Artificial intelligence regulation imposes no intellectual property obligations on most startup founders, and its data security duties arrive first through the Cyber Resilience Act reporting deadline of September 11, 2026. Two of the three European regimes founders ask about do not reach them at all. The Digital Markets Act, Regulation (EU) 2022/1925, binds only companies the European Commission designates as gatekeepers, which under Article 3 requires annual Union turnover of at least EUR 7.5 billion, about 8.71 billion US Dollars, in each of the last three financial years, or a market value of at least EUR 75 billion, about 87.1 billion US Dollars, together with 45 million monthly active end users and 10,000 yearly active business users in the Union. The Digital Services Act, Regulation (EU) 2022/2065, reaches intermediary services that transmit or host information supplied by others, and its Article 19 exempts micro and small enterprises from the online platform obligations even where a company is otherwise in scope.
That leaves the AI Act, Regulation (EU) 2024/1689, and the chapter founders were bracing for moved. Regulation (EU) 2026/1744, published in the Official Journal on July 24, 2026 and in force since July 27, 2026, deferred the Chapter III high risk requirements from August 2, 2026 to December 2, 2027 for standalone systems listed in Annex III, and to August 2, 2028 for artificial intelligence embedded as a safety component in regulated products. What binds a founder today is the prohibition list in Article 5, the transparency and marking duties in Article 50, and, for anyone training or substantially fine tuning a general purpose model, the copyright policy and training data summary duties in Article 53. Article 99, paragraph 6 caps fines for small and medium enterprises at the lower of the stated percentage or the stated amount, which is the most useful sentence in the statute for a company under 50 people.
The enforceable intellectual property rules come from United States case law and agency guidance, not from European regulation. The enforceable data security rules come from the Cyber Resilience Act, the NIS2 Directive, and Article 32 of the General Data Protection Regulation. At seed stage the compliance spend is security attestation, and the AI attributable portion is close to zero.
Detailed Findings
Which AI regulations actually apply to a startup right now
Three European regulations get named in founder conversations, and only the AI Act currently creates a duty for a company under 50 employees. The prohibitions in Article 5 of Regulation (EU) 2024/1689 have applied since February 2, 2025, and Regulation (EU) 2026/1744 added two more, covering artificial intelligence that generates child sexual abuse material or non consensual intimate imagery, with a transition period running to December 2, 2026.
The Article 50 transparency duties began applying on August 2, 2026. A provider whose system generates synthetic audio, image, video, or text must mark the output in a machine readable format detectable as artificially generated. A deployer of an emotion recognition system or a biometric categorisation system must inform the people exposed to it. A deployer who publishes deepfake content must disclose that it is artificially generated. Systems already on the market before August 2, 2026 received a grace period to December 2, 2026 for the marking requirement.
Article 4 was softened. Providers and deployers must now take measures to support the development of sufficient artificial intelligence literacy among staff. The original text required them to ensure it. That change matters because it lowers the evidentiary burden on a small company that cannot fund a training program.
The penalty structure sets the risk. Article 99, paragraph 3 sets a ceiling of EUR 35 million, about 40.7 million US Dollars, or 7 percent of worldwide annual turnover for a prohibited practice. Article 99, paragraph 4 sets EUR 15 million, about 17.4 million US Dollars, or 3 percent for most other breaches. Article 99, paragraph 5 sets EUR 7.5 million or 1 percent for supplying incorrect information. For a small or medium enterprise, including a startup, paragraph 6 applies whichever of the two figures is lower. A twelve person company facing a 3 percent exposure is facing 3 percent of a small number, and that reframes the entire compliance budget conversation.
Does the Digital Markets Act impose any obligation on a startup
No. Regulation (EU) 2022/1925 creates obligations only for undertakings the Commission designates as gatekeepers, and the Article 3, paragraph 2 thresholds are structural: EUR 7.5 billion in annual Union turnover in each of the last three financial years or a fair market value of EUR 75 billion in the last financial year, a core platform service in at least three Member States, and 45 million monthly active end users plus 10,000 yearly active business users sustained in each of the last three financial years. Nothing a seed stage company does moves it toward that list.
