October 2026 brought 25 AI policy and regulation changes that we could pin to an official document. Four of them change what a private company has to do: the FCC's revised TCPA opt-out rule (effective November 25), HHS's HTI-5 rule, which drops the "model card" requirement for decision support tools in certified health IT (effective December 28), the enforcement chapters of Poland's AI act (applicable since October 28) and New York's chatbot law for minors (effective January 1, 2027). Almost everything else is a draft, a consultation or guidance. Four comment windows close in November, the first on November 9, and New York City's doom loop rule now takes comments until December 18.
Each row links the regulator's, legislature's or court's own page. We built the list on October 30 from the source logs behind our October coverage and read the newer documents (the EU standard, the EU draft procedure rule and HHS's HTI-5) that day. Anything we could only find in press coverage is not here. The rolling version of this list is the "What changed this month" box on our AI law tracker; dates further out are in the AI regulation deadline calendar.
October 2026, row by row
| Date | Where | What changed | Who it binds | Next date |
|---|---|---|---|---|
| Oct 5 | Norway | The government announced a temporary ban on AI glasses in selected places and said it will bring a bill to the Storting "as soon as possible" (regjeringen.no) | Nobody yet: announcement | None given |
| Oct 6 | Utah | Executive Order 2026-08, effective immediately: agencies "shall avoid" AI that does not adhere to the principles of Utah's Pro-Human AI Initiative (order text) | State agencies | In force |
| Oct 7 | Singapore | MAS issued Guidelines on AI Risk Management for all financial institutions and all forms of AI (MAS) | Financial institutions | Sections 3 and 4 from Oct 7, 2027; 5 and 6 by Oct 7, 2028 |
| Oct 7 | Germany | Federal cabinet approved the government bill on protection against digital violence (Federal Ministry of Justice) | Nobody yet: the Bundestag still has to pass it | Bundestag vote |
| Oct 7 | US federal | Treasury announced its first civil penalty under the Outbound Investment Security Program: $200,000 against Amidi, LLC, issued in July, for not notifying an investment in a Chinese embodied AI company (Treasury) | US persons investing in Chinese AI, chip and quantum companies | Program in force since Jan 2, 2025 |
| Oct 8 | UK | Law Commission consultation: software and AI systems would be treated as products in their own right (Law Commission) | Nobody: consultation | Closes Jan 14, 2027 |
| Oct 8 | UK | ICO said ten AI developers, among them OpenAI, Google, Meta and Anthropic, made or committed to data protection changes, and opened a call for evidence on AI agents (ICO) | Nobody: call for evidence | Closes Nov 20, 2026 |
| Oct 8 | Denmark | Culture minister Zenia Stampe introduced a bill that makes it illegal to share lifelike reproductions of a person's appearance and voice (Ministry of Culture) | Nobody until passed | Bill text says Jan 1, 2027 |
| Oct 9 | UK | Judiciary position statement on judges' own use of AI: "cautious but positive" (Courts and Tribunals Judiciary) | Judges | None |
| Oct 12 | EU | Commission draft implementing regulation for its own AI Act proceedings under Articles 75c and 75d: access to the file, procedural safeguards, limitation periods for penalties (Have your say) | Nobody yet: draft | Feedback closes Nov 9, 2026 |
| Oct 14 | EU | Implementing Decision (EU) 2026/2274 published the reference of EN 18286:2026, a quality management system standard and the first harmonised standard under the AI Act (EUR-Lex) | Voluntary; following it gives a presumption of conformity with the Article 17 requirements it covers | Annex III high-risk duties apply Dec 2, 2027 |
| Oct 16 | China | MOFCOM and the Ministry of Science and Technology published a draft revision of the export-restricted technology catalogue with 23 AI items: large models, agents, computing clusters, information processing (MOFCOM) | Nobody yet: draft | Comments close Nov 15, 2026 |
| Oct 19 | UK | FCA good and poor practice on AI in financial services, which in the FCA's words "do not create new requirements" (FCA) | No new duties | None |
| Oct 20 | US federal | DHS order under the Federal Acquisition Supply Chain Security Act (FR Doc. 2026-21447) excludes DeepSeek products from civilian agency procurement and removes them, and third-party products "developed using DeepSeek implementations", from agency IT (Federal Register) | Federal civilian agencies | Published Oct 20 |
| Oct 20 | New York City | DCWP proposed a rule against AI customer service "doom loops", with fines starting at $525 (DCWP) | Nobody yet: proposed | Comments by Dec 18, 2026 (was Nov 19) |
