AI Compliance Map — Jun 19–26 (2026)

Immediate triage queue as of June 26, 2026:
July 1 — China Decree 837: audit outbound-investment filings, China resident-individual exposure, and AI/data/algorithm investments before the regulation takes effect. 1
July 13 — South Korea KFTC: comments close on proposed AI advertising substantiation-rule amendments. 2
July 22 — EU transparency Code: initial signatories to the AI-generated content transparency Code must submit the signing form. 3
July 23 — EU high-risk classification consultation and US FAR overhaul comments: both close the same day. 4 5
August 2 — EU Article 50: transparency obligations remain on the original date even while high-risk obligations move under the Omnibus political deal. 6

This issue covers June 19, 2026, 5:30 p.m. through June 26, 2026, 5:00 p.m. in the channel's display timezone. Across the reporting window, 40 new items were identified in US federal, US state, EU/UK/Ireland, China, Canada, and APAC sources.

The useful compliance signal this week is timing. EU high-risk AI obligations are politically deferred but not fully safe to file away; Article 50 transparency work still has an August 2 live date. China has a July 1 outbound-investment effective date with thin public implementation detail. US states moved on therapy chatbots, companion chatbots, school AI, legal citation verification, and frontier-model audits.

US federal

Quantum EOs turn PQC into an AI-adjacent contractor issue

President Trump signed EO 14412, "Securing the Nation Against Advanced Cryptographic Attacks," on June 22, 2026. Federal high-value assets and high-impact systems must transition to post-quantum cryptography for key establishment by December 31, 2030, and for digital signatures by December 31, 2031. The FAR Council must publish a proposed contractor rule within 180 days, about December 19, 2026, requiring covered contractors to comply with NIST PQC standards by December 31, 2030. 7

The same day, EO 14413 created a QC-ADDS effort to develop at least one large-scale quantum computer for the Department of Energy and required five-year plans for quantum sensors and networking from Commerce, Energy, NSF, and NASA. 8 The EO 14412 fact sheet links the order to the June 2 AI cybersecurity EO, placing PQC migration inside the federal AI-security program rather than in a standalone cryptography lane. 9

Compliance impact: AI vendors selling into federal environments should add PQC readiness to security-roadmap and procurement-response planning, especially where AI systems depend on long-lived encrypted data, model-weight protection, or federal cloud workloads.

FAR overhaul enters rulemaking, including ICT and supply-chain parts

The FAR Council published the first four proposed Revolutionary FAR Overhaul rules in the Federal Register on June 23, 2026, covering FAR Parts 17 through 20. Part 39 on information and communication technology and Part 40 on information security and supply-chain security are part of the affected package, and comments run for 30 days, approximately through July 23, 2026. 5

The overhaul has already cut about 3,000 mandates and 500 pages in agency deviations, and the new framework includes risk-based audit requirements for contracts above $2 million and a four-year sunset clause requiring reconsideration of regulations. 5

Compliance impact: Federal AI contractors should review how Parts 39 and 40 change ICT procurement, AI/cloud supply-chain review, and audit exposure before the July 23 comment deadline.

House activity points to AI oversight, not immediate private-sector mandates

H.R.8881, the SBA Artificial Intelligence Utilization Act of 2026, passed the House on June 23, 2026. The bill requires the Small Business Administration administrator to report annually to House and Senate Small Business committees on AI and machine-learning use, including use-case risks, benefits, human involvement, and whether the tool fills an agency need. 10

H.R.9381, the AWARE Act, was introduced on June 22, 2026, by House Education and Workforce Committee Chair Tim Walberg. It directs the Bureau of Labor Statistics to compile statistics on AI usage in the workforce and does not impose new employer or developer obligations. 11

The House Science, Space, and Technology Committee scheduled a full committee markup during the week of June 22-28 for 10 bills, including H.R.9333, the AI Flaw Reporting and Security Enhancement Act, and H.R.9341, the AI-Ready Federal Data Guidelines Act. 12

Compliance impact: These House items are mostly government-use, statistics, and voluntary reporting infrastructure. AI policy teams should track them for future standards and procurement effects, but they do not create immediate private-sector compliance duties.

Workday ruling expands AI hiring-vendor litigation risk

In Mobley v. Workday, a Northern District of California judge granted in part and denied in part Workday's motion to dismiss the third amended complaint in an algorithmic-bias class action. The court allowed California Fair Employment and Housing Act claims to proceed on the theory that Workday's AI screening tools may make it an employer's "agent," rather than a passive software vendor. 13

The court also allowed California FEHA claims for non-California plaintiffs who applied for out-of-state jobs because the challenged screening systems were allegedly designed, developed, maintained, trained, and operated from Workday's California headquarters. 13

Compliance impact: Employment-AI vendors should review agency-liability language in customer contracts, adverse-impact testing, proxy-disability controls, and documentation showing where model governance decisions occur.

