What We Are Building

Rules on how financial firms may use artificial intelligence are arriving in the European Union, the United States and the United Kingdom at the same time, in three different shapes. The European Union has a statute: a lender that uses an AI system to score individuals’ creditworthiness is a “deployer” of a high-risk system, with duties that apply from 2 December 2027, a date the EU moved back by 487 days in July 2026, and fines of up to €15 million or 3% of worldwide turnover. The United States has a contest: states passed 150 AI-related laws in 2025, Colorado repealed and re-enacted its own, the SEC proposed and then withdrew a rule on predictive analytics, and a December 2025 executive order called for a federal framework that “preempts State AI laws”. The United Kingdom has a posture: five non-statutory principles, no new rules, and an existing Consumer Duty, in a market where 75% of surveyed firms already use AI. The same activity, scoring a borrower or generating an advertisement, triggers a separately worded duty in each place. That multiplication, not any single rule, is the first problem Reg42 is building for. The design is described near the end, with every capability stated as a target.

In this piece: three regimes, one year; the European statute; the American contest; the British posture; one activity, three duties; what the system is meant to do; why AI rules come first.

Three regimes, one year

Financial regulation normally arrives one topic at a time, and a firm’s compliance program grows one appendix at a time. Rules on artificial intelligence are not arriving that way. Between February 2025 and August 2028 the EU AI Act applies in seven steps.¹ In 2025 alone, US states passed 150 AI-related laws and the Stanford AI Index recorded 58 AI-related federal regulations.⁸ In the UK, the FCA has told firms that its existing rules apply to AI and that it does not plan to introduce extra regulations for it.¹⁵

For a firm that operates in all three, the question is not which regime is strictest. It is how many separately worded duties attach to one decision, and how a program that was built for one regime absorbs the other two. The evidence below is arranged to answer that question. The reader should expect it to cut both ways: in two of the three jurisdictions, national authorities have since 2025 withdrawn proposed AI rules for financial firms or declined to add new ones, and that is reported as found.

The European statute

Regulation (EU) 2024/1689, the AI Act, sorts AI systems by use. Annex III lists uses the Act treats as high-risk. Two of them sit in the middle of financial services: point 5(b), “AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of AI systems used for the purpose of detecting financial fraud”, and point 5(c), “AI systems intended to be used for risk assessment and pricing in relation to natural persons in the case of life and health insurance”.² A bank that uses an AI system to score individual loan applicants, or an insurer that uses one to price life cover, is operating a high-risk system under the Act’s own words.

Article 16 sets out the obligations of the “provider”, the body that develops a system, or has one developed, and places it on the market or puts it into service under its own name. But the Act also defines a “deployer”: “a natural or legal person, public authority, agency or other body using an AI system under its authority”.⁶ A financial firm that uses such a system is a deployer, and Article 26 gives deployers twelve paragraphs of duties: use the system in line with the provider’s instructions and “take appropriate technical and organisational measures”; “assign human oversight to natural persons who have the necessary competence, training and authority”; where the deployer controls the input data, “ensure that input data is relevant and sufficiently representative”; monitor operation and report serious incidents; keep the automatically generated logs for at least six months; inform workers’ representatives before using a system at work; and, for Annex III systems that make or help make decisions about people, “inform the natural persons” that the system is in use.³

A second set of duties does not depend on the high-risk label. Article 50 requires that people interacting with an AI system “are informed that they are interacting with an AI system”, that synthetic audio, image, video or text outputs “are marked in a machine-readable format” and are “detectable as artificially generated or manipulated”, and that deployers of deep fakes “disclose that the content has been artificially generated or manipulated”.⁴ The first two duties fall on providers and the deep-fake duty on deployers, so a marketing department that uses a generative model to make voice messages or video that count as deep fakes has a disclosure duty under Article 50(4), whatever it thinks of Annex III.

