AI Regulation & Policy — 2026年9月28日 週次レポート
AI Regulation & Policyのニュース＆アップデート — すべての記述に一次ソースのリンク付き。
重要な発見
エグゼクティブサマリー（5件）
- •The UN General Assembly high-level week crystallized a geopolitical fracture that will define AI governance for years: the US is actively resisting multilateral AI control frameworks while simultaneously pursuing bilateral dialogue with China on AI security incidents. The EU, France, and multilateral bodies are pushing in the opposite direction. The practical consequence is that binding international AI governance instruments are increasingly unlikely in the near term, accelerating the divergenc…
- •The EU's regulatory perimeter around AI continued to expand and sharpen this period. The KIDS Act's enforcement architecture is now clearer — AI chatbots fall under the AI Act, not the DSA, and enforcement timelines are dramatically compressed. The CRA's first reporting obligations are live. The Dutch DPA's €824.99M Uber fine for automated decision-making without human oversight sets a financial precedent that makes the AI Act's human oversight requirements for high-risk systems a balance-sheet …
- •In the US, the regulatory picture remains bifurcated between federal deregulation and state acceleration. California's September 30 deadline for AI employment bills is the most immediate trigger. Delaware's HB 380 — uniquely making third-party data recipients directly subject to state privacy law — signals that state legislatures are closing loopholes that federal law has not addressed. The cumulative effect is a multi-state compliance burden that is growing faster than federal preemption discus…
- •Enterprise AI governance is now a quantified market failure: survey data shows adoption outpacing controls by nearly two to one, with only 5% of organizations reporting clear lifecycle accountability for AI agents. The 98% planning budget increases for AI governance technology signals that this gap is recognized and being addressed — but the 40% deploying AI while controls are still being developed indicates the gap will persist for the foreseeable future, creating ongoing regulatory and operati…
- •The open-weight model competition between the US and China is emerging as a distinct AI governance and national security dimension. With most capable open-weight models currently Chinese and the capability gap narrowing to four to seven months, the question of who controls the global open-weight ecosystem has moved from a technical debate to a geopolitical one — with direct implications for AI safety standards, export controls, and the bilateral AI dialogue framework agreed at the Trump-Xi summi…
今回の要点（13件）
- 1.UN Secretary-General Guterres warned at the General Assembly that power is transferring from governments to private corporations through AI, while President Trump rejected any multilateral AI control scheme and directed agencies to rename AI as 'Super Intelligence' — the most significant international AI governance fracture of the reporting period [3a].
- 2.The Trump-Xi summit produced a bilateral AI dialogue channel and agreement on communications for serious AI security incidents [3a].
- 3.The UN's scientific panel on AI called for safeguards to be adapted as current firewalls are 'unravelling,' with OpenAI's Sam Altman and Anthropic's Dario Amodei briefing the UN Security Council on AI risks [7].
- 4.Detailed analysis confirmed the EU KIDS Act places AI companions and general conversational chatbots under the AI Act's supervisory system, and introduces a 30-day/90-day expedited enforcement procedure — significantly faster than the nearly two years it took to obtain preliminary findings in the TikTok DSA case [3b].
- 5.EU Cyber Resilience Act incident reporting obligations became active on September 11, 2026, requiring manufacturers to report actively exploited vulnerabilities within 24 hours and severe incidents within 72 hours through ENISA's Single Reporting Platform [5a].
- 6.The Dutch DPA fined Uber €824,990,000 for automated driver account deactivation without meaningful human involvement — the largest GDPR fine specifically targeting automated decision-making — with Privacy World Blog noting it sets a precedent for AI Act human oversight requirements [5b].
- 7.Three California AI employment bills await Governor Newsom's signature or veto by September 30, 2026, the most immediate near-term regulatory trigger in the U.S. AI governance landscape [2].
- 8.Delaware Governor signed HB 380 on September 2, 2026, expanding the Delaware Personal Data Privacy Act to lower applicability thresholds and — uniquely among state privacy laws — making third parties who acquire personal data from controllers directly subject to the Act, effective January 1, 2027 [5c].
