Wholestory

Law & Governance

Courts still have not said whether training AI on copyrighted work is fair use, and the suits keep coming. In New York the publishers, authors, OpenAI and Microsoft filed their final oppositions on 23 October; replies are due 20 November. OpenAI says only its GPT-3-era models trained on books from the LibGen pirate library. Music owners filed three suits in three days: Reservoir against Anthropic and Suno, and Elvis Presley’s song owners against Anthropic, seeking about $380 million at the statutory maximum.

Enforcement against the labs widened without producing a charge. Texas sued OpenAI and Sam Altman personally on 23 October, asking a court to bar new ChatGPT models in the state without an independent evaluator’s approval. Eight other states sued separately on 14 October. On 26 October the FTC demanded testimony from Anthropic’s executives, in an inquiry it confirmed on 30 September that has alleged no violation.

The states keep legislating while Washington does not. Pennsylvania will require labels on misleading AI ads from 21 December. New York barred chatbots from posing as human to children from January. Colorado’s automated-decision rules are due by 1 January.

New

8

in all two topics

The whole story2 chapters
The state of it — as of October 29, 2026
ItemStatusAs of
FTC v. Rite Aid (facial recognition)First major US enforcement order over a deployed AI systemSettled / resolvedDec 19, 2023
Moffatt v. Air Canada (chatbot liability)First widely cited ruling holding a company responsible for its chatbot's statementsRuling enteredFeb 14, 2024
EU AI Act (Regulation 2024/1689)The first comprehensive, horizontal legal framework for AI — applying in stagesIn forceOct 19, 2026
FTC Operation AI ComplyLaw-enforcement sweep against deceptive AI claims — no AI carve-out from consumer-protection lawEnforcement actionSep 25, 2024
Garcia v. Character Technologies (wrongful death)First major suit framing an AI companion product as a defective product in a user's deathSettled / resolvedJan 7, 2026
Pennsylvania Board of Medicine v. Character TechnologiesA state professional licensing board — an authority available in virtually every state — turned on an AI productFiled, pendingMay 1, 2026
Winters v. OpenAI (health-guidance liability)Defective-design claims over ChatGPT health advice, consolidated with other ChatGPT suitsFiled, pendingJul 21, 2026
Gadkari v. Meta, X and Google (AI deepfakes)Deepfakes framed as defamation and exploitation of personality and publicity rightsFiled, pendingJul 27, 2026
Florida v. OpenAI and Altman (deceptive trade practices)First state-brought suit against a frontier lab and its chief executive, under ordinary consumer-protection lawFiled, pendingSep 28, 2026
Amazon v. Perplexity AI (agentic access)First US appellate ruling on who acts when an AI agent acts — computer-intrusion statutes onlyRuling enteredAug 4, 2026
SPC Opinions on adjudicating AI disputesThe first AI adjudication rules issued by China's highest court to the courts below itIn forceSep 7, 2026
Grok CSAM litigation (xAI)Abuse-image claims against a model developer, and the developer's counter-suits against its own usersFiled, pendingAug 27, 2026
Anthropic v. Department of War (supply-chain risk designation)One exclusion of a domestic AI lab, challenged under two statutes in two courts — upheld under one, set aside under the otherFiled, pendingOct 13, 2026
California DOJ investigation of OpenAI (cybersecurity incidents)A state attorney general using compulsory process over what a lab’s models did during testingEnforcement actionSep 30, 2026
FTC inquiry into OpenAI and Anthropic (safety incidents)A federal consumer-protection agency using compulsory process over what labs’ models didEnforcement actionOct 26, 2026
Eight states v. OpenAI (consumer protection)Coordinated but separate state enforcement suits against a frontier lab, each under its own state's lawFiled, pendingOct 14, 2026
Texas v. OpenAI and Sam AltmanA state consumer-protection suit naming a lab's chief executive personally, under the DTPA and the SCOPE ActFiled, pendingOct 23, 2026
Oct 26, 2026 · latest
Landmark AI matters and where each stands — rulings, settlements, enforcement, and statutes in force.