DOJ/xAI intervention remains unresolved

DOJ filed a motion on June 15, 2026, to intervene in and dismiss NAACP v. x.AI Corp. in the Northern District of Mississippi. DOJ argued that xAI's Grok "Gov" model supports mission-critical Pentagon operations and that the Clean Air Act citizen-suit provision is unconstitutional under Article II because enforcement power belongs to the executive branch. 14

The NAACP case alleges that xAI operates 27 to 60 methane gas-burning turbines without permits to power its Colossus 2 data center in Southaven, Mississippi. As of June 26, Chief Judge Debra Brown had not ruled on DOJ's motion. 14

Compliance impact: AI infrastructure teams should not treat government-customer status as an environmental-compliance shield unless the court adopts DOJ's theory; the case remains pending.

Federal preemption remains stalled

No federal AI preemption bill had been formally introduced in either chamber as of June 26, 2026. The Obernolte-Trahan "Great American AI Act" discussion draft would preempt state AI model-development laws for three years but preserve post-deployment state laws, while Blackburn's "TRUMP AMERICA AI Act" remains an unintroduced discussion draft. 15

Compliance impact: State-law compliance programs should proceed on enacted and pending state statutes rather than assuming near-term federal preemption relief.

US states

Arizona vetoes the whole AI slate

Arizona Governor Katie Hobbs vetoed 88 bills on June 19, including HB 2592 on state-agency AI implementation, HB 2133 on synthetic intimate depictions, HB 2311 on chatbot safety, and HB 4005 on AI courses in public schools. 16

Compliance impact: AI companies lose a potential Arizona state-agency deployment mandate and avoid new Arizona deepfake and chatbot-safety duties for now, but the veto package also leaves no state-specific compliance standard to rely on.

Illinois sends SB 315 to Governor Pritzker

Illinois SB 315, the Artificial Intelligence Safety Measures Act, was formally sent to Governor JB Pritzker on June 26, 2026, starting a 60-day window for signature, veto, or enactment without signature. The bill would require large frontier developers to maintain frontier AI frameworks covering catastrophic-risk assessment, mitigations, governance, cybersecurity, third-party evaluations, and internal-use risks. 17

SB 315 also mandates annual independent third-party audits, transparency reports before deploying new models, critical safety-incident reporting, whistleblower protections, civil penalties, and Illinois Emergency Management Agency reporting systems. 18

Compliance impact: Frontier-model developers with Illinois exposure should prepare a governor-window tracker now; if signed, SB 315 would push state-level frontier safety compliance toward audited frameworks and incident reporting.

Rhode Island signs chatbot, therapy, and clinical-documentation bills

Rhode Island Governor Dan McKee signed three AI-related measures during the week of June 22-25: S2195/H7350 on companion chatbot self-harm and physical-harm protocols, S2197/H7349 prohibiting unlicensed AI therapy or psychotherapy services, and H7538 requiring healthcare providers using AI to document clinical visits to notify patients and review AI-generated documentation for accuracy after each visit. 19

Compliance impact: Companion chatbot operators, AI therapy products, and healthcare documentation vendors should segment Rhode Island users and update self-harm escalation, licensure, disclosure, and clinician-review workflows.

California sends AB 2148 to Newsom

California AB 2148 was sent to Governor Gavin Newsom on June 24, 2026, after Assembly approval by 76-0 on May 4 and Senate approval by 38-0 on June 18. The bill would require elementary and secondary public school employees or contractors providing services in public schools to be "natural persons," effectively barring AI from serving as teachers. 19

Compliance impact: K-12 ed-tech vendors should separate AI tutoring and workflow support from teacher-of-record functions in California deployments.

Michigan data-center regulation accelerates

Michigan Senate Democrats introduced an eight-bill package on June 18 to regulate large data centers, including water-use caps, energy-cost responsibility, and a ban on nondisclosure agreements for local officials. A bipartisan Capitol rally on June 23 demanded local control over data-center development, and SB 1018-1020 would impose a 365-day statewide moratorium. 20

The Sierra Club urged the Michigan Strategic Fund Board to halt tax breaks for data centers and warned that tax breaks could cost the state more than $90 million. 20

Compliance impact: AI infrastructure teams planning Michigan projects should model one-year construction-delay risk, water and power constraints, tax-incentive uncertainty, and local-disclosure obligations.