| Oct 22 | South Korea | KFTC draft guidelines on AI claims in advertising, which the KFTC says are not legally binding (KFTC) | Nobody: guidance | Comments close Nov 11, 2026 |
| Oct 22 | US, Canada, UK, Australia, New Zealand | CISA, Canada's Cyber Centre and partner agencies in Australia, New Zealand and the UK published joint guidance on managing AI token consumption, with small and medium businesses listed as an audience (CISA) | Nobody: guidance | None |
| Oct 22 | Florida | Attorney General James Uthmeier proposed the Safe Screens Act, which would bar AI chatbots from giving minors features that simulate companionship or claim to be human (Florida AG) | Nobody yet: proposal | None set |
| Oct 23 | US federal | SEC Division of Examinations FY2027 priorities name emerging technologies as a headline area; the SEC says the list is not exhaustive (SEC) | SEC registrants, through exams | None |
| Oct 23 | Texas | Attorney General Ken Paxton sued OpenAI and Sam Altman under the Deceptive Trade Practices Act in Collin County, seeking over $1,000,000 (Texas AG) | OpenAI (lawsuit) | None |
| Oct 26 | US federal | FCC's revised TCPA consent-revocation rule published (FR Doc. 2026-21821) (Federal Register) | Callers and texters, including AI voice | Effective Nov 25, 2026 |
| Oct 28 | US federal | HHS final rule HTI-5 (FR Doc. 2026-21943) removes the source attribute and intervention risk management requirements for decision support interventions in certified health IT (Federal Register) | Certified health IT developers, and the providers who buy from them | Effective Dec 28, 2026 |
| Oct 28 | US federal | FTC sent Section 6(b) orders to nine companies, including Delta, Uber, Instacart, Target and Walmart, on using personal data to set prices and pay (FTC) | The nine recipients | 45 days from receipt |
| Oct 28 | Poland | The inspection, proceedings, settlement and penalty chapters of the Act of 3 July 2026 on AI systems became applicable; the regulator, KRiBSI, held its first meeting (KRiBSI) | Companies supervised under the AI Act in Poland | Applicable now |
| Oct 28 | New York | Governor Hochul signed S.9051B/A.10379C (Chapter 368), which bans unsafe AI chatbot features for minors; penalties up to $25,000 per violation (NY Assembly) | Chatbot operators with New York users | Effective Jan 1, 2027 |
The four that move a company's obligations
The FCC rule is the one most small teams will hit first. The FCC already treats AI-generated voices as "artificial" voices under the TCPA: its February 2024 ruling (FCC 24-17) says callers must get prior express consent before a call that uses a voice generated through AI. The new order, FCC 26-67, adopted September 30 and released October 1, never mentions AI; we searched the Federal Register text for it. What it changes is opt-outs. From November 25, a caller may make one of three methods exclusive (a key-press or voice option on the call, a reply text with a standard word such as "stop", or a website or number the caller names), and a revocation in reply to an informational call can be read as covering only that category. A telemarketing opt-out still ends all telemarketing from that caller. If your AI agent places reminders or follow-ups, map which category each campaign sits in before November 25. Our FCC TCPA breakdown has the full list.
Screenshot: Federal Register, Vol. 91, No. 205, page 67214 (FR Doc. 2026-21821), govinfo.gov PDF, October 30, 2026.
HTI-5 is the odd one: a rule that removes AI transparency. HHS's Office of the National Coordinator dropped the requirement that certified health IT support source attributes for predictive tools, the "model cards" that say how a model was trained, its intended use and limitations, and how it performs across patient groups. The pushback was on the record: "A large majority of commenters were not supportive of our proposal," HHS wrote. HHS's answer is to push the job onto buyers: "We encourage users of certified health IT to ask their developers for such information." We'd take that literally. If you run a clinic or sell into one, put the model card fields in the contract now, because from December 28 the certification no longer guarantees them.
Screenshot: Federal Register, Vol. 91, No. 207, page 67940 (FR Doc. 2026-21943), govinfo.gov PDF, October 30, 2026.
Poland can now inspect and fine under the AI Act. The inspection, proceedings, settlement and penalty chapters of Poland's Act of 3 July 2026 (Dziennik Ustaw item 1003) applied three months after publication, on October 28, and the new regulator KRiBSI met the same day. If people in Poland use your chatbot or generate content with your tool, our Poland breakdown lists what KRiBSI looks at first.