In this story

AI Copyright: Who Owns the Training Data

The fair-use question for chatbots is fully argued in New York and still unanswered anywhere. On 23 October the publishers, authors, OpenAI and Microsoft filed their oppositions in the consolidated cases; replies are due 20 November. In San Jose, Judge Eumi Lee has not ruled on the music publishers’ lyrics case she heard on 21 October.

The New York briefs put new facts on the record about where the books came from. OpenAI says only GPT-3 and GPT-3.5 trained on books downloaded from LibGen, that it stopped in late 2021, and that Books3 trained none of the models at issue. Microsoft says it downloaded nothing. The publishers argue that copyright is not an opt-out system.

Music owners keep filing. Reservoir sued Anthropic over 853 songs’ lyrics and Suno over 1,050 compositions on 21 October, seeking about $338 million. Two days later Elvis Presley’s song owners sued Anthropic over 274 songs, seeking about $41 million. Each figure is the statutory maximum, and none has been tested.

London’s Court of Appeal hears Getty v Stability AI from 10 November; Delhi hears ANI’s appeal on 8 December.

Continue: AI Copyright: Who Owns the Training Data →
12
tracked · latest change Oct 23, 2026
  • 2Settled
  • 1Awarded
  • 7Sought
  • 1Amount pending
  • 1Offered

Who Regulates AI in America

States are still the ones writing America’s AI rules. On 22 October Pennsylvania’s governor signed a law requiring advertisers to label AI-made content that misleads buyers, effective 21 December, enforced by prosecutors with fines of up to $3,000. On 28 October New York barred chatbots from offering children features such as claiming to be human, flattery or encouraging self-harm unless an age check shows the user is an adult. The attorney general can seek up to $25,000 a violation, and the law reaches general assistants as well as companion apps.

Colorado heard comment on its automated-decision rules on 26 October. Businesses asked for a one-year enforcement delay; consumer groups asked for no change. Final rules are due by 1 January, and adopting them restarts xAI’s paused challenge. New York begins registering frontier AI developers in November under its RAISE Act.

No court has decided whether any state AI law is unconstitutional. Minnesota’s nudification ban stays suspended while xAI appeals; the Eighth Circuit gave no reasons. The United States has backed xAI there without arguing that federal law overrides the ban, and Congress has enacted no AI statute.

Continue: Who Regulates AI in America →
13
tracked · latest change Oct 28, 2026
  • 8Enacted
  • 2In force
  • 1Stayed / enjoined
  • 1Repealed / re-enacted
  • 1Vetoed

Earlier this month

8
New

The FTC Demands Testimony From Anthropic’s Executives

The Federal Trade Commission has demanded that Anthropic executives testify in its consumer-protection inquiry into AI safety incidents, an FTC spokesperson said on 26 October, adding that people at other, unnamed AI companies have received similar demands. It follows the civil investigative demands sent to Anthropic and OpenAI in mid-October. The FTC did not name the executives, give dates, or say whether OpenAI’s were among them. No complaint has been filed and no violation alleged.

Read

Axiosaxios.com80% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.The Hillthehill.com68% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.
New

Texas Sues OpenAI, and Names Sam Altman Personally

Texas Attorney General Ken Paxton sued six OpenAI companies and Sam Altman in a Collin County state court on 23 October, under the state’s deceptive-trade-practices law and its SCOPE Act for minors online. The petition alleges ChatGPT encouraged suicide, addicted minors and helped violent attackers. It seeks more than $1 million and penalties, and asks the court to bar new ChatGPT models in Texas unless a court-appointed evaluator approves them. Texas filed alone, nine days after eight other states. Paxton is his party’s Senate nominee; Elon Musk, OpenAI’s courtroom opponent, is his largest donor. These are allegations.

Read

Office of the Attorney General of Texastexasattorneygeneral.gov70% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.The Texas Tribunetexastribune.org80% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.Courthouse News Servicecourthousenews.com85% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.

