One entry per development: what happened, who it reaches, and the source it was checked against. Upcoming fixed deadlines are marked with a dashed border. The log is re-checked on the first of each month, and the date at the top shows when it was last reviewed.
Feeds (Atom): All changes · Banks and credit unions · Private equity and asset managers · Hospitals and health systems · Insurers · Employers and HR. Data: updates.json.
Businesses that meet the CCPA thresholds and use ADMT, meaning technology that replaces or substantially replaces human decisionmaking, for significant decisions must comply from January 1, 2027, including pre-use notice, access, and opt-out rights, with exceptions to the opt-out such as a human appeal. Significant decisions include hiring, allocation or assignment of work, compensation, promotion, demotion, suspension, and termination.
Source: California Privacy Protection Agency, text of regulations (11 CCR 7001, 7200, 7220, 7221) · Guide: US state AI laws
Developers and deployers of automated decision-making technology that materially influences consequential decisions, including financial or lending services, insurance, housing, health-care services, and employment, must meet documentation, notice, and adverse-decision explanation duties, and, after an adverse outcome, consumers may request correction and human review (the latter to the extent commercially reasonable). Among the carve-outs, an insurer subject to C.R.S. 10-3-1104.9 is in compliance with the law in the practice of insurance (C.R.S. 6-1-1708(1)). HIPAA covered entities, and their business associates for services rendered to them, are exempt from C.R.S. 6-1-1701 to 6-1-1706 except for employment decisions, and a health care provider gets that exemption only if it operates from a location in Colorado; covered entities must still give patients a general notice of advanced technology use and make specific disclosures when ADMT determines eligibility for financial assistance (C.R.S. 6-1-1708(3)). A creditor that is required to provide, and provides, an ECOA notice complies with the law's notice and disclosure duties for the same decision if that notice also meets them (C.R.S. 6-1-1704(6)). A federal court order in X.AI LLC v. Weiser bars the Colorado Attorney General from enforcing the law, including by investigation, for violations occurring on or before 14 days after the court rules on xAI's preliminary injunction motion; xAI had not filed that motion as of October 21, 2026.
Source: SB 26-189, Session Laws 2026, Chapter 131, Colorado General Assembly · Guide: US state AI laws
Under the Digital Omnibus, high-risk duties for stand-alone Annex III systems apply from December 2, 2027. They include AI that evaluates the creditworthiness of natural persons or establishes their credit score (fraud detection excluded) and AI for risk assessment and pricing in relation to natural persons in life and health insurance (Annex III points 5(b) and 5(c)).
Source: Regulation (EU) 2026/1744, EUR-Lex · Guide: EU AI Act compliance
Regulation (EU) 2026/1744 sets December 2, 2027 as the date from which the AI Act's high-risk duties apply to systems listed in Annex III. Annex III point 4 covers AI for recruitment or selection, decisions on promotion or termination, allocating tasks based on individual behaviour or personal traits, and monitoring or evaluating performance. Article 26(7) requires employer deployers to inform workers' representatives and affected workers before use.
Source: Regulation (EU) 2026/1744, EUR-Lex · Guide: EU AI Act compliance
In National Fair Housing Alliance v. CFPB, No. 1:26-cv-01820, plaintiffs moved for summary judgment (ECF No. 28) against the rule removing disparate impact from the CFPB's reading of ECOA. The docket shows no motion for a preliminary injunction, so the rule remains in effect; under the July 24, 2026 scheduling order, briefing runs to January 12, 2027.
Source: Docket, National Fair Housing Alliance v. CFPB, No. 1:26-cv-01820 (D.D.C.), CourtListener RECAP · Guide: AI in financial services
Proposed non-binding guidance would replace the 2023 interagency third-party guidance and ask institutions to prioritize relationships by the magnitude and likelihood of harm. Comments are due November 16, 2026.
Source: OCC Bulletin 2026-46
Regulation (EU) 2026/1744 moves stand-alone high-risk duties to December 2, 2027 and high-risk AI in regulated products to August 2, 2028. Prohibitions and general-purpose AI model duties are not delayed. Article 50 transparency duties apply from August 2, 2026, with a grace period to December 2, 2026 for the Article 50(2) marking duty on generative systems placed on the market before August 2, 2026.
