New York proposes AI safety audits; Saudi Arabia weighs local storage; 86 US state AI laws enacted
AI governance is moving toward recurring reporting, independent audits, incident disclosure, traceability and enforcement, while Saudi Arabia’s proposal could add a broad local-storage obligation. The key distinction is status: many of the newest measures remain proposals or consultations, whereas the state-law count records enacted rules, making enactment, effective dates and overlapping duties the main points to watch.
State and national rulemaking
New York lawmakers propose stronger AI safety oversight. State Sen. Andrew Gounardes and Assemblymember Jordan Wright introduced a bill on October 29 that would require large AI developers to file quarterly reports on automated research and computing use, disclose major capability or risk increases within 72 hours, and undergo annual independent safety audits. The proposal would also give New York’s DIGIT office authority to limit certain computing activity and allow the attorney general to seek court orders halting dangerous deployments.
If enacted, the bill would move beyond the RAISE Act’s safety-plan disclosures toward recurring external examinations, 90-day catastrophic-risk assessments, and possible state intervention. Its practical effect will depend on enactment and how regulators and courts use the proposed powers.
Saudi Arabia considers a broad local-storage requirement. Proposed amendments to the implementing regulation of Saudi Arabia’s Personal Data Protection Law would state that controllers “shall store Personal Data within the Kingdom,” while still permitting cross-border transfers. The consultation is open until November 5, 2026, and the amendments would take effect 60 days after publication in the Official Gazette.
The wording could require multinational businesses to reassess the location of Saudi-related production data, backups, disaster-recovery copies, cloud services, and vendor-managed systems. It also leaves unresolved how the proposed storage obligation would interact with the country’s existing transfer framework and standard contractual clauses.
States continue to expand AI and data-center legislation. USLege counted 86 enacted AI laws across 25 states from January 1 through November 1, 2026. California led with 20 laws; health care, chatbots and AI companions, and deepfakes were the largest subject areas. The tracker also identified 36 data-center laws across 18 states, including 15 addressing utility rates, tariffs, or grid connections.
The figures are a conservative floor because the tracker excludes budget measures and laws that only mention AI incidentally. Even so, the breadth of activity shows that organizations must track both rules governing AI applications and legislation addressing the infrastructure needed to run them. The count does not replace reviewing each law’s duties, enforcement provisions, and effective dates.
California lawmakers signal a broader AI-safety package. Following an October 27 oversight hearing on frontier-model risks—including situations in which companies lost control of AI agents—California lawmakers said they would pursue a “comprehensive” package when the Legislature returns. The debate builds on Senate Bill 53, which requires large AI developers to publish safety and transparency frameworks and report safety problems to the state Office of Emergency Services.
The commitment is not yet an enacted package, but it indicates that California may expand from its existing disclosure and incident-reporting framework toward additional safeguards. The next legislative session will show whether the hearing produces specific bills.
Implementation and enforcement
Norway prepares to bring the EU AI Act into national law. Norway is preparing an amended AI bill for consultation in autumn 2026, with the government aiming to present it to the Storting in spring 2027. The proposed law would incorporate the EU AI Act through the EEA Agreement, give the Norwegian Communications Authority a coordinating role, and leave sector supervision to bodies such as Finanstilsynet.
Norwegian organizations do not yet have the proposed AI Act as national law, but they remain subject to GDPR and sector-specific requirements. The planned division of responsibilities makes early regulatory mapping important, particularly where AI systems involve both data protection and financial or other regulated activities.
AI oversight is becoming more operational in Canada, India, the United States, and the EU. Shared Services Canada opened a Phase 2 prototype challenge on October 30 for tools that can trace AI outputs, expose decision processes, and keep government systems aligned with changing rules; proposals are due December 22, 2026. India’s telecom regulator, TRAI, has proposed guidelines covering risk assessments, human oversight, incident reporting, and consumer protection, with comments due November 27. The EU AI Office describes enforcement tools for general-purpose AI that include evaluations, information requests, corrective measures, and fines.
Together, these developments point to a shift from broad principles toward inventories, audit trails, reassessments, and regulator-facing documentation. The Canadian challenge is a procurement opportunity rather than a final compliance regime, and TRAI’s obligations remain unsettled pending consultation.
The EU and national authorities are opening more concrete routes to challenge AI use. The European Data Protection Supervisor can receive complaints alleging violations of the AI Act involving EU bodies. Separately, LawFold reports that Croatian courts are hearing early claims involving banks, employers, and public agencies.
The developments suggest a move from high-level governance toward disputes over real-world deployments. The Croatian case details remain source-specific until confirmed by official Croatian records, while the EDPS complaint route provides a defined mechanism for challenging AI use by EU institutions.
Deployment in professional services
A&O Shearman and Harvey are launching agentic AI tools for legal work. The firms say the first agents will handle antitrust filing analysis, cybersecurity, fund formation, and loan review through multi-step reasoning. The tools are intended for internal use and, over time, for clients and other law firms.
The rollout marks a move from general drafting assistance toward agents designed for defined, high-value workflows. Wider availability could accelerate adoption, but it also increases the importance of supervision, training, information security, and data management. Solicitors remain subject to existing professional and regulatory duties when using AI.