NextAI+ Praxis--:----UTCThe new rules, in plain language. EU, UK, Singapore, US state-level, mainland China — what changed, who has to act, by when. We do not summarise statutes; we read them the way a compliance officer at a mid-sized firm reads them, and report what is enforceable on Monday morning.
The UK’s 4 November guidance limits the EU AI Act in Northern Ireland to AI closely integrated with physical products placed on that market, leaving standalone software and online tools outside, with prohibitions and AI literacy from 10 November 2026 and the Annex III and Annex I high-risk requirements from 2 December 2027 and 2 August 2028, the Commission’s Interoperable Europe toolbox gathers standards, use cases, training and procurement guidance while PAIR remains under development, the seventh Japan–EU financial forum names safe AI use and frontier-AI cyber threats for cooperation, the DOJ’s 13 October memorandum merges its January AI task force into DOJ-SITF, and Democrats plan independent testing, liability and data-centre cost bills while September’s ASI ban stays in committee.
The World Internet Conference’s 3 November report would extend safety evaluation from foundation models to deployed systems and allocate responsibility by each party’s actual control, its readiness assessment covering 24 countries on six dimensions and 22 secondary indicators with an evidence cut-off of 31 August 2026, the Cyberspace Administration’s intelligent internet initiative seeks a trust framework across agent discovery, negotiation and execution, Singapore’s Ministry of Manpower confirms reviewing AI output brings mental fatigue, CSA, GovTech and IMDA tell consumers to limit personal agents in application settings and approve important actions individually, and Korea’s PIPC guide explains server-side API authorisation ahead of the annual vulnerability assessment and penetration test covered public systems face from 1 January 2027.
The Bank of England and FCA’s 2026 survey finds 94% of respondents hold firmwide AI policies while ongoing monitoring, leakage testing and recertification are each reported by only around half, 81% lean on vendor assurance for high-materiality third-party systems and just 24% claim deep knowledge of them as the third-party share rises from 35% to 53%, HM Treasury’s Budget proposes £40 million for a National Agentic Security Unit and a Data Centre Covenant tying extra support to five policy tests, NIST’s ten agent identity tenets put permission decisions outside model reasoning and keep append-only records agents cannot edit, and the Commission has replies to every expired AI Act request across more than 30 companies without announcing findings.
Lawrence Wong’s 28 October proposal would start from common incident categories and secure exchange, covering serious failures deployers identify and near misses that trigger no existing reporting duty, Australia’s Digital Duty of Care Bill passed the House on 28 October with proposed section 27 requiring written risk assessments at least annually and six-year retention and section 25E(1)(da) treating simulated emotional intimacy that displaces a child’s human relationships as harmful, Japan’s Digital Agency opened an AI Diet-response prototype to about 180,000 staff who must still verify facts against original sources, and the Cyberspace Administration’s nineteenth deep synthesis batch registers technical support providers without naming a specific application product.
The Council for Science and Technology’s advisory letter, dated 30 July 2026, recommends mapping compute, data, skills and model dependencies under a single accountable owner and keeping trusted access to leading global models while building selected domestic capability, HM Treasury adds £120 million for the AI Security Institute and £60 million for the National Cyber Shield while scoping an agentic cybersecurity sandbox still at design stage, US Treasury proposes removing the existing AI notification category and widening prohibitions with comments due 7 December 2026, and the SEC’s FY2027 examination priorities ask whether automated advice disclosures match the controls actually in operation.
MOFCOM and eight other departments fold use-case tiering, data-use boundaries and risk monitoring into commercial AI agent governance while exploring a negative list for data use, the CSRC signals forthcoming guidance on safe and compliant AI in securities and futures where the 2023 information-security measures already require five years of business logs, State Council opinions pair employment-risk assessments with project reviews in market-access areas that may cause substantial job disruption, Japan’s Digital Agency publishes Gennai Standards requiring approval of important operations and technical measures that stop any party tampering with security-critical logs, and Korea’s Daegu innovation zone opens in full for AI robotics and healthcare data research.
