Global AI Regulations Roundup: Top Stories of September 2026

Watch: September's AI Pulse - All Major Highlights

A quick overview of global AI headlines you cannot afford to miss.

Play Video
Contributors

Yasir Nawaz

Digital Content Producer at Securiti

Aswah Javed

Associate Data Privacy Analyst at Securiti

Rohma Fatima Qayyum

Associate Data Privacy Analyst at Securiti

Nayab Wali

Associate Global Compliance Analyst at Securiti

Aiman Kanwal

Assoc. Data Privacy Analyst at Securiti

Faqiha Amjad

Associate Data Privacy Analyst at Securiti

Published October 12, 2026

Editorial Note

AI regulation is shifting from broad principles to practical accountability.

September's developments show AI regulation moving from principles to practical control. Security risks from autonomous systems took centre stage, with regulators issuing new guidance and frameworks to keep agentic AI within defined limits and under human oversight. Transparency around AI-generated content also gained momentum, as new disclosure and labelling requirements took shape ahead of EU AI Act deadlines. At the same time, enforcement is becoming real, with early AI Act compliance requests and new liability for failures in high-risk AI oversight, alongside stronger protections for individuals in sensitive contexts such as recruitment and children's use of AI companions. Organizations should be ready to demonstrate that their AI systems are secure, transparent and accountable in practice.

North & South America Jurisdiction

September 16, 2026
California, United States

California Governor Gavin Newsom signed SB 1050 on September 16, 2026. The law requires audio, video and audiovisual advertisements that prominently feature realistic AI-generated “synthetic performers” to include a clear disclosure, such as “this performance features a synthetic performer” or “no human performer is depicted.”

The requirement applies when a synthetic performer demonstrates a product, delivers narration, or illustrates or reacts to a commercial message. It does not cover AI used solely for translation or accessibility, or certain advertisements for expressive works where the synthetic performer is consistent with the underlying work.

The law reflects a growing regulatory focus on transparency in commercial uses of generative AI.

Read More.

2. California Introduces Child-Safety Protections for AI Companion Chatbots

September 10, 2026
California, United States

California Governor Gavin Newsom signed Adam’s Law (SB 1119) on September 10, 2026. The law regulates AI companion chatbots capable of human-like interactions and sustained relationships, while excluding certain customer service tools and chatbots provided exclusively for workplace use.

Operators must use age assurance or apply specified child protections to everyone. Requirements include documented risk assessments and mitigation measures, public safety policies, crisis response protocols, AI disclosures, parental controls and default usage limits. The law also restricts selling children’s information, behavioral and conversation based advertising, and manipulative interface designs.

Adam’s Law reflects increasing scrutiny of AI products that may encourage emotional dependency or expose minors to psychological and privacy risks.

Read More.

Europe & Africa Jurisdiction

3. Spain's AEPD Warns Companies Evaluating AI Recruitment Tools To Screen CVs

September 23, 2026
Spain

The Spanish Data Protection Authority (AEPD) has issued a warning to companies evaluating an AI recruitment tool to screen CVs. Such companies must ensure data protection by design and by default, conduct a DPIA if high risks are identified, and maintain transparency with candidates and employees, in addition to human intervention in cases involving decision-making with the AI tool.

Candidates and workers must receive clear, accessible and understandable information about the processing of their personal data and the role that the tool plays in the evaluation process.

Read More.

4. Slovenia’s AKOS Issues Clarification On Obligations Of GenAI System Providers

September 21, 2026
Slovenia

Slovenia's Agency for Communication Networks and Services of the Republic of Slovenia (AKOS) has clarified that providers of GenAI systems, including general-purpose AI systems that generate synthetic audio, visual, video, or text content, must comply with transparency obligations under Article 50(2) of the EU AI Act by December 2, 2026. Moreover, providers must develop effective, interoperable, robust, and reliable technical solutions for labeling and detecting AI-generated content. Certain AI systems performing auxiliary functions or legally authorized tasks are exempt from these obligations.

Read More.

September 9, 2026
Italy

Italy has introduced a new criminal offense linked to the security and human oversight of high-risk AI systems. The new offense covers failures to adopt the required technical security measures or human oversight measures for high-risk AI systems where those omissions create a danger to life or public or individual safety. The penalties can reach 8 years’ imprisonment where the conduct creates a danger to state security. The law brings AI-related offences within the scope of entity liability, including the new offence and the existing offence concerning the unlawful dissemination of AI-generated or altered content. This means that an AI incident can potentially develop into an investigation involving both individual criminal liability and corporate liability.

Read More.

