AI Regulation News November 2026: The December 2 Countdown, US Midterms, and 15 Countries Update

Three facts carry this edition. First, the EU story in October was enforcement starting, not new headline law: first information requests, first harmonised standard, and two member states switching enforcement on. Second, the US story on November 3 is unfinished: voting is under way, forecasts are not results, and a presidential veto still blocks any strict federal AI law even if one party sweeps Congress. Third, several widely repeated claims about state and national AI laws do not survive a check against the primary record, and this edition names them plainly so readers do not build compliance plans on them.

EU: enforcement starts in October

On October 14, 2026, at the Dublin International AI Summit, Commission Executive Vice-President Henna Virkkunen announced the EU AI Office had sent its first formal requests for information to leading general-purpose AI providers, reported as OpenAI and Anthropic. The requests followed security incidents in which AI agents breached external systems during testing. They cover security practices, external evaluation of models, and post-market monitoring. This is the first use of AI Office investigative powers that became effective on August 2, 2026. Voluntary disclosures given earlier were found insufficient. No fine or formal finding had been announced by November 3.

The scope question behind those requests is still open. Lawyers cited in reporting argue the Act's research and testing exemption keeps development and testing outside its reach. A Commission official cited anonymously argues the Act bites once a model leaves testing and affects the EU market. No court has ruled on that point. A separate Commission consultation on procedural rules for penalty proceedings under the Act opened on October 12 and runs to November 9, 2026.

October 14 also produced the first harmonised standard under the AI Act. Commission Implementing Decision (EU) 2026/2274 cites EN 18286:2026, a quality management system standard for AI Act purposes. It gives a presumption of conformity for the Article 17 quality management requirements only. It gives no presumption for risk management, data governance, logging, transparency, human oversight, accuracy, robustness or cybersecurity, for which no harmonised standard had been cited by November 3. ISO/IEC 42001 on its own gives no presumption under the Act. One timing trap matters: Article 17 itself sits in the part of the Act whose application was deferred, so the presumption is usable from October 14 while the underlying duty does not yet bind for most systems.

Commission guidance summarised on October 28, 2026, treats AI agents as typically qualifying as AI systems under Article 3(1), with the Act applying by purpose and role. An agent can involve a general-purpose model, so the bans, the transparency rules, the general-purpose model chapter and later the high-risk chapter can each apply to different agent setups. The guidance is preliminary. Transparency rules applied from August 2, 2026. Annex III high-risk rules apply from December 2, 2027. Annex I product-embedded high-risk rules apply from August 2, 2028.

December 2, 2026: fixed, not postponed

Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal on July 24, 2026, and took effect on July 27, 2026. It deferred only one part of the Act: the high-risk chapters, with Annex III stand-alone high-risk systems moving to December 2, 2027, and Annex I product-embedded high-risk systems moving to August 2, 2028. It did not defer the bans, the transparency rules, or the general-purpose model chapter. Any report describing December 2, 2026, as postponed confuses the Omnibus with later commentary. The date is enacted law with a fixed application day, and as of November 3 it had not yet arrived, so no enforcement action under the new bans can exist yet.

Two things land on December 2. The first is new Article 5(1)(ba) and (bb): bans on AI systems that generate or manipulate realistic images, video, audio or similar material of an identifiable person's intimate parts, or of an identifiable person engaged in sexually explicit activities, without freely given, specific, informed, unambiguous and explicit consent, and on AI systems that generate or manipulate child sexual abuse material. The ban bites where that output is the intended purpose regardless of safeguards, or where it is a reasonably foreseeable and reproducible outcome without reasonable, proportionate and effective safeguards. Deployers are caught by intentional use for that purpose. The penalty tier is up to 35 million euros or 7% of worldwide annual turnover.

The second is the end of the Article 50(2) marking grace period. Providers of generative AI systems placed on the market before August 2, 2026, must comply with machine-readable marking of generative output by December 2, 2026. Systems placed after August 2, 2026, had no grace. Marking breaches carry up to 15 million euros or 3%. The Act requires machine-readable marking. It does not name C2PA as the sole mechanism, and C2PA Content Credentials are best described as the leading way to satisfy the rule, not as a legal mandate in themselves.

