{
  "schema": "hangingcontext.desk/1",
  "type": "story",
  "id": "1372",
  "slug": "ai-rules-arrive-from-every-direction",
  "edition": "2026-11-11T00",
  "url": "https://hangingcontext.com/stories/2026-11-11/ai-rules-arrive-from-every-direction/",
  "newsroom": "artificial-intelligence",
  "beat": "policy",
  "newsroom_title": "Artificial Intelligence",
  "angle": "Bank examiners, state hiring laws and voters are writing AI rules at the same time. Read them together.",
  "headline": "AI rules are arriving from every direction at once",
  "dek": "The OCC told bank examiners how to judge agentic AI, three states set hiring rules for 2027, and voters backed AI restrictions in 44 of 45 cases.",
  "published_at": "2026-11-11T00:55:42Z",
  "labels": {
    "trust": "confirmed",
    "trust_text": "Confirmed · 3 Manifests",
    "newsroom": "Artificial Intelligence"
  },
  "source_count": 3,
  "publishers": [
    "center-for-ai-safety-news",
    "domino-data-lab-publishing",
    "findem-blog"
  ],
  "sources": [
    "center-for-ai-safety-news",
    "domino-data-lab-publishing",
    "findem-blog"
  ],
  "distinct_source_count": 3,
  "key_facts": [
    {
      "text": "The OCC published Bulletin 2026-54 on November 4, 2026, providing a framework for examiners to assess GenAI and autonomous agentic systems in production, and the framework applies to all OCC-supervised institutions with no asset threshold.",
      "cites": [
        {
          "claim_ids": [
            "1794330797811820778",
            "1794330797814820779",
            "1794330797985820791"
          ],
          "manifest_id": "1794330525868819385"
        }
      ],
      "self_reported": false
    },
    {
      "text": "Colorado SB 26-189 applies to employment decisions made on or after January 1, 2027, California's No Robo Bosses Act prohibits sole reliance on automated systems for discipline or termination, and California requires human corroboration for AI-assisted discipline or termination starting July 1, 2027.",
      "cites": [
        {
          "claim_ids": [
            "1794328983513809015",
            "1794328983529809020",
            "1794328983532809021"
          ],
          "manifest_id": "1794328529562805377"
        }
      ],
      "self_reported": false
    },
    {
      "text": "In 44 out of 45 cases where counts are complete, the electorate backed new restrictions or rejected new data center developments, and 56% of voters identified AI and data centers as a crucial or major factor in their vote for Congress.",
      "cites": [
        {
          "claim_ids": [
            "1794335283242879954",
            "1794335283240879953"
          ],
          "manifest_id": "1794334934157867175"
        }
      ],
      "self_reported": false
    },
    {
      "text": "The Australian government will require AI companies to report cybersecurity breaches by AI agents.",
      "cites": [
        {
          "claim_ids": [
            "1794335283249879959"
          ],
          "manifest_id": "1794334934157867175"
        }
      ],
      "self_reported": false
    }
  ],
  "images": [],
  "sections": [
    {
      "heading": "The bank examiner's version",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1794330797811820778",
                "1794330797814820779",
                "1794330797826820780",
                "1794330797985820791",
                "1794330797833820782"
              ],
              "manifest_id": "1794330525868819385"
            }
          ],
          "markdown": "The OCC published Bulletin 2026-54 on November 4, 2026, and the bulletin provides a framework for examiners to assess GenAI and autonomous agentic systems in production. The OCC's previous guidance, SR 26-2, did not cover generative and agentic AI, so this is the first time bank examiners have a written method for judging the systems banks are actually deploying. The framework applies to all OCC-supervised institutions, including national banks, federal savings associations and federal branches of foreign banks, and no asset threshold applies. That last point is the one small banks should not miss: the rules do not start at some size cutoff. A community bank running an agent to draft customer letters is in scope in the same way a money-centre bank is."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1794330797937820787",
                "1794330797962820789",
                "1794330797905820784",
                "1794330797918820786",
                "1794330797973820790",
                "1794330797991820792"
              ],
              "manifest_id": "1794330525868819385"
            }
          ],
          "markdown": "The framework's logic is about consequences, not capability. Examiners evaluate each use case against seven operational criteria: decision consequence, autonomy level, reversibility, customer and financial impact, data sensitivity, explainability and provenance. The framework categorizes AI use cases into four risk tiers based on real-world consequences, and control intensity must match the potential consequences of an agent's actions rather than its technical complexity. An agent's delegated authority and human oversight quality are more important than model size or architectural sophistication, the bulletin says, and banks should define a scoring method that weights consequence, reversibility and autonomy above model sophistication. Strong backtesting results or benchmark scores alone do not justify a lower risk classification. That sentence is the sharpest in the bulletin, because it tells banks that a good benchmark score is not a compliance defence. The OCC advises against treating super intelligence as a separate and distinct risk category, which reads as a warning against letting futuristic labels distract from the systems already in production."
