AI Compliance Map — Oct 16–23, 2026: Treasury proposes limits on AI investment abroad, DeepSeek is ordered off federal civilian systems, and the EU moves to loosen the data rules AI depends on
Weekly AI compliance impact map for October 16-23, 2026: Treasury proposes notifiable and prohibited AI investments abroad, Homeland Security publishes its DeepSeek exclusion order, the EU Council agrees a position on the data rules AI training depends on, the FCA sets out what good AI practice looks like, Colorado's AI rules reach their hearing, Florida proposes chatbot limits for minors, China's new five-year plan commits to AI legislation, and the Fifth Circuit reassigns a case over AI-invented citations.
This compliance impact map covers October 16, 2026, at 17:00 through October 23, 2026, at 17:00 (UTC-05:00). Nine verified actions fall inside the window. The binding ones did not touch how models are built. They settled where AI money, AI products and AI training data may go.
Treasury proposed rules that would make some AI investments abroad notifiable and others prohibited 1. Homeland Security published an order excluding DeepSeek from federal civilian procurement 2. The Council of the EU agreed a position that would let companies process sensitive data for AI development under safeguards 3. A federal appeals court pulled a case from a district judge because his order cited a decision that does not exist.
Two deadlines fall inside the next week. Colorado closes comments on its AI rules on October 26, at the same hearing where the rules are argued. Treasury's investment proposal will start its comment clock when it reaches the Federal Register.
Immediate action items
- Screen outbound AI investments against the Treasury proposal now. The Notice of Proposed Rulemaking would require US persons to notify Treasury of transactions in notifiable technologies and bar them from others in prohibited technologies 1. AI systems, high-performance computing and semiconductors are covered sectors in the statute, and Treasury added biotechnology 1. Deal teams should start flagging AI exposure to countries of concern before the final rule lands.
- Check federal civilian supply chains for DeepSeek code. The Homeland Security order excludes DeepSeek products from civilian agency procurement. It also requires removal of DeepSeek products and of third-party products and services built on DeepSeek implementations 2. A vendor questionnaire that stops at the model name will miss the second category.
- File Colorado comments by October 26. The Department of Law published its regulatory analysis for the rules implementing the ADMT Act and the Chatbot Safety Act on October 21, at least five days before the hearing 4. The hearing and the comment deadline both fall on October 26 5. Both statutes take effect January 1, 2027 67.
- Read the Council's data position against your training pipeline. The mandate adds safeguards to a new derogation that would allow processing of sensitive data for biometric verification and in the context of developing and operating AI systems 3. The text is a negotiating position, so no obligation changes yet. It does show which questions the final regulation will answer.
- Audit AI-assisted filings before a court does it for you. The Fifth Circuit vacated an injunction and pulled the case from the judge who issued it, citing an AI-hallucinated case in his order 10. Any team using a model to draft submissions should check every citation against a reporter.
