How we verify
A compliance site is only useful if its dates and figures are right. This page says what we check, what we have not checked yet, and what we got wrong.
What we check
- Primary sources first. EUR-Lex for EU law, official legislature and governor pages for state bills, agency pages and court dockets for enforcement. Law-firm and news summaries are used to corroborate, not as the only source.
- Named facts one by one. Every case name, fine amount, docket, bill number and article number is checked individually. We do not list them from memory.
- Secondary-only claims are labelled. If a date appears only in secondary coverage, the article says "reported" and tells you where to confirm it.
- Dated checks. A regulation entry shows a verified date only when its dates, status and headline figures were re-checked on that day.
Where coverage stands
- regulation entries carry a verified date
- link to a primary source
- corrections published below
Verified means dates, status and headline figures were re-checked. Some checks relied on law-firm or agency summaries rather than the full statute text, so read the source before you rely on detailed requirements. Any entry without a verified date has not been re-checked. This is general information, not legal advice.
Corrections
AI Data Retention Policy Template: What to Keep and Delete
Was: Gave one year as the US retention period for AI hiring records and said only three kinds of record have a legal minimum.
Now: One year is the federal rule (29 CFR 1602.14). California's employment regulations on automated-decision systems have required four years since October 1, 2025 (2 CCR 11013(c)), and Colorado's SB 26-189 requires three years for covered automated decision-making records from January 1, 2027.
Meta Commercial Terms crawl clause
Was: The November 6 update said the March 2024 terms still govern your Page, ads and catalogue.
Now: Meta lists four sets of existing terms with different dates: the Commercial Terms (March 6, 2024), the Self-Serve Ad Terms (August 22, 2025), the Ad Creative Generative AI Terms (May 6, 2024) and the Product Catalog Terms (last modified February 13, 2015). The current Self-Serve Ad Terms already let Meta crawl the content at an advertiser's domains once an order is placed.
Colorado AI Act regulation card
Was: Gave January 1, 2027 as the effective date of SB 26-189 without saying that some subsections took effect when it was signed.
Now: Most of SB 26-189, including every duty on deployers and developers, takes effect January 1, 2027 and applies to consequential decisions made on or after that date. A few subsections, among them the attorney general's duty to adopt rules on the post-adverse-outcome disclosure and consumer rights, took effect on signing, May 14, 2026 (section 5 of the act; Legislative Council final fiscal note).
AI Adoption Governance: Stop the Quiet Rebellion
Was: A May 2026 note said shadow AI was about 40% of enterprise AI usage, and a regulatory note said the EU AI Act and FTC guidance require documented use cases and training on approved tools. The controls table said FTC guidance requires transparency about AI assistance.
Now: The 40% figure could not be traced to the WalkMe report and was removed. The note now states the EU AI Act Article 4 AI literacy duty, in application since 2 February 2025 and amended by the Digital Omnibus (Regulation (EU) 2026/1744, in force 27 July 2026). The table cites the FTC's August 28, 2025 Workado order on AI claims and the high-risk dates of 2 December 2027 and 2 August 2028.
AI Governance for HR Teams: Compliance Guide
Was: Said New Jersey has passed requirements for AI disclosure in employment decisions effective in 2026.
Now: New Jersey has no signed AI employment disclosure law; bills A3854 and A3855 were not signed. Existing NJLAD and Division on Civil Rights disparate impact rules still apply (see our New Jersey guide).
AI Regulatory Readiness Scorecard for Software and Biotech
Was: Listed Maryland among laws that require employers to notify candidates when AI is used in screening or assessment.
Now: Maryland HB 1202 (Labor and Employment 3-717, in effect since October 1, 2020) requires the applicant's signed waiver before facial recognition is used in an interview; Illinois and New York City carry the notice rules.
AI Governance for HR Teams: Compliance Guide
Was: Said Maryland prohibits using facial recognition for employment decisions in most circumstances.
Now: Maryland HB 1202 (Chapter 446 of 2020, Labor and Employment 3-717, in effect since October 1, 2020) bars facial recognition that creates a facial template during a job interview unless the applicant signs a consent waiver.
HR AI Governance: EU AI Act and EEOC Rules for AI Hiring
Was: Said Maryland House Bill 1202 requires disclosure before facial recognition in video interviews.
Now: Maryland HB 1202 (Chapter 446 of 2020, Labor and Employment 3-717, in effect since October 1, 2020) bars facial recognition that creates a facial template during a job interview unless the applicant signs a consent waiver.
EEOC AI Hiring Guidance 2026: Employer Compliance Checklist
Was: Said Maryland HB 1202 only requires notifying candidates before AI facial recognition analysis is used in hiring.
Now: The law (Chapter 446 of 2020, Labor and Employment 3-717, in effect since October 1, 2020) bars facial recognition that creates a facial template during an interview unless the applicant consents by signing a waiver.
MiraclePlus Sanctions: What US AI Teams Need to Check
Was: Said a judge sentenced Linwei Ding to 12 months.
Now: The September 1, 2026 minute entry (docket 457, N.D. Cal. 3:24-cr-00141) commits him to 12 months minus one day, followed by two years of supervised release.
AI vendor scorecard, Notion AI card
Was: Described Notion AI as an add-on to existing Notion plans.
Now: Notion's pricing page includes Notion AI in the Business and Enterprise plans; Free and Plus get a trial of Notion AI, after which Notion asks for an upgrade to Business or Enterprise.
Glossary: EU AI Act, Limited-Risk AI System and Watermarking / Content Provenance
Was: Said minimal-risk AI carries no mandatory obligations, only voluntary guidelines; that limited-risk systems should add disclosures "now" without saying Article 50 already applies; that a one-line UI notice covers AI-generated content; that labeling covers deepfakes and emotional-state inference; and that any AI-generated content a team publishes must be disclosed.
Now: The Article 4 AI literacy duty applies to every provider and deployer and has since February 2, 2025. Article 50 has applied since August 2, 2026: chatbots tell users they are AI, providers mark generative AI outputs in a machine-readable format, deployers inform people exposed to emotion recognition and disclose deepfakes and AI-generated text on matters of public interest unless it had human editorial review.
California SB 53 regulation card and OpenAI SB 53 news post
Was: Said critical safety incidents posing an imminent risk of death or serious injury must be reported to the Office of Emergency Services (the post: to California) within 24 hours. Both also said the transparency report must come before a frontier model is deployed, and the card did not say the $1 million penalty applies to large frontier developers.
Now: The 15-day report goes to the Office of Emergency Services; an incident posing an imminent risk of death or serious physical injury must be disclosed within 24 hours to an appropriate authority, such as a law enforcement or public safety agency (Business and Professions Code 22757.13(c)). The transparency report is due before or at the same time as deployment (22757.12(c)). The civil penalty of up to $1 million per violation applies to a large frontier developer (22757.15(a)).
Meta Layoffs Lawsuit: AI Flagged Workers on Medical Leave
Was: Called Does 1 through 26 v. Meta a class action, said terminations were finalized on July 22 and the case was moving into discovery in court, and counted eight PDA plaintiffs.
Now: The 26 plaintiffs sued as individuals under Meta's class-action waiver, seeking relief in aid of arbitration. Judge Orrick denied the TRO on July 17, 2026; July 22 was the scheduled separation date; ten plaintiffs bring the Title VII/PDA counts (eight women on pregnancy or maternity leave, two men on parental leave).
AI Training Data Copyright: What the Bartz Ruling Means
Was: Said a 2026 settlement confirmed that training on licensed works is fair use, that the court made fair use conditional on lawfully acquired data, that final approval was granted at the May 14, 2026 hearing, that authors get $3,100 per work and that payments began in June 2026.
Now: The fair use ruling is Judge Alsup's June 23, 2025 order (training fair use, pirated library copies not). Final approval came on July 20, 2026, at about $3,000 per work less costs and fees; first payments are expected by November 15, 2026.
AI Adoption Governance: Stop the Quiet Rebellion
Was: Said 21% of workers have never been warned about AI policy.
Now: WalkMe's 2026 figure, as reported by Fortune on April 9, 2026, is the reverse: only 21% of workers report ever being warned about AI policy.
Workday AI Lawsuit: What HR Teams Using AI Screening Must Do
Was: Said the EEOC has held since 2022 that employers cannot shift discrimination liability to AI vendors, as if that guidance were still current, and that a selection rate under 80% of the top group's is evidence of discrimination.
Now: The EEOC removed its May 2022 and May 2023 AI documents on January 27, 2025; Title VII, the ADA and the ADEA still apply. Under 29 CFR 1607.4(D) a rate under four-fifths is generally regarded as evidence of adverse impact.
Emergent Robotics Capabilities: π0.7 and Governance Risks (legacy post, noindex)
Was: Said π0.7 learned an air fryer task from a clip of inserting a bottle with 80% success, cited a 3x gain, "Levine's scaling law" and percentages credited to NIST, ISO/IEC 42001, the OECD and ENISA, said the EU AI Act classifies "prohibited unpredictable AI", and showed an unsourced Isaac Sim code line.
Now: Physical Intelligence's post names two air fryer episodes plus DROID data as the closest training data; its paper's 80% is a laundry-folding success rate on a UR5e robot and unseen tasks run 60-80%. The AI Act has no unpredictable-AI category. The other figures and the code line were removed.
Microsoft 365 vs Google Workspace GDPR: Copilot vs Gemini
Was: Said Google states no processing region for Gemini and that we found no region commitment for Gemini features.
Now: Google's Workspace Data Regions page lists Gemini prompts and responses as covered data: at rest on every Data Regions version, and in use on Enterprise or Assured Controls Data Regions. Gemini Notebook, logs and cached content are not covered.
