8 dated developments from May 2026 that bear on AI compliance, each checked against the source linked. Entries are tagged by industry; the newest developments and fixed deadlines ahead are on the AI regulation news page.
Feeds (Atom): All changes · Banks and credit unions · Private equity and asset managers · Hospitals and health systems · Insurers · Employers and HR · Law firms and legal teams · Manufacturers · Importers and exporters. Data: updates.json.
BIS guidance states that the license requirement for advanced computing items for entities headquartered in, or with an ultimate parent headquartered in, Country Group D:5 or Macau predates the AI Diffusion rule and is still enforced in every destination outside the United States, unless a license exception in 15 CFR 740.2(a)(9)(ii) is available. Bona fide data center operators otherwise acting consistently with the EAR need not stop ongoing use, storage, disposal, or servicing of advanced computing items because of the guidance, until further notice from BIS.
Source: BIS guidance, May 31, 2026 · Guide: AI compliance, layer by layer
HB 26-1263 (Session Laws 2026, Chapter 208), approved May 29, 2026, adds conversational artificial intelligence service definitions to C.R.S. 6-1-1701 and an operator-duties section to Part 17 of the Colorado Consumer Protection Act. An operator must use commercially reasonable or generally accepted methods to estimate users' ages. On and after January 1, 2027, an operator must clearly and conspicuously disclose that the service is artificial intelligence, apply specified protections when it knows an account holder or user is a minor, implement a suicide and self-harm protocol that refers users to crisis services, and not represent outputs as provided by, endorsed by, or equivalent to services of specified licensed professionals. On and after July 1, 2027, it must report annually to the Attorney General. The Attorney General is implementing the act in the same rulemaking as SB 26-189.
Source: HB 26-1263, Session Laws 2026, Chapter 208 (enrolled act), Colorado General Assembly · Guide: Colorado SB 26-189 explained
An industry letter to DFS-regulated entities warned that frontier AI models can amplify the potency, scale, and speed of identifying vulnerabilities. It imposes no new requirements and points back to Part 500 and the October 2024 AI letter.
Source: NYDFS industry letter · Guide: AI in financial services
The Commission published draft guidelines on the classification of high-risk AI systems under Article 6 of the AI Act and invited stakeholder feedback before formal adoption. Article 6(5) required the guidelines by February 2, 2026. The draft covers Article 6(1) with Annex I and Article 6(2) with Annex III and includes practical examples. As of October 23, 2026, no final version had been published.
Source: European Commission, Draft Commission guidelines on the classification of high-risk AI systems (May 19, 2026) · Guide: EU AI Act checklist by role
The replacement regulates automated decision-making technology in consequential decisions from January 1, 2027, with documentation, notice, and explanation duties and, after an adverse outcome, a consumer right to request human review to the extent commercially reasonable. The enacted text contains no impact assessment or risk management program duty; the 2024 law (SB 24-205) required both. Among the carve-outs, an insurer subject to C.R.S. 10-3-1104.9 is in compliance with the law in the practice of insurance (6-1-1708(1)). HIPAA covered entities, and their business associates for services rendered to them, are exempt from 6-1-1701 to 6-1-1706 except for employment decisions, and a health care provider gets that exemption only if it operates from a location in Colorado; covered entities must still give patients a general notice of advanced technology use and make specific disclosures when ADMT determines eligibility for financial assistance (6-1-1708(3)). A creditor that is required to provide, and provides, an ECOA notice complies with the law's notice and disclosure duties for the same decision if that notice also meets them (6-1-1704(6)). A federal court order in X.AI LLC v. Weiser bars the Colorado Attorney General from enforcing the law, including by investigation, for violations occurring on or before 14 days after the court rules on xAI's preliminary injunction motion; xAI had not filed that motion as of October 21, 2026.
Source: SB 26-189, Session Laws 2026, Chapter 131, Colorado General Assembly · Guide: US state AI laws
The State Bar's Board of Trustees approved revisions to its Practical Guidance for the Use of Generative Artificial Intelligence in the Practice of Law, originally published November 16, 2023. The update addresses agentic AI. The guidance is advisory; separate rule amendments remain proposals.
Source: Ethics News, State Bar of California · Guide: AI compliance, layer by layer
GAO decided that the May 2025 press release announcing non-enforcement of the AI Diffusion rule meets the APA definition of a rule, that no CRA exception applies, and that it must be submitted to Congress and the Comptroller General before it can take effect. GAO stated that the Diffusion rule, which created the ECCN 4E091 model weight control, remains legally in effect until Commerce completes its planned rulemaking to rescind it.
Source: GAO decision B-337935 · Guide: AI compliance, layer by layer
The Advisory Committee on Evidence Rules did not recommend action on proposed Rule 707, which would apply Rule 702 reliability standards to AI output offered without an expert. It revised the draft, decided not to republish it for comment yet, and set expert vetting for its fall meeting; the October 15, 2026 agenda includes the item. Any revised version would need a new comment period.
Source: Report of the Advisory Committee on Evidence Rules, May 17, 2026 · Guide: AI compliance, layer by layer