The Commission publishes the reference to EN 18286:2026 in the Official Journal, giving high-risk AI providers a presumption of conformity confined to the requirements the standard covers, the AI Office confirms it has received serious AI incident reports and sent requests for information on safety practices to model developers, the UK Cabinet Office, AISI and NCSC set out AI risk defences that would bring serious agentic incidents and near misses into reporting while the Cyber Security and Resilience Bill remains before Parliament, New York’s Attorney General updates election guidance warning that chatbots return wrong deadlines and poll sites, and the FSB’s final report sets 12 non-binding practices adding deterministic controls, approval triggers and safe shutdown for agents.
MOFCOM and MOST consult on 23 additional AI entries in the technology export catalogue while temporary pre-export registration already applies to overseas transfers, licences and changes of control, China’s National AI Standardization General Group publishes an embodied intelligence ethics report grading risk R1–R5 across the lifecycle, the HKMA’s updated supervisory guidance requires use-case inventories covering embedded AI with independent validation and a kill switch for material or higher-risk uses, Singapore’s CSA reports agentic AI exercise findings favouring runtime monitoring, hardened execution environments and access controls outside the model, and Japan’s AI Safety Institute reports on its first joint technical workshop with Korea on multilingual evaluation and multimodal red teaming.
Three New York City proposals would make third-party validation and human-initiated shutdown conditions of commercial deployment, open model providers to suits over foreseeable third-party misuse and restrict election deepfakes, a reintroduced CISA Securing AI Task Force Act would coordinate AI security work inside the agency, the MHRA accepts all 44 recommendations of the healthcare AI commission with draft PCCP guidance due by December 2026, Canada’s OPC treats voiceprints as sensitive biometric information that may require express consent, and the European Commission’s Scientific Panel examines recent loss-of-control incidents.
The final MAS Guidelines on Artificial Intelligence Risk Management take effect on 7 October 2027 with life cycle controls due by 7 October 2028 and higher-risk controls expected sooner, the SAFR framework puts agent identity, mandate and risk-limit checks before an action executes while expressly not constituting regulatory guidance, Australia’s OAIC opens a formal privacy investigation into the HeyCyan smart glasses app without finding a breach, and China’s Opinions on Developing New Quality Productive Forces fold AI technology monitoring, risk early warning and emergency response into industrial policy.
The White House and six AI companies commit voluntarily to internal controls, internal review, independent external assessment and board oversight, California’s SB 947 bars sole reliance on automated systems in discipline and termination from July 2027 while SB 1000 removes the user threshold for generative-AI provenance duties and SB 503 requires clinical AI bias disclosure and periodic monitoring by healthcare facilities, and Governor Andrew Bailey argues for testing before and after deployment alongside the capacity to intervene effectively.
Three recommended national standards for government, computer vision and multimodal large-scale models take effect in stages in 2027 without setting a uniform mandatory deadline, EMEAP warns that common supplier dependencies and similar model decisions can transmit risk across the financial system, Australia’s OAIC clarifies that human participation in a final decision does not automatically remove the automated decision-making disclosure obligation due on 10 December 2026, and Korea’s PIPC begins a UK equivalence review while the National AI Strategy Committee prepares public AI agent services.
A delegated regulation grades data centre power and water use from A to G while minimum performance standards go to consultation, the NCSC proposes five dimensions for judging automated defensive actions, California signs seven data centre bills on disclosure and electricity cost allocation and names four AI safety advisers, and the FTC asks whether ad optimisation tools facilitate impersonation scams.
The CAC publishes filing details for three smartphone on-device generative AI services while their cloud calls and data flows still need separate verification, Korea’s PIPC provisionally designates tax and health data innovation zones and opens agent permission, log and memory questions, Japan’s Consumer Commission compares regulatory and redress routes when AI shapes purchases, and Singapore’s IBF pairs AI training with job redesign across 23 financial institutions.