AI Workforce Displacement and the WARN Act in 2026
Was: Cited "Illinois AI Regulation and Employment Act proposals" with no bill number or source, and cited Article 13 of the EU AI Act as a duty to inform workers about high-risk AI that applies now.
Now: We could not confirm an Illinois bill by that name; the post cites Public Act 103-0804 (HB 3773), in force since January 1, 2026. The worker notice is in Article 26(7), and for Annex III employment systems it applies from December 2, 2027.
AI Governance: Exit Timing 12-Month Window (legacy post, noindex)
Was: Named a "Federal AI Risk Act (FARA)", a "US Federal AI Safety Act" and an upcoming "Health-AI Act" with a low-risk tier, and gave regulatory dates (October 1, 2026, Q4 2026, early 2027), a "Model-Risk Regulation" with 12 control categories and a 90-day enforcement grace period.
Now: None of these exist in GovInfo, congress.gov or the Federal Register; the only HEALTH AI Act is H.R. 7381 (118th Congress), referred to committee in February 2024. The nearest real bill is H.R. 8819, the Federal Artificial Intelligence Risk Management Act of 2026, which covers federal agencies and is in committee. The examples no longer name laws or dates.
AI Coding Tool Governance: Cap Copilot and Claude Code Spend
Was: Said a user who exhausts their Copilot budget loses Copilot access, quoted GitHub's docs as saying "there is no automatic fallback to lower-cost models when a budget is exhausted", and quoted an older wording of the additional-usage default.
Now: A spent user budget blocks the features that draw AI credits; inline completions and next edit suggestions keep working. GitHub's docs no longer carry the fallback sentence, so the post cites their "hard stop" wording, and the default quote matches the current page.
AI Data Privacy for Small Teams: GDPR and CCPA Checklist
Was: Described our GDPR-compliant AI assistants comparison as covering six assistants including Cohere, and said California SB 942 requires deployers of generative AI tools to implement AI content detection.
Now: The comparison covers five assistants; Cohere was dropped on October 15, 2026. SB 942's duties fall on covered providers, which must offer a free disclosure verification tool and add latent disclosures; SB 1000 renamed the tool and removed the user threshold on September 30, 2026.
AI Governance for Small Teams: The Complete Guide (2026)
Was: Described our GDPR-compliant AI assistants comparison as covering six assistants including Cohere, and said the FTC, SEC, state attorneys general and the EEOC were all running simultaneous AI enforcement actions.
Now: The comparison covers five assistants; Cohere was dropped on October 15, 2026. The enforcement sentence now cites only what our linked FTC enforcement guide documents: FTC and state attorney general cases.
OpenAI Trust Portal: GDPR Article 28 Guide for Enterprise
Was: Said OpenAI's sub-processor list names five cloud infrastructure providers.
Now: The list, last updated October 14, 2026, names six: Cerebras is the sixth, processing in the United States and Canada.
Seedance 2.5 Business Risk Checklist: ByteDance AI Video
Was: Said Seedance 2.5 had been live on CapCut and Dreamina since July 31, 2026, described a three-minute long-video mode, paraphrased the Disney letter and the senators' letter inaccurately, and treated the studio disputes as wholly unresolved.
Now: CapCut's July 31 announcement put the rollout start in the following week, in Europe, Asia, the Middle East and South America. No source supports a three-minute mode. The quotes now match Axios and CNBC, and the post adds the August 17, 2026 MPA agreement with ByteDance, whose terms weren't published.
Texas TRAIGA Complaint Portal Is Live: What AI Teams Do Now
Was: Said the TRAIGA complaint portal opened September 1, 2026, that for eight months nobody could file, that the attorney general spent that time on sandbox rules, staffing and training, and that the AG can open a TRAIGA investigation on its own initiative.
Now: September 1, 2026 was the statutory deadline; the Consumer AI Rights page with its File An AI Complaint button was archived on July 2, 2026. The unsourced claims are removed, and the post now notes that Section 552.103 ties the demand power to complaints received through the mechanism.
AI Acceptable Use Policy Generator: Fill-in Template
Was: Said the template was structured to satisfy FTC requirements and EU AI Act transparency obligations, cited AI Act Article 13 as transparency obligations for deployers and Article 28 as deployer obligations, and said most small teams don't need legal review.
Now: No template satisfies those laws on its own. Article 13 covers information providers give deployers, Article 28 concerns notifying authorities, and deployer obligations are in Article 26. A table now maps each section to GDPR Article 28(3), HIPAA 164.502(e), 16 CFR 465.2 and AI Act Articles 4, 26(7) and 50(1).
FTC AI Marketing Claims: Substantiation Checklist
Was: Dated the DoNotPay and accessiBe settlements to January 2025, said accessiBe promised 48-hour compliance, said Air AI collected about $19 million, cited a 2023 FTC AI report and 2024 staff guidance we could not verify, quoted a Cox Media tagline without a source, and said the Cox order bans pre-checked boxes and bundled consent.
Now: DoNotPay was announced September 25, 2024 and finalized February 11, 2025; accessiBe was announced January 3, 2025. The unsourced figures, documents and tagline are removed. The FTC's Cox statement covers mandatory terms of service for an invasive service, and the orders were finalized August 27, 2026.
SEC AI Examination 2026: What Examiners Will Ask About AI
Was: Said the SEC embedded AI oversight into every FY2026 examination category, that the priorities require written supervisory procedures for every AI tool and fiduciary analysis of AI recommendations, that there is no de minimis threshold, and attributed a table of examiner checks to the priorities.
Now: The FY2026 priorities cover AI under emerging financial technology and cybersecurity (accurate AI claims, policies to supervise AI, automated advice consistent with client profiles) and create no new obligations. The table is now labelled as our mapping, and the FY2027 priorities of October 23, 2026 are covered.
AI Enforcement 2026: FTC, SEC, State AGs, DOJ and EEOC
Was: Said the SEC's FY2026 examination priorities embed AI oversight across every exam category and that the SEC brought AI washing actions against advisers in 2024 and 2025.
Now: The priorities say examiners will review AI capability representations for accuracy; the advisers case is the March 18, 2024 Delphia and Global Predictions settlement ($400,000 in total penalties).
AI incident reporting: when you must notify regulators
Was: Put the Article 73 reporting duty on deployers with a 72-hour initial notice, cited Article 73(5) for general-purpose AI models, said Article 73 obligations apply now, gave NHTSA crash deadlines of 24 hours and 10 days, said aviation crews must report through ASRS, and said the FTC requires AI incident reports.
Now: Providers report (15 days; 2 days for widespread infringement or critical-infrastructure disruption; 10 days after a death); deployers inform the provider first under Article 26(5). GPAI duty is Article 55(1)(c). High-risk rules apply from December 2, 2027 and August 2, 2028. NHTSA's amended order sets five days for the most severe crashes. ASRS and FTC claims removed.
New York's 3 AI bills: what employers should prepare for
Was: Said all three bills were awaiting the governor; described the votes as 137-0, 60-0 and near-unanimous; said the workforce reporting bill had no explicit penalty and that reports wouldn't be published; compared the notice bill to an FTC proposed policy and FTC disclosure standards without a source.
Now: S9051-B was signed October 28, 2026 (Chapter 368, effective January 1, 2027). A9581-B passed the Assembly 105-35; Senate tallies are unconfirmed. The workforce bill sets up to $500 a day with a 90-day cure, and the Department of Labor would publish an aggregate report. The FTC comparisons were removed and the chatbot feature list now follows the enacted text.
TypeScript AI agent logging and audit trail patterns
Was: Used the deprecated gen_ai.system attribute and the removed gen_ai.prompt and gen_ai.completion fields, captured prompts by default, cited semantic conventions v1.37 and v1.38, said span attributes are retained forever, tied EU AI Act logging to an August 2, 2026 enforcement date, said a review log satisfies the Act's human oversight requirements, and cited SOC 2 CC6 and an EEOC audit trail without a source.
Now: The GenAI conventions now live in a separate OpenTelemetry repository, use gen_ai.provider.name and capture no content by default (OTEL_INSTRUMENTATION_GENAI_CAPTURE_CONTENT defaults to NO_CONTENT). Annex III logging rules apply from December 2, 2027; Article 26(2) oversight is framed as assigning competent people. Unsourced mappings removed; the review trail is append-only.
AI rollout governance: employee resistance checklist
Was: Described the Writer and Workplace Intelligence survey as covering workers across the U.S., the U.K. and Europe; linked a Fortune URL that returns 404 and Writer's homepage; repeated untraced forum anecdotes (a sprint costing tens of thousands of dollars, fabricated fire codes, a VP sorting a list).
Now: Writer's survey page lists the US, UK, France, Germany and Australia, at companies with 100 or more employees. Links now point to the live Fortune article and the report page. The untraced anecdotes were removed; the community quotes are linked Reddit comments.
ChatGPT vs Claude vs Gemini: enterprise compliance
Was: Said none of the three vendors sign HIPAA BAAs; said Claude consumer chats may be used for training; listed Business as Claude's minimum plan for a DPA; used the plan names ChatGPT Team and Gemini Advanced (Google One AI Premium); said all three appoint an EU representative, with no source.
Now: OpenAI (ChatGPT for Healthcare, Enterprise with Regulated Workspace, API), Anthropic (HIPAA-ready services incl. API and Enterprise) and Google (Workspace BAA, Gemini included) all offer BAAs for specific products. Claude Free, Pro and Max users choose whether chats train models. Anthropic's DPA is in the Commercial Terms, covering Claude Team. ChatGPT Team was renamed Business on August 29, 2025. The EU representative row was removed.
