Ten Stories, and Half of Them Weren't True the Way They First Sounded

NYC's AI Moratorium Has a Backstory: A Teacher "Stoplight" Policy Nobody Talked About

Okay so NYC just told public schools "no ChatGPT till 9th grade" and I have thoughts, but also a plot twist I didn't know about until I went digging.

The headline part first, because it's a big deal. Mamdani and the new chancellor rolled out what they're calling the country's biggest generative AI moratorium in schools, and it's not a soft suggestion, it's a real rule. Kids from pre-K through 8th grade can't use generative AI in class at all, and companion chatbots, the "AI friend" kind, are banned for literally every grade, even high school. There's screen time caps too now, 30 minutes a day max for grades 3-5, 45 minutes for 6-8. High schoolers get a little breathing room, some small supervised pilot programs, plus twice-a-year lessons on how AI actually works and where it messes up. It's only for one year — they want to study what happens before deciding what's next.

But here's the part that surprised me. That ban is only about students. Turns out back in March, months before any of this, the city already put out a completely separate rulebook for teachers, and it's basically a stoplight. Like an actual red light green light system. Green means go — brainstorming a lesson plan, drafting a boring email. Yellow means a human has to check it first — translating for families who don't speak English, tweaking material for a kid with a disability. Red is just never, full stop — grading papers, discipline decisions, anything to do with an IEP, counseling a kid in crisis.

And I have to add this because it's not like everyone just clapped and moved on. The stoplight policy actually got delayed because of real backlash — parents packed public meetings, over half the City Council signed a letter, almost 6,500 people left comments on the draft. The chancellor himself admitted the draft "missed the mark" and called AI "the most invasive technology that we've seen." And the ban that came out of all that is now getting hit from the other direction — tech investors calling it bad policy that mostly hurts kids who can't afford AI access at home anyway.

Makes me wonder if the ban eventually grows its own stoplight too.

Zimbabwe Regulator Starts Mandatory Data-Protection Inspections

Zimbabwe just turned data protection from a paperwork exercise into something regulators can actually show up and check on, and I think this is one of those stories that's easy to scroll past but is honestly a bigger deal than it looks.

Starting September 1, POTRAZ began actually inspecting organizations, not just requiring them to fill out compliance forms, under Regulatory Notice 2 of 2026. They're checking whether you've got a data controller license, a Data Protection Officer, real cybersecurity. They're going risk-based: banks, insurers, hospitals, schools, universities, churches, government ministries, mining companies, and NGOs go first, because those are the places holding the most sensitive data on the most people.

Here's the part that surprised me: the threshold for needing a license is processing data for just 50 people. That's basically any small business with a customer list, or any church with a congregation roster. And the penalties aren't symbolic — heavy fines or actual prison time for executives caught processing data without a license.

Which is exactly why this is getting pushback — not from privacy advocates, but from the businesses now on the hook. A legal expert quoted in local coverage called the fee structure "a desperate means of raising money from people" rather than genuine data protection, since certification alone costs over $1,250. I don't think that means the law is wrong to exist. I think it means enforcement design is hard, and doing it well probably means scaling requirements to the size of the organization instead of one flat fee for everyone from a multinational bank to a rural church.

Nigeria's Digital Economy Bill Inches Toward AI Rules, Details Still Vague

This one's been in the pipeline for almost a year and it keeps almost-but-not-quite becoming law, which honestly says a lot about how legislatures actually work versus how the press releases make it sound.

Nigeria's Senate has been pushing the National Digital Economy and E-Governance Bill, sponsored by Senator Afolabi Salisu, who back in November 2025 was telling reporters it would be signed into law before the end of that year. It's now September 2026. The bill has cleared public hearing and is sitting in third reading, waiting on harmonization between the Senate and House before it goes to President Tinubu for assent.

What's actually in it: this would be Nigeria's first real attempt at a comprehensive legal framework covering electronic transactions, mandatory government digitization, and AI — specifically "mandating ethical, risk-based frameworks for AI systems." I'll be honest, that's vague enough that I can't tell you what a company would have to do differently on day one. I couldn't find public reporting that spells out an actual licensing regime the way the EU AI Act does, so take any "licenses for high-risk AI" framing you've seen elsewhere with a grain of salt — what's confirmed is the intent, not yet the mechanics.

What is concrete: Salisu has been consistent that the bigger goal is closing "longstanding gaps" — the legal ambiguity around electronic contracts and the fact that government agencies currently can't talk to each other's databases. I'll keep watching this one since "presidential assent any week now" has been the story since last November.

