What already binds your AI build, and what is only dated

What already binds you

If your product has a support assistant built on Claude, from 12 November 2026 you owe the people using it a disclosure. Not under any statute. Under the terms of the model it runs on.

Anthropic’s Usage Policy requires every consumer-facing chatbot or agent that communicates directly with external users to “disclose to users that they are interacting with AI rather than a human”, at a minimum at the start of each session or in the interface. No size threshold and no jurisdiction — and it reaches a company using the API, not only someone shipping on the consumer product. It is also the one duty in this layer with a date to wait for: the policy carrying it takes effect on 12 November 2026.

That is the shape of the whole first layer. We read four model providers’ policies on 3 November 2026. Each conditions the use of its services in consequential or high-risk decisions on some form of human oversight, and two of the four also require telling someone that AI was involved. The triggers differ more than the duties do.

The four model providers’ policies, as read on 3 November 2026.

Microsoft’s is the widest and Google’s the narrowest, so the same product can be inside one policy and outside another on the same facts.

Anthropic’s reads to us as the most demanding where it bites: in one of eleven named areas — legal, medical, finance, credit, insurance, housing, employment, education and credentials, healthcare access, public benefits and services, and legal status and adjudication — “a qualified person must meaningfully review a High-risk AI Recommendation”, with the authority to change it, before it reaches “an individual who might rely on it” as advice or is used to carry out a decision. And the person affected “must be clearly told that AI was used to produce it”, though you need not name the vendor or the model. Each area carries its own definition and they narrow a long way: finance means a personalised recommendation about someone’s own investments or their own tax, and the line is whether it applies to an individual’s circumstances rather than whether the thing is software.

The duty is not flat, and its exceptions matter more than the list of areas does. Where law permits, human review is not required before acting on a recommendation wholly favourable to the individual: paying an insurance claim, approving coverage or prior authorisation for care a clinician has ordered, granting eligibility for a healthcare service or programme, or granting or continuing a public benefit. A separate exclusions block lifts the requirements altogether for business operations that do not advise or decide about a specific individual, and for internal drafting, research or analysis that is not the recommendation finally delivered. Four of the eleven areas are exactly where that carve-out operates, so it reaches the readers most likely to be inside the duty.

Two caveats we would want if we were reading this rather than writing it. These are four policies read on one day, and we did not read OpenAI’s, because its pages answered a plain request with a bot check and we do not defeat bot checks. And only two of the four require any disclosure at all — we read the other two end to end, and the word does not appear in one of them.

A contract is not a statute. It also has teeth a statute does not

None of the above is law, and two of the four say so themselves. Anthropic’s policy states that its high-risk requirements “do not replace local legal requirements and restrictions”, and that where local law conflicts or adds, you follow the law. Amazon Web Services goes further and names the statute: your obligation to comply with applicable law “includes laws specific to artificial intelligence such as the EU AI Act.”

So the two layers are additive, not alternative. But a policy applies when you accept it, where a statute waits for its commencement date — and the heaviest statutory duties are still ahead of theirs. The one date in this layer runs the other way: Anthropic published a new version of its Usage Policy on 8 October 2026 and “the updated policy takes effect on November 12”, but two of the requirements above are not new — the qualified person in the loop, and telling the affected individual — and Anthropic says so: “These requirements haven’t changed with the updated version of our Usage Policy.” So those two bind today, and they are the ones this note’s title rests on.

Then the part worth reading twice, because it is not on the policy page. Anthropic’s Commercial Terms make the Usage Policy “incorporated by reference into these Terms” — a contractual obligation, not a statement of expectations — and require you to “cooperate with reasonable requests for information” about your compliance with it. Amazon Web Services has that audit hook in the policy itself: “You agree to provide information about your intended uses”. And Anthropic’s Terms define an indemnified claim to include a third-party claim related to “use of the Services in violation of the Usage Policy”. Breach the policy, and somebody else’s claim against the vendor becomes yours to defend and pay for.

We can say that of Anthropic because we read the agreement its policy is incorporated into. For the other three we read the policies and not the agreements they point at, so we do not say it of them.

One more clause for anyone building agents rather than features: Microsoft requires “adequate human user controls to monitor such system’s decisions and actions”, to “detect anomalies, and intervene when appropriate”, and documentation of what it can do on its own. Hold that beside the timeline below, where the EU’s own requirement that a high-risk system be designed for human oversight does not arrive until December 2027 for one class of high-risk system and August 2028 for the other.

Does any of it actually reach you?

Now the statutes. The question a reader has is not what they say but whether they apply, so that is where this starts.

