Key Takeaways
- →From 2 December 2026 the EU bans AI-generated child sexual abuse material and non-consensual intimate imagery, and generators already on the market must mark their output.
- →Colorado's Attorney General takes comments on draft rules for its two new AI laws until 26 October 2026; both laws start on 1 January 2027.
- →From 10 December 2026 Australian privacy policies must disclose automated decisions that could significantly affect people.
- →New York's RAISE Act reaches frontier developers with more than USD 500 million in revenue from 1 January 2027.
Regulation Note, October 2026. Every date below was checked against its primary text on 5 October 2026 and matches its row in the Regulation Tracker.
The date that matters most this quarter is 2 December. That day the EU starts applying two bans and a deadline that the Digital Omnibus wrote into the AI Act. The bans cover two kinds of AI-generated imagery. The deadline is for systems already on sale. Three more dates sit close behind it: a Colorado comment window that closes this month, a new Australian privacy duty in December, and New York's frontier-model law on New Year's Day.
What does the EU ban from 2 December?
The Digital Omnibus, Regulation (EU) 2026/1744, added two prohibitions to Article 5 of the AI Act: AI-generated child sexual abuse material and non-consensual intimate imagery. Both apply from 2 December 2026. Breaking a prohibition can cost up to EUR 35 million or 7 percent of worldwide annual turnover, whichever is higher.
The same day is the deadline for older generators. Article 50(2) requires providers of systems that generate synthetic audio, images, video or text to mark the output "in a machine-readable format and detectable as artificially generated or manipulated". New systems have had to do this since 2 August 2026. Systems placed on the market before then have until 2 December 2026, under the new Article 111(4). The EU AI Act guide sets out the rest of the Act's timetable.
Who it touches: anyone offering a generative AI system in the EU. By when: 2 December 2026.
What can Colorado deployers still shape before 26 October?
Colorado's Attorney General filed draft rules on 11 August 2026 for two laws that start on 1 January 2027. SB 26-189 replaces the state's 2024 AI Act with duties on automated decision-making technology. HB 26-1263 covers public chatbots. Formal written comments are open until 26 October 2026, and longer if the rulemaking hearing runs past that date.
SB 26-189 applies to consequential decisions made on or after 1 January 2027 in which the technology materially influences the outcome. A consumer who gets an adverse outcome can ask for a way to correct inaccurate personal data and for meaningful human review and reconsideration. Only the Attorney General enforces it, and until 1 January 2030 the office must first give notice and 60 days to cure where a cure is possible. HB 26-1263 requires operators of public conversational AI services to say the service is AI, estimate users' ages, protect known minors, run a protocol for prompts about suicide or self-harm, and report on that protocol to the Attorney General each year.
Who it touches: developers and deployers of automated decision tools used in Colorado, and chatbot operators. By when: comments by 26 October 2026, duties from 1 January 2027.
What must Australian privacy policies say from 10 December?
From 10 December 2026, an organisation covered by the Privacy Act has a new disclosure duty when it has a computer program make a decision, or do something substantially and directly related to making it. If that decision could reasonably be expected to significantly affect someone's rights or interests, its privacy policy must say so. The duty, APP 1.7, comes from the Privacy and Other Legislation Amendment Act 2024 and covers decisions made after it commences. A breach is a civil penalty provision with a maximum of 200 penalty units, and the regulator can issue infringement notices.
Who it touches: businesses and agencies covered by the Privacy Act that automate decisions weighty enough to affect people's rights or interests. By when: 10 December 2026.
Who does New York's RAISE Act reach on 1 January?
The RAISE Act starts on 1 January 2027, after a chapter amendment signed on 27 March 2026 set that date. It applies to large frontier developers, meaning those whose revenue with affiliates exceeded USD 500 million in the previous year. They must write, follow and publish a frontier AI framework that explains how they assess and mitigate catastrophic risk, report critical safety incidents, and send a state office regular summaries of catastrophic-risk assessments from internal use. The Attorney General can seek up to USD 1 million for a first violation and USD 3 million for each later one.
Who it touches: the largest frontier model developers. By when: 1 January 2027.
The Regulation Tracker carries every row behind this Note, each linked to its law.
Sources and corrections
- Regulation (EU) 2026/1744 (Article 5 points (ba) and (bb), Article 111(4), Article 113) and Regulation (EU) 2024/1689 (Articles 50(2) and 99(3)), Official Journal text.
- Colorado Attorney General, ADMT and chatbot rulemaking; Colorado General Assembly, SB 26-189 (Session Laws 2026, Ch. 131) and HB 26-1263.
- Federal Register of Legislation, Privacy and Other Legislation Amendment Act 2024 (No. 128), s 2(1) item 7 and Schedule 1 Part 15.
- New York State Senate, S8828 (Chapter 96 of 2026), General Business Law Article 44-B.
All sources read on 5 October 2026. Corrections: [email protected].
Get The Brief
Original thinking on AI strategy and governance. Every other Tuesday.
Senior AI strategist helping leaders make AI real across four continents. Forbes Technology Council member, IEEE Senior Member.
Ajay's views, from 15 years in the field. Not legal or compliance advice. See full disclaimers →
Published by AI Exponent LLC