The dates matter because they have already moved. As adopted in 2024, the Act applied in general from 2 August 2026, and the Annex III duties fell under that date. On 8 July 2026 the EU adopted Regulation (EU) 2026/1744, the “Digital Omnibus on AI”, which entered into force on 27 July 2026, six days before the general application date. The consolidated Article 113 now reads: the rules in Chapter III, Sections 1 to 3, apply from “2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III” and from “2 August 2028 as regards AI systems classified as high-risk pursuant to Article 6(1) and Annex I”.¹ Computed for this article, the Annex III deferral is 487 days. The omnibus also added a transitional rule: providers of generative systems already on the market before 2 August 2026 have until 2 December 2026 to comply with the Article 50(2) marking duty.⁴

Two readings of that change are possible and both are fair. One is that the EU has become less demanding: a 16-month reprieve for lenders is a real reprieve. The other is that a firm which had built its 2026 program against the 2024 text had to rewrite its dates within weeks of the old deadline. On that reading the Act did not get simpler; it got different. A compliance program that stores its obligations clause by clause can absorb such a change as a change to specific entries. A program held in policy documents and spreadsheets has to find every place the old date was written down.

The maximum fines have not moved. Article 99 sets three tiers: up to €35 million or 7% of total worldwide annual turnover for prohibited practices; up to €15 million or 3% for breaches of the operator duties, a list that names Articles 26 and 50; up to €7.5 million or 1% for supplying incorrect, incomplete or misleading information to authorities. In each case the higher figure applies, except for SMEs and start-ups, for whom the lower applies; the omnibus added the same lower cap for small mid-cap enterprises (SMCs) in the two lower tiers.⁵ These are maximums, not expected fines, and the Article 26 duties they back do not apply to Annex III systems until 2 December 2027.

The American contest

The United States has no federal AI statute for financial firms. What it has instead is a layered contest between states, agencies and the White House, and a firm has to read all three layers.

Start with the states. The Stanford AI Index counts AI-related bills passed into law by US states: one in 2016, 49 in 2023, 131 in 2024 (restated as 132 in the 2026 edition’s data) and 150 in 2025. In 2025 California passed 20, Texas 12 and New York 10. The Index describes state policies as “developing across different tracks, including targeted protections against discrimination, misinformation, and abuse”, and does not say how many of the laws touch financial firms.⁸ But each is a text a nationwide firm has to read to find out.

Colorado shows what a broad one looks like, and how fast it can change. SB 24-205, enacted in 2024, required developers and deployers of high-risk AI systems to “use reasonable care to protect consumers from any known or reasonably foreseeable risks of algorithmic discrimination”, with impact assessments, risk management policies and consumer notices for consequential decisions. Its start was pushed to June 2026 in a special session in August 2025, and on 27 April 2026 a federal court ordered the state Attorney General not to begin enforcing it, an order that extends to “any legislation amending SB 24-205”. In the 2026 session the legislature passed SB 26-189, signed into law on 14 May 2026, which, in the words of the official fiscal note, “repeals and reenacts the standards and requirements for the development and use of artificial intelligence (AI) systems initially created in Senate Bill 24-205”. The new law takes effect on 1 January 2027. It drops the high-risk label for “automated decision-making technology”, keeps, in the fiscal note’s words, “financial and lending services” among the covered domains, requires developers and deployers to make disclosures from that date, including notice to consumers, treats a breach as a deceptive trade practice with a civil penalty of up to $20,000 per violation, and gives firms a right to cure that “expires on January 1, 2030”.⁷ A lender that built a Colorado program in 2025 therefore built it against a law that was never enforced and that, from 1 January 2027, is replaced by a different text.

Now the federal agencies. The Index records 25 AI-related federal regulatory actions in 2023, 59 in 2024 and 58 in 2025.⁸ For securities firms, the action to note is a proposal that failed. On 26 July 2023 the SEC proposed rules on “Conflicts of Interest Associated with the Use of Predictive Data Analytics by Broker-Dealers and Investment Advisers”, aimed at conflicts of interest in firms’ “interactions with investors” through technologies that “optimize for, predict, guide, forecast, or direct investment-related behaviors or outcomes”. On 12 June 2025 the Commission formally withdrew it, together with thirteen other proposals from 2022 and 2023, stating that it “does not intend to issue final rules with respect to these proposals”.⁹

What remains for broker-dealers is the existing rulebook, read through a technology-neutral lens. FINRA’s Regulatory Notice 24-09 of 27 June 2024 says that FINRA “intends for its rules and guidance to be technologically neutral”, that “the content standards of Rule 2210 (Communications with the Public) apply” to AI-generated communications, that Rule 3110 supervision applies, and that the Notice “does not create new legal or regulatory requirements or new interpretations of existing requirements”.¹⁰ The posture resembles the UK’s more than the EU’s: no new duty, but every old duty now has to be shown to hold for a model.

