Global AI regulatory update - October 2026

In this edition of our global AI bulletin, we will be looking at:

• Global – Organization for Economic Co-operation and Development (OECD) publishes paper on agentic AI deployment and governance gaps.
• Asia – China’s AI Safety Governance Framework, Hong Kong’s agentic AI privacy guidance, Australia’s frontier AI cyber threat guidance for boards and Singapore’s personal data guidance for generative AI.
• Europe – Ireland’s AI supervision insights report, EU AI Act enforcement and transparency rules and the launch of the AI Gigafactories procurement call and the EU Digital Omnibus on AI.
• UK – The challenges of agentic AI in cyber defense, UK Parliament calls for comprehensive AI legislation, the FCA’s frontier AI cyber resilience review and the Government announces a new AI Taskforce.
• US - New York begins RAISE Act implementation, California enacts child-safety AI laws, creates AI verification and auditor frameworks and launches an AI Cyber Defense Program, while New Jersey targets algorithmic pricing.

Global

Global: Working paper maps agentic AI deployment and governance gaps

On September 16, 2026, the Organization for Economic Co-operation and Development (OECD) published a working paper on agentic AI. It draws on interviews with 25 organizations, including AI developers, enterprise users and government agencies.

The paper finds agentic AI is moving beyond experiments into organizational workflows. Reported uses span software development, cybersecurity, compliance and customer support. However, governance practices are still at an early stage. Gaps persist in evaluation and assurance, cybersecurity and accountability across organizational and agent-to-agent boundaries.

Impact: Interviewed organizations reported several safeguards. These include human approval for high-stakes actions such as payments, limits on agent permissions and registries of approved agents. Many participants called for clearer expectations on traceability and accountability where multiple agents interact.

The OECD is preparing further reports on agentic AI in government and on public AI procurement. Separately, the Global System for Mobile Communications Association expects to publish agentic AI guidance in fall 2026.

Asia

China: AI Safety Governance Framework 3.0 published

On September 14, 2026, China's National Technical Committee 260 on Cybersecurity (TC260) published version 3.0 of its AI Safety Governance Framework. The update was announced at the opening of National Cybersecurity Awareness Week in Jinan.

Developed under the guidance of the Cyberspace Administration of China (CAC), the framework updates the risk taxonomy introduced in earlier versions. It classifies AI safety risks into inherent, application and derivative categories. The document also refines technical countermeasures and governance responses across the AI lifecycle.

While not legally binding, the framework is an influential technical guidance within China's broader AI governance standards.

Impact: Businesses developing, deploying or procuring AI systems in China should consider using Framework 3.0 as a benchmark for internal risk management and security controls.

Although it does not impose statutory penalties, TC260 standards may carry significant practical weight in China's regulatory ecosystem. Firms in financial services and technology should review their AI governance programs against the updated risk classifications. This applies particularly around agentic AI, data protection and content safety.

Although the Framework is not legally binding, organizations should also monitor subsequent standards and regulatory developments. Framework 3.0 may inform future AI governance requirements and technical standards in China.

Hong Kong: Agentic AI privacy guidance published

On August 25, 2026, the Office of the Privacy Commissioner for Personal Data (PCPD) issued guidance on protecting personal data privacy in the use of agentic AI. This is the PCPD's first dedicated publication on the privacy implications of agentic AI systems.

The guidance supplements the PCPD's 2024 Artificial Intelligence: Model Personal Data Protection Framework. It sets out nine data protection recommendations alongside a lifecycle security checklist.

The guidance underlines that AI agents are not legal persons and cannot displace a deployer's accountability under the Personal Data (Privacy) Ordinance.

Impact: Organizations deploying agentic AI in Hong Kong should inventory all current deployments and assess compliance against the nine recommendations. Key steps include:

• applying least-privilege access controls
• segregating operating environments
• maintaining effective oversight of agentic AI systems
• updating privacy notices where personal data is processed through agentic AI systems

Businesses are encouraged to review contractual arrangements with AI agent vendors and service providers. These should ensure appropriate safeguards for the collection, use, retention and security of personal data. Although the guidance is non-binding, it signals heightened regulatory expectations and is likely to serve as a practical compliance benchmark.

Australia: Frontier AI cyber threat guidance for boards issued

On August 5, 2026, the Australian Signals Directorate (ASD) published guidance on frontier AI cyber threats for boards of directors. The publication was developed in collaboration with the Australian Institute of Company Directors (AICD).

The guidance:

• explains how frontier AI models are making cyber-attacks faster, more scalable and easier to execute
• highlights risks including AI-enabled vulnerability exploitation, and cyber supply chain exposure
• sets out immediate, short-term and longer-term priorities for organizations to strengthen their cyber security posture

Boards are expected to oversee and challenge management on the organization’s readiness for frontier AI-driven threats.

