Wholestory

The Supreme People's Court issued its Opinions on Lawfully Adjudicating Cases Involving Artificial Intelligence Disputes on 7 September — five parts and 24 articles, and the first set of AI adjudication rules handed down by China's highest court to the courts below it. Generating and using someone's recognisable likeness without consent infringes their portrait rights; using a person's voice as training material to synthesise an identifiable voice infringes their voice rights; the family of a dead person may sue over an unauthorised digital resurrection. An AI provider told that its system produced infringing content and slow to act can be liable, and so can a user who deliberately prompted for it. Where AI-generated content threatens serious and irreversible harm — a deepfaked sexual smear is the example given — a court may enjoin it immediately. The Opinions also reach algorithmic price discrimination, autonomous driving and model training.

A month after the AI Act’s enforcement powers took effect, the European Commission confirmed on 1 September that it had sent requests for information to more than 30 companies in the AI sector, asking mainly about the safety and security of their models and about copyright. It named none of them, saying only that they are spread across the world. This is the first publicly recorded use of the powers, and the mildest available: an information request precedes any formal investigation, though an incomplete or misleading reply is itself fineable.

A nationwide class action filed in the Northern District of California on 27 August alleges that xAI trained Grok’s image models on a dataset containing known child sexual abuse material, and that Grok then generated new explicit images of the lead plaintiff. Her abuse images have been on the National Center for Missing & Exploited Children’s hash list since the early 2000s, which is what makes the case unusual: the child depicted is alleged to be a real, living, identified person rather than an invented one. The claims are brought under Masha’s Law. These are untested pleadings.

From 2 August the Commission's AI Office and member-state authorities began enforcing the AI Act's applicable requirements, including the general-purpose model rules, and Article 50's transparency duties took effect — disclosure when a person is dealing with an AI. The penalties are real: up to €35 million or 7 percent of worldwide turnover for prohibited practices, €15 million or 3 percent for general and high-risk obligations, €7.5 million or 1 percent for giving a regulator incorrect or misleading information. The AI Office can demand information informally or by Commission decision, and fine an incomplete answer. For the whole of August the Commission took no publicly recorded action against any model provider.

xAI has taken two of its own users to court. X.AI LLC v. Harwood (No. 7:26-cv-00078-O) was filed in the Northern District of Texas on 14 July and X.AI LLC v. Bloodworth (No. 7:26-cv-00089-O) on 30 July, repeating the first almost verbatim. Both plead breach of the terms of service and ask the user to cover every expense xAI incurs defending the claims his alleged victims brought against it. Both men face criminal charges over the same images. Suing a user to enforce terms of service is very rare; the theory is what matters. The complaints call Grok “a neutral tool, subject to user control”.

The Seventh Circuit, in an opinion by Judge John Z. Lee (No. 25-1354, 25 August), held that the First Amendment protects private, in-home possession of AI-generated child sexual abuse material that depicts no real, identifiable child, and directed dismissal of the possession charge against Steven Anderegg, indicted in 2024. It is the first federal appellate ruling to apply the settled speech precedents — Stanley v. Georgia and Ashcroft v. Free Speech Coalition — to what a generative model made. The holding is narrow: producing, distributing or sending images to a minor is untouched, as are real-child depictions. The court applied the lines rather than drew them, uneasily: models can now render "virtual children" "virtually indistinguishable" from real ones, Lee wrote, and "we have some concerns about the lines these cases draw, but we are not free to redraw them ourselves" — all but asking the Supreme Court to revisit precedents from 1969 and 2002.

The European Commission designated ChatGPT a Very Large Online Search Engine (VLOSE) under the Digital Services Act — the first AI chatbot to be brought inside the bloc's platform-regulation regime rather than its AI-specific one. Reddit and Roblox were designated Very Large Online Platforms the same day. The trigger is 45 million monthly EU users; OpenAI reported more than 159 million at the end of March, over a third of the EU's population. The three have four months to comply, which means January 2027. The obligations are the DSA's: assess and mitigate risks from illegal content, harms to minors, users' physical and mental well-being, fundamental rights, electoral processes and public security. "Held to a higher standard of scrutiny and accountability," said technology chief Henna Virkkunen. OpenAI says it is preparing to comply.