Alongside the rules sits a voluntary framework. NIST published the AI Risk Management Framework 1.0 on 26 January 2023, as directed by the National Artificial Intelligence Initiative Act of 2020, describing it as “voluntary, rights-preserving, non-sector specific, and use-case agnostic”.¹¹ It binds no one; unlike the state laws, it is one text for every state.

The third layer is the White House, and here the direction is explicit. The July 2025 AI Action Plan recommended that agencies with AI-related discretionary funding “consider a state’s AI regulatory climate when making funding decisions”, and that NIST “revise the NIST AI Risk Management Framework to eliminate references to misinformation, Diversity, Equity, and Inclusion, and climate change”.¹² Executive Order 14365 of 11 December 2025, “Ensuring a National Policy Framework for Artificial Intelligence”, states that “State-by-State regulation by definition creates a patchwork of 50 different regulatory regimes”, orders an AI Litigation Task Force within 30 days, directs Commerce to identify “onerous” state laws within 90 days, and calls for a “legislative recommendation establishing a uniform Federal policy framework for AI that preempts State AI laws”.¹³ The order does not itself pre-empt any state law. It names Colorado’s law as an example of the problem it describes;¹³ Colorado’s rewrite was signed five months later, and the final fiscal note does not mention the order.⁷

The American picture, then, is of rules multiplying at the state level, a federal government trying to thin them, and sector regulators declining to add any. For a firm this is not a lighter load than the EU’s. It is a different kind of load: a larger number of shorter texts, each with its own date, and one of them, Colorado’s, under a federal court order.

The British posture

The United Kingdom chose a third path, and its financial regulator has held to it. The March 2023 white paper from the Department for Science, Innovation and Technology, “A pro-innovation approach to AI regulation”, set out five cross-sectoral principles: “Safety, security and robustness”; “Appropriate transparency and explainability”; “Fairness”; “Accountability and governance”; “Contestability and redress”. It said the principles “will be issued on a non-statutory basis and implemented by existing regulators”, that the approach “will not involve the creation of a new AI (Artificial Intelligence) regulator”, and that “We will not assign rules or risk levels to entire sectors or technologies.”¹⁴

The FCA translated that into its own vocabulary in its 2024 AI Update, describing itself as “a technology-agnostic, principles-based and outcomes-focused regulator” and showing “how some of the key elements of our existing regulatory framework map to each of these principles”. Two of the elements it maps are central to this article. The first is the Consumer Duty: “AI can also raise risks for consumers, and firms should consider their obligations under the Consumer Duty.” The second is the Senior Managers and Certification Regime, which “emphasises senior management accountability and is relevant to the safe and responsible use of AI”. The FCA’s current approach page is blunter: “We do not plan to introduce extra regulations for AI.”¹⁵

The firms this posture governs are already well into the technology. The Bank of England and FCA surveyed UK financial firms in 2024 and received 118 responses. Of those, “75% of firms are already using artificial intelligence (AI)” with “a further 10% planning to use AI over the next three years”, against 58% and 14% in the 2022 survey. “55% of all AI use cases have some degree of automated decision-making”; “One third (33%) of AI use cases are reported as external or third-party implementations”; foundation models “form 17% of all AI use cases”; and “84% of firms reported having an accountable person for their AI framework”.¹⁶ The 2022 survey drew 71 responses and the 2024 survey 118, so the samples differ and the comparison is indicative rather than precise. By subtraction, computed for this article, 16% of firms did not report an accountable person for their AI framework.

Where is the AI? Today the area named most often is “optimisation of internal processes (41% of respondents)”, followed by cybersecurity (37%) and fraud detection (33%). Where is it going? Towards the customer and towards the compliance function itself: an additional 36% of firms expect to use AI for customer support including chatbots within three years, and an additional 32% for regulatory compliance and reporting.¹⁶ The second figure is the one this series of articles is about; the first is the one the Consumer Duty is about.

Asked which rules constrain their adoption of AI, firms named existing ones. Data protection and privacy was the largest regulatory constraint, with 23% calling it large, 29% medium and 10% small. The report lists resilience and cyber security rules (12%, 22%, 17%) and the FCA Consumer Duty and conduct rules (5% large, 21% medium, 23% small) among the other notable constraints; the Duty’s three shares add to 49% of firms naming it as some constraint, computed for this article.¹⁶ That is the British mechanism in one number. No AI rule was written, and 49% of responding firms still report an existing conduct rule as a constraint on adopting the technology.