Judge voids Pentagon Anthropic blacklist: vendor guide
Was: Dated Judge Lin's ruling August 28, 2026; said Hegseth acted in February 2026 under 10 U.S.C. 3252 and FASCSA together; gave the case as No. 72379655; said the government had partnered with Anthropic on Mythos; called the second case a D.C. district court complaint; the TL;DR told contractors they could resume using Claude.
Now: The opinion and judgment were filed August 27, 2026 in No. 3:26-cv-01996-RFL (72379655 is CourtListener's docket ID). The directives came February 27 and the Section 3252 letter is dated March 3; the FASCSA Section 4713 designation is a separate action the D.C. Circuit upheld 2-1 on September 25. The court says the government is discussing collaboration on Mythos. The resume line was removed.
Was: Described the Evolv Technologies order only as a stipulated order filed with the complaint that the FTC lists as pending, which left it unclear whether the order was in force.
Now: The federal court in Massachusetts entered the stipulated order on December 5, 2024 (No. 1:24-cv-12940, docket entry 19). The FTC's case page still lists the case as pending.
NYC Chatbot Doom Loop Rule: Customer Service Checklist
Was: Gave November 19, 2026 as the deadline for comments on DCWP's proposed Automated Customer Service Systems rule and as the date of the public hearing.
Now: The NYC Rules page lists both as December 18, 2026 (hearing 11:00 AM; "Comments close by December 18, 2026"), and Wiley's October 29 client alert gives the same date. DCWP's notice PDF and hearings page still said November 19 when we checked on October 30.
AI governance roles and responsibilities for small teams
Was: Cited Article 20 for deployer log retention, Article 26(6) for assigning monitoring to a competent person, Article 26(3) for the DPIA and Article 26(7) for informing affected individuals; called the three-role structure the legal minimum for Annex III use; misdescribed NIST AI RMF GOVERN 1.1, 1.4, 2.2, 4.1, 6.1, MAP 5.1 and MANAGE 4.1; tied an AI register to Article 70.
Now: Logs are Article 26(6), human oversight by competent people Article 26(2), monitoring 26(5), the DPIA 26(9), workers 26(7), affected individuals 26(11); the Act names no roles. NIST subcategories quoted from AI 100-1. Article 70 designates national authorities. Unchecked ISO 42001 clause claims, time estimates and salary ranges removed.
How to add AI tools to your SOC 2 program
Was: Described CC6.8 as unauthorized disclosure, CC4.2 as fraud risk, A1.1 as dependence on AI tool uptime, CC6.7 as transmission and disposal and CC6.1 as logical and physical access; described AI questions asked by auditors at several major firms and a SOC 2 CCM questionnaire.
Now: Per the AICPA 2017 Trust Services Criteria (2022 points of focus): CC6.8 covers unauthorized or malicious software, CC4.2 the communication of control deficiencies (fraud risk is CC3.3), A1.1 processing capacity (business disruption is CC9.1), CC6.7 transmission, movement and removal, CC6.1 logical access. The unsourced auditor claims were removed.
Who owns AI-generated content? Copyright rules
Was: Said Thaler's image came from his DABUS system and treated the August 2023 District Court ruling as final; dated Copyright Office guidance February 2023 and 2024; said the Office indicated that extensive prompting can be evidence of authorship; said a work-for-hire agreement transfers contractor work outside the statutory categories.
Now: The image came from the Creativity Machine; the D.C. Circuit affirmed on March 18, 2025 and the Supreme Court denied review on March 2, 2026. The guidance was published March 16, 2023. The Office's January 2025 report says prompts alone do not provide sufficient control. A written assignment is needed.
AI data retention policy template
Was: Cited AI Act Article 26(5) for deployer log retention, an Article 12 three-year minimum for AI output review records and a ten-year training data rule under Article 10; gave OFCCP retention thresholds as 50 employees and $50,000; attributed a 25-month period to FCRA 15 USC 1681w; called FTC commercial surveillance work a 2023 policy statement.
Now: Deployer logs: Article 26(6), at least six months. Articles 10 and 12 set no retention period; Article 18 sets ten years for provider documentation. The OFCCP rule used 150 employees and $150,000 and was rescinded effective October 26, 2026 (91 FR 54444). The 25 months comes from Regulation B, 12 CFR 1002.12. The FTC statement claim was removed.
Amazon KDP AI-generated books: surge data and the rules
Was: Said Amazon had escalated to account-level restrictions and suspensions for undisclosed AI content and was reviewing older titles; cited Amazon data that over 40% of new KDP titles in Q1 2026 involved AI and a researcher estimate of two-thirds; listed AI disclosure rules at Smashwords, Draft2Digital, IngramSpark, OverDrive and Hoopla.
Now: No source was found for any of these, so they were removed. NBER Working Paper 34777 reports that AI-containing books topped half of 2025 releases; KDP's content guidelines describe rejecting or removing a title, with notice and an appeal.
EU Product Liability Directive and AI
Was: Said Directive (EU) 2024/2853 was adopted in November 2024, published on December 18, 2024 and in force since December 9, 2024; said the AI Liability Directive was still at proposal stage in mid-2026; said trade secrets would not shield model documentation in disclosure.
Now: The Directive is dated October 23, 2024 and entered into force on December 8, 2024; December 9, 2026 is the transposition deadline and the start of application to new products. The Commission withdrew the AI Liability Directive proposal (notice published October 6, 2025). Article 9 requires courts to protect confidential information when they order disclosure.
German court rules Google liable for false AI Overviews
Was: Called the EU AI Liability Directive still pending.
Now: The Commission withdrew the AI Liability Directive proposal; the withdrawal notice was published in the Official Journal on October 6, 2025.
Privacy-first AI APIs: which ones don't train on your data
Was: Said Google uses Google AI Studio and unpaid Gemini API content to improve its products, without the exception for users in the EEA, Switzerland and the UK; listed Anthropic zero data retention as available by agreement without noting that Covered Models (Claude Mythos 5 and 5.1, Claude Fable 5 and 5.1) have required 30-day retention since June 9, 2026; marked Cohere's DPA as not verified.
Now: Google's Gemini API terms apply the paid-service data terms to AI Studio and the unpaid quota for users in the EEA, Switzerland and the UK. Anthropic's API docs say Covered Models need 30-day retention and are not available under ZDR unless Anthropic expressly authorizes it. Cohere's enterprise data commitments page tells SaaS customers to email [email protected] for its DPA.
Vendor scorecard and privacy API selector
Was: Showed Cohere's DPA as unknown. The selector's training filter was defined as no training by default or by contract, yet listed Mistral and Cohere, which both train on API data until you opt out. The Anthropic card gave zero data retention by agreement without the Covered Models exception, the Google card said unpaid Gemini API data can improve Google products without the EEA, Switzerland and UK exception, and the Azure DPA link opened a data privacy FAQ.
Now: Cohere shares its DPA with SaaS customers on request ([email protected]). The filter now covers providers that don't train by default or let you switch training off, and the Mistral and Cohere notes say training stays on until you opt out. Covered Models (Claude Mythos 5 and 5.1, Claude Fable 5 and 5.1) require 30-day retention. EEA, Swiss and UK users get Google's paid-service data terms on unpaid use. The Azure link opens the Microsoft Products and Services DPA. The seven API providers other than DeepSeek were re-checked on October 24, 2026.
Was: The unpaid Gemini API / AI Studio row said Google uses that content to improve its products, without the exception for users in the EEA, Switzerland and the UK.
Now: The row now says the paid-service data terms apply to those users, as Google's Gemini API terms state.
AI coding tools governance policy
Was: The Google AI Studio row said unpaid content is used to improve Google products, without the exception for users in the EEA, Switzerland and the UK.
Now: The row now says the paid-service data terms apply to those users, as Google's Gemini API terms state.
Was: An FAQ question called the Illinois video interview law the "Illinois AEIA". No Illinois law has that name.
Now: The law's short title is the Artificial Intelligence Video Interview Act (820 ILCS 42/1, in effect since January 1, 2020); the question now uses that name.
AI vendor governance scorecard
Was: Showed ISO 27001 as unknown for the OpenAI API and for AWS Bedrock, and SOC 2 as unknown for AWS Bedrock, so the ISO 27001 and SOC 2 filters left them out.
Now: OpenAI's trust portal lists ISO/IEC 27001:2022 for the API, ChatGPT Enterprise and Edu; AWS lists Amazon Bedrock as in scope of its ISO 27001 certification and its SOC reports.
EU AI Act Article 13: what deployers must tell users
Was: Said the Article 13 obligations apply from August 2027 and put the deployer's duty to tell people under Article 13, including for a diagnostic AI tool in a clinic.
Now: High-risk rules apply from December 2, 2027 (Annex III) and August 2, 2028 (Annex I products). Article 13 binds providers; the duty to inform people is Article 26(11) and covers only Annex III systems that make or help make decisions about them.
EU AI Act Article 9 risk management system guide
Was: Pointed to an August 2027 compliance deadline for high-risk systems and said third-party conformity assessment applies mainly to Annex III categories.
Now: High-risk rules apply from December 2, 2027 (Annex III) and August 2, 2028 (Annex I products). Annex III points 2 to 8 use internal control without a notified body (Article 43(2)); notified bodies come in for some biometric systems and for Annex I products.
Was: The summary said the EU AI Act duties apply to high-risk systems from December 2, 2027.
Now: December 2, 2027 is the date for Annex III systems; for high-risk AI in Annex I products, such as medical devices, the duties apply from August 2, 2028.
EU AI Act high-risk classification: May 2026 guidelines
Was: Said the December 2, 2027 date also covers most transparency requirements, gave August 2, 2027 for Annex I product-safety systems, and said four national authorities had announced enforcement plans.