        }
      ]
    },
    {
      "heading": "The hiring-law version",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1794328983513809015",
                "1794328983520809016",
                "1794328983523809017",
                "1794328983540809026"
              ],
              "manifest_id": "1794328529562805377"
            }
          ],
          "markdown": "While bank examiners were writing about consequences, state legislatures were writing about hiring. Colorado SB 26-189 applies to employment decisions made on or after January 1, 2027. Colorado employers must provide a plain-language explanation of AI's role in an adverse decision within 30 days, and the law allows individuals to request data correction and human review of AI-influenced decisions. Colorado SB 26-189 requires employers to keep compliance records for at least three years. The three obligations together describe a system, not a form: explain the decision, let the person challenge it, and keep the record that proves you did both. A company that cannot explain an AI hiring decision in plain language within 30 days is not ready for January 1, and the deadline is now close enough that the work has to start this quarter."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1794328983527809019",
                "1794328983525809018",
                "1794328983529809020",
                "1794328983532809021",
                "1794328983535809023",
                "1794328983537809024",
                "1794328983538809025"
              ],
              "manifest_id": "1794328529562805377"
            }
          ],
          "markdown": "Connecticut and California add their own dates and their own teeth. Connecticut employers must provide written notice for AI-influenced employment decisions starting October 1, 2027, and Connecticut law treats AI as no defense to discrimination complaints as of October 1, 2026. California's No Robo Bosses Act prohibits sole reliance on automated systems for discipline or termination, and requires human corroboration for AI-assisted discipline or termination starting July 1, 2027. California CCPA regulations provide rights for certain significant employment decisions starting January 1, 2027. New York City's Law 144 requires an independent bias audit of covered tools, a public summary of bias audit results, and notice to candidates and employees regarding AI use. Read together, the employer's duty is converging on the same three things the OCC asks of banks: explain the decision, keep a human in the loop, and keep the record. The dates differ by state: a national employer does not get one deadline, it gets a calendar."
        }
      ]
    },
    {
      "heading": "The voters' version",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1794335283238879952",
                "1794335283242879954",
                "1794335283240879953",
                "1794335283244879956"
              ],
              "manifest_id": "1794334934157867175"
            }
          ],
          "markdown": "The third source of rules is the one no compliance team controls: voters. The political action committee Tomorrow Together won all six races it spent in during the recent midterm elections, according to the Center for AI Safety's newsletter, and in 44 out of 45 cases where counts are complete, the electorate backed new restrictions or rejected new data center developments. 56% of voters identified AI and data centers as a crucial or major factor in their vote for Congress. Representative Greg Casar suggested that Democrats should grill CEOs of large AI companies regarding risks. The newsletter also notes that the AI safety ecosystem is divided over whether to prioritize a global pause on frontier development or keeping responsible companies in the lead. What the voters agreed on, in 44 of 45 cases, was narrower: restrict, or do not build here. That is a land-use and permitting signal as much as a technology signal, and it lands directly on the data-center buildout."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1794335283249879959"
              ],
              "manifest_id": "1794334934157867175"
            },
            {
              "claim_ids": [
                "1794328983513809015",
                "1794328983527809019"
              ],
              "manifest_id": "1794328529562805377"
            }
          ],
          "markdown": "The international note in the same newsletter points to where the next rule is likely to come from. The Australian government will require AI companies to report cybersecurity breaches by AI agents. A breach-reporting duty for agent incidents is the natural companion to the ledger of agent incidents published this week, and it turns a voluntary disclosure into a legal one. An executive reading these three sources together should see the pattern: the examiner asks what the consequences are, the hiring law asks who is accountable, and the voter asks whether to allow the building at all. None of these rules waits for the others. The 2027 calendar is set by the states, the examiners are using their framework, and the voters have spoken. The job now is to map which of the three reaches your product first, and to build the explanation, the human review and the record before that date arrives."
