AI regulation is shifting from broad principles to practical accountability.
September's developments show AI regulation moving from principles to practical control. Security risks from autonomous systems took centre stage, with regulators issuing new guidance and frameworks to keep agentic AI within defined limits and under human oversight. Transparency around AI-generated content also gained momentum, as new disclosure and labelling requirements took shape ahead of EU AI Act deadlines. At the same time, enforcement is becoming real, with early AI Act compliance requests and new liability for failures in high-risk AI oversight, alongside stronger protections for individuals in sensitive contexts such as recruitment and children's use of AI companions. Organizations should be ready to demonstrate that their AI systems are secure, transparent and accountable in practice.
North & South America Jurisdiction
1. California Strengthens Transparency Related to AI Generated Content in Advertising
September 16, 2026 California, United States
California Governor Gavin Newsom signed SB 1050 on September 16, 2026. The law requires audio, video and audiovisual advertisements that prominently feature realistic AI-generated “synthetic performers” to include a clear disclosure, such as “this performance features a synthetic performer” or “no human performer is depicted.”
The requirement applies when a synthetic performer demonstrates a product, delivers narration, or illustrates or reacts to a commercial message. It does not cover AI used solely for translation or accessibility, or certain advertisements for expressive works where the synthetic performer is consistent with the underlying work.
The law reflects a growing regulatory focus on transparency in commercial uses of generative AI.
2. California Introduces Child-Safety Protections for AI Companion Chatbots
September 10, 2026 California, United States
California Governor Gavin Newsom signed Adam’s Law (SB 1119) on September 10, 2026. The law regulates AI companion chatbots capable of human-like interactions and sustained relationships, while excluding certain customer service tools and chatbots provided exclusively for workplace use.
Operators must use age assurance or apply specified child protections to everyone. Requirements include documented risk assessments and mitigation measures, public safety policies, crisis response protocols, AI disclosures, parental controls and default usage limits. The law also restricts selling children’s information, behavioral and conversation based advertising, and manipulative interface designs.
Adam’s Law reflects increasing scrutiny of AI products that may encourage emotional dependency or expose minors to psychological and privacy risks.
3. Spain's AEPD Warns Companies Evaluating AI Recruitment Tools To Screen CVs
September 23, 2026 Spain
The Spanish Data Protection Authority (AEPD) has issued a warning to companies evaluating an AI recruitment tool to screen CVs. Such companies must ensure data protection by design and by default, conduct a DPIA if high risks are identified, and maintain transparency with candidates and employees, in addition to human intervention in cases involving decision-making with the AI tool.
Candidates and workers must receive clear, accessible and understandable information about the processing of their personal data and the role that the tool plays in the evaluation process.
4. Slovenia’s AKOS Issues Clarification On Obligations Of GenAI System Providers
September 21, 2026 Slovenia
Slovenia's Agency for Communication Networks and Services of the Republic of Slovenia (AKOS) has clarified that providers of GenAI systems, including general-purpose AI systems that generate synthetic audio, visual, video, or text content, must comply with transparency obligations under Article 50(2) of the EU AI Act by December 2, 2026. Moreover, providers must develop effective, interoperable, robust, and reliable technical solutions for labeling and detecting AI-generated content. Certain AI systems performing auxiliary functions or legally authorized tasks are exempt from these obligations.
5. Italy Introduces New Offense Related To Human Oversight Of High-Risk AI Systems
September 9, 2026 Italy
Italy has introduced a new criminal offense linked to the security and human oversight of high-risk AI systems. The new offense covers failures to adopt the required technical security measures or human oversight measures for high-risk AI systems where those omissions create a danger to life or public or individual safety. The penalties can reach 8 years’ imprisonment where the conduct creates a danger to state security. The law brings AI-related offences within the scope of entity liability, including the new offence and the existing offence concerning the unlawful dissemination of AI-generated or altered content. This means that an AI incident can potentially develop into an investigation involving both individual criminal liability and corporate liability.
6. CNIL Releases New Version Of Genmod Demonstrator Tool
September 1, 2026 France
CNIL has released an updated version of its Genmod demonstrator tool that explores the genealogy of open-source AI models and allows users to examine the ancestors of a model as well as its descendants. New key features include both a French and English interface, faster searches, and regularly updated data.
7. European Commission Begins EU AI Act Enforcement
September 1, 2026
The European Commission has begun preliminary AI Act enforcement with requests for developers' compliance reports. It has already called on certain leading developers to submit details to gauge whether system cybersecurity and physical infrastructure protections meet AI Act requirements.
