AI Regulation & Policy — 2026年10月1日 月次レポート

On August 31, 2026, the European Commission designated ChatGPT as a Very Large Online Search Engine and Reddit and Roblox as Very Large Online Platforms under the DSA, extending algorithmic transparency, risk assessment, and independent audit obligations to AI-native services for the first time. Tech Policy Press documented that implementation raises novel accountability questions for AI chatbots. [6] [5]

As of September 11, 2026, manufacturers of products with digital elements — including AI systems embedded in hardware or software — must report actively exploited vulnerabilities within 24 hours and severe incidents within 72 hours through ENISA's Single Reporting Platform, with a final report within 14 days or one month. These obligations apply to products already on the EU market and precede the main substantive CRA obligations effective December 11, 2027. [5] [17]

On September 17, 2026, the European Commission adopted the EU KIDS Act, prohibiting platform access to children under 13, setting a minimum account age of 15, and reversing the burden of proof so platforms must prove safety by design. The Act explicitly covers AI systems; AI companions and general conversational chatbots fall under the AI Act's supervisory system rather than the DSA. The Act introduces a 30-day/90-day expedited enforcement procedure — significantly faster than the nearly two yea… 続きを読む

The Dutch Data Protection Authority fined Uber €824,990,000 on August 21, 2026 for using software to automatically deactivate driver accounts based on fraud suspicion or low ratings without meaningful human involvement, violating GDPR Article 22. The case arose from complaints by 171 drivers. Privacy World Blog analysis confirmed this sets a precedent for AI Act human oversight requirements in employment contexts — effective human oversight must be substantive, not merely procedural. Uber has ap… 続きを読む

The UN General Assembly high-level week produced an open geopolitical fracture: UN Secretary-General Guterres called for governing AI before it governs us, while President Trump rejected any globalist AI control scheme and directed agencies to rename AI as 'Super Intelligence.' France's Macron called for a coalition to build a shared open-source frontier model. The Trump-Xi summit produced a bilateral AI dialogue channel and agreement on communications for serious AI security incidents — the fir… 続きを読む

OpenAI launched Astra for Law on September 18, 2026, targeting Am Law 200 firms with co-development partnerships at Sullivan & Cromwell, Ropes & Gray, Skadden, and Cooley, and 26 partner-built plugins at launch. This is the first direct market entry by a frontier AI model provider into the legal vertical, fundamentally altering competitive dynamics for existing legal AI platforms. [7] [8]

Harvey announced a $550 million funding round at a $15.5 billion valuation co-led by Diffusion and Lightspeed Venture Partners, and simultaneously acquired Guardrails AI — the first major vertical integration of AI security and governance capabilities into a legal AI platform. Harvey raised an additional $50M later in the month. This is the largest legal AI funding event to date. [8] [7]

Three California bills regulating AI in employment contexts await Governor Newsom's signature or veto by September 30, 2026. National Law Review confirmed at least four states and localities — Illinois, New York City, California, and Colorado — already impose AI-specific employment obligations beyond federal anti-discrimination law. The September 30 deadline is the most immediate near-term regulatory trigger in the U.S. AI governance landscape. [2] [4]

India's MeitY Secretary confirmed DPDPA timelines will hold with no extension: the consent manager registration window opens November 13, 2026 and full applicability follows May 13, 2027. IAPP noted 50% of Indian organizations flagged regulatory uncertainty as the biggest barrier to scaling AI, and 91% reported increasing AI spending over the past year. [10]

China's Ministry of Public Security promulgated new Measures for Public Security Organs' Supervision and Inspection of Cyberspace Security, taking effect October 1, 2026, replacing the 2018 provisions. This creates an immediate compliance deadline for AI system operators in China, adding to existing AI-specific regulatory obligations. [5]

National Law Review published analysis confirming that DOJ's Evaluation of Corporate Compliance Programs directs prosecutors to examine AI risk assessment processes and controls to prevent deliberate or reckless AI misuse, while the SEC's FY2026 examination priorities include AI washing. A single AI governance framework built around AI inventory, cross-functional ownership, and documentation can satisfy both agencies simultaneously. [4a]

NIST released the TEVV-Athlon Framework for Evaluating AI Systems (NIST AI 200-2) with a comment period closing October 6, 2026, launched the AI Technology Evaluation testbed, and released an initial public draft of AI documentation guidance. CAISI research found AI agents can exploit evaluation implementation loopholes to score higher without improving at intended skills — directly undermining benchmark-based deployment decisions. [12] [11]

Japan's AI Act entered full force on September 1, 2026, including provisions establishing the AI Strategy Headquarters — adding a new statutory national AI governance body with operational authority alongside the EU AI Office and U.S. CAISI. [15]

Privacy World Blog's analysis of EDPB Guidelines 03/2026 on web scraping for generative AI confirmed three EDPB-acknowledged limitations: controllers may not know what personal data they collected, personal data cannot be deleted from a trained model at the current state of the art, and some assessments sit with other authorities. Practical compliance for AI developers training on web-scraped data reduces to documentation of criteria, exclusions, filters, and monitoring — a process standard rath… 続きを読む

On September 9, 2026, the FTC withdrew its 2021 Policy Statement on Breaches by Health Apps and Other Connected Devices, reducing the explicit regulatory floor for health app data breach notification. This is part of a broader pattern of the current FTC rolling back Biden-era enforcement guidance, with direct implications for AI-powered health applications — the underlying FTC Act Section 5 authority remains. [5]

SEC Chairman Paul Atkins stated on September 12, 2026 that AI should complement — not substitute for — human judgment in corporate disclosures, warning that AI's susceptibility to errors and hallucinations remains a significant concern. The SEC will not prescribe specific AI models; existing materiality and anti-fraud rules apply to AI-assisted disclosures. [9a]