Moderate
Guidance
Announced
United States (federal) · Sep 22, 2026
WBUR reports driver’s license data appearing on dark web, raising AI‑enabled fraud risks
WBUR discussed a breach where images of driver’s licenses have been posted on the dark web. The episode highlighted risks of new account fraud, especially when combined with AI tools that can synthesize voice, images, or video. It also…
Moderate
Guidance
Published
European Union · Sep 22, 2026 · effective Sep 22, 2026
ENISA releases 2026 Threat Landscape report highlighting AI-enabled cyber threats and supply‑chain risks
ENISA's 2026 Threat Landscape report analyses incidents from 1 January to 31 December 2025, noting a rise in ransomware, AI‑driven malicious activity, and supply‑chain attacks. The report finds public administration to be the most targeted…
ENISA · NIS2 Directive
Moderate
Proposed regulation
Proposed
European Union · Sep 21, 2026
EU Commission proposes KIDS Act to impose age‑based restrictions and safety‑by‑design for children online
On September 17, 2026 the European Commission published a proposal for a new EU KIDS Act that would ban users under 15 from creating accounts on certain social networking and video‑sharing services, with limited exceptions. The draft…
European Commission · Digital Services Act
Moderate
Proposed regulation
Proposed
European Union · Sep 21, 2026
EU proposes Article 88c/88bis to allow unrestricted AI use of personal data
A leaked Irish Presidency document proposes that personal data used "in the context of AI" be automatically lawful, removing consent requirements. The draft Article 88c (now 88bis) would permit AI companies to process any personal data for…
European Commission · General Data Protection Regulation
Moderate
Proposed regulation
Proposed
United States (federal) · Sep 18, 2026
EFF urges lawmakers to base AI cybersecurity rules on established best practices
The EFF recommends that any new AI cybersecurity legislation focus on proven security measures such as sandboxing, monitoring, and logging to mitigate risks demonstrated by recent AI lab incidents. It calls for minimum safety requirements…
Moderate
Guidance
Announced
New York · Sep 17, 2026 · effective Jan 1, 2027
NY Attorney General urges workers to file whistleblower complaints on unsafe AI development
New York Attorney General Letitia James issued an alert encouraging employees with knowledge of unsafe or illegal AI development to submit confidential whistleblower complaints. The alert references the Responsible AI Safety and Education…
New York Attorney General's Office · New York SHIELD Act
Moderate
FRAMEWORK UPDATE
Published
European Union · Sep 17, 2026 · effective Aug 2, 2026
EU AI Board discusses AI Act implementation and publishes Action Plan on cybersecurity and AI
On 17 September 2026 the EU AI Board met under the Irish Presidency to review priorities for EU AI policy and AI Act enforcement. The meeting included an update on the Commission’s Action Plan on cybersecurity and AI and on transparency…
European Commission · EU AI Act
Moderate
Proposed bill
Passed
California · Sep 15, 2026
California legislature passes three AI employment bills pending Governor's signature
The California State Legislature approved SB 947, SB 951, and AB 1883, which impose restrictions on automated decision systems, require technology displacement notices under Cal/WARN, and limit workplace surveillance tools. Each bill would…
California Labor Commissioner · SB 947 (No Robo Bosses Act)
Moderate
Fine
Announced
Netherlands · Sep 10, 2026
Dutch DPA fines Uber €824,990,000 for automated decisions affecting drivers
On August 21, 2026, the Dutch Data Protection Authority announced it had fined Uber €824,990,000 for breaching the EU GDPR rules on solely automated decision‑making. The fine targets Uber's use of automated systems that affect driver…
Dutch Data Protection Authority · General Data Protection Regulation
Moderate
Guidance
Published
France · Sep 10, 2026
CNIL releases Volume 2 of “L’Agence Privacy” to educate adolescents on cybercrime and data privacy
On 10 September 2026 the French data‑protection authority CNIL published the second volume of its educational comic series “L’Agence Privacy”. The free online and paper resource targets teenagers and parents, covering risks such as…
CNIL
Moderate
Lawsuit filed
Filed
United States (federal) · Sep 8, 2026