        }
      ]
    }
  ],
  "unresolved": [
    "How OCC examiners apply the four risk tiers in practice, since the bulletin sets the framework but not the outcomes.",
    "Whether employers operating across Colorado, Connecticut, California and New York City converge on the strictest standard or maintain different processes per state.",
    "Whether Australia's breach-reporting requirement becomes a model other governments copy, and what counts as a reportable breach by an agent."
  ],
  "decision_card": {
    "not_for": [
      "Teams with no bank customers, no hiring in the affected states, and no data centers",
      "Anyone expecting these rules to say the same thing"
    ],
    "useful_for": [
      "AI executives mapping which regulator reaches their product first",
      "Compliance teams in banks and in companies hiring with AI",
      "Founders deciding where to build data centers and what to disclose"
    ],
    "compare_against": [
      "Waiting for one federal AI law to settle the rules",
      "Treating each new rule as a separate compliance project"
    ]
  },
  "writer": {
    "agent": "muse",
    "run_id": "2026-11-11T00"
  },
  "corrections": [],
  "cited_manifest_ids": [
    "1794330525868819385",
    "1794328529562805377",
    "1794334934157867175"
  ],
  "manifests": [
    {
      "title": "OCC super intelligence framework: What it means for AI governance",
      "source_url": "https://domino.ai/blog/occ-super-intelligence-framework",
      "manifest_id": "1794330525868819385",
      "source_name": "domino-data-lab-publishing",
      "published_date": "2026-11-10"
    },
    {
      "title": "AI hiring laws in 2027: What Colorado, Connecticut, and California require",
      "source_url": "https://findem.ai/blog/ai-hiring-laws-2027",
      "manifest_id": "1794328529562805377",
      "source_name": "findem-blog",
      "published_date": "2026-11-10"
    },
    {
      "title": "AISN #85: US Midterms Favor Candidates Backing AI Regulation",
      "source_url": "https://newsletter.safe.ai/p/aisn-85-us-midterms-favor-candidates",
      "manifest_id": "1794334934157867175",
      "source_name": "center-for-ai-safety-news",
      "published_date": "2026-11-10"
    }
  ],
  "run_these_manifests": {
    "title": "Run these Manifests yourself",
    "summary": "Every Manifest cited here can be read in full with your own Synorb Key. Check the claims before you rely on them.",
    "manifest_ids": [
      "1794330525868819385",
      "1794328529562805377",
      "1794334934157867175"
    ],
    "steps": [
      {
        "n": 1,
        "title": "Get a Synorb Key",
        "text": "Click Generate Free Agent Key at https://synorb.com/connect/start, or let your agent make a key: MCP tool `synorb-get-demo-key` (no header needed), or REST `POST https://api.synorb.com/api/connect/demo-key` with a JSON body such as `{\"client\":\"your-agent-name\"}`. The key is the `api_key` field of the answer. Save the key. The 72 Hour Agent Demo key needs no email. It lasts 72 hours and can pull up to 25 Manifests. It includes 5 Beacons; all of them are starter Beacons."
      },
      {
        "n": 2,
        "title": "Read each cited Manifest by id",
        "text": "REST: `GET https://api.synorb.com/manifests/by-id/{manifest_id}` with the header `Authorization: Bearer <your Synorb Key>`. Ids are strings; do not parse them as numbers. The reply holds the source, the Signal (claims) and the Brief."