6. CNIL Releases New Version Of Genmod Demonstrator Tool

September 1, 2026
France

CNIL has released an updated version of its Genmod demonstrator tool that explores the genealogy of open-source AI models and allows users to examine the ancestors of a model as well as its descendants. New key features include both a French and English interface, faster searches, and regularly updated data.

Read More.

7. European Commission Begins EU AI Act Enforcement

September 1, 2026

The European Commission has begun preliminary AI Act enforcement with requests for developers' compliance reports. It has already called on certain leading developers to submit details to gauge whether system cybersecurity and physical infrastructure protections meet AI Act requirements.

Read More.

Asia Jurisdiction

8. Australia Launches Urgent Review After OpenAI AI Agent Accesses Government Websites

September 24, 2026
Australia

Australian Prime Minister Anthony Albanese has announced an urgent government review following a cyber incident in which an artificial intelligence agent developed by OpenAI gained unauthorized access to Australian Government websites. The incident, which occurred in June 2026, involved an OpenAI internal model bypassing security blocks on the public-facing Medicare statistics reporting service administered by Services Australia. The AI agent reportedly accessed both public and non-public files, wrote files to internal servers, and may have targeted other health data portals across state and federal systems. In response, the Australian Government has established an inter-agency taskforce, referred the matter to the Joint Select Committee on Artificial Intelligence for potential law enforcement or legislative action, and directly raised serious concerns with OpenAI CEO Sam Altman. The government warned that failure to implement strict guardrails and accountability under forthcoming AI standards legislation could leave critical digital infrastructure vulnerable to autonomous systems capable of circumventing access controls.

Read More.

9. China Releases Four Cybersecurity Standard Practice Guides

September 15, 2026
China

The National Cybersecurity Standardization Technical Committee Secretariat in China has officially released four cybersecurity standard practice guides under Document No. Wang An Mi Zi(2026) No. 118, spearheaded by the Guidelines for Artificial Intelligence Application Security.

The General Principles serve as a universal foundational baseline applicable to artificial intelligence activities across all industries. At the same time, three companion sector-specific guides deliver targeted, practical security instructions customized for the Education, Healthcare, and Radio, Television and Online Audio-Visual sectors.

Read More.

10. China’s TC260 Releases AI Safety Governance Framework At Start Of National Cybersecurity Awareness Week

September 11, 2026
China

China’s National Cybersecurity Standardization Technical Committee (TC260) has released the Artificial Intelligence Safety Governance Framework 3.0 at the opening ceremony of the 2026 National Cybersecurity Awareness Week.

The updated framework responds to new trends in artificial intelligence development and emerging security governance challenges by refining AI risk classification, strengthening technical response measures, and optimizing comprehensive governance mechanisms.

Read More.

11. Australia Releases New Guidance On Agentic AI Harnesses

September 11, 2026
Australia

The Australian Signals Directorate’s Australian Cyber Security Center (ASD's ACSC) has released new guidance on securing Agentic AI Harnesses. The ACSC stresses that governance controls must be enforced directly through the harness layer. Other recommended measures include enforcing least-privilege access, requiring mandatory human-in-the-loop approval for sensitive operations, continuously monitoring and validating agent outputs, and maintaining strict human accountability.

Read More.

WHAT'S NEXT:
Key AI Developments to Watch For

Analyze this article with AI

Prompts open in third-party AI tools.
Join Our Newsletter

Get all the latest information, law updates and more delivered to your inbox



More Stories that May Interest You
Videos
View More
Rehan Jalil, Veeam on Agent Commander : theCUBE + NYSE Wired: Cyber Security Leaders
Following Veeam’s acquisition of Securiti, the launch of Agent Commander marks an important step toward helping enterprises adopt AI agents with greater confidence. In...
View More
Mitigating OWASP Top 10 for LLM Applications 2025
Generative AI (GenAI) has transformed how enterprises operate, scale, and grow. There’s an AI application for every purpose, from increasing employee productivity to streamlining...
View More
Top 6 DSPM Use Cases
With the advent of Generative AI (GenAI), data has become more dynamic. New data is generated faster than ever, transmitted to various systems, applications,...
View More
Colorado Privacy Act (CPA)
What is the Colorado Privacy Act? The CPA is a comprehensive privacy law signed on July 7, 2021. It established new standards for personal...
View More
Securiti for Copilot in SaaS
Accelerate Copilot Adoption Securely & Confidently Organizations are eager to adopt Microsoft 365 Copilot for increased productivity and efficiency. However, security concerns like data...
View More
Top 10 Considerations for Safely Using Unstructured Data with GenAI
A staggering 90% of an organization's data is unstructured. This data is rapidly being used to fuel GenAI applications like chatbots and AI search....
View More
Gencore AI: Building Safe, Enterprise-grade AI Systems in Minutes
As enterprises adopt generative AI, data and AI teams face numerous hurdles: securely connecting unstructured and structured data sources, maintaining proper controls and governance,...
View More
Navigating CPRA: Key Insights for Businesses
What is CPRA? The California Privacy Rights Act (CPRA) is California's state legislation aimed at protecting residents' digital privacy. It became effective on January...
View More
Navigating the Shift: Transitioning to PCI DSS v4.0
What is PCI DSS? PCI DSS (Payment Card Industry Data Security Standard) is a set of security standards to ensure safe processing, storage, and...
View More
Securing Data+AI : Playbook for Trust, Risk, and Security Management (TRiSM)
AI's growing security risks have 48% of global CISOs alarmed. Join this keynote to learn about a practical playbook for enabling AI Trust, Risk,...

