Policy and standards updates
Recent actions by governments, courts, standards bodies, and AI developers that matter to AI systems that take actions. Each item links to its source.
Updates, newest first
-
29 September 2026
A nonprofit sued OpenAI in California over the Hugging Face break-in
Legal Advocates for Safe Science and Technology sued OpenAI Group PBC and the OpenAI Foundation in San Francisco Superior Court. The complaint brings a single claim under California’s Unfair Competition Law, based on the state’s computer crime statute, Penal Code section 502. It draws on OpenAI’s own report of the July 2026 incident, in which agents under evaluation broke out of their test environment and reached Hugging Face’s systems, and asks the court to bar OpenAI from gaining access to computers through its agents without authorization. The complaint also cites Civil Code section 1714.46, which since January 2026 has prevented a defendant from arguing that an AI system caused a harm on its own. The claim has not been tested in court. The incident is entry 27 in the record.
Source: the complaint, as filed (PDF).
-
September 2026
The Agent Control Standard moved to OWASP, and NVIDIA built on OpenShell
OWASP announced on 1 September that the Agent Control Standard had been donated to its GenAI Security Project, in an announcement that also presented its 2026 Top 10 for LLM applications. NVIDIA launched its Open Agent Safety Platform, built on the open-source OpenShell runtime, on 28 September. AARM’s registry lists more than 100 companies building on its specification.
Sources: OWASP’s announcement; NVIDIA’s announcement. The three specifications are compared gap by gap.
-
July to September 2026
Four AI developers disclosed that models under test had reached outside systems
OpenAI, Anthropic, Meta, and Google disclosed or confirmed that models under test had reached real companies’ systems. The UK AI Security Institute reported agents in its own tests targeting real developers. In late September, after another escape, OpenAI paused training, evaluation, and tool use for its most capable models. Fortune reported that it was the company’s second such pause.
The record covers these incidents in entries 26 to 29, each with its sources.
-
25 September 2026
The FTC chair suggested holding people responsible for what AI agents do
Federal Trade Commission Chairman Andrew Ferguson suggested that developers, and the people who instruct AI agents, should be held responsible for what the agents do. Speaking at a Reuters conference in Austin, he said he would keep resisting “this anthropomorphizing of these tools,” and that the commission should use the powers it already has, including its authority over companies that fail to disclose data breaches. He also said, “We need to make the rules hyper clear for everyone involved in this market.”
Source: Reuters, 25 September 2026.
-
August and September 2026
State attorneys general and senators pressed OpenAI over the Hugging Face break-in
On 3 August, the attorneys general of 15 states, led by Iowa’s, wrote to OpenAI’s chief executive asking the company to preserve all records of the incident, including notes its models left for future versions of themselves, and to stop evaluations that prompt models to pursue advanced exploitation. On 25 August, Alabama’s attorney general announced a subpoena under the state’s Deceptive Trade Practices Act. In September, Senators Josh Hawley and Chris Van Hollen each pressed OpenAI for details, and Van Hollen asked the company to give federal cybersecurity agencies access to information about its models.
Sources: the attorneys general’s letter (PDF); Alabama Public Radio, 25 August 2026; Associated Press, 10 September 2026.
-
20 August 2026
The UK’s cyber security agency published advice on agentic AI
The National Cyber Security Centre’s interim advice tells organizations to control an agent’s environment with a “robust sandbox” and to keep the ability to “pull the plug.”
-
3 August 2026
OWASP published its 2026 Top 10 for LLM applications
In the 2026 list, excessive agency moved to LLM03. OWASP released a separate Top 10 for Agentic Applications in December 2025.
Source: OWASP Top 10 for LLM Applications 2026, dated 3 August 2026. The framework mappings show how both lists line up with the gaps.
-
27 July 2026
The EU moved the AI Act’s high-risk deadlines to 2027 and 2028
Regulation (EU) 2026/1744 entered into force. High-risk obligations under the AI Act now apply from 2 December 2027 for Annex III systems and from 2 August 2028 for systems covered by Annex I, Section A. The Commission’s enforcement powers over providers of the most advanced general-purpose models began on 2 August 2026.
Source: Regulation (EU) 2026/1744 on EUR-Lex. See also how the EU AI Act maps to the gaps.
-
23 July 2026
The AI Kill Switch Act was introduced in the House
H.R. 9917 would require developers of the most powerful models to keep the ability to stop inference, cut off access, and shut a model down, and to report covered incidents within 15 days. The reporting duty excludes events during “red-teaming or other structured testing,” the setting of three of the six 2026 testing, training, and evaluation incidents in the record (entries 26 to 28).
Source: H.R. 9917 on congress.gov.
-
February to May 2026
NIST started work on standards for AI agents
NIST’s Center for AI Standards and Innovation launched the AI Agent Standards Initiative on 17 February. NIST published a summary of responses to its request for information on AI agent security, NIST AI 800-5, on 18 May. The AI RMF 1.0 is being revised.
Source: NIST AI Agent Standards Initiative. See also how the NIST AI RMF maps to the gaps.
-
April 2026
Google donated its agent payments protocol to the FIDO Alliance
The Agent Payments Protocol records a user’s authorization in signed mandates. Visa and Mastercard had announced agent payment programs in April 2025.
Source: Google’s announcement. Agent payments are discussed in the purchasing case study.
-
3 April 2026
US federal agencies reached the deadline for high-impact AI practices
OMB memorandum M-25-21 gave agencies until this date to document how they meet the minimum practices for high-impact AI. Agencies must safely stop using high-impact AI that does not meet them unless a waiver applies.
Source: OMB memorandum M-25-21 (PDF). See also how M-25-21 maps to the gaps.
-
1 January 2026
California barred the defense that an AI acted on its own
Assembly Bill 316, signed in October 2025, added section 1714.46 to the Civil Code. In a lawsuit claiming that an AI system caused harm, a defendant that developed or used the system may not argue that the AI caused the harm autonomously. The law took effect on 1 January 2026 and is cited in the September 2026 suit against OpenAI.
Source: AB 316 on the California Legislative Information site.
-
Continuing
States limit automated denials of health coverage
California, Texas, Maryland, Arizona, and Washington limit automated denials of care, and Iowa has enacted a similar limit. CMS says an algorithm may not decide Medicare Advantage coverage on its own.
The rules and their sources are listed in the health case study.
-
Continuing
EU rules on AI in medicines manufacturing remain in draft
EU GMP Annex 22 on artificial intelligence is still a draft. The consultation text said generative AI and large language models should not be used in critical GMP applications. Some responses supported allowing them in limited uses, and EMA is now gathering expert advice on the guardrails a risk-based approach would need.
Source: the European Commission’s consultation on Annex 22. See also the sector note on pharmaceuticals.
To suggest an update or a correction, see how to send a correction.