AI Law Wiki News for September 10, 2026

September 10, 2026 — A UK commission recommends a new regulatory approach to AI in healthcare, with a government response still to follow. Malaysia’s digital minister says the AI Governance Bill draft is complete and will go to Cabinet. The BIS head warns that AI investment financing creates financial-stability risks. California signs SB 1119 (Adam’s Law) and a wider child-safety package covering chatbots, social media and pupil data. SEC officials discuss AI disclosure risks, with Chair Atkins defending materiality and human judgment. Canada publishes provider-assessment guidance addressing AI training data and privacy accountability; comments close December 4. Anthropic reports disrupted Claude misuse involving cyberattacks, surveillance and potentially harmful biological research. GSA announces a 27-month OpenAI procurement offer expected to start October 1, with no platform fee and discounted usage. Senator Chris Van Hollen requests OpenAI safety answers by September 17 and access for federal technical assessors.

UK commission recommends lifecycle oversight of healthcare AI

The National Commission into the Regulation of AI in Healthcare published recommendations on September 10 for a future regulatory framework. The MHRA said the government and regulator would consider the recommendations and respond in due course; publication does not itself introduce new binding requirements.

The report recommends staged authorisation for suitable AI-enabled medical devices: initial deployment would occur within a controlled scope, with risk controls and evidence gathering before authorisation expands. It also calls for ongoing real-world safety and performance monitoring, stronger enforcement mechanisms and clearer allocation of responsibilities across developers, healthcare providers and professionals.

Supporting research by the Health Foundation, the commission’s research partner, found that participants’ support for healthcare AI depended on safeguards, particularly accuracy and meaningful human oversight. Its separate report combines public polling with deliberative research on regulatory priorities.

Malaysia’s minister says AI Governance Bill draft is complete

Digital Minister Gobind Singh Deo said on September 10 that Malaysia’s AI Governance Bill draft was complete and would be submitted to Cabinet, Malay Mail reported. He expressed hope of tabling it this quarter or in the first quarter of 2027 and said enforcement arrangements were being prepared. These were plans for further steps, rather than an announcement of parliamentary introduction or enactment.

The earlier public consultation ran from July 10 to August 1. Its official record describes proposed central oversight and risk-based governance requirements. In its July 10 announcement, the Digital Ministry said the planned framework would complement existing laws and allocate governance responsibilities according to participants’ roles and control over AI systems.

BIS head warns about AI financing risks and policy challenges

BIS General Manager Pablo Hernández de Cos warned on September 10 that debt, private credit and concentrated valuations in the AI investment boom could create financial-stability vulnerabilities. His Mumbai speech stressed that AI’s benefits depend on policy choices, including skills, competition and data governance.

Reuters reported his concern that financing is becoming harder to assess as companies rely more on borrowing and interconnected arrangements. He called for caution, without predicting that a downturn was inevitable.

He said AI leaves central-bank mandates unchanged but makes economic monitoring and policy judgments more difficult. These were policy remarks, not an announcement of new binding requirements.

California signs Adam’s Law and wider child-safety package

Governor Gavin Newsom announced on September 10 that he signed SB 1119, known as Adam’s Law, as part of a package addressing companion chatbots, social media and children’s privacy. The announcement also lists AB 1709 on covered platforms, AB 1159 on student information and SB 867 on chatbot-enabled toys.

The Legislature’s enrolled SB 1119 text provides for risk assessments before new or substantially modified companion chatbots are released, child-safety policies and protective settings. Section 21812 makes those requirements operative July 1, 2027. It separately sets an initial independent-audit deadline of January 1, 2029, or before an operator first makes a chatbot publicly available, whichever is later, followed by audits every two years and additional audits for certain risk-increasing modifications. Before January 1, 2032, the audit section does not apply to operators with less than $500 million in gross revenue in the prior calendar year. Signing therefore does not make every obligation immediately operative.

KQED’s pre-signing reporting explains how the measure builds on earlier chatbot safeguards, including age checks, crisis support and limits on harmful interactions with children. The governor’s announcement establishes the subsequent signing; the legislative page reviewed still displayed the enrolled version.

SEC officials address AI disclosure risks at investor committee meeting

At the SEC’s September 10 Investor Advisory Committee meeting, Chair Paul Atkins said AI’s ability to analyze filings does not justify departing from materiality when setting disclosure requirements. He emphasized preparation costs, hallucination risks and the continuing need for human judgment. His published remarks expressly state that his views do not necessarily represent the Commission or other commissioners.

Commissioner Hester Peirce asked whether AI improves disclosure quality or increases errors and boilerplate, whether structured-data conventions could inhibit innovation, and whether large and small issuers face different costs. She warned against premature regulation while asking which AI issues were ready for Commission review.