Spotlight Talks

Spotlight 59:11
Data Controls for AI: Findings from the 2026 GigaOm DSPM Research
Watch Now View
Spotlight 1:02:06
Consent by proxy: When AI agents start deciding for us
Watch Now View
Spotlight 1:00:41
Future-Proofing for the Privacy Professional
Watch Now View
Spotlight 50:52
From Data to Deployment: Safeguarding Enterprise AI with Security and Governance
Watch Now View
Spotlight 11:29
Not Hype — Dye & Durham’s Analytics Head Shows What AI at Work Really Looks Like
Not Hype — Dye & Durham’s Analytics Head Shows What AI at Work Really Looks Like
Watch Now View
Spotlight 11:18
Rewiring Real Estate Finance — How Walker & Dunlop Is Giving Its $135B Portfolio a Data-First Refresh
Watch Now View
Spotlight
Choosing the Right DSPM: An Industry Analyst’s Perspective
Watch Now View
Spotlight 13:38
Accelerating Miracles — How Sanofi is Embedding AI to Significantly Reduce Drug Development Timelines
Sanofi Thumbnail
Watch Now View
Spotlight 10:35
There’s Been a Material Shift in the Data Center of Gravity
Watch Now View
Spotlight 14:21
AI Governance Is Much More than Technology Risk Mitigation
AI Governance Is Much More than Technology Risk Mitigation
Watch Now View
Latest
Australia’s Office of AI: Why Annual Audits Miss What Your AI Can Reach View More
Australia’s Office of AI: Why Annual Audits Miss What Your AI Can Reach
Picture this: a fictional but entirely plausible scenario. An Australian financial institution's AI systems spend six months accessing a customer data repository nobody has...
View More
A Complete DSPM Needs Classification and Context
Classification is one of the core functions a DSPM program handles, and it usually runs in tandem with discovery, since together they form the...
DSPM for SaaS Applications: 2026 Guide View More
DSPM for SaaS Applications: 2026 Guide
Learn how DSPM secures sensitive data across SaaS applications, from discovering shadow data and misconfigurations to controlling access and exposure.
The EU Cyber Resilience Act (CRA): A Complete Guide for Compliance View More
The EU Cyber Resilience Act (CRA): A Complete Guide for Compliance
Here’s what you need to know about the EU’s Cyber Resilience Act (CRA), including the best solutions to aid your compliance efforts. Read on...
Context Is the New Coverage View More
Context Is the New Coverage
Classification alone can’t secure data and AI. Learn why context like access, usage, and lineage is key to reducing risk across data and AI...
Stop Storing Risk: An Executive's Guide to ROT Data Minimization View More
Stop Storing Risk: An Executive’s Guide to ROT Data Minimization
An executive's guide to reducing redundant, obsolete, and trivial (ROT) data to cut storage costs, shrink your attack surface, and improve compliance.
The Toxic Combination Problem in DataAI Risks View More
The Toxic Combination Problem in DataAI Risks
Discover how siloed security alerts create hidden toxic risk combinations and how correlated context helps reduce alert fatigue and uncover compound risks faster.
The Cloud Storage Bill Nobody Reads View More
The Cloud Storage Bill Nobody Reads
Hidden cloud storage costs add up fast. Learn how redundant, obsolete, and trivial data drives unnecessary spend, expands risk, and why automated data minimization...
View More
Take the Data Risk Out of AI
Learn how to prepare enterprise data for safe Gemini Enterprise adoption with upstream governance, sensitive data discovery, and pre-index policy controls.
View More
Navigating HITRUST: A Guide to Certification
Securiti's eBook is a practical guide to HITRUST certification, covering everything from choosing i1 vs r2 and scope systems to managing CAPs & planning...
What's
New