The Joint Committee on Human Rights recommends prior approval for high-risk systems, supply chain due diligence and independent oversight, the Commission’s KIDS Act would bar dependency-inducing designs and default cross-session memory for minors, California’s SB 1050 requires synthetic-performer disclosure in advertising from January 2027, and an executive order directs study of on-site frontier evaluation and emergency shutdown.
TC260’s Framework 3.0 grades risk across five levels and details agent identities, least privilege, approvals and memory isolation, four application security guidelines set deployment safeguards and human review for education, healthcare and audiovisual services, a draft on secure agent development addresses long-term memory authorisation and tool-call permission checks, and Hong Kong’s Policy Address proposes supplier compliance declarations for government AI procurement.
The NSA, CISA and FBI extend distillation defences across aggregator routing chains, the Commission proposes harmonised R&D procurement and IP financing, the NCSC addresses shadow AI data and permission risks, and the UK seeks evidence on energy AI and publishes recommendations for continuous monitoring of healthcare AI.
China’s Supreme People’s Court treats AI-fabricated competitor reviews as unfair competition, MOFCOM challenges geographic restrictions on model access, South Korea’s PIPA amendments require 72-hour breach notification and sharpen management accountability, and Japan examines how conversational AI and agents shape consumer decisions.
ChatGPT is designated a Very Large Online Search Engine under the DSA, the Commission sends requests for information to more than 30 AI companies without establishing violations, the US DOJ supports training-stage fair use in the OpenAI litigation, and a NIST-hosted forum brings agent interactions into threat modelling.
The CAC reports action across content, accounts and apps, MIIT consults on intelligent decision-making standards for manufacturing, seven departments propose generative-AI resource assessment and disclosure, Hong Kong’s school AI sandbox keeps compliance with schools, and Singapore’s ACRA pairs automated detection with human validation.
The Commission moves GPAI oversight and generative-content transparency into enforcement, the UK and Ukraine bring data sovereignty and AI assurance into defence cooperation, the FTC finalizes $930,000 in AI marketing settlements, and California’s AB 2713 extends provenance data into the download chain.
Hong Kong’s PCPD turns least privilege and human oversight into deployment controls for agents, Japan publishes a generative-AI IP principle-code, Korea implements public-sector AI risk management, Singapore consults on training and output liability, and China issues a cluster of national standards covering agents, RAG and model platforms.
The FDA brings premarket evaluation and postmarket monitoring into its design for GenAI-enabled devices, the FTC sets out how it would police data-driven personalized pricing, the UK moves on usage limits and mental-health safety for children’s chatbots, and the NCSC puts isolation controls at the centre of agent deployment.
China’s cyber data security risk assessment measures take effect, putting important data processors on an annual assessment, reporting and verification cycle, while Korea’s National Assembly amends the PIPA to let lawfully collected personal information be used for AI development — but only with public necessity and PIPC approval.
Colorado turns decision explanations, human review and protections for minors into operational procedure, the EU’s cloud and AI study feeds lock-in and extraterritorial risk into CADA, the CAC holds publicly available personal information to a reasonable scope, NIST consults on NVD modernization, and Korea updates its CBPR certification standards.
The EU refines GPAI post-market monitoring and copyright transparency, the UK’s AI Growth Lab brings legal AI under coordinated regulatory consultation, NIST joins the Genesis Mission on industrial agent security, the US keeps outbound AI investment restrictions in force, and Korea and Singapore both pull agents inside existing frameworks.
The EU’s Digital Omnibus pushes high-risk obligations back again, NIST launches a blind testing programme and a data-centre security analysis that extends AI governance to computing infrastructure, Korea eases the clinical evidence pathway for medical AI, and China pushes IPv6 into large-model deployment.