New York's chatbot law gives operators two months. S.9051B passed both chambers in June and was signed on October 28 as Chapter 368; it takes effect January 1, 2027, with penalties of up to $25,000 per violation. The New York chatbot law post has the feature list and the age-check rules.
One near-miss for the list: EN 18286 is voluntary, so it binds nobody. It is still the row we'd read first if you build high-risk AI for the EU market. The Commission says the standard is "designed to be layered on top of" ISO/IEC 42001, ISO 9001 or a sector QMS rather than replacing them, so an ISO/IEC 42001 shop isn't starting over. Nobody needs it this quarter, though: the Annex III high-risk duties it supports apply from December 2, 2027.
Comment windows: four in November, one moved to December
| Closes | Who is asking | About | Worth a response if you |
|---|---|---|---|
| Nov 9 | European Commission | How the Commission runs its own AI Act proceedings (Articles 75c and 75d) | expect to face the Commission directly in an AI Act proceeding |
| Nov 11 | Korea Fair Trade Commission | AI claims in advertising | market AI features to customers in Korea |
| Nov 15 | China's MOFCOM and Ministry of Science and Technology | 23 AI items in the export-restricted technology catalogue | build on Chinese models or work with Chinese AI partners |
| Nov 20 | UK ICO | Agentic AI and data protection | build or deploy agents that touch UK personal data |
| Dec 18 | New York City DCWP | AI customer service doom loops | run AI customer service for New York City consumers |
If you answer only one, make it the New York City rule if you serve consumers there: of the five, it is the only draft that names a fine, starting at $525. Check the date before you plan around it. The city's rules page gave November 19 as the comment deadline when we read it on October 21; on October 30 it said "Comments close by December 18, 2026", with the public hearing that day at 11:00am. The page already has public comments, including one from October 20: "I strongly support this proposal to create common-sense restrictions on AI slop!" (NYC Rules). Commissioner Samuel A.A. Levine framed it the same way at launch: "We are not waiting for Washington to come to the rescue of working people." Our doom loop checklist covers what the rule would require.
The Korean guidelines are the weakest of the five: the KFTC itself says they are not legally binding. Skip them unless your ads already make claims about AI.
Two events we left off
The Fifth Circuit's opinion of October 22 in No. 25-60496 vacated an injunction and sent the case to a different district judge. Judge Wingate, who issued it, had said a law clerk used AI on an earlier draft of an order that was docketed by mistake. It is a ruling about one judge, not a rule anyone else must follow, so it sits in our Fifth Circuit post instead. California's batch of AI bills, including AB 1883 on workplace surveillance tools (Chapter 853), was signed on September 30, so it belongs to September; see Newsom's September 30 AI signings.
Which rows to read for your team
| If you | Read | First date that matters |
|---|---|---|
| run a consumer chatbot or companion app | New York (Oct 28), Florida (Oct 22), Denmark (Oct 8) | Jan 1, 2027 in New York |
| place AI voice calls or texts in the US | FCC (Oct 26) | Nov 25, 2026 |
| sell or buy clinical decision support | HHS HTI-5 (Oct 28) | Dec 28, 2026 |
| provide high-risk AI in the EU | EN 18286 (Oct 14), Poland (Oct 28), Commission draft (Oct 12) | Nov 9 feedback; Dec 2, 2027 |
| work at a bank, insurer or adviser | MAS (Oct 7), FCA (Oct 19), SEC (Oct 23) | Oct 7, 2027 in Singapore |
| sell to US federal civilian agencies | DHS DeepSeek order (Oct 20) | Already published |
| sell AI tools to Utah state agencies | Executive Order 2026-08 (Oct 6) | Already in effect |
The SEC and FCA rows are on the list because they tell you where examiners and supervisors will look, not because they add a rule. Treat them as an agenda, not a deadline.
Related Reading
- AI Regulation Deadline Calendar: 2026 and 2027 Dates
- TCPA Revocation Rule Takes Effect Nov 25 for AI Calls, Texts
- New York AI Chatbot Law: What S.9051B Bans From 2027
- Poland AI Act Enforcement: What KRiBSI Can Do From Oct 28
- Korea AI Washing Guidelines: KFTC Ad Checklist in English
- DeepSeek Federal Ban: What Government Contractors Check Now
