Act Now Brief | Monday 6 April 2026
For founders, operators, and creators who are using AI | USA · UK · EU
🇺🇸 USA | FTC enforcement velocity and the shift in its enforcement posture
Since last Monday, the FTC has clarified its AI enforcement approach. The agency is moving away from preemptive prohibition (its January stance on Rytr) and toward enforcement based on concrete consumer harm or actual deception. That means less risk if your product’s potential for misuse is hypothetical. More risk if you’re overstating what your AI does or hiding how you use user data. The FTC released its FY 2026-2030 Strategic Plan on April 3, making AI enforcement (including AI washing and data misuse) an explicit agency priority. The enforcement vehicle is Section 5 of the FTC Act: unfair or deceptive practices. OkCupid’s settlement from last week is still the precedent. Data sharing without consent is prosecutable. AI capability claims that are not substantiated are prosecutable.
So what?
If you’re building AI products: If you make performance or capability claims about your AI, they need substantiation. Run your marketing copy through the lens of “could the FTC argue this is deceptive?” If you share user data with third parties for training, explicit consent and disclosure are not optional.
If you’re using AI in your business: If you use third-party AI vendors, ask them directly: how do they handle data security and consent? If you cannot get a clear answer, assume the vendor is exposed, and you may be liable downstream.
If you’re advising AI companies: Tell clients the FTC is now enforcing. The shift from Rytr is tactical, not strategic. The agency still owns AI enforcement. Overstated claims and data misuse are live issues. Vet your marketing and data handling before the FTC comes to you.
🇪🇺 EU | August 2 remains the immovable deadline. Build for it.
No change since last Monday. The Digital Omnibus didn’t pass on March 26. The August 2, 2026 deadline for high-risk AI Act compliance stands. Four months remain. EU member states are still designating enforcement authorities (only 8 of 27 so far), but enforcement will happen when capacity arrives. The practical implication: assume the deadline holds. If your AI system qualifies as high-risk under Annex III (hiring, lending, criminal justice, education, benefits decisions), you must complete conformity assessment, technical documentation, CE marking, and national database registration by August 2. If you haven’t started, you’re months behind.
So what?
If you’re building AI products: If you ship high-risk AI into the EU, your compliance scope and vendor capacity must be locked by mid-June. Run your conformity assessment gap analysis this week. If you’re relying on a vendor to complete this work, confirm their timeline now.
If you’re using AI in your business: If you deploy high-risk AI in the EU, the vendor’s compliance is not sufficient. You must perform impact assessments, maintain risk documentation, and ensure consumer notice. Start this work now. Don’t wait for the vendor.
If you’re advising AI companies: Tell clients the August 2 deadline is real. The Digital Omnibus delay means no extension. Build a 16-week backwards timeline from August 2. You need the scope defined by mid-April, vendor capacity confirmed by May 1, and testing complete by June 15.
🇬🇧 UK | Documentation now. Enforcement later.
Still no new enforcement actions. The ICO is in the engagement phase with foundation model developers, collecting information about data handling, bias testing, and impact assessment practices. When the ICO moves to enforcement (expected later this year or in 2027), your documented practices will be the evidence of compliance or noncompliance. Have bias testing results. Have data processing records. Have impact assessments. Have risk documentation. Have transparency disclosures. If the ICO asks and you can’t produce these artifacts, you’ve moved from a compliance question to an enforcement liability.
So what?
If you’re building AI products: Document your model development, testing, bias assessment, and risk mitigation now. These artifacts shield you from enforcement. Don’t wait for the ICO to ask.
If you’re using AI in your business: If you use AI for hiring, benefits, or automated decisions, run your documentation audit this week. The ICO will ask. Be ready to show it.
If you’re advising AI companies: Tell clients the ICO enforcement is coming. The window to build your documentary evidence is closing. Do it now. After the ICO starts enforcement cases, documentation is discovery, not defense.
🇺🇸 USA | White House AI policy framework is now law (sort of). Congress is still stalled.
On March 20, the White House released its National Policy Framework for Artificial Intelligence, calling on Congress to turn it into legislation by the end of 2026. The framework proposes federal preemption of state AI laws that impose “undue burdens” on developers and general-purpose systems, while carving out child safety, fraud prevention, state procurement, and infrastructure. This is a signal. Congress has already rejected preemption multiple times (in the One Big Beautiful Bill Act and the defense bill). The framework is persuasive, not binding. What this means for you: assume state AI laws will stay. The preemption battle will play out in courts and in Congress, not on your compliance calendar. Build for California, Colorado, and Oregon. Don’t assume a federal framework will wash away state obligations.
So what?
If you’re building AI products: You’re now operating in a fragmented state legal landscape. Assume Colorado (June 30), California (2026 onwards), and Oregon (January 1, 2027) compliance requirements will remain. Build your product roadmap against the strictest rule.
If you’re using AI in your business: If your business spans multiple states, plan for different compliance requirements in each. Ask your vendors whether they’re building for state-by-state compliance or betting on federal preemption. If they’re betting on preemption, plan to rework your setup if Congress doesn’t act.
If you’re advising AI companies: Tell clients the White House framework is not a relief valve. Congress has rejected preemption before and may do so again. Advise clients that state law compliance is not optional and may be mandatory even after federal legislation passes.
🟡 Heads up
🇺🇸 USA | California AB 1883 still advancing. Three separate workplace AI regulations are now in motion.
