AI regulation, September 2026: the briefing

August was the month the AI Act grew an enforcer and the month the world's regulators mostly caught their breath after August 2. Three instruments in the register were missing or misdescribed, and all three now sit on their pages with citations. The next date that bites is October 1, 2026, in Connecticut.

What changed in August

On August 2 the EU's Article 50 transparency duties went into application and the Commission's AI Office formally began enforcing the act alongside national authorities, with its power to fine general-purpose model providers becoming applicable the same day. California's AI Transparency Act reached its operative date on purpose that morning too, making August 2 the first synchronized compliance date across the Atlantic. The rest of the month brought guidance, explainers, and the first compliance-program rewrites. No fines exist yet under the AI Act, whatever syndicated content claims.

Three corrections to the register

The largest is Connecticut. The register had recorded the state's comprehensive framework as stalled after the 2025 veto threat. It was wrong by June. SB 5, the Artificial Intelligence Responsibility and Transparency Act, Public Act 26-15, was signed May 27, 2026 and is the broadest state AI law enacted this year, covering automated employment decision tools, AI companions, frontier-developer whistleblowers, content provenance, AI-related layoff disclosures, and online safety for minors. Most of it takes effect October 1, 2026. The entry, the state tracker, the calendar, and the law index are updated.

Second, the Digital Omnibus on AI is no longer a political agreement. It was published in the Official Journal on July 24 as Regulation (EU) 2026/1744 and has been in force since July 27, which makes the high-risk deferrals to December 2027 and August 2028 binding text. The EU entry and the glossary now cite the regulation.

Third, the United States has a new AI executive order, Executive Order 14409. Signed June 2, "Promoting Advanced Artificial Intelligence Innovation and Security" asks agencies to design a voluntary framework under which developers of covered frontier models give the government up to 30 days of pre-release access for national-security vetting, and creates an AI cybersecurity clearinghouse. It is this administration's first frontier-model mechanism, and it lives on the federal entry.

What comes next

October 1, 2026: Connecticut's first wave, including the amendment that makes an algorithm no defense to a discrimination claim. December 2, 2026: the EU's marking grace period for pre-August generative systems ends and the ban on non-consensual intimate imagery generators takes effect. January 1, 2027: Colorado's replacement statute, New York's frontier law, Illinois' Safety Measures Act, Connecticut's AI companion rules, and Utah's AI provenance law all land on one day. The calendar carries every date through 2028.

Watchlist, unverified

Four threads are tracked but not yet filed, because each rests on a single source: South Korea moving to ban unauthorized digital clones of faces and voices through competition law; the Philippines classifying photorealistic synthetic media as biometric data; California's end-of-session AI bills, which sit on the governor's desk until September 30; and the state chatbot-law wave, with roughly a hundred bills introduced across more than thirty legislatures this year. Each gets an entry when a primary text or two independent legal analyses confirm it.

Since publication

Updated September 24, 2026. California's governor signed the AI auditor bills, SB 813 and AB 1405, on September 9 and Adam's Law on companion chatbots on September 10. On September 16 he signed SB 1050, which requires ads to disclose synthetic performers from January 1, 2027, and on September 18 he ordered a plan for frontier-model oversight, including an emergency shutoff, due November 16. In Congress, Senate talks on a federal AI framework stalled, and no federal bill is expected to reach a floor vote before the November midterms. The California and federal entries and the calendar carry the details. Updated September 28, 2026: California named the four experts who will write the executive order's plan; Illinois created an AI Cabinet by executive order; Virginia's governor set up an AI task force and asked Congress not to preempt the states; Australia, which shelved mandatory guardrails in December, put mandatory standards for data centers and frontier developers out for consultation and tied a review of an OpenAI agent incident to coming AI standards legislation; and China published new enforcement cases under the content-labeling rules. Updated October 2, 2026: California's governor signed every AI bill the register was tracking by the September 30 deadline, including SB 1000, which removed the AI Transparency Act's user threshold with immediate effect, and SB 947 on automated discipline and termination, and vetoed three; the Connecticut CART Act's first wave took effect October 1; and a federal executive order of September 29 renamed AI 'super intelligence' in executive-branch documents without changing any rule. Updated October 12, 2026: Spain's Cortes were dissolved on October 6 for a November 29 election, which ended the AI governance bill and both deepfake bills; the EU AI Office said it has obtained serious incident reports from frontier developers after loss-of-control incidents; the UK Information Commission opened a call for evidence on agentic AI; and Colorado posted revised ADMT and chatbot rules ahead of its October 26 hearing. Updated October 19, 2026: the EU published the reference of its first harmonized standard under the AI Act, EN 18286 on quality management systems; the UK said it will look at extending its cyber resilience regime to AI incidents; Australia's parliamentary AI committee urged incident reporting and embedded evaluators for frontier labs; and Mexican senators filed a general AI law. The register has also corrected this briefing's dates. Peru's first sector deadline fell in September 2026, because the regulation's one-year clock ran from September 10, 2025, and Utah's AI provenance law, HB 276, joins the January 1, 2027 list.

What we refused to believe

Two widely syndicated claims this month were fabricated: that a UK AI bill cleared the House of Commons with Royal Assent expected in October, and that the AI Office had already issued tens of millions of euros in fines. Parliament's own tracker and the Commons Library disprove the first; the second appears nowhere credible. Both came from content mills producing "regulation roundups" at volume. That is the environment this register exists in, and it is why every entry links to primary text.