Begin with California, which in three days did both things. On 28 September 2026 it chaptered a chatbot regime binding only a business with “more than five hundred million dollars ($500,000,000) in gross annual revenue nationally”. On 30 September, by an urgency statute in immediate effect, it amended its AI Transparency Act so that a covered provider is anyone producing a system “publicly accessible within the geographic boundaries of the state” — no threshold at all.

Your size tells you nothing about which of California’s AI duties reach you. And the gate sits on a subdivision, not on an Act: its child-safety Act gates one duty and not its neighbours, while the Transparency Act’s definitions still carry a two-million-user figure that governs exactly one section — not the duties everybody quotes it against.

We know that because it is the mistake we made. Our own research reported the deleted threshold as live, from a copy taken three days before it changed — on this statute, while writing this.

The reach tests, which are all different. Texas reaches anyone whose product or service is used by people living in the state — no establishment, no staff, no marketing. California’s training-data law attaches when a system “is made publicly available to Californians for use”, with or without payment, and contains no requirement that the developer do business in the state at all. Korea’s Act reaches conduct carried out abroad where it affects the home market or the people using a service there. Vietnam’s reaches foreign organisations and individuals taking part in AI activities in Vietnam. Neither that formula nor the Korean one above is quoted here: both are rendered from a translation, the Korean one from a government-published English text that disclaims legal effect, and a translation is not a quotation. China’s generative-AI measures turn on providing a service to the public within the country, with an application programming interface expressly included. Taiwan’s Act has no applicability or scope article at all, and we found none in Japan’s.

The thresholds that let you out, and the three that do not exist. Colorado’s duties bind a person “doing business in Colorado”, so on its face it does not reach a company with none. Australia’s new automated-decision duty binds an entity that is not a small business operator, and a small business is one whose “annual turnover for the previous financial year is $3,000,000 or less” — unless a statutory disqualifier applies, and one of those catches a business that discloses personal information about an individual for a benefit, or provides a benefit in order to collect it. The frontier-model statutes of California, New York and Connecticut each use the same gate, “annual gross revenues in excess of five hundred million dollars”, but they put it in different places.

Against those, three instruments reach a company with no local presence and give it nothing to fall under: Texas’s Act, California’s training-data law, and California’s companion-chatbot statute.

Two readings worth getting right, because we got each of them wrong once. On the frontier-model statutes the line is not that you build on someone else’s model and are therefore outside; it is whether you train, fine-tune or materially modify. An interface-only builder is outside. A fine-tuner is inside the argument, and whether its compute counts with the original training run is unresolved on California’s own wording — Connecticut settled the same question expressly, which is what it looks like when a legislature decides rather than leaves. Either way, below five hundred million dollars of group revenue you are outside every penalty and every expensive duty in California’s and New York’s chapters whatever your compute does, and not necessarily outside three California duties that nothing in them sanctions.

Connecticut is the exception, and it is the one that would catch a small company. Its notice duty binds “each frontier developer” with no revenue gate — a posted workplace notice, notice to new hires, periodic notice to remote workers, or an acknowledged annual notice — and a frontier developer that breaches it owes Connecticut a penalty that “does not exceed one thousand dollars per violation”, which the Attorney General may sue to collect. The gate sits on one subdivision of that section and not on the section. We had this wrong in a draft of this note, which is the same error the section above warns about.

On California’s training-data law the duty attaches to a developer who produces “an artificial intelligence system or service for use by members of the public”, and separately when that system “is made publicly available to Californians for use”. A product anyone can sign up to is plainly inside. A bespoke internal application for one unaffiliated client has a real argument that it is outside — and not a safe one, because the statute’s only carve-outs from “members of the public” are an affiliate and a hospital’s medical staff member, which can be read either as naming the only excluded business customers or as a list of particular people. Nothing we read resolves it.

The map, dated

Nine regimes a company shipping software is most likely to meet. The column that matters is the last one: what happens first if you are not compliant, which is rarely a fine and is sometimes nothing.

Nine regimes, as read on 3 and 4 November 2026. Each date is the one its own instrument sets or, where the instrument is silent, the one its jurisdiction’s default commencement rule gives. Where a date is counted from another, the arithmetic is ours and is marked.

Two things a date alone hides. Vietnam’s law is in force now, but a system already running has twelve months from commencement — eighteen for systems in health, education and finance — so an incumbent product is not late. Korea’s labelling duties are in force and breaching them is not directly fineable: the route runs through an investigation and a corrective order, and the fine attaches to disobeying the order.

The dates move, and not only forwards

A map is a photograph. Here are the dates the regimes above turn on, in order, and then the two places they have run backwards. It is a selection and not every date in what we read.

Read on 3 and 4 November 2026. Every date here is set by its own instrument, except where the instrument is silent and the date follows its jurisdiction’s default commencement rule.

