Global Tech Policy Tracker — 2026-09-13

Top Story

1 sources

cdt.org

cdt.org

US Congress Remains Deadlocked on Federal AI Safety Framework

As of mid-September 2026, the United States still lacks a comprehensive federal AI Act, with legislative efforts facing significant headwinds in both chambers of Congress. Despite growing momentum driven by whistleblower warnings about risks to humanity, lawmakers have been unable to reach a consensus on key legislation. The primary obstacle lies in the disagreement over liability: senators are struggling to agree on language that would hold AI developers accountable for harms caused by their systems. The Klobuchar-Thune AI safety bill, which had garnered some bipartisan interest, faces an impasse over these specific accountability mechanisms.

This federal vacuum has created a fragmented regulatory landscape. While the White House has issued executive orders aimed at eliminating state-law obstruction of national AI policy, states like California continue to push forward with their own regulations. The lack of a unified federal standard means that companies must navigate a patchwork of state laws, creating compliance challenges for national and global operators. House Minority Leader Hakeem Jeffries has convened a Democrat-only AI commission to formulate policy recommendations, but there is little hope among lawmakers that meaningful legislation will pass this year.

The uncertainty is compounded by the influence of the tech lobby, which has successfully resisted many state-level attempts to regulate automated decision systems. However, the "landscape has changed dramatically" recently, with states defying tech industry pressure to pass their own rules. This trend suggests that if Congress fails to act, the US will continue to operate under a decentralized model of AI governance, potentially diverging significantly from the EU’s centralized approach.

New Legislation & Regulatory Actions

United States (California): Governor Newsom Signs New AI Package

• What happened: On September 11, 2026, California Governor Gavin Newsom signed a flurry of AI-related bills into law. These measures include child online protections and an "IVO framework" (Integrity, Verification, Oversight) for AI systems.
• Who it affects: Tech companies operating in California, particularly those deploying generative AI and social media platforms, must now comply with stricter oversight and verification requirements.
• Status: Enacted (September 11, 2026).
• Why it matters: California often sets the de facto national standard for tech regulation. These laws add immediate compliance burdens for companies already navigating a complex web of state regulations, further isolating the federal government's hands-off approach.

European Union: High-Risk AI Rules Delayed to 2027

• What happened: Following significant pushback from Big Tech, the European Commission proposed delaying the enforcement of stricter rules on "high-risk" AI applications until December 2027, originally scheduled for August 2026.
• Who it affects: Developers and deployers of AI systems in sectors such as healthcare, law enforcement, and critical infrastructure within the EU.
• Status: Proposed delay (Digital Omnibus), subject to debate and votes by European countries.
• Why it matters: This delay provides companies with more time to prepare for compliance but also highlights the tension between regulatory ambition and industry capacity. It signals that even in the EU, the most stringent parts of the AI Act face implementation hurdles.

Global: Shift from Guidance to Enforcement

• What happened: Regulatory bodies worldwide are transitioning from issuing voluntary guidelines to active enforcement. In the EU, the AI Office is operational, and member states are designating national supervisory authorities.
• Who it affects: All organizations deploying AI in regulated jurisdictions, who must now demonstrate documented controls and technical safeguards rather than relying on aspirational ethics statements.
• Status: Under review/enforcement phase (2026).
• Why it matters: The era of "soft law" is ending. Companies must now invest in tangible compliance infrastructure to avoid penalties, which can reach up to €35 million or 7% of global annual turnover in the EU.

Enforcement & Penalties

• Italy → OpenAI: The Italian data protection authority fined OpenAI €15 million for GDPR violations related to training data processing. This action establishes that regulators expect documented controls and evidence of compliance, not just theoretical safeguards.

• EU Member States → AI Operators: With penalty provisions now "live," member states are laying down rules for enforcement. Penalties for serious violations under the EU AI Act can be up to €35 million or 7% of global annual turnover, exceeding GDPR ceilings.

Industry Response

• Tech Lobby: The technology industry has successfully lobbied against many state-level automated decision system (ADS) bills in the US, leading to a lack of momentum in regulating consequential decision-making technologies. However, this strategy is facing increasing resistance from state lawmakers and attorneys general.

• Big Tech (EU): Major technology firms exerted significant pushback against the EU's original timeline for high-risk AI rules, contributing to the proposed delay until December 2027. This demonstrates the industry's ability to shape regulatory timelines through lobbying efforts.

• Startups and SMEs: In response to the complex global landscape, startups and small-to-medium enterprises (SMEs) are increasingly focusing on "compliance-as-a-service" solutions. The EU AI Act explicitly requires member states to consider the economic viability of SMEs when imposing penalties, prompting a shift toward lighter-touch compliance frameworks for smaller entities.

Region Scorecard

Analysis: What This Means

• For AI Developers: The lack of a federal US standard means you must design for the strictest state laws (likely California) and the EU's emerging GPAI (General Purpose AI) rules. Build modular compliance systems that can adapt to different jurisdictional requirements.
• For Startups: Leverage SME provisions in the EU AI Act, which allow for reduced compliance burdens. However, do not ignore basic GDPR and data provenance requirements, as seen in the OpenAI fine. Document your training data sources rigorously.
• For Enterprises: The shift from guidance to enforcement in the EU and US states requires immediate investment in internal AI governance teams. Relying on external counsel alone is no longer sufficient; you need technical safeguards that can be audited by regulators.
• For End Users: Expect more transparency requirements from platforms, especially regarding child safety and AI-generated content verification, driven by new California laws.

What to Watch Next Week

• US Congressional Hearings: Monitor upcoming testimony from AI experts and whistleblowers, which may pressure legislators to break the current stalemate on the Klobuchar-Thune bill.
• EU Digital Omnibus Votes: Watch for European Parliament and Council debates on the proposed delay of high-risk AI rules, which could solidify or reverse the timeline.
• State-Level Bill Introductions: Track new ADS bills introduced in New York and Illinois, as states continue to fill the federal vacuum.