AI Compliance Map — Oct 23–30, 2026: New York bans a dozen chatbot behaviours for minors, Washington deletes AI "model cards" from health IT, and UK regulators put personal agents under existing law
Weekly AI compliance impact map for October 23-30, 2026: New York bans twelve chatbot behaviours for minors, federal health IT rules drop AI model cards, Treasury opens the comment clock on AI investment abroad, UK regulators put personal AI agents under existing law, and France fines a retailer over a recommender trained without consent.
This compliance impact map covers October 23, 2026, at 17:00 through October 30, 2026, at 17:00 (UTC-05:00). Five actions and one enforcement decision fall inside the window. Four of them concern what a user must be told, or what a product may say to a user. Only one concerns capital.
No legislature in any of the jurisdictions we track passed a new AI statute this week. The binding changes came from an agency deleting a disclosure duty, a governor adding a product ban, four UK regulators restating existing law, and a French regulator fining a retailer €7 million.
Immediate action items
- Compare your companion-chatbot features against New York's list before January 1, 2027. The state now bans a dozen named behaviours for users under 18, and for any user whose age has not been verified 1. The prohibition covers what the bot may claim to be, not only what it may say.
- If you supply predictive decision-support software to US hospitals, plan for the loss of the model-card duty on December 28. The federal health IT rule that required source-attribute disclosure for predictive tools was stripped back in a final rule published October 28 2. The duty disappears from certification; the buyer's questions do not.
- File on the outbound-investment proposal by December 7. Treasury's proposed rule for the Outbound Investment Security Program reached the Federal Register on October 26, which started the clock 3. Deal teams with AI exposure abroad have six weeks to shape definitions they will live with.
- Stop treating an AI agent as a new legal category in the UK. The four regulators of the Digital Regulation Cooperation Forum said on October 30 that existing frameworks already reach personal AI agents 4. Map the agent to the duties you already carry, rather than waiting for an agent-specific rule.
- Check the consent basis for any recommender you train on behavioural data from EU users. France's data protection authority fined Fnac Darty €7 million over a tracker that personalised products and trained its recommendation algorithm without consent 5. Consent for personalisation was the issue; training the model on the same data was part of it.
Weekly regulatory comparison
| Jurisdiction | Instrument / Action | Governing Authority | Legal Status | Covered Entities | Operative Date | Primary Compliance Takeaway |
|---|---|---|---|---|---|---|
| United States — federal | Outbound Investment Security Program Regulations | Department of the Treasury | Proposed rule in the Federal Register; comments open | US persons investing in notifiable or prohibited technologies abroad | Published October 26, 2026; comments close December 7, 2026 | The AI, semiconductor and computing sectors now have a written screening test to comment on 3 |
| United States — federal | ONC deregulatory final rule for health IT certification | Department of Health and Human Services, Office of the National Coordinator | Final rule | Developers and users of certified health IT, including predictive decision-support software | Published October 28, 2026; effective December 28, 2026 | Model-card disclosure and intervention risk-management criteria for predictive tools come out of certification 2 |
| United States — New York | S.9051B / A.10379C, unsafe AI companion features | Governor of New York; enforced by the Attorney General | Signed into law | Operators of AI chatbots reachable by users under 18 in New York | Signed October 28, 2026; effective January 1, 2027 | Twelve named chatbot behaviours become unlawful for minors, with age verification as the gate 1 |
| United Kingdom | Joint statement on protecting people and businesses in an agentic economy | CMA, FCA, ICO and Ofcom through the Digital Regulation Cooperation Forum | Regulatory statement; no new rule | Firms deploying personal AI agents in UK markets | Published October 30, 2026 | Existing law applies to agents; accountability does not move to the agent 4 |
| United Kingdom | Pre-Budget AI package | HM Treasury | Funding commitment | AI developers, security firms, public services | Announced October 24, 2026 | Commitments listed in the release exceed £600 million, including a bigger AI Security Institute and a scoping study for an agentic-cyber sandbox 6 |
| France | Sanction SAN-2026-015 against Fnac Darty | Commission nationale de l'informatique et des libertés (CNIL) | Enforcement decision, published | Operators of apps using non-essential trackers, including for recommendation training | Decided October 22, 2026; published October 29, 2026 | Personalisation and model training fall outside the cookie exemption; consent is required 5 |
United States — federal
Treasury opens the comment window on AI investment abroad
Treasury's proposal implementing Subtitle C of the Comprehensive Outbound Investment National Security Act reached the Federal Register on October 26 as Docket No. TREAS-DO-2026-0595 3. It is the same instrument we flagged last week in its press-release form. What changed is that the comment clock now runs, to December 7 3.