Now: Article 50 transparency rules have applied since August 2, 2026; Annex I high-risk rules apply from August 2, 2028; the unsourced claim about national authorities was removed.
AI governance for healthcare startups: HIPAA and HITECH
Was: Said the EU AI Act deadline for diagnostic and triage AI was December 2, 2027 and called healthcare AI high-risk by default.
Now: Diagnostic AI that is a medical device, or a device's safety component, needing third-party conformity assessment is high-risk via Article 6(1) and Annex I, from August 2, 2028; December 2, 2027 is the Annex III date, which covers emergency patient triage.
What is the EU AI Act? Plain-English guide
Was: Put medical AI under the December 2, 2027 high-risk date and said Annex I products follow product safety timelines.
Now: AI in medical devices is high-risk via Article 6(1) and Annex I when the device needs third-party conformity assessment, and those rules apply from August 2, 2028.
AI governance for small teams: the complete guide
Was: Said EU AI Act high-risk rules apply to any AI used in clinical diagnosis, treatment or patient management, and grouped healthcare under the December 2, 2027 deadline.
Now: Medical AI is high-risk when it is a medical device, or a device's safety component, needing third-party conformity assessment (Article 6(1) and Annex I), from August 2, 2028; emergency patient triage is the Annex III case.
Denmark deepfake bill: consent record and takedown templates
Was: Said no effective date had been fixed for the Danish deepfake bill and that the bill text could not be read.
Now: The bill as introduced on October 8, 2026 (L 49, section 2(1)) enters into force on January 1, 2027 if the Folketing passes it; its notes make the face-and-voice rule a civil matter with no criminal penalty and no takedown deadline.
ConnectWise Cloud Backup breach: what to check in M365
Was: Said Storm-0940 tried to sign in to more than 2,250 tenants at 2,900 attempts a minute.
Now: Microsoft gives two figures: more than 2,250 tenants after the ConnectWise compromise, and a peak of 2,900 failed logons a minute on October 11 in the earlier password spray against 327 accounts.
Italy's Garante fine against Character.AI
Was: Said the Garante's orders map almost exactly onto Colorado's HB 26-1263, that the Colorado act requires private-by-default profiles for minors, that its parental tools cover parents of under-13 users, and that the investigation ran for nearly three years.
Now: HB 26-1263 overlaps only on age estimation: it has no cooling-off period and no private-by-default duty, and its privacy tools cover minors and a parent or guardian of any minor. The investigation ran 20 months (November 2024 to July 2026).
California 2026 AI bills tracker
Was: Said AB 1609 gives no revenue threshold, called all 13 September 30 signings AI bills, and quoted SB 951 in words its source did not use.
Now: AB 1609's chaptered text covers businesses with more than $500 million in gross annual revenue nationally; 12 of the 13 signings are AI bills (AB 1864 is gene synthesis); SB 951 is quoted from the chaptered bill.
Newsom's September 30 AI signings: who must act
Was: Described AB 1331 and AB 1883 together as covering workplace surveillance tools in bathrooms.
Now: Only AB 1331 covers restrooms; AB 1883 bars workplace surveillance tools that collect neural data or predict a worker's emotional state.
Colorado Chatbot Safety Act (HB 26-1263)
Was: Told operators to count crisis referrals for calendar year 2027 for the July 1, 2027 annual report.
Now: The statute asks for referrals in the preceding calendar year and does not say which year the first report covers; the checklist now says so and suggests raising it at the October 26 hearing.
Anthropic's Project Panama and the FTC letter
Was: Said the groups' FTC letter warns that rare books could be destroyed with AI firms taking the last copies.
Now: The letter says rare, out-of-print titles are among the books being brokered and asks the FTC to find out how often a destroyed copy was one of the last; the public record does not show it.
AI acceptable use policy template
Was: Told financial services teams to add disclosure duties under "CFPB guidance" and EU teams to reference their "conformity assessment status".
Now: Points to ECOA and Regulation B (12 CFR 1002.9), since the CFPB withdrew its adverse action circulars on May 12, 2025, and to the EU AI Act Article 26 deployer duties; conformity assessment is a provider duty.
Was: Left "and public benefits" out of Colorado's consequential-decision list, said which columns regulators look at first without a source, and quoted a Reddit thread its moderators have since removed.
Now: Colorado list completed from SB 26-189, the unsourced claim replaced with our own suggestion, and the Reddit section removed.
Notion AI vs Microsoft Copilot
Was: Said Notion Enterprise has zero retention at every model provider and that Notion AI uses Notion-hosted models plus Anthropic and OpenAI.
Now: Notion now says most Enterprise models have zero retention and the rest are off until an owner opts in; its subprocessor list also names Google, xAI, Cerebras and three inference providers.
ChatGPT product liability cases (JCCP 5431)
Was: Our take said "a dozen families" expect the cases to turn on the same questions.
Now: One of the 12 coordinated cases was brought by First County Bank, which opposed coordination with the Raine family; the sentence now describes the 12 cases accurately.
Fintech AI governance (CFPB, FCRA)
Was: Cited "CFPB guidance" for adverse action reason rules and said a notice needs at least four reasons.
Now: Cites Regulation B (12 CFR 1002.9(b)(2)): no fixed number of reasons, more than four not likely to be helpful; the CFPB circulars were withdrawn on May 12, 2025.
Was: The financial decision-making item listed "CFPB guidance" alongside FCRA and ECOA.
Now: Points to Regulation B adverse action notices; the CFPB circulars were withdrawn on May 12, 2025.
Was: The Notion AI entry said Enterprise has zero retention at its LLM providers.
Now: Most Enterprise models have zero retention; the few that keep data are off until the workspace owner opts in.
Meta Commercial Terms crawl clause
Was: Said the US English and UK English editions of Meta's Commercial Terms preview disagree, and that the UK English edition still let Meta use crawled website content to "train" Meta Company Products (the text we saw on October 19).
Now: On October 22 both editions limit crawled content to advertising and business products and neither says train. The post also adds the CMA's letter to Meta and the German publishers' request to the European Commission.
AI employee monitoring laws guide
Was: Said Connecticut's notice must describe the methods used, that GDPR requires a DPIA for all large-scale employee monitoring, that Article 22 gives a right to object, and that the NLRB had signaled more scrutiny of AI monitoring; also made unsourced claims about Florida, Washington's health data law, French law, EU court rulings, BIPA settlements and HIPAA.
Now: Rewritten against the statutes: Connecticut requires notice of the types of monitoring (a posting counts), a DPIA is required where high risk is likely, Article 22 is a right not to be subject to solely automated decisions, and the NLRB monitoring memo was rescinded in 2025. The unsourced claims were removed.
Illinois AI employment law guide
Was: Treated the AI Video Interview Act and HB 3773 as one law: said the Video Interview Act took effect January 1, 2026, carries a $500-per-day penalty enforced by the Department of Labor or DCEO, requires written consent, an opt-out to human review and a ban on AI as the sole hiring factor, and covers Illinois residents wherever the job is.
Now: The Video Interview Act (820 ILCS 42) has applied since 2020 to AI analysis of recorded interviews for positions based in Illinois: notice, explanation, consent, limited sharing, deletion on request and a demographic report if AI alone picks in-person interviews; it has no penalty section. HB 3773 (P.A. 103-0804) amends the Human Rights Act from January 1, 2026. The unsourced tool table was removed.
AI hiring tool compliance state-by-state matrix
Was: Described Illinois HB 3773 as an amendment to the AI Video Interview Act requiring written notice, written consent and a human review option for AI-analyzed video interviews of Illinois-resident candidates.
Now: Two separate laws: the Video Interview Act (since 2020) requires notice, an explanation and consent for positions based in Illinois, with no human review option; HB 3773 amends the Human Rights Act and covers any AI in employment decisions from January 1, 2026.
Workday AI lawsuit HR screening checklist
Was: Said the Illinois AI Video Interview Act requires written consent and bans AI analysis as the sole basis for a hiring decision.
Now: The act requires notice, an explanation and consent, without saying written, and has no sole-basis ban; HB 3773 is a separate Human Rights Act amendment.
EEOC AI hiring guidance employer checklist
Was: Said the Illinois AI Video Interview Act requires written consent.
Now: It requires consent before the interview and doesn't say written. HB 3773 was added to the state table as a separate law.
Was: Listed only "written notice" before AI video interview analysis for Illinois.
Now: Notice, an explanation and consent before an AI-analyzed video interview (Video Interview Act), plus HB 3773's notice duty for any AI used in employment decisions.
FCRA AI hiring disclosure requirements
Was: Said the Illinois AI Video Interview Act was amended effective January 1, 2026, requires written consent, bans AI as the sole hiring factor and applies to anyone hiring Illinois residents.
Now: The act dates from 2020, requires consent without saying written, has no sole-factor ban and covers positions based in Illinois; January 1, 2026 is HB 3773, a separate law.
Multi-state AI compliance strategy
Was: Said Illinois amendments extending to broader AI employment use took effect in 2024.
Now: HB 3773 was signed in 2024 and took effect January 1, 2026.
US state AI law tracker, June 2026
Was: Said Illinois HB 3773 requires written notice before using the tool and is "just disclosure".
Now: HB 3773 requires notice, without saying written, and also bars AI with a discriminatory effect on protected classes and zip codes as a proxy.
One Big Beautiful Bill AI preemption
Was: Said the Illinois AI Video Interview Act "has survived multiple legal challenges".
Now: We found no court decision applying the act; the claim was removed.
Utah AI Policy Act compliance guide
Was: Called the AI Policy Act "HB 452", signed March 22, 2024, with a "sincerely asks" trigger and no up-front disclosure for anyone; said Utah was the first state with such a law and that there is no private right of action.
