawsuit. The Connecticut page said SB 5 is formally titled the Connecticut Artificial Intelligence Responsibility and Transparency Act. The Singapore page said MAS asks financial institutions to apply life cycle controls to high-risk uses as soon as possible. The deadline list called AB 2013 the California AI Transparency Act.
Now: Colorado links the SB 26-189 notice and letter templates, and notes the April 27, 2026 order in X.AI LLC v. Weiser that the attorney general not start enforcement until 14 days after the court rules on xAI's preliminary injunction motion. SB 5's formal title is An Act Concerning Online Safety; CART is a nickname. The MAS Guidelines take effect October 7, 2027, with Sections 5 and 6 by October 7, 2028, and set no earlier date. AB 2013 is the training data transparency law; the California AI Transparency Act is SB 942. The deadline list adds the EU AI Act bans from December 2, 2026, Connecticut's AI companion rules from January 1, 2027 and the MAS date.
Was: Said an employer cannot outsource liability to its AI vendor and is always responsible for the tools it uses, and did not mention Executive Order 14281.
Now: The EEOC's 2023 technical assistance said an employer may be responsible under Title VII even if an outside vendor developed the test. The page now notes that EO 14281 (April 23, 2025) tells agencies to deprioritize disparate-impact enforcement, while Title VII's disparate-impact section stays in the statute.
AI regulations hub and deadline list
Was: Said EO 14179 revoked EO 14110, dated the EU AI Act bans to August 1, 2024, put a €85M damages cap in the Product Liability Directive, said NYC's audit found 17 problems at 32 companies, and said the CFPB withdrew 66 other documents with Circular 2022-03.
Now: EO 14110 was revoked by EO 14148; EO 14179 orders a review of actions taken under it. The bans apply from February 2, 2025 (Article 113). The Directive sets no financial ceilings. NYC's Department of Consumer and Worker Protection reviewed 32 company websites and found one instance of potential non-compliance; the State Comptroller found at least 17 at the same companies. The withdrawal notice lists Circular 2022-03 among many documents without that count. All 21 cards on the hub were re-checked on October 11, 2026.
Was: Listed an EU AI Office investigation into general-purpose AI models in November 2024, named "Omni AI" and a $50,000 Rytr payment in Operation AI Comply, and showed the UK's £7.5 million Clearview fine as standing.
Now: The AI Office's enforcement powers applied from August 2, 2026, and its first formal requests for information went out on August 29, 2026. Operation AI Comply (September 25, 2024) named DoNotPay, Ascend Ecom, Ecommerce Empire Builders, Rytr and FBA Machine, and the Rytr order was set aside on December 22, 2025. The Clearview fine went back through the tribunals; the Upper Tribunal upheld three of the ICO's four grounds in October 2025.
FTC AI enforcement actions guide
Was: Cited an FTC "AI and Your Business" guidance document, listed "Automaters AI" as an Operation AI Comply case, dated the AI Action Plan February 2025, and had a state attorney general section with task-force counts we could not source.
Now: No such FTC document exists, so the article now quotes the orders themselves. The case is FBA Machine / Passive Scaling. The AI Action Plan is dated July 23, 2025. The state section now covers the Texas and Massachusetts cases, each with the attorney general's release.
Vendor scorecard and privacy API selector
Was: Showed no HIPAA BAA, no zero data retention and unknown ISO 27001 for Anthropic, no EU data residency for OpenAI, no SOC 2 for Mistral or Perplexity, no training opt-out for Perplexity or Grammarly, a 90-day retention figure for Perplexity, and four dead DPA links.
Now: Each field was re-checked against the vendor's own documentation on October 8, 2026, and every one of those values was corrected. Fields with no source we could open now show unknown, and the GPAI column shows signatories of the EU General-Purpose AI Code of Practice.
Was: Said EU AI Act prohibitions applied from August 2024 and high-risk rules from August 2, 2026, put AI regulatory sandboxes due by August 2026, described GDPR Article 22 as a right to an explanation, listed critical infrastructure as needing a notified body, and called the AI Liability Directive a pending proposal.
Now: Prohibitions apply from February 2, 2025. Under the Digital Omnibus (Regulation (EU) 2026/1744), high-risk rules apply from December 2, 2027 (Annex III) and August 2, 2028 (Annex I), and sandboxes are due by August 2, 2027. Article 22 is a right not to be subject to solely automated decisions; AI Act Article 86 adds a right to explanation. The Commission withdrew the AI Liability Directive.
Colorado Chatbot Safety Act (HB 26-1263)
Was: Said customer support chatbots are covered and that the law sets no timing for telling users they are talking to AI.
Now: Customer service chatbots are excluded by 6-1-1701(3.5)(b)(II), and the statute sets daily, three-hour and on-request disclosure timing.
DeepSeek and Chinese AI models under GDPR
Was: Dated Italy's DeepSeek ban to early 2026 and said V4 was available in EU regions on AWS Bedrock, Azure and Google Vertex AI.
Now: The Garante's order is dated January 30, 2025. Only Microsoft Foundry is confirmed, with V4-Flash in the EU Data Zone.
ChatGPT product liability cases (JCCP 5431)
Was: Said later cases newly named Sam Altman personally and called all twelve coordinated cases wrongful-death suits.
