Regulatory Exposure

Regulatory Exposure is a data page on the Companies desk of Glassbox Auditing. One company's AI-law brief: the laws and rules that apply to it, their obligations quoted from the official text, and the regulators' enforcement matters that resemble its situation. New AI rules add compliance costs and legal exposure for the companies that build or use AI.

Last updated: 7 Nov 2026.

What is on this page today?

EU AI Act: delayed to in 24 days (2 Dec 2026) — Art. 50(2) machine-readable marking of synthetic content: generative systems already on the market before 2 August 2026 get until 2 December 2026 (new Art. 111(4) inserted by Regulation (EU) 2026/1744) (Official Journal of the EU, 1 Dec 2026)
EU AI Act: applies in 24 days (2 Dec 2026) — New prohibitions inserted by Regulation (EU) 2026/1744: AI systems generating non-consensual intimate imagery (Art. 5(1)(ba)) and child sexual abuse material (Art. 5(1)(bb)) (Official Journal of the EU, 1 Dec 2026)
EU Digital Omnibus on AI: applies in 24 days (2 Dec 2026) — New AI Act prohibitions (Art. 5(1)(ba)/(bb): non-consensual intimate imagery and CSAM generation) and end of the Art. 50(2) grace period for legacy generative systems (Official Journal of the EU, 1 Dec 2026)
Australia Privacy Act 1988 / APPs: applies in 32 days (10 Dec 2026) — APP 1.7-1.9 (privacy policies must disclose use of computer programs, using personal information, to make or substantially assist decisions that could significantly affect individuals) apply: 2024 amending Act Sch 1… (AU official text, 9 Dec 2026)
105 provisions are quoted from the official text of 42 AI and data laws: 51 from U.S. state laws — laws of other countries: 24 from 7, U.S. federal laws: 21 from 11 · 15 provisions dropped, not guessed · Cut from each law's published text, whitespace normalised (Official texts of the laws (EUR-Lex, Congress.gov, state legislatures), 7 Nov 2026)

Where does the data come from?

Items on this page come from Official Journal of the EU; AU official text; Official texts of the laws (EUR-Lex, Congress.gov, state legislatures). Each item links to its own source. All sources, how items are checked.

What does this page lead to?

AI Law & Enforcement (AI): The laws and matters applied here come from the AI Law corpus, so a new law coming into force adds obligations to every company profile it covers. (moves the same way; months; sector scale) Source: Official texts: EUR-Lex, state legislatures, the Federal Register and national gazettes (each law links its own).
Courts & Lawsuits (Companies): Regulators' AI enforcement matters (FTC, SEC, state attorneys general) end in orders, fines or suits, so a company that resembles past matters carries more of that legal exposure. (moves the same way; years; company scale) Source: Regulators' own announcements: FTC, SEC, Justice Department, EEOC, state attorneys general, European data-protection authorities (each matter links its own).
Valuation (Companies): EU AI Act fines reach 7% of worldwide turnover for banned uses and compliance work is a running cost, so wider exposure weighs on expected earnings. (moves the other way; years; company scale) Source: Official texts: EUR-Lex, state legislatures, the Federal Register and national gazettes (each law links its own).
Job Listings (Companies): New obligations such as risk assessments, audits and documentation are met with compliance, legal and safety staff, which show up as job postings. (moves the same way; months; company scale) Source: freehire public API (open job postings crawled from company career sites and job boards).
Interest Groups (People & Money): Companies facing new AI rules report lobbying on them; LDA filings list the AI issues and bills each company lobbied on. (moves the same way; months; economy scale) Source: lda.gov Lobbying Disclosure Act filings.

What feeds this page?

AI Companies (AI): The bigger a developer's models and user base, the more AI laws apply to it (the EU AI Act's general-purpose model duties, state rules) and the more regulators' matters resemble its situation. (moves the same way; months to years; company scale) Source: Regulators' own announcements: FTC, SEC, Justice Department, EEOC, state attorneys general, European data-protection authorities (each matter links its own).
AI Models (AI): Models trained with very large compute (above 10^25 operations) are presumed to carry systemic risk under the EU AI Act, which adds testing, reporting and security duties for their developers. (moves the same way; months; company scale) Source: Official texts: EUR-Lex, state legislatures, the Federal Register and national gazettes (each law links its own).
AI Law & Enforcement (AI): Each law that comes into force adds obligations for the companies it covers; the Regulatory Exposure page lists the laws and matters that fit one company. (moves the same way; months; company scale) Source: Official texts: EUR-Lex, state legislatures, the Federal Register and national gazettes (each law links its own).
Watchlist & Alerts (Briefing): A regulatory-action alert marks a new tie to a regulator; enforcement can bring fines, consent orders or limits on a product line. (either way, depending on the cause; weeks to years; company scale) Source: Regulators' own announcements: FTC, SEC, Justice Department, EEOC, state attorneys general, European data-protection authorities (each matter links its own).
Lawmaking (Domestic Intelligence): Executive orders and new federal rules on AI, published in the Federal Register, add to the obligations each company carries on Regulatory Exposure. (moves the same way; months; company scale) Source: Federal Register API.
Events & Interviews (Feed): Executives' testimony on AI before lawmakers and regulators tends to come while AI rules are drafted; Regulatory Exposure lists the AI laws that reach each company. (either way, depending on the cause; months; company scale) Source: Official texts: EUR-Lex, state legislatures, the Federal Register and national gazettes (each law links its own).
Government (People & Money): Agency heads named by the president decide which AI rules advance and how hard the FTC, SEC and EEOC enforce them, which sets the obligations a company carries on Regulatory Exposure. (either way, depending on the cause; months; company scale) Source: Federal Register API.
Interest Groups (People & Money): The big-tech companies' PACs and lobbying focus heavily on AI and data rules, the same laws whose obligations Regulatory Exposure lists company by company. (either way, depending on the cause; years; company scale) Source: lda.gov Lobbying Disclosure Act filings.

Regulatory Exposure

What is on this page today?

Where does the data come from?

What does this page lead to?

What feeds this page?

What else is on the Companies desk?