The EU’s moved back. Its high-risk obligations were to apply from 2 August 2026 and 2 August 2027; an amending regulation in force since July 2026 moved them to 2 December 2027 and 2 August 2028. Our note on the AI Act for companies outside the EU has the detail. A deadline that a great many maps had already printed was moved, so a map written before July is wrong.

And one duty is being deleted. The only federal United States rule we found imposing an AI-transparency duty on a software vendor — a model-card requirement for clinical decision support in certified health software — is removed by a final rule effective 28 December 2026. It is in force today, with weeks left. Regulation is not moving one way everywhere.

A date can also mean the section took effect and the duty did not. Connecticut’s employment provisions took effect on 1 October 2026; their duties attach only to technology deployed on or after 1 October 2027.

Which is why we would not trust any map, including this one, on its age alone. The question is not how old the source is. It is whether a legislature has sat since, and whether it passed anything that took effect immediately. An eight-month-old copy of one California chapter was still accurate when we checked it; a five-week-old copy of another was not, because a legislature had sat in between and passed an urgency statute. We nearly published the stale one.

What is not law at all

A large part of what gets published as AI regulation is not regulation. It is worth separating, because conflating the two is how a team ends up buying a certificate to answer a statute.

ISO/IEC 42001 is a management system standard. ISO’s own description is that it works “Rather than looking at the details of specific AI applications” — it is about your processes, not about a model. And ISO is plain about what certification is not: “a company or organization cannot be certified by ISO.” A certificate comes from a third-party body, and it says something about how you run things. It is not a finding that you comply with any law.

The NIST AI Risk Management Framework says of itself that it “is intended to be voluntary, rights-preserving, non-sector-specific, and use-case agnostic”.

The Council of Europe’s AI convention is not in force. It needs five consents, at least three of them from Council of Europe member states, and the Council’s own page, read on 3 November 2026, lists one Party — the European Union. That is the Council’s thematic page rather than the depositary’s own chart, which would not load for us, and the page is inconsistent with itself about status, so this is a treaty’s status taken from a source whose authoritative counterpart we could not read. In force it would still not bind you: its provisions are addressed to the Parties, and the Council Decision approving it says it is to be “implemented in the Union exclusively through Regulation (EU) 2024/1689” — the AI Act you already have.

Japan, Taiwan and Singapore legislated promotion, or published frameworks, rather than enforceable duties — a choice, not a lag. Japan’s Act does place a duty on business, to cooperate, with nothing particular to do and no consequence for not doing it. Taiwan’s Act is in force and imposes no enforceable duty on a private business.

And the United Kingdom now has a statutory instrument about AI which binds nobody: it requires the Information Commissioner to “prepare an appropriate code of practice giving guidance as to good practice” on AI and automated decision-making. No duty on a company, and no deadline for the code. It matters because the regulator’s own AI guidance is older than the law it explains and carries a notice saying it is under review.

So how does the voluntary layer reach you anyway? ISO names it itself: “For some industries, certification is a legal or contractual requirement.” A contract, or a statute that points at a standard — Texas’s own safe harbour names a NIST publication, though it is the Generative AI Profile rather than the framework quoted above. What we looked for and could not find is a public procurement rule mandating the AI management standard; the sources asserting one were almost all certification consultancies, certification bodies and vendors, and one lead we did not follow was a report of it in Italian public contracting.

One list, because the overlap is smaller than it looks

You do not need a compliance programme per jurisdiction. Across everything above, four controls carry most of the weight.

A qualified person reviews a consequential output before it is acted on, and can change it. All four vendor policies require some form of human oversight, each on a trigger of its own — but that precise formulation, a qualified person with authority to change the recommendation before it is acted on, is Anthropic’s. The EU asks for something related and not the same: from December 2027 a high-risk system must be designed so that it can be “effectively overseen by natural persons”, which is a duty to build for oversight rather than to carry one out. Colorado asks for something adjacent in its own words: “an opportunity for meaningful human review and reconsideration of the consequential decision”, by someone with authority to approve, modify or override it, though after the decision rather than before and only so far as commercially reasonable. Connecticut asks for nothing of this shape — the phrase “human review” does not appear in its Act. It is still the single highest-value control to build first.

Tell people when they are dealing with AI, and when a decision used it. Two vendor policies require it now; since August 2026 the EU has required that a person interacting directly with an AI system be “informed that they are interacting with an AI system”, unless that is obvious to a reasonably observant person; Vietnam and China require labelling; and California requires provenance in generated media.

Keep a record of what the system did and who approved it. No vendor policy asks for a log in terms, but two reserve a right to ask about your use — one in its policy, the other in its commercial terms — and the regimes here that do bite assume you can account for a decision afterwards.