Now: Altman is already a defendant in the coordinated cases. The coordination order lists 12 cases, and not all of them are wrongful-death claims.
Colorado ADMT Rule 6.6 article, SB 26-189 guide, weekly roundup Sep 21 to 27
Was: The Rule 6.6 article said the ADMT comment period closed September 23 and was five days away. The SB 26-189 guide described the April 27 federal order as a direct ban on enforcement. The weekly roundup gave May 20 as the SB 26-189 signing date.
Now: September 23 was only the date the Attorney General expected to post interim revisions. Comments and the hearing are October 26. The April 27 order is a stipulated agreement between xAI and the attorney general, not a ruling on the merits. SB 26-189 was signed May 14, 2026.
Was: Written before the bills were signed. Described a 90-day notice and 25-worker threshold for SB 951, a right of first bid and penalty fund, and guessed SB 947 would take effect January 1, 2027.
Now: Both bills were signed September 30, 2026. SB 951 uses the existing 60-day Cal/WARN notice and adds technology displacement disclosures, operative January 1, 2027. SB 947 is operative July 1, 2027 with a $500 civil penalty per violation.
Was: Stated as fact that Colorado published a revised ADMT draft on September 23, described a UK AI Regulation and Safety Bill at House of Lords committee stage, and gave a BC lawsuit theory that OpenAI helped plan the shooting. Also captioned a server-room photo as the UN session.
Now: Colorado filed its proposed rules on August 11 and said interim revisions were expected by September 23, which we could not confirm were posted. The hearing and final comment deadline are October 26. The UK has no AI bill. The BC complaint alleges OpenAI flagged the shooter in June 2025 and did not alert police. Image and alt text replaced.
Regulations tracker, third pass
Was: The EO 14179 entry said Virginia had an active AI law and predicted federal duties would not grow, the White House framework entry said it protected smaller developers and covered workforce displacement, the NYC hiring-law entry said the law was actively enforced and required 3-year record retention, the China entry claimed log retention and blanket identity verification, the ISO 42001 entry said it aligns closely with the EU AI Act, the FDA entry said clearance is always required, and the NIST entry said several states offer safe harbors.
Now: Virginia's bill was vetoed and the December 2025 order targeting state AI laws is noted. The framework is described from its March 2026 text. NYC enforcement is described using the December 2025 State Comptroller audit, and the 3-year retention claim is removed. China's log-retention and blanket identity claims are removed. ISO 42001 is not a harmonised AI Act standard. FDA review depends on device pathway. Texas TRAIGA is the state safe harbor tied to the NIST AI RMF.
Regulations tracker, second pass
Was: The NY RAISE Act was dated June 2025 and called the first state frontier AI law, Canada's AIDA was listed as pending, AB 2013 was described as covering datasets of 1 million or more records, CFPB Circular 2022-03 and the EEOC AI guidance were listed as in effect, the FTC penalty was $51,744, the SEC entry cited Corporation Finance AI guidance that we could not find, the EU-US entry actually described the EU AI Pact, and Colorado still listed the 2024 impact-assessment duties.
Now: RAISE was signed December 19, 2025 (California's SB 53 came first). AIDA died with Bill C-27 in January 2025. AB 2013 has no dataset-size threshold. The CFPB circular was withdrawn May 12, 2025 and the EEOC removed its AI guidance January 27, 2025. The FTC amount is $53,088. The SEC entry now describes its enforcement cases. The EU-US entry is now the EU AI Pact. Colorado lists the SB 26-189 duties. Australia's standard was replaced by Guidance for AI Adoption on October 21, 2025.
Was: Texas TRAIGA and Virginia HB 2094 were listed as pending, Colorado showed SB 24-205 as the operative law, and EU AI Act high-risk duties were dated August 2026.
Now: TRAIGA has been in effect since January 1, 2026. Virginia HB 2094 was vetoed on March 24, 2025. Colorado's SB 24-205 was replaced by SB 26-189 (effective January 1, 2027). EU high-risk duties now apply from December 2, 2027 under Regulation (EU) 2026/1744.
Notion AI vs Microsoft Copilot
Was: Said Copilot runs only on Azure OpenAI, that Notion commits to no training only on paid tiers, that Notion offers no BAA, and priced Copilot at $30.
Now: Anthropic and OpenAI are Microsoft subprocessors. Notion does not train on customer data by default on any plan, Enterprise can sign a BAA, and Copilot Business is $21 per user.
Microsoft 365 Copilot vs Google Workspace
Was: Gave wrong Google Workspace prices, said Google offered only usage counts for AI activity, and said Copilot audit logging needs E3 or higher.
Now: Prices, Google's Gemini log events and Vault, and Copilot's Audit (Standard) 180-day default retention are corrected against vendor documentation.
California 2026 AI bills tracker
Was: The descriptions of SB 813 and AB 1405 were swapped, and the article treated signature as still pending.
Now: Descriptions match the Governor's official announcement.
AI acceptable use policy template
Was: Said Claude Teams was required for zero retention, which conflated no-training with no-retention.
Now: Separates the two and dates the check. Consumer plans of ChatGPT, Claude and Copilot may train on data unless you opt out.
Report an error
Found something wrong? Email [email protected] with the page and the source. Confirmed errors are fixed and added to the log above.