Source: Regulation (EU) 2026/1744, EUR-Lex · Guide: EU AI Act compliance
Working group materials say company surveys stay open through September 30, versions 5.0 and 6.0 will be exposed for comment, and version 7.0 will be presented at the Fall National Meeting for adoption consideration. It is not adopted.
Source: NAIC Big Data and AI (H) Working Group materials, July 22, 2026 · Guide: AI in insurance
The rule states that ECOA does not authorize disparate impact liability and deletes the effects test language from Regulation B. The adverse action reasons requirement in 12 CFR 1002.9 is unchanged.
Source: Federal Register, 91 FR 21620 · Guide: AI in financial services
Before a health care insurer denies a claim or a prior authorization that involves medical necessity, a medical director must individually review it, exercise independent medical judgment, and not rely solely on recommendations from any other source. The act is effective from and after June 30, 2026. The law does not mention AI.
Source: Laws 2025, Chapter 165 (HB 2175), Arizona Legislature · Guide: AI in health care
Ruling on Workday's motion to dismiss the Third Amended Complaint, the court kept the California FEHA claims, finding the plaintiffs adequately alleged that Workday screened applications from its California headquarters and that, as an alleged agent, Workday would be directly rather than derivatively liable under FEHA; it kept an amended ADA claim and dismissed one plaintiff's newly added Title VII race claim, according to Duane Morris.
Source: Duane Morris Class Action Defense Blog, June 24, 2026 · Guide: AI in hiring and HR
The Office of Legal Counsel advised the EEOC that its Title VII disparate impact guidelines are unconstitutional and read the business-necessity defense to require only that a practice rationally serve a valid business purpose. The opinion states that it does not address disparate impact liability under the ADEA.
Source: Office of Legal Counsel, Constitutionality of Disparate-Impact Liability Under Title VII (slip opinion), June 9, 2026 · Guide: AI in hiring and HR
Smaller covered institutions, including advisers with less than $1.5 billion in assets under management, must have an incident response program, policies to oversee service providers and ensure they notify the firm of a breach within 72 hours, and procedures to notify affected individuals as soon as practicable and within 30 days unless the firm reasonably determines that substantial harm or inconvenience is not likely.
Source: Baker Donelson, Regulation S-P: June 3, 2026 Compliance Deadline for Smaller Investment Advisers · Guide: AI in financial services
The notice implements the October 22, 2025 vacatur of provisions to the extent they expanded sex discrimination to include gender identity. It states that the other provisions of the 2024 rule remain in force. 45 CFR 92.210 is not among the provisions the notice lists as vacated.
Source: Federal Register · Guide: AI in health care
The Department postponed its rulemaking, including the June 10 hearing, and withdrew the proposed notice rules published May 15, 2026. The statute, in effect since January 1, 2026, continues to apply without implementing rules.
Source: Ogletree Deakins, June 4, 2026 · Guide: AI in hiring and HR
A voluntary certification for U.S. healthcare organizations that assesses AI governance and processes; it does not validate or certify individual AI products. ASC Focus reports the June 1, 2026 launch date.
Source: ASC Focus (Ambulatory Surgery Center Association) · Guide: AI governance frameworks
An industry letter to DFS-regulated entities warned that frontier AI models can amplify the potency, scale, and speed of identifying vulnerabilities. It imposes no new requirements and points back to Part 500 and the October 2024 AI letter.