Write down what the system is — what it does, who it affects, what it is not for. Vietnam requires a classification dossier for a system it rates medium or high risk, notified before the system is put into use; California’s training-data law requires published documentation; and the EU requires a high-risk system’s technical documentation to be “drawn up before that system is placed on the market or put into service”. The same page answers a buyer’s security questionnaire.

What those four do not do is make you compliant with anything, and we would not say otherwise: we document controls, we do not certify compliance with any regulation. They are the overlap, not a safe harbour.

Then we ran the test on ourselves

Two statutes of that same California session reach our own work rather than a client’s. Neither is in the map above, which is about what reaches a company shipping software, so it would be poor form to leave them out here.

The one that reaches our marketing. From 1 January 2027 California makes it unlawful for any person “to create and cause to be published” an advertisement that “prominently includes” a synthetic performer without a prescribed disclosure. The duty is conjunctive, which matters for an agency: making an advertisement a client then places is a real argument that you have created but not caused publication — and it disappears the moment you publish your own work, which we do. The trigger we would actually meet is an AI voiceover, and the cure is one line of prescribed text. What the dossier had missed until the last check is the consequence: a violation of that section is made a violation of California’s false-advertising statute, which is a misdemeanour — up to six months, or $2,500, or both — and the bill’s own digest says it is “expanding the scope of a crime”. A prosecutor must be awarded a civil penalty on top, and a private party who lost money can sue.

And the pair worth memorising, because two Acts of the same session cover the field between them. A synthetic performer is defined as one not recognisable as any identifiable natural person; a digital replica is one readily identifiable as a real person’s voice or likeness. They are mutually exclusive, reading the two definitions side by side, though neither Act says so. If the AI person in your advertisement looks or sounds like somebody real, you need their consent; if they look like nobody, you need a disclosure. There is no third option. The two halves are not on the same clock: using a real person’s voice or likeness in an advertisement without consent is already actionable, and what arrives on 1 January 2027 is the clarification that a digital replica counts as that voice or likeness. The disclosure is the half that starts then.

The one that reaches our service line, and does not. The same session set up a registry for people who sell AI audits. We checked it against what we actually publish, expecting to be inside it. We are not: a “covered AI audit” is defined as one assessing controls “necessary for compliance with state law”, and the only thing we call an audit is an accessibility audit against WCAG, which our process page describes as automated and keyboard checks and says is not a claim of conformance. What the chapter does govern is a claim we have not made.

The rule in it that would bite us is a different one, and it is worth anybody’s attention who builds and then reviews: a registered auditor may not conduct a covered AI audit “that requires the auditor to evaluate the auditor’s own work”, including of a system, control or process it “materially designed, developed, implemented, or operated for the auditee”. A registered auditor cannot audit what it built. That constrains how a registered auditor sequences work, not what a studio outside the registry may sell — and it is the kind of thing you find only by reading the statute rather than a summary of it.

What this map does not cover

Worth knowing, because a map that does not say where it stops is not much use.

We did not sweep all fifty American states. Two live instruments turned up by accident while we were checking others, which tells you the gap is real. So we nowhere claim that only these states have done anything.

We left out a whole category that may matter more than any single AI statute. Comprehensive state privacy law bites on AI features without being called AI law. California’s own regulations on automated decision-making technology took effect on 1 January 2026, define a significant decision by the kind of outcome it produces — financial services, housing, education, employment — and must be complied with by 1 January 2027. We did not survey the other states’, and none of this is in the map. That is the first thing we would add next.

India we could not read. Its gazette would not serve us the instrument, so we say nothing about its labelling rules in either direction — including nothing about the widely-quoted figure for how much of an image a label must cover, which we traced to a consultation draft rather than a rule.

Singapore rests on an archived index captured in mid-2024, because its own statute database refused our requests. Utah we cut back to one fact — the section every tracker cites is repealed — because it legislated again in 2026 and we did not read it. OpenAI’s terms we did not read. And the implementing decrees that would tell you how to comply, Vietnam’s especially, we did not obtain: they hold the risk detail, the filing procedure and the format of a required mark.

Review and corrections

This note was read against primary sources on 3 and 4 November 2026 — the instruments themselves, their official gazettes, court filings and the vendors’ own policies. Where a date comes from a clause we cite the clause; where an instrument is silent and the date follows a default commencement rule, that is our reading of the rule and not a quotation from the Act. A few things here are not from a primary source — Singapore and India among them — and where that is so this note says it.

It will go out of date, and the first things to go will be the dates. Three of the nine regimes in the map have duties attaching in 2027, one United States duty disappears in December 2026, and the model vendors revise their policies on their own schedule — one of them did so a month before we wrote this. If you find something here that is wrong, or that has moved, tell us and we will correct it and say what changed.

This is not legal advice. It is what we read, with the pinpoints, so that you can check it or hand it to someone who can.