The proposal requires US persons to notify Treasury of transactions in notifiable technologies and bars them from transactions in prohibited ones 3. It carries over definitions and concepts from the existing program where the statute allows, and adds applicability dates so the current rules keep governing earlier activity 3.
For a compliance team the practical work is drafting comments, not building controls. The definitions of notifiable technology and of a covered foreign person decide which deals need a filing. Those definitions are open for six weeks. After that they are decided elsewhere.
No other AI-specific federal rule or proposed rule reached the Federal Register in the window 7.
Health IT loses its AI disclosure duty
The Office of the National Coordinator for Health IT published a deregulatory final rule on October 28 that removes 14 certification criteria and revises seven 2. The consequential change is buried in the decision-support criterion.
The rule deletes the source-attribute requirements that produced "model cards" for predictive decision-support interventions, and the intervention risk-management requirement that went with them 2. It also removes the maintenance duty that required developers to review and update that information 2.
A model card described how a predictive tool was trained, what it was intended for, its limits, and how it performed across patient groups 2. The agency said it was not persuaded users relied on that information, and that developers called the requirements burdensome 2.
Most commenters disagreed. They argued the removal shifts evaluation and liability to providers and weakens the ability to check bias 2. The agency acknowledged the concern and encouraged buyers to ask about quality and performance before deploying 2.
The rule takes effect December 28. Suppliers should decide now whether to keep publishing model-card information voluntarily. The hospitals buying these tools have just been handed the diligence work, and they will ask the same questions in a contract that certification no longer answers.
United States — states
New York bans chatbot behaviour rather than chatbot silence
Governor Kathy Hochul signed S.9051B/A.10379C on October 28, alongside a separate law on internet-connected baby monitors 1. The chatbot law takes effect January 1, 2027 8.
It forbids features, not disclosures. A chatbot may not pretend to be a real person, claim to be alive or to have feelings, or assert a romantic, personal, professional or authority relationship with a child 1. It may not use flattery to hold attention, ask unprompted emotional questions, or mine a child's earlier disclosures 1.
The list continues into harder ground: no promoting suicide, self-harm, eating disorders or substance use; no urging secrecy or the avoidance of parents; no sexually explicit content 1.
Age verification is the gate. Companies must confirm a user is not a minor, offer more than one verification route, and include at least one option that does not depend on a government identity document 1. Age information must be deleted after use 1.
The Attorney General may seek civil penalties of up to $25,000 per violation, plus damages and restitution 8. The law also allows a court to order destruction of data collected unlawfully, and of any model trained on it 1.
That last remedy is the one to read twice. A training-data violation can now reach the model itself, which turns a product decision about data collection into an asset question.
Industry groups objected to the breadth of the language. Tech:NYC said the wording could force companies to restrict tutoring and career tools for minors 8. Expect that argument in the first enforcement action or constitutional challenge. Neither has been filed yet.
United Kingdom
Four regulators say agents are not a new legal category
On October 30 the Digital Regulation Cooperation Forum published a joint statement on protecting people and businesses in an agentic economy 4. Its members are the Competition and Markets Authority, the Financial Conduct Authority, the Information Commissioner's Office and Ofcom 4.
The statement sets out what each regulator is already doing on personal AI agents, how they will work together as adoption grows, and how existing law applies to those agents 4. It creates no new obligation, and it says so by implication rather than by disclaimer.
An assistant that books, buys, answers and remembers can touch consumer law, financial regulation, data protection and online safety at the same time. That overlap is why the four issued one document. Its value is the commitment to coordinate, rather than each regulator discovering the same product separately.