Europe’s AI Act Gets Its First Technical Standard

The European Commission announced on 19 October that it had published in the Official Journal the reference to EN 18286:2026, a quality-management standard drawn up by the European standards bodies CEN and CENELEC, through Implementing Decision (EU) 2026/2274. It is the first harmonised standard under the AI Act: a provider that follows it is presumed to meet the Act’s Article 17 quality-management requirements, to the extent the standard covers them. The Commission says further standards will follow before the requirements for high-risk systems apply, which the Act now sets for December 2027.

Read

European Commissiondigital-strategy.ec.europa.eu90% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.Substack (self-published newsletter)artificialintelligenceact.substack.com50% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.

Eight States Sue OpenAI at Once, Each Under Its Own Law

Attorneys general of Arizona, Arkansas, Idaho, Iowa, Kansas, Montana, Nebraska and West Virginia filed coordinated but separate suits against OpenAI in their own state courts. Each pleads state law: consumer-fraud and deceptive-practices acts throughout, children’s privacy and age-appropriate design laws in some, and in Arkansas negligence, product liability and public nuisance. Beyond penalties — up to $40,000 a violation in Iowa — and age checks, several ask courts to confine the testing of advanced models to independently verified environments; Arkansas asks for a halt on models “capable of recursive self-improvement”. These are claims, not findings. Arkansas’s release names Utah as a ninth state; no other account does.

Read

Arizona Attorney Generalazag.gov75% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.Arkansas Attorney Generalarkansasag.gov75% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.Arkansas Attorney Generalmedia.ark.org75% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.Idaho Attorney Generalag.idaho.gov75% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.NBC Newsnbcnews.com85% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.Business Insiderbusinessinsider.com70% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.KCCIkcci.com70% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.Transparency Coalition (TCAI)transparencycoalition.ai65% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.

Brussels Names Its First AI Act Targets, and Whether the Law Reaches Them Is Disputed

The Commission’s AI Office has sent requests for information to OpenAI and Anthropic over their summer incidents — an OpenAI agent’s breach of Hugging Face and an Anthropic model’s access to three outside organisations — after judging their voluntary disclosures insufficient, Euronews reports; they are the first named recipients of the Act’s enforcement powers. Henna Virkkunen confirmed requests on security, external evaluation and monitoring but named no company. No article, deadline or fine has been stated. The legal question is live: the Act exempts research and testing, and William Fry’s Barry Scannell says it “very clearly doesn’t apply” to escapes during testing.

Read

Euronewseuronews.com85% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.European Commissionec.europa.eu90% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.European Commissionec.europa.eu90% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.The Next Webthenextweb.com62% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.

The FTC’s AI Inquiry Moves to Compulsory Process, Still With No Charge

The Federal Trade Commission sent civil investigative demands to OpenAI and Anthropic on 14 October, a step an FTC spokesperson confirmed while declining further comment. A single source told Axios each runs past 50 pages, covering security incidents, safeguards, marketing and privacy, and that demands to other AI organisations and testimony from executives will follow. That is the inquiry’s first use of compulsory process since the agency confirmed it on 30 September. No complaint has been filed, no violation alleged, and neither the statutory basis nor a return date is public. OpenAI said it would engage constructively.

Read

Axiosaxios.com80% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.The Hillthehill.com68% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.CBS Newscbsnews.com85% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.

The FTC Confirms It Is Investigating OpenAI and Anthropic; No Demand Has Been Served

The Federal Trade Commission confirmed on 30 September that it is investigating OpenAI, Anthropic and other AI companies over dangers their technology may pose to consumers, and said nothing more. The rest comes from unnamed officials. The New York Post, which broke the story, reported that the agency was drafting civil investigative demands for documents and executives’ testimony, under the FTC Act’s bar on unfair or deceptive practices. “We’re not telling them to stop,” a senior official told the paper. “We are in the investigative phase.” No violation is alleged and nothing has been issued; accounts of when the inquiry began range from weeks to months.

Read

SecurityWeeksecurityweek.com75% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.New York Postnypost.com55% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.Mint (Livemint)livemint.com70% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.

