Navigating Federal/State AI Governance: The October 2026 Update

Introduction

As we come to terms with the speed and complexity that AI presents, are we equipped to think of alternative ways to respond and even anticipate the impact that these developments will have?

In this update I will attempt to show the changes and adaptations that federal/state authorities have introduced in response to technological advances in AI. Although, while we have been told that these initiatives have been in response to public/market demand, there has often been a lack of consistency and clarity in the need, and perhaps we should consider this question “and who does this benefit...?

Observations on developments

In January 2026 I published Navigating Federal/State AI Governance and Compliance: Five Factors for Competitive Advantage. It argued that the conflict between a deregulating federal government and active state legislatures would take years to resolve, and that organisations should not wait for “federal clarity” before building AI accountability into their operations.

Nine months later, that argument has survived, although much of the detail has not. Headline developments:

• California has rewritten its AI Transparency Act and created a framework for independent AI auditors.
• Colorado repealed the law I described and moved its start date to January 2027.
• Illinois, which did not feature in January, has passed the first state law requiring annual independent audits of the largest AI developers.
• In Washington, DC the administration has added executive orders, a voluntary industry accord and a new AI task force to its preemption strategy, while Congress has produced a wave of bills, from federal preemption to a ban on superintelligence, without passing any of them.

This update records what has changed and corrects what is now out of date. It also reorganises the January article’s five factors approach into a simpler framework:

Summary of changes since January

Factor 1Federal government action

The executive branch: litigation, voluntary review and a task force

The federal approach now runs on several tracks at once.

Challenging state laws. The December 2025 executive order directed the Attorney General to create an AI Litigation Task Force to challenge state AI laws (White House). The task force was established on January 9, 2026 (Department of Justice). In April, the DOJ moved to intervene in a lawsuit seeking to block the original Colorado AI Act (Reuters). In March, the White House published a National Policy Framework recommending that Congress preempt state AI laws it considers unduly burdensome. It is a set of recommendations, not law (White House).

Security review of frontier models. On June 2, President Trump signed Executive Order 14409. It set up a voluntary process giving the government 30 days to review new frontier models before release to trusted partners, and it explicitly stops short of licensing or mandatory pre-clearance (Congressional Research Service). The government has also intervened in specific cases. In June, the Commerce Department suspended exports of two Anthropic models and lifted the controls at the end of the month, after safeguards were put in place (Reuters). In September, the White House asked OpenAI and Anthropic not to share new models with the UK’s AI Security Institute until US testing was complete (Politico).

Industry engagement without regulation. In August, the President said Congress wanted to regulate the AI industry “out of business” (Reuters). On September 19, he announced an “AI Force” and an AI czar. He said the administration would not “hinder or stifle” the industry and would address “BAD” conduct through the existing criminal and civil justice system (NBC News). On September 29, Meta, Nvidia, Google, OpenAI, xAI and Anthropic signed the White House Accord on Super Intelligence. They committed to internal controls, an internal oversight team, independent outside auditors and an independent board committee to review audit results. The accord is voluntary, carries no penalties and does not require audit results to be published (Al Jazeera).

The task force. On October 3–4, Director of National Intelligence Jay Clayton was named to lead a new “Super Intelligence Force”. Its members include FTC Chair Andrew Ferguson, Under Secretary of Defense Emil Michael and OPM Director Scott Kupor. It reports to the President and Chief of Staff Susie Wiles, and has 120 days to report on AI’s risks and opportunities and recommend the federal government’s responsibilities (CNBC; NBC News). No calendar deadline has been published. Counting from the announcement, 120 days runs to about the start of February 2027.

Congress: many proposals, no law

The catalyst for much of this activity was the OpenAI–Hugging Face incident. In July 2026, according to OpenAI, its models in an internal cybersecurity evaluation got around controls meant to isolate them from the internet and compromised parts of OpenAI’s research infrastructure and Hugging Face’s systems (OpenAI). In mid-September, Geoffrey Hinton told lawmakers at a closed briefing organised by Senator Sanders that Congress had “maybe a year” to put safeguards in place (NBC News).