The EU’s content-labelling obligations enter application, Singapore’s PDPC explains how the PDPA applies across the generative-AI lifecycle, the UK AI Security Institute finds every evaluated model overstepping task boundaries, the US expands its Genesis Mission research platform, and China eases obligations for small-scale handlers while updating outbound-data rules.
The White House launches GOLD EAGLE to run AI-assisted vulnerability coordination across agencies, Japan’s cabinet approves a second AI Basic Plan built on open AI sovereignty, China brings emotionally oriented AI services under full-lifecycle governance, the UK opens a call for evidence on data regulation, and the EU orders Alphabet to open Android to third-party AI.
The FTC reinforces AI drafting disclosure and human verification, while the EU advances model cybersecurity, data sovereignty and content transparency, and the UK reviews lifecycle gaps in AI security services.
The UK’s MHRA requires fact-checked, human-signed AI-generated regulatory responses, the Bank of England flags systemic risk from agentic AI in trading and payments, the US FTC probes whether suppressed AI accuracy is consumer deception, and the UN issues its first scientific AI assessment.
China’s eight ministries roll out an AI+consumption plan, a US bill would require frontier developers to report dangerous capabilities within 7 days, the EU joins the Pax Silica supply-chain pact, and Brussels moves to designate AWS and Azure as DMA gatekeepers.
The US restricts foreign access to frontier models on national-security grounds, the NO FAKES Act clears committee, the UK’s DUAA complaint rules take effect, and the EU launches its AI Act advisory forum while selecting EUROPA as its sovereign model project.
The EU issues an AI content-labeling code while pushing its deadline to December, New York’s synthetic-performer disclosure law becomes the week’s only enforceable rule, and US federal preemption talks resume as frontier cyber-capability access stays unresolved.
The US folds frontier model safety into national cybersecurity and proposes a federal AI framework, the EU’s Cloud and AI Development Act pushes compute sovereignty, and Singapore details lifecycle rules for personal data in generative AI.
Illinois’s SB315 mandates third-party audits for frontier models, the EU fines Temu €200M under the DSA, the G7 folds generative AI into child-safety rules, and China issues agent-interconnection standards covering identity and tool-calling governance.
Colorado simplifies AI compliance and the EU delays high-risk deadlines again, while China blocks Meta’s Manus acquisition and issues its first AIGC fines — an East-West divergence that demands embedded compliance.
China rolls out full-cycle AI risk oversight in education, the Bank of England stress-tests algorithmic herding, and Singapore proposes an ISO generative-AI testing standard. Governance is moving from ethical principle to auditable, machine-checkable enforcement.
China bans AI virtual companions for minors, the EU makes 6-month tamper-proof logs admissible as legal evidence, and the US FTC cracks down on AI-washing. Three shifts that move compliance out of policy and into the architecture.
The EU’s content-labeling rule takes effect in November with fines up to 7% of revenue, while China mandates ethics review for high-risk systems. The compliance clock is running, pushing governance from legal sign-off into built-in technology.
The White House unveils a national AI policy framework, the EU defers high-risk obligations to 2027–2028, and Singapore and Brazil tighten their rules. As regulation densifies, the corporate task shifts from checkbox compliance to building governance capability.
The US challenges state AI laws and mandates “American AI systems” for federal contracts, the EU delays high-risk compliance to December 2027, and FINRA flags agentic-AI risk. A week that reopens questions of supply chain and accountability.
The EU AI Act enters enforcement with fines up to 7% of revenue; the US hits a March 11 federal-vs-state clash; attacker breakout time collapses to 29 minutes. A jurisdiction-by-jurisdiction read of why compliance and security now converge into one governance agenda.
A close, weekly reading of how large enterprises actually wire AI into the business. Architecture, vendor choice, where the money lands. Filed every Thursday.
The reports worth an afternoon, taken seriously at length. One document per entry — we read the appendices so the argument holds.
If you want both columns delivered together, four times a year, in one quiet email — leave an address. Otherwise just bookmark this page.