Still no new movement since last Monday. AB 1883 (workplace surveillance and bias inference restrictions) passed committee 5-0 on March 19 and continues through the legislature. This is distinct from AB 1898 (notice and disclosure) and SB 947 (automated hiring decisions). If you build HR tech, employee monitoring, hiring tools, or worker scoring systems, California is creating three separate compliance regimes for your product. The patchwork is expanding, and these bills create private rights of action (class action risk). Plan for all three to pass. Don’t rely on any single veto or legislative failure.
So what?
If you’re building AI products: If you build HR, hiring, or employee monitoring AI, assume all three California bills will pass. Audit your product against notice requirements (AB 1898), automated hiring restrictions (SB 947), and bias/surveillance prohibitions (AB 1883).
If you’re using AI in your business: If you use AI for hiring or performance management in California, your vendors may face new legal restrictions. Start asking vendors what they’re doing to comply with these three bills.
If you’re advising AI companies: Tell clients California is moving toward comprehensive regulation of workplace AI. Build for all three bills. Class action exposure is real if you miss any of them.
🇺🇸 USA | Colorado AI Act enforcement is three months away. High-risk systems in employment, housing, credit, and healthcare must comply by June 30, 2026.
Still on track. No change since last Monday. The Colorado AI Act will enforce on June 30, 2026. Developers must exercise reasonable care, provide technical documentation, and publish statements. Deployers must adopt risk policies, run impact assessments, and issue consumer notices. Violations are consumer protection violations (up to $20,000 per violation, depending on impact). If you operate in Colorado or serve Colorado customers with high-risk AI, your June 30 deadline is in 12 weeks.
So what?
If you’re building AI products: If your system is high-risk under the Colorado Act, confirm your technical documentation and public statement by May 15. You need a full month before June 30 to fix any gaps.
If you’re using AI in your business: If you deploy high-risk AI in Colorado, your impact assessments and consumer notices must be in place by June 30. Start the audit now.
If you’re advising AI companies: Tell clients Colorado is the first nationwide enforcement. Get compliant by June 30. After that date, noncompliance exposes you to state AG enforcement and class action risk.
🟢 On the radar
FTC’s AI washing enforcement is accelerating: The agency brought a dozen AI washing cases in 2025, targeting overstated capability claims. Expect more enforcement in 2026. If your marketing says your AI does something, have the data to prove it.
State deepfake laws are multiplying: 46 states now have deepfake legislation (as of early 2026). Montana and South Dakota require election deepfake disclosures. Expect broader coverage to include platform liability and payment processor requirements as lawmakers broaden their approach beyond creators.
California’s AI youth mental health bill (SB 1181) had a hearing April 6: Bill is moving through the legislature. Will likely regulate AI systems designed to influence youth engagement or mental health. Watch for impact on consumer AI and social platforms.
EU AI Office code of practice on transparency is in development: Expect final publication before August 2, 2026. Will provide guidance on transparency, labeling, and disclosure for general-purpose AI systems and foundation models.
White House DOJ task force is still litigating state AI laws on constitutional grounds: This will take years. Build for state compliance now. Don’t assume federal preemption arguments will succeed in court.
The one thing to do this week
Audit your marketing copy and data handling against the FTC’s Section 5 enforcement standard. For each AI capability claim you make, ask: Do I have substantiation data? For each dataset or user data point you touch, ask: Is there explicit consent and full disclosure of how the data is used and who it’s shared with? If you can’t answer yes to either question, fix it this week before the FTC comes to you.
Deadline tracker
🇪🇺 EU | High-risk AI systems must comply with EU AI Act (conformity assessment, CE marking, national registration) | August 2, 2026 | Four months away. No extension. Assume the deadline holds.
🇺🇸 USA | Colorado AI Act enforcement begins (reasonable care, documentation, consumer notice) | June 30, 2026 | Three months away. High-risk systems in employment, housing, credit, and health.
🇺🇸 USA | Oregon SB 1546 and Washington HB 2225 take effect (AI companion chatbots, disclosure requirements) | January 1, 2027 | Nine months away. Oregon has private right of action ($1,000 per violation).
🇺🇸 USA | California AB 1883 (workplace surveillance and bias inference restrictions) | TBD 2026 | Passed committee 5-0 March 19. High likelihood of passage.
🇺🇸 USA | California AB 1898 and SB 947 (AI hiring and employment notice/disclosure requirements) | TBD 2026 | Both advancing through legislature. Private right of action in both.
🇬🇧 UK | ICO finishes engagement with 11 foundation model developers | TBD 2026 | Findings will inform enforcement priorities. Expect enforcement cases to follow later in 2026 or 2027.
🇬🇧 UK | UK AI Bill introduced (expected after May King’s Speech) | TBD 2026 | Awaiting legislative timetable. Will provide a statutory foundation for AI regulation.
Sources:
AI Enforcement Accelerates as Federal Policy Stalls and States Step In
FTC Brings Dozen AI-Washing Enforcement Cases in 2025, Targeting Overstated AI Claims
The White House National Policy Framework for Artificial Intelligence
White House Legislative Recommendations on AI Preemption of State Laws
AI News Digest: The AI Hiring Compliance Deadline Just Got Complicated
IAPP Global Summit 2026: FTC Commissioner Meador on Enforcement Approach