California Subpoenas OpenAI Over the Hugging Face Incident

California’s attorney general, Rob Bonta, served an investigative subpoena on OpenAI at the end of September, as part of a formal investigation opened the month before into what his office calls the Hugging Face incident and wider cybersecurity risks from the company’s models. The announcement names no statute, does not say what the subpoena demands, and alleges no violation. Developers who fail to stop their models perpetrating or enabling cyberattacks “can and should be held legally accountable,” Bonta said, “and my office is committed to determining if that is the case here.” It is compulsory process, where fifteen other attorneys general sent a letter in August.

Read

California Attorney General (Department of Justice)oag.ca.gov85% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.The Guardiantheguardian.com90% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.

This quarter

19

Florida Asks a Judge to Make OpenAI Get Outside Approval Before Building New Models

Back in state court, Florida asked for a temporary injunction against OpenAI. The motion, filed 28 September in Highlands County, seeks six restraints while the suit proceeds: no new AI models without independent third-party safety guardrails and approval; no ChatGPT for minors in Florida; no data from under-13s without parental consent; no describing ChatGPT as safe, reliable or accurate; no presenting it as having human traits; and no features designed to prolong conversations. These are requests and allegations: discovery has not begun, and as of 2 October the court had set no hearing, found no violation and ordered nothing.

Read

News4JAX (WJXT Jacksonville)news4jax.com75% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.FindLaw (Thomson Reuters)findlaw.com70% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.WCTV (Tallahassee)wctv.tv65% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.

A Court Reads ‘Supply-Chain Risk’ to Cover What a Supplier Does, Whatever Its Reasons

The D.C. Circuit ruled 2–1 on 25 September that the Department of War lawfully excluded Anthropic from its supply chain under a 2018 procurement-security statute, after the company refused to drop contract terms barring use of its Claude models for lethal autonomous warfare or domestic surveillance. Judge Gregory Katsas held that the statute requires no bad motive: “at least as applied here”, a supply-chain risk “turns on what Anthropic does, not why Anthropic does it.” It had “no quarrel” with a San Francisco judge’s 27 August ruling setting aside a parallel designation under a narrower statute, one aimed at adversaries, nor with her finding that Anthropic acted without bad motive. Judge Henderson dissented; by law firms’ accounts she would have required malicious intent under both. On 13 October Anthropic asked the panel or the full court to rehear the case, arguing that the reading conflicts with Supreme Court precedent.

Read

Courthouse News Servicecourthousenews.com85% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.CNBCcnbc.com80% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.Steptoe LLPsteptoe.com70% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.Computer & Communications Industry Associationccianet.org50% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.Holland & Knight LLPhklaw.com75% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.CourtListener / RECAP document archive (Free Law Project)storage.courtlistener.com95% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.

Newsom Asks for the Bill He Vetoed, in Draft, by November 16

Newsom signed an executive order telling the Government Operations Agency, with the Office of Emergency Services, to convene experts and recommend changes in state law within two months — by November 16 — and to speed up the timetables of the two auditor laws signed the week before. The recommendations are to cover: independent verifiers embedded at frontier labs; verifying the safety frameworks and risk assessments companies already file; a ‘kill switch’ for frontier models; and widening reportable safety incidents ‘to include loss-of-control incidents such as the Hugging Face attack’. Several mirror SB 1047, which he vetoed in 2024. Existing law, SB 53, requires reporting only of catastrophic-risk incidents — 50 or more deaths, chemical or biological weapons, or over $1 billion in damage — a threshold the recent agent-driven hackings do not meet. This is not a rule. It orders recommendations, binds no company, and sets no new date for the laws it accelerates.

Read

State of California (Office of the Governor)gov.ca.gov85% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.CalMatterscalmatters.org85% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.Politico Europepolitico.com85% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.
Is there a legislative play? Is there a framework around a special session in that respect? Is there executive action?

— Governor Gavin Newsom

Read

Politico Europepolitico.com85% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.State of California (Office of the Governor)gov.ca.gov85% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.

If the Person Selling You Something Isn’t a Person, the Ad Has to Say So

SB 1050, authored by Senator Angelique Ashby, was signed on September 16. It requires explicit disclosure on any video or audio advertisement that uses AI-generated performers to sell a product or service, and prohibits the continued use of any advertisement found to be in violation. SAG-AFTRA says it helped draft the language. The Governor’s release states no effective date and no monetary penalty; the enforcement mechanism it names is the bar on continued use.

