AI Compliance Weekly — 2026-10-25

The European Commission opened feedback on a draft implementing act that would set common rules for AI regulatory sandboxes under the AI Act. The sandbox framework is meant to let prospective providers develop, train, validate, and test innovative AI systems under regulatory supervision, including in real-world conditions where appropriate.

Why it matters: Companies building AI systems now have a clearer path to test high-risk use cases with regulators, but only if they can document controls, supervision, and the scope of testing. Compliance teams should watch this closely because the implementing act will shape how sandbox participation affects product launch planning and evidence gathering.

The Commission also opened a consultation on draft guidelines for deciding whether an AI system is high-risk under the AI Act. The draft offers clarifications for providers, deployers, and market surveillance authorities, with practical examples across different use cases.

Why it matters: This will directly affect classification decisions, which in turn determine which AI Act controls, documentation, and governance obligations apply. The source also signals that final guidance is due by the end of 2026, so teams should validate current product inventories against likely high-risk criteria now.

CNIL published recommendations on how the GDPR applies to AI development phases, including purpose definition, lawful basis, data minimization, transparency, security, rights handling, and DPIA expectations. The guidance covers design, dataset creation, and model training, and it says a DPIA is strongly recommended for development.

Why it matters: This is a practical roadmap for teams building AI with personal data, especially where training data sources, lawful basis, and transparency notices are still being decided. Organizations should align AI development workflows with GDPR documentation and DPIA triggers before datasets are locked and model training begins.

The Dutch AP fined Uber nearly 825 million euros for fully automated driver deactivations without human review and for failing to sufficiently inform drivers about automated decision-making. The conduct involved automated account deactivations based on suspected fraud or low customer reviews.

Why it matters: This is a strong enforcement signal that automation in employment or platform decisions needs human review and clear disclosures, not just technical performance. Teams using automated decision systems should reassess appeal paths, transparency notices, and whether humans are meaningfully involved before adverse actions are taken.

The FTC finalized an order against IntelliVision Technologies after allegations that it made false or unsubstantiated claims that its AI facial-recognition software was free of gender or racial bias. The order bars the company from making those claims without substantiation.

Why it matters: AI vendors making fairness or bias-free claims now face clear FTC exposure if they cannot back those statements with evidence. Compliance and product teams should review external marketing, sales decks, and model-performance claims for supportability before they go out.

The FTC finalized an order requiring accessiBe to pay $1 million after allegations that it misrepresented its AI web accessibility tool as making any website WCAG-compliant. The case was first announced in January 2025 and later approved as final by the Commission.

Why it matters: This reinforces that AI-assisted compliance tools cannot promise outcomes they do not actually deliver. Companies selling or buying AI accessibility tools should test claims against real-world performance and avoid overbroad legal assurances in customer-facing materials.

The FTC approved a final order barring Workado from advertising the accuracy or efficacy of its AI content detection products unless it has competent and reliable evidence supporting the claims. The order also requires compliance reporting for four years after issuance.

Why it matters: This raises the bar for any vendor marketing AI detection, classification, or scoring tools as accurate or reliable. Firms should preserve validation evidence, align claims with testing methodology, and expect regulators to scrutinize substantiation, not just product demos.

HHS said the HTI-5 proposed rule would streamline the ONC certification program, update information blocking regulations, and promote FHIR-based AI-enabled interoperability. The proposal will be open for public comment for 60 days after publication.

Why it matters: Health IT vendors and regulated healthcare organizations should review how certification and information-blocking changes affect integration plans and AI-enabled workflows. The proposal may change implementation priorities for data sharing, API design, and compliance documentation once comments are finalized.

The FDA issued draft guidance on documentation and lifecycle-management practices for marketing submissions covering AI-enabled device software functions. It recommends a comprehensive approach to risk management throughout the total product life cycle.

Why it matters: Medical device teams will need stronger evidence packs for AI-enabled software functions, especially around design controls, validation, and post-market lifecycle management. Even though the draft is non-binding, it signals the documentation standard FDA expects in submissions.

ISO published an explained guide for ISO/IEC 27090, which focuses on security guidance for AI systems across the AI life cycle. The guide highlights AI-specific threats, detection, mitigation, and how organizations should assess existing security controls.

Why it matters: Security teams using ISO-based controls can start mapping AI systems into their risk inventories and identify where conventional security testing misses AI-specific attack paths. It is especially relevant for organizations that rely on third-party models or retraining pipelines and need to understand how detection and response should work.

The European Supervisory Authorities published their 2027 work programme, keeping digital operational resilience and oversight of critical ICT third-party service providers under DORA as key priorities. The programme also says the Joint Committee will assess the implications of technological developments, including growing use of artificial intelligence.

Why it matters: Financial firms should expect continued supervisory attention on ICT third-party arrangements, resilience testing, and governance over critical vendors. AI adoption will likely be viewed through a resilience lens, so firms should keep operational dependency mapping and third-party controls current.

The Office of the Privacy Commissioner of Canada updated its AI and privacy resources hub and leadership page, pointing to guidance, principles, news, and collaboration on responsible, trustworthy, privacy-protective AI. The materials also note that addressing the privacy impacts of generative AI is one of the Commissioner’s strategic priorities.

Why it matters: This is not a rulemaking change, but it shows where Canadian privacy expectations are heading on generative AI and related use cases. Organizations operating in Canada should monitor the OPC’s guidance stream and align AI governance with privacy-by-design expectations.

The OPC also said it collaborates with domestic and international partners on statements, resolutions, and toolkits aimed at responsible and privacy-protective AI. The page is a collaboration and resources hub rather than a binding legal instrument.

Why it matters: For compliance teams, this matters because it signals that cross-border privacy expectations for AI will continue to evolve through soft law and joint guidance. Organizations should watch for principles that may later influence supervisory expectations or enforcement tone.

AI Act final guidance: The Commission says final guidance on high-risk classification is expected by the end of 2026, so product classification decisions should be reviewed before that framework hardens.

Sandbox operating rules: The AI Act sandbox consultation could shape how regulators supervise testing in controlled environments, which may affect launch plans for higher-risk AI systems.

FTC claim substantiation: The FTC’s recent actions show a growing focus on evidence for bias, accessibility, and accuracy claims, especially for AI tools sold into regulated markets.

DORA third-party oversight: The ESAs are keeping critical ICT third-party oversight and AI-related resilience concerns on the 2027 agenda, which should keep vendor governance high on financial firms’ priority lists.