The main proposals are:

The Sanders–Casar bill is the most far-reaching. Beyond the ban, it would create a cabinet-level Department of Artificial Intelligence to monitor frontier systems across their lifecycle, impose a “corporate death penalty” on violating entities and up to 20 years’ imprisonment on individuals, and direct the United States to pursue international agreements (Senator Sanders). Caleb Max of the National AI Association called it “dead on arrival” (NBC News).

Before leaving for the midterm recess, Speaker Mike Johnson said that if he called an emergency session to regulate AI, “nobody in the room knows yet what that should look like” (CBS News). The House did pass the Ratepayer Protection Act on data-centre energy costs by 417–3 (USA Today), but the bill stalled in the Senate (CNBC). Public opinion is divided: in a New York Times/Siena poll, 42% of voters trusted Republicans more on AI and 40% trusted Democrats more (New York Times).

Factor 2State government action

California: from one law to a layered framework

The AI Transparency Act is live and has been rewritten. The Act (SB 942, as amended by AB 853) became operative on August 2, 2026 (Morgan Lewis). On September 30, Governor Newsom signed SB 1000, an urgency bill that took effect immediately (Morrison Foerster). It:

• removed the 1 million-user threshold, so the Act now applies to anyone producing a publicly accessible generative AI system in California;
• removed the requirement to offer a visible (“manifest”) disclosure, while keeping the embedded (“latent”) disclosure, which must now state whether the system created or altered the content (Digital Democracy / CalMatters);
• replaced the “AI detection tool” with a “disclosure verification tool”; and
• clarified the licensee rule: a provider that knows a licensee has made the system non-compliant has 72 hours to act, and the licensee then has 96 hours to fix it or stop using it. Providers are not required to monitor licensees.

Large-platform duties begin January 1, 2027, and capture-device duties January 1, 2028. A companion bill, AB 2713, revises platform provenance duties (Digital Democracy / CalMatters).

Independent auditing is in statute. SB 813 and AB 1405, signed September 9, create a framework for Independent Verification Organisations (IVOs) and a state registry of AI auditors with standards for independence (Office of the Governor). From January 1, 2029, only registered auditors may conduct a “covered AI audit”. Auditors must keep records for 10 years, and an audit is “relevant to, but not conclusive of” liability in litigation (Crowell & Moring). Executive Order N-9-26 (September 18) brings administrative deadlines forward: IVO criteria by May 1, 2027 and auditor-registry steps by December 1, 2027. It also asks for recommendations by November 16, 2026 on onsite IVOs at frontier labs, a verified “kill switch” and wider incident reporting (Executive Order N-9-26). The order speeds up implementation but does not change the statutory January 1, 2029 registration requirement.

AI at work. SB 947, the No Robo Bosses Act, takes effect July 1, 2027. Employers may not rely solely on automated systems to discipline or dismiss workers, and must provide human corroboration and written notice (SHRM). California’s 2025 frontier law, SB 53, already requires large frontier developers to publish safety frameworks and report critical incidents (Office of the Governor).

Illinois: the new front-runner on independent audits

Illinois was not in the January article. It has since taken one of the most significant steps of any state.

SB 315, the Artificial Intelligence Safety Measures Act, was signed by Governor JB Pritzker on July 6, 2026 and takes effect January 1, 2027. It was sponsored by Senator Mary Edly-Allen and Representative Daniel Didech and passed with bipartisan support (Office of the Governor of Illinois). According to Latham & Watkins:

• Who is covered: developers of frontier models trained with more than 10^26 operations. The heaviest duties fall on “large frontier developers” with annual revenue above $500 million.
• Staged obligations: annual disclosure statements begin January 1, 2027. Published frontier AI frameworks and annual independent third-party audits begin January 1, 2028 (or 90 days after a developer first qualifies, if later).
• Incident reporting: critical safety incidents must be reported within 72 hours, or within 24 hours where there is an imminent risk of death or serious injury. California’s SB 53 allows 15 days.
• Auditor independence: no financial interest between developer and auditor; payment cannot depend on results. Developers must publish a summary of each audit report within 30 days.
• Whistleblowers: protection for employees who report risks, plus an anonymous internal reporting process.
• Enforcement: the Attorney General only, with no private right of action. Penalties are up to $1 million for a first violation and $3 million for later violations.