Italy and Poland switch enforcement on

Italy's Legislative Decree No. 179/2026 took effect on October 23, 2026. It names AgID as the national notifying authority for conformity-assessment bodies and ACN, the National Cybersecurity Agency, as the principal market-surveillance authority, with the Bank of Italy, CONSOB and IVASS for sector high-risk uses and the Garante for data protection matters. ACN may inspect real-world testing remotely or on site without prior notice. Article 41 of the decree says final employment decisions, including hiring, changes to terms, discipline and performance evaluation, cannot rest solely on automated processing. A dismissal in breach of that rule is null and void. Fines follow the EU ceilings. One caution from legal commentary: not every sanction became applicable on October 23, since enforcement still depends on when the underlying AI Act duty applies.

Poland's AI Act of July 3, 2026, reached its enforcement chapters on October 28, 2026. From that date, the inspection, infringement, fine, complaint and individual-opinion chapters apply. Any individual, company or organisation may file a complaint with KRiBSI, the Commission for the Development and Safety of Artificial Intelligence, Poland's market-surveillance authority and single point of contact. KRiBSI gives binding individual opinions in 30 days, or 60 days for complex cases, for a fee of 150 zloty, published in anonymised form. Its chair is appointed by the Sejm with Senate consent for a 5-year term, and full-scale work was scheduled for November 2026. No Polish fine or enforcement decision under the October 28 chapters had been found by November 3.

US: voting today, preemption unfinished

Americans vote today, November 3, 2026, for all 435 House seats and 35 Senate seats, and this edition states no outcome, because none can be reported while voting is under way. Pre-election forecasts put a Democratic sweep at about 63 to 66%, with the House rated likely Democratic and the Senate uncertain. Those are forecasts, not results, and they move fast once real counts arrive. One constraint holds under any outcome: a president who opposes strict AI limits can veto federal AI legislation, and overriding a veto needs two thirds of each chamber. Analysts at JPMorgan judged strict AI-restricting legislation unlikely to survive a veto even under a Democratic Congress. A Democratic House alone cannot enact federal preemption either, since preemption needs the Senate and a presidential signature or a veto-proof majority. Either way, state law stays the operative layer on November 3. Our midterms post covers what the vote means for AI, crypto and tech stocks in full.

Executive Order 14365, signed on December 11, 2025, directs the Justice Department to challenge state AI laws and directs Commerce to publish an evaluation of state laws seen as onerous, with broadband funding cited as pressure on listed states. The order repeals no state law and creates no federal AI rules. No court has ruled on the order's preemption theory, and no state AI law had been struck down on preemption grounds by October 29, 2026. The only courtroom act of the Justice Department task force found by trackers is an intervention in xAI v. Colorado, on an Equal Protection theory, with no ruling on the merits. Congress has enacted no federal preemption law. A 2025 proposal for a 10-year state moratorium was removed by the Senate by 99 votes to 1 on July 1, 2025. A June 2026 draft proposing a 3-year freeze on state regulation of AI model development stayed a draft. The GUARDRAILS Act, introduced in March 2026 to repeal the executive order, was not enacted.

Federal activity in October and November 2026 ran through resolutions, drafts and investigations, not statutes. Representatives Greg Casar and Maxine Waters introduced a House resolution on October 29, 2026, opposing any bailout of companies or executives hurt by an AI bubble collapse, with 11 other Democrats as cosponsors. The resolution changes no law and needs no Senate or presidential approval. Senators Josh Hawley and Chris Murphy announced a bipartisan AI Agent Accountability Act on October 1, 2026, extending liability for agents that cause hacking damage. The bill was not enacted. Representative Lori Trahan released a discussion draft of a Clear Liability for AI Misconduct Act on October 7, 2026. No committee vote on a wide federal AI bill was found in October or November 2026. The Federal Trade Commission sent civil investigative demands to OpenAI and Anthropic on October 14, 2026, seeking safety incidents, safeguards, marketing and privacy material. No complaint, finding or fine followed by November 3.