Court-filing AI rules are live in Florida and New York

Florida Supreme Court Rule 2.515(d)(2) took effect June 15, 2026. Every signer of a court filing must now represent that the legal authorities identified exist and are accurately cited, and judges may impose sanctions including reprimand, contempt, striking documents, dismissal, costs, and attorney fees. The public comment period remains open until August 11, 2026. 21

New York Part 161, effective June 1, 2026, permits AI use in court submissions but requires lawyers to understand the technology and ensure accuracy; no specific enforcement actions were identified in this week's window. 22

Compliance impact: Legal AI vendors and litigation teams need human citation-verification controls, audit logs, and state-specific court-filing warnings for Florida and New York matters.

Pennsylvania, Connecticut, Missouri, and New York remain active watch items

Pennsylvania HB 2006, the AI in Companionship Applications Safety Act, advanced from the House Communications and Technology Committee with amendments on June 23 by a 14-12 vote; HB 95 on synthetic advertising disclosure passed the full House 124-78 on June 17; and SB 806 passed the Senate 48-2 on June 10. 19

Connecticut Attorney General William Tong issued an AI advisory memorandum to state agencies in June, stating that AI technologies remain subject to civil-rights, consumer-protection, privacy, and antitrust laws, including CUTPA risk for deceptive AI practices and CTDPA obligations for profiling systems. 23

Missouri SB 1019, a healthcare omnibus bill that includes an AI therapy chatbot ban, was sent to Governor Mike Kehoe on May 28 and still awaited action as of June 25. The 45-day deadline is disputed: one reading points to June 29 from legislative passage, while another points to July 12 from transmission. 19

New York's seven-bill AI package had been sent to Governor Kathy Hochul by June 1 with a December 31 action deadline, and no action was reported during the June 19-26 window. 19

Compliance impact: Product teams should keep separate state trackers for companion chatbots, synthetic advertising, therapy chatbots, and existing-law enforcement; these items are not interchangeable even when they target similar harms.

EU, UK, and Ireland

EU Omnibus gives high-risk systems more time, but not Article 50

The European Parliament voted 423-57-174 on June 16, 2026, to approve the Digital Omnibus on AI provisional agreement, after the Council presidency and Parliament negotiators reached a provisional agreement on May 7. Formal Council approval and Official Journal publication remained pending in the research package. 6

The Omnibus would move standalone Annex III high-risk AI compliance from August 2, 2026, to December 2, 2027, and embedded Annex I product high-risk AI compliance from August 2, 2027, to August 2, 2028. Article 50 transparency obligations remain set for August 2, 2026. 6

The Omnibus also adds prohibitions on AI-generated non-consensual intimate content and child sexual abuse material from December 2, 2026, and moves the AI regulatory sandbox deadline to August 2, 2027. 24

Compliance impact: EU teams should run two tracks: Article 50 deployment by August 2, and high-risk-system gap analysis under the delayed timetable until the Omnibus is formally in force.

Ireland's AI Bill moves fast through the Dáil

Ireland's Regulation of Artificial Intelligence Bill 2026, Bill 69 of 2026, was published on June 19 and completed First Stage and Second Stage in Dáil Éireann on June 24. The bill establishes Oifig IS na hÉireann, the Irish AI Office, as the national EU AI Act enforcement body. 25

The bill amends the Central Bank Act 1942, Communications Regulation Act 2002, Competition and Consumer Protection Act 2014, and Freedom of Information Act 2014. RTÉ reported that Minister of State Niamh Smyth framed the bill as part of Ireland's preparation for its EU Council Presidency and its role as a digital regulatory hub. 26

Compliance impact: Companies with EU headquarters or major EU regulatory interfaces in Ireland, including major model providers and platforms, should map which authority will handle AI Act issues and prepare for a multi-authority Irish enforcement model.

UK regulators publish their own generative-AI benchmark

The UK Digital Regulation Cooperation Forum published "DRCF Insights: Innovating With Generative AI in the DRCF Member Regulators" on June 24. The report covers ICO, FCA, CMA, and Ofcom work across governance frameworks, prompt engineering, AI detection of consumer harm, and AI-solution evaluation. 27

The CMA's agentic AI work has supported eight investigations and more than 100 advisory letters to businesses, including work on consumer journeys and drip pricing. 28

Compliance impact: UK-regulated firms should treat the DRCF controls as a preview of supervisory expectations: documented AI governance, human review, RAG where appropriate, bias and hallucination management, and evaluation before deployment.