For a founder the Digital Markets Act is an asset. Article 6, paragraph 9 gives business users continuous and real time data portability from a gatekeeper. Article 6, paragraph 7 requires interoperability with hardware and software features. Article 5, paragraph 3 removes the anti steering restrictions that kept a startup from telling its own customers about a cheaper channel. A founder who reads the Digital Markets Act as a compliance burden has read it backwards.
What does the Digital Services Act require of an AI company
Nothing, unless the product transmits or hosts information supplied by third parties. The obligations in Regulation (EU) 2022/2065 attach to intermediary services, which Article 3 defines as mere conduit, caching, and hosting. A model that generates output on the provider’s own infrastructure in response to a user prompt is not storing information provided by a recipient of the service in the sense the statute uses.
Where a startup does host user content, a community forum, a marketplace, a shared workspace, Article 19 excludes providers of online platforms that qualify as micro or small enterprises from the whole of Section 3, with the single exception of Article 24, paragraph 3. The exclusion continues for twelve months after a company grows out of the category. Only designation as a very large online platform under Article 33, which requires 45 million average monthly recipients in the Union, removes the shelter.
The Digital Omnibus expanded the AI Office’s supervisory reach over artificial intelligence integrated into very large online platforms. That is the platform’s duty. It reaches a startup through the vendor agreement, and it is now appearing in enterprise procurement language before it appears in any statute that binds the vendor directly.
What intellectual property duties does AI regulation create
Two, both in Article 53 of the AI Act, and both apply only to providers of general purpose artificial intelligence models. Article 53, paragraph 1, point c requires a written policy for complying with Union copyright law, including identifying and respecting reservations of rights expressed under Article 4, paragraph 3 of Directive (EU) 2019/790. Article 53, paragraph 1, point d requires publication of a sufficiently detailed summary of the content used for training, drawn up according to the template the Commission published on July 24, 2025. Both have applied since August 2, 2025, and the Commission’s enforcement powers against general purpose model providers became exercisable on August 2, 2026.
The trap is who counts as a provider. The Commission’s guidelines of July 18, 2025 set an indicative floor of 10^23 floating point operations for a model to be a general purpose model at all, and treat a downstream party who fine tunes someone else’s model as a new provider once the compute used for the modification reaches one third of the compute used to train the original. A team fine tuning an open weight model on a few thousand dollars of compute is nowhere near that line. A team that continues pretraining is worth checking against it. Article 54 separately requires a provider established outside the Union to appoint an authorised representative in the Union before placing the model on the market.
Who owns the output, and can a startup patent an AI assisted invention
A work generated by a machine without human authorship has no United States copyright, and that is now settled. The District of Columbia Circuit held in Thaler v. Perlmutter, 130 F.4th 1039 (D.C. Cir. 2025), that the Copyright Act of 1976 requires a human author, and the Supreme Court denied certiorari on March 2, 2026. Part 2 of the Copyright Office report on copyright and artificial intelligence, issued January 29, 2025, drew the operative line: prompts alone do not confer authorship, no matter how detailed, because the user does not control how the system executes them. Protection attaches to human authored material that remains perceptible in the output, and to human selection, arrangement, and modification of machine generated material.
This creates a specific drafting problem that most founders have not seen. Standard software terms assign ownership of output to the customer. If the output carries no copyright, the assignment conveys nothing, and the representation supporting it is false. The fix is a grant of whatever rights exist plus a covenant not to assert, and an express acknowledgment that some output may not be protectable. Investors’ counsel started catching this in 2026.
On the patent side, artificial intelligence cannot be named as an inventor. The Federal Circuit held in Thaler v. Vidal, 43 F.4th 1207 (Fed. Cir. 2022), that the Patent Act’s reference to an individual means a natural person. What changed since is the analysis for a human inventor using an artificial intelligence tool. The Revised Inventorship Guidance for AI Assisted Inventions, 90 Fed. Reg. 54636, published November 28, 2025, rescinded the February 2024 guidance and removed the Pannu joint inventorship test as a way of measuring a human contribution against a machine. Artificial intelligence is now treated as ordinary equipment, like a research database, and the traditional conception standard governs: a specific and settled idea, a particular solution, and not a research plan. Any startup still running its invention disclosure process off the February 2024 framework is applying rescinded guidance.
