🏛️ Issues and Advocacy Training
Courses › AI Issues: Technical, Legal, Social and Logistical

Lesson 8 of 9 · about 18 minutes

AI Law and Regulation as of October 2026

You'll be able to

  • List the EU AI Act's phase-in dates after the 2026 Digital Omnibus changes
  • Describe the main US federal executive actions on AI from 2025 on
  • Explain what Idaho Code 67-6628A requires of synthetic media in election communications
  • State where Colorado's AI Act stands after SB 26-189
  • Name the federal tools being used against state AI laws and their limits

AI law in October 2026 is a moving target in three places at once. The European Union has a full statute and just pushed back its hardest deadlines. The US has no broad federal AI law, and the executive branch is actively trying to discourage state rules. The states keep passing laws anyway, mostly narrow ones about deepfakes, elections and specific uses, while the broadest state law, Colorado's, has been rewritten before it ever took effect. Every date below can change. Check the primary source before you repeat one.

The European Union: the AI Act

The EU AI Act entered into force on August 1, 2024 and phases in by risk level. It bans a short list of uses outright, sets testing and documentation rules for "high-risk" systems, requires transparency for some others, and puts separate duties on providers of general purpose models. Fines for banned practices can reach 35 million euros or 7 percent of worldwide turnover.

In 2026 the EU passed a "Digital Omnibus" amendment that delayed the high-risk deadlines. Negotiators reached a political agreement on May 7, 2026, according to the European Commission. Parliament approved it June 16 and the Council adopted it June 29, according to secondary sources. The European Commission's AI Act page confirms the new dates and entry into force on July 27, 2026, and links the Official Journal text, Regulation (EU) 2026/1744.

ProvisionOriginal dateAfter the Omnibus
Prohibited practices (Article 5), such as social scoring2 Feb 2025Unchanged. New ban on AI "nudifier" and child abuse image generators added, with transition to 2 Dec 2026
General purpose AI model duties2 Aug 2025Unchanged
Transparency (Article 50): telling people they are talking to AI, labeling deepfakes2 Aug 2026Unchanged; machine-readable marking gets grace to 2 Dec 2026 for systems already on the market
High-risk uses in Annex III (hiring, credit, education, policing, critical infrastructure)2 Aug 20262 Dec 2027
High-risk AI in regulated products, Annex I (medical devices, machinery)2 Aug 20272 Aug 2028

Why it matters in the US: American companies selling into Europe must comply, and many will apply one standard everywhere rather than run two.

US federal: executive actions, not statutes

  • EO 14179, January 23, 2025, "Removing Barriers to American Leadership in Artificial Intelligence," revoked President Biden's 2023 AI order (EO 14110) and called for an action plan within 180 days.
  • OMB Memorandum M-25-21, April 3, 2025, governs how federal agencies use AI. Agencies (except defense and intelligence) must publish an annual inventory of AI use cases, name a Chief AI Officer, and apply minimum practices to "high-impact" AI: pre-deployment testing, an impact assessment, human oversight, and a way for affected people to get human review. Uses that fail those practices must be stopped.
  • America's AI Action Plan, July 2025, set out a pro-development agenda and warned that differing state rules fragment the market.
  • EO 14365, December 11, 2025, "Ensuring a National Policy Framework for Artificial Intelligence," created a Justice Department AI Litigation Task Force to challenge state AI laws, ordered Commerce to list burdensome state laws, conditioned some of the $42 billion BEAD broadband money on states easing AI rules, and asked the FTC and FCC to consider policies that would override state requirements. It carves out child safety, data center infrastructure and state government's own AI purchasing and use.

Older laws still apply to AI. The FCC ruled in February 2024 that AI voices in robocalls are "artificial" under the Telephone Consumer Protection Act. The FTC enforces against deceptive AI claims and unfair practices. Civil rights, credit and employment laws apply whether or not a computer made the decision.

An executive order directs the federal government. It does not by itself erase a state law. That takes an act of Congress, a valid agency rule, or a court ruling. When anyone says an order "bans" state AI laws, check what actually happened in court.

States

Idaho: synthetic media in elections, Idaho Code 67-6628A

Idaho's 2024 House Bill 664, the Freedom From AI-Rigged (FAIR) Elections Act, is codified at Idaho Code 67-6628A. Key parts:

  • What it covers: synthetic media, meaning audio or video of a person's speech or conduct made with digital technology that is realistic but false, would lead a reasonable person to believe it shows something that did not happen, and would leave a very different impression than the unaltered original (read the exact wording in the statute).
  • Who can sue: a candidate whose speech or conduct is deceptively represented through synthetic media in an electioneering communication. They can seek an injunction and damages, and the court may award attorney's fees to the prevailing party. The candidate must prove use of synthetic media by clear and convincing evidence.
  • The disclosure defense: including the statement "This (video/audio) has been manipulated." For video, the text must be easily readable and stay on screen for the full duration. For audio-only, it must be read clearly at the beginning and end, and repeated at least every two minutes if the audio runs longer.
  • Who is liable: generally the creator (the "information content provider"). A medium that distributes the content is liable only if it removes the disclosure or alters the content into synthetic media. Federally licensed broadcasters airing communications subject to 47 U.S.C. 315 are exempt.
  • No time window: the section does not limit itself to a period before an election.