Now: The act was SB 149, signed March 13, 2024; SB 226 (2025) moved the rules to Utah Code 13-77 with a clear-and-unambiguous-request trigger and an up-front duty for regulated occupations in high-risk interactions. HB 452 is the mental health chatbot law. The unsourced claims were removed.
Employee monitoring laws by state tracker
Was: Cited New York "Labor Law § 740A" with a signed acknowledgment before monitoring, said Delaware always requires a written acknowledgment, described Illinois draft rules open for comment with a four-year retention rule and Attorney General penalties, and said remote workers are covered wherever they live.
Now: New York is Civil Rights Law §52-c: notice upon hiring, acknowledged in writing or electronically, and posted. Delaware needs an acknowledgment only for its one-time notice. Illinois withdrew its draft rules on June 2, 2026, and the act has no retention rule or AI-specific penalty. New York and Delaware turn on the employer's place of business.
AI employee monitoring laws 2026
Was: Said New York requires a new notice whenever monitoring practices change and a description of what is monitored, and that Delaware always requires prior written notice.
Now: New York's Civil Rights Law §52-c notice is given upon hiring, in the statute's blanket wording, acknowledged and posted. Delaware accepts a daily electronic notice or an acknowledged one-time notice.
AI hallucination sanctions tracker
Was: Dated the Couvrette v. Wisnovsky sanction to Q1 2026 and United States v. McGee to October 14, 2025, gave the Whiting docket as No. 25-5425, called all five cases 2026 sanctions for AI output, and said Stewart's corrections added new false quotations without acknowledging the problem.
Now: Couvrette's sanctions order is dated December 12, 2025 (fee order March 23, 2026); McGee was filed October 10, 2025; Whiting is Nos. 24-5918/5919 and 25-5424, and AI use there was never established; Stewart's corrections swapped in real quotations that changed the meaning, and she conceded the Rule 11 violation.
State chatbot disclosure laws 2026
Was: Said California SB 243 covers every customer support chatbot, requires disclosure only when a user sincerely asks and lets any user sue over a denial, and that Utah requires proactive disclosure at the start of any AI interaction.
Now: SB 243 covers companion chatbots, excludes bots used only for customer service, requires an up-front notice when a reasonable person could think the bot is human, and gives a civil action for injury in fact; sales bots fall under SB 1001. Utah requires disclosure on a clear and unambiguous request.
Was: Said SB 243 had no private right of action, that Adam's Law was the first to give one against companion chatbot operators, and that Adam's Law has no damages floor.
Now: SB 243 already gives a civil action for at least $1,000 per violation (Section 22605). Under Adam's Law a financial-harm claim must allege more than $1,000 per child.
EU AI Act GPAI codes of conduct
Was: Said signing the GPAI Code of Practice gives a presumption of conformity, that an AI Office public register lists systemic-risk models (naming four) and holds training summaries, that the 10^25 FLOP threshold is not cumulative, and that the Code was finalised in June 2026 with four chapters.
Now: Articles 53(4) and 55(2) let providers rely on the Code to demonstrate compliance; only harmonised standards give a presumption. No Article 52(6) list found; Article 51(2) counts cumulative compute; the Code was published July 10, 2025, in three chapters.
Meta skipped the EU AI code (Llama)
Was: The page description said Llama gets no presumption of conformity because Meta did not sign the GPAI Code of Practice.
Now: Signing gives no presumption either; Article 53(4) lets signatories rely on the Code to demonstrate compliance. The description now says Meta must prove compliance another way.
Texas biometric law and AI hiring
Was: Presented Business & Commerce Code Section 503.001 as part of TRAIGA, said consent must be written and state a retention period, allowed retention up to three years, read 'per violation' as per applicant, and quoted a 'publicly available' definition and exclusions the section lacks.
Now: Section 503.001 is the Capture or Use of Biometric Identifier Act (2009), amended by TRAIGA from January 1, 2026: notice and consent before capture, no written-form rule, deletion no later than one year after the purpose expires; rebuilt from the statute text.
BIPA and facial recognition AI
Was: Said Texas CUBI requires written notice and consent.
Now: Section 503.001 requires notice and consent before capture, with no written-form rule, and deletion no later than one year after the purpose expires.
Was: Implied Texas law requires written consent and a published retention schedule for biometric data.
Now: Texas's Section 503.001 requires notice and consent before capture, with no written-form rule, and deletion no later than one year after the purpose expires.
Was: Credited the July 1, 2026 threshold changes to SB 4 instead of Public Act 25-113, said the new sensitive data categories become enforceable October 1, described the geolocation sale ban as an opt-in rule, and kept the repealed 25,000-consumer revenue test.
Now: The July 1 changes, including sensitive data, come from Public Act 25-113; SB 4 (Public Act 26-64) starts October 1, 2026 and bans the sale of precise geolocation data; the revenue test was replaced by the sale trigger.
Seedance enterprise risk checklist
Was: Described copyright litigation from Disney and Paramount, dated the MPA letter February 22, and said Seedance 2.5 entered enterprise beta in the first week of July.
Now: The studios and the MPA sent cease-and-desist letters and we found no lawsuit; the MPA letter is dated February 20, 2026; Seedance 2.5 was announced June 23 and reached CapCut on July 31, 2026.
Texas TRAIGA compliance checklist
Was: Told readers to adopt NIST AI RMF 1.0 for TRAIGA's defense and described the cure and penalty rules loosely; several FAQ answers relied on an earlier draft bill we could not source.
Now: Rebuilt step by step from the enrolled text of HB 149: the defense names NIST's Generative AI Profile or another recognized framework and covers violations found through internal review (Sec. 552.105(e)); cure, penalties and investigative demands follow Secs. 552.103-552.105.
Was: Called NIST AI RMF compliance a complete affirmative defense that protects you before a violation is alleged, misstated the AI system definition, listed exclusions the law lacks, and cited AG guidance and penalty estimates we could not source.
Now: Rewritten against Sec. 552.105(e): a defense for violations discovered through feedback, testing, agency guidelines or an internal review that substantially complies with NIST's Generative AI Profile or another recognized framework.
Was: Said documented NIST AI RMF compliance is an affirmative defense, misdescribed two banned uses, referred to an earlier draft bill without a source, and said the AG decides which violations are uncurable.
Now: The defense is the Sec. 552.105(e) internal-review route; the ban list follows Secs. 552.052-552.057; the court decides curability; health care providers' disclosure duty is noted.
Was: Said TRAIGA gives a presumption of reasonable care to companies that follow NIST AI RMF, and that the FTC has cited NIST AI RMF in enforcement actions.
Now: The presumption applies to everyone (Sec. 552.105(c)); the NIST-linked defense is separate and names the Generative AI Profile. The FTC claim was removed for lack of a source.
Multi-state AI compliance strategy
Was: Said NIST AI RMF documentation satisfies most US state safe harbors and fully satisfies Texas TRAIGA's.
Now: Texas is the only law in the comparison with a framework-linked defense, and it covers violations found through internal review.
AI acceptable use policy annual update
Was: Cited TRAIGA Sections 5, 7 and 8 for an employment-inference ban, a human review duty and an annually reviewed safe harbor program; said EU high-risk enforcement had already begun.
Now: TRAIGA's bans are in Secs. 552.052-552.057, it has no human review duty for private companies, and its defense is in Sec. 552.105(e). The Annex III rules apply from December 2, 2027.
AI governance Q3 review template
Was: Cited a TRAIGA Section 541.152 offering reduced liability for following NIST AI RMF, and said Texas regulators will examine specific NIST controls.
Now: The defense is in Sec. 552.105(e) and names the Generative AI Profile or another recognized framework; the law lists no controls.
ISO 42001 vs EU AI Act vs NIST AI RMF
Was: Called TRAIGA Senate Bill 2024 and said it gives a safe harbor for high-risk AI systems that NIST AI RMF explicitly qualifies for.
Now: TRAIGA is House Bill 149, has no high-risk category, and its defense names NIST's Generative AI Profile or another recognized framework.
AI compliance checklist by team size
Was: Said framework adoption is required for a Texas TRAIGA safe harbor.
Now: TRAIGA requires no framework; its internal-review defense names NIST's Generative AI Profile or another recognized framework.
One documentation set for EU AI Act, NIST AI RMF and TRAIGA
Was: Said TRAIGA requires a governance program with inventory, risk, oversight, incident and vendor elements, bans social scoring and biometric surveillance for everyone, and gives a safe harbor for NIST AI RMF 1.0 compliance.
Now: TRAIGA has no documentation duty; the social scoring and biometric bans bind government entities; the Texas column now maps records to Secs. 552.103-552.105.
Was: Said TRAIGA's disclosure duty covers certain other regulated entities and applies at the start of any AI-driven interaction.
Now: Sec. 552.051 covers government agencies (before or at the time of interaction) and health care providers (by the first date of service) only.
EU AI Act high-risk documentation templates
Was: Presented Articles 9-15 and Article 18's 10-year retention as deployer duties, and the sample notice promised a right to human review of any AI-assisted decision.
Now: Articles 9-15 are provider requirements (Article 16) and Article 18 binds providers; deployer duties are in Article 26, including logs kept at least six months. The notice now reflects the Article 86 right to an explanation and the GDPR Article 22 right to human intervention for solely automated decisions.
AI agent data controls register template
Was: The summary said Article 12 logging took effect August 2, 2026; called a small r/artificial post viral; merged two IBM sources and cited IBM figures we could not find; put six-month log retention in Article 12.