- 9.OneTrust's 2026 AI-Ready Governance Survey of 1,200 senior decision-makers found that 74% report scaled AI adoption but only 47% have clear governance controls for AI agents, and just 5% say lifecycle accountability is clear — with 98% planning to increase AI governance technology budgets by an average of 25% [1a] (company announcement — may reflect promotional framing).
- 10.EDPB Guidelines 03/2026 on web scraping for generative AI acknowledge that personal data cannot be deleted from a trained model at the current state of the art, meaning compliance effectively reduces to a documented diligence standard rather than a demonstrated harm-reduction standard [4a].
- 11.Ropes & Gray and Sullivan & Cromwell both announced proprietary AI tools co-developed with OpenAI designed to embed firm-specific processes and precedents, signaling that law firm AI differentiation is shifting from model capability to institutional knowledge integration [9a] [9b].
- 12.Palantir hired former Labour deputy leader Tom Watson as Senior Vice President ahead of a December 2026 break clause decision on its £330m NHS contract, illustrating how AI vendors in sensitive public sector contexts are competing on political access as much as technical merit [3c].
- 13.The UK AI Security Institute estimated that leading open-weight models' cyber capabilities are only four to seven months behind those of the best closed models, with most capable open-weight models currently Chinese — framing open-weight model leadership as a US national security priority [3d].
市場動向
AI Governance Gap Widens as Adoption Outpaces Controls
A survey of 1,200 senior decision-makers across eight markets, published by OneTrust in September 2026, found that 74% of respondents reported departmental or scaled AI adoption and 87% encourage AI agent use, yet only 47% have clear governance controls in place for those agents — and just 5% say coordination and accountability across the AI lifecycle is clear in their organization [1a] (company announcement — may reflect promotional framing). Additionally, 40% say they are moving forward with A…
Legal AI Ecosystem Consolidates Around Proprietary Firm-Specific Tools
This period saw multiple major law firms announce bespoke AI tools co-developed with OpenAI: Ropes & Gray built a proprietary diligence review tool designed to replicate the firm's internal process [9a], and Sullivan & Cromwell announced an Agreement Analyzer that produces issue memoranda and tracked-changes documents [9b]. Harvey raised an additional $50M during the period [9c]. The pattern signals that the legal AI market is bifurcating: firms are embedding institutional knowledge into proprie…
Agentic AI Governance Emerges as Distinct Enterprise Risk Category
Multiple sources this period converged on agentic AI as a qualitatively new governance challenge. OneTrust's Chief Innovation Officer published a detailed framework arguing that agents with write access to enterprise systems represent a new class of insider risk — reward-seeking optimizers that can find unintended shortcuts — and that governance must be architecturally independent from the agent itself [1b]. The OECD.AI Wonk published analysis on September 24, 2026 on how practitioners are deplo…
競合動向
Law Firm AI Tool Differentiation Shifts to Institutional Knowledge Embedding
Following OpenAI's Astra for Law launch in the prior period, this week's activity shows the competitive response taking shape: firms are building proprietary tools that embed their specific processes and precedents rather than competing on model capability. Ropes & Gray's diligence tool is designed to replicate the firm's own review process [9a], and Sullivan & Cromwell's Agreement Analyzer incorporates the firm's differentiated process and set of precedents [9b]. Separately, CMS and Dentons sol…
Palantir's UK NHS Position Under Pressure — Political Influence Strategy Intensifies
Tech Policy Press reported on September 25, 2026 that Palantir's UK branch hired Tom Watson, former deputy leader of the Labour party, as Senior Vice President, ahead of a break clause in its £330m NHS Federated Data Platform contract that the UK Government must decide on by December [3c]. Two cross-party parliamentary committees have called for the NHS contract to end [3c]. This illustrates how AI and data platform vendors operating in sensitive public sector contexts are increasingly competing…
US-China AI Dialogue Opens — Open-Weight Model Competition Intensifies
The Trump-Xi summit in Washington produced an agreement on ongoing AI dialogue and a communications channel for serious AI security incidents, according to Tech Policy Press on September 27, 2026 [3a]. A perspective published September 24, 2026 argued that most capable open-weight models — including GLM 5.3, Kimi K3, DeepSeek V4.1-Flash, and Qwen3.8 — are currently Chinese, and that the UK AI Security Institute estimated leading open-weight models' cyber capabilities are only four to seven month…
制度・規制動向
UN General Assembly Becomes AI Governance Flashpoint — Geopolitical Fractures Deepen
