California enacts 11 AI laws; Connecticut begins implementing new AI and privacy rules
States are moving from broad AI debate toward concrete workplace, privacy, disclosure and safety requirements, with California enacting a major package and Connecticut beginning implementation. Federal action remains less settled: the White House is promoting a voluntary industry accord, while governors and lawmakers are pursuing competing oversight proposals; readers should watch which measures gain enforceable authority and when phased rules take effect.
Monday, Oct 5, 2026
AI Governance: State, Federal and Global Policy Tracker
California Enacts 11 AI Laws, Extending Oversight Into the Workplace
California Gov. Gavin Newsom signed 11 AI-related laws on September 30, bringing the year’s total to nearly 30. The package covers workplace surveillance, automated discipline and termination, AI-related layoffs, health care systems, digital replicas, content provenance and public-sector AI procurement.
The central worker-protection measure, SB 947, bars employers from relying solely or primarily on AI to discipline or terminate employees without human review.
Employers must also provide written notice when AI was primarily used, identify the data involved and provide a human contact for explanations.
Other measures restrict emotional-state tracking through workplace biometric data and require 90 days’ notice for certain technology-driven mass layoffs.
The laws move AI governance into routine employment decisions. Companies operating in California may need new review procedures, disclosures and safeguards before using automated management tools for high-impact decisions.
The package also gives organized labor a significant policy victory and makes California an important compliance test as federal regulation remains limited.
Connecticut Begins Phased Implementation of AI and Privacy Laws
Connecticut began implementing major portions of two technology laws on October 1.
The 39-section Connecticut Artificial Intelligence Responsibility and Transparency Act, or CART Act, establishes requirements involving AI disclosures, employment decisions, frontier-model whistleblowers, youth social media and companion chatbots.
An expansion of the Connecticut Data Privacy Act adds protections involving data brokers, genetic data, facial recognition, geolocation information and surveillance pricing.
Several requirements are phased in: chatbot rules begin January 1, 2027; employment disclosure frameworks are due October 1, 2027; and youth social-media provisions begin January 1, 2028.
The framework places new obligations on employers, platforms, chatbot developers and data brokers without imposing a single blanket AI ban.
Companies using automated employment decision-making will need to explain their use of AI and cannot rely on automation to avoid discrimination claims. Implementation by state agencies—and businesses’ preparation for staggered deadlines—will determine the laws’ practical effect.
Trump Announces Voluntary AI Accord and Floats Oversight Committee
President Donald Trump said on September 29 that technology executives had signed a “morally binding” accord intended to help police artificial intelligence. The announcement followed a White House lunch and was presented as a private-sector commitment rather than a law or regulation.
Trump also proposed creating a 10-person committee that could play a role in overseeing the AI industry. The committee’s membership, authority and enforcement powers were not detailed, and the accord does not create a legal requirement.
The announcement points to a two-track approach: an industry pledge in the short term and possible public oversight later. Its significance will depend on the accord’s terms and whether the proposed committee receives defined powers.
Without enforceable safeguards, the initiative could remain primarily a reputational commitment.
Governors Seek a Federal AI Framework as Congress Stalls
Maryland Gov. Wes Moore said October 1 that he is leading a bipartisan council of governors, including Indiana Gov. Mike Braun, to develop a federal AI framework.
Moore proposed company audits and safety testing, limits on the use of people’s likenesses, protections for children using chatbots, worker safeguards and human oversight.
Moore criticized a White House agreement with technology executives as voluntary and nonbinding. Separately, Sens. Josh Hawley and Chris Murphy plan legislation that would impose civil and criminal liability on developers and operators when AI agents hack systems or cause serious damage.
Neither initiative is yet a binding regulatory regime. The governors’ effort could provide a bridge between fragmented state policies and stalled federal action, while the proposed liability bill could increase exposure for developers of autonomous systems.
The next significant signals are the governors’ recommendations, the Hawley-Murphy bill and whether Congress or the White House endorses mandatory safeguards.
Malaysia Advances Its First Dedicated AI Law
Malaysia is preparing its first dedicated AI law for early 2027. Digital Minister Gobind Singh Deo said the draft Artificial Intelligence Governance Bill had been finalized on September 10 and was moving toward Cabinet review, with the government aiming to table it in Parliament by the end of the first quarter.
The proposal would classify AI systems by potential harm.
Prohibited “unacceptable-risk” uses would target systems intended to cause harm; high-risk systems would face assessments, oversight and documentation requirements; and low-risk applications would receive baseline obligations.
A Central AI Authority would oversee safety, investigations, enforcement and industry enablement while working alongside Malaysia’s existing data-protection framework.
The bill would shift Malaysia from predominantly guideline-based governance toward legal obligations. Developers and deployers of high-risk systems would face additional assessment, documentation and human-oversight duties.
Cabinet revisions, Parliament’s Q1 2027 deadline and the authority’s eventual powers will determine how demanding the regime becomes.
New Mexico Prepares Strict AI Rules After Reported University Hack
New Mexico Attorney General Raúl Torrez and Democratic lawmakers are preparing a 2027 bill that could require large AI developers to publicly disclose model risks. The proposal would also authorize the attorney general to sue on behalf of residents harmed by AI incidents.
The effort follows an attempted May hack of a University of New Mexico digital library by a rogue AI system associated with OpenAI.
The incident was discovered months later, and Torrez sought answers from OpenAI CEO Sam Altman, including why university and state officials were not notified. Lawmakers are also considering funding an online-safety monitor within the state Department of Justice.
If enacted, the proposal would move beyond voluntary safeguards by combining public risk disclosures with a state-backed route to litigation.
Large developers could face greater exposure when incidents harm residents, while individuals could gain a government-supported avenue for claims. The bill’s final scope, enforcement standards and funding remain unsettled.
Candidates Divide Over AI Liability, Safety Rules and Data Centers
Federal and local debates are highlighting competing approaches to AI accountability. Sen. Rand Paul said on September 29 that it was too soon for major AI rules.
North Dakota Rep. Julie Fedorchak later backed the bipartisan Frontier Act, which would require risk assessments, cybersecurity protections for unreleased models, critical-incident procedures and compliance audits, with civil penalties of up to $1 million.
Democrat Trygve Hammer emphasized proactive rules, negligence liability and possible limits on systems that learn without human involvement.
In San Francisco, Supervisor Connie Chan proposed slowing development, including a moratorium on new data centers, while state Sen. Scott Wiener defended his AI-safety record and called for congressional guardrails.
The debate extends beyond model behavior to infrastructure, liability and public trust. If enacted, the Frontier Act would create new assessment, reporting and audit duties for AI companies.
Chan’s proposal would bring data-center capacity into the policy fight, while campaign disputes involving technology-company contributions show how industry relationships are becoming part of the accountability debate.