Source: NYDFS industry letter · Guide: AI in financial services
The replacement regulates automated decision-making technology in consequential decisions from January 1, 2027, with documentation, notice, and explanation duties and, after an adverse outcome, a consumer right to request human review to the extent commercially reasonable. The enacted text contains no impact assessment or risk management program duty; the 2024 law (SB 24-205) required both. Among the carve-outs, an insurer subject to C.R.S. 10-3-1104.9 is in compliance with the law in the practice of insurance (C.R.S. 6-1-1708(1)). HIPAA covered entities, and their business associates for services rendered to them, are exempt from C.R.S. 6-1-1701 to 6-1-1706 except for employment decisions, and a health care provider gets that exemption only if it operates from a location in Colorado; covered entities must still give patients a general notice of advanced technology use and make specific disclosures when ADMT determines eligibility for financial assistance (C.R.S. 6-1-1708(3)). A creditor that is required to provide, and provides, an ECOA notice complies with the law's notice and disclosure duties for the same decision if that notice also meets them (C.R.S. 6-1-1704(6)). A federal court order in X.AI LLC v. Weiser bars the Colorado Attorney General from enforcing the law, including by investigation, for violations occurring on or before 14 days after the court rules on xAI's preliminary injunction motion; xAI had not filed that motion as of October 21, 2026.
Source: SB 26-189, Session Laws 2026, Chapter 131, Colorado General Assembly · Guide: US state AI laws
In X.AI LLC v. Weiser, No. 1:26-cv-01515, a minute order (ECF No. 24) bars the Colorado Attorney General from initiating enforcement, including investigations, for violations of SB 24-205, or of legislation replacing or amending it enacted in the 2026 session, that occur on or before 14 days after the court rules on xAI's preliminary injunction motion. xAI must file that motion within 28 days after final adoption of rules implementing the law; the docket showed no motion as of October 21, 2026.
Source: Docket, X.AI LLC v. Weiser, No. 1:26-cv-01515 (D. Colo.), CourtListener RECAP · Guide: US state AI laws
Revised guidance supersedes SR 11-7 and SR 21-8, is expected to be most relevant to banking organizations with more than $30 billion in total assets, and leaves generative and agentic AI out of scope per the OCC. The NCUA did not join.
Source: Federal Reserve SR 26-2 · Guide: AI in financial services
California, Colorado, Connecticut, Florida, Iowa, Louisiana, Maryland, Pennsylvania, Rhode Island, Vermont, Virginia, and Wisconsin piloted the exam tool, with the pilot running through September 2026.
Source: Fenwick, NAIC Expands AI Systems Evaluation Tool Pilot Program to 12 States (March 9, 2026) · Guide: AI in insurance
The January 29, 2026 guidance supersedes the version issued January 6, 2026. FDA describes the change as a minor correction deleting a reference to time-critical decision-making on pages 13 and 14 for alignment with the January 6 update. The guidance says FDA does not consider software functions intended for a critical, time-sensitive task or decision to meet Criterion 4.
Source: U.S. Food and Drug Administration · Guide: AI in health care
Makes it unlawful under the Cartwright Act to use or distribute a common pricing algorithm as part of a contract, combination, or conspiracy in restraint of trade, or while coercing another person to adopt its recommended price or commercial term. Reaches portfolio companies using shared pricing tools.
Source: AB-325 Cartwright Act: violations, California Legislative Information · Guide: AI pricing and antitrust
Traditional Medicare providers in New Jersey, Ohio, Oklahoma, Texas, Arizona, and Washington may request prior authorization for listed services or face pre-payment medical review. CMS states that all recommendations for non-payment are determined by appropriately licensed clinicians; the model runs through December 31, 2031.
Source: Centers for Medicare & Medicaid Services · Guide: AI in health care
Providers must disclose AI use in a service or treatment to the patient or personal representative by the date it is first provided, or, in an emergency, as soon as reasonably possible (Sec. 552.051(f)).
Source: Texas Legislature · Guide: US state AI laws
An AI-based algorithm may not be the sole basis of a utilization review agent's decision to deny, delay, or modify services based in whole or in part on medical necessity. Agents must disclose AI use to the department, network providers, enrollees, and on their public website.
Source: LB 77 slip law, Nebraska Legislature · Guide: AI in health care
The amended Human Rights Act makes it a civil rights violation for an employer to use AI in recruitment, hiring, promotion, renewal of employment, selection for training or apprenticeship, discharge, discipline, tenure, or the terms, privileges, or conditions of employment in a way that has the effect of discriminating, bars zip codes as a proxy, and makes failure to give notice a violation.