Now: Article 12 applies to Annex III systems from December 2, 2027; IBM's Think 2026 recap and its June study are cited separately, unsupported figures removed; retention is in Articles 19 and 26(6).
CNIL credit scoring and the AI Act
Was: Below its October 19 correction, the body still told the unconfirmed story of CNIL requests to 14 lenders as fact, and said deployers must report serious incidents within 15 days under Article 72.
Now: Body rewritten around CNIL's May 7, 2026 recommendation and the AI Act text; incident reporting is Article 73, mainly a provider duty.
AI governance Q3 review template
Was: Said Article 18 requires documentation for 10 years after the system leaves the market.
Now: The 10 years run from placing on the market or putting into service and bind providers; deployers keep logs for at least six months.
FTC says Colorado's AI bias law may be preempted
Was: Left out xAI's lawsuit against Colorado's Attorney General, where enforcement is paused by an April 27, 2026 stipulation, and the FTC's August 7 disparate-impact statement; said without a source that Texas TRAIGA and Illinois law would face the same preemption argument.
Now: The post covers the xAI case and the stipulation (no enforcement until 14 days after a preliminary-injunction ruling), notes the August 7 statement says it does not preempt state law, and drops the unsourced Texas and Illinois claim.
Does your AI vendor train on your data
Was: Said Atlassian uses data from every plan unless teams opt out, missed GitHub's April 24 training change for Copilot Free, Pro and Pro+, called consumer Copilot's opt-out limited, gave an unsourced Atlassian customer count and billed the page as an 11-vendor comparison.
Now: Atlassian's in-app data is on by default only for Free and Standard; GitHub individual plans train unless you opt out; Microsoft says consumers can opt out at any time; the page covers seven vendors.
Moonshot AI, Anthropic Fable and Treasury sanctions
Was: Gave Kimi K3's unveiling as July 15-17 and said its open weights came out July 27, without a source.
Now: K3 was unveiled July 16; the unsourced open-weights date is removed. Moonshot is on neither the OFAC SDN list nor the BIS Entity List as of October 20.
FTC AI accuracy policy: questions for your vendor
Was: Attributed the over-90% no-fact-check figure to the FTC press release, said Anthropic walked back the Fable 5 safeguard within 24 hours, and said the statement names suppression of accuracy for undisclosed commercial interests as a category.
Now: The figure is in the proposed policy statement, citing an AI developer; Fable 5 launched June 9 and Anthropic reversed course June 11. The statement's examples are ideological distortion, pressure from state law and political pressure; it names no commercial-interest category.
State AG AI chatbot lawsuits tracker
Was: Left out the October 14 eight-state suit against OpenAI and described Minnesota's law without the Eighth Circuit's October 2 injunction.
Now: The tracker lists nine states with their own suits, and the Minnesota row reflects the injunction.
EU AI Act deployer evidence gaps for SMEs
Was: Treated Articles 14, 26 and 27 as applying from August 2, 2026, put employment uses under the Article 27 impact assessment, gave deployers the Article 73 incident report and assigned chatbot disclosure to deployers.
Now: Annex III high-risk rules apply from December 2, 2027 (Annex I from August 2, 2028); Article 27 covers public-law bodies, public-service providers and credit or life and health insurance uses; Article 73 is a provider duty and deployers inform the provider; chatbot disclosure is a provider duty.
Two EU AI Act posts: agent data controls register, high-risk documentation templates
Was: The register post said enforcement for high-risk systems began August 2, 2026; the templates post said GPAI documentation was due by August 2, 2026.
Now: Annex III high-risk rules, Article 12 logging included, apply from December 2, 2027; GPAI provider obligations have applied since August 2, 2025, with until August 2, 2027 for models already on the market.
CNIL credit scoring and the EU AI Act
Was: Said high-risk obligations took effect August 2, 2026 and reported CNIL requests to 14 financial institutions on the strength of one aggregator blog.
Now: High-risk rules apply from December 2, 2027; the CNIL claim is unconfirmed, a correction leads the post and it's removed from search indexing.
Does your AI vendor train on your data
Was: Said Anthropic doesn't train on Claude conversations on any plan, and described Atlassian's data contribution change as still to come.
Now: Claude Free, Pro and Max users choose in Privacy Settings, commercial plans aren't used by default; Atlassian's change went into effect August 17, 2026.
Three EU AI Act Digital Omnibus posts, stale status and dates
Was: Said the Official Journal published the Omnibus on July 27, 2026 and still treated it in places as a provisional agreement; said it does not touch Article 5, that the remaining bans start August 2, 2026 and GPAI requirements start August 2, 2026; gave Annex I an original August 2, 2026 date; described SME exclusions not in the text.
Now: Regulation (EU) 2026/1744 was published July 24 and in force July 27, 2026; it adds two Article 5 bans from December 2, 2026; the original bans applied from February 2, 2025 and GPAI obligations from August 2, 2025; Annex I moved from August 2, 2027 to August 2, 2028; no SME sector exclusions exist.
EU AI Act Annex III guide, full re-check against the consolidated text
Was: Still described the Digital Omnibus as the May 7 provisional agreement, not yet law, with the old date given as December 2, 2027; the October 16 note called the May 7 agreement unverified (it did happen); listed insurance claims triage and all insurance pricing, travel document checks and face-based access control as high-risk; said critical infrastructure AI can need a notified body and gave GPAI obligations from August 2, 2026.
Now: Regulation (EU) 2026/1744 moved Annex III from August 2, 2026 to December 2, 2027; only life and health insurance pricing is listed, travel document verification and one-to-one biometric verification are excluded, only point 1 biometrics can need a notified body, and GPAI obligations applied from August 2, 2025.
Five EU AI Act posts: Annex III lists, Article 27 scope, provider role
Was: The compliance checklist and the sprint checklist listed nine Annex III categories with insurance in general; the checklist put banking, education and healthcare entities under Article 27; the classification post and the risk-decisioning post listed insurance pricing in general and stale Omnibus dates; the plain-English guide called startups selling a fine-tuned product deployers.
Now: Eight Annex III areas, life and health insurance only; Article 27 covers public-law bodies, private entities providing public services and credit or life and health insurance deployers; dates per Regulation (EU) 2026/1744; a company selling an AI system under its own name is its provider (Article 3(3)).
EU AI Act complete guide for small teams, three statements tightened
Was: Said the December 2026 bans hit providers of generative AI only, gave the Article 6(3) conditions as examples, and gave the two-day incident deadline only for widespread infringements.
Now: The bans also bind deployers who use a system to produce that material; one of the four Article 6(3) conditions must be met; the two-day deadline also covers a serious and irreversible disruption of critical infrastructure.
EU AI Act complete guide for small teams, full audit; insurance scope in three EU AI Act posts
Was: The Annex III table listed real-time biometric identification, all insurance risk and critical infrastructure management; clinical AI was placed under Annex III; deployers were told they cannot deploy without a declaration of conformity; three other posts listed insurance risk in general.
Now: Remote biometric identification (verification excluded), life and health insurance only, safety components only; medical-device AI is high-risk through Annex I; only public-authority deployers must not use unregistered systems.
AI vendor scorecard, HIPAA BAA column and FAQ
Was: Marked Cursor and Perplexity as offering no HIPAA BAA and Mistral and Grammarly as unknown; the HIPAA FAQ named only five vendors.
Now: Cursor and Grammarly offer BAAs on Enterprise plans and Mistral for qualifying services; Perplexity says it is HIPAA compliant but publishes no BAA terms, so it is unknown. The FAQ now covers all 17 vendors.
AI vendor DPA tracker, DeepSeek API training opt-out
Was: Said the DeepSeek API training opt-out works through the "Improve the model for everyone" setting or by email to [email protected].
Now: The setting is the opt-out; the email right in DeepSeek's privacy policy covers the account holder's own personal information, since section 5.5 of the Open Platform terms leaves end users' data in an app built on the API to the developer's own privacy policy.
GDPR Article 30 RoPA template, ten vendor entries and Article 30 notes
Was: Named OpenAI, L.L.C. at 1960 Bryant Street as processor and Anthropic, PBC for every customer; said GitHub's individual plan only may contribute to training; said Intercom does not train on customer data and HeyGen's training terms were unclear; named HeyGen Interactive, Inc. in San Francisco; said Midjourney trains unless you have a private plan and offers enterprise DPAs; gave Washington's likeness law an effective date of June 10, 2026; credited the EDPB with recommending legal basis in the RoPA and called the AI vendor a sub-processor.
Now: OpenAI OpCo, LLC, 1455 3rd Street (OpenAI Ireland Ltd. for EEA and Swiss customers); Anthropic Ireland, Limited for EEA, Swiss and UK customers; GitHub Copilot Free, Pro and Pro+ data is used for training since April 24, 2026 unless users opt out; Intercom can fine-tune on anonymized customer data and HeyGen trains on non-Enterprise inputs unless you opt out; HeyGen Technology Inc., Los Angeles; Midjourney's Stealth Mode controls visibility, not training, and we found no Midjourney DPA; Washington SSB 5886 took effect June 11, 2026; the ICO quote replaces the EDPB claim and the AI vendor is a processor.
Best AI tools for compliance, full re-check of all eight tools
Was: Said Cursor has no standard enterprise tier, Notion's audit log is partly available on Business, a Claude Business/Enterprise tier has audit logs, GitHub Copilot Individual is the personal plan, and Grammarly's extension reads passwords; used the old plan names ChatGPT Team and Grammarly Premium/Business; cited a 4-7 tools figure and called Anthropic's zero retention the strongest control of any vendor.