Illinois has built on these rules. On September 22, Governor Pritzker signed Executive Order 2026-07, creating an Illinois AI Cabinet of experts and state agencies, due to sunset by the end of 2027. Among other things, it will assess whether data-centre tax incentives and permits should depend on safety and transparency standards, whether AI safety requirements should be built into state procurement, and whether existing legal remedies are enough to hold AI companies accountable for harm (Illinois Executive Order 2026-07).

Illinois also regulates AI outside the frontier. Since January 1, 2026, the Illinois Human Rights Act has barred employers from using AI that discriminates against protected classes, or using zip codes as a proxy for them (Morgan Lewis). A 2025 law restricts the use of AI in therapy and psychotherapy (Quartz).

Colorado: the deadline has moved

Colorado’s SB 24-205 never took effect on June 30, 2026. It was repealed and replaced by SB 26-189, which takes effect January 1, 2027 and covers automated decision-making technology (ADMT) used to materially influence consequential decisions (Colorado Attorney General). The new law drops the earlier duty of “reasonable care” to prevent algorithmic discrimination (Reuters). It focuses instead on developer documentation, consumer notice, explanations after adverse outcomes, data correction and meaningful human review (Colorado General Assembly). Proposed rules were filed August 11, and comments close at the formal hearing on October 26, 2026 (JD Supra).

Other states

New York’s amended RAISE Act, which imposes frontier-developer transparency and reporting duties, takes effect January 1, 2027 (Reed Smith). Pennsylvania’s governor has called for federal regulation, and Virginia’s governor has launched an AI task force (NBC News).

Factor 3The market power principle

In January, I argued that California’s economic weight meant its laws mattered regardless of federal direction. That principle has grown stronger, and it now operates through several states at once.

• California has widened its reach. With the user threshold removed, the AI Transparency Act applies to any producer of a publicly accessible generative AI system in the state.
• The frontier laws are converging. California SB 53, New York’s RAISE Act and Illinois SB 315 use the same 10^26 compute and $500 million revenue thresholds (Latham & Watkins). A developer covered by one is likely to be covered by all three, which makes the strictest elements (such as Illinois’s annual audit) a practical national standard for that group.
• States are using their purchasing power. Illinois’s AI Cabinet is examining whether to attach AI safety requirements to state procurement and data-centre incentives (Illinois Executive Order 2026-07).
• Industry has set its own baseline. The six signatories of the White House Accord have publicly committed to independent outside auditors (Al Jazeera). Their enterprise customers and suppliers can reasonably expect similar practices further down the supply chain.

Factor 4The financial case

Financial exposure should be described accurately: statutory maximums, not forecasts.

Penalties are only part of the case. The costs that do not depend on any regulator are often larger:

• Fraud. The Hong Kong deepfake case, which cost about US$25.6 million, remains the clearest example of what weak verification costs (CNN).
• Incidents. The OpenAI–Hugging Face incident shows that even leading developers can lose control of systems in testing. OpenAI responded by pausing training, quarantining a model and rebuilding infrastructure (OpenAI).
• Litigation. Under California SB 813, an independent audit is “relevant to, but not conclusive of” liability (Crowell & Moring). Good records will matter in court.
• Commercial access. As procurement and partner requirements tighten, organisations that cannot show evidence of control may lose contracts.

Factor 5Governance as an enabler

In January, I argued that governance should enable innovation rather than restrict it. The October evidence points the same way, and adds a specific mechanism: independent assurance.

Independent verification now appears in almost every serious framework:

• State law: California’s IVO and auditor registry (SB 813, AB 1405); Illinois’s annual audits from 2028 (SB 315).
• Executive and voluntary: the White House Accord’s commitment to independent auditors and board review.
• Federal proposals: licensed independent verification organisations in the FRONTIER Act and the Great American AI Act; disclosures for independent researchers in the AI Systems Transparency Act; a federal monitoring department in the Sanders–Casar bill.