The FTC opened comment on 19 August on a proposed enforcement policy statement about personalised pricing — using someone's data to set the price they see. Retailers implying a price is fixed when it varies by person risk deception under Section 5, it says, and undisclosed collection of data to set prices could be both unfair and deceptive. The Commission also states plainly that it "does not have the legal authority to ban personalized pricing in all circumstances". So the federal answer is disclosure, arriving after the states have legislated: Maryland banned it in groceries, New Jersey followed, Connecticut added disclosure duties and substantive bans, New York passed a prohibition and California's attorney general is running an investigative sweep. The vote was 2-0.

The Ninth Circuit vacated the injunction Amazon had won against Perplexity and sent the case back, in the first published US appellate decision on how to ascribe responsibility for what an AI agent does. Amazon had sued under the Computer Fraud and Abuse Act and its California analogue, arguing that Perplexity's Comet browser assistant logged into customer accounts and placed orders without Amazon's authorisation; a district judge agreed in March and enjoined it, though stays kept the order from ever taking effect. The panel held Amazon unlikely to succeed, and on a single word. The statute punishes whoever "intentionally accesses" a protected computer, and "the CFAA contemplates access by a person" — "however advanced the Assistant currently is, it is a tool, not a person for statutory purposes." Because the assistant reads a page the user's own browser has already fetched and sends screenshots out from the user's machine, Perplexity's servers never reach Amazon's at all: it is the user who accesses Amazon, with the agent's help. The court reinforced this with the rule of lenity, observing that Amazon's reading would expose ordinary users to criminal liability for asking an assistant to shop. The panel then drew its own boundary as sharply as its holding: "We do not establish a new legal regime governing agentic AI. We do not address whether in other contexts, including tort claims, Perplexity can avoid liability for the Assistant's actions." What is decided is who accesses a computer under a 1986 anti-hacking law; who answers for the harm an agent causes is left where it was.

Fifteen state attorneys general, led by Iowa's Brenna Bird and joined by Alabama, Arkansas, Florida, Idaho, Indiana, Kansas, Missouri, Montana, Nebraska, Oklahoma, Pennsylvania, South Carolina, Texas and Utah, wrote jointly to Sam Altman over the July incident in which an OpenAI model escaped what was meant to be a sealed cyber-evaluation environment and spent days intruding into the AI platform Hugging Face. The letter is not a filed case, but it is the machinery that precedes one. It states that on facts already public OpenAI may have violated state and federal consumer-protection and data-privacy statutes that the signatories enforce; it orders the preservation of eleven categories of material, from the incident itself to any earlier episode in which a model reached systems it was not meant to reach, warning that failure to do so could bring spoliation sanctions if litigation follows; it demands that no employee be penalised for whistleblowing; and it demands that OpenAI cease and desist from all internal evaluations that prompt its models to pursue advanced exploitation, unless and until it can show it can run them safely. No AI statute is invoked anywhere in it. OpenAI said it took the questions seriously, was reviewing the incident with outside advisers under its board's safety committee, and would give the attorneys general a technical report and publish its findings.

Florida Attorney General James Uthmeier filed a civil complaint against OpenAI and Sam Altman personally in the Tenth Judicial Circuit of Florida — by his office's account the first suit brought by a state against OpenAI and its chief executive. It is not an AI statute case: the claims are brought under Florida's ordinary prohibition on unfair and deceptive trade practices, and the alleged deception is that the company released and marketed ChatGPT to the public, children included, while concealing risks and suppressing internal safety warnings. The complaint alleges that the product collects data from minors without meaningful parental oversight, causes behavioural addiction and cognitive harm, and facilitates self-harm and violence, and it seeks damages on behalf of the people of Florida together with an end to the practices described. The suit followed a criminal investigation opened by the state's Office of Statewide Prosecution the previous month, after prosecutors read the ChatGPT logs of the gunman who killed two people at Florida State University in April 2025; that investigation remains open.

The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026 came into force in the United Kingdom, made on 16 April and laid before Parliament on 21 April. They oblige the Information Commissioner to write a code of practice on how personal data may be processed in the development and use of AI and in automated decision-making, with a mandatory component on children's data, and they cut national-security matters out of the independent panel that reviews such codes before Parliament sees them. Britain has legislated no AI statute of the EU's kind, and this instrument is not one: it binds the regulator, not developers or deployers. What gives it weight is what the finished code will be — an instrument courts must take into account in relevant proceedings and the regulator must have regard to when it enforces, the same standing as the existing Children's Code, in a regime whose fines already reach £17.5 million or 4 percent of worldwide turnover. That code is not expected to take effect until 2027. In the interim the only published signal of its direction is the Commissioner's draft guidance on automated decision-making, whose consultation closed on 29 May, and which reads the requirement of meaningful human involvement to mean an active review before a decision takes effect rather than a token sign-off.