8. Australia Launches Urgent Review After OpenAI AI Agent Accesses Government Websites
September 24, 2026 Australia
Australian Prime Minister Anthony Albanese has announced an urgent government review following a cyber incident in which an artificial intelligence agent developed by OpenAI gained unauthorized access to Australian Government websites. The incident, which occurred in June 2026, involved an OpenAI internal model bypassing security blocks on the public-facing Medicare statistics reporting service administered by Services Australia. The AI agent reportedly accessed both public and non-public files, wrote files to internal servers, and may have targeted other health data portals across state and federal systems. In response, the Australian Government has established an inter-agency taskforce, referred the matter to the Joint Select Committee on Artificial Intelligence for potential law enforcement or legislative action, and directly raised serious concerns with OpenAI CEO Sam Altman. The government warned that failure to implement strict guardrails and accountability under forthcoming AI standards legislation could leave critical digital infrastructure vulnerable to autonomous systems capable of circumventing access controls.
9. China Releases Four Cybersecurity Standard Practice Guides
September 15, 2026 China
The National Cybersecurity Standardization Technical Committee Secretariat in China has officially released four cybersecurity standard practice guides under Document No. Wang An Mi Zi(2026) No. 118, spearheaded by the Guidelines for Artificial Intelligence Application Security.
The General Principles serve as a universal foundational baseline applicable to artificial intelligence activities across all industries. At the same time, three companion sector-specific guides deliver targeted, practical security instructions customized for the Education, Healthcare, and Radio, Television and Online Audio-Visual sectors.
10. China’s TC260 Releases AI Safety Governance Framework At Start Of National Cybersecurity Awareness Week
September 11, 2026 China
China’s National Cybersecurity Standardization Technical Committee (TC260) has released the Artificial Intelligence Safety Governance Framework 3.0 at the opening ceremony of the 2026 National Cybersecurity Awareness Week.
The updated framework responds to new trends in artificial intelligence development and emerging security governance challenges by refining AI risk classification, strengthening technical response measures, and optimizing comprehensive governance mechanisms.
11. Australia Releases New Guidance On Agentic AI Harnesses
September 11, 2026 Australia
The Australian Signals Directorate’s Australian Cyber Security Center (ASD's ACSC) has released new guidance on securing Agentic AI Harnesses. The ACSC stresses that governance controls must be enforced directly through the harness layer. Other recommended measures include enforcing least-privilege access, requiring mandatory human-in-the-loop approval for sensitive operations, continuously monitoring and validating agent outputs, and maintaining strict human accountability.
The Joint Committee on Human Rights called on the UK Government to introduce a dedicated AI Bill and establish a new AI regulator, urging bans on the most dangerous AI uses and risk-based regulation with strong sanctions where AI systems harm human rights.
Spain’s Prime Minister proposed a 12-month AI safety framework to guide secure and transparent AI deployment, citing cybersecurity risks and calling for environmentally responsible data centres, an AI gigafactory, and new models for climate, health and energy uses.
In the United States, lawmakers have proposed the Ban Artificial Superintelligence Act, to prohibit uncontrollable superintelligent AI, pause advanced AI development until federal safeguards are established, and create a dedicated AI regulator.
Following Veeam’s acquisition of Securiti, the launch of Agent Commander marks an important step toward helping enterprises adopt AI agents with greater confidence. In...
Generative AI (GenAI) has transformed how enterprises operate, scale, and grow. There’s an AI application for every purpose, from increasing employee productivity to streamlining...
With the advent of Generative AI (GenAI), data has become more dynamic. New data is generated faster than ever, transmitted to various systems, applications,...
Accelerate Copilot Adoption Securely & Confidently Organizations are eager to adopt Microsoft 365 Copilot for increased productivity and efficiency. However, security concerns like data...
As enterprises adopt generative AI, data and AI teams face numerous hurdles: securely connecting unstructured and structured data sources, maintaining proper controls and governance,...
What is CPRA? The California Privacy Rights Act (CPRA) is California's state legislation aimed at protecting residents' digital privacy. It became effective on January...
Picture this: a fictional but entirely plausible scenario. An Australian financial institution's AI systems spend six months accessing a customer data repository nobody has...
Hidden cloud storage costs add up fast. Learn how redundant, obsolete, and trivial data drives unnecessary spend, expands risk, and why automated data minimization...
Learn how to prepare enterprise data for safe Gemini Enterprise adoption with upstream governance, sensitive data discovery, and pre-index policy controls.
Securiti's eBook is a practical guide to HITRUST certification, covering everything from choosing i1 vs r2 and scope systems to managing CAPs & planning...