Regulation
The EU AI Act's August 2026 date arrived, and the timeline is still moving
What happened. Most high-risk obligations under the EU AI Act became applicable on August 2, 2026, while a Parliament vote to push high-risk duties to December 2027 (and sector-specific duties to August 2028) awaits Council confirmation.
What it means for you. If your systems are sold into the EU, or their outputs touch EU residents, the obligations reach you from New Jersey. Technical documentation, conformity assessment, EU database registration, and an EU authorized representative are the four items to check. Penalties run to 15 million euros or 3 percent of global turnover.
Source: Holland & Knight analysis
Agentic AI
Two in three enterprises have seen an AI agent act outside its intended scope
What happened. A survey of 202 enterprise technology and security leaders, published September 1, 2026 by Enterprise Management Associates for Cequence Security, found 65 percent had agents act beyond intended scope, 29 percent with measurable organizational impact.
What it means for you. The governance numbers are the story: 46 percent could produce a complete 30-day audit trail, and 32.7 percent provisioned agents with least privilege. If you are piloting agents, the audit trail and the permission model are the two controls to put in before the pilot, not after.
Source: Infosecurity Magazine
US state law
Colorado replaced its AI Act, and the clock restarted
What happened. Colorado repealed the 2024 AI Act and replaced it with the Automated Decision-Making Technology Act, signed May 14, 2026, effective January 1, 2027 once the attorney general completes rulemaking.
What it means for you. The replacement puts documentation duties on developers and notice duties on deployers, including a plain-language explanation within 30 days of an adverse decision. Penalties reach $20,000 per violation, with a 60-day cure period that expires in 2030. If you use automated screening anywhere in hiring, lending, or housing, the notice workflow is the piece to design now.
Source: Skadden analysis
Employment
The employment rules already in force are the ones catching companies out
What happened. California's Civil Rights Council regulations on automated decision systems took effect October 1, 2025, with a four-year retention requirement for automated-decision system data. Illinois' AI disclosure law took effect January 1, 2026.
What it means for you. These apply now, and they reach any employer using AI in recruitment, hiring, or promotion, including résumé screeners bought off the shelf. Anti-bias testing needs to be documented, and records kept for four years.
Source: Seyfarth Shaw roundup
Nothing in the Weekly Signal is legal advice. HEED SAI is not your law firm or your accountant. Where a development touches your obligations, we will tell you what to ask your counsel.
