AI rules are arriving from every direction at once

The bank examiner's version

The OCC published Bulletin 2026-54 on November 4, 2026, and the bulletin provides a framework for examiners to assess GenAI and autonomous agentic systems in production. The OCC's previous guidance, SR 26-2, did not cover generative and agentic AI, so this is the first time bank examiners have a written method for judging the systems banks are actually deploying. The framework applies to all OCC-supervised institutions, including national banks, federal savings associations and federal branches of foreign banks, and no asset threshold applies. That last point is the one small banks should not miss: the rules do not start at some size cutoff. A community bank running an agent to draft customer letters is in scope in the same way a money-centre bank is. m:…9385

The framework's logic is about consequences, not capability. Examiners evaluate each use case against seven operational criteria: decision consequence, autonomy level, reversibility, customer and financial impact, data sensitivity, explainability and provenance. The framework categorizes AI use cases into four risk tiers based on real-world consequences, and control intensity must match the potential consequences of an agent's actions rather than its technical complexity. An agent's delegated authority and human oversight quality are more important than model size or architectural sophistication, the bulletin says, and banks should define a scoring method that weights consequence, reversibility and autonomy above model sophistication. Strong backtesting results or benchmark scores alone do not justify a lower risk classification. That sentence is the sharpest in the bulletin, because it tells banks that a good benchmark score is not a compliance defence. The OCC advises against treating super intelligence as a separate and distinct risk category, which reads as a warning against letting futuristic labels distract from the systems already in production. m:…9385

The hiring-law version

While bank examiners were writing about consequences, state legislatures were writing about hiring. Colorado SB 26-189 applies to employment decisions made on or after January 1, 2027. Colorado employers must provide a plain-language explanation of AI's role in an adverse decision within 30 days, and the law allows individuals to request data correction and human review of AI-influenced decisions. Colorado SB 26-189 requires employers to keep compliance records for at least three years. The three obligations together describe a system, not a form: explain the decision, let the person challenge it, and keep the record that proves you did both. A company that cannot explain an AI hiring decision in plain language within 30 days is not ready for January 1, and the deadline is now close enough that the work has to start this quarter. m:…5377

Connecticut and California add their own dates and their own teeth. Connecticut employers must provide written notice for AI-influenced employment decisions starting October 1, 2027, and Connecticut law treats AI as no defense to discrimination complaints as of October 1, 2026. California's No Robo Bosses Act prohibits sole reliance on automated systems for discipline or termination, and requires human corroboration for AI-assisted discipline or termination starting July 1, 2027. California CCPA regulations provide rights for certain significant employment decisions starting January 1, 2027. New York City's Law 144 requires an independent bias audit of covered tools, a public summary of bias audit results, and notice to candidates and employees regarding AI use. Read together, the employer's duty is converging on the same three things the OCC asks of banks: explain the decision, keep a human in the loop, and keep the record. The dates differ by state: a national employer does not get one deadline, it gets a calendar. m:…5377

The voters' version

The third source of rules is the one no compliance team controls: voters. The political action committee Tomorrow Together won all six races it spent in during the recent midterm elections, according to the Center for AI Safety's newsletter, and in 44 out of 45 cases where counts are complete, the electorate backed new restrictions or rejected new data center developments. 56% of voters identified AI and data centers as a crucial or major factor in their vote for Congress. Representative Greg Casar suggested that Democrats should grill CEOs of large AI companies regarding risks. The newsletter also notes that the AI safety ecosystem is divided over whether to prioritize a global pause on frontier development or keeping responsible companies in the lead. What the voters agreed on, in 44 of 45 cases, was narrower: restrict, or do not build here. That is a land-use and permitting signal as much as a technology signal, and it lands directly on the data-center buildout. m:…7175

The international note in the same newsletter points to where the next rule is likely to come from. The Australian government will require AI companies to report cybersecurity breaches by AI agents. A breach-reporting duty for agent incidents is the natural companion to the ledger of agent incidents published this week, and it turns a voluntary disclosure into a legal one. An executive reading these three sources together should see the pattern: the examiner asks what the consequences are, the hiring law asks who is accountable, and the voter asks whether to allow the building at all. None of these rules waits for the others. The 2027 calendar is set by the states, the examiners are using their framework, and the voters have spoken. The job now is to map which of the three reaches your product first, and to build the explanation, the human review and the record before that date arrives. m:…7175 m:…5377