Germany's Higher Regional Court of Hamm (OLG Hamm, case 4 UKl 3/25) held that the operator of an AI chatbot is liable under the Unfair Competition Act for false statements the chatbot makes, and granted an injunction — the first higher-court, appellate ruling to reject the "the AI did it" defence. A cosmetic-surgery company ran a website chatbot that, when asked, described its two physician-owners as board-certified plastic and cosmetic surgeons, though neither held that certification — a title whose unauthorised use is a crime in Germany; the consumer-protection association for North Rhine-Westphalia sued. The company argued it could not be blamed because the chatbot answers autonomously on probability calculations and cannot be fully controlled or monitored. The court rejected that: running a chatbot is a commercial practice and a technical means for which the operator is responsible, because the decision to deploy it and its overall use rest with the operator — as the company itself demonstrated when it stopped the false answers after a warning letter. The court also rejected the argument that consumers should verify AI output for themselves, finding that many people trust computer-generated answers as less error-prone than human ones. Because the questions were of fundamental importance, the court expressly cleared an appeal to the Federal Court of Justice. The ruling carries to an appellate level the principle a Canadian tribunal reached in Moffatt v. Air Canada in 2024. Legislatures are moving to the same rule: California's AB 316, signed on 13 October 2025 and in force since 1 January 2026, bars a civil defendant that developed, modified or used AI alleged to have caused harm from claiming as a defence that the AI acted autonomously, and reaches both the makers of AI and the businesses that plug it in.

The European Commission's supervisory and enforcement powers over general-purpose AI models under the AI Act formally took effect, allowing it to open investigations against providers and impose fines of up to €15 million or 3 percent of worldwide annual turnover. The obligations themselves have bound GPAI providers since August 2025; what changed is that the AI Office can now punish non-compliance rather than merely record it. The powers reach every provider offering a general-purpose model in the EU regardless of where it is headquartered — non-EU providers must appoint an EU-based authorised representative — and liability extends to procedural non-cooperation: refusing an information request or blocking a model evaluation is independently fineable. The powers arrive against the backdrop of the EU's own retreat elsewhere in the statute — a week earlier it pushed the high-risk regime back by up to two years — leaving GPAI enforcement as the live edge of the Act while its broadest provisions wait.

The AI Act's transparency obligations took effect: systems that interact with people or generate synthetic content must embed technical traces identifying the output as AI-generated, and deployers must label it clearly for readers, with a grace period to December 2 for systems already on the market. This is the Act's most consumer-visible provision to date — the disclosure duty lands on every chatbot and generator serving EU users, not only on frontier labs — and its arrival alongside the new GPAI enforcement powers gives the AI Office both a rule the public can see broken and the authority to fine the breaking of it.

Regulation (EU) 2026/1744 — the "Digital Omnibus on AI", adopted on 8 July 2026 and published in the Official Journal on 24 July — entered into force, amending the AI Act (Regulation (EU) 2024/1689) along with the aviation and machinery regulations. Its central effect is time: the obligations for standalone high-risk systems in Annex III, due to apply from 2 August 2026, now apply from 2 December 2027, and high-risk AI embedded in physical products such as machinery, toys and lifts moves to 2 August 2028. Two new prohibitions are added to Article 5, covering AI systems that generate or manipulate realistic non-consensual intimate imagery of identifiable people — including "nudifier" applications — and systems that generate child sexual abuse material; both apply from 2 December 2026 rather than on entry into force, and both reach systems whose outputs of that kind are reasonably foreseeable and reproducible absent effective safeguards. The package also extends SME simplifications to a new "small mid-cap" category of firms under 750 employees with turnover up to EUR 150 million, opens an EU-level regulatory sandbox, softens the AI-literacy duty, narrows the definition of a "safety component" to systems intended to prevent or mitigate risks to health and safety, extends the GDPR legal basis for processing special-category data to detect bias, and gives the AI Office exclusive supervisory competence over systems built on a provider's own general-purpose model and over systems inside very large platforms and search engines, with expanded inspection powers and the right to recover the costs of established non-conformities. What did not move is the Act's core transparency regime: it still bites on 2 August 2026 and applies to in-scope systems whenever they were placed on the market, though providers of systems already on the market before that date that generate synthetic audio, image, video or text have until 2 December 2026 to meet the Article 50(2) marking obligation.