Impact: Boards are encouraged to reassess existing risk tolerances, as frontier AI may render current assumptions outdated. Organizations are advised to secure attack surfaces, patch vulnerabilities within risk-based timeframes, replace legacy systems and adopt AI for cyber defense purposes.

Firms in financial services and technology should evaluate their dependence on AI vendor, associated supply chain risks and related foreign ownership risks.

Singapore: Advisory guidelines published on personal data in generative AI

On July 20, 2026, Singapore's Personal Data Protection Commission (PDPC) published advisory guidelines on the use of personal data in generative AI (GenAI).

The guidelines cover:

• the collection and use of personal data for GenAI model development
• the allocation of data protection responsibilities across the GenAI lifecycle
• the handling of individuals' access and correction requests

In particular, the PDPC considers general notifications are insufficient where an organization is seeking consent to use user data for GenAI development. Organizations must provide AI-specific notifications when seeking such consent. Where an organization relies on the Publicly Available Exception, its rationale should be documented, especially for personal data behind digital barriers.

Dataset suppliers handling personal data may also be subject to data protection obligations. This would depend on their role and the circumstances in which they collect, use or disclose that data.

Impact: Although the guidelines are advisory and not legally binding, they clarify the PDPC’s expectation on documentation and accountability.

Organizations developing or deploying GenAI should review their notification and consent mechanisms against the new AI-specific expectations. Financial institutions and fund managers using AI-driven analytics should review their vendor contracts. These should address the handling, protection and governance of personal data by third-party AI providers.

Europe

Ireland: AI supervision insights report published

On September 25, 2026, the Irish Data Protection Commission (DPC) published its AI Insights Report. The report details the DPC’s supervision of AI products and services between 2021 and 2025.

Impact: Businesses developing or deploying AI in the EU should treat the report as practical regulatory guidance on the DPC’s supervisory expectations. Organizations relying on legitimate interests for AI model training should review their balancing assessments and transparency notices. Objection mechanisms must also meet the standards in the report and the EDPB AI Opinion.

EU: AI Act enforcement and transparency rules apply

On July 31, 2026, the European Commission announced that key AI Act enforcement provisions would take effect on August 2, 2026. The AI Office and national authorities will oversee compliance and enforcement.

The first obligations focus on transparency requirements for AI systems. Chatbots must disclose AI interaction, deepfakes must be labeled and AI-generated content must include machine-readable markings.

Breaches of Article 50 may result in fines of up to EUR 15 million or 3% of global annual turnover.

The AI Omnibus proposal has deferred obligations for high-risk AI systems until December 2, 2027.

Impact: Businesses deploying AI systems in the EU should ensure compliance with the new transparency requirements.

Businesses using chatbots, generative AI tools or content-generation systems must disclose AI interactions and label AI-generated or manipulated content. Existing systems benefit from a transitional period until November 2, 2026 for machine-readable content markings. Non-compliance may result in fines of up to EUR 15 million or 3% of global annual turnover.

Businesses should consider:

• implementing AI transparency disclosures for chatbots and interactive AI systems
• reviewing content-labeling processes, including machine-readable markings for AI-generated content
• assessing alignment with the Code of Practice on AI-generated content transparency
• preparing for high-risk AI system obligations from December 2, 2027

EU: AI Gigafactories procurement call launched

On July 30, 2026, the EU launched a call for tenders to establish up to seven AI Gigafactories through the High Performance Computing Joint Undertaking.

The initiative aims to expand Europe’s AI computing capacity for training, inference and fine-tuning advanced frontier AI models. Backed by up to EUR 10 billion in public funding, it could unlock over EUR 20 billion private investment.

Eighteen member states signed a joint procurement agreement. The first lot supports up to four projects (up to EUR 500 million each). The second lot supports up to three projects (up to EUR 1 billion each).

The call closes on November 12, 2026.

Impact: Tech businesses, AI infrastructure providers, data center operators and cloud service providers should assess opportunities arising from the initiative.

The programs significant investment in AI computing infrastructure may create procurement and partnership opportunities. Businesses developing advanced AI models could also benefit from greater access to EU-based computing capacity.

Businesses should consider:

• identifying potential consortium partners across industry, research and public sector organizations
• assessing how participation could support long-term AI infrastructure, innovation and growth objectives
• monitoring funding, procurement and partnership opportunities linked to the program

EU: Digital Omnibus on AI enters into force

On July 24, 2026, the EU’s Digital Omnibus on AI was published in the Official Journal of the European Union and entered into force on July 27, 2026.

The legislation amends the AI Act. It introduces a phased timetable for high-risk AI obligations and transitional measures for certain generative AI transparency requirements. The Omnibus creates new prohibited AI practices and strengthens the powers of the EU AI Office. It also expands regulatory sandboxes, clarifies links with product safety laws and extends compliance flexibilities to small mid-cap enterprises.