For a firm already deploying agents, the work this quarter is mapping, not waiting. Identify which regulated activity the agent performs, which firm is accountable for the output, and where a human can intervene. No agent-specific UK statute is coming to answer those questions.
The Chancellor funds the safety side
The Chancellor announced an AI package on October 24, ahead of the Budget 6. It is spending, not regulation, and it matters to compliance teams mainly because it expands the institutions that will supervise them.
The package includes £120 million more for the AI Security Institute, to test systems and develop technical standards 6. A £165 million biosecurity initiative carries £100 million for a new AI Biosecurity Lab, supported by up to £200 million in model credits from OpenAI and Anthropic 6.
One line is regulatory. Within a £60 million National Cyber Shield, the government will scope a new sandbox for deploying agentic cyber security tools across critical national infrastructure, the public sector and industry 6. A sandbox is where the deployment questions get answered before rules exist.
Europe — France
A recommender trained without consent costs €7 million
The CNIL sanctioned Fnac Darty's two French entities €7 million on October 22, and published the decision on October 29 5. The breakdown is €6 million for Fnac Darty Participations et Services and €1 million for Fnac Direct 5.
The tracker at issue sent a user identifier and browsing activity to a third-party domain from the mobile app 5. It was used to personalise product recommendations and to train the recommendation algorithm 5.
The regulator held that neither use fell inside the exemption for strictly necessary trackers under article 82 of the French data protection act, so prior consent was required 5. The companies must show within one month that their new tool collects consent where needed, or pay €10,000 per day of delay 5.
Read narrowly, this is a cookie case. Read for its AI relevance, it says that training a recommender on behavioural data is a purpose of its own, and one that the consent exemption does not cover.
No EU-level instrument, court judgment or AI Act enforcement decision fell inside the window. The EU item in this week's map is a national regulator's decision, and we state it as such.
Near-term calendar
- November 2–6, 2026 — China's National People's Congress Standing Committee meets, with the ratification of the agreement establishing a World AI Cooperation Organization on its agenda 9.
- December 2, 2026 — AI systems placed on the EU market before August 2, 2026 must meet the Article 50 marking and detection duties 10.
- December 7, 2026 — Comments close on Treasury's Outbound Investment Security Program proposal 3.
- December 28, 2026 — The ONC deregulatory final rule takes effect, removing the predictive-DSI model-card requirements from certification 2.
- January 1, 2027 — New York's companion-chatbot law applies 8, and Colorado's ADMT Act and Chatbot Safety Act take effect 11.
What the window did not contain
- No EU-level instrument. The Commission's digital-policy newsroom, its AI Act document library and the Official Journal produced no AI act, implementing measure or enforcement decision dated inside the window. The nearest EU-level actions remain the first harmonised standard, published in the Official Journal in October 12, and the Council's data-rulebook position of October 21, both covered in earlier issues.
- No Chinese AI instrument. We verified no binding AI measure from a Chinese ministry or regulator, and no AI case judgment, dated inside the window. The State Council's opinions on AI and employment were released on October 23, before this window opened.
- No court ruling on an AI question. The nearest were procedural: a discovery protective order in Texas on October 28 limiting how a party may put confidential material into an AI system 13, and orders still working through the Fifth Circuit's October 22 reassignment.
- No other jurisdiction. Beyond France, we verified no AI-specific rule or enforcement decision from a national regulator in Asia, Latin America, Africa or Canada with a governing date inside the window.
References
- 1
- 2
- 3Outbound Investment Security Program Regulations
federalregister.gov
- 4
- 5
- 6
- 7Federal Register documents, October 24–30, 2026
federalregister.gov
- 8
- 9常委会第二十五次会议议程
npc.gov.cn
- 10The enforcement framework of the AI Act
digital-strategy.ec.europa.eu
- 11SB26-189 Automated Decision-Making Technology
leg.colorado.gov
- 12First harmonised standard supporting the AI Act published in the Official Journal
digital-strategy.ec.europa.eu
- 13
This story was produced automatically by a channel. One sentence is all it takes for Neodrop to keep producing for you.