For most of 2026, AI rules moved slowly: frameworks, consultations, delayed deadlines. October changed the pace. In two weeks the US government made incident reporting mandatory, an AI lab drafted its own federal law, eight states went to court, New York City proposed rules for customer-service chatbots, and the EU began using its new enforcement powers. Here is what each move means, in order of how likely it is to affect your work.
Two weeks of AI rules
White House: reporting is "not optional"
AI companies must notify regulators of security incidents involving their models and fix the harm.
Eight states sue OpenAI
Separate cases in Arizona, Arkansas, Idaho, Iowa, Kansas, Montana, Nebraska and West Virginia.
EU AI Office questions OpenAI and Anthropic
Formal requests about security, external evaluation and monitoring.
Anthropic's draft bill reported
Politico reports the draft being shown to Congress; TechCrunch follows on 20 October.
DeepSeek order and NYC chatbot rulesNow
The US publishes the federal DeepSeek ban; New York City proposes customer-service AI rules.
New EU bansUpcoming
AI that generates non-consensual intimate imagery or child abuse material is banned in the EU.
US: incident reporting becomes mandatory
On 9 October, the White House told AI companies that reporting security incidents involving their models is "not optional", ending a purely voluntary approach. Axios reported that the move followed incidents Anthropic disclosed: during testing, its models had submitted visa applications through a State Department web form and a false homicide tip to Philadelphia police. None of the applications were processed. The statement applies to all AI companies but does not yet spell out penalties.
US: Anthropic's draft safety bill
Anthropic has been showing Congress a draft federal bill, first reported by Politico on 16 October. It sets a very high bar for intervention, but creates a legal route to stop a dangerous release.
- Risks covered
- creating or releasing a biological weapon, a model evading its developer's controls, or a cyberattack
- Who pays the evaluators
- the labs may pay, as long as payment does not depend on the result
- What it forbids
- any federal agency halting a model's distribution on its own
- Similar law
- the thresholds resemble California's SB 53
- Status
- a draft shown to lawmakers, not an introduced bill
It goes further than most industry proposals, such as Nvidia's argument that no new AI laws are needed. Critics question whether evaluators paid by labs can be independent. Like any proposal from a company it would regulate, read it alongside others before drawing conclusions.
US: eight states sue OpenAI
On 14 October, the attorneys general of eight states filed coordinated but separate lawsuits in their own state courts. They allege OpenAI marketed ChatGPT as safe while designing it to be highly agreeable and engaging, with harms that especially affect children and vulnerable users. They seek penalties, changes to how ChatGPT works, and limits on collecting minors' data. OpenAI disputes the claims and points to its parental controls and age-specific protections. None of the allegations have been tested in court.
US: DeepSeek out of federal systems, and NYC chatbot rules
DeepSeek order
Binding, federal- Published
- 20 October, under the 2018 supply chain security law
- Does not restrict companies or the public
- Civilian agencies must remove DeepSeek products, including inside third-party software
- Federal contractors must report covered products within 3 business days
NYC chatbot rule
Proposed, city- Proposed
- 20 October by the Department of Consumer and Worker Protection
- Fines from $525; 30-day comment period with a public hearing
- Businesses must disclose when customers deal with an automated system
- They must offer an easy way to reach a human
- Endless unhelpful bot loops would count as a deceptive practice
Read more about the DeepSeek order and what "DeepSeek implementations" might cover in DeepSeek this week.
EU: the AI Office starts asking questions
The EU's powers to enforce the AI Act's rules for general-purpose AI models became applicable on 2 August 2026. Since then the AI Office has sent formal requests for information to model providers. On 14 October, Executive Vice-President Henna Virkkunen said requests had gone to OpenAI and Anthropic, covering security, external evaluation and monitoring of how models are used. Euronews linked them to summer incidents in which an OpenAI agent escaped its test environment and attacked Hugging Face, and an Anthropic model gained unauthorised access to outside organisations during testing.
For the full EU timetable, including the delayed high-risk deadlines and the new bans from 2 December, read the EU AI Act in 2026.
What to do now
- 1
Say when it's AI
If customers chat with or hear an AI, tell them. It is already required under the EU AI Act for many systems and proposed in New York City.
- 2
Offer a human
Give an obvious way out of a chatbot or voice agent. It is good service and is becoming a legal expectation.
- 3
Keep a register of AI tools
List the models and vendors in use, including inside SaaS products. Federal contractors need this for the DeepSeek order; everyone else will be asked sooner or later.
- 4
Log agent actions
If agents act on real systems, keep tamper-proof logs. Incidents are now something regulators expect to hear about.
- 5
Watch your vendors' answers
Ask AI suppliers how they handle incidents and regulator requests; their problems can become yours.
Check your understanding
1/3Which of these is a proposal, not yet binding?
The draft has been shown to Congress but not introduced.
2/3What threshold does Anthropic's draft bill use?
Covering bioweapons, models evading control, and cyberattacks.
3/3What would New York City's proposed rule require?
Fines would start at $525 per violation.
You got 0 out of 3.
Related: when AI agents go off-script, the EU AI Act in 2026 and the Personal Agent Protocol.
Sources: Axios on the White House reporting requirement (9 October 2026); TechCrunch citing Politico on Anthropic's draft bill (20 October 2026); Troutman Pepper Locke on the state lawsuits (16 October 2026); NYC Department of Consumer and Worker Protection press release (20 October 2026); The Hacker News on the DHS order (20 October 2026); Euronews via AI Weekly on the EU AI Office requests (14 October 2026). This is not legal advice.
Alessandro Ecclesie AgazziWritten by Alessandro Ecclesie Agazzi, analytics engineer in London. Updated 21 October 2026. About me