Impact: Businesses should review how the revised timetable affects AI compliance planning and product development. Providers of high-risk AI systems have additional time to prepare for future obligations.

Organizations using generative AI should assess whether transitional arrangements apply to existing systems. Businesses should also monitor forthcoming guidance on the AI Act's interaction with product safety legislation.

National regulatory sandboxes must be established by August 2, 2027. Additional high-risk AI requirements will apply from December 2, 2027 and August 2, 2028.

EU: AI Act transparency guidance published

On July 20, 2026, the European Commission published final guidance on the Artificial Intelligence Act (AI Act) transparency requirements.

The guidance explains how providers and deployers of certain AI systems can meet these obligations. It covers user notifications for chatbots and AI agents, disclosure requirements for deepfakes and certain public-interest content and transparency obligations for emotion recognition and biometric categorization systems.

The guidance was issued ahead of the transparency requirements taking effect on August 2, 2026.

Impact: Businesses offering AI services to users in the EU should review whether the transparency requirements apply to their systems. Organizations may need to introduce user disclosures and content-marking measures.

Providers and deployers using generative AI, emotion recognition, or biometric categorization technologies should assess compliance arrangements and governance processes.

Businesses should also ensure systems placed on the market before August 2, 2026 comply with the applicable content-marking requirements by December 2, 2026.

UK

UK: Blog post highlights challenges of agentic AI in cyber defense

On September 21, 2026, the UK's National Cyber Security Centre (NCSC) published a blog post on agentic AI in cyber defense.

The NCSC argues that offensive cyber problems are largely technical, making them well suited to AI automation. Defensive challenges, by contrast, are primarily organizational and political. Automated defensive actions risk disrupting business operations and require human accountability.

The NCSC proposes a risk-assessment framework covering potency, scope, criticality, rollout confidence and recoverability.

The NCSC and the Department for Science, Innovation and Technology (DSIT) are jointly developing "Cyber Shield," a national-scale agentic cyber defense program.

Impact: The NCSC plans to publish an "AI for Cyber Defense" problem book outlining priority research areas.

Organizations deploying AI-driven security tools should assess automated actions against the proposed risk framework. Low-potency tasks, such as advising human analysts, present the safest starting point for automation.

Businesses should evaluate whether their systems support rollback and recovery. They should also strengthen traditional cyber defenses rather than waiting for agentic solutions to mature.

UK: Joint Committee calls for comprehensive AI legislation

On September 14, 2026, the UK Parliament’s Joint Committee on Human Rights (JCHR) published its report, Human Rights and the Regulation of AI. The report concludes that the existing legal and regulatory framework is fragmented and inadequate to address AI-related risks.

The JCHR calls on the Government to introduce a dedicated AI Bill adopting a risk-based approach. Key recommendations include:

• mandatory transparency obligations across the AI lifecycle
• due diligence requirements for all supply chain actors
• prohibitions on AI uses deemed incompatible with human rights

The JCHR also urges the establishment of an independent AI oversight body with statutory enforcement powers.

Impact: The report signals potential legislative change that could reshape how technology and financial services firms develop, procure and deploy AI systems in the UK. Businesses should assess their AI governance frameworks against the report’s recommendations, particularly around transparency, automated decision-making and supply chain accountability.

The JCHR recommends strengthening UK GDPR protections for automated decisions and a public consultation on prohibited AI practices. The report also urges the UK to set a timeline for ratifying the Council of Europe Framework Convention on AI, which could introduce binding international standards.

UK: FCA reviews frontier AI cyber resilience

On September 2, 2026, the Financial Conduct Authority (FCA) published a multi-firm review on the use of frontier AI in cyber resilience.

The review found that frontier AI can help firms identify vulnerabilities more quickly. However, organizations may struggle to validate, prioritize and remediate the higher volume of findings generated.

The FCA emphasized the importance of governance, human oversight, accountability and strong cyber resilience foundations. It also highlighted supplier management, dependency mapping and operational resilience as AI-driven vulnerability discovery becomes more widespread.

Impact: Financial services firms should assess how frontier AI may affect their cyber resilience and vulnerability management processes. Organizations should ensure governance frameworks, oversight arrangements and accountability structures keep pace with AI adoption. Firms may also need to strengthen supplier risk management, dependency mapping and operational resilience capabilities.

The findings may be particularly relevant to smaller firms seeking to adopt frontier AI technologies. Businesses should consider whether existing cyber risk management programs can effectively manage the increased volume of vulnerabilities identified through AI-enabled tools.

UK: Government announces new AI Taskforce

On July 24, 2026, the UK government announced a new AI Taskforce reporting directly to the Prime Minister. Lord Vallance was appointed as chair, bringing extensive scientific and public sector experience.