South Africa's AI Policy, Pulled Over Fake Citations, Still Has No Timeline

This is the story from this batch I keep thinking about, because it's a live demonstration of the exact risk everyone keeps warning about with AI, and it happened inside a government AI policy of all places.

South Africa's Department of Communications published a Draft National AI Policy in the Government Gazette on April 10, 2026, for public comment. It proposed a whole new bureaucracy: a National AI Commission, an AI Ethics Board, an AI Regulatory Authority, an AI Ombudsperson, a National AI Safety Institute, even an AI Insurance Superfund. Ambitious stuff.

Then, sixteen days later, on April 27, it got pulled. Not over political pushback on the substance, but because journalists checked the bibliography and found at least six of the policy's 67 citations were completely fabricated — AI-hallucinated references to academic papers that don't exist. Communications Minister Solly Malatsi withdrew the draft and called it "not a mere technical issue" but something that "compromised the integrity and credibility of the draft policy." One portfolio committee chair reportedly told the department to "skip using ChatGPT this time" on the redraft.

Here's the part that gets me: this is a document about how to regulate AI, apparently drafted with unverified AI assistance, that then failed because of AI hallucinations. And I want to flag something — a version of this story going around says a revised policy is expected at Cabinet by November 2026. I could not verify that timeline anywhere. What I could verify is closer to the opposite: no confirmed timeline for a redraft exists, and one outlet described South Africa's digital economy as being left in "regulatory limbo" because of it.

Vietnam Passes Southeast Asia's First Binding AI Law

While everyone's watching the EU AI Act and wondering when the US will do anything, Vietnam just quietly became the first country in Southeast Asia with an actual binding AI law, and the vote wasn't even close.

On December 10, 2025, Vietnam's National Assembly passed the Law on Artificial Intelligence, 429 votes to 434 — that's 90.7% in favor. Eight chapters, 35 articles, effective March 1, 2026, with a grace period to March 2027 for most AI systems (September 2027 if you're in health, education, or finance, which tracks — those are the sectors where getting it wrong hurts the most).

The structure is a three-tier risk system — high, medium, low — based on impact on rights and safety. High-risk systems get periodic audits and, for some categories, mandatory pre-market certification. Here's the part that surprised me: the law explicitly bans using AI to disable human oversight mechanisms, and separately bans concealing information you're required to disclose about how a system works. Those read like direct responses to real failure modes, not hypothetical ones.

One law firm's analysis pointed out the law "contains many terms and references resembling those under the EU AI Act" but deliberately skips the EU's "unacceptable risk" category. 429 to 434 is not a contested vote — that kind of near-unanimity on a binding AI law is still rare enough globally that I think it's worth sitting with for a second.

Indonesia's Data Law Isn't Fully Active Yet — But the AI Money Already Is

This is the one where I have feelings, because on paper it's a straightforward business story — foreign AI company invests big in Southeast Asia — and I don't think it should get reported that flatly.

Indonesia's data protection law, the PDP Law, has technically been in force since October 2024. And on August 4, 2026, CoreWeave announced it will build three data centers there — its first move into the Asia-Pacific region, adding 360 megawatts of contracted power, expected online in 2028.

Here's the part I want to push back on gently: you'll see the PDP law described as "fully active," and that's not quite right. There's still no functioning Data Protection Authority in the country — the implementing regulation that would define enforcement mechanics is still being finalized. So the actual enforcement backbone that's supposed to protect Indonesians' data from exactly this kind of foreign-infrastructure buildout isn't built yet.

And separately, on the power side, Indonesia's grid is already fragile — two major blackouts hit Sumatra and Java in May 2026, one explicitly blamed on constrained coal supply. I couldn't find reporting that directly ties the CoreWeave announcement to those blackouts, that would be overstating it, but I also can't unsee the pattern: a country whose grid is already stretched thin is about to add 360 megawatts of new, always-on AI demand, and its data protection regulator doesn't exist yet either.

UK's Own Committee Says the Online Safety Act "Is Not Working"

Remember when the UK passed the Online Safety Act and everyone treated it as the enforcement answer to platform accountability? Parliament's own committee just said, basically, not so fast.

The House of Lords Communications and Digital Committee opened a formal inquiry into whether the Act is actually working, with written submissions due September 7, 2026. Committee chair Baroness Keeley didn't hedge: "It is now clear that the act is not working as well as it should." That's not an outside critic — that's the committee that's supposed to be overseeing implementation.