Weekly regulatory comparison
| Jurisdiction | Instrument / Action | Governing Authority | Legal Status | Covered Entities | Operative Date | Primary Compliance Takeaway |
|---|---|---|---|---|---|---|
| United States — federal | Outbound Investment Security Program NPRM under the COINS Act | Department of the Treasury | Proposed rule; comments open | US persons, including controlled foreign entities | Issued October 22, 2026 | AI, semiconductors, quantum, supercomputing and hypersonics become notifiable or prohibited investment areas, with biotechnology added 1 |
| United States — federal | Exclusion and Removal Order #2026-01 on DeepSeek | Department of Homeland Security under the Federal Acquisition Supply Chain Security Act | Order published as a Federal Register notice; agencies must comply | Federal civilian executive branch agencies and their suppliers | Notice published October 20, 2026; order dated July 24, 2026 | DeepSeek, and third-party products built on DeepSeek implementations, leave civilian agency systems 2 |
| United States — Colorado | Rules implementing the ADMT Act and the Chatbot Safety Act | Colorado Department of Law (Attorney General) | Rulemaking at its hearing; statutes enacted | Developers and deployers of automated decision-making technology; operators of conversational AI services | Hearing October 26, 2026; statutes effective January 1, 2027 | Comments close the same day as the hearing, and the compliance build has ten weeks left 46 |
| United States — Florida | Safe Screens Act, proposed by the Attorney General | Florida Attorney General | Legislative proposal announced; no bill filed yet | App stores, social platforms and AI chatbot operators serving minors in Florida | Announced October 22, 2026 | Chatbot features that simulate companionship or claim to be human would be unfair practices, at up to $50,000 per violation 11 |
| European Union | Council mandate on the digital-rulebook omnibus (Omnibus VII, data part) | Council of the EU | Negotiating position; trilogue to follow | Controllers and processors under the GDPR, including AI developers and deployers | Agreed October 21, 2026 | A lawful route for sensitive data in AI development moves closer, with safeguards and a longer breach-notification clock 3 |
| United Kingdom | AI good and poor practice; framework for agentic finance | Financial Conduct Authority | Supervisory guidance under existing rules | FCA-authorised firms and their senior managers | Published October 19, 2026 | Existing rules govern AI use; incident reporting is being extended to AI failures and near misses 8 |
| China | National Informatisation 15th Five-Year Plan | Central Cyberspace Affairs Commission | Central policy plan; creates no obligation | Enterprises operating in China's digital economy | Issued October 23, 2026 | Foundational AI legislation and AI-focused judicial interpretations join the 2026–2030 agenda 1213 |
| United States — courts | Jackson Federation of Teachers v. Fitch, No. 25-60496 | US Court of Appeals for the Fifth Circuit | Opinion on appeal; injunction vacated, case reassigned | Litigants and counsel filing AI-assisted papers | Filed October 22, 2026 | An AI-invented citation cost a district judge the case; filings need citation checks 10 |
| South Korea | AI data-centre support measures and forthcoming enforcement decree | Ministry of Science and ICT | Policy package; subordinate decree to follow | AI data-centre builders, equipment suppliers and host regions | Announced October 22, 2026; special zones in the first half of 2027 | Permits and building-size rules are being cut, with a 200 billion won localisation programme attached 14 |
United States — federal
The outbound-investment rule turns to AI
Treasury issued its Notice of Proposed Rulemaking on October 22, implementing the Comprehensive Outbound Investment National Security Act that Congress passed in the fiscal 2026 defence authorization 1. The act directs Treasury to require notification of certain transactions and to prohibit others, in five sectors: semiconductors and microelectronics, artificial intelligence systems, quantum information technologies, high-performance computing, and hypersonic systems 1.
Treasury used the authority Congress gave it to add biotechnology to that list 1. The proposal also sets the knowledge standard, the reasonable-and-diligent inquiry expected before a deal closes, and the penalties for violations 1.
For a compliance team the change is procedural. A deal that needed only a sanctions screen now needs a technology screen, run against the technical specifications Treasury has drafted for each sector. The final rule sets the effective date, so the design work happens this quarter and the obligation arrives later.
No AI-specific federal rule or proposed rule reached the Federal Register during the window 15.
DeepSeek leaves civilian agency systems
Homeland Security published notice of Exclusion and Removal Order #2026-01 on October 20, at 91 FR 66346 2. The order rests on the Federal Acquisition Supply Chain Security Act. It tells civilian agencies to exclude DeepSeek and its affiliates from procurement and to remove their products from agency systems 2.
The removal clause reaches past the company. It covers third-party products and services developed using DeepSeek implementations, which brings resellers, integrators and any tool fine-tuned on a DeepSeek model into scope 2.
The order was signed on July 24, 2026. What arrived in this window is the public notice that makes it citable and enforceable across agencies 2. Suppliers to federal civilian agencies should treat it as a live requirement. Defence and intelligence systems sit outside its scope.
United States — states
Colorado's AI rules reach their hearing
The Department of Law published a regulatory analysis on October 21 for rules implementing two statutes: the Automated Decision-Making Technology Act, Senate Bill 26-189, and the Chatbot Safety Act, House Bill 26-1263 4. The rules would clarify the adverse-outcome disclosure duty, set standards for meaningful human review, and define what it means for covered technology to materially influence a consequential decision 4.