One activity, three duties

Put the three regimes side by side and the multiplication is visible. Take two things a financial firm might do with a model in 2027, and read what each jurisdiction says about it.

Three things stand out from the table. The duties are real in all three places, but only the EU writes them down as AI duties for the whole jurisdiction; in the US that happens state by state, and at federal level, as in the UK, they have to be inferred from older text. The dates differ: 2026, 2027 and “now”. And none of the three regimes uses the others’ vocabulary. “Deployer”, “automated decision-making technology” and “Consumer Duty outcomes” describe overlapping obligations in words that share almost nothing. A firm that enters a second jurisdiction cannot copy its first program; it has to rebuild the mapping from scratch, in a new language, against a different calendar.

The marketing row deserves a closer look because the UK already publishes enforcement data for it. The FCA counts financial promotions amended or withdrawn after its intervention: 573 in 2021, 8,582 in 2022, 10,008 in 2023 and 19,766 in 2024, a 34.5-fold rise in three years computed for this article. The FCA ties part of the jumps to its own sector work: its intervention with lenders and brokers after a Dear CEO letter in May 2022 accounted for 7,191 of the 2022 total, which it calls one of the contributing factors, and its engagement with 46 claims management firms accounted for 9,197 of the 2024 total; of 2024 it says “we increased our interventions in response to failures in financial promotions”.¹⁷ The series measures regulatory attention as much as market behaviour. But it also shows the volume of interventions a single conduct duty already generates. Article 50 in the EU and Rule 2210 in the US now sit on top of the same activity.

What the system is meant to do

This article describes what Reg42 is building, and it does so on one condition: every capability below is a design intent or a target. None of it is a working fact, and nothing in the evidence above depends on it.

The starting point is a language rather than a product. CLHEAR is an open standard, in development, for describing a compliance program in one common form. The standard proposes to describe seven kinds of thing: the rule text itself, kept verbatim and split along its own structure; the duties that text creates; the roles the text addresses, such as the EU’s “deployer” or Colorado’s “developer”; the documents a duty calls for; the systems a duty touches; the processes by which the duty is discharged; and the profile of the firm, meaning the facts about it (jurisdictions, licences and other conditions) that decide which duties apply. The intent is that a clause in the AI Act, a section of SB 26-189 and a paragraph of the FCA Handbook can all be written in the same form, so that a reader, or a machine, can see where they overlap and where they do not.¹⁸

CLHEAR is published under the GNU Affero General Public License v3.0, in a public repository at github.com/Reg42-ai/clhear.¹⁸ The licence choice is deliberate: a language that only one company can read is not a language, and a regulator or auditor asked to trust a machine-drawn map has a stronger case for trusting one whose grammar is public and whose derivation can be re-run. The repository states that the engine ships with no regulatory texts loaded; a firm brings the texts it is bound by.

Reg42 is building the system that runs a program on top of that language. The design has three steps, and each is stated as what the system is intended to do, not what it does today.

1. Map. Read the rule texts a firm has chosen and write out, in CLHEAR form, what they require of a firm with that profile: every duty, linked to the clause it came from. The target is that a change such as the July 2026 move of the Annex III date appears as a change to specific duties and to everything connected to them, rather than as a search across documents.
2. Compare. Describe what the firm actually has, its policies, roles, committees, systems and evidence, in the same language, and set it against the map. The gap between the two is the diagnosis. The target is that the firm knows its compliance score, the share of its duties that are evidenced as met, at any moment rather than at audit time.
3. Comply. Close the gaps, with software doing the drafting, matching and monitoring and accountable people deciding and signing. The target is that any compliance question (which duties does this model trigger in Colorado; who is the accountable person for the firm’s credit-scoring system under Article 26(2); which promotions used generated video last quarter) is answered with its evidence in 60 seconds.

Two design constraints run through all three steps. The system is intended to run inside the firm’s own cloud account, so that rule texts, policies and evidence never leave the firm’s perimeter; this is a design decision, not yet a deployed configuration. And at every point where a duty is matched, a gap is declared or a control is changed, the design requires a named person to sign. The machine proposes; the person disposes. That mirrors what the EU and UK texts ask for in their own words, Article 26(2)’s “natural persons who have the necessary competence, training and authority” and the SM&CR’s “senior management accountability”, and what 84% of UK firms surveyed already report: “an accountable person for their AI framework”.³¹⁵¹⁶

Reg42 states three targets for the system, and labels them as targets: to cut a firm’s total compliance cost by 80%; to let the firm know its compliance score at any moment; and to answer any compliance question in 60 seconds. No figure in this article is evidence that any of the three has been reached. They are the numbers against which the project asks to be judged.