Here's the part that surprised me, from actual oral evidence: Andy Burrows of the Molly Rose Foundation told the committee, "I do not get the impression that the companies are quaking in their boots at Ofcom's enforcement approach." A specific example came up — a sixfold rise in "com groups," networks that facilitate grooming and self-harm content among teenagers, that existing codes of practice never anticipated. There was also a small, almost funny-if-it-weren't-serious detail: people have been getting around age verification using video game avatars.

Baroness Kidron, one of the more prominent voices on child safety online, even acknowledged the Act "does leave certain gaps, and will need some more work." I don't think this means the Online Safety Act was a bad idea. I think it means "we passed a law" and "the harm stopped" are two different milestones, and right now the UK is finding out just how far apart they can be.

Brazil's AI Bill Isn't Heading to a Senate Vote — It's Stuck in the Chamber

I need to correct something here, because the version of this story floating around said Brazil's AI bill was headed for "a final Senate vote on September 16." I went looking for that vote. I can't find it, and what I found instead is a clearer, honestly more interesting story about how this bill has actually been moving.

Brazil's Bill 2338/2023, the Marco Legal da Inteligência Artificial, already passed the Senate on December 10, 2024 — over a year and a half ago. It then moved to the Chamber of Deputies on March 17, 2025, where a special committee took over. As of the most recent reporting I could verify, the bill was still in that committee, with a Chamber vote expected "before the August 2026 recess." I could not confirm a specific September 16 date anywhere, so if you see that circulating, treat it as unverified.

What's actually in the Senate-approved text is worth knowing regardless of the exact vote date: a three-tier risk system, developer disclosure of copyrighted training material, and — this genuinely surprised me — recommendation and content-curation algorithms got explicitly excluded from the high-risk category in the final Senate version. Given how much global debate there's been about recommendation algorithms and radicalization, that's a real choice, not an oversight, and I haven't seen it get nearly as much attention as the AI-generated-content provisions.

So: still not law. Still moving. Just moving through a different chamber, on a different timeline, than the version of this story I started with.

Argentina's Provinces Are Regulating AI Piecemeal — and Tucumán Leads

Argentina still has zero national AI law, and the honest way to describe what's happening is that provinces are just doing it themselves, at different speeds, with different priorities, and the patchwork is more interesting than a single national bill would be.

Buenos Aires province approved Resolución 9/2025, setting rules for how AI systems can be used across the public administration, with a specific focus on making sure automated decisions can't affect fundamental rights without human accountability behind them. It's explicitly modeled on OECD and UNESCO guidance, and came with real infrastructure behind it — a new data center built to keep training data anonymized and stored on state infrastructure rather than sent to some foreign cloud.

Here's where an earlier version of this story turned out to be wrong in an interesting way: Tucumán, not Mendoza, is the strongest confirmed example in the whole country. Tucumán passed a law making AI use mandatory in its provincial education system, and separately passed a full ethics-and-responsible-use law covering AI across all three branches of government, complete with mandatory impact assessments, public algorithm registries, and a built-in requirement to review the whole law every three years. I found no evidence of anything resembling an AI law in Mendoza.

And at the national level, Senator Anabel Fernández has a bill to criminalize non-consensual AI-generated sexual images, building directly on 2023's Ley Olimpia, which first recognized digital sexual violence as a form of gender-based violence under Argentine law.

Australia Built an AI Office. New Zealand's Election Has One Party's AI Policy.

This is a fun one because it's really a story about contrast: Australia just did something big, and New Zealand's political class is having a very public identity crisis about whether to follow.

On July 15, 2026, Australian PM Anthony Albanese announced what his government is calling the first legislated national AI framework in the world, and immediately stood up an Office of AI. It's not just symbolic: companies can't train AI on Australian creative work without consent and compensation, and — this is the part I actually care about — data centers now have to underwrite their own power supply, pay their full grid connection costs, and reduce power draw when the grid needs it to.

New Zealand doesn't have anything like that. Its approach has been deliberately light-touch — no AI-specific legislation, focused on "reducing adoption barriers" rather than building oversight. Two academics are on record saying NZ "continues to fall behind" its trading partners.

And here's the part that actually got me: as of August 2026, with a 2026 election coming, only the Greens have released an AI policy at all — a proposed one-year moratorium on new data centre consents, with co-leader Chloe Swarbrick warning "we are sleepwalking into the biggest industrial revolution at the fastest pace I can think of." Labour, National, ACT, and NZ First have been vague, silent, or still "coming soon." So you've got Australia legislating a full framework in one announcement, and next door, an entire election cycle where AI policy might come down to one minor party's data-centre moratorium.