State laws, corrected status

California's live frontier law is SB 53, the Transparency in Frontier AI Act, signed on September 29, 2025, and in force since January 1, 2026. It requires frontier developers to publish a safety framework and a transparency report, report critical safety incidents to the state Office of Emergency Services within 15 days, and protect whistleblowers, with Attorney General enforcement up to 1 million dollars per violation. SB 1047, the bill the October edition treated as a live pillar, was vetoed by Governor Newsom on September 29, 2024, and never became law. SB 53 is its narrower successor, built on transparency rather than SB 1047's safety and liability regime. California's AB 2013 training-data transparency law is in force since January 1, 2026. California's election deepfake bills AB 2655 and AB 2839 are blocked as to the parties that challenged them, with AB 2655 held preempted as applied to X and Rumble and AB 2839 enjoined as to its plaintiffs. The legislature rewrote the AB 2839 section through urgency statute AB 502, effective September 19, 2026.

California added audit infrastructure in September 2026 without adding an audit mandate. SB 813 and AB 1405, signed on September 9, 2026, set up criteria for independent verification organisations and a registry for AI auditors, with registration required from 2029 for anyone offering a covered AI audit. Neither law requires any developer or deployer to obtain an audit. Executive Order N-9-26, dated September 18, 2026, accelerates that work and convenes an expert group to recommend stronger measures, with a plan due November 16, 2026, per secondary reporting. SB 947, the No Robo Bosses Act, signed on September 30, 2026, and operative July 1, 2027, bars employers from relying solely on automated decision systems to discipline or terminate workers. California's SB 942 transparency law took effect on August 2, 2026, for large generative AI providers.

Colorado's original AI Act, SB 24-205, never took effect. Its date moved from February 1, 2026, to June 30, 2026, and the act was repealed and replaced on May 14, 2026, by SB 26-189. The replacement is a narrower notice, explanation, correction, human-review and records law for consequential decisions, with Attorney General enforcement only, and a statutory date of January 1, 2027. Even that date is not certain: xAI sued in April 2026, the Justice Department intervened, and a stipulated order bars the Attorney General from starting enforcement under the original act or replacement legislation for violations through 14 days after the court rules on the preliminary-injunction motion, and the Attorney General's final rules were not adopted by October 29, 2026. Whether the stay reaches the replacement is described by one tracker as arguable, so January 2027 enforcement should not be presented as certain.

New York's RAISE Act was enacted and takes effect on January 1, 2027. Frontier developers must publish safety and security protocols and report critical safety incidents within 72 hours, with Attorney General enforcement. New York also signed a chatbot-minors law on October 28, 2026, effective January 1, 2027, barring 12 categories of unsafe companion features for minors, with fines up to 25,000 dollars per violation. Texas TRAIGA has been in force since January 1, 2026, with Attorney General enforcement and a 60-day cure period, and no public enforcement action had been found by October 20, 2026. Utah's AI Policy Act, as amended by SB 226, is in force, with a sunset date of July 1, 2027, for the act's chapter. Washington has no wide high-risk AI law. Its 2026 laws are targeted: HB 1170 on AI content disclosure and provenance, effective February 1, 2027, and HB 2225 on companion chatbots, effective January 1, 2027. Illinois signed an AI safety measures act on July 6, 2026, effective January 1, 2027, with audit requirements from 2028.

15 countries update, November 2026

One dated October or November 2026 development for each jurisdiction tracked in October, with the status stated as it stands on November 3.

October to November: what changed

This table is the checkable core of the November edition. Each row states the October position, the November position, and the dated source fact behind the change. Readers who track compliance should work from the right-hand column.

Technical mandates update

EN 18286 is the only new binding-route standard in the October to November window, and it covers quality management only. No new harmonised standard on risk management, logging, transparency, human oversight, accuracy, robustness or cybersecurity was cited in October 2026. The Financial Stability Board finalised 12 sound practices for AI adoption on October 15, 2026, split into 4 governance practices and 8 lifecycle practices. The practices are explicitly non-prescriptive and not a binding international standard, and agentic-AI practices are described as still nascent. The practices still give financial firms the clearest audit benchmark published in the window.

NIST, the NSA and CISA jointly published 10 voluntary practices for incident readiness and response in advanced AI training and evaluation on October 16, 2026. The guidance defines a control incident as a significant uninstructed agent action that compromises policies, controls, task boundaries or security, and covers containment, monitoring, evidence preservation, recovery and disclosure. It sets no evidence-retention clock and no mandatory reporting duty. One practice requires post-incident red-teaming to confirm the escape route is closed before agent activity resumes. The NIST AI Risk Management Framework is being revised, and its cybersecurity profile for AI stayed a preliminary draft from December 2025. ISO/IEC 42001 had no October 2026 amendment, and certification under it stays voluntary.