EFF releases 1,000 pages of CMS records on AI-driven Medicare WISeR prior‑authorization program
EFF obtained about 1,000 pages of CMS documents through its FOIA lawsuit filed in March, revealing delays, denials, and financial incentives in the WISeR AI model. The records show requests sometimes waited up to 83 days and vendors denied…
Centers for Medicare & Medicaid Services (CMS)
Moderate
Guidance
Announced
United States (federal) · Sep 3, 2026
SEC Investor Advisory Committee to Host Sept. 10 Meeting on AI Technologies and NMS Rules
The U.S. Securities and Exchange Commission’s Investor Advisory Committee will hold a public meeting on Sept. 10, 2026 to discuss artificial intelligence technologies in the public markets and the SEC’s Regulation National Market System…
Securities and Exchange Commission · Regulation National Market System
Moderate
Proposed regulation
Announced
France · Sep 3, 2026
CNIL agenda includes review of draft decrees on automated personal data processing and authorizations for health data studies
The CNIL plenary session agenda for 3 September 2026 lists examinations of draft deliberations on a decree modifying decree n° 2023‑935 for the SISPoPP system, a draft decree on the API‑PNR France system, and authorizations for RCTs, IQVIA…
Commission nationale de l'informatique et des libertés (CNIL) · General Data Protection Regulation
Moderate
Data protection authority action
Announced
Spain · Sep 2, 2026
AEPD to host data‑protection session at XX Jornadas STIC on 24 Nov 2026
The Spanish Data Protection Agency (AEPD) will hold a dedicated data‑protection space on 24 November 2026 during the XX Jornadas STIC conference in Madrid. The event, organized by the Centro Criptológico Nacional, the Centro Nacional de…
Agencia Española de Protección de Datos
Moderate
Guidance
Published
SG · Aug 25, 2026
PDPC publishes Advisory Guidelines on Personal Data in Generative AI at Singapore Data Festival
On July 20, 2026, Singapore’s Personal Data Protection Commission released its finalized Advisory Guidelines on the Use of Personal Data in Generative AI. The guidance clarifies the Publicly Available Exception for web‑scraping and…
Personal Data Protection Commission (PDPC) · EU AI Act
Moderate
New law
Signed
Colorado · Aug 17, 2026 · effective Jan 1, 2027
Colorado governor signs SB 26-189, revising AI Act to regulate ADMT in employment
On May 14, 2026, Colorado Governor signed SB 26-189, repealing and replacing the 2024 Artificial Intelligence Act. The new law, effective January 1, 2027, targets automated decision‑making technology (ADMT) that materially influences…
DE DOJ · Delaware Personal Data Privacy Act
Moderate
Proposed bill
Announced
European Union · Aug 6, 2026
EU proposes Cloud and AI Development Act (CADA) to boost AI and cloud sovereignty
The European Commission released the Cloud and AI Development Act (CADA) proposal in June 2026, aiming to enhance EU competitiveness in AI and cloud technologies. The draft sets up Cloud and AI Leadership Initiatives, national AI…
European Commission · General Data Protection Regulation
Moderate
Guidance
Announced
United States (federal) · Aug 5, 2026
Future of Privacy Forum releases updated AI risk assessment framework and best practices for hiring
Future of Privacy Forum and leading HR software firms released Updated Best Practices for AI and Workplace Assessment Technologies, addressing generative and agentic AI in employment. The guidance outlines a risk assessment framework and…
EU AI Office · EU AI Act
Moderate
Proposed bill
Introduced
United States (federal) · Aug 5, 2026
Senator Mark Kelly introduces Senior Chatbot Protection Act
Future of Privacy Forum notes the bipartisan Senior Chatbot Protection Act was introduced to establish baseline consumer protections and transparency for AI chatbots used by older adults. The statement welcomes the effort to create clear…
Delaware Personal Data Privacy Act
Moderate
Proposed bill
In committee
United States (federal) · Aug 5, 2026
Senate Commerce Committee to vote on four privacy‑invasive bills (KOSA, SCREEN Act, Youth AI Privacy Act, CHATBOT Act)
The Senate Commerce Committee will vote this week on four bills: KOSA, the SCREEN Act, the Youth AI Privacy Act, and the CHATBOT Act. The bills are presented as child‑protection measures but are criticized for creating new privacy and…
U.S. Senate Commerce Committee · KOSA
