A federal 48-hour rule went live Monday — and the EU just made nudifier AI prohibited outright.
The dominant tension this week wasn't capability versus alignment — it was timing versus scope. Western regulators delayed almost every horizontal AI Act deadline they could, while sharpening rules around specific harms: non-consensual intimate imagery, hiring discrimination, and platform liability. The result is a 2026 enforcement landscape that is narrower than promised, but harder where it counts.
Watch & Listen First
- The Rise of AI Public Safety — Bloomberg's Thursday segment on how state attorneys general are reframing AI harms as consumer-protection cases. Short, sharp, and currently the clearest mainstream framing of the May enforcement wave.
- For Humanity: An AI Risk Podcast — John Sherman's weekly run continued this week with a sober look at the OpenAI mission-alignment team dissolution and what internal safety governance at frontier labs even means now.
Key Takeaways
- Platforms now have 48 hours. The TAKE IT DOWN Act's notice-and-takedown duty became enforceable May 19; non-consensual intimate deepfakes must come down on receipt, full stop.
- Brussels bought time. The Digital Omnibus deal pushes Annex III high-risk obligations from August 2026 to December 2027 — a 16-month reprieve arriving with eight weeks to spare.
- Colorado folded. SB 26-189 repealed the duty-of-care, impact-assessment regime that was supposed to set a U.S. template. What's left is disclosure.
- Anthropic's $1.5B is real money. The Bartz fairness hearing closed with a 92.77% claims rate — a market price for unlicensed training, even before final approval lands.
- Audits became liability shields. Third-party bias audits have shifted from voluntary signal to the strongest evidentiary defense available in HR-tech discrimination cases.
The Big Story
Platform takedown duties under the TAKE IT DOWN Act became enforceable · May 19, 2026 · StackCyber tracker
→ The federal compliance window slammed shut Monday: any covered platform that receives a complaint about non-consensual intimate imagery has 48 hours to remove it, with no fair-use carve-out and no procedural delay. This is the first federally enforceable AI-content takedown duty in U.S. history, and it lands on top of the EU AI Act Omnibus deal adding an outright prohibition on AI tools used to generate non-consensual intimate content or CSAM, applicable from 2 December 2026. The mechanism is consequential because it sidesteps the harder fights about model regulation entirely — the obligation runs to platforms and to the inference layer, not the foundation labs. For the safety-minded reader: this is the architecture U.S. and EU enforcers will repeat for the next class of harms.
Also This Week
EU Digital Omnibus formally amends the AI Act timeline · May 7, 2026 · Consilium
→ High-risk obligations slip 16 months to December 2027 and product-embedded systems to August 2028; synthetic-content marking gets a four-month transparency-marking extension to December 2026 — softer headline rule, harder content rules underneath.
Colorado repeals its 2024 AI Act, replaces it with a transparency-only regime · May 14, 2026 · Davis Wright Tremaine
→ Polis signed SB 26-189 stripping out impact assessments and risk-management programs, leaving disclosure obligations effective January 1, 2027 — and the state AG has already said he won't enforce until rulemaking concludes.
European Commission publishes draft Article 50 transparency guidelines · May 8, 2026 · European Commission
→ Synthetic-content marking, chatbot disclosure, and biometric-categorisation notices are now specified in operational detail — this is the de-facto compliance roadmap for any provider serving the EU market.
Bartz v. Anthropic fairness hearing closes with 92.77% claims rate · May 14, 2026 · Authors Alliance
→ The $1.5B settlement now awaits Judge Martínez-Olguín's final approval order — the precedent is that bulk-licensing training data, not fair-use bravado, is the cheapest path forward.
Turow plus five publishers file class action against Meta and Zuckerberg · May 5, 2026 · NPR
→ The next training-data case lines up against Llama — and unlike Bartz, it names the CEO personally.
From the Lab
Defensive Refusal Bias: How Safety Alignment Fails Cyber Defenders · arXiv 2603.01246
→ The paper documents a measurable cost to RLHF safety training: aligned models systematically refuse legitimate security work, blunting the same defenders the safety case is meant to protect. It's a useful corrective to the narrative that refusal equals safety, and a sharper input to the constitutional-AI design question of whose harm gets weighted in the loss function.
Worth Reading
- Colorado pulls back on AI regulation — DLA Piper's read on why the duty-of-care model collapsed and what enforcement actually looks like under a disclosure-only regime.
- EU AI Act Update: Timeline Relief, Targeted Simplification, and New Prohibitions — Covington's clean walkthrough of what got delayed, what got added, and what the new "no significant risk" exception will do in practice.
- What Authors Need to Know About the Anthropic Settlement — The Authors Guild's plain-English breakdown of how the $1.5B actually flows, useful even for non-rightsholders trying to model future settlement economics.
The regulatory mood this month is not de-escalation — it's triage. The headline deadlines are slipping; the floor under the worst content is rising. Both moves count.