Field guides for the 2026 AI regulatory wave.

On August 2, 2026, the second major wave of EU AI Act obligations becomes enforceable. General-Purpose AI (GPAI) model providers, deployers of high-risk systems, and any organisation using AI in HR, finance, education, or critical infrastructure must demonstrate compliance — or risk fines of up to €35 million or 7% of global annual turnover for prohibited practices (Art. 5), and €15M / 3% for high-risk system failures (Art. 99).

Most compliance teams underestimate the scope: the Act applies extraterritorially to any provider placing AI on the EU market, regardless of where the company is headquartered. A U.S. SaaS vendor selling to a Berlin client is in scope.

Step 1 — Inventory every AI system in production. This is the single biggest gap we see. Shadow AI tools (consumer ChatGPT accounts, Otter.ai recorders, free image generators) typically account for 40–60% of an enterprise's true AI footprint. You cannot classify what you cannot see.

Step 2 — Classify each system by risk tier. Prohibited (Art. 5), High-risk (Annex III — HR, biometrics, critical infra, education, credit scoring, law enforcement), Limited-risk (Art. 50 transparency), or Minimal-risk. Most enterprise tools fall into Limited or High.

Step 3 — Identify GPAI dependencies. If you build on top of a foundation model (GPT-4, Claude, Gemini, Llama), you inherit downstream obligations including technical documentation and copyright-compliant training-data policy disclosures.

Step 4 — Run a Data Protection Impact Assessment (DPIA) under GDPR Art. 35 for every high-risk use case. The AI Act explicitly cross-references GDPR — they are not separate workstreams.

Step 5 — Implement Art. 50 transparency duties. Users interacting with chatbots must be informed they're talking to AI. Synthetic media (deepfakes, AI avatars, voice clones) must carry machine-readable provenance signals (C2PA content credentials are the emerging standard).

Step 6 — Sign Data Processing Agreements (DPAs) with every vendor processing personal data on your behalf. Consumer-tier AI accounts almost never come with a compliant DPA — this is a fast track to enforcement action.

Step 7 — Lock down EU data residency where required. Several Member State DPAs have already signalled they will treat non-adequate jurisdiction transfers as Chapter V GDPR violations regardless of Standard Contractual Clauses.

Step 8 — Train your workforce. Article 4 mandates AI literacy obligations: staff using AI systems must be sufficiently trained to understand the system's limitations and risks.

Step 9 — Establish an AI governance committee with documented authority to approve, restrict, or block AI tools. Regulators will ask for the minutes.

Step 10 — Produce a board-ready compliance report. Not a 200-page PDF nobody reads — a one-page risk score with item-level legal references and remediation owners. This is the artefact that gets you through an audit.

SafeScan AI compresses this 10-step process from a 12-week consulting engagement into a 60-second automated scan. Upload your software inventory, get a board-ready report mapped to every relevant Article.

There is no federal AI law in the United States. There are 47 state legislatures actively drafting AI bills, and four states (Colorado, California, Utah, Texas) already have binding obligations on the books. A national SaaS company sells into all 50 — compliance is now a patchwork tracking problem, not a single-jurisdiction policy question.

Colorado SB 24-205 (effective Feb 1, 2026) is the most aggressive. It creates a duty of reasonable care to protect consumers from algorithmic discrimination in any 'consequential decision' (employment, education, financial services, healthcare, housing, insurance, legal services). Developers and deployers of high-risk AI must complete annual impact assessments, disclose system characteristics to consumers, and report discovered algorithmic discrimination to the Colorado Attorney General within 90 days. Penalties: deceptive trade practice fines, $20k per violation.

California AB 2013 (effective Jan 1, 2026) mandates training-data transparency for any generative AI made available to Californians. Developers must publish high-level summaries of datasets used to train or fine-tune the model, including data sources, time periods, copyright status, and whether personal information was included.

California SB 942 (the AI Transparency Act, 2026) requires generative AI providers with >1M monthly users to offer free AI-detection tools and apply latent and manifest disclosures to AI-generated content. This is California's answer to deepfake risk.

Utah AI Policy Act (effective May 1, 2024) is already enforceable. It requires clear disclosure when consumers interact with generative AI in regulated professions and holds providers liable for AI outputs under existing consumer protection law.

Texas TRAIGA (HB 1709 — Texas Responsible AI Governance Act) is the next wave. If passed in the current form, it imposes Colorado-style impact assessments on deployers of high-risk AI in employment, insurance, financial services, and healthcare.

The compliance reality: A 200-person SaaS company selling into the US now needs to track per-state obligations, run annual impact assessments per Colorado, publish training-data summaries per California, deploy AI-detection tooling per SB 942, and document disclosure flows per Utah. That is impossible to maintain manually.