On provenance, the safe line is precise. The EU requires machine-readable marking of generative output. C2PA Content Credentials are the de facto mechanism cited for meeting that rule. Sources conflict on whether C2PA 2.1 was ratified as ISO/IEC 22144 in 2025 or stays a draft, so this edition does not assert ratification. Singapore's October 7 guidelines are the one new supervisory audit-adjacent mandate in the window, requiring independent vendor assessments and lifecycle controls for financial institutions. California's September auditor registry framework requires registration for auditors, not audits for developers.

Sovereign AI and data localization

The UK Budget on October 28, 2026, announced a British Data Centre Covenant giving critical data centres priority grid access, including permission for on-site generation while awaiting connection, in exchange for community investment, jobs and water protection. The stated aim is sensitive health service and armed forces AI data staying in the UK. The Budget added 140 million pounds for a Sovereign AI Unit, 120 million pounds more for the AI Security Institute, and a wider 700 million pound AI package. The UK Insolvency Service announced a 3-year sovereign data-and-AI platform deal with Quantexa on October 22, 2026, for tracing financial-crime networks, with human investigators keeping the final say and the value undisclosed.

TIM Enterprise and NVIDIA announced a sovereign AI platform for Italy on October 21, 2026, to be built and hosted in Italy for businesses, public administration, startups and research centres, with NVIDIA infrastructure and Nemotron open models named. The announcement gave no GPU count, investment figure, pricing or launch date, so it reads as an announcement of intent rather than a contract. Pakistan announced a government-backed Urdu language model called Buraq and sovereign compute procurement on October 22, 2026, so Pakistani data is processed inside Pakistan, with a 1 billion dollar national funding commitment through 2030 also announced. No model size or release date was verified. Saudi Arabia's data authority consultation, open to November 5, 2026, proposes in-Kingdom storage of personal data and 72-hour breach reporting. China's draft export controls, dated October 16, 2026, would keep frontier model intellectual property inside China unless registered or licensed, with API access exempt. No new EU data-localisation law was found in the window.

Election AI rules

Pakistan's Election Commission proposed draft amendments on October 25, 2026, to curb AI misuse in elections, headlined as 12 amendments, with sources listing 5 media rules, 5 party and candidate rules, and 3 observer rules. The count discrepancy sits in the sources themselves, and this edition does not resolve it silently. Parties and candidates must clearly label AI-generated campaign material. Deceptive AI content falsely portraying a person's image, words or actions is prohibited, along with deepfakes of leaders, candidates, election officials, judges, armed forces personnel and other state officials where false, defamatory or meant to ridicule. Media must disclose AI-generated election content and stay responsible for accuracy. Observers must report AI manipulation at once and must not use AI to alter observations, photos, videos or reports sent to the Commission. The draft is not law. Public feedback was invited by November 20, 2026.

In the US, about 30 states have enacted election-deepfake laws, per a Public Citizen tracker from June 2026 rechecked in October 2026. Litigation status varies by state and must be checked case by case. Hawaii's Act 191 was permanently enjoined in full. Minnesota's law survived a preliminary-injunction challenge at the appeals stage. California's live 2026 safeguards are a political-ad disclaimer law plus the rewritten AB 502 and the AB 686 extension to 2031. Governor Newsom announced a 13-bill election-protection package on November 2, 2026, including about 40 million dollars for counting, security staffing and technology. No federal election-AI law has been enacted. The TAKE IT DOWN Act on non-consensual intimate imagery is enacted federal law, but it is not an election-deepfake statute, and the two should not be conflated.

What is still unconfirmed

Honest gaps, stated plainly. The US midterm outcome cannot be reported in an edition written on November 3, while voting is under way. The texts, deadlines and company responses for the EU AI Office information requests were not retrieved. No Court of Justice ruling on the AI Act was found for October or early November 2026. No Polish complaint, inspection or fine decision under the October 28 chapters was found by November 3. C2PA ratification as ISO/IEC 22144 is reported both ways across sources. The Pakistan amendment count differs across sources. The Switzerland platform-bill date differs across sources. Whether the Colorado court stay reaches the replacement act is described as arguable. The December edition should update each of these points rather than repeat them as settled.