AI Regulation Weekly Brief- Week ending 15 August 2026

Six developments this week move from the EU's enforcement machinery going live in practice, to a first-of-its-kind US chatbot law protecting minors, to two Asian jurisdictions tackling deepfakes through entirely different legal routes, to Australia and New Zealand each taking their own next step on AI oversight.

1. EU AI Act Enforcement Channels Go Live Two weeks after enforcement began, the practical machinery is now visible. The European Commission has opened three separate reporting routes: a general complaints tool for anyone who believes an AI system breaches the Act, an anonymous whistleblower channel, and a narrower route for downstream providers using general-purpose AI models built by someone else. Penalties for transparency breaches remain capped at €15 million or 3% of global turnover. Separately, the Commission's 31 July announcement named more than 180 organisations to the first signatory list under the GPAI Code of Practice — the voluntary instrument providers can rely on to demonstrate compliance. The Digital Omnibus that deferred high-risk obligations to December 2027 was itself formally adopted as Regulation 2026/1744 on 27 July, closing the loop on a change agreed in principle back in May.

Source: European Commission, Shaping Europe's Digital Future; industry reporting, 31 July–10 August 2026

2. Colorado Becomes First US State to Regulate Chatbots for Minor Safety Governor Jared Polis signed the Chatbot Safety Act (H.B. 26-1263) on 1 July, making Colorado the first state to legislate specifically against chatbot-driven psychological and safety harms to minors, with baseline protections for all users and additional safeguards for under-18s. The Act takes effect 1 January 2027 and sits alongside — not instead of — Colorado's separate SB 26-189, which replaced the state's broader algorithmic-discrimination framework earlier this year. The two laws reflect a broader pattern: states are increasingly regulating AI by discrete harm (chatbots, deepfakes) rather than attempting comprehensive frontier-model statutes. A mid-year tracking report counts 85 AI-related laws now passed across 27 states in 2026, with 78 separate chatbot bills still active.

Source: Mintz, "AI: The Washington Report," August 2026; Transparency Coalition AI legislative update, 14 August 2026

3. Philippines Brings Deepfakes Under Privacy Law The Philippines has classified photorealistic synthetic media as biometric data, a legal manoeuvre that pulls non-consensual AI-generated depictions of real people squarely inside existing privacy law rather than requiring a dedicated deepfake statute. It is a notably different theory from most jurisdictions' approach of legislating deepfakes as their own category, and one that lets enforcement begin immediately under infrastructure regulators already operate.

Source: Ctrl+AI+Reg, 12 August 2026

4. South Korea Bans AI Clones of Faces and Voices — Through Competition Law Where the Philippines reached for privacy law, South Korea has gone commercial: amendments to its competition law now prohibit unauthorised AI-generated digital clones of a person's face or voice, framing the harm as unfair competition rather than a privacy violation. The contrast between the two approaches, arriving in the same week, is a useful reminder that "deepfake regulation" is not one policy area but several, depending on which existing legal doctrine a jurisdiction chooses to extend.

Source: Ctrl+AI+Reg, 12 August 2026

5. Australia's AI Standards Reach National Cabinet The Australian Standards for AI, announced by Prime Minister Albanese on 15 July, go before National Cabinet this month for agreement among state and territory leaders, with legislation still expected in early 2027. In parallel, Australia's privacy regulator, the OAIC, has opened its first-ever compliance sweep focused specifically on AI systems — separate from the standards process, and a signal that existing privacy law is already being actively enforced against AI use while the dedicated framework is still being designed.

Source: SafeAI-Aus; Tech News Australia, August 2026

6. New Zealand's Privacy Regulator Publishes a Biometrics Code New Zealand's Office of the Privacy Commissioner has published a Biometrics Code of Practice, regulating the collection and use of biometric information under the existing Privacy Act 2020 rather than new AI-specific legislation — consistent with New Zealand's stated "light touch, proportionate" approach. For any AI system using facial recognition or voice biometrics, this is the operative rulebook in the absence of a standalone AI statute.

Source: Simpson Grierson, "Regulating AI in New Zealand and abroad," August 2026

This newsletter is published by the World AI Regulation Summit, the premier forum for sharing best practices across jurisdictions. The annual meeting will be held in London on 5-6 November 2026. Visit https://worldairegulation.org/