AI Compliance Weekly — 2026-11-01

The European Commission says it is preparing additional AI Act guidance on high-risk systems, the AI value chain, substantial modification, post-market monitoring, and interaction with other EU laws. The page also flags stakeholder concerns around research exemptions in Article 2(6) and (8) and medical-device development use cases.

Why it matters: Teams building or deploying AI in the EU should expect more detailed interpretive guidance on scoping, lifecycle controls, and cross-law overlap. Until then, compliance programs should map where the AI Act may intersect with sector rules and internal model governance.

The Commission’s AI Act fact page summarizes the Act’s risk-based framework, GPAI transparency and systemic-risk obligations, and the broader AI governance architecture. It reiterates that application is gradual rather than tied to a new standalone announcement.

Why it matters: This is not new law, but it reinforces the baseline for internal controls and board-level oversight. Compliance teams should use it as a reference point for classification, documentation, and governance readiness across AI use cases.

eSafety says providers of social media, messaging, gaming, apps, and websites must take reasonable steps to keep Australians safe under the Basic Online Safety Expectations. The regulator can also require providers to report on how they are meeting any or all of the Expectations, including the rationale for those steps.

Why it matters: This raises the bar from general safety commitments to evidence-backed reporting. Providers should be ready to document controls, explain why they are reasonable, and show how they reduce harm to users.

Canada’s OPC says organizations using or developing generative AI should label AI-generated content or decisions, establish legal authority for collecting and using personal information, and make the system transparent and explainable. The guidance also stresses privacy by design, limiting data sharing, and considering impacts on vulnerable groups, including children.

Why it matters: This gives privacy teams a concrete checklist for AI deployments that touch personal information. If your product uses generative AI, you should verify lawful basis, consent quality where relied on, disclosures, and whether outputs are clearly labeled.

Switzerland’s FDPIC says private- and public-sector controllers must complete a DPIA when processing is likely to create a high risk to personality or fundamental rights. If residual risk remains high after mitigation, the controller must obtain an opinion from the FDPIC; private controllers may be exempt if they have consulted their data protection officer.

Why it matters: This makes risk assessment and escalation a formal compliance step, not just a best practice. Organizations handling sensitive or large-scale surveillance-like processing should ensure DPIAs are documented, specific, and ready for regulator review.

Japan’s METI and MIC compiled AI Guidelines for Business Ver. 1.0 by integrating and updating earlier AI guidance for a broad range of AI business operators. The page indicates the ministries will continue updating the guidance as needed.

Why it matters: While not binding rules, these guidelines are a useful control benchmark for AI governance programs. Teams operating in Japan should align policies, accountability, and documentation practices with the consolidated guidance.

The OECD’s AI Law Radar is a daily refreshed tracker covering AI laws, regulations, obligations, and deadline calendars across 79 jurisdictions. It includes CSV export, RSS feeds, an API, and links to primary sources.

Why it matters: For compliance teams, this is a monitoring tool rather than a rule change, but it can materially improve jurisdictional scanning. It is especially useful for keeping obligation inventories and deadline logs current.

The FCA has launched a review of how AI may reshape UK retail financial services by 2030 and beyond, focusing on future technology, market, consumer, and regulatory implications. It is seeking views now and plans to report to its Board in the summer before publishing externally.

Why it matters: This is an early signal of where UK conduct and supervisory expectations may go, even though no new rules are proposed yet. Firms using AI in retail financial services should use the review to anticipate governance, consumer-harm, and model-risk expectations.

HHS’s OCR dashboard shows how HIPAA cases are closed, including technical assistance, corrective action, and other resolution categories. The page notes that many investigations take multiple years and may involve multi-year monitoring.

Why it matters: This is useful for understanding how long enforcement matters can stay open and how often they end without litigation. Compliance teams can use the data to benchmark response timelines and readiness for corrective action plans.

HHS says the remaining Notice of Privacy Practices modifications tied to the reproductive health privacy rule remain in effect and must be complied with by February 16, 2026. It also notes a proposed HIPAA Security Rule overhaul that would require written, regularly reviewed, tested, and updated cybersecurity policies and procedures for covered entities and business associates.

Why it matters: The NPP obligations are live, while the Security Rule changes remain proposed and should be tracked for timing and scope. Health sector privacy and security teams should separate immediate compliance work from longer-range rulemaking planning.

The FDA continues to publish and update public lists of AI-enabled medical devices as transparency resources and regulatory references. The agency says sponsors should include enough detail in public summaries to support future tagging of foundation-model-based functionality, while recognizing the list is not comprehensive.

Why it matters: Medical device companies using AI should expect public-summary quality to matter for regulatory visibility and future categorization. This affects how product, regulatory, and labeling teams write authorization summaries and public-facing device descriptions.

The CAC launched a special action to drive implementation of algorithm recommendation provisions through self-inspection, inspections, filing, and rectification. Internet enterprises are told to conduct self-checks, submit algorithm filing information, and assign dedicated personnel for algorithm security governance.

Why it matters: This is an operational enforcement push, not just a policy statement. Platforms and large websites in China should ensure filing, governance ownership, and remediation processes are in place and documented.

AI Act follow-on guidance: The European Commission says more AI Act guidance is coming on high-risk systems, substantial modification, and post-market monitoring. Compliance teams should watch for clarifications that may affect current classification and control design.

HIPAA Security Rule timing: The proposed Security Rule overhaul is still pending, but HHS has already signaled stronger written, tested, and regularly updated cybersecurity requirements. Health organizations should monitor rulemaking closely and avoid treating it as already final.

AI law monitoring tools: The OECD’s AI Law Radar makes it easier to track multi-jurisdiction obligations and deadlines. That points to a broader trend: regulators expect teams to maintain current obligation inventories, not rely on static annual reviews.

Consumer safety reporting: Australia’s eSafety guidance shows how online safety regimes are moving toward evidence-based reporting on ‘reasonable steps.’ Expect similar pressure elsewhere for providers to show how safety controls are actually working, not just that they exist.