Eligibility is the harder gate. In Recentive Analytics, Inc. v. Fox Corp., 134 F.4th 1205 (Fed. Cir. 2025), the Federal Circuit held as a matter of first impression that applying generic machine learning to a new data environment or industry is ineligible under 35 U.S.C. 101, and certiorari was denied December 8, 2025. Claims must recite an improvement to the machine learning itself. Cutting the other way, a Patent Office memorandum of August 4, 2025 instructs examiners to distinguish claims that recite a judicial exception from those that merely involve one, and to issue a section 101 rejection only where ineligibility is more likely than not.
In the seed and Series A financings I have papered over the past two years, no investor’s counsel has asked for an AI Act representation. What they ask for, every time, is a schedule of every model in the stack with its license, and a representation about the provenance of the training and fine tuning data. The diligence request list changed well before the statute did, and it is a better guide to actual risk than any regulatory calendar.
Is training on copyrighted data still lawful
Every United States merits ruling so far has treated the act of training a model on copyrighted works as fair use. The liability sits earlier in the pipeline, at how the corpus was obtained, and the price of getting that part wrong now carries a published number. In Bartz v. Anthropic PBC, 787 F. Supp. 3d 1007 (N.D. Cal. 2025), the court split the question three ways on June 23, 2025: training large language models on the books was fair use and described as spectacularly transformative; format shifting lawfully purchased print books to digital was fair use; and retaining pirated copies in a permanent central library was not fair use on any factor, with a later lawful purchase failing to cure the earlier download. The class settlement of 1.5 billion US Dollars received final approval on July 20, 2026, at roughly 3,000 US Dollars per work across approximately 500,000 works, four times the 750 US Dollar statutory minimum, with first distributions scheduled for November 15, 2026.
Kadrey v. Meta Platforms, decided in the Northern District of California on June 25, 2025, reached fair use for the defendant on a narrow evidentiary record: the model could not meaningfully reproduce the books, and the plaintiffs offered no empirical evidence of market dilution, which the court identified as the strongest available theory in a future case. Thomson Reuters Enterprise Centre GmbH v. ROSS Intelligence Inc., 765 F. Supp. 3d 382 (D. Del. 2025), went the other way, holding that copying to build a directly competing legal research product was not transformative. That case was argued in the Third Circuit on June 11, 2026, and no opinion had issued as of September 4, 2026. It will be the first appellate decision on fair use in artificial intelligence training.
Two decisions outside the training line matter as much. In Getty Images versus Stability AI, [2025] EWHC 2863 (Ch), decided November 4, 2025, the English High Court held that model weights are not infringing copies because the model does not store the works and the weights are the product of learned patterns. And in Cox Communications, Inc. v. Sony Music Entertainment, decided unanimously on March 25, 2026, the Supreme Court narrowed contributory copyright liability to inducement or a service tailored to infringement, vacating a one billion US Dollar judgment. Artificial intelligence defendants moved on that holding within weeks.
On the disclosure side, California Civil Code section 3111, effective January 1, 2026, requires a developer of a generative artificial intelligence system to post a high level summary of the datasets used, reaching back to systems released or substantially updated on or after January 1, 2022. The statute names no penalty and no enforcement mechanism. A constitutional challenge failed at the preliminary injunction stage on March 5, 2026 and is on appeal to the Ninth Circuit, and the statute remains enforceable.
What data security obligations bind an AI startup in 2026
The nearest hard deadline is September 11, 2026, when Article 14 of the Cyber Resilience Act, Regulation (EU) 2024/2847, begins requiring manufacturers of products with digital elements to report actively exploited vulnerabilities and severe incidents. The cadence is a 24 hour early warning, a 72 hour notification, and a final report within 14 days after a corrective measure becomes available for a vulnerability, or within one month of the 72 hour notification for a severe incident. Reports go simultaneously to the coordinating computer security incident response team and to the European Union Agency for Cybersecurity through a single reporting platform. Full application, including the essential requirements and the penalty regime of EUR 15 million or 2.5 percent of worldwide turnover, follows on December 11, 2027.
Scope is where founders get this wrong in both directions. Downloadable or installed artificial intelligence software, endpoint agents, mobile applications, and on premises components are products with digital elements. Pure cloud native software as a service generally sits outside, unless the remote data processing is necessary for the product’s core function, which pulls a bundled offering back in. Article 12 of the Cyber Resilience Act bridges to the AI Act, deeming a high risk system that satisfies the relevant essential requirements compliant on the cybersecurity side.
