AI regulation and standards

OpenAI proposed mandatory pre-release evaluations of the most capable AI models by the Center for AI Standards and Innovation (CAISI), while arguing CAISI should recommend mitigations rather than approve or block deployments. The proposal, titled "Democratic Governance of Frontier AI: A blueprint for a federal framework," came a day after a White House executive order on advanced AI innovation and security. It also calls for audits, transparency reports, incident reporting, whistleblower protections, and stronger security controls for frontier AI systems.

OpenAI has published its Frontier Governance Framework, which explains how its safety and security practices align with emerging legal requirements, including California's Transparency in Frontier AI Act and the EU AI Act's Code of Practice for General Purpose AI. The framework builds on the existing Preparedness Framework and covers risk assessment and mitigation for cyber offense, CBRN risks, harmful manipulation, and loss of control, along with model reporting, incident response, and framework updates.

Hours before he was set to sign an executive order calling for a government safety review of new AI models before release, Donald Trump abruptly backed out. He said the US would not slow its AI race, citing American dominance and competition with China.

Article 50 of the EU AI Act sets transparency obligations for providers and deployers of AI systems in four situations: direct interaction with people, synthetic content generation, emotion recognition or biometric categorisation, and deepfakes or public-interest text. The obligations apply to any AI system in those situations, not only high-risk systems, and to open-source systems, from 2 August 2026.

AWS Security Blog announced a new compliance guide, ISO/IEC 42001:2023 on AWS, for organizations building an Artificial Intelligence Management System (AIMS) on AWS services. The guide maps ISO 42001:2023 clauses 4–10 and Annex A controls A.2–A.10 to AWS services and architectural capabilities, and it notes that customers remain responsible for defining their AIMS scope, implementing controls, and demonstrating conformity during certification audits.

CrowdStrike has been selected for OpenAI's Trusted Access for Cyber (TAC) program, which gives verified, selected defenders governed access through identity verification and tiered controls. OpenAI released GPT-5.4-Cyber, a frontier model designed for defensive cybersecurity, alongside the TAC expansion. The article is largely promotional, describing CrowdStrike's Falcon platform and AgentWorks framework and noting that the EU AI Act's next phase takes effect August 2, 2026.

This overview explains how the European Commission's enforcement powers over general-purpose AI (GPAI) model providers under Chapter V of the EU AI Act will apply. The powers, covering documentation requests, evaluations, measures and fines, take effect on 2 August 2026, while the obligations themselves applied from 2 August 2025.

California Governor Gavin Newsom signed an executive order giving the state four months to develop AI policies that prioritize public safety. Companies seeking state contracts must show policies that prevent AI from distributing child sexual abuse material and violent pornography, avoid harmful bias, and prevent unlawful discrimination, detention, and surveillance. The order also directs the state to develop best practices for watermarking AI-generated or manipulated images and videos.

European lawmakers voted to delay key parts of the EU AI Act, the bloc's flagship AI law, and to back proposals to ban nudify apps. The delay would push compliance deadlines for high-risk AI system developers to December 2027, and to August 2028 for AI covered by sector-specific safety rules such as toys or medical devices.

The Trump administration unveiled a seven-point legislative blueprint for AI regulation on Friday. It proposes that the federal government avoid most AI regulation beyond child safety rules and bar states from interfering with the "national strategy to achieve global AI dominance." The plan also urges Congress to add safeguards for minors using AI services and to address electricity cost spikes linked to AI infrastructure.

The EU AI Act classifies AI systems used in employment decisions, including recruitment, selection, candidate evaluation, performance monitoring, and decisions on compliance, contract terms or termination, as high-risk. Both providers and deployers of such systems must meet obligations, including risk assessments, bias testing, human oversight and transparency disclosures, with compliance required by 2 August 2026. The Act may apply to deployers not based in the EU when system outputs affect people in the Union.

Two AI-focused political action committees are competing in a New York congressional race, an early test of AI regulation ahead of the midterm elections. Jobs and Democracy PAC, the Democratic arm of a pro-regulation group, is backing Alex Bores, the assemblyman behind New York's RAISE Act, which requires large AI developers to publish safety protocols and report serious misuse of their technology. Leading the Future, backed by Andreessen Horowitz and others, has run ads against Bores.

The paper proposes CA–CI, an extension of contextual integrity that integrates dignity thresholds from the capabilities approach and treats purpose as a constitutive parameter. The authors show how CA–CI can operationalize the EU AI Act's fundamental rights impact assessments, harm thresholds, and anticipatory governance.

Legal compliance professionals explain how modifying an AI system or general-purpose AI (GPAI) model can make the modifier a provider under the EU AI Act, shifting compliance obligations onto them. The shift is triggered when a high-risk AI system is modified or a GPAI model is significantly changed in generality, capabilities, or systemic risk, such as through fine-tuning. The authors state that the European Commission set relatively high compute-based thresholds for substantial GPAI modifications and expects few modifiers to become GPAI providers. Misclassification can lead to fines of up to €15 million or 3% of global annual revenue.

This resource, by Santeri Koivula and Karl Koch, explains the EU Whistleblowing Directive (2019) and how it relates to the EU AI Act. From 2nd August 2026, the Directive explicitly covers reporting violations of the EU AI Act, protecting employees, contractors, suppliers, job applicants and former workers who report them internally, to national authorities, or publicly in certain situations.

On 18 July 2025, the European Commission published draft Guidelines clarifying provisions of the EU AI Act for General Purpose AI (GPAI) models. The Guidelines set the compute threshold of more than 10²³ FLOPs for GPAI classification and 10²⁵ FLOPs for systemic-risk models, and they require providers to notify the Commission within two weeks of reaching that threshold. Once translated into all EU languages, the Guidelines will be formally adopted.

The Code of Practice gives developers of General Purpose AI (GPAI) models a framework for meeting the requirements of the EU AI Act, though providers may demonstrate compliance through other appropriate methods. GPAI rules take effect on August 2, 2025, and Commission enforcement actions begin on August 2, 2026. Models released before August 2, 2025 must comply by August 2, 2027.

The Senate voted 99-1 to remove a provision from the Republican "Big Beautiful Bill" that would have barred states from regulating AI by tying it to federal broadband expansion funds. The provision had been narrowed after the Senate Parliamentarian ruled it could only apply to the new $500 million in funds, not the full $42.45 billion previously appropriated. The Senate Commerce Committee had revised the original moratorium to clear the Byrd Rule, which bars policy provisions in budget bills.

This resource presents a non-exhaustive selection of AI literacy programs for organisations and professionals in Europe, aimed at supporting Article 4 of the EU AI Act. Programs were selected for alignment with Article 4, a clear non-technical target audience, accessible format, transparency, and geographic and sectoral diversity. The list reflects publicly available information as of April 2025, and the author, Tânia Figueiredo, notes that no claims are made about legal compliance or endorsement.

The source is a guide to the EU AI Act's provisions for small and medium-sized enterprises (SMEs). It covers regulatory sandboxes that SMEs can access free of charge with priority, assessment fees proportional to company size, simplified technical documentation forms, and dedicated guidance channels.