Monday, June 1, 2026
Independent Technology Journalism  ·  Est. 2026
Artificial Intelligence

AI Regulation in 2026: What the New Rules Actually Require

The Audit That Changed How OpenAI Ships Models Earlier this year, OpenAI's GPT-5 series faced something its predecessors never did: a mandatory conformity assessment under the EU AI Act's Ge...

AI Regulation in 2026: What the New Rules Actually Require

The Audit That Changed How OpenAI Ships Models

Earlier this year, OpenAI's GPT-5 series faced something its predecessors never did: a mandatory conformity assessment under the EU AI Act's General-Purpose AI (GPAI) provisions before deployment in European markets. The process took roughly eleven weeks, required submission of training data provenance documentation, and resulted in two requested modifications to the model's output filtering architecture. It wasn't a ban. It wasn't even particularly punishing. But it signaled, unambiguously, that the era of ship-first-explain-later is over in at least one major jurisdiction—and the rest of the world is watching closely to see whether that model spreads.

We've spent the past several weeks reviewing enforcement guidance, interviewing researchers, and combing through the technical annexes of three major regulatory frameworks. What follows isn't a policy summary you'd find in a government press release. It's an attempt to explain what these rules actually demand at the engineering level—and where they're likely to break down.

The EU AI Act Enforcement Phase Has Real Teeth Now

The EU AI Act entered its full enforcement phase in August 2026, after a staggered rollout that began with prohibited practices in February 2025 and high-risk system rules in August of the same year. GPAI model obligations—the ones affecting frontier labs like OpenAI, Anthropic, Google DeepMind, and Mistral—became fully enforceable this past spring, and the European AI Office has already opened preliminary investigations into three unnamed providers.

The Act distinguishes between standard GPAI models and those with "systemic risk," defined as models trained on more than 10^25 FLOPs. That threshold, technically arbitrary but practically meaningful, sweeps in GPT-5, Gemini Ultra 2, and Anthropic's Claude 4 Opus. These models face additional obligations: adversarial testing (red-teaming) against the EU's common evaluation framework, incident reporting within 72 hours of detecting a "serious incident," and cybersecurity standards aligned with ETSI EN 303 645—a standard originally written for IoT devices but now being retrofitted for AI system security.

"The 72-hour incident reporting window is where I expect the first real enforcement collisions," said Dr. Amara Osei-Bonsu, AI governance researcher at the Oxford Internet Institute. "Most large model deployments don't have instrumentation that can even detect a qualifying incident that fast, let alone escalate it through legal and engineering simultaneously."

"The regulation was written assuming that AI systems behave more like medical devices than like software platforms. That assumption has consequences that engineers haven't fully reckoned with yet." — Dr. Amara Osei-Bonsu, Oxford Internet Institute

The fines are not symbolic. Non-compliance for GPAI providers with systemic risk designation carries penalties up to 3% of global annual turnover, and for prohibited practices—such as real-time biometric surveillance in public spaces without specific exemptions—up to 6%. For a company like Microsoft, whose Azure AI services are deeply embedded in European enterprise infrastructure, that's a number worth building compliance teams around.

What the US Executive Order on AI Actually Mandates in Practice

The Biden-era Executive Order on AI from October 2023 required frontier model developers to share safety test results with the US government before public release. The current administration extended and revised that order in March 2026, narrowing the compute threshold that triggers reporting from 10^26 FLOPs to 10^25 FLOPs—matching the EU's systemic risk threshold, likely not by coincidence—and adding explicit requirements around biological and chemical capability evaluations.

NIST's AI Risk Management Framework (AI RMF 1.0), released in January 2023, has become the de facto compliance skeleton that most US-based enterprises use to structure internal governance. But it's voluntary. And that's the core tension in the American approach: unlike the EU, the US has bet heavily on sector-specific guidance and industry self-attestation rather than binding horizontal law. The FTC has authority over deceptive AI practices; the FDA governs AI in medical devices; FINRA watches algorithmic trading. There's no single enforcement body, no unified audit standard, and no penalty structure that spans industries.

Keep reading
More from Verodate