Reactor operations taught me a discipline that transfers here without translation. On a submarine the reportable event is defined before the casualty, not after it, and the log entry is made by the watchstander who saw it, on the clock, in writing. Every regime described here runs on the same instrument. A company deciding at two in the morning on the night of the incident what counts as reportable has already lost the first window.
The NIS2 Directive, Directive (EU) 2022/2555, captures cloud computing service providers under Annex I as digital infrastructure, at a threshold of 50 employees or EUR 10 million, about 11.6 million US Dollars, in annual turnover and balance sheet total. Reporting runs 24 hours for an early warning, 72 hours for the incident notification, and one month for the final report. Article 20 makes management bodies responsible for approving and overseeing the risk management measures and exposes them to liability for infringements. Article 34 sets penalties at EUR 10 million or 2 percent for essential entities and EUR 7 million or 1.4 percent for important entities. As of August 2026, 23 of 27 Member States had applicable national law, and on July 8, 2026 the Commission referred Ireland, Spain, France, and the Netherlands to the Court of Justice.
Article 32 of the General Data Protection Regulation remains the workhorse: pseudonymisation and encryption, confidentiality and integrity and availability and resilience, restoration after an incident, and regular testing of effectiveness. Article 33 keeps the 72 hour breach notification. Article 83 keeps the ceiling at EUR 20 million or 4 percent of worldwide turnover. The European Data Protection Board’s Opinion 28/2024 of December 17, 2024 is the document to read before asserting that a trained model contains no personal data: anonymity is not presumed, and a provider must show case by case that personal data cannot be extracted by query or attack.
Founders keep asking about the 96 hour breach window and the single reporting entry point. That is the Digital Omnibus Regulation proposal, COM(2025) 836, tabled November 19, 2025, and it is not law. More than a thousand amendments were filed by the July 15, 2026 deadline, the Council compromise was blocked, and Parliament’s negotiating position is not expected before February 2027. Plan on 72 hours.
One AI Act provision is worth reading now even though it does not bite until December 2, 2027. Article 15, paragraph 5 requires high risk systems to resist data poisoning, model poisoning, adversarial examples, and confidentiality attacks. That is a product architecture requirement with a fifteen month lead time, and it is cheaper to build in than to retrofit. Article 55 already applies to providers of general purpose models with systemic risk above 10^25 floating point operations, requiring documented adversarial testing, incident reporting to the AI Office without undue delay, and cybersecurity protection for the model and its physical infrastructure.
Which United States state laws apply, and what do they require
The operative United States artificial intelligence regime is state law, and it is now the larger practical burden for a company headquartered in California or Texas. No federal artificial intelligence statute of general application has been enacted. Executive Order 14365 of December 11, 2025 created a litigation task force and directed the Commerce Department to identify conflicting state laws, but an executive order cannot preempt a state statute on its own, and the task force has filed no independent action. A moratorium on state enforcement was stripped from the 2025 reconciliation bill by a Senate vote of 99 to 1 and dropped again from the fiscal year 2026 defense authorization.
Texas House Bill 149, the Responsible Artificial Intelligence Governance Act, took effect January 1, 2026 and applies to any person conducting business in Texas or offering products to Texas residents, with no small business exemption. Its discrimination provision requires intentional unlawful discrimination and states expressly that disparate impact alone does not establish intent. Compliance with the National Institute of Standards and Technology AI Risk Management Framework is an affirmative defense. Penalties run from 10,000 to 12,000 US Dollars per curable violation, 80,000 to 200,000 US Dollars per uncurable violation, and 2,000 to 40,000 US Dollars per day for a continuing violation, subject to a 60 day cure period, enforced exclusively by the Attorney General.
California Senate Bill 53, the Transparency in Frontier Artificial Intelligence Act, took effect January 1, 2026 and reaches almost nobody. It applies to foundation models trained with more than 10^26 floating point operations, and its heavier obligations attach only to developers with more than 500 million US Dollars in annual gross revenue. Frontier developers must publish a transparency report before deployment and report critical safety incidents to the Office of Emergency Services within 24 hours where there is imminent risk of death or serious injury and within 15 days otherwise, with penalties up to 1,000,000 US Dollars per violation. Catastrophic risk is defined as foreseeable material risk of 50 or more deaths or serious injuries, or more than one billion US Dollars in property damage.