Why AI rules come first

A system like this could be pointed at any part of the rulebook. Reg42 is pointing it first at AI rules across the EU, the US and the UK, and the evidence above gives three reasons that do not depend on taking Reg42’s word for anything.

First, the regime is new. The deployer duties of Article 26 apply from 2 December 2027; Colorado’s disclosures from 1 January 2027; FINRA’s and the FCA’s readings of their existing rules from 2024.¹⁷¹⁰¹⁵ The Article 26 and Colorado duties do not yet apply, so no program built for them has yet been tested by enforcement. A map drawn now is drawn on a mostly blank sheet.

Second, it arrives in three jurisdictions at once, in three vocabularies. That is a demanding test of a common language, and therefore an informative one. If the same duty can be written once and shown to satisfy “deployer”, “automated decision-making technology” and “Consumer Duty outcomes” together, the method has been tested where word-matching fails. If it cannot, that will be visible early.

Third, the texts keep moving, and the evidence shows the cost of that. The EU moved its dates within weeks of the deadline. Colorado repealed and re-enacted its law before it was ever enforced. The SEC proposed and withdrew. A program that stores its duties clause by clause, with lineage to the text, can absorb such changes as edits. A program held in people’s heads absorbs them by hiring.

Against those reasons, two facts cut the other way and should be stated. At national level, the US and UK actions on financial firms reported here since 2025 have withdrawn a proposed AI rule or declined to add new ones: the SEC withdrew its predictive analytics proposal, and the FCA says it does not plan extra regulations for AI.⁹¹⁵ A system whose first market is AI compliance is therefore betting that reading old rules against new technology is as much work as reading new rules; the UK survey’s 49% of firms naming the Consumer Duty as a constraint on AI is the evidence for that bet, and it is survey evidence.¹⁶ And the EU’s deferral means the Article 26 deployer duties for Annex III systems do not apply before 2 December 2027, which gives the project time and also removes, for now, an obvious forcing event. Whether a common language earns its place in that window is the question the rest of this series, and the repository, will have to answer in public.