How SafeScan automates this: Our risk engine cross-references your AI inventory against every active US state bill and flags per-state obligations on a per-tool basis. When a new state law is enacted (Texas TRAIGA, NY S 8755, IL HB 5116), the mapping updates automatically — your next scan reflects the change without re-engaging consultants.

In October 2024, the Australian Securities and Investments Commission (ASIC) published Information Sheet 280: Using artificial intelligence in financial services. INFO 280 is not technically 'law' in the same sense as the EU AI Act, but for any Australian Financial Services (AFS) licensee it carries the force of supervisory expectation — and failure to meet it can be treated as a breach of the general AFS licensee obligations under s912A of the Corporations Act.

What INFO 280 expects: AFS licensees must (1) maintain an AI governance framework proportionate to the risk and scale of AI use, (2) ensure board and senior management oversight, (3) implement model risk management including pre-deployment testing and ongoing monitoring, (4) maintain accountability for AI-driven decisions (the 'human in the loop' principle), and (5) ensure consumer disclosures where AI materially affects the financial service provided.

The shadow AI problem in financial services: ASIC's 2024 review found that most AFS licensees underestimate AI usage in their organisation by a factor of 3–5×. Advisers using consumer ChatGPT for client-meeting notes, analysts running Claude to summarise research, ops teams using Otter.ai for compliance call recordings — none of these typically appear on the official AI inventory, yet all process client personal information.

Why this matters for your AFS licence: Under s912A you must do all things necessary to ensure the financial services covered by the licence are provided efficiently, honestly and fairly. ASIC has signalled that material undisclosed AI use in client-facing workflows — particularly where the AI vendor is in a non-adequate jurisdiction or trains on submitted data — can constitute a breach.

APRA's parallel expectation: APRA-regulated entities (banks, super funds, insurers) face overlapping obligations under CPS 230 (Operational Risk Management, effective July 2025) and the forthcoming CPS 234 AI guidance. Material AI providers must be assessed as material service providers.

The Privacy Act 1988 layer: Recent amendments (Privacy and Other Legislation Amendment Act 2024) introduced automated decision-making transparency requirements that apply to any organisation using AI in decisions that materially affect individuals. Disclosures are required in privacy policies by December 2026.

What SafeScan does for Australian licensees: We map every AI tool in your inventory against INFO 280, CPS 230, the 1988 Privacy Act ADM requirements, and the forthcoming Australian Voluntary AI Safety Standard. The report you take to your audit committee or board risk committee references the specific paragraph numbers an ASIC supervisor would cite.

The traditional AI compliance audit is a 12-week professional services engagement. A team of three to five consultants — typically junior associates supervised by a partner — runs workshops with your IT, legal, and security teams, manually catalogues your AI usage in spreadsheets, maps it against a static checklist, and delivers a 180-page PDF for $50,000 to $250,000. By the time the PDF lands, three of the tools in scope have shipped major updates, two new state laws have been enacted, and your engineering team has onboarded four AI tools that weren't in the original inventory.

Problem 1 — The interview-based inventory. Manual audits start by asking employees what AI tools they use. People forget. They omit consumer-tier tools they aren't supposed to be using. They confuse SaaS features with standalone AI products. The result is an inventory that's 40–60% incomplete on day one.

Problem 2 — Static regulatory mapping. A consultant's checklist reflects the regulatory landscape on the day they built it. The EU AI Act has had 6 substantive Commission implementing acts since publication. US state laws change quarterly. ASIC updates INFO 280 guidance through public letters. A PDF audit is a snapshot of a moving target.

Problem 3 — Cost as a barrier to re-auditing. At $50k per cycle, most enterprises audit annually at best. That means 11 months of every year you are operating without an up-to-date compliance picture. In a regulatory environment where Colorado, California, Utah, Texas, the EU, ASIC, and APRA are all moving in the same year, annual auditing is structurally inadequate.

Problem 4 — Consultant incentives. A consulting firm makes money from complexity. They are not incentivised to give you the 1-page risk score you actually need; they are incentivised to give you the 180-page report that justifies the next engagement.

The AI-native alternative: Software-based AI auditing flips every variable. The inventory is built from your actual SaaS data (CSV/SSO export), not a spreadsheet of self-reports. The regulatory mapping updates automatically when a new state law passes. The cost drops from $50,000 per engagement to $300 per month, which means you can re-audit weekly, not annually. The deliverable is a 1-page board-ready score backed by item-level legal references, not a 180-page PDF.

This is not 'replacing lawyers with AI' — it is replacing manual inventory-building and static checklist-mapping with automation, so that human legal expertise is applied where it actually matters: edge cases, novel regulatory interpretation, and remediation strategy. The mechanical 80% of an audit no longer needs to cost $50,000.

SafeScan AI starts at $300/month for early-entry customers. The price you sign up at is the price you pay for life. Compare that to the next quote you receive for a 'comprehensive AI governance assessment'.