The California rules that will actually reach a growing startup are the Privacy Protection Agency regulations effective January 1, 2026. Automated decisionmaking technology obligations attach to pre existing systems on January 1, 2027 and to new systems before first use. Risk assessments covering activities before 2026 are due by December 31, 2027, with the first submission to the agency on April 1, 2028. Cybersecurity audits phase in by revenue band, April 1, 2028 for businesses above 100 million US Dollars in 2026 revenue, April 1, 2029 between 50 and 100 million, and April 1, 2030 below 50 million. The underlying business thresholds gate everything: 25 million US Dollars in gross revenue, or personal information of 100,000 consumers or households, or half of revenue from selling or sharing personal information.
Illinois House Bill 3773 took effect January 1, 2026 and amends the Illinois Human Rights Act, which covers employers with one or more employees. Using artificial intelligence that discriminates on a protected basis in recruitment, hiring, promotion, discipline, or discharge is itself a civil rights violation, and using ZIP code as a proxy for a protected class is a standalone violation requiring no separate showing of effect. Notice is required when artificial intelligence is used for those purposes. The Department of Human Rights proposed implementing rules on May 15, 2026 and withdrew them on June 2, 2026, so the statutory duty is live while the contours of a compliant notice are unsettled. A separate 2025 amendment added civil penalties of 16,000 US Dollars for a first violation, 42,500 for a second within five years, and 70,000 for a third.
Colorado is the cautionary example. Its 2024 artificial intelligence statute was delayed twice and then repealed and replaced by Senate Bill 189, signed May 14, 2026, before it ever became enforceable. The replacement, codified at Colorado Revised Statutes section 6 1 1701 and following, takes effect January 1, 2027 and is a transparency statute: developer documentation to deployers, pre use notice to consumers, adverse outcome disclosure within 30 days, access and correction and meaningful human review rights, and three year records. The algorithmic discrimination duty of care, the impact assessments, and the risk management program requirements were all removed. Penalties reach 20,000 US Dollars per violation with a 60 day cure period that sunsets January 1, 2030, enforced exclusively by the Attorney General with no private right of action.
New York’s Responsible AI Safety and Education Act, signed December 19, 2025 and amended March 27, 2026, takes effect January 1, 2027 and now mirrors California at 10^26 floating point operations and 500 million US Dollars in revenue. Incident reporting runs 72 hours, or 24 hours where there is imminent risk of death, with penalties up to 1,000,000 US Dollars for a first violation and 3,000,000 for a subsequent one.
Are regulators really looking at outcomes instead of who made the decision
In part, and the record splits along state lines. Illinois wrote an outcome standard: the discriminatory result is the violation, and the ZIP code proxy provision dispenses with proof of effect altogether. Texas wrote the opposite, requiring intentional unlawful discrimination and stating that disparate impact alone does not establish intent. Colorado deleted its outcome oriented duty of care in May 2026 when it replaced its statute. California’s automated decisionmaking rules turn on whether the technology replaces or substantially replaces human decisionmaking for a significant decision, which is a test about the decisionmaker, not the outcome.
Article 22 of the General Data Protection Regulation sits on the outcome side and has for eight years, giving a data subject the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, with a right to human intervention and to contest. A founder building an employment, lending, housing, insurance, or healthcare product should assume the outcome standard applies. General productivity software does not warrant that spend.
What does AI compliance actually cost at seed, Series A, and Series B
At seed stage the artificial intelligence attributable compliance cost is close to zero, and the real spend is security attestation demanded by customers. A SOC 2 Type II report runs roughly 20,000 to 60,000 US Dollars all in for a company at this stage, counting readiness work, auditor fees, and tooling. ISO/IEC 27001 certification for a small company runs roughly 23,000 to 27,000 US Dollars in year one. ISO/IEC 42001, the artificial intelligence management system standard published in 2023, runs roughly 21,000 to 70,000 US Dollars for initial certification. Every one of those figures comes from a compliance vendor with a commercial interest in it, and no independent pricing survey exists, which is worth stating plainly.