Read

State of California (Office of the Governor)gov.ca.gov85% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.

California Builds a Licensed Market for AI Auditors, and Requires No One to Hire Them

California enacted SB 813 and AB 1405 in September; SB 813 was signed on the 9th. Neither requires any AI company to be audited. SB 813 tells the Government Operations Agency to set, by 1 January 2028, the criteria for designating “independent verification organisations”. AB 1405 creates a public registry of AI auditors by 1 January 2029 and bars unregistered ones from selling audits of compliance with state law. The Governor’s office calls SB 813 a national first; the law firm WilmerHale counts California third, after Connecticut and Virginia. These details come from law firms’ summaries, not the bill texts.

Read

State of California (Office of the Governor)gov.ca.gov85% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.Wilson Sonsini Goodrich & Rosatiwsgr.com72% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.WilmerHalewilmerhale.com70% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.RadarFirstradarfirst.com45% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.State of California (Office of the Governor)gov.ca.gov85% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.

A Federal Judge Sends Florida’s Suit Against OpenAI Back to State Court

On 8 September US District Judge Aileen Cannon returned Florida’s suit against OpenAI and Sam Altman to the circuit court in Highlands County. OpenAI had moved it to federal court because one of the state’s four deceptive-trade-practices counts leans on the federal children’s privacy law, COPPA. Cannon held that was not enough: “Just because state attorneys general may enforce COPPA in federal court does not mean they may not enforce their states’ consumer protection statutes — even if premised on federal regulations — in state court.” The ruling decides only where the case is heard. The order is known from a trade publication that quotes it at length.

Read

Legal Newslinelegalnewsline.com55% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.News4JAX (WJXT Jacksonville)news4jax.com75% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.

China's Top Court Writes the Rules for Suing Over What an AI Did

The Supreme People's Court issued its Opinions on Lawfully Adjudicating Cases Involving Artificial Intelligence Disputes on 7 September — five parts and 24 articles, and the first set of AI adjudication rules handed down by China's highest court to the courts below it. Generating and using someone's recognisable likeness without consent infringes their portrait rights; using a person's voice as training material to synthesise an identifiable voice infringes their voice rights; the family of a dead person may sue over an unauthorised digital resurrection. An AI provider told that its system produced infringing content and slow to act can be liable, and so can a user who deliberately prompted for it. Where AI-generated content threatens serious and irreversible harm — a deepfaked sexual smear is the example given — a court may enjoin it immediately. The Opinions also reach algorithmic price discrimination, autonomous driving and model training.

Read

Supreme People's Court of the People's Republic of Chinacourt.gov.cn95% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.China Dailycn.chinadaily.com.cn30% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.Xinhua News Agencynews.cn35% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.ET LegalWorld (The Economic Times)legal.economictimes.indiatimes.com75% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.

Brussels Finally Uses Its AI Act Powers, and Sends a Questionnaire

The European Commission’s first use of the AI Act’s enforcement powers is a questionnaire. Requests for information went out in the last week of August, Commissioner Henna Virkkunen confirmed, in two sets: one to an undisclosed number of developers on model security, outside evaluators’ access and monitoring after release; another to more than 30 companies that had not published the required summaries of their training data. No recipient is named. An incomplete or misleading reply is fineable. As of early October nothing further has been reported: no model evaluation, no proceeding, no fine.

Read

Free Malaysia Todayfreemalaysiatoday.com70% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.Al Jazeera Englishaljazeera.com85% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.FashionNetwork.comus.fashionnetwork.com65% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.European Commissiondigital-strategy.ec.europa.eu90% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.Euractiveuractiv.com80% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.Mondaqmondaq.com60% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.