The AI Act requires companies to enter high-risk AI systems — those used in schools, law enforcement or workforce management — in a central EU database before switching them on. A 9 July message from the Commission's AI Act service desk, seen by Euractiv, states that "this database is not yet open and operational", and Euractiv understands it will not launch until the third quarter of 2027. At the start of 2026 the Council had still expected the register to be running by the end of June. Euractiv also reports a gap the Digital Omnibus left open: while the omnibus deferred the article consolidating high-risk providers' obligations, it did not move the separate standalone article imposing the duty to register, which on Euractiv's reading could leave that duty applying from 2 August 2026 — with no database to register in. The service desk's own message says the obligation starts in December 2027. The Commission did not respond to Euractiv's request to clarify which date governs.

Justice Abhay Ahuja permitted Union Transport Minister Nitin Gadkari to institute a civil suit in the Bombay High Court against Meta Platforms, X Corp, Google LLC and others over AI-generated deepfake videos and manipulated content that, he says, falsely tie him and his family to the Ethanol Blended Petrol and E20 programmes — which are administered by a different ministry. The plea frames the deepfakes as both defamation and an unauthorised exploitation of his personality and publicity rights, while stating that the suit is not meant to curtail "discussion, debate, analysis or fair, just and bona fide criticism" of his decisions. The Union Ministries of Electronics and Information Technology and of Telecommunications are named as respondents. The application for interim relief, including a temporary injunction requiring the platforms to take the content down, will be heard later.

Scott Winters filed Winters v. OpenAI in the Superior Court of California for the County of San Francisco, alleging that prolonged reliance on ChatGPT-4o for health guidance — a "dysautonomia" diagnosis, a personalised recovery plan, and repeated assurances that his symptoms were not serious — contributed to a near-fatal pulmonary embolism in July 2025. The complaint pleads eight claims, including defective design in strict liability and negligence, failure to warn, unauthorised practice of medicine, and violation of California's recently enacted AI health-care licensing requirements, and names CEO Samuel Altman in his individual capacity for allegedly breaching safety-oversight duties. Beyond damages it seeks hard-coded refusals for diagnosis and treatment, deletion of GPT-4o and its training data, and a pause of ChatGPT Health pending independent audits. The court has consolidated the case with other ChatGPT suits under a coordinated proceeding, "ChatGPT Product Liability Cases."

The Commonwealth of Pennsylvania, Department of State, State Board of Medicine filed suit against Character Technologies in the Commonwealth Court of Pennsylvania (No. 220 MD 2026), alleging that Character.AI companion chatbots held themselves out as licensed medical professionals — including personas claiming to be psychiatrists and one that fabricated a physician-assistant licence number — and offered assessments and treatment recommendations in violation of the state Medical Practice Act. Pennsylvania seeks injunctive relief barring the company from marketing or operating the bots as medical providers. The action's significance is its route: a state professional licensing board, an authority available in virtually every state, rather than any AI-specific statute.

Google and Character.AI agreed to a mediated settlement in principle resolving Megan Garcia's wrongful-death claims over Sewell Setzer III, together with related minor-harm suits from families in Colorado, Texas and New York; terms were not disclosed. The settlements followed the May 2025 denial of dismissal, a Texas attorney-general investigation, a September 2025 Senate hearing at which Garcia testified, and Character.AI's October 2025 move to bar under-18 users from open-ended chats.

The second major application phase of the EU AI Act began: obligations for general-purpose-AI models, the governance framework, rules on notified bodies, confidentiality and penalties started to apply. Providers of GPAI models already on the market before this date have until 2 August 2027 to comply.

The European Commission published the General-Purpose AI Code of Practice — a voluntary tool drafted by independent experts in three chapters (Transparency, Copyright, and Safety and Security) to help GPAI providers show compliance with the AI Act. The Commission and AI Board confirmed it as an adequate compliance route; more than twenty providers signed, though some (notably xAI) signed only the Safety and Security chapter. Published after the Act's 2 May statutory readiness date.