The taskforce will sit within the Office for the Prime Minister and the Cabinet. Its remit is to direct and implement the government’s overall AI strategy. AI Minister Kanishka Narayan will lead the taskforce and attend Cabinet. The body aims to drive public sector transformation and unlock economic growth nationwide.

The AI Security Institute will also move under this new structure. The government described this as placing AI at the center of decision-making for the first time.

Impact: Businesses supplying AI products or services to the public sector should anticipate accelerated procurement activity. Those operating in regulated sectors should monitor whether new AI-driven policies affect compliance requirements.

The relocation of the AI Security Institute suggests potential shifts in AI safety and governance expectations. The taskforce’s direct line to the Prime Minister indicates that AI policy decisions will carry significant political weight.

US

US: New York begins RAISE Act implementation

On September 21, 2026, New York announced implementation steps for the Responsible AI Safety and Education Act, known as the RAISE Act. Beginning in November 2026, New York will direct large frontier AI developers to register with the state and prepare for compliance with RAISE Act requirements on transparency, safety and incident reporting.

Beginning in January 2027, covered AI companies must comply with those standards and provide regular reports to the Office of Digital Innovation, Governance, Integrity and Trust (DIGIT). DIGIT sits within the New York State Department of Financial Services.

The RAISE Act requires large frontier AI developers to establish and publish safety and transparency frameworks. Developers must also report critical safety incidents within 72 hours, file quarterly catastrophic-risk assessments and register with DIGIT.

Impact: Large frontier AI developers should treat New York’s November registration step as the start of an operational compliance process rather than a passive notice requirement. Covered developers should prepare public safety frameworks, internal incident-reporting procedures, quarterly risk-assessment processes and governance documentation ahead of January 2027 compliance.

US: California enacts child-safety chatbot and social-media package

On September 10, 2026, California signed a broad child-safety package covering social media, AI chatbots, online platforms, K–12 pupil data, digital wellness, and AI-enabled child exploitation risks.

The package includes SB 1119, known as Adam's Law. The law imposes new requirements for companion chatbots used by children. These include child-safety audits, risk assessments, Attorney General reporting and measures to address harmful outputs. The package also includes SB 867. The law prohibits the manufacture, sale, exchange or offering for sale of toys that include a companion chatbot until January 1, 2031.

Impact: The California package shows that legislatures are moving beyond general AI transparency rules. The focus is shifting toward controls for child-facing AI systems, addictive design, targeted advertising and safety audits.

US: California creates AI verification and auditor frameworks

On September 9, 2026, California Governor Gavin Newsom signed SB 813 and AB 1405, establishing new AI oversight infrastructure for independent verification and auditing. SB 813 establishes a framework for independent verification organizations that can assess AI systems and models for compliance with state law. AB 1405 creates a state registry for AI auditors and sets standards for auditor independence, transparency and integrity.

On September 18, 2026, Governor Newsom issued Executive Order N-9-26 directing accelerated implementation of the new oversight framework. The order also seeks recommendations on stronger tools, including onsite independent verification and an AI "kill switch.”

Impact: California is moving beyond general AI policy principles toward a third-party assurance model. The framework centers on independent assessment, auditor registration and operational oversight.

AI developers and deployers subject to California law should expect increasing scrutiny of auditability, auditor independence, safety documentation and readiness for independent verification.

US: California launches AI Cyber Defense Program to protect critical infrastructure

On August 10, 2026, California announced a first-in-the-nation AI Cyber Defense Program to strengthen protection of state assets and critical infrastructure against AI-enabled cyber threats. The program will be housed within the California Cybersecurity Integration Center and will use AI for vulnerability detection, network hardening and incident response. California also plans to expand advanced cybersecurity capabilities for local governments and critical infrastructure partners and designate an AI Cybersecurity Officer in every state agency.

Impact: The program signals that AI is becoming central to both sides of cyber risk. Threat actors are using AI to accelerate attacks, while governments are deploying AI-enabled tools to improve detection and response.

US: New Jersey targets algorithmic pricing through grocery and rental-market legislation

On July 20, 2026, New Jersey signed the Forbidding the Algorithmic Inflation of Rent Act (FAIR Act). The law regulates algorithmic rent-setting systems and seeks to prevent coordination of rental prices or occupancy levels.

On July 23, 2026, New Jersey also signed the Fair Price Protection Act. The law prohibits retailers from using personal information to set personalized prices for identical products. This includes data such as online activity, location and purchasing history.

Impact: The developments demonstrate how regulators and legislators may scrutinize pricing systems that rely on personal data or behavioral predictions. Particular attention may be given to outcomes that appear discriminatory, opaque or coordinated.

Institutions should review pricing governance, model documentation, fair lending controls and consumer-disclosure practices for AI-enabled pricing tools.

Co-authored by: Uendi Barreti, Paola Paccani and Jon Botham (Knowledge Insights)