The UN General Assembly high-level week produced sharply divergent national positions on AI governance. UN Secretary-General Guterres warned that 'we are witnessing an extraordinary transfer of power away from governments to a handful of private corporations and individuals' and that humanity must govern AI 'before it governs us' [3a]. President Trump rejected 'any attempt to construct a globalist scheme of control' for AI and directed US agencies to refer to AI as 'Super Intelligence' [3a]. Fra…
EU KIDS Act Advances Through Legislative Process — Enforcement Architecture Clarified
Following the European Commission's September 17, 2026 adoption of the EU KIDS Act proposal, this period produced detailed analysis of how the Act fits into the existing EU digital rulebook. Tech Policy Press analysis on September 24, 2026 confirmed that the Act extends safety-by-design obligations to online games, video-gaming platforms, and AI chatbots and companions — categories not covered by the DSA [3b]. AI companions and general conversational chatbots would fall under the AI Act's superv…
California AI Employment Bills Await Governor's Signature — September 30 Deadline
Global Policy Watch reported on September 26, 2026 that the California legislature passed three bills regulating AI in the employment context, now on Governor Newsom's desk with a September 30, 2026 deadline to sign or veto [2]. Separately, California Governor Newsom signed AB 1709 on September 10, 2026, restricting addictive features on online platforms for users under 16 and establishing the e-Safety Advisory Commission, with civil penalties of up to $25,000 per affected minor for negligent vi…
EU Cyber Resilience Act Reporting Obligations Now Active — Manufacturers Must Comply
As of September 11, 2026, manufacturers of products with digital elements are subject to new incident reporting obligations under the EU Cyber Resilience Act, confirmed by both Hunton Privacy Blog [5a] and Privacy World Blog [4b]. The staged reporting process requires an early warning within 24 hours of awareness, a full notification within 72 hours, and a final report within 14 days (for actively exploited vulnerabilities) or one month (for severe incidents) [5a]. These obligations apply even t…
Dutch DPA's €824.99M Uber Fine Signals Automated Decision-Making Enforcement Escalation
On August 21, 2026, the Dutch Data Protection Authority announced a fine of €824,990,000 against Uber for using software between 2018 and 2022 to automatically deactivate driver accounts based on fraud suspicion or low ratings without meaningful human involvement, in violation of GDPR Article 22 [5b]. Privacy World Blog confirmed the case arose from complaints by 171 drivers and was handled by the Dutch DPA as Uber's lead supervisory authority under the GDPR one-stop-shop mechanism [4c]. The Pri…
Delaware Privacy Law Significantly Expanded — Third Parties Now Directly Subject to Act
Delaware Governor Matt Meyer signed House Bill 380 on September 2, 2026, significantly expanding the Delaware Personal Data Privacy Act effective January 1, 2027 [5c]. The amendments lower the applicability threshold from 35,000 to 10,000 Delaware consumers, and for businesses deriving more than 20% of gross revenue from personal data sales, from 10,000 to 5,000 consumers [5c]. Notably, and unlike any other state consumer privacy law, HB 380 makes third parties who acquire personal data from con…
EDPB Web Scraping Guidelines for Generative AI — Compliance Standard Closer to Documented Diligence Than Demonstrated Harm Reduction
Privacy World Blog published detailed analysis on July 7, 2026 EDPB Guidelines 03/2026 on web scraping in the context of generative AI, noting three significant limitations the EDPB itself acknowledges: an epistemic limitation (the controller may not know what it has collected), a technical limitation (personal data cannot be deleted from a trained model at the current state of the art), and an institutional limitation (some assessments sit with other authorities and courts) [4a]. The analysis c…
ソース活動
先週からの変化
UN General Assembly AI Governance Clash — US Rejects Multilateral Control
The UN General Assembly high-level week produced an open geopolitical fracture on AI governance: the UN Secretary-General called for governing AI before it governs us, while President Trump rejected any globalist AI control scheme and directed agencies to rename AI as 'Super Intelligence' [3a]. The Trump-Xi summit produced a bilateral AI dialogue channel and agreement on communications for serious AI security incidents [3a]. The UN's scientific panel on AI called for safeguards to be adapted as …
EU KIDS Act Legislative Architecture Clarified — AI Chatbots Under AI Act Supervision
Detailed analysis this period confirmed that the EU KIDS Act, adopted September 17, 2026, places AI companions and general conversational chatbots under the AI Act's supervisory system rather than the DSA framework, and introduces a 30-day/90-day expedited enforcement procedure [3b]. Hunton Privacy Blog confirmed the proposal has been submitted to the European Parliament and Council [5d]. This updates the prior period's initial adoption announcement with enforcement architecture detail.