Idaho also passed HB 465 (AI-generated child sexual abuse material) and HB 575 (non-consensual explicit synthetic media) in 2024. Check the Legislature's site for anything newer.

Example: applying 67-6628A

A political committee in an invented county runs a 45-second online video in which an AI-generated version of candidate Dana Whitlock appears to say she would close the county library. She never said it.

  • Realistic, false, depicts speech that did not occur: likely synthetic media under the definition.
  • In a communication about a candidate: likely an electioneering communication.
  • If the video carried "This video has been manipulated" readable for all 45 seconds, the committee has an affirmative defense.
  • Without it, Whitlock can ask a court for an injunction and damages, and must prove the use of synthetic media by clear and convincing evidence.
  • A website that hosted the video unchanged is generally not liable; one that cropped out the disclosure could be.

The module "Video and Radio Ad Development" covers the other disclosure rules that apply to political ads.

Colorado: the AI Act, rewritten

Colorado's SB 24-205, passed in 2024, was the first broad state law on "high-risk" AI in consequential decisions. It required developers and deployers to use reasonable care against algorithmic discrimination, with impact assessments and risk programs. Its start was pushed to June 30, 2026. In April 2026 the Justice Department intervened in a federal lawsuit brought by xAI challenging it, and enforcement was stayed, though not on the merits.

In May 2026 the legislature passed SB 26-189, "Automated Decision-Making Technology," weeks before the old law would have started. According to Arnold and Porter's summary, the new law:

  • takes effect January 1, 2027;
  • drops the standalone duty to avoid algorithmic discrimination, the impact assessments and the annual reviews;
  • keeps duties for developers to give deployers information on intended uses, limitations and training data categories;
  • requires deployers to notify consumers before using automated decision tools in consequential decisions, and after an adverse decision to tell them of rights to correct data and get human review;
  • covers education, employment, housing, lending, insurance, health care and essential government services;
  • is enforced by the attorney general only, with penalties up to $20,000 per violation and a 60-day cure period in most cases.

Colorado's existing anti-discrimination law still applies. In early July 2026 (published in the Federal Register July 7) the FTC proposed a policy statement suggesting even the narrower law might be preempted by the FTC Act. That statement was a proposal with comments due July 31, 2026; watch for whether it becomes final.

California: frontier model transparency

California's SB 53, signed September 29, 2025 and effective January 1, 2026, applies to developers training models with more than 10^26 operations. Large developers (over $500 million in revenue) must publish a safety framework, publish transparency reports for new models, and report critical safety incidents to the state Office of Emergency Services within 15 days, or 24 hours if there is imminent danger. It protects whistleblowers. Penalties reach $1 million per violation.

Common mix-ups

  • Claim: The EU AI Act's high-risk rules started in August 2026. What the evidence shows: The 2026 Omnibus moved them to December 2027 for Annex III uses and August 2028 for product-related systems. Bans and general purpose model duties already apply.
  • Claim: Idaho bans deepfakes in elections. What the evidence shows: Idaho Code 67-6628A gives the depicted candidate a right to sue, and a proper disclosure is a defense. It is a civil remedy with a labeling safe harbor, not a ban.
  • Claim: Colorado's AI Act took effect in 2026. What the evidence shows: The original was delayed, stayed and then replaced by SB 26-189, which starts January 1, 2027.
  • Claim: There is no AI regulation in the US. What the evidence shows: There is no broad federal AI statute, but federal agency rules, existing consumer and civil rights laws, and dozens of state laws apply.

Reporting angle

  • For state bills, read the enrolled text on the legislature's site, not a summary. Note the effective date, who enforces, and whether there is a private right to sue.
  • Track the DOJ AI Litigation Task Force's filings and the FTC's final action on its July 2026 proposal. Each could change which state laws are enforceable.
  • In election season, ask your county clerk and secretary of state's office what complaints they have received about synthetic media, and ask local stations and platforms how they handle 67-6628A disclosures.
  • Federal agencies must publish AI use case inventories under M-25-21. Check the inventories of agencies with local offices (USDA, VA, SSA) for tools used on your residents.

Research angle

Check yourself

1. After the 2026 Digital Omnibus, when do EU AI Act obligations for Annex III high-risk systems (hiring, credit scoring, education and similar) apply?

2. Under Idaho Code 67-6628A, what is an affirmative defense for someone who uses synthetic media of a candidate in an electioneering communication?

3. Who may sue under Idaho's synthetic media election law?

4. What did Colorado's SB 26-189 do to the original Colorado AI Act (SB 24-205)?

5. What does Executive Order 14365 (December 11, 2025) direct the Justice Department to do?

6. Can a presidential executive order by itself cancel a state AI law?

Terms in this lesson

Preemption
When valid federal law overrides a conflicting state law.
High-risk AI system
Under the EU AI Act, an AI system in a listed sensitive use, such as hiring, credit or critical infrastructure, that must meet testing and documentation rules.
General purpose AI model
EU AI Act term for models like large language models that can do many tasks; providers have transparency duties since August 2025.
Synthetic media
In Idaho Code 67-6628A, realistic but false audio or video of a person, made with digital technology, showing speech or conduct that did not happen.
Electioneering communication
A communication about candidates in an election. Idaho's synthetic media section uses the term without defining it there.
Consequential decision
In state AI laws, a decision with major effects on a person, such as hiring, lending, housing, insurance or education.

Full glossary

Sources