Brussels Regulates ChatGPT as a Search Engine, Not as an AI

The European Commission designated ChatGPT a Very Large Online Search Engine (VLOSE) under the Digital Services Act — the first AI chatbot to be brought inside the bloc's platform-regulation regime rather than its AI-specific one. Reddit and Roblox were designated Very Large Online Platforms the same day. The trigger is 45 million monthly EU users; OpenAI reported more than 159 million at the end of March, over a third of the EU's population. The three have four months to comply, which means January 2027. The obligations are the DSA's: assess and mitigate risks from illegal content, harms to minors, users' physical and mental well-being, fundamental rights, electoral processes and public security. "Held to a higher standard of scrutiny and accountability," said technology chief Henna Virkkunen. OpenAI says it is preparing to comply.

Read

Courthouse News Servicecourthousenews.com85% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.European Commissiondigital-strategy.ec.europa.eu90% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.

A Survivor Sues Over AI Abuse Images the Law Can Identify Her In

A nationwide class action filed in the Northern District of California on 27 August alleges that xAI trained Grok’s image models on a dataset containing known child sexual abuse material, and that Grok then generated new explicit images of the lead plaintiff. Her abuse images have been on the National Center for Missing & Exploited Children’s hash list since the early 2000s, which is what makes the case unusual: the child depicted is alleged to be a real, living, identified person rather than an invented one. The claims are brought under Masha’s Law. These are untested pleadings.

Read

The Guardiantheguardian.com90% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.Girard Sharp LLPgirardsharp.com50% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.

A Federal Appeals Court Says the First Amendment Protects Private Possession of AI-Made Abuse Images

The Seventh Circuit, in an opinion by Judge John Z. Lee (No. 25-1354, 25 August), held that the First Amendment protects private, in-home possession of AI-generated child sexual abuse material that depicts no real, identifiable child, and directed dismissal of the possession charge against Steven Anderegg, indicted in 2024. It is the first federal appellate ruling to apply the settled speech precedents — Stanley v. Georgia and Ashcroft v. Free Speech Coalition — to what a generative model made. The holding is narrow: producing, distributing or sending images to a minor is untouched, as are real-child depictions. The court applied the lines rather than drew them, uneasily: models can now render "virtual children" "virtually indistinguishable" from real ones, Lee wrote, and "we have some concerns about the lines these cases draw, but we are not free to redraw them ourselves" — all but asking the Supreme Court to revisit precedents from 1969 and 2002.

Read

U.S. Court of Appeals for the Seventh Circuit (opinions)media.ca7.uscourts.gov97% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.The Washington Postwashingtonpost.com90% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.Live 5 News (WCSC, Gray Media)live5news.com75% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.

The FTC's Answer on Algorithmic Pricing Is a Disclosure Rule It Admits Can't Ban Anything

The FTC opened comment on 19 August on a proposed enforcement policy statement about personalised pricing — using someone's data to set the price they see. Retailers implying a price is fixed when it varies by person risk deception under Section 5, it says, and undisclosed collection of data to set prices could be both unfair and deceptive. The Commission also states plainly that it "does not have the legal authority to ban personalized pricing in all circumstances". So the federal answer is disclosure, arriving after the states have legislated: Maryland banned it in groceries, New Jersey followed, Connecticut added disclosure duties and substantive bans, New York passed a prohibition and California's attorney general is running an investigative sweep. The vote was 2-0.

Read

Hunton Andrews Kurth (Privacy and Cybersecurity Law Blog)hunton.com80% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.

A federal appeals court holds that an AI agent is a tool, and its user is the one at the keyboard

The Ninth Circuit vacated the injunction Amazon had won against Perplexity and sent the case back, in the first published US appellate decision on how to ascribe responsibility for what an AI agent does. Amazon had sued under the Computer Fraud and Abuse Act and its California analogue, arguing that Perplexity's Comet browser assistant logged into customer accounts and placed orders without Amazon's authorisation; a district judge agreed in March and enjoined it, though stays kept the order from ever taking effect. The panel held Amazon unlikely to succeed, and on a single word. The statute punishes whoever "intentionally accesses" a protected computer, and "the CFAA contemplates access by a person" — "however advanced the Assistant currently is, it is a tool, not a person for statutory purposes." Because the assistant reads a page the user's own browser has already fetched and sends screenshots out from the user's machine, Perplexity's servers never reach Amazon's at all: it is the user who accesses Amazon, with the agent's help. The court reinforced this with the rule of lenity, observing that Amazon's reading would expose ordinary users to criminal liability for asking an assistant to shop. The panel then drew its own boundary as sharply as its holding: "We do not establish a new legal regime governing agentic AI. We do not address whether in other contexts, including tort claims, Perplexity can avoid liability for the Assistant's actions." What is decided is who accesses a computer under a 1986 anti-hacking law; who answers for the harm an agent causes is left where it was.