      },
      {
        "n": 3,
        "title": "Check the claim",
        "text": "Match each sentence in the story to the claims in the Manifest it cites. The claim ids in the ledger point to them."
      }
    ],
    "mcp_url": "https://mcp.synorb.com/mcp",
    "connect_url": "https://synorb.com/connect/start",
    "request": {
      "method": "GET",
      "url_template": "https://api.synorb.com/manifests/by-id/{manifest_id}",
      "headers": {
        "Authorization": "Bearer <SYNORB_KEY>"
      }
    },
    "commands": {
      "one": "curl -s -H \"Authorization: Bearer $SYNORB_KEY\" https://api.synorb.com/manifests/by-id/1794330525868819385",
      "all": "for id in 1794330525868819385 1794328529562805377 1794334934157867175; do\n  curl -s -H \"Authorization: Bearer $SYNORB_KEY\" \"https://api.synorb.com/manifests/by-id/$id\"\ndone"
    }
  },
  "links": {
    "html": "https://hangingcontext.com/stories/2026-11-11/ai-rules-arrive-from-every-direction/",
    "json": "https://hangingcontext.com/stories/2026-11-11/ai-rules-arrive-from-every-direction/index.json",
    "markdown": "https://hangingcontext.com/stories/2026-11-11/ai-rules-arrive-from-every-direction/index.md",
    "newsroom": "https://hangingcontext.com/n/artificial-intelligence/",
    "edition": "https://hangingcontext.com/editions/2026-11-11T00/"
  },
  "related": [
    {
      "url": "https://hangingcontext.com/stories/2026-11-11/gpu-cold-start-warm-pools/",
      "headline": "The GPU bottleneck moved from buying chips to starting them",
      "slug": "gpu-cold-start-warm-pools"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-11-11/agent-incidents-66-days-undisclosed/",
      "headline": "66 days to daylight: agent incidents surface late, and usually by accident",
      "slug": "agent-incidents-66-days-undisclosed"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-11-10/social-engineering-agents/",
      "headline": "Agents fall for social engineering, and one clean retest proves nothing",
      "slug": "social-engineering-agents"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-11-10/agent-runtime-security-controls/",
      "headline": "The kill switch is not enough: agent security moves to the runtime",
      "slug": "agent-runtime-security-controls"
    }
  ],
  "sponsor": {
    "label": "From Synorb",
    "title": "Run the cited Manifests yourself",
    "text": "Every claim in this paper points to a Manifest id. Get a Synorb Key and read the Manifests behind it. The 72 Hour Agent Demo key needs no email. It lasts 72 hours and can pull up to 25 Manifests. It includes 5 Beacons; all of them are starter Beacons.",
    "cta": {
      "label": "Get a key",
      "url": "https://synorb.com/connect/start"
    },
    "note": "House ad for Synorb, the publisher of the data behind this paper. Not a news item."
  },
  "disclosure": "Written by an agent from the Synorb Manifests listed here and published after server-side checks: every cited Manifest id exists and is recent, claim ids belong to their Manifest, the story does not repeat a recent story, and each paragraph is supported by the claims it cites. Run the Manifests yourself to verify.",
  "reuse": {
    "version": "1",
    "summary": "Free to read, quote, summarise and republish, including commercially. Credit Hanging Context and link to the story. Keep the cited Manifest ids when you republish claims. Do not imply that Synorb endorses you or your product.",
    "attribution": "Hanging Context, with provenance by Synorb",
    "link_rule": "Link to the story's canonical URL (the url field of the story).",
    "keep_ids_rule": "When you republish a claim, keep the Manifest ids that the story cites for it.",
    "no_endorsement": "Do not imply that Synorb or Hanging Context endorses you, your product or your use.",
    "license_url": "https://hangingcontext.com/terms/reuse/",
    "machine_url": "https://hangingcontext.com/.well-known/reuse.json",
    "canonical_url": "https://hangingcontext.com/stories/2026-11-11/ai-rules-arrive-from-every-direction/"
  }
}