6 dated developments from October 2025 that bear on AI compliance, each checked against the source linked. Entries are tagged by industry; the newest developments and fixed deadlines ahead are on the AI regulation news page.
Feeds (Atom): All changes · Banks and credit unions · Private equity and asset managers · Hospitals and health systems · Insurers · Employers and HR · Law firms and legal teams · Manufacturers · Importers and exporters. Data: updates.json.
The court vacated provisions to the extent they expanded Title IX's definition of sex discrimination to include gender identity. HHS later stated that the rule's other provisions remain in force.
Source: Federal Register (HHS notice describing the order) · Guide: AI in health care
Amended Regulation 10-1-1 (3 CCR 702-10) extends the SB21-169 governance framework to private passenger auto and health benefit plan insurers. Law firm summaries report that full compliance and the first annual report were due July 1, 2026.
Source: Faegre Drinker, Colorado Division of Insurance Expands AI-Related Governance (September 2, 2025) · Guide: AI in insurance
S. 2296 passed the Senate 77 to 20 with the GAIN AI Act of 2025 attached as Subtitle H, sections 6081 to 6083. The provision would add section 1758A to the Export Control Reform Act of 2018, require a license to export, reexport, or transfer in-country advanced integrated circuits to any country outside Country Groups A:4, A:5, and A:6, and require applicants for licenses to arms-embargoed countries or countries of concern to certify that United States persons had a right of first refusal, that the applicant had no current backlog of US requests and could not foresee one or a loss of production capacity for US buyers, and that it was not giving foreign buyers advantageous pricing or terms that it was not giving US buyers. The House NDAA had no counterpart provision, and the enacted law left it out.
Source: S. 2296, Engrossed in Senate, govinfo.gov · Guide: AI compliance, layer by layer
OCC Bulletin 2025-26 states that the OCC's model risk guidance does not require community banks to perform annual model validation and lets them tailor validation frequency and scope to risk.
Source: OCC Bulletin 2025-26 · Guide: AI in financial services
Applies to carriers, and to PBMs and private review agents working for them, that use AI, algorithms, or other software in utilization review. Tools must rest on individual clinical information, not solely a group dataset; quarterly reports must state whether a tool was used in adverse decisions.
Source: Chapter 747 (HB 820), Maryland General Assembly · Guide: AI in health care
The regulations make clear that using an automated-decision system may violate California law if it harms applicants or employees based on protected characteristics, require employment records, including automated-decision data, to be kept at least four years, and add definitions of key terms such as automated-decision system and agent.
Source: California Civil Rights Department, June 30, 2025 · Guide: AI in hiring and HR