Now: Cursor offers SSO, SCIM and compliance logging for enterprises; Notion's and Claude's audit logs are Enterprise only; GitHub Copilot's personal plans (Free, Pro, Pro+) train on interaction data unless users opt out; Grammarly says its extensions ignore password and payment fields on a best-efforts basis; plans are ChatGPT Business and Grammarly Pro/Enterprise; the unsourced figure and superlative were removed.
Washington AI likeness law checklist, full re-check against the enacted text of SSB 5886
Was: Gave the effective date as June 10, 2026; said the law bans AI sexual deepfakes and deceptive AI media generally, requires written consent and rejects oral consent, is enforced by the attorney general, puts takedown and moderation duties on platforms and distributors, awards capped statutory damages, and exempts satire only when clearly labeled.
Now: Effective June 11, 2026 (signed March 16, 2026). SSB 5886 adds a forged digital likeness to RCW 63.60 for use in goods, advertising and fundraising; consent may be written or oral, express or implied; the bill gives the attorney general no role and platforms no duties, and RCW 63.60.070(4) exempts advertising media owners; remedies are a $3,000 civil penalty plus actual damages, profits and, for a forged digital likeness, noneconomic damages; the satire exemption has no labeling requirement. Sexual deepfakes fall under HB 1999 (2024).
AI governance metrics dashboard, Washington deadline
Was: Listed Washington's AI likeness law under June 10, 2026.
Now: June 11, 2026, per the Washington Legislature's bill page for SSB 5886.
New York synthetic performer ad law, full re-check against the enacted text of S8420-A
Was: Said platforms must remove flagged non-compliant ads within 5 days, the attorney general enforces the law, New York enacted it in January 2026, it applies to any ad reaching New York wherever the advertiser is based, deceased performers' digital replicas are exempt, and several states had introduced copies; dated Washington's AI likeness law June 10, 2026 and said it covers sexual and deceptive AI content with statutory damages.
Now: Signed December 11, 2025 as Chapter 617 of the Laws of 2025, effective June 9, 2026. Subdivision 8 exempts the media that publish or disseminate ads, so there is no takedown duty; the statute names no enforcer and draws no geographic line; deceased performers' replicas are covered by Chapter 616 (Civil Rights Law 50-f); the unsourced claim about other states was removed. Washington SSB 5886 took effect June 11, 2026 and covers use in goods, ads and fundraising, with a civil penalty plus actual damages, profits and noneconomic damages for a forged digital likeness.
TAKE IT DOWN Act compliance, full re-check against Public Law 119-12
Was: Said requests must be verified with a government ID or sworn declaration, the law requires reasonable steps against re-uploads and a removal confirmation, private messaging isn't covered, and the Act criminalizes AI-generated child sexual abuse material; described a May 19, 2026 FTC priorities statement we could not find; dated the EU Digital Omnibus May 7, 2026; said Washington's AI likeness law took effect June 10, 2026 and listed it as the state intimate-image law.
Now: Section 3 requires a written request with a signature, location information, a good-faith statement and contact details, and reasonable efforts to remove known identical copies; hashing and outcome notices are FTC advice; messages are in the covered-platform definition; child pornography is left to existing federal law; the EU Omnibus is Regulation (EU) 2026/1744 of July 8, 2026; SSB 5886 took effect June 11, 2026 and Washington's fabricated intimate images law is HB 1999 (Chapter 88, Laws of 2024).
Was: Said a valid request only needs a URL, description or hash, platforms must take reasonable steps to prevent re-uploads, penalties are $53,088 per violation per day, hosting or distributing NCII is a federal crime, California, Texas and New York let victims sue, and the May 11 letters were warning letters.
Now: A valid request is written, with a signature, location information, a good-faith statement and contact details; the Act requires reasonable efforts to remove known identical copies; the FTC cites up to $53,088 per violation, with daily counting only for a continuing failure; Section 2 covers knowingly publishing under set conditions; the state example is Washington's HB 1999; the May 11 letters were reminders and the warning letters went to 12 nudify sites on May 20.
GDPR Article 30 RoPA template, Notion AI and Grammarly entries
Was: Gave Notion's address as 2300 Harrison Street, limited Notion's DPA to Business and Enterprise, said Notion AI queries are retained 30 days, named Grammarly, Inc. as processor, said Grammarly Business data is not used for training, and linked privacy pages as the DPA references.
Now: Notion Labs, Inc., 685 Market Street, San Francisco; the DPA is part of the Master Subscription Agreement covering Plus, Business, Enterprise and any organization use; Notion's LLM providers keep data 30 days or fewer, with zero retention on Enterprise. Grammarly's processor is Superhuman Platform Inc., formerly Grammarly, Inc.; team plans bought on the website start with training on until an admin turns it off. Both entries link the current DPAs.
Best AI tools for compliance, Notion AI and Grammarly sections
Was: Said Notion's DPA covers only Business and Enterprise (no DPA on Plus) with no training opt-out on Free or Plus, and that Grammarly Free and Premium have no training opt-out.
Now: Notion's DPA comes with the Master Subscription Agreement, which covers Plus, Business, Enterprise and any organization use, and Notion's AI terms rule out training on that data. Grammarly Free and Premium users can opt out of training in their account privacy settings.
AI vendor scorecard, Notion AI links
Was: The Notion DPA link opened a page that no longer exists and the privacy link opened a sign-in page.
Now: Both links point to Notion's current Data Processing Addendum and Privacy Policy.
Was: Listed NYC Local Law 144 and the EEOC hiring guidance for every use case that affects a person's outcome, including credit, health and education uses.
Now: The tool asks whether the use case screens job candidates or decides promotions, the decisions Local Law 144 covers (NYC Administrative Code § 20-870), and lists the two hiring entries only when the answer is yes.
New York RAISE Act regulation card
Was: Said the RAISE Act applies only to large frontier developers (annual revenue above $500 million) and that those developers report safety incidents within 72 hours.
Now: Every frontier developer, meaning anyone who trained a model with more than 10²⁶ operations, must publish a transparency report with each new frontier model and report critical safety incidents to the DFS office within 72 hours. The $500 million revenue threshold adds the frontier AI framework and disclosure statement duties, and the Attorney General's penalties apply to those large developers. Source: the final text, Chapter 96 of 2026, on the New York State Assembly site.
Glossary and EU AI Act topic hub
Was: The glossary said serious incidents must be reported within 24 hours, or within 15 days for safety incidents and 3 months for others; said building a product on the OpenAI or Anthropic API makes you a deployer, and that using ChatGPT or Claude in a high-risk application also makes you a deployer; defined deployers as organizations that use a system under their own name. The EU AI Act hub said most high-risk obligations apply from August 2026. The CCPA entry dated the automated decisionmaking rules to January 1, 2026.
Now: Article 73 sets 15 days, 10 days if a person died, and 2 days for a widespread infringement or serious critical-infrastructure incident. A company that builds an AI system on a GPAI model is that system's provider (a downstream provider), and Article 25 makes anyone who puts a general-purpose tool to a high-risk use its provider. Deployers are organizations that use an AI system under their authority. High-risk rules apply from December 2, 2027 (Annex III) and August 2, 2028 (Annex I). The CCPA regulations took effect January 1, 2026, and businesses using ADMT for significant decisions must comply from January 1, 2027. The penalties answer now adds the SME and small mid-cap caps and the Commission's separate GPAI fines.
Was: Showed the Garante's €15 million OpenAI fine as standing, with OpenAI saying it would appeal; said the Bunnings facial recognition decision was still under tribunal review; called the Amazon Alexa, IntelliVision, Workado and Evolv orders proposed; and did not say the DoNotPay and Cox Media orders were final.
Now: The Court of Rome annulled the OpenAI decision on March 18, 2026, on the ground that Ireland's DPC was the lead authority. On February 4, 2026 the Administrative Review Tribunal set aside the Bunnings consent finding and upheld the notice and policy findings, and the Privacy Commissioner did not appeal. The court entered the Alexa order on July 19, 2023, and the FTC finalized the IntelliVision, Workado, DoNotPay and Cox Media orders. The Evolv order is a stipulated court order the FTC lists as pending. The tracker also adds Italy's July 2026 fine on Character.AI and the DPC's April 2025 Grok inquiry.
AI data privacy guide and GDPR AI fines guide
Was: The privacy guide's enforcement table listed an Irish DPC €91M AI training fine, a $3.5M FTC fine on an AI hiring vendor, a CNIL order against an AI writing tool and a California AG probe of an AI review platform, none of which we could match to a regulator's record. The GDPR fines guide said Italy's ChatGPT action ended without a fine.
Now: The table now lists five cases checked against regulator and court sources (OpenAI, Replika and Character.AI in Italy, X's Grok in Ireland, Clearview AI in the Netherlands). The GDPR fines guide adds the December 2024 €15 million fine and its annulment in March 2026.
AI regulations hub, Colorado, Connecticut and Singapore pages, and the deadline list
Was: The Colorado page still linked impact-assessment, high-risk and safe-harbor terms and an impact assessment template from SB 24-205, and did not mention the court-ordered enforcement pause in xAI's lawsuit. The Connecticut page said SB 5 is formally titled the Connecticut Artificial Intelligence Responsibility and Transparency Act. The Singapore page said MAS asks financial institutions to apply life cycle controls to high-risk uses as soon as possible. The deadline list called AB 2013 the California AI Transparency Act.
Now: Colorado links the SB 26-189 notice and letter templates, and notes the April 27, 2026 order in X.AI LLC v. Weiser that the attorney general not start enforcement until 14 days after the court rules on xAI's preliminary injunction motion. SB 5's formal title is An Act Concerning Online Safety; CART is a nickname. The MAS Guidelines take effect October 7, 2027, with Sections 5 and 6 by October 7, 2028, and set no earlier date. AB 2013 is the training data transparency law; the California AI Transparency Act is SB 942. The deadline list adds the EU AI Act bans from December 2, 2026, Connecticut's AI companion rules from January 1, 2027 and the MAS date.