The European figures that get quoted at founders come from the Commission’s own 2021 impact assessment and are widely misread. The headline of EUR 6,000 to 7,000 per high risk system is reached only after deducting everything the Commission assumed a firm already does as business as usual. The un deducted itemisation in the annex is data oversight at EUR 2,763, documentation and traceability at EUR 4,390, provision of information at EUR 3,627, human oversight at EUR 7,764, and robustness and accuracy at EUR 10,733, totalling EUR 29,277, about 34,004 US Dollars per system. The supporting study put a quality management system built from scratch at EUR 193,000 to 330,000, about 224,170 to 383,295 US Dollars, plus EUR 71,400 annually, about 82,931 US Dollars. A startup with no existing compliance function is the firm for which the deduction does not apply.
Bruegel’s June 11, 2026 analysis adopts a combined provider and deployer range of EUR 14,623 to 29,277 per system, 9 to 17 percent of an assumed EUR 170,000 development budget, and makes the point that carries: the requirements do not scale with developer size, so the same absolute cost lands on a four person team and on a twenty thousand person incumbent. None of it binds until December 2, 2027, and only for systems in Annex III.
There is no authoritative published survey of what companies actually spend on artificial intelligence oversight staffing. A profession report published May 21, 2025 found that 77 percent of organisations were working on artificial intelligence oversight and that 98.5 percent expected to need additional staff within twelve months, with no dollar figures in the public materials. A widely cited global survey published August 25, 2026, covering 1,719 respondents in 97 countries, contains no oversight budget figure at all. Any specific per company number a founder is quoted for artificial intelligence compliance should be traced to a source before it enters a board deck.
How should a founder document compliance before approaching investors
Four artifacts carry the diligence, and each takes days rather than months if started before the term sheet. The first is a model and dataset inventory naming every model in the stack, the exact license governing each, and the provenance of every training and fine tuning corpus. The second is written evidence of the acquisition channel for each corpus, invoices, license agreements, crawl logs, robots directives honored, because Bartz turned on how the material was obtained and not on what was done with it afterward.
The third is an Article 50 marking implementation record, dated before December 2, 2026, for any product that emits synthetic media. The fourth is a security attestation paired with an incident response runbook that names the reporting clock for every regime the company touches, 24 hours to the coordinating response team under the Cyber Resilience Act, 72 hours to the supervisory authority under Article 33 of the General Data Protection Regulation, 24 hours under NIS2 where it applies, and whatever the customer contract demands, which is usually shorter than all of them.
The next piece in this sequence takes the training data representation apart clause by clause: the exact language investors’ counsel began inserting into Series A stock purchase agreements in 2026, why the indemnity carve out for open weight models fails the moment a license changes upstream, and which two words in the standard provenance representation a founder should refuse to sign.
Open Questions
Whether the Third Circuit affirms Thomson Reuters v. ROSS will set the first appellate rule on fair use in artificial intelligence training. The case was argued June 11, 2026 and no opinion has issued. An affirmance on the reasoning below, that copying to build a competing product is not transformative, reaches further into commercial model development than the district court holdings that have reassured founders so far.
Whether the Digital Omnibus Regulation on data survives Parliament in recognisable form determines the legal basis for training on personal data. The proposed Article 88c legitimate interest basis for artificial intelligence development sat in recitals rather than operative text as of July 2026. If it stays there, European model developers keep relying on a balancing test that no supervisory authority has blessed for training at commercial scale.
Whether harmonised standards exist when the December 2, 2027 deadline arrives. As of June 2026 no standard from the European standardisation committee’s artificial intelligence technical committee had been cited in the Official Journal, and the cybersecurity and robustness standards for Article 15 remained at enquiry and drafting stage. The Digital Omnibus decoupled the deadline from standards availability, so providers may face a conformity assessment with no presumption of conformity to assess against.
Whether any court will hold that model weights, system prompts, or fine tuning datasets are trade secrets. No United States court has decided the question either way. Every candidate case settled, was dismissed on other grounds, or was amended to drop the claim, including the trade secret action between two frontier developers dismissed with prejudice on June 15, 2026 on the ground that mere possession is not misappropriation. Startups are pricing acquisitions on the assumption that weights are protectable assets, and no decision supports it.