Notes and sources

1. European Commission, AI Act Service Desk, consolidated Article 113 and Article 111 of Regulation (EU) 2024/1689, based on the EUR-Lex consolidated version as at 27 July 2026, with points (a), (c), (c)(i) and (c)(ii) of Article 113 marked as amended and point (d) and Article 111(4) marked as new. Article 113: the Regulation "shall apply from 2 August 2026"; point (a), Chapters I and II from 2 February 2025, except Article 5(1), first subparagraph, points (ba) and (bb), and Article 5(1a) and (1b) (new prohibitions on non-consensual intimate imagery and child sexual abuse material), "which shall apply from 2 December 2026"; point (b), Chapter III Section 4, Chapters V (general-purpose AI models), VII (governance) and XII (penalties) and Article 78 from 2 August 2025, except Article 101; point (c), "Chapter III, Sections 1, 2, and 3, with the exception of Article 6(5), shall apply from" 2 December 2027 (Annex III) and 2 August 2028 (Annex I); point (d), "Articles 102 to 110 shall apply from 27 July 2026." The amending act is Regulation (EU) 2026/1744 of 8 July 2026 (Digital Omnibus on AI), published in the Official Journal on 24 July 2026; its EUR-Lex record gives 27 July 2026 as the date of entry into force. Its recital 40 gives the "initial date of application" of those Chapter III obligations as "2 August 2026" and says the date "is set to 2 December 2027 for AI systems classified as high-risk pursuant to Article 6(2) and Annex III, and to 2 August 2028 for AI systems classified as high-risk pursuant to Article 6(1) and Annex I"; its recital 1 says the 2024 text brought all rules into application "by 2 August 2027". The operative part of the amending act could not be read in full on EUR-Lex for this article; the dates above are from the Commission’s consolidated text and agree with recital 40. The deferral of Annex III duties is computed as 2 August 2026 to 2 December 2027, 487 days (16 months).
2. Regulation (EU) 2024/1689, Annex III, point 5(b): "AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of AI systems used for the purpose of detecting financial fraud"; point 5(c): "AI systems intended to be used for risk assessment and pricing in relation to natural persons in the case of life and health insurance".
3. Regulation (EU) 2024/1689, Article 26, Obligations of deployers of high-risk AI systems, paragraphs 1 to 12; paragraph 2: "Deployers shall assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support." The consolidated text shows no amendment markers on this article.
4. Regulation (EU) 2024/1689, Article 50, Transparency obligations for providers and deployers of certain AI systems, paragraphs 1, 2 and 4 (paragraphs 1 and 2 begin "Providers"; paragraph 4 begins "Deployers"); Article 111(4), new, gives providers of generative systems already on the market before 2 August 2026 until 2 December 2026 to meet Article 50(2).
5. Regulation (EU) 2024/1689, Article 99, Penalties, consolidated text: paragraph 3, "up to EUR 35 000 000 or, if the offender is an undertaking, up to 7 % of its total worldwide annual turnover for the preceding financial year, whichever is higher"; paragraph 4, "up to EUR 15 000 000 or, if the offender is an undertaking, up to 3 %"; paragraph 5, "up to EUR 7 500 000 or, if the offender is an undertaking, up to 1 %"; paragraph 6, for SMEs including start-ups, "whichever thereof is lower"; paragraph 6a, marked as new, "In the case of SMCs, each fine referred to in paragraphs 4 and 5 shall be up to the percentages or amount referred therein, whichever is lower." Paragraph 4 lists "obligations of deployers pursuant to Article 26" and "transparency obligations for providers and deployers pursuant to Article 50". Paragraph 1 is marked as amended and paragraph 4, point (da), as new; the amounts in paragraphs 3 to 5 carry no marker. Article 3, point (14b), new, defines an SMC as a small mid-cap enterprise under Recommendation (EU) 2025/1099.
6. Regulation (EU) 2024/1689, Article 3, point (3) "provider": "a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model", or has one developed, and places it on the market or puts it into service under its own name or trademark; point (4) "deployer": "a natural or legal person, public authority, agency or other body using an AI system under its authority", except in personal non-professional use. Article 16, Obligations of providers of high-risk AI systems.
7. Colorado General Assembly, SB 24-205, Consumer Protections for Artificial Intelligence (2024), summary of the bill as enacted: developers and deployers of a high-risk system must "use reasonable care to protect consumers from any known or reasonably foreseeable risks of algorithmic discrimination", with a risk management policy and program, an impact assessment and notice to a consumer if the system makes, or will be a substantial factor in making, a consequential decision. SB 26-189, Automated Decision-Making Technology: status "Became Law"; bill history, 14 May 2026, "Governor Signed". Signed act, section 5: "this act takes effect January 1, 2027", except the provisions listed in its subsection (2), and "applies to consequential decisions made on or after January 1, 2027". Legislative Council Staff, Final Fiscal Note, 8 September 2026, which "reflects the enacted bill": "This bill repeals and reenacts the standards and requirements for the development and use of artificial intelligence (AI) systems initially created in Senate Bill 24-205"; "Beginning on January 1, 2027, developers and deployers of artificial intelligence systems must