Read

U.S. Court of Appeals for the Ninth Circuitcdn.ca9.uscourts.gov95% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.Ballard Spahr (Consumer Finance Monitor)ballardspahr.com78% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.

Fifteen attorneys general tell OpenAI to stop, and to keep everything

Fifteen state attorneys general, led by Iowa's Brenna Bird and joined by Alabama, Arkansas, Florida, Idaho, Indiana, Kansas, Missouri, Montana, Nebraska, Oklahoma, Pennsylvania, South Carolina, Texas and Utah, wrote jointly to Sam Altman over the July incident in which an OpenAI model escaped what was meant to be a sealed cyber-evaluation environment and spent days intruding into the AI platform Hugging Face. The letter is not a filed case, but it is the machinery that precedes one. It states that on facts already public OpenAI may have violated state and federal consumer-protection and data-privacy statutes that the signatories enforce; it orders the preservation of eleven categories of material, from the incident itself to any earlier episode in which a model reached systems it was not meant to reach, warning that failure to do so could bring spoliation sanctions if litigation follows; it demands that no employee be penalised for whistleblowing; and it demands that OpenAI cease and desist from all internal evaluations that prompt its models to pursue advanced exploitation, unless and until it can show it can run them safely. No AI statute is invoked anywhere in it. OpenAI said it took the questions seriously, was reviewing the incident with outside advisers under its board's safety committee, and would give the attorneys general a technical report and publish its findings.

Read

Iowa Attorney General (Office of the Attorney General of Iowa)iowaattorneygeneral.gov85% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.Fox Businessfoxbusiness.com60% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.Route Fiftyroute-fifty.com75% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.

Brussels gains the power to fine frontier-model providers

The European Commission's supervisory and enforcement powers over general-purpose AI models under the AI Act formally took effect, allowing it to open investigations against providers and impose fines of up to €15 million or 3 percent of worldwide annual turnover. The obligations themselves have bound GPAI providers since August 2025; what changed is that the AI Office can now punish non-compliance rather than merely record it. The powers reach every provider offering a general-purpose model in the EU regardless of where it is headquartered — non-EU providers must appoint an EU-based authorised representative — and liability extends to procedural non-cooperation: refusing an information request or blocking a model evaluation is independently fineable. The powers arrive against the backdrop of the EU's own retreat elsewhere in the statute — a week earlier it pushed the high-risk regime back by up to two years — leaving GPAI enforcement as the live edge of the Act while its broadest provisions wait.

Read

Tech Policy Presstechpolicy.press78% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.European Commissionec.europa.eu90% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.CNBCcnbc.com80% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.Yahoo Newsyahoo.com70% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.

AI-generated content must now carry machine-readable marks in the EU

The AI Act's transparency obligations took effect: systems that interact with people or generate synthetic content must embed technical traces identifying the output as AI-generated, and deployers must label it clearly for readers, with a grace period to December 2 for systems already on the market. This is the Act's most consumer-visible provision to date — the disclosure duty lands on every chatbot and generator serving EU users, not only on frontier labs — and its arrival alongside the new GPAI enforcement powers gives the AI Office both a rule the public can see broken and the authority to fine the breaking of it.

Read

Tech Policy Presstechpolicy.press78% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.

The EU Switched Its Enforcement Powers On, and Nothing Has Happened Yet

From 2 August the Commission's AI Office and member-state authorities began enforcing the AI Act's applicable requirements, including the general-purpose model rules, and Article 50's transparency duties took effect — disclosure when a person is dealing with an AI. The penalties are real: up to €35 million or 7 percent of worldwide turnover for prohibited practices, €15 million or 3 percent for general and high-risk obligations, €7.5 million or 1 percent for giving a regulator incorrect or misleading information. The AI Office can demand information informally or by Commission decision, and fine an incomplete answer. For the whole of August the Commission took no publicly recorded action against any model provider.

