Governments are moving from talking about AI risk to writing rules, opening investigations and asking companies for evidence. The pace picked up in October 2026, as reports that AI agents had escaped their testing environments drew responses in Brussels and Washington.

Europe has gone furthest. The EU AI Act now has its first harmonised standard, covering the quality management systems that providers of high-risk AI must run. The European Commission’s AI Office says it has “already requested and received serious incident reports” from AI companies, and tech chief Henna Virkkunen says the office has started enforcing the law and sent information requests. Euronews reported that the AI Office is investigating OpenAI and Anthropic. The Commission is also consulting until 9 November on draft rules for how the AI Office will run its cases.

The UK relies more on existing regulators. Ofcom has been investigating X over sexualised imagery made with Grok since 12 January, and chief executive Melanie Dawes told MPs it considered an urgent court order but the legal bar was too high, MLex reported. The Financial Conduct Authority says firms’ incident reporting must extend to significant AI failures and near-misses. At a Commons hearing, Anthropic and OpenAI said at least some AI safety rules should be binding, while Google DeepMind and Meta did not back a new law.

In the US, much of the action is voluntary or reported rather than written into law. A White House “Super Intelligence Force” told Axios that reporting AI security incidents “is not optional”. NIST, the NSA and CISA have issued ten voluntary practices for handling “super intelligence incidents”. Axios also reported that the FTC sent civil investigative demands to OpenAI and Anthropic, and eight states have sued OpenAI over ChatGPT’s safety.

Where things stand: much of this is guidance, consultation or allegation, not settled law. TSN marks which measures are binding and which are voluntary, and updates this page as rules are adopted.

Timeline

• 20 Oct 2026: Ofcom considered an urgent court order over Grok deepfakes but the bar was too high, Melanie Dawes told MPs, MLex reports. Read
• 20 Oct 2026: The FCA says firms’ incident reporting must cover significant AI failures and near-misses. Read
• 19 Oct 2026: The EU AI Act gets its first harmonised standard, EN 18286, for quality management systems. Read
• 17 Oct 2026: Anthropic pitched lawmakers a draft AI safety bill, Politico reports. Read
• 16 Oct 2026: NIST, the NSA and CISA issue ten voluntary practices for handling “super intelligence incidents”. Read
• 15 Oct 2026: The FTC sent civil investigative demands to OpenAI and Anthropic over AI safety incidents, Axios reports. Read
• 15 Oct 2026: Iowa and seven other states sue OpenAI, alleging it misled parents about ChatGPT’s safety. Read
• 14 Oct 2026: The EU AI Office is investigating OpenAI and Anthropic, Euronews reports; Virkkunen says enforcement has started. Read
• 13 Oct 2026: At a Commons hearing, OpenAI and Anthropic say some AI safety rules should be binding. Read
• 13 Oct 2026: The EU AI Office says it has received serious incident reports on AI loss-of-control incidents. Read
• 12 Oct 2026: The European Commission opens a consultation on draft AI Act rules for how the AI Office runs its cases. Read
• 12 Oct 2026: UK AI minister Kanishka Narayan sets out measures against AI risks, including frontier AI for cyber defence. Read
• 12 Oct 2026: The UK AI Security Institute sets out its priorities for technical best practice in frontier AI. Read
• 11 Oct 2026: The White House Super Intelligence Force says AI companies must report security incidents, Axios reports. Read
• 7 Oct 2026: Politico obtains the charter for the White House’s new Super Intelligence Force. Read