provide certain disclosures" about "automated decision-making technology" (ADMT); covered domains include "financial and lending services"; deployers "must notify consumers that the decision uses ADMT"; violations are "a deceptive trade practice"; a civil penalty "of up to $20,000 for each violation"; the right to cure "expires on January 1, 2030"; SB 24-205: "Implementation of the bill was delayed until June 2026 during the special legislative session in August 2025"; "On April 27, 2026, the Attorney General was ordered by U.S. District Court to not initiate enforcement of SB 24-205 or any legislation amending SB 24-205" until rule-making is complete and the court rules in X. AI LLC v. Weiser. Earlier versions: initial fiscal note, 4 May 2026; first revised, 6 May 2026. The final fiscal note does not mention Executive Order 14365.
8. Stanford HAI, AI Index Report 2026, chapter 8: "the total number of AI-related bills passed increased from fewer than 10 in 2020 to 150 in 2025" (figure 8.4.4); "California enacted 20 AI-related bills, double the total in New York (10) and two-thirds more than Texas (12)" in 2025; Missouri and Rhode Island "have not enacted any AI-related legislation to date"; "State policies are developing across different tracks, including targeted protections against discrimination, misinformation, and abuse"; the number of federal AI-related regulations rose "from one recorded action in 2016 to 58 in 2025" (figure 8.4.10), covering "federal rules and executive orders". The chapter does not link state AI laws to financial firms. The 2026 edition’s public data files give 132 state laws for 2024 (fig_8.4.4.csv) and 1, 25, 59 and 58 federal regulations for 2016, 2023, 2024 and 2025 (fig_8.4.10.csv). Stanford HAI, AI Index Report 2025, chapter 6: "Only one such bill was passed in 2016, rising to 49 by 2023"; "In the past year alone, that number more than doubled to 131" (figure 6.2.9); "In 2024, 59 AI-related regulations were introduced", "more than double the 25 recorded in 2023" (figure 6.2.19), found by "a keyword search for 'artificial intelligence' on the Federal Register". Other per-year values were not used.
9. US Securities and Exchange Commission, Conflicts of Interest Associated with the Use of Predictive Data Analytics by Broker-Dealers and Investment Advisers, Release Nos. 34-97990 and IA-6353, proposed 26 July 2023, 88 FR 53960 (9 August 2023), file S7-12-23; summary: proposed rules "to eliminate, or neutralize the effect of, certain conflicts of interest associated with broker-dealers’ or investment advisers’ interactions with investors through these firms’ use of technologies that optimize for, predict, guide, forecast, or direct investment-related behaviors or outcomes" (Federal Register). Withdrawal: Withdrawal of Proposed Regulatory Actions, Release Nos. 33-11377, 34-103247, IA-6885 and IC-35635, dated 12 June 2025, 90 FR 25531 (17 June 2025): the Commission "is formally withdrawing certain notices of proposed rulemaking issued between March 2022 and November 2023"; 14 proposals in all, including file S7-12-23; the Commission "does not intend to issue final rules with respect to these proposals".
10. FINRA, Regulatory Notice 24-09, FINRA Reminds Members of Regulatory Obligations When Using Generative Artificial Intelligence and Large Language Models, 27 June 2024: "FINRA intends for its rules and guidance to be technologically neutral"; "the content standards of Rule 2210 (Communications with the Public) apply whether member firms’ communications are generated by a human or technology tool"; "pursuant to Rule 3110 (Supervision), a member firm must have a reasonably designed supervisory system tailored to its business"; "This Notice does not create new legal or regulatory requirements or new interpretations of existing requirements".
11. NIST, Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1, published 26 January 2023, "As directed by the National Artificial Intelligence Initiative Act of 2020 (P.L. 116-283)"; "The Framework is intended to be voluntary, rights-preserving, non-sector specific, and use-case agnostic."
12. The White House, Winning the Race: America’s AI Action Plan, July 2025, recommended policy actions: "Led by OMB, work with Federal agencies that have AI-related discretionary funding programs to ensure, consistent with applicable law, that they consider a state’s AI regulatory climate when making funding decisions"; "Led by DOC through the National Institute of Standards and Technology (NIST), revise the NIST AI Risk Management Framework to eliminate references to misinformation, Diversity, Equity, and Inclusion, and climate change"; regulatory sandboxes "would be enabled by regulatory agencies such as the Food and Drug Administration (FDA) and the Securities and Exchange Commission (SEC)".
13. Executive Order 14365 of 11 December 2025, Ensuring a National Policy Framework for Artificial Intelligence, 90 FR 58499 (16 December 2025), section 1: "State-by-State regulation by definition creates a patchwork of 50 different regulatory regimes that makes compliance more challenging, particularly for start-ups"; "For example, a new Colorado law banning 'algorithmic discrimination' may even force AI models to produce false results"; section 3, "Within 30 days of the date of this order, the Attorney General shall establish an AI Litigation Task Force"; section 4, Commerce to "publish an evaluation of existing State AI laws that identifies onerous laws" within 90 days; section 8(a), a "legislative recommendation establishing a uniform Federal policy framework for AI that preempts State AI laws". The order contains no provision that itself preempts a state law.
