AI Regulation Tracker
Every US state AI law, federal action, and EU AI Act milestone we track — updated daily from LegiScan, the Federal Register, the FTC, and EUR-Lex. Members see per-regulation compliance notes and the full deadline calendar, free.
| Regulation | Jurisdiction | Status | Impact | Effective | Source |
|---|---|---|---|---|---|
Illinois AI Safety Act Signed July 6, 2026, this frontier-model law targets developers with over $500M revenue training models above defined compute thresholds. It requires public transparency frameworks, pre-deployment reports, 72-hour safety-incident reporting, quarterly catastrophic-risk assessments to the AG, and — a first in the US — annual independent third-party safety audits, with penalties up to $3M per violation. 🔒 “What to do” compliance notes — members only frontier-modelstransparency | IL (state) | Enacted | Watch | 2027-01-01 | View |
EU AI Act Digital Omnibus The EU's simplification package amending the AI Act: it defers high-risk obligations from August 2, 2026 to December 2, 2027 for stand-alone (Annex III) systems and August 2, 2028 for product-embedded (Annex I) systems, extends SME simplifications to small mid-caps, and adds a new prohibition on AI generating CSAM and non-consensual intimate imagery. Parliament approved June 16, 2026 and the Council gave final approval June 29, 2026; publication in the Official Journal is imminent. 🔒 “What to do” compliance notes — members only generaltransparency | European Union | Passed legislature | Watch | — | View |
EU AI Act The world's first comprehensive AI law, applying to any company placing AI systems on the EU market or whose AI outputs are used in the EU — including US startups with EU users. It bans certain practices (social scoring, manipulative AI), imposes heavy obligations on 'high-risk' systems (hiring, credit, biometrics), transparency duties on chatbots and synthetic content, and a dedicated regime for general-purpose AI models. Penalties reach 7% of global turnover. 🔒 “What to do” compliance notes — members only generalfrontier-modelstransparencychatbotsdeepfakesbiometricsemployment | European Union | In effect | Action required | 2024-08-01 | View |
Upcoming deadlines
Online platforms with 2M+ monthly users must detect and surface provenance metadata in content distributed on their services.
CCPA-covered businesses using automated decisionmaking technology for significant decisions must have pre-use notices, opt-out mechanisms, and access-request handling in place; CPPA enforcement expected after this date.
Colorado's revised AI law takes effect: deployers of covered automated decision-making technology must provide pre-use notices, 30-day adverse-decision notices, and honor data access/correction and human-review requests.
Large frontier AI developers must publish safety and security protocols and report safety incidents to New York within 72 hours, as finalized by the March 2026 chapter amendment.
Latest developments
DHS is blocking all DeepSeek AI products and services from federal civilian agency IT systems and procurement; AI governance leaders should monitor this as a potential signal of heightened scrutiny on foreign AI vendors and plan accordingly for similar restrictions that could affect enterprise AI sourcing.
USPS is creating a centralized call center database that will use agent analytics to improve customer service; AI compliance owners should monitor this as it involves automated analytics on personal data and may implicate bias, transparency, and data minimization requirements under emerging AI regulations.
NIH is establishing a Chief AI Officer position within the National Institutes of Health, signaling increased federal focus on AI governance in research institutions. AI compliance leaders should monitor this for potential downstream guidance on AI use in federally-funded research and emerging standards for AI oversight in government.
Don’t check this page — we’ll tell you.
Free weekly digest of what changed, every Monday morning.