EU Cyber Resilience Act Reporting Obligations Now In Force
As of September 11, 2026, EU CRA incident reporting obligations are active for all manufacturers of products with digital elements, including those already on the market. The 24-hour/72-hour/14-day staged reporting process is now operational through ENISA's Single Reporting Platform [5a] [4b]. This is the CRA's first live compliance requirement, preceding the main substantive obligations effective December 11, 2027.
Dutch DPA Fines Uber €824.99M for Automated Decision-Making — Largest GDPR ADM Fine
The Dutch DPA announced a fine of €824,990,000 against Uber on August 21, 2026 for automated driver account deactivation without meaningful human involvement, violating GDPR Article 22 [5b]. Privacy World Blog analysis noted this sets a precedent for AI Act human oversight requirements in employment contexts [4c]. Uber has appealed. This is the largest GDPR fine specifically targeting automated decision-making.
California AI Employment Bills at Governor's Desk — September 30 Veto/Sign Deadline
Three California bills regulating AI in employment contexts are awaiting Governor Newsom's signature or veto by September 30, 2026 [2]. California also signed AB 1709 on September 10, 2026 restricting addictive platform features for under-16 users [5e]. The September 30 deadline is the most immediate near-term regulatory trigger in the U.S. AI governance landscape.
ウォッチリスト — 今後の締切
NIST public comment period closes on TEVV-Athlon Framework for Evaluating AI Systems
ソース: NIST AIWIPO Global Forum on IP and AI — two-day event in Geneva covering AI-related legal and policy issues across the full spectrum of IP rights
ソース: WIPO AI & IPWIPO Artificial Intelligence Infrastructure Interchange (AIII) Annual Meeting in Geneva — updates on Technical Exchange Network work on IP infrastructure and AI
ソース: WIPO AI & IP示唆・見るべき論点（9件）
- 1.The EU KIDS Act's placement of AI chatbots and companions under the AI Act's supervisory system — rather than the DSA — means that AI companion applications face the AI Act's risk classification, conformity assessment, and human oversight requirements, not merely DSA transparency obligations. Organizations developing AI companion products for European markets should begin AI Act compliance assessments now, not wait for the KIDS Act to be adopted.
- 2.The Dutch DPA's €824.99M Uber fine establishes that automated decision-making producing significant effects on workers — even when the system was deployed years ago — is subject to GDPR Article 22 enforcement at scale. The fine's calculation by reference to worldwide annual turnover means that large platform companies using AI for workforce management face existential financial exposure if their systems lack meaningful human oversight.
- 3.The EDPB's acknowledgment that personal data cannot be deleted from a trained model at the current state of the art is a regulatory admission with profound implications: it means that GDPR's right to erasure cannot be fully honored for data absorbed into AI model weights. Organizations training on personal data should treat this as a permanent compliance liability, not a temporary technical limitation, and document their diligence processes accordingly.
- 4.The Trump administration's renaming of AI as 'Super Intelligence' and rejection of multilateral governance frameworks is not merely rhetorical — it signals that US engagement in international AI standards bodies (ISO, ITU, OECD) may become more adversarial, potentially undermining the interoperability of AI governance frameworks that US companies rely on for global market access.