Source: Public Act 103-0804, Illinois General Assembly · Guide: AI in hiring and HR
The proposed rule would remove the source attribute and predictive DSI risk management requirements for certified health IT developers. Comments closed February 27, 2026; not final as of October 2026.
Source: Federal Register · Guide: AI in health care
The page collects resources for evaluating AI and AI vendors, presented as tools rather than new regulatory requirements, and ties AI vendor oversight to existing third-party letters 07-CU-13 and 01-CU-20.
Source: Troutman Pepper Locke, Consumer Financial Services Law Monitor
The report's generative AI section describes governance, testing, and monitoring practices for broker-dealers using the technology and discusses emerging risks from AI agents. Relevant to broker-dealers affiliated with banks, sponsors, and asset managers.
Source: FINRA, 2026 Annual Regulatory Oversight Report: Generative AI · Guide: AI in financial services
Larger covered institutions, including advisers with at least $1.5 billion in assets under management, must comply with the incident response, customer notice, and service provider oversight provisions adopted May 16, 2024.
Source: Baker Donelson, Regulation S-P: June 3, 2026 Compliance Deadline for Smaller Investment Advisers · Guide: AI in financial services
DCWP had reviewed 32 companies' posted bias audits and found one issue; the Comptroller's team found at least 17 potential problems in the same 32. DCWP generally agreed with the recommendations while disputing some findings. An audit of the regulator, not a penalty on any employer.
Source: Office of the New York State Comptroller, audit report 2024-N-6 (PDF) · Guide: AI in hiring and HR
The proposed final judgment limits sharing of competitors' nonpublic data through RealPage, restricts model training to data at least 12 months old, and bars models that treat geography more narrowly than at a state level. No money damages.
Source: Proposed Final Judgment, United States v. RealPage, Inc. · Guide: AI pricing and antitrust
The Division will review for accuracy registrants' representations about their AI capabilities and assess policies and procedures to monitor or supervise AI use, including in fraud prevention and detection, back-office operations, AML, and trading functions, as applicable.
Source: SEC, Fiscal Year 2026 Examination Priorities · Guide: AI in financial services
The court vacated provisions to the extent they expanded Title IX's definition of sex discrimination to include gender identity. HHS later stated that the rule's other provisions remain in force.
Source: Federal Register (HHS notice describing the order) · Guide: AI in health care
Amended Regulation 10-1-1 (3 CCR 702-10) extends the SB21-169 governance framework to private passenger auto and health benefit plan insurers. Law firm summaries report that full compliance and the first annual report were due July 1, 2026.
Source: Faegre Drinker, Colorado Division of Insurance Expands AI-Related Governance (September 2, 2025) · Guide: AI in insurance
OCC Bulletin 2025-26 states that the OCC's model risk guidance does not require community banks to perform annual model validation and lets them tailor validation frequency and scope to risk.
Source: OCC Bulletin 2025-26 · Guide: AI in financial services
Applies to carriers, and to PBMs and private review agents working for them, that use AI, algorithms, or other software in utilization review. Tools must rest on individual clinical information, not solely a group dataset; quarterly reports must state whether a tool was used in adverse decisions.
Source: Chapter 747 (HB 820), Maryland General Assembly · Guide: AI in health care
The regulations make clear that using an automated-decision system may violate California law if it harms applicants or employees based on protected characteristics, require employment records, including automated-decision data, to be kept at least four years, and add definitions of key terms such as automated-decision system and agent.
Source: California Civil Rights Department, June 30, 2025 · Guide: AI in hiring and HR
Seven elements, from governance structures to education and training. Polsinelli describes the guidance as voluntary.
Source: Polsinelli · Guide: AI governance frameworks
A practitioner who uses AI for diagnostic purposes must review all AI-created records consistent with Texas Medical Board standards and disclose the use to patients. Covered entities must keep electronic health records under their control physically in the U.S. or a U.S. territory for storage on or after January 1, 2026.
Source: Texas Legislature · Guide: AI in health care
A utilization review agent may not use an automated decision system to make, wholly or partly, an adverse determination; administrative support and fraud detection uses are allowed. Applies to plans delivered, issued, or renewed on or after January 1, 2026.