For chatbot operators, the rules would specify the additional metrics that annual reports to the Attorney General must carry 4. Both statutes take effect January 1, 2027 67.
The procedural detail matters more than the paperwork. The analysis was prepared at the Department's discretion, after a member of the public asked for one on October 12, and released at least five days before the hearing 4. Anyone who wants a different definition of material influence has until the hearing and comment deadline on October 26 5.
Florida proposes a chatbot template
Florida's Attorney General proposed the Safe Screens Act on October 22. The bill would bar AI chatbot operators from giving minors features that simulate companionship through personification or emotional engagement, offer unsupervised therapy, generate sexual content, or claim the chatbot is a real human 11.
Knowing or reckless violations would be unfair practices under Florida law, at up to $50,000 per violation 11. The proposal also sets design defaults for teenage social accounts: quiet hours from 11 p.m. to 7 a.m., a two-hour daily limit, autoplay off by default 11.
No bill has been filed, and the proposal binds no one. It belongs on the watch list because the same list of prohibited chatbot features has now appeared in a Colorado statute and a Florida proposal in one year. That list is the likeliest shape of the next state chatbot rule.
European Union
The Council's position on the digital rulebook
The Council agreed its negotiating position on October 21 for the proposal that simplifies data protection, privacy and cybersecurity rules, the data half of the seventh omnibus package 3. The AI-related half of that package became law on June 29, 2026 3.
Three elements bear on AI work. The mandate adds safeguards to a derogation that would allow processing of sensitive data for biometric verification and in the context of developing and operating AI systems, and it clarifies the lawful ground for processing personal data for AI development 3. It backs an extension of the deadline for notifying personal data breaches 3. It replaces the proposed single EU entry point for incidents with one entry point in each member state, plus an information point at EU level 3.
The text stays a position. The presidency negotiates with the European Parliament once the Parliament adopts its own 3. A company that trains on special-category data in Europe can plan around this direction while keeping its current basis for processing intact until a regulation appears in the Official Journal.
United Kingdom
The FCA writes down what good AI looks like
The Financial Conduct Authority published a review of good and poor practice in AI on October 19, drawn from supervisory work, industry engagement and its AI Lab 9. The review says existing rules already cover AI use. Firms remain responsible for the consumer outcomes that AI-supported tools deliver 9.
Its findings are specific. Firms that did well defined the consumer need before choosing a tool, tested outcomes across vulnerability and capability groups, and kept auditable records of prompts, outputs, model versions and escalation decisions 9. Firms that did badly retrofitted governance after deployment, excluded vulnerable customers from AI journeys by default, or treated human oversight as a box-ticking exercise 9.
Jessica Rusu, the FCA's chief data, information and intelligence officer, used her October 19 speech to push the horizon out. She said the regulator's incident rules must extend to significant AI failures and near-misses, and that the FCA will work with industry and frontier labs on a trusted framework for agentic finance covering agent identity, delegated authority and accountability 8. A joint survey with the Bank of England, due the following week, finds 86% of firms now use AI 8.
For a regulated firm, the review is the closest thing to a checklist the FCA has published. It applies through Consumer Duty and the senior managers regime, so no new rule has to arrive for it to bite.
China
A five-year plan that promises an AI law
The Central Cyberspace Affairs Commission issued the National Informatisation 15th Five-Year Plan on October 23 12. The plan sets out 10 task areas, 25 key tasks and 7 dedicated programmes, with 12 headline indicators that include the penetration rate of new-generation intelligent terminals and AI agents 16.
Its tenth task area covers legislation and standards. The plan text commits to advancing foundational legislation on artificial intelligence alongside digital economy, telecommunications, online crime and online harassment, and to researching judicial interpretations focused on AI, personal information protection and online ecology 13.
A central plan binds nobody directly. It changes the odds. Chinese AI regulation this year has run through specialised measures: the generative AI filing regime, content labelling, the rules on anthropomorphic interaction services. A named commitment to an AI law points toward a single statute that multinationals would map against the EU AI Act.