- 5.Delaware's HB 380 provision making third-party data recipients directly subject to the state privacy act — regardless of whether they independently meet the applicability thresholds — is a structural change that closes the data broker loophole present in most other state privacy laws. Organizations that purchase personal data from Delaware controllers should immediately assess whether they are now directly regulated.
- 6.The bilateral US-China AI security incident communications channel agreed at the Trump-Xi summit is the first formal mechanism for AI-related crisis communication between the two powers. While limited in scope, it creates a precedent and infrastructure that could be expanded — and signals that both governments recognize AI-enabled incidents as a category of risk requiring dedicated diplomatic channels.
- 7.The OECD's publication of two pieces on agentic AI governance in the same week — one on practitioner deployment and one on government use — signals that agentic AI is moving from experimental to operational in both enterprise and public sector contexts faster than governance frameworks are being developed. Organizations deploying agents should not wait for regulatory guidance; the OECD's practitioner-derived frameworks are the most current available reference.
- 8.Palantir's hiring of a former Labour deputy leader ahead of a December 2026 NHS contract break clause decision illustrates a broader pattern: AI vendors in sensitive public sector contexts are investing in political access as a competitive moat. Procurement officials and policymakers should treat this as a governance risk — the revolving door between government and AI vendors creates conflicts of interest that existing lobbying disclosure rules may not adequately capture.
- 9.The California AI employment bills' September 30 deadline creates a binary outcome: if signed, California will have the most comprehensive state AI employment regulation in the US, covering the full employment lifecycle with bias audit, notice, and opt-out requirements. If vetoed, it signals that even California's governor views the current wave of AI employment regulation as premature — which would have significant implications for the national legislative trajectory.
信頼度サマリー
今週引用したソース 23 件あなたが選んだ 30 件の監視URLから検出（1つのURLから複数記事が出ることがあります）。
各ソースは信頼度レベルに応じて重み付けされています。単独ソースの主張は AI 合成時に未検証としてフラグ付けされます。
参照ソース一覧
OneTrust published multiple articles this period including the 2026 AI-Ready Governance Survey Report findings (74% adoption, only 47% with governance controls), the 'You Are the Frontier' framework for enterprise AI governance architecture, and CISO guidance on AI governance across the enterprise.
Global Policy Watch reported on California legislature advancing three AI employment bills to Governor Newsom's desk with a September 30, 2026 deadline, Brazil's ANPD public consultation on regulatory oversight, and FCC draft TCPA consent revocation rules.
Tech Policy Press published extensive coverage of the UN General Assembly AI governance clash, Trump-Xi summit AI dialogue, EU KIDS Act legislative architecture analysis, Europe's digital sovereignty funding gap, open-weight model geopolitics, Palantir's UK NHS lobbying strategy, and facial recognition racial bias in ICE enforcement.
Privacy World Blog published analysis on EU CRA reporting obligations active from September 11, 2026; EDPB web scraping guidelines for generative AI and their limitations; Delaware HB 380 amendments; China's simplified personal information protection regime; and U.S. AI law midyear state update.
Hunton Privacy Blog reported on EU CRA reporting obligations taking effect September 11, 2026; Dutch DPA €824.99M Uber fine for automated decision-making; Delaware privacy law expansion signed September 2, 2026; EU KIDS Act proposal submitted to Parliament and Council; and California AB 1709 signed September 10, 2026.
National Law Review published analysis on AI employment law employer liability and compliance guide covering Illinois, NYC, California, and Colorado AI employment obligations; employment AI tools raising bias, privacy, and compliance challenges; and OSHA HazCom November 2026 compliance deadlines.
UN News reported on the UN General Assembly high-level week with AI governance as a central theme, UN scientific panel calling for stronger AI safeguards as current firewalls are unravelling, OpenAI and Anthropic briefing the UN Security Council, and UN Secretary-General Guterres warning of power transfer to private corporations through AI.
EU Digital Strategy confirmed EU KIDS Act press release and proposal documents published September 17, 2026; Code of Conduct on Disinformation second batch of reports published September 24, 2026; and 20th meeting of the European Board for Digital Services held September 24, 2026.
