Important vs. Imperative: AI Regulatory Edition
AI Regulation Is Becoming an Operating System
Editorial Decision: “Accentuate the Positive; Eliminate the Negative. Don’t get stuck with Mr. In-Between”
This edition is leading with a change in regulatory posture rather than a list of new laws. Across California, the European Union, and the United Kingdom, the common signal is that AI governance is moving into the operating layer: independent audits, product disclosures, lifecycle monitoring, incident reporting, documented change controls, and explicit allocation of responsibility.
The board-level question is no longer, “Do we have an AI policy?” It is, “Can we prove that our AI controls remain effective after deployment?”
Why read this
AI regulation is becoming less abstract.
The newest measures are not asking companies only to publish principles or appoint a committee. They are reaching into how AI systems are evaluated, how users are informed, how risks are monitored, how models are changed, and who is accountable when performance deteriorates.
That turns AI compliance from a legal interpretation exercise into an operating discipline.
The Imperative
California is building an assurance market
On September 9, California enacted two laws that could shape the infrastructure around AI compliance.
Senate Bill 813 establishes a framework for independent verification organizations that can assess AI systems and models for compliance with state law. Assembly Bill 1405 creates a state registry for AI auditors and sets standards for auditor independence, transparency, and integrity (Office of Governor Gavin Newsom).
The important development is not simply that California wants more AI audits. It is that the state is beginning to define who can provide assurance and what makes that assurance credible.
That distinction matters. An internal review can confirm that a process exists. Independent verification is intended to test whether claims about safety, compliance, and control effectiveness can withstand outside scrutiny.
California then extended the operational theme into specific use cases.
On September 10, the governor signed SB 1119, known as Adam’s Law. The measure requires companies providing companion chatbots for children to implement crisis protocols for suicidal ideation, parental controls, notifications when a child disables safety settings, independent child-safety audits, and annual risk assessments (Office of Governor Gavin Newsom).
On September 16, the governor signed SB 1050, requiring explicit disclosure in video or audio advertising that uses AI-generated performers to sell a product or service. Synthetic figures must be labeled, and an advertisement found to violate the law cannot continue to be used (Office of Governor Gavin Newsom).
Taken together, these measures point toward a layered compliance model:
The organization must know which systems and content are covered.
The product must carry the required controls and disclosures.
Risk assessments must be repeated rather than completed once.
Independent parties may be expected to verify the organization’s claims.
Evidence must be available when a regulator, customer, auditor, or litigant asks for it.
For companies operating nationally, “California-only” may not remain a practical product strategy. Controls built for one large market often become part of the default product, audit, and contracting model.
Europe has moved from preparation to enforcement
The European Union’s AI Act transparency requirements began applying on August 2, 2026, with enforcement led by the European Commission’s AI Office and national authorities.
Chatbots and other interactive AI systems must tell users when they are interacting with AI rather than a human. Deepfake images, video, and audio must be labeled. AI-generated or AI-altered content must also carry machine-readable marks where the rules apply (European Commission).
This is an engineering and content-operations obligation, not just a disclosure paragraph for the legal team.
The organization may need to know:
Which customer experiences are AI-mediated.
Which media assets are generated or materially altered by AI.
Whether a label is visible, accurate, and persistent.
Whether the required machine-readable signal survives editing, distribution, and platform conversion.
Who approves an exception and who monitors the control after release.
The Commission also reported that more than 180 organizations had signed the Code of Practice on transparency of AI-generated content when enforcement began (European Commission).
The broader lesson is that transparency is becoming a system property. A policy can say that the company will disclose AI use. Compliance depends on whether the disclosure appears in the right interaction, in the right format, at the right time, and remains detectable downstream.
For multinational organizations, this also exposes a familiar governance problem: the law is territorial, but the model, content pipeline, and product architecture may be global.
The UK is designing regulation for systems that keep changing
On September 10, the United Kingdom’s National Commission into the Regulation of AI in Healthcare published 44 recommendations for a future regulatory and assurance framework.
The recommendations are not law. A cross-government response will follow. But the document is a useful preview of how regulators may approach AI products that evolve after approval (UK Medicines and Healthcare products Regulatory Agency).
The proposed model includes:
Staged authorizations rather than relying only on a single pre-market decision.
Post-market surveillance plans assessed at authorization.
Real-world studies and ongoing performance reporting.
Escalation when performance degrades, even if no reportable incident has occurred.
Predetermined Change Control Plans for adaptive and continuously learning systems.
Version control and traceability for deployed AI-enabled devices.
Transparent reporting of dependencies on general-purpose and foundation models.
Explicit contractual allocation of risk-control responsibilities between manufacturers and healthcare providers.
Clearer reporting of adverse incidents and searchable safety information for the public.
The Commission’s full report says staged authorization should address the limits of a single-timepoint assessment and support evidence generation, real-world performance assessment, and lifecycle assurance (UK National Commission report).
This is a significant regulatory idea.
Traditional approval assumes that the product evaluated is substantially the product that will remain in service. AI complicates that assumption. Models are updated. Foundation-model dependencies change. data distributions drift. Workflows adapt. Users find new uses that the original assessment may not have anticipated.
A lifecycle model does not ask only whether the system was acceptable at launch. It asks whether the organization can detect when the system is no longer behaving within its approved or expected boundaries.