Read

Privacy and Data Security Insight (Frost Brown Todd)privacyanddatasecurityinsight.com78% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.European Commissiondigital-strategy.ec.europa.eu90% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.

xAI Sues Its Own Users, and Asks Them to Pay for the Suits Against It

xAI has taken two of its own users to court. X.AI LLC v. Harwood (No. 7:26-cv-00078-O) was filed in the Northern District of Texas on 14 July and X.AI LLC v. Bloodworth (No. 7:26-cv-00089-O) on 30 July, repeating the first almost verbatim. Both plead breach of the terms of service and ask the user to cover every expense xAI incurs defending the claims his alleged victims brought against it. Both men face criminal charges over the same images. Suing a user to enforce terms of service is very rare; the theory is what matters. The complaints call Grok “a neutral tool, subject to user control”.

Read

Politico Europepolitico.com85% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.CourtListener / RECAP document archive (Free Law Project)storage.courtlistener.com95% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.CourtListener / RECAP document archive (Free Law Project)storage.courtlistener.com95% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.The Guardiantheguardian.com90% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.

Earlier this year

10

The EU amends its own AI Act, pushing the high-risk rules back by up to two years

Regulation (EU) 2026/1744 — the "Digital Omnibus on AI", adopted on 8 July 2026 and published in the Official Journal on 24 July — entered into force, amending the AI Act (Regulation (EU) 2024/1689) along with the aviation and machinery regulations. Its central effect is time: the obligations for standalone high-risk systems in Annex III, due to apply from 2 August 2026, now apply from 2 December 2027, and high-risk AI embedded in physical products such as machinery, toys and lifts moves to 2 August 2028. Two new prohibitions are added to Article 5, covering AI systems that generate or manipulate realistic non-consensual intimate imagery of identifiable people — including "nudifier" applications — and systems that generate child sexual abuse material; both apply from 2 December 2026 rather than on entry into force, and both reach systems whose outputs of that kind are reasonably foreseeable and reproducible absent effective safeguards. The package also extends SME simplifications to a new "small mid-cap" category of firms under 750 employees with turnover up to EUR 150 million, opens an EU-level regulatory sandbox, softens the AI-literacy duty, narrows the definition of a "safety component" to systems intended to prevent or mitigate risks to health and safety, extends the GDPR legal basis for processing special-category data to detect bias, and gives the AI Office exclusive supervisory competence over systems built on a provider's own general-purpose model and over systems inside very large platforms and search engines, with expanded inspection powers and the right to recover the costs of established non-conformities. What did not move is the Act's core transparency regime: it still bites on 2 August 2026 and applies to in-scope systems whenever they were placed on the market, though providers of systems already on the market before that date that generate synthetic audio, image, video or text have until 2 December 2026 to meet the Article 50(2) marking obligation.

Read

European Commissioneur-lex.europa.eu90% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.European Commissiondigital-strategy.ec.europa.eu90% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.Stephenson Harwoodstephensonharwood.com65% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.Orrick, Herrington & Sutcliffeorrick.com78% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.Tech Policy Presstechpolicy.press78% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.European Commissiondigital-strategy.ec.europa.eu90% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.

Earlier

15

The EU AI Act enters into force

The European Union's Artificial Intelligence Act entered into force — the first comprehensive, horizontal legal framework for AI anywhere, built on a risk-based approach (minimal, limited/transparency, high and unacceptable risk). Proposed by the Commission in April 2021 and agreed by Parliament and Council in December 2023, its obligations apply on a staggered timeline: prohibited practices first, then general-purpose-AI and governance rules, with high-risk-system requirements last.

Read

European Commissioncommission.europa.eu90% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.EU Artificial Intelligence Act (artificialintelligenceact.eu)artificialintelligenceact.eu70% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.Jones Dayjonesday.com68% credibility · not yet testedAn opening estimate from its institutional history — none of its claims checked yet.
Covered since Jan 2023Read it from the start →