Europe & Americas: Northern Ireland AI Act Scope, EU Tools, Japan–EU Finance, DOJ-SITF and Democrats’ AI Plans

On 4 November 2026, the UK government published Guidance on the EU AI Act in Northern Ireland, explaining the rules’ limited application to physical products and their supply chains under the Windsor Framework.

The guidance centres its scope on AI systems closely integrated with physical products placed on the Northern Ireland market, and distinguishes the roles of providers, manufacturers, importers and distributors. Standalone software, online AI tools and apps generally fall outside these limited arrangements. Inclusion depends on how AI is integrated, its intended purpose and the relevant supply-chain role; applicability in other EU markets needs to be assessed separately.

Businesses selling smart devices, medical devices or products with built-in assistants should map product versions and responsible entities separately for Great Britain, Northern Ireland and EU markets. Assess whether AI is pre-installed, necessary for the product’s intended functionality and consistent with the uses described in instructions and marketing materials; procurement contracts should specify the testing, technical documentation and change information expected from upstream suppliers. Responsibilities for the same product line need to be assessed by market and supply-chain role, with conclusions revisited when integration or intended use changes.

The guidance lists 10 November 2026 as the start date for certain prohibitions, AI literacy and AI interaction disclosure requirements; the relevant Annex III high-risk use-case requirements and Annex I product-related high-risk requirements apply from 2 December 2027 and 2 August 2028 respectively. As of 7 November, the initial milestone had not yet been reached. Businesses can schedule disclosures, testing and documentation by product classification and applicable provision, incorporating the different dates into release plans.

On 4 November 2026, the European Commission introduced an AI toolbox for the European public sector through the Interoperable Europe portal, giving public bodies access to tools, guidance and practical examples that they can find, assess and adapt.

The toolbox brings together AI standards and tools, public-sector use cases, skills training, and legal and procurement guidance in one place, helping institutions address technology selection, organisational readiness and staff capabilities together. Institutions can start with existing tools and examples and adapt them to their own business and data conditions; individual procurements still need the institution’s own security, legal and use-condition assessments.

Businesses supplying AI solutions to European public bodies can align delivery materials with customers’ actual operating conditions: which documents are processed, who reviews results, whether data leaves the institutional environment and who maintains open-source components. Procurement documents should also specify licensing conditions, security updates and exit support so that customers can assess long-term operating costs. Public bodies reusing tools should retest them with local data, languages and workflows to determine which functions are ready to use and which require adaptation.

The EU’s Apply AI Strategy had previously proposed a shared repository of open-source, reusable public-sector tools; the toolbox introduced this week supports that commitment. The portal also states that the Public Sector AI and Interoperability Readiness Pathway (PAIR) remains under development and that the toolbox will continue to evolve with public bodies’ needs and experience. Businesses can use existing resources to prepare pilots and procurement materials, then supplement validation as further assessment tools become available.

On 6 November 2026, the European Commission published the statement of the seventh Japan–EU Joint Financial Regulatory Forum, reporting discussions in Tokyo on 4–5 November between Japan’s Financial Services Agency (FSA) and the Commission’s Directorate-General for Financial Stability, Financial Services and Capital Markets Union (DG FISMA) on financial AI, cybersecurity and regulatory cooperation.

The joint statement records the parties’ directions for regulatory cooperation, emphasising safe and transparent use of AI in finance alongside stronger cyber resilience. Discussions covered risks from AI applications themselves and cyber threats amplified by frontier AI, with continued cooperation proposed bilaterally and through forums including the G7, G20 and Financial Stability Board. Financial institutions’ specific implementation requirements remain governed by their respective applicable rules.

Financial groups operating in Japan and Europe should examine dependencies on shared models and suppliers across entities: which services would be affected by an outage at a common API, cloud platform or security provider, and could a component vulnerability expose systems in several regions simultaneously? Deployment reviews can test model performance, fallback processes and recovery capability together, with contracts assigning cross-border incident cooperation and information-delivery responsibilities. Groups can share testing and investigation materials while each entity implements its local reporting and regulatory communication arrangements.

Practical arrangements for Japan–EU financial regulatory cooperation were established in March 2022. This forum further addressed AI adoption and cyber threats from frontier models, with the next meeting scheduled for Brussels in 2027. Cross-border institutions can continue monitoring specific documents from the FSA and relevant EU authorities, recording cooperation topics separately from the requirements each entity must implement, with clear business scope, owners and implementation dates.

On 5 November 2026, the US Department of Justice (DOJ) published arrangements for its Super Intelligence Task Force (DOJ-SITF), setting out its responsibilities for coordinating related criminal and civil enforcement and developing guidance on the evaluation of compliance measures.

The accompanying DOJ memorandum is dated 13 October 2026 and directs the task force to coordinate criminal and civil enforcement, resolve overlaps between departmental investigations and cases, and recommend enforcement priorities, while developing guidance on prosecuting unlawful conduct and assessing compliance measures. Its notifications concerning investigations, charges and case resolutions are directed to DOJ components as part of internal enforcement coordination.

Model providers and businesses offering public-facing generative services should review their handling of individual complaints or indications of misuse, from detection and assessment through restrictions on use and follow-up review. Records should show when the business became aware of a risk, which product version was involved, why it chose a particular response and whether that response worked. Risk-response records need to support reconstruction of actual decisions. Where several suppliers or business entities are involved, responsibilities for evidence preservation, investigation cooperation and responses to legal requests should also be assigned.

The existing AI task force announced in January 2026 has been merged into DOJ-SITF under the October memorandum, with its matters, work products and personnel arrangements transferred; the 5 November announcement made these organisational arrangements public. Businesses can monitor the task force’s specific guidance and how compliance measures are assessed in cases, then adjust internal investigation and documentation processes accordingly.

On 6 November 2026, Reuters reported that several US Democratic lawmakers and their staff were preparing AI safety and data-centre legislation to pursue after taking majority control of the new Congress in January 2027.

The legislative plans focus on independent model safety testing, liability for AI-related harm and protection against data-centre electricity costs, with stronger scrutiny of major AI companies through congressional committees also planned. Representative Lori Trahan’s staff confirmed plans to pursue independent evaluation and liability legislation; Senator Chuck Schumer identified data-centre energy costs as a priority. Detailed requirements await the introduction and consideration of bills.

Businesses supplying models or AI products to the US market should first check whether existing evaluations can support external review: whether test findings correspond to specific versions, actual uses and known limitations, which materials can be shared and which require controlled access. Where customers suffer harm, contracts should define the respective testing, disclosure, correction and investigation-cooperation responsibilities of suppliers, integrators and deployers. Data-centre operators and large-scale compute purchasers can separately map electricity cost allocation and contractual terms, preparing accurate business information for assessing subsequent provisions.

Proposals to restrict artificial superintelligence (ASI) predate the election: the Ban Artificial Superintelligence Act of 2026, promoted by independent Senator Bernie Sanders and Democratic Representative Greg Casar, was introduced in the Senate and House on 23 and 24 September respectively, proposing to ban ASI, pause advanced AI development and establish a federal Department of Artificial Intelligence. Following the election, Democratic lawmakers have begun advancing the next Congress’s AI regulatory agenda; the ASI ban proposal introduced in September remains at the committee stage. Businesses can focus subsequent reviews on formal bills’ evaluation scope, responsible parties and applicable exceptions.