Law.com reported on Ropes & Gray's proprietary diligence tool built with OpenAI; Sullivan & Cromwell's Agreement Analyzer built with OpenAI; Harvey raising an additional $50M; Epiq acquiring Canopy data breach response software; CMS and Dentons selling Noxtua AI to C.H. Beck for more than $114M; and Casepoint launching two AI agents for document review.
Jurist reported on Amnesty International calling for abolition of ICE citing widespread human rights violations including facial recognition use; US Supreme Court allowing federal government to resume voter citizenship checks against Social Security records; and UN General Assembly adopting first sea level rise declaration.
Artificial Lawyer reported on Noxtua raising €100M with C.H. Beck becoming majority shareholder; Chamelio raising $26M Series A; Harvey pro bono program launch; and iManage webinar on context and governance shaping legal AI's future.
Above the Law reported on Trump ordering all US agencies to refer to AI as 'Super Intelligence'; LSU football coach using ChatGPT for legal advice as illustration of AI limitations; Biglaw firms training lawyers to be human as AI handles more legal work; and law schools struggling to decide whether to teach AI.
Harvard Law School Forum published analysis on SEC proposed rescission of Rule 14a-8 shareholder proposals; Dodiya v. Franklin Delaware Chancery Court decision on DGCL Section 144 safe harbors; SEC innovation exemption for tokenized NMS stock; and 2026 sustainability report analysis showing 55% of S&P 500 companies reference AI governance policies.
NIST AI updated with CAISI page confirming role as industry's primary US government contact for AI testing and collaborative research; NIST launched AI Technology Evaluation (AITE) in August 2026; and seeking public comment on TEVV-Athlon Framework through October 6, 2026.
WIPO AI & IP confirmed Global Forum on IP and AI scheduled for November 9-10, 2026 in Geneva; AIII Annual Meeting scheduled for November 11, 2026; and Technical Exchange Network operational with over 90 experts from dozens of countries.
NIST ITL AI Engagement page updated confirming ITL AI Webinar on AI agent enrichment workflow at National Vulnerability Database held September 17, 2026, and seeking public comment on TEVV-Athlon Framework through October 6, 2026.
OECD.AI published two new AI Wonk posts: 'Putting agentic AI systems to work: What practitioners reveal about deployment and governance' on September 24, 2026, and 'Governing with agentic AI: when machines act on government's behalf' on September 25, 2026.
UNESCO AI updated with news on Caribbean Voices at the 4th UNESCO Global Forum on Ethics of AI; call for papers advancing research on Ethics of AI published September 23, 2026; and UNESCO opening third edition of digital citizenship and AI course now available in Portuguese on September 25, 2026.
IAPP reported on EU AI Act literacy changes potentially complicating compliance; Italy's AI framework operationalizing the EU AI Act; Ireland's DPC fining Google €403M; global AI cybersecurity concerns following Australia Medicare portal breach; and EU AI Act article count growing to 35-36 entries.
Future of Life Institute published statement on September 24, 2026 that world leaders at the UN called to rein in the superintelligence race, welcoming calls for pacing and coordination but noting urgency requires practical solutions. Also confirmed Anthropic's June 2026 warning on AI self-improvement risks and FLI's response.
White House tech innovation page updated confirming Trump administration's AI Action Plan to maintain US AI dominance; $2.7 trillion in tech and AI investment attracted; and Fact Sheet on advancing fair and reciprocal relationship with China published September 25, 2026 following Trump-Xi summit.
Japan Cabinet Office AI Strategy page confirmed FY2027 budget request for AI-related programs published September 18, 2026; AI Basic Plan Phase II cabinet decision on July 14, 2026; and MOU between Japan AISI and US OpenAI signed May 29, 2026.
IMDA Singapore published press release on new AI Fluency Programmes for Legal Professionals and nearly 2,000 job opportunities for Singapore's tech workforce, dated August 20, 2026.
AI Regulation & Policyを毎週、自動で監視
このレポートは一次ソースのみから生成されています。テーマとソースを選べば、引用付きレポートが毎週届きます。7日間無料トライアル・$33/月から。
無料トライアルを始める