Australia moved the needle most sharply this week: the eSafety Commissioner said the Age-Restricted Material Codes have fully commenced, creating concrete age-assurance and child-protection expectations for online services, including AI companion chatbots. In the United States, the FTC doubled down on AI-related consumer protection, finalizing orders over deceptive advertising and voice-data claims while also reopening and setting aside the Rytr AI testimonial order. Separately, HHS reminded companies handling consumer health data that HIPAA, the FTC Act, and the Health Breach Notification Rule may all apply at once. The main theme across jurisdictions is clear: regulators are focusing less on abstract AI policy and more on whether products, disclosures, age checks, and data practices actually work as claimed.
Other jurisdictions / frameworks
Australia age-restricted material codes fully commence
Australia’s Age-Restricted Material Codes have fully commenced, requiring online services across the ecosystem to implement age-appropriate protections for children and age assurance for access to certain adult material. The eSafety Commissioner said services must prevent children’s exposure to age-inappropriate content and that age-assurance measures must be accurate, robust, fair and reliable.
Why it matters: If your product can expose minors to adult content, you now need defensible age-gating and child-safety controls, not just policy language. The privacy constraint is also practical: age assurance must comply with Australian privacy laws and be managed solely by the service being used.
Read source →eSafety targets AI companions over child safety risks
eSafety issued legal notices to four AI companion providers asking how they protect Australian children from sexually explicit content, suicide and self-harm risks, and child sexual exploitation and abuse material. The notices also require responses on compliance with the Government’s Basic Online Safety Expectations Determination and steps being taken to keep Australians safe online.
Why it matters: AI companion providers should expect direct regulator scrutiny on safety-by-design, content moderation, and child protection controls. The notice process can force detailed reporting, so teams need documentation ready on safeguards, escalation paths, and how risks are monitored in practice.
Read source →Basic Online Safety Expectations define reporting duties
eSafety’s guidance explains the Basic Online Safety Expectations and the circumstances in which it can require online service providers to report how they are meeting them. The expectations include safe use for all end-users, children’s best interests in service design, safe use of generative AI and recommender systems, and minimization of unlawful and harmful material.
Why it matters: This turns online safety into an evidence-and-reporting problem, not just a policy commitment. Providers should be prepared to show how specific features, including AI and encryption, are made safer and how those controls are tracked over time.
Read source →eSafety publishes AI services transparency response
eSafety published a transparency-notice report on AI services and explained how enforceable notices are used to assess compliance with the Basic Online Safety Expectations. The guidance says providers can receive periodic or non-periodic notices, and section 20 of the Online Safety (Basic Online Safety Expectations) Determination expects information requests to be answered within 30 days.
Why it matters: For AI service operators, regulator-ready recordkeeping now matters as much as product design. If eSafety sends a notice, missing the 30-day response window or lacking evidence of compliance could turn a reporting request into enforcement risk.
Read source →US Federal & State Regulation
FTC finalizes Cox Media Group deceptive ads orders
The FTC finalized orders against Cox Media Group and two other firms, requiring redress and restrictions after finding deceptive claims about advertising services. The orders bar misrepresentations about advertising features, voice-data collection and consent, and geographic targeting capabilities, and the firms will pay a total of $930,000 in redress.
Why it matters: Adtech and marketing vendors need tight controls over product claims, especially where AI or data profiling is involved. Sales, marketing, and privacy disclosures should align with actual capabilities and consent flows, or they may become FTC enforcement issues.
Read source →FTC drops Rytr AI testimonial order
The FTC reopened and set aside its 2024 final order against Rytr, concluding the complaint did not satisfy the FTC Act and that the order unduly burdened AI innovation. Rytr consented to vacating the order, and the action was taken in response to the Trump Administration’s AI Action Plan.
Why it matters: This is a signal that FTC AI enforcement posture can shift quickly, but it does not reduce the need for substantiation and deceptive-practices controls. Companies using AI-generated testimonials or claims should still assume the FTC will scrutinize how outputs are represented to consumers.
Read source →HHS maps HIPAA and FTC health-data obligations
HHS issued guidance explaining that companies collecting consumer health information may need to comply with HIPAA, the FTC Act, and the FTC’s Health Breach Notification Rule. It highlights authorization requirements for marketing uses of PHI, Security Rule safeguards for ePHI, breach-notification duties, and the need to avoid deceptive or unfair health-data claims.
Why it matters: Health apps, digital health vendors, and consumer platforms should review whether they fall into overlapping HIPAA and FTC regimes, then align privacy notices, security controls, and breach workflows accordingly. The warning on misleading user interfaces is especially important for consent and data-use disclosures.
Read source →Colorado first to pass cross-sector AI rules
A resource from IAPP identifies Colorado as the first state to pass cross-sectoral private-sector rules for certain high-risk AI systems. The update frames Colorado as a state-level baseline for AI governance.
Why it matters: Organizations operating in Colorado should treat this as a reference point for broader state AI compliance programs, especially around high-risk AI governance. Even without full statutory detail in the source, the signal is that state-level AI obligations are moving from theory to enforcement-adjacent governance expectations.
Read source →GDPR / Data Protection Enforcement
AEPD adds AI and age-assurance resources
The AEPD’s innovation-and-technology portal lists updated resources on AI, privacy by design, risk management, and age assurance. The page is a resource index rather than a rule or enforcement action, but it shows where the agency is directing attention.
Why it matters: For compliance teams, this is a useful signal for policy and control priorities, especially around AI governance and privacy by design. It is not a new obligation on its own, but it can shape supervisory expectations and internal audit focus.
Read source →AEPD repository surfaces AI and children-safety materials
The AEPD repository page collects multiple AI, children-safety, and age-assurance materials, including guidance on chatbots and age verification. The page lists documents published across several dates, but it is only an index and not a standalone compliance rule.
Why it matters: Teams using AI in Spain or the wider EU should monitor this repository as a lead indicator of supervisory priorities. The practical value is in the topics being surfaced, especially children, age assurance, and AI governance.
Read source →ISO Standards
FDA webinar explains PCCP planning for AI devices
The FDA held a webinar on its final guidance for Predetermined Change Control Plans for AI-enabled device software functions. The agency explained that a PCCP should describe planned AI modifications, the methodology for developing and validating them, and the expected impact of those changes.
Why it matters: Medical-device teams need a formalized approach to iterative AI updates, including how changes are validated before release. The practical takeaway is that change management, model validation, and safety documentation must be designed together, not retrofitted later.
Read source →On Our Radar
Australia online safety enforcement: With the Age-Restricted Material Codes now fully commenced, expect more scrutiny of age assurance, child-safety controls, and AI companions that can generate harmful content.
FTC focus on AI claims: The FTC’s actions this week reinforce that deceptive marketing, voice-data claims, and unsupported AI promises remain a live enforcement area.
Cross-border AI governance creep: Spain’s AEPD and Colorado’s state AI baseline both point to a broader trend: AI governance is becoming a patchwork of practical supervisory expectations, not a single global rulebook.