EU transparency Code creates a July 22 decision point

The European AI Office published the final Code of Practice on Transparency of AI-Generated Content on June 10. The Code has a provider section for marking and detecting AI-generated content and a deployer section for labeling deepfakes and AI-generated text. 29

Initial signatories must submit the signing form by July 22, 2026, and the public signatory list is expected in July. 3 Slaughter and May noted that the Code leaves hard liability questions at the platform boundary, especially where a bad actor removes markings from an AI-generated deepfake. 30

Compliance impact: Providers and deployers of generative AI in the EU need a July 22 sign-or-explain decision, plus fallback documentation if they do not rely on the Code.

Munich court treats AI Overviews as Google's own statements

The Munich I Regional Court issued a preliminary injunction on May 28, 2026, in case 26 O 869/26, holding that Google could be directly responsible for false statements in AI Overviews that associated two Munich publishers with scams, subscription traps, and dubious business conduct. Google appealed on June 12. 31

The court treated AI Overviews as Google's own statements rather than neutral search results and rejected reliance on DSA hosting-provider protection. 31

Compliance impact: Providers of AI-generated summaries, retrieval-augmented chatbots, and answer engines should assess source grounding, traceability, notice-and-takedown workflows, and defamation-risk review in EU markets.

UK ICO, Italy, and EU high-risk guidance add more implementation work

The UK ICO set out a safe-AI innovation plan on June 22, including a statutory AI and automated-decision-making code of practice, agentic AI guidance, transparency resources for procurement of off-the-shelf AI tools, and simplified sandbox services. 32

Italy's Council of Ministers preliminarily approved two AI Act implementation decrees on June 10 under Law No. 132/2025; the measures confirm AI support for workplace functions but prohibit fully automated decisions in hiring, dismissal, and disciplinary action where employee rights are affected. 33

The European Commission extended the targeted consultation on draft high-risk AI classification guidelines to July 23, 2026, and final guidelines are expected by the end of 2026. 4

Sidley Austin's June 24 Article 50 guide warns that regulators will assess whether disclosures are clear, accessible, and effective in context, and it recommends use-case mapping, user-interaction review, content-labeling standards, governance updates, exemption documentation, and vendor-contract review before August 2. 34

Compliance impact: EU and UK compliance teams should not wait for every final guide. They can start with classification inventories, Article 50 disclosure design, AI procurement due diligence, and employment-AI human-review controls.

China, Canada, and APAC

China Decree 837 takes effect July 1

China's State Council Decree 837, the outbound-investment regulation effective July 1, 2026, creates full-lifecycle regulation for outbound investment: pre-investment filing and security review, ongoing monitoring, and post-exit accountability. 1

Sina Finance reported that Decree 837 covers Chinese resident individuals as well as enterprises, limits legal individual overseas-investment channels to Stock Connect, QDII, and Cross-Border Wealth Management Connect, and imposes fines of 0.1% to 1% of investment amount for unregistered investments, with one-to-three-year overseas-investment bans for serious violations. 35

Compliance impact: AI companies with China-linked ownership, outbound R&D investments, algorithm/data asset transfers, or offshore holding structures should complete an ODI and security-review gap check before July 1.

China financial data rules affect AI in finance

Six Chinese agencies, including CAC, PBOC, NFRA, CSRC, the National Bureau of Statistics, and SAFE, issued Financial Information Service Data Classification and Grading Guidelines on June 13, 2026. The guidelines cover financial data types such as stocks, bonds, funds, foreign exchange, commodities, wealth management, and indices. 36

Financial regulators also released a June 22 Q&A on guidelines for AI safety development and application in banking and insurance, which is separate from the financial-data classification guidelines. 36

Compliance impact: Financial AI providers in China should align AI training, analytics, and output workflows with sectoral data classification and grading controls.

Canada privacy and online-safety bills stay at second reading

Canada's Bill C-36, the Protecting Privacy and Consumer Data Act, was introduced on June 15, 2026, and remained at second reading in the House of Commons as of June 26. The bill replaces Part 1 of PIPEDA, recognizes privacy as a fundamental right, adds automated-decision transparency for legal or similarly significant effects, creates deepfake deletion rights, provides human review of automated decisions, and adds children's data protections. 37

Bill C-36 would create administrative monetary penalties up to the greater of CAD $10 million or 3% of global revenue, and criminal fines up to the greater of CAD $25 million or 5% of global revenue. 38

Bill C-34, the Safe Social Media Act, was introduced on June 10 and also remained at second reading. It would create the Digital Safety Commission of Canada, impose a mandatory social-media ban for users under 16, regulate AI chatbot safety, and require AI-generated content labeling. 39 Michael Geist argues that the exemption process is operationally weak because the government may need 12 to 18 months to develop regulations while the ban takes effect immediately. 40

Compliance impact: Canadian teams should prepare for privacy-led AI governance rather than a standalone AI Act: ADM transparency, deepfake deletion, child-data controls, chatbot safety, age verification, and synthetic-content labeling.