Whether federal preemption of state artificial intelligence law arrives through legislation or through litigation. Congress declined preemption three times between July 2025 and the 2026 session. The litigation route has produced one complaint in intervention in a case a private company filed. A founder building a compliance program against Texas, Illinois, and Colorado requirements is building against law that a single statute could vacate, and against law that has already been repealed once in Colorado before it took effect.
Source List
Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence, Official Journal L, 12 July 2024. Primary source for Articles 4, 5, 50, 51, 53, 54, 55, 72, 73, and 99, and the sole statutory basis for the intellectual property duties described.
Regulation (EU) 2026/1744, Digital Omnibus on artificial intelligence, Official Journal, 24 July 2026, in force 27 July 2026. Primary source for the deferral of Chapter III to 2 December 2027 and 2 August 2028, the Article 4 and Article 6 amendments, the watermarking grace period, and the small and medium enterprise documentation relief.
Regulation (EU) 2024/2847 of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements, the Cyber Resilience Act. Primary source for the Article 14 reporting cadence beginning 11 September 2026, the Article 12 bridge to the AI Act, and the Article 64 penalties applying from 11 December 2027.
Regulation (EU) 2022/2065 on a Single Market for Digital Services and Regulation (EU) 2022/1925 on contestable and fair markets in the digital sector. Primary sources for the Article 19 micro and small enterprise exclusion and the Article 3 gatekeeper designation thresholds respectively.
Directive (EU) 2022/2555 concerning measures for a high common level of cybersecurity across the Union, and Regulation (EU) 2016/679, the General Data Protection Regulation. Primary sources for the incident reporting cadences, the Article 20 management liability provision, and Articles 22, 32, 33, and 83.
Thaler v. Perlmutter, 130 F.4th 1039 (D.C. Cir. 2025), certiorari denied 2 March 2026; Thaler v. Vidal, 43 F.4th 1207 (Fed. Cir. 2022); Recentive Analytics, Inc. v. Fox Corp., 134 F.4th 1205 (Fed. Cir. 2025), certiorari denied 8 December 2025. Controlling authority on human authorship, human inventorship, and machine learning subject matter eligibility.
Bartz v. Anthropic PBC, 787 F. Supp. 3d 1007 (N.D. Cal. 2025), settlement approved 20 July 2026; Kadrey v. Meta Platforms, Inc. (N.D. Cal. 25 June 2025); Thomson Reuters Enterprise Centre GmbH v. ROSS Intelligence Inc., 765 F. Supp. 3d 382 (D. Del. 2025), argued in the Third Circuit 11 June 2026; Cox Communications, Inc. v. Sony Music Entertainment (U.S. 25 March 2026); Getty Images (US) Inc. v. Stability AI Ltd., [2025] EWHC 2863 (Ch). The current fair use and secondary liability record.
Revised Inventorship Guidance for AI Assisted Inventions, 90 Fed. Reg. 54636, 28 November 2025, and the United States Patent and Trademark Office memorandum on subject matter eligibility of 4 August 2025. Operative agency guidance, superseding the February 2024 inventorship guidance.
Copyright and Artificial Intelligence, Part 2: Copyrightability, United States Copyright Office, 29 January 2025, and Part 3: Generative AI Training, pre publication version, 9 May 2025. Agency position on prompt based authorship and on training as fair use.
European Data Protection Board Opinion 28/2024 of 17 December 2024 on data protection aspects of artificial intelligence models. Governing supervisory position that a trained model is not presumed anonymous.
Impact Assessment accompanying the proposal for a Regulation laying down harmonised rules on artificial intelligence, SWD(2021) 84 final, 21 April 2021, together with the supporting study of April 2021 and the Digital Omnibus impact assessment, SWD(2025) 836 final, 19 November 2025. Official cost estimates, including the annex itemisation totalling EUR 29,277 per system.
Mario Mariniello, The right balance: how to fix European Union artificial intelligence regulation, Bruegel policy brief, 11 June 2026. Current independent analysis of per system compliance cost and its disproportionate effect on small developers.
Texas House Bill 149, 89th Legislature; California Senate Bill 53 and California Civil Code section 3111; Illinois House Bill 3773 and Public Act 103 0804; Colorado Senate Bill 189 of 2026; New York Chapter 699 of the Laws of 2025 as amended. The operative United States state statutes.