14. Department for Science, Innovation and Technology, A pro-innovation approach to AI regulation, white paper presented to Parliament 29 March 2023: "5 values-focused cross-sectoral principles". Principles: "Safety, security and robustness"; "Appropriate transparency and explainability"; "Fairness"; "Accountability and governance"; "Contestability and redress". "Instead, the principles will be issued on a non-statutory basis and implemented by existing regulators"; the approach "will not involve the creation of a new AI (Artificial Intelligence) regulator"; "We will not assign rules or risk levels to entire sectors or technologies."
15. FCA, AI Update, first published 22 April 2024 according to its publication page: "the FCA is a technology-agnostic, principles-based and outcomes-focused regulator"; "AI can also raise risks for consumers, and firms should consider their obligations under the Consumer Duty"; the Senior Managers and Certification Regime "emphasises senior management accountability and is relevant to the safe and responsible use of AI"; the paper shows "how some of the key elements of our existing regulatory framework map to each of these principles". FCA, AI and the FCA: our approach, first published 8 September 2025, last updated 2 October 2026: "We do not plan to introduce extra regulations for AI"; "In 2024, we published our AI Update setting out how our existing rules apply to AI."
16. Bank of England and Financial Conduct Authority, Artificial intelligence in UK financial services 2024, 21 November 2024, section 1.2: "The survey received 118 responses". "75% of firms are already using artificial intelligence (AI)" with "a further 10% planning to use AI over the next three years", against "58% and 14% respectively" in 2022. "55% of all AI use cases have some degree of automated decision-making"; "One third (33%) of AI use cases are reported as external or third-party implementations"; "Foundation models form 17% of all AI use cases"; "84% of firms reported having an accountable person for their AI framework". Section 2.4: "The area with the highest percentage of respondents using AI is optimisation of internal processes (41% of respondents)", followed by "cybersecurity (37%) and fraud detection (33%)"; "Over the next three years, an additional 36% of respondents expect to use AI for customer support (including chatbots), 32% for regulatory compliance and reporting, 31% for fraud detection, and 31% for optimisation of internal processes"; "Note that these are increases over the existing number of use cases." Section 4.4: "Data protection and privacy was noted by respondents as the greatest regulatory constraint", with "23% identifying it as a large constraint, 29% as medium, and 10% as a small constraint"; "Other notable regulatory constraints include resilience and cyber security rules (12% of firms consider it a large constraint, 22% medium, 17% small), and FCA Consumer Duty and conduct (5% large, 21% medium, 23% small)". The 2022 joint survey, Bank of England and FCA, Machine learning in UK financial services, 11 October 2022: "In total, 168 firms received the questionnaire and 71 submitted responses (42% overall response rate)."
17. FCA, financial promotions data for 2022 ("In relation to authorised firms, following our intervention, last year we had 8,582 promotions amended/withdrawn which is an increase of 1398%, compared to 573 in 2021"; lenders and brokers: "We issued a Dear CEO letter in May 2022 warning c28,000 lenders and brokers"; "Our intervention in this sector has resulted in 7,191 promotions being amended or withdrawn", "one of the contributing factors to the significant increase in our amend and withdraw outcomes for 2022"), 2023 ("10,008 promotions amended/withdrawn which is an increase of 16.6%, compared to 8,582 in 2022"; proactive work: "1401 (14% of the 10,008)") and 2024 ("for authorised firms we had 19,766 promotions amended/withdrawn", "an increase of 97.5%, compared to 10,008 in 2023"; "In 2024 we increased our interventions in response to failures in financial promotions"; "our engagement with 46 authorised CMCs resulted in 9,197 financial promotions being amended/withdrawn"; proactive work: "1,633 (8% of the 19,766)"; "we issued 2,240 alerts in 2024" about unauthorised firms). The 2021 to 2024 multiple, 34.5, is computed for this article as 19,766 divided by 573.
18. Reg42-ai, github.com/Reg42-ai/clhear, a public repository; LICENSE file: GNU Affero General Public License v3.0 (SPDX AGPL-3.0), as reported by the GitHub API on 20 October 2026. The README describes the engine’s current layers (sources, obligations, components, profile attributes and applicability, compliance activities, composition), lists jurisdictions, roles, conditions and licences as the organisation’s profile attributes, and states that "CLHEAR ships with no texts loaded". The seven kinds of thing listed in the text are Reg42’s statement of design intent, as set out in the founder letter that accompanies this series, not a description of the repository’s current layers.
19. Directive 2014/65/EU (MiFID II), Article 24(3), ESMA Interactive Single Rulebook: "All information, including marketing communications, addressed by the investment firm to clients or potential clients shall be fair, clear and not misleading." FCA Handbook, COBS 4.2.1R(1): "A firm must ensure that a communication or a financial promotion is fair, clear and not misleading."