South Korea, Japan, Singapore, Australia, and Pax Silica

South Korea saw two AI-relevant moves: on June 22, Representative Jo In-cheol and 19 co-sponsors introduced an AI Basic Act amendment adding children and adolescents to the statutory definition of AI vulnerable groups, and on June 23 the KFTC opened comments through July 13 on proposed AI advertising substantiation-rule amendments. 2

Japan released a draft revision of its AI Basic Plan on June 20, 2026, about six months after the original December 2025 plan. The draft addresses cyberattack risks from advanced AI models, misinformation and disinformation countermeasures, and AI-generated content detection technologies. 41

Singapore's IMDA updated the Model AI Governance Framework for Agentic AI on May 20, and Baker McKenzie analysis on June 23 notes four dimensions: upfront risk assessment and bounding, meaningful human accountability, technical controls and processes, and end-user responsibility. 42 MAS also opened a June 10 consultation on technology risk management and AI governance, with comments due July 31. 42

The US State Department issued a Joint Statement on AI Opportunity Partnership on June 25 under the Pax Silica initiative, organized around pro-innovation regulation, AI supply-chain cooperation, and private-industry mobilization. 43

Australia's OAIC consultation on automated-decision-making transparency obligations closed June 15, and no consultation summary or submissions analysis had been published as of June 26. DP-REG signed a memorandum of understanding on June 17 to strengthen digital-platform oversight coordination. 44

Compliance impact: APAC workstreams should prioritize Korea advertising comments, Singapore agentic-AI governance alignment, Japan cyber/disinformation policy monitoring, and Australia's December 2026 ADM transparency deadline.

Upcoming compliance deadlines

Date	Jurisdiction	Obligation or event	Affected entities	Status
June 29, 2026	Missouri	Possible SB 1019 governor deadline under the legislative-passage calculation. 19	AI therapy chatbot operators with Missouri users	Disputed date; July 12 is the alternative calculation
July 1, 2026	China	Decree 837 takes effect; ODI filing and security-review checks become urgent. 1	China-linked AI companies, investors, resident individuals, offshore structures	Effective date fixed
July 13, 2026	South Korea	KFTC comment period closes on proposed AI advertising substantiation-rule amendments. 2	Advertisers and platforms using AI-generated or AI-supported claims	Comment period open
July 22, 2026	EU	Initial signatory form due for the AI-generated content transparency Code. 3	Generative AI providers and deployers in the EU	Sign-or-explain decision point
July 23, 2026	EU	High-risk AI classification guideline consultation closes. 4	Providers and deployers classifying Annex I/III systems	Extended deadline
July 23, 2026	US federal	FAR overhaul comment period closes for the first proposed RFO rules. 5	Federal contractors, AI/cloud vendors, procurement teams	Estimated 30-day comment close from June 23 publication
July 31, 2026	Singapore	MAS consultation on technology risk management and AI governance closes. 42	MAS-regulated financial institutions and AI vendors	Comment period open
August 2, 2026	EU	Article 50 transparency obligations apply. 34	AI providers and deployers placing systems on the EU market	Date unchanged by Omnibus
August 11, 2026	Florida	Public comments close on Rule 2.515(d)(2). 21	Lawyers, legal AI vendors, court-filing workflows	Rule already effective
August 25, 2026	Illinois	Approximate 60-day SB 315 governor window closes from June 26 transmission. 17	Frontier-model developers	Governor action pending
December 2, 2026	EU	Omnibus transition date for watermarking systems already on market and new prohibited AI-generated NCIC/CSAM practices. 24	Generative image/video providers and deployers	Depends on Omnibus formal entry into force
December 2026	Australia	ADM transparency compliance deadline. 44	Entities using automated decisions about individuals	Final guidance not yet published
December 31, 2026	New York	Governor deadline for the seven-bill AI package sent by June 1. 19	AI product, disclosure, safety, and platform teams depending on bill scope	Governor action pending
December 31, 2030	US federal	EO 14412 PQC key-establishment deadline for federal high-value assets and high-impact systems. 7	Federal agencies and covered contractors	Future implementation rule expected