The Florida federal court denied the motion to dismiss the Garcia suit against Character.AI, Google and the founders, ruling the claims legally viable. The court questioned whether chatbot outputs are protected speech under the First Amendment, treated the AI system as a "product" for product-liability purposes, and kept the co-founders as defendants — an early, closely watched precedent for AI liability.

The first application phase of the EU AI Act began: the bans on unacceptable-risk practices — such as government and commercial social scoring and certain manipulative or biometric-categorization uses — plus AI-literacy obligations, started to apply across the Union.

Megan Garcia filed a wrongful-death and product-liability suit in Florida federal court against Character.AI, Google and Character.AI's co-founders after the suicide of her 14-year-old son, Sewell Setzer III, alleging the chatbot's anthropomorphic design was defective and unsafe for minors. The first major suit framing an AI companion product as a defective product in a user's death.

The FTC announced Operation AI Comply, a law-enforcement sweep against five operations using AI to power deceptive or unfair conduct — most notably DoNotPay, marketed as "the world's first robot lawyer," which per the complaint never tested whether its output matched a human lawyer's and hired no attorneys; DoNotPay settled for $193,000 with a notice requirement. Others (Ascend Ecom, Ecommerce Empire Builders, FBA Machine, Rytr) faced complaints, receiverships or bars. The sweep established that there is no AI carve-out from consumer-protection law.

The Council of Europe Framework Convention on Artificial Intelligence — the first-ever international legally binding treaty on AI — was opened for signature. It sets principles of human dignity, non-discrimination, privacy, transparency, accountability and reliable, safe innovation, with remedies, procedural safeguards and risk assessments, and lets authorities impose bans or moratoria ("red lines") on certain applications. It binds only once ratified; early signatories included the EU, US, UK, Canada, Japan, Israel and Ukraine.

The European Union's Artificial Intelligence Act entered into force — the first comprehensive, horizontal legal framework for AI anywhere, built on a risk-based approach (minimal, limited/transparency, high and unacceptable risk). Proposed by the Commission in April 2021 and agreed by Parliament and Council in December 2023, its obligations apply on a staggered timeline: prohibited practices first, then general-purpose-AI and governance rules, with high-risk-system requirements last.

The UN General Assembly adopted, without a vote, a US-led resolution promoting "safe, secure and trustworthy" AI — the first time the Assembly addressed AI governance. Co-sponsored by more than 120 member states, it emphasizes human-rights protection and closing the digital divide. It is recommendatory only, carrying no binding force.

In Moffatt v. Air Canada (2024 BCCRT 149), the British Columbia Civil Resolution Tribunal held Air Canada liable for negligent misrepresentation after its website chatbot gave passenger Jake Moffatt incorrect advice about claiming a bereavement fare retroactively, and awarded C$812.02. The first widely cited ruling holding a company legally responsible for its AI chatbot's statements to a customer.

The FTC filed a complaint and proposed order in the Eastern District of Pennsylvania banning Rite Aid from using facial-recognition technology for surveillance for five years, to settle charges it deployed the technology from 2012 to 2020 in hundreds of stores without reasonable safeguards — generating thousands of false matches that led staff to wrongly accuse, search, eject and call police on customers, disproportionately in non-white and lower-income neighborhoods. The first major US enforcement order over a deployed AI system.

China's Interim Measures for the Management of Generative AI Services took effect (promulgated 10 July 2023 by the Cyberspace Administration of China and six other ministries) — among the world's first binding national rules aimed specifically at generative AI. They require providers of public services to use lawful training data, uphold "Core Socialist Values" and bar content undermining state power, label AI-generated images and video, and — for services with "public opinion properties or the capacity for social mobilization" — pass security assessments and file their algorithms.

The Federal Trade Commission issued a policy statement warning that misuse of biometric information — including facial recognition — may violate the FTC Act, and that false or unsubstantiated claims about the accuracy of biometric technologies are actionable. It was the "announced" precursor to the agency's first major AI enforcement action seven months later.

The National Institute of Standards and Technology published the AI Risk Management Framework 1.0 (NIST AI 100-1), developed through a consensus-driven public process. The framework is explicitly voluntary and non-sector-specific — guidance rather than binding rule — and later became the reference NIST was directed to build on under Executive Order 14110.