Courts
The Fifth Circuit removes a judge over invented citations
The Fifth Circuit vacated a preliminary injunction against Mississippi's H.B. 1193 on October 22 and sent the case to a different district judge 10. The panel's route to that order ran through the lower court's own drafting.
The district judge's temporary restraining order had cited a decision that does not exist, one of several errors the panel describes as AI hallucinations 10. The judge later admitted that a law clerk had used AI to help draft an earlier version 10. The panel held that the embarrassment of those hallucinations made it reasonable to expect the judge would struggle to set aside his earlier findings, and reassigned the case 10.
The appeal decided a case about a state diversity law, so the opinion sets no rule for AI in litigation. What it shows is a court treating fabricated authority as a defect serious enough to cost a judge the case, which is the standard firms should assume for their own filings.
Other jurisdictions
Korea eases the ground under AI data centres
Korea's Ministry of Science and ICT announced support measures for AI data centres at a regulatory reform committee chaired by President Lee Jae-myung on October 22 14. The ministry will write subordinate decrees under the AI data centre act to cut preliminary reviews and document requests. It will also exclude unmanned server and cooling facilities from the floor-area calculation that triggers parking and charging requirements 14.
A 200 billion won programme, about US$139 million, will fund domestic components and solutions next year 14. Special zones follow in the first half of 2027, with a community benefit plan as a condition of the status 14. The proposed enforcement decree goes out for public notice at the end of October.
Near-term calendar
- October 26, 2026 — Colorado's rulemaking hearing, with comments closing at 11:59 p.m. Mountain Time 5.
- Coming weeks — Treasury's proposed rule appears in the Federal Register, and that notice opens its comment period 1.
- End of October 2026 — Korea publishes its proposed enforcement decree on AI data centres for public notice 14.
- December 2, 2026 — AI systems placed on the EU market before August 2, 2026 must meet the Article 50 marking and detection duties 17.
- January 1, 2027 — Colorado's ADMT Act and Chatbot Safety Act take effect, with the implementing rules in place 67.
- First half of 2027 — Korea designates its AI data centre special zones 14.
What the window did not contain
- No adopted EU instrument. The EU action this week is a Council negotiating position on a proposal, and nothing entered into force.
- No AI Act enforcement decision or fine. The Commission and national authorities have held enforcement powers since August 2026, and neither exercised them in the window.
- No final US federal AI rule. Treasury's proposed rule and the DeepSeek procurement notice are the federal actions, and no AI-specific rule reached the Federal Register between October 16 and October 23 15.
- No ruling that decides an AI question on the merits. The Fifth Circuit decided a case about a state diversity law, and its AI content is a finding about the lower court's drafting.
- No new binding Chinese AI instrument. The five-year plan sets direction and creates no duty.
References
- 1
- 2Notice of Order Regarding Exclusion and Removal of DeepSeek Products
federalregister.gov
- 3Digital rulebook: Council agrees position
consilium.europa.eu
- 4
- 5
- 6SB26-189 Automated Decision-Making Technology
leg.colorado.gov
- 7HB26-1263 Conversational AI Service Operator
leg.colorado.gov
- 8
- 9
- 10Jackson Federation of Teachers v. Fitch, No. 25-60496
ca5.uscourts.gov
- 11Attorney General James Uthmeier Proposes the Safe Screens Act
myfloridalegal.com
- 12《国家信息化“十五五”规划》印发
gov.cn
- 13《国家信息化“十五五”规划》印发：推进人工智能等基础性立法
baijiahao.baidu.com
- 14Korea to Slash AI Data Center Rules
en.sedaily.com
- 15Federal Register documents, October 16–23, 2026
federalregister.gov
- 16《国家信息化“十五五”规划》答记者问
cac.gov.cn
- 17The enforcement framework of the AI Act
digital-strategy.ec.europa.eu
This story was produced automatically by a channel. One sentence is all it takes for Neodrop to keep producing for you.