The common requirement is evidence: a reliable record of which system ran, what was disclosed, what controls operated, who reviewed the outcome and what happened when it was challenged. Organisations that keep that record can move faster with customers, auditors and regulators because they can show, rather than assert, that their AI is under control.

Where Regitech fits

Regitech was founded out of mediation and alternative dispute resolution practice, and designs backwards from the moment a decision is challenged. As described on regitech.ai, it provides a modular evidence layer that records which system ran, what was disclosed, what controls executed, and who reviewed, approved or overrode an outcome. It works alongside existing governance, privacy and case-management systems. Its four modules are Audit Readiness, Provenance & Disclosure, Evidence Orchestration, and Human Oversight & Dispute Workflow.

To be clear about scope: Regitech does not audit or red-team models. Its aim is that “when someone does, the evidence is already there.” Its website labels the core evidence workflow as implemented and pilot-ready, and capabilities such as C2PA conformance and optional tamper-evident anchoring as in validation. Regitech does not claim to guarantee compliance (Regitech).

What the five factors do not fully capture

The five factors describe who acts (federal and state government), why it reaches you (market power), what it costs (the financial case) and why to act anyway (governance as an enabler). Two perspectives deserve more explicit attention.

People and recourse. The people affected by AI decisions are increasingly the focus of the law. Colorado gives consumers notice, explanations, correction and human review. California’s SB 947 gives workers notice and human corroboration. Illinois bars discriminatory AI in employment. The AI Systems Transparency Act proposes consumer-facing disclosures. Public trust is also unsettled: neither party has a clear lead on AI in the polls. An organisation that can explain a decision and offer a fair route to challenge it is meeting a legal requirement and building trust at the same time. This could be treated as a sixth factor: people and recourse.

Incentives to adopt. Beyond avoiding penalties, organisations now have positive reasons to adopt governance early. Registered audits may count in litigation. State procurement and data-centre incentives may come to depend on safety standards. Enterprise customers increasingly expect partners to follow the practices their largest suppliers have committed to. These incentives fit within Factor 5 but are worth stating explicitly to business audiences.

Priorities for Q4 2026 to Q1 2027

1. 1Re-scope California coverage under SB 1000 and check latent disclosures and verification tools.
2. 2Update licensing contracts to include the 72-hour provider and 96-hour licensee steps.
3. 3Prepare for January 1, 2027: Colorado SB 26-189, Illinois SB 315 disclosure statements and New York’s RAISE Act. Comment on Colorado’s rules by October 26.
4. 4Plan for independent audits: Illinois from 2028 for large frontier developers; California registered auditors from 2029. Keep records in a form an auditor can review.
5. 5Build human review and recourse into consequential and employment decisions, ahead of California SB 947 (July 1, 2027).
6. 6Track the federal calendar: California’s expert recommendations (November 16, 2026), the federal task force report (around early February 2027) and any preemption bill.

Conclusion

The January article asked whether your AI roadmap was built for the business realities of 2026, regardless of which regulator shows up first. In October, the answer is clearer. Federal government action remains largely voluntary and uncertain. State government action is now spread across California, Colorado, Illinois and New York. Market power is spreading those rules nationally. The financial case rests on fraud, incidents, litigation and commercial access as much as on penalties. And governance has become an enabler because independent assurance is now expected from every direction.

“Organisations that can show what their AI did, why, and who was accountable will be ready for whichever framework takes hold.”

Corrections to the January 2026 article

• The Hong Kong deepfake fraud was reported in early 2024, not November 2024 (CNN).
• Colorado SB 24-205 never took effect on June 30, 2026. It was replaced by SB 26-189, effective January 1, 2027.
• California’s 1 million-user threshold and manifest-disclosure requirement were removed by SB 1000 on September 30, 2026.
• Colorado’s law did not contain the C2PA-style provenance requirements the January article attributed to it.
• The per-day penalty multiplications and “bounty hunter” market were illustrations, not features of the statutes.

This article provides general information and does not constitute legal advice. Organisations should take advice on the laws that apply to their own roles, systems and jurisdictions. Information is current as of October 7, 2026.