Healthcare is the immediate context, but the management logic can travel to other high-consequence sectors.
The Important
Regulation is converging on evidence
The durable issue is not regulatory fragmentation alone. It is the emergence of a common operating expectation beneath different laws and sectors.
Regulators increasingly expect an organization to know what AI it uses, understand the risks attached to each use, place controls in the product and workflow, monitor performance after deployment, preserve evidence, and assign responsibility across the lifecycle.
The specific obligations will vary. The management system should not.
Discovery
An organization cannot govern AI systems it cannot identify.
Discovery should cover more than a model inventory. It should connect each AI use to:
The business owner and technical owner.
The developer, deployer, vendor, and underlying model provider.
The people affected by the system.
The data used for training, retrieval, inference, logging, and monitoring.
The jurisdictions and sectors in which the system operates.
The decisions, content, or interactions the system influences.
The disclosures, assessments, audits, and records that may be required.
The third parties responsible for controls the organization does not operate itself.
The right unit of governance is not “the model.” It is the deployed use case, including its data, interfaces, dependencies, users, contracts, and downstream effects.
Agility
AI systems change faster than conventional compliance documentation.
Regulatory agility means being able to update a control without rebuilding the entire governance program. It requires:
Versioned model and prompt records.
Change thresholds that trigger review or reauthorization.
Test suites tied to the intended use and affected population.
Repeatable impact and risk assessments.
Monitoring for drift, control failure, and unintended use.
A process for withdrawing, limiting, or rolling back a system.
Contract terms that preserve access to evidence when a vendor changes an underlying model.
An annual review may be too slow for a system that changes monthly or learns continuously.
Governance
AI accountability often fails at the seams.
The developer may control the model. A business unit may control the use case. IT may control deployment. Legal may interpret the law. Risk may define the control. A vendor may hold the evidence. No single party may own the complete outcome.
Governance should therefore make responsibility explicit:
Who decides whether the use is permitted?
Who validates the system before deployment?
Who monitors performance and complaints?
Who owns required disclosures?
Who can suspend the system?
Who reports an incident?
Who assures the board that the evidence is complete?
The control is not complete until an accountable owner can show that it works.
Three Questions for the Board
Can management produce a current inventory of our material AI use cases, including the jurisdictions, affected people, vendors, model dependencies, and required controls attached to each one?
Which AI controls are independently tested, and what evidence shows that disclosures, safety mechanisms, monitoring, and escalation processes continue to work after deployment?
When an AI model, vendor, data source, or use case changes, who decides whether the system must be retested, restricted, reported, or removed?
Executive Action
Ask management for one evidence pack covering the organization’s three highest-consequence AI use cases.
For each use case, the pack should include the owner, purpose, affected population, jurisdictional analysis, model and vendor dependencies, risk assessment, required disclosures, test results, monitoring thresholds, incident path, change history, and suspension authority.
If that package cannot be assembled quickly, the immediate gap is not documentation. It is governance visibility
California’s independent AI verification and auditor laws:
https://www.gov.ca.gov/2026/09/09/governor-newsom-signs-first-in-the-nation-ai-safeguards-to-protect-californians-calls-on-the-federal-government-to-do-its-part/California’s companion-chatbot and child-safety laws:
https://www.gov.ca.gov/2026/09/10/governor-newsom-signs-the-strongest-child-safety-chatbot-and-social-media-laws-in-the-nation/California’s disclosure law for advertising that uses AI-generated performers:
https://www.gov.ca.gov/2026/09/16/governor-newsom-signs-new-law-to-protect-workers-require-disclosures-on-ai-generated-advertising/European Commission announcement on AI Act enforcement and transparency requirements:
https://digital-strategy.ec.europa.eu/en/news/commission-starts-enforcing-ai-act-rules-and-new-transparency-requirements-2-augustUK National Commission recommendations for AI in healthcare:
https://www.gov.uk/government/publications/national-commission-into-the-regulation-of-ai-in-healthcare-recommendations-for-a-future-regulatory-frameworkFull UK National Commission report:
https://assets.publishing.service.gov.uk/media/6aa2662962ec7fe7bedf52b9/Full_National_Commission_Report_-Publication_1_.pdf
Which part of your AI governance program is hardest to evidence today: inventory, testing, monitoring, vendor oversight, or accountability?
Standards and Regulatory Desk
European AI standards: The European Commission says CEN and CENELEC are developing harmonized standards for high-risk AI systems across ten areas: risk management, data governance and quality, record keeping, transparency, human oversight, accuracy, robustness, cybersecurity, quality management, and conformity assessment. Use of harmonized standards is voluntary, but standards referenced in the Official Journal can provide a presumption of conformity with the corresponding AI Act requirements (European Commission).
NIST AI for CSF: NIST SP 1353, NIST Cybersecurity Framework 2.0: Quick-Start Guide for Using Artificial Intelligence for CSF Analysis and Reporting, remains an Initial Public Draft. Comments are due October 15, 2026, at 11:59 p.m. The guide provides structured prompts intended to help practitioners create CSF-related artifacts and improve AI-assisted CSF analysis (NIST).
Implementation caution: The California announcements do not provide all effective dates, detailed enforcement mechanisms, or implementation deadlines. Organizations should review the enrolled and chaptered statutory text before treating the governor’s summaries as a complete compliance specification.