Source: S.B. No. 815, enrolled, Texas Legislature · Guide: AI in health care
On Humana's motion to dismiss, breach of contract, good faith and fair dealing, unjust enrichment, and common law fraud claims may proceed and four other claims were dismissed with prejudice. The claims are allegations; Humana contests them.
Source: Barrows v. Humana Inc., No. 3:23-cv-00654, memorandum opinion and order (via Georgetown Litigation Tracker) · Guide: AI in health care
AI may not make independent therapeutic decisions or interact directly with clients in therapeutic communication, among other limits; recorded or transcribed sessions using AI need written notice and consent. After a hearing, IDFPR may impose civil penalties of up to $10,000 per violation.
Source: Illinois General Assembly · Guide: AI in health care
The July 2023 proposal on conflicts of interest from predictive data analytics used by advisers and broker-dealers was withdrawn with other pending proposals by a notice dated June 12, 2025 and effective June 17, 2025. Any future action would start with a new proposal.
Source: SEC, Withdrawal of Proposed Regulatory Actions, 90 FR 25531 (June 17, 2025) · Guide: AI in financial services
The court preliminarily certified a nationwide collective of applicants age 40 and over on the age discrimination claims against Workday, the vendor of the AI screening tools.
Source: Holland & Knight, May 2025 · Guide: AI in hiring and HR
Circulars 2022-03 and 2023-03 on adverse action reasons for complex models were withdrawn. The Regulation B duty to give specific reasons did not change.
Source: Federal Register, 90 FR 20084 · Guide: AI in financial services
Covered entities must make reasonable efforts to identify patient care decision support tools using input variables that measure race, color, national origin, sex, age, or disability, and to mitigate the discrimination risk from each (45 CFR 92.210(b)-(c)).
Source: Federal Register · Guide: AI in health care
The order directs federal agencies to deprioritize enforcement based on disparate impact, naming Title VII's provision at 42 U.S.C. 2000e-2. It also directs the Attorney General and the EEOC Chair to assess, within 45 days, pending matters that rely on disparate-impact liability, and directs the Attorney General, HUD, the CFPB, the FTC, and other agencies that enforce the Equal Credit Opportunity Act, the Fair Housing Act, or laws against unfair, deceptive, or abusive acts or practices to evaluate their pending proceedings that rely on it.
Source: Federal Register, April 28, 2025 · Guide: AI in hiring and HR
The SEC alleges the founder raised over $42 million by claiming the app used AI to complete purchases when it relied largely on contract workers. Allegations, not findings.
Source: SEC Litigation Release No. 26282 · Guide: AI in financial services
The court let breach of contract and good faith and fair dealing claims proceed and dismissed five others with prejudice, most as preempted by the Medicare Act. The claims are allegations; UnitedHealth denies using nH Predict.
Source: Estate of Lokken v. UnitedHealth Group, No. 0:23-cv-03514, memorandum opinion and order (via Georgetown Litigation Tracker) · Guide: AI in health care
The public company settled charges that it described third-party speech recognition technology as its own and overstated how much its product reduced human involvement. No penalty; the order cites financial condition, remedial acts, and cooperation.
Source: SEC, In the Matter of Presto Automation Inc., Securities Act Release No. 11352 · Guide: AI in financial services
The Division on Civil Rights issued guidance on how the Law Against Discrimination applies to automated decision-making tools used in employment, housing, public accommodations, credit, and contracting, and clarified that regulated entities may be liable for algorithmic discrimination from a tool developed by a third party.
Source: New Jersey Office of the Attorney General, January 9, 2025 · Guide: AI in hiring and HR
AB 3030 requires a disclaimer and human contact instructions on generative AI patient communications about clinical information unless a licensed or certified health care provider read and reviewed them.
Source: Duane Morris · Guide: AI in health care
SB 1120 (Health and Safety Code 1367.01; Insurance Code 10123.135) requires plan and insurer AI used in utilization review to rely on the enrollee's own clinical record, not solely a group dataset. The tool may not deny, delay, or modify care based on medical necessity; a licensed physician or competent licensed health care professional must make that determination.
Source: Fenwick · Guide: AI in health care