XBRL US separately confirmed that its president and CEO, Campbell Pryde, participated in the AI panel. These materials document the meeting and officials’ policy views; the remarks are not an adopted AI disclosure rule or a committee recommendation.

See the earlier meeting-notice coverage.

Canada publishes provider-assessment guidance covering AI training data

Canada’s Privacy Commissioner published guidance on September 10 for businesses subject to the Personal Information Protection and Electronic Documents Act (PIPEDA) that use third-party services involving personal information. The regulator is accepting comments until December 4, after which it may revise the document.

The guidance recommends checking the source and lawful collection of AI training data, assessing whether consent is needed when a provider uses customer information for its own algorithm training, and examining risks such as bias, inaccuracy and discriminatory treatment. It also addresses data flows, contracts, subcontractors and ongoing monitoring.

These are recommended assessment practices supporting existing PIPEDA accountability obligations, rather than a newly enacted AI law. The guidance distinguishes recommended due diligence from organizations’ continuing responsibility for compliance. See Canada AI Law for related Canadian coverage.

Anthropic discloses disrupted AI misuse across seven harm areas

Anthropic disclosed on September 10 that it had disrupted misuse of Claude involving cyberattacks, surveillance and research that could support biological weapons, AP reported. The company’s report covers activity disrupted between December 2025 and August 2026, rather than incidents all occurring on the publication date.

Its case studies span seven areas, also including influence operations, scams and fraud, conventional weapons development and illicit model distillation. Anthropic says it used findings to strengthen safeguards and shared intelligence with authorities and industry partners where appropriate. It describes the examples as notable cases rather than a representative sample of all misuse.

These are the company’s investigative assessments and reported interventions, not court findings. The account of potentially harmful biological research does not establish that a biological weapon was produced.

GSA announces new government AI procurement agreement

On September 10, the General Services Administration announced a 27-month OneGov agreement with OpenAI, expected to take effect October 1. It provides no platform-access fee or minimum spending commitment and a 50% discount on token-based usage. Eligibility extends to federal, state, local and tribal governments. Agencies still pay for consumption.

GSA says the agreement incorporates its AI terms and conditions to protect government data and supports OMB Memorandum M-25-22, the federal AI acquisition policy. OpenAI says ChatGPT Enterprise business inputs and outputs are not used to train its models. These are procurement and service commitments announced by the parties.

Mobile World Live reports that the new arrangement follows the earlier $1-per-agency pilot, scheduled to end September 30. The announcement concerns a forthcoming offer, not a completed government-wide deployment.

Van Hollen requests OpenAI safety answers and federal assessment access

Senator Chris Van Hollen announced a September 10 letter asking Sam Altman for public answers by September 17 about OpenAI’s model-safety testing, monitoring and security practices. He urged access to technical information for researchers at NIST, NSA and CISA so they could assess model risks.

The letter also urges removal from public access where monitoring is insufficient to assure safety or concerns about misrepresented test capabilities remain unresolved. These are the senator’s requests and concerns, not a binding agency order or findings of liability.

AP reports that OpenAI responded to the senators’ inquiries by pointing to its investigation and published account of the Hugging Face incident and changes to security and alignment practices. The separate September 9 digest covers Senator Hawley’s earlier letter.

Meta plaintiffs denied nonparty AI discovery

In Chicken Soup for the Soul, Carreyrou/Cambronne and Cognella’s actions against Meta, Magistrate Judge Thomas S. Hixson denied motions to compel discovery from nonparties OpenAI and Anthropic on September 10. The requests concerned literary-output capabilities, licensing and torrenting. The court found shortcomings in relevance and proportionality and applied prior licensing-market reasoning; it did not decide Meta’s underlying copyright liability.

The litigation concerns alleged use of copyrighted books for AI development. Cognella’s May 4 complaint, for example, alleges unauthorized copying for Llama training and asserts copyright and copyright-management-information claims; those are the publisher’s allegations.

A separate September 10 order addressed the September 11 deadline for fact-discovery motions and allowed unilateral letter submissions if an opponent failed to cooperate. It left Meta’s requested extension concerning Cognella to District Judge Vince Chhabria.

Ninth Circuit denies rehearing in Amazon–Perplexity dispute

On September 10, 2026, the Ninth Circuit denied rehearing en banc in Amazon’s dispute with Perplexity AI. No judge requested a full-court vote, and the court granted leave to file an amicus brief. The denial leaves in place the appellate decision vacating the preliminary injunction concerning Perplexity’s Comet AI Assistant; it does not itself finally dismiss Amazon’s lawsuit.