Was: Said an employer cannot outsource liability to its AI vendor and is always responsible for the tools it uses, and did not mention Executive Order 14281.
Now: The EEOC's 2023 technical assistance said an employer may be responsible under Title VII even if an outside vendor developed the test. The page now notes that EO 14281 (April 23, 2025) tells agencies to deprioritize disparate-impact enforcement, while Title VII's disparate-impact section stays in the statute.
AI regulations hub and deadline list
Was: Said EO 14179 revoked EO 14110, dated the EU AI Act bans to August 1, 2024, put a €85M damages cap in the Product Liability Directive, said NYC's audit found 17 problems at 32 companies, and said the CFPB withdrew 66 other documents with Circular 2022-03.
Now: EO 14110 was revoked by EO 14148; EO 14179 orders a review of actions taken under it. The bans apply from February 2, 2025 (Article 113). The Directive sets no financial ceilings. NYC's Department of Consumer and Worker Protection reviewed 32 company websites and found one instance of potential non-compliance; the State Comptroller found at least 17 at the same companies. The withdrawal notice lists Circular 2022-03 among many documents without that count. All 21 cards on the hub were re-checked on October 11, 2026.
Was: Listed an EU AI Office investigation into general-purpose AI models in November 2024, named "Omni AI" and a $50,000 Rytr payment in Operation AI Comply, and showed the UK's £7.5 million Clearview fine as standing.
Now: The AI Office's enforcement powers applied from August 2, 2026, and its first formal requests for information went out on August 29, 2026. Operation AI Comply (September 25, 2024) named DoNotPay, Ascend Ecom, Ecommerce Empire Builders, Rytr and FBA Machine, and the Rytr order was set aside on December 22, 2025. The Clearview fine went back through the tribunals; the Upper Tribunal upheld three of the ICO's four grounds in October 2025.
FTC AI enforcement actions guide
Was: Cited an FTC "AI and Your Business" guidance document, listed "Automaters AI" as an Operation AI Comply case, dated the AI Action Plan February 2025, and had a state attorney general section with task-force counts we could not source.
Now: No such FTC document exists, so the article now quotes the orders themselves. The case is FBA Machine / Passive Scaling. The AI Action Plan is dated July 23, 2025. The state section now covers the Texas and Massachusetts cases, each with the attorney general's release.
Vendor scorecard and privacy API selector
Was: Showed no HIPAA BAA, no zero data retention and unknown ISO 27001 for Anthropic, no EU data residency for OpenAI, no SOC 2 for Mistral or Perplexity, no training opt-out for Perplexity or Grammarly, a 90-day retention figure for Perplexity, and four dead DPA links.
Now: Each field was re-checked against the vendor's own documentation on October 8, 2026, and every one of those values was corrected. Fields with no source we could open now show unknown, and the GPAI column shows signatories of the EU General-Purpose AI Code of Practice.
Was: Said EU AI Act prohibitions applied from August 2024 and high-risk rules from August 2, 2026, put AI regulatory sandboxes due by August 2026, described GDPR Article 22 as a right to an explanation, listed critical infrastructure as needing a notified body, and called the AI Liability Directive a pending proposal.
Now: Prohibitions apply from February 2, 2025. Under the Digital Omnibus (Regulation (EU) 2026/1744), high-risk rules apply from December 2, 2027 (Annex III) and August 2, 2028 (Annex I), and sandboxes are due by August 2, 2027. Article 22 is a right not to be subject to solely automated decisions; AI Act Article 86 adds a right to explanation. The Commission withdrew the AI Liability Directive.
Colorado Chatbot Safety Act (HB 26-1263)
Was: Said customer support chatbots are covered and that the law sets no timing for telling users they are talking to AI.
Now: Customer service chatbots are excluded by 6-1-1701(3.5)(b)(II), and the statute sets daily, three-hour and on-request disclosure timing.
DeepSeek and Chinese AI models under GDPR
Was: Dated Italy's DeepSeek ban to early 2026 and said V4 was available in EU regions on AWS Bedrock, Azure and Google Vertex AI.
Now: The Garante's order is dated January 30, 2025. Only Microsoft Foundry is confirmed, with V4-Flash in the EU Data Zone.
ChatGPT product liability cases (JCCP 5431)
Was: Said later cases newly named Sam Altman personally and called all twelve coordinated cases wrongful-death suits.
Now: Altman is already a defendant in the coordinated cases. The coordination order lists 12 cases, and not all of them are wrongful-death claims.
Colorado ADMT Rule 6.6 article, SB 26-189 guide, weekly roundup Sep 21 to 27
Was: The Rule 6.6 article said the ADMT comment period closed September 23 and was five days away. The SB 26-189 guide described the April 27 federal order as a direct ban on enforcement. The weekly roundup gave May 20 as the SB 26-189 signing date.
Now: September 23 was only the date the Attorney General expected to post interim revisions. Comments and the hearing are October 26. The April 27 order is a stipulated agreement between xAI and the attorney general, not a ruling on the merits. SB 26-189 was signed May 14, 2026.
Was: Written before the bills were signed. Described a 90-day notice and 25-worker threshold for SB 951, a right of first bid and penalty fund, and guessed SB 947 would take effect January 1, 2027.
Now: Both bills were signed September 30, 2026. SB 951 uses the existing 60-day Cal/WARN notice and adds technology displacement disclosures, operative January 1, 2027. SB 947 is operative July 1, 2027 with a $500 civil penalty per violation.
Was: Stated as fact that Colorado published a revised ADMT draft on September 23, described a UK AI Regulation and Safety Bill at House of Lords committee stage, and gave a BC lawsuit theory that OpenAI helped plan the shooting. Also captioned a server-room photo as the UN session.
Now: Colorado filed its proposed rules on August 11 and said interim revisions were expected by September 23, which we could not confirm were posted. The hearing and final comment deadline are October 26. The UK has no AI bill. The BC complaint alleges OpenAI flagged the shooter in June 2025 and did not alert police. Image and alt text replaced.
Regulations tracker, third pass
Was: The EO 14179 entry said Virginia had an active AI law and predicted federal duties would not grow, the White House framework entry said it protected smaller developers and covered workforce displacement, the NYC hiring-law entry said the law was actively enforced and required 3-year record retention, the China entry claimed log retention and blanket identity verification, the ISO 42001 entry said it aligns closely with the EU AI Act, the FDA entry said clearance is always required, and the NIST entry said several states offer safe harbors.
Now: Virginia's bill was vetoed and the December 2025 order targeting state AI laws is noted. The framework is described from its March 2026 text. NYC enforcement is described using the December 2025 State Comptroller audit, and the 3-year retention claim is removed. China's log-retention and blanket identity claims are removed. ISO 42001 is not a harmonised AI Act standard. FDA review depends on device pathway. Texas TRAIGA is the state safe harbor tied to the NIST AI RMF.
Regulations tracker, second pass
Was: The NY RAISE Act was dated June 2025 and called the first state frontier AI law, Canada's AIDA was listed as pending, AB 2013 was described as covering datasets of 1 million or more records, CFPB Circular 2022-03 and the EEOC AI guidance were listed as in effect, the FTC penalty was $51,744, the SEC entry cited Corporation Finance AI guidance that we could not find, the EU-US entry actually described the EU AI Pact, and Colorado still listed the 2024 impact-assessment duties.
Now: RAISE was signed December 19, 2025 (California's SB 53 came first). AIDA died with Bill C-27 in January 2025. AB 2013 has no dataset-size threshold. The CFPB circular was withdrawn May 12, 2025 and the EEOC removed its AI guidance January 27, 2025. The FTC amount is $53,088. The SEC entry now describes its enforcement cases. The EU-US entry is now the EU AI Pact. Colorado lists the SB 26-189 duties. Australia's standard was replaced by Guidance for AI Adoption on October 21, 2025.
Was: Texas TRAIGA and Virginia HB 2094 were listed as pending, Colorado showed SB 24-205 as the operative law, and EU AI Act high-risk duties were dated August 2026.
Now: TRAIGA has been in effect since January 1, 2026. Virginia HB 2094 was vetoed on March 24, 2025. Colorado's SB 24-205 was replaced by SB 26-189 (effective January 1, 2027). EU high-risk duties now apply from December 2, 2027 under Regulation (EU) 2026/1744.
Notion AI vs Microsoft Copilot
Was: Said Copilot runs only on Azure OpenAI, that Notion commits to no training only on paid tiers, that Notion offers no BAA, and priced Copilot at $30.
Now: Anthropic and OpenAI are Microsoft subprocessors. Notion does not train on customer data by default on any plan, Enterprise can sign a BAA, and Copilot Business is $21 per user.
Microsoft 365 Copilot vs Google Workspace
Was: Gave wrong Google Workspace prices, said Google offered only usage counts for AI activity, and said Copilot audit logging needs E3 or higher.
Now: Prices, Google's Gemini log events and Vault, and Copilot's Audit (Standard) 180-day default retention are corrected against vendor documentation.
California 2026 AI bills tracker
Was: The descriptions of SB 813 and AB 1405 were swapped, and the article treated signature as still pending.
Now: Descriptions match the Governor's official announcement.
AI acceptable use policy template
Was: Said Claude Teams was required for zero retention, which conflated no-training with no-retention.
Now: Separates the two and dates the check. Consumer plans of ChatGPT, Claude and Copilot may train on data unless you opt out.
Report an error
Found something wrong